Ignore:
Timestamp:
May 23, 2008, 6:56:41 AM (17 years ago)
Author:
Paul Smedley
Message:

Update source to 3.0.29

File:
1 edited

Legend:

Unmodified
Added
Removed

  • branches/samba-3.0/docs/manpages/smb.conf.5

    r44 r134  
    1 .\"Generated by db2man.xsl. Don't modify this, modify the source.
    2 .de Sh \" Subsection
    3 .br
    4 .if t .Sp
    5 .ne 5
    6 .PP
    7 \fB\\$1\fR
    8 .PP
    9 ..
    10 .de Sp \" Vertical space (when we can't use .PP)
    11 .if t .sp .5v
    12 .if n .sp
    13 ..
    14 .de Ip \" List item
    15 .br
    16 .ie \\n(.$>=3 .ne \\$3
    17 .el .ne 3
    18 .IP "\\$1" \\$2
    19 ..
    20 .TH "SMB.CONF" 5 "" "" ""
     1.\"     Title: smb.conf
     2.\"    Author:
     3.\" Generator: DocBook XSL Stylesheets v1.73.2 <http://docbook.sf.net/>
     4.\"      Date: 05/21/2008
     5.\"    Manual: File Formats and Conventions
     6.\"    Source: Samba 3.0
     7.\"
     8.TH "SMB\.CONF" "5" "05/21/2008" "Samba 3\.0" "File Formats and Conventions"
     9.\" disable hyphenation
     10.nh
     11.\" disable justification (adjust text to left margin only)
     12.ad l
    2113.SH "NAME"
    2214smb.conf - The configuration file for the Samba suite
    … …  
    2416.PP
    2517The
    26 \fIsmb.conf\fR
    27 file is a configuration file for the Samba suite.
    28 \fIsmb.conf\fR
    29 contains runtime configuration information for the Samba programs. The
    30 \fIsmb.conf\fR
     18\fIsmb\.conf\fR
     19file is a configuration file for the Samba suite\.
     20\fIsmb\.conf\fR
     21contains runtime configuration information for the Samba programs\. The
     22\fIsmb\.conf\fR
    3123file is designed to be configured and administered by the
    3224\fBswat\fR(8)
    33 program. The complete description of the file format and possible parameters held within are here for reference purposes.
     25program\. The complete description of the file format and possible parameters held within are here for reference purposes\.
    3426.SH "FILE FORMAT"
    3527.PP
    36 The file consists of sections and parameters. A section begins with the name of the section in square brackets and continues until the next section begins. Sections contain parameters of the form:
    37 
    38 .sp
    39 
     28The file consists of sections and parameters\. A section begins with the name of the section in square brackets and continues until the next section begins\. Sections contain parameters of the form:
     29.sp
     30.RS 4
    4031.nf
    41 
    4232\fIname\fR = \fIvalue \fR
    43 
    4433.fi
    45 
    46 .PP
    47 The file is line-based - that is, each newline-terminated line represents either a comment, a section name or a parameter.
    48 .PP
    49 Section and parameter names are not case sensitive.
    50 .PP
    51 Only the first equals sign in a parameter is significant. Whitespace before or after the first equals sign is discarded. Leading, trailing and internal whitespace in section and parameter names is irrelevant. Leading and trailing whitespace in a parameter value is discarded. Internal whitespace within a parameter value is retained verbatim.
    52 .PP
    53 Any line beginning with a semicolon (\fB;\fR) or a hash (\fB#\fR) character is ignored, as are lines containing only whitespace.
     34.RE
     35.PP
     36The file is line\-based \- that is, each newline\-terminated line represents either a comment, a section name or a parameter\.
     37.PP
     38Section and parameter names are not case sensitive\.
     39.PP
     40Only the first equals sign in a parameter is significant\. Whitespace before or after the first equals sign is discarded\. Leading, trailing and internal whitespace in section and parameter names is irrelevant\. Leading and trailing whitespace in a parameter value is discarded\. Internal whitespace within a parameter value is retained verbatim\.
     41.PP
     42Any line beginning with a semicolon (\(lq;\(rq) or a hash (\(lq#\(rq) character is ignored, as are lines containing only whitespace\.
    5443.PP
    5544Any line ending in a
    56 \fB\\\fR
    57 is continued on the next line in the customary UNIX fashion.
    58 .PP
    59 The values following the equals sign in parameters are all either a string (no quotes needed) or a boolean, which may be given as yes/no, 0/1 or true/false. Case is not significant in boolean values, but is preserved in string values. Some items such as create masks are numeric.
     45\(lq\e\(rq
     46is continued on the next line in the customary UNIX fashion\.
     47.PP
     48The values following the equals sign in parameters are all either a string (no quotes needed) or a boolean, which may be given as yes/no, 0/1 or true/false\. Case is not significant in boolean values, but is preserved in string values\. Some items such as create masks are numeric\.
    6049.SH "SECTION DESCRIPTIONS"
    6150.PP
    6251Each section in the configuration file (except for the [global] section) describes a shared resource (known as a
    63 \fBshare\fR). The section name is the name of the shared resource and the parameters within the section define the shares attributes.
     52\(lqshare\(rq)\. The section name is the name of the shared resource and the parameters within the section define the shares attributes\.
    6453.PP
    6554There are three special sections, [global], [homes] and [printers], which are described under
    66 \fBspecial sections\fR. The following notes apply to ordinary section descriptions.
    67 .PP
    68 A share consists of a directory to which access is being given plus a description of the access rights which are granted to the user of the service. Some housekeeping options are also specifiable.
    69 .PP
    70 Sections are either file share services (used by the client as an extension of their native file systems) or printable services (used by the client to access print services on the host running the server).
     55\fIspecial sections\fR\. The following notes apply to ordinary section descriptions\.
     56.PP
     57A share consists of a directory to which access is being given plus a description of the access rights which are granted to the user of the service\. Some housekeeping options are also specifiable\.
     58.PP
     59Sections are either file share services (used by the client as an extension of their native file systems) or printable services (used by the client to access print services on the host running the server)\.
    7160.PP
    7261Sections may be designated
    73 \fBguest\fR
    74 services, in which case no password is required to access them. A specified UNIX
    75 \fBguest account\fR
    76 is used to define access privileges in this case.
    77 .PP
    78 Sections other than guest services will require a password to access them. The client provides the username. As older clients only provide passwords and not usernames, you may specify a list of usernames to check against the password using the
     62\fIguest\fR
     63services, in which case no password is required to access them\. A specified UNIX
     64\fIguest account\fR
     65is used to define access privileges in this case\.
     66.PP
     67Sections other than guest services will require a password to access them\. The client provides the username\. As older clients only provide passwords and not usernames, you may specify a list of usernames to check against the password using the
    7968user =
    80 option in the share definition. For modern clients such as Windows 95/98/ME/NT/2000, this should not be necessary.
    81 .PP
    82 The access rights granted by the server are masked by the access rights granted to the specified or guest UNIX user by the host system. The server does not grant more access than the host system grants.
    83 .PP
    84 The following sample section defines a file space share. The user has write access to the path
    85 \fI/home/bar\fR. The share is accessed via the share name
     69option in the share definition\. For modern clients such as Windows 95/98/ME/NT/2000, this should not be necessary\.
     70.PP
     71The access rights granted by the server are masked by the access rights granted to the specified or guest UNIX user by the host system\. The server does not grant more access than the host system grants\.
     72.PP
     73The following sample section defines a file space share\. The user has write access to the path
     74\fI/home/bar\fR\. The share is accessed via the share name
    8675foo:
    87 
    88 .sp
    89 
     76.sp
     77.RS 4
    9078.nf
    91 
    9279        \fI[foo]\fR
    93         path = /home/bar
    94         read only = no
    95 
     80        \fIpath = /home/bar\fR
     81        \fIread only = no\fR
    9682.fi
    97 
    98 .PP
    99 The following sample section defines a printable share. The share is read-only, but printable. That is, the only write access permitted is via calls to open, write to and close a spool file. The
    100 \fBguest ok\fR
     83.RE
     84.PP
     85The following sample section defines a printable share\. The share is read\-only, but printable\. That is, the only write access permitted is via calls to open, write to and close a spool file\. The
     86\fIguest ok\fR
    10187parameter means access will be permitted as the default guest user (specified elsewhere):
    102 
    103 .sp
    104 
     88.sp
     89.RS 4
    10590.nf
    106 
    10791        \fI[aprinter]\fR
    108         path = /usr/spool/public
    109         read only = yes
    110         printable = yes
    111         guest ok = yes
    112 
     92        \fIpath = /usr/spool/public\fR
     93        \fIread only = yes\fR
     94        \fIprintable = yes\fR
     95        \fIguest ok = yes\fR
    11396.fi
    114 
     97.RE
     98.sp
    11599.SH "SPECIAL SECTIONS"
    116100.SS "The [global] section"
    117101.PP
    118 Parameters in this section apply to the server as a whole, or are defaults for sections that do not specifically define certain items. See the notes under PARAMETERS for more information.
     102Parameters in this section apply to the server as a whole, or are defaults for sections that do not specifically define certain items\. See the notes under PARAMETERS for more information\.
    119103.SS "The [homes] section"
    120104.PP
    121 If a section called [homes] is included in the configuration file, services connecting clients to their home directories can be created on the fly by the server.
    122 .PP
    123 When the connection request is made, the existing sections are scanned. If a match is found, it is used. If no match is found, the requested section name is treated as a username and looked up in the local password file. If the name exists and the correct password has been given, a share is created by cloning the [homes] section.
     105If a section called [homes] is included in the configuration file, services connecting clients to their home directories can be created on the fly by the server\.
     106.PP
     107When the connection request is made, the existing sections are scanned\. If a match is found, it is used\. If no match is found, the requested section name is treated as a username and looked up in the local password file\. If the name exists and the correct password has been given, a share is created by cloning the [homes] section\.
    124108.PP
    125109Some modifications are then made to the newly created share:
    126 .TP 3n
    127 \(bu
    128 The share name is changed from homes to the located username.
    129 .TP 3n
    130 \(bu
    131 If no path was given, the path is set to the user's home directory.
     110.sp
     111.RS 4
     112.ie n \{\
     113\h'-04'\(bu\h'+03'\c
     114.\}
     115.el \{\
     116.sp -1
     117.IP \(bu 2.3
     118.\}
     119The share name is changed from homes to the located username\.
     120.RE
     121.sp
     122.RS 4
     123.ie n \{\
     124\h'-04'\(bu\h'+03'\c
     125.\}
     126.el \{\
     127.sp -1
     128.IP \(bu 2.3
     129.\}
     130If no path was given, the path is set to the user\'s home directory\.
     131.sp
     132.RE
    132133.PP
    133134If you decide to use a
    134 \fBpath =\fR
    135 line in your [homes] section, it may be useful to use the %S macro. For example:
    136 
    137 .sp
    138 
     135\fIpath =\fR
     136line in your [homes] section, it may be useful to use the %S macro\. For example:
     137.sp
     138.RS 4
    139139.nf
    140 
    141140\fBpath = /data/pchome/%S\fR
    142 
    143141.fi
    144 is useful if you have different home directories for your PCs than for UNIX access.
    145 .PP
    146 This is a fast and simple way to give a large number of clients access to their home directories with a minimum of fuss.
     142.RE
     143.sp
     144is useful if you have different home directories for your PCs than for UNIX access\.
     145.PP
     146This is a fast and simple way to give a large number of clients access to their home directories with a minimum of fuss\.
    147147.PP
    148148A similar process occurs if the requested section name is
    149 \fBhomes\fR, except that the share name is not changed to that of the requesting user. This method of using the [homes] section works well if different users share a client PC.
    150 .PP
    151 The [homes] section can specify all the parameters a normal service section can specify, though some make more sense than others. The following is a typical and suitable [homes] section:
    152 
    153 .sp
    154 
     149\(lqhomes\(rq, except that the share name is not changed to that of the requesting user\. This method of using the [homes] section works well if different users share a client PC\.
     150.PP
     151The [homes] section can specify all the parameters a normal service section can specify, though some make more sense than others\. The following is a typical and suitable [homes] section:
     152.sp
     153.RS 4
    155154.nf
    156 
    157155\fI[homes]\fR
    158 read only = no
    159 
     156\fIread only = no\fR
    160157.fi
    161 
     158.RE
    162159.PP
    163160An important point is that if guest access is specified in the [homes] section, all home directories will be visible to all clients
    164 \fBwithout a password\fR. In the very unlikely event that this is actually desirable, it is wise to also specify
    165 \fBread only access\fR.
     161\fIwithout a password\fR\. In the very unlikely event that this is actually desirable, it is wise to also specify
     162\fIread only access\fR\.
    166163.PP
    167164The
    168 \fBbrowseable\fR
    169 flag for auto home directories will be inherited from the global browseable flag, not the [homes] browseable flag. This is useful as it means setting
    170 \fBbrowseable = no\fR
    171 in the [homes] section will hide the [homes] share but make any auto home directories visible.
     165\fIbrowseable\fR
     166flag for auto home directories will be inherited from the global browseable flag, not the [homes] browseable flag\. This is useful as it means setting
     167\fIbrowseable = no\fR
     168in the [homes] section will hide the [homes] share but make any auto home directories visible\.
    172169.SS "The [printers] section"
    173170.PP
    174 This section works like [homes], but for printers.
    175 .PP
    176 If a [printers] section occurs in the configuration file, users are able to connect to any printer specified in the local host's printcap file.
    177 .PP
    178 When a connection request is made, the existing sections are scanned. If a match is found, it is used. If no match is found, but a [homes] section exists, it is used as described above. Otherwise, the requested section name is treated as a printer name and the appropriate printcap file is scanned to see if the requested section name is a valid printer share name. If a match is found, a new printer share is created by cloning the [printers] section.
     171This section works like [homes], but for printers\.
     172.PP
     173If a [printers] section occurs in the configuration file, users are able to connect to any printer specified in the local host\'s printcap file\.
     174.PP
     175When a connection request is made, the existing sections are scanned\. If a match is found, it is used\. If no match is found, but a [homes] section exists, it is used as described above\. Otherwise, the requested section name is treated as a printer name and the appropriate printcap file is scanned to see if the requested section name is a valid printer share name\. If a match is found, a new printer share is created by cloning the [printers] section\.
    179176.PP
    180177A few modifications are then made to the newly created share:
    181 .TP 3n
    182 \(bu
     178.sp
     179.RS 4
     180.ie n \{\
     181\h'-04'\(bu\h'+03'\c
     182.\}
     183.el \{\
     184.sp -1
     185.IP \(bu 2.3
     186.\}
    183187The share name is set to the located printer name
    184 .TP 3n
    185 \(bu
     188.RE
     189.sp
     190.RS 4
     191.ie n \{\
     192\h'-04'\(bu\h'+03'\c
     193.\}
     194.el \{\
     195.sp -1
     196.IP \(bu 2.3
     197.\}
    186198If no printer name was given, the printer name is set to the located printer name
    187 .TP 3n
    188 \(bu
    189 If the share does not permit guest access and no username was given, the username is set to the located printer name.
    190 .PP
    191 The [printers] service MUST be printable - if you specify otherwise, the server will refuse to load the configuration file.
    192 .PP
    193 Typically the path specified is that of a world-writeable spool directory with the sticky bit set on it. A typical [printers] entry looks like this:
    194 
    195 .sp
    196 
     199.RE
     200.sp
     201.RS 4
     202.ie n \{\
     203\h'-04'\(bu\h'+03'\c
     204.\}
     205.el \{\
     206.sp -1
     207.IP \(bu 2.3
     208.\}
     209If the share does not permit guest access and no username was given, the username is set to the located printer name\.
     210.sp
     211.RE
     212.PP
     213The [printers] service MUST be printable \- if you specify otherwise, the server will refuse to load the configuration file\.
     214.PP
     215Typically the path specified is that of a world\-writeable spool directory with the sticky bit set on it\. A typical [printers] entry looks like this:
     216.sp
     217.RS 4
    197218.nf
    198 
    199219\fI[printers]\fR
    200 path = /usr/spool/public
    201 guest ok = yes
    202 printable = yes
    203 
     220\fIpath = /usr/spool/public\fR
     221\fIguest ok = yes\fR
     222\fIprintable = yes\fR
    204223.fi
    205 
    206 .PP
    207 All aliases given for a printer in the printcap file are legitimate printer names as far as the server is concerned. If your printing subsystem doesn't work like that, you will have to set up a pseudo-printcap. This is a file consisting of one or more lines like this:
    208 
    209 .sp
    210 
     224.RE
     225.PP
     226All aliases given for a printer in the printcap file are legitimate printer names as far as the server is concerned\. If your printing subsystem doesn\'t work like that, you will have to set up a pseudo\-printcap\. This is a file consisting of one or more lines like this:
     227.sp
     228.RS 4
    211229.nf
    212 
    213 alias|alias|alias|alias...   
    214 
     230alias|alias|alias|alias\.\.\.   
    215231.fi
    216 
    217 .PP
    218 Each alias should be an acceptable printer name for your printing subsystem. In the [global] section, specify the new file as your printcap. The server will only recognize names found in your pseudo-printcap, which of course can contain whatever aliases you like. The same technique could be used simply to limit access to a subset of your local printers.
    219 .PP
    220 An alias, by the way, is defined as any component of the first entry of a printcap record. Records are separated by newlines, components (if there are more than one) are separated by vertical bar symbols (|).
     232.RE
     233.PP
     234Each alias should be an acceptable printer name for your printing subsystem\. In the [global] section, specify the new file as your printcap\. The server will only recognize names found in your pseudo\-printcap, which of course can contain whatever aliases you like\. The same technique could be used simply to limit access to a subset of your local printers\.
     235.PP
     236An alias, by the way, is defined as any component of the first entry of a printcap record\. Records are separated by newlines, components (if there are more than one) are separated by vertical bar symbols (|)\.
    221237.sp
    222238.it 1 an-trap
    … …  
    224240.nr an-break-flag 1
    225241.br
    226 \fBNote\fR
     242Note
    227243.PP
    228244On SYSV systems which use lpstat to determine what printers are defined on the system you may be able to use
    229245printcap name = lpstat
    230 to automatically obtain a list of printers. See the
     246to automatically obtain a list of printers\. See the
    231247printcap name
    232 option for more details.
     248option for more details\.
    233249.SH "USERSHARES"
    234250.PP
    235 Starting with Samba version 3.0.23 the capability for non-root users to add, modify, and delete their own share definitions has been added. This capability is called
    236 \fBusershares\fR
    237 and is controlled by a set of parameters in the [global] section of the smb.conf. The relevant parameters are :
     251Starting with Samba version 3\.0\.23 the capability for non\-root users to add, modify, and delete their own share definitions has been added\. This capability is called
     252\fIusershares\fR
     253and is controlled by a set of parameters in the [global] section of the smb\.conf\. The relevant parameters are :
    238254.PP
    239255usershare allow guests
    240 .RS 3n
    241 Controls if usershares can permit guest access.
     256.RS 4
     257Controls if usershares can permit guest access\.
    242258.RE
    243259.PP
    244260usershare max shares
    245 .RS 3n
    246 Maximum number of user defined shares allowed.
     261.RS 4
     262Maximum number of user defined shares allowed\.
    247263.RE
    248264.PP
    249265usershare owner only
    250 .RS 3n
    251 If set only directories owned by the sharing user can be shared.
     266.RS 4
     267If set only directories owned by the sharing user can be shared\.
    252268.RE
    253269.PP
    254270usershare path
    255 .RS 3n
    256 Points to the directory containing the user defined share definitions. The filesystem permissions on this directory control who can create user defined shares.
     271.RS 4
     272Points to the directory containing the user defined share definitions\. The filesystem permissions on this directory control who can create user defined shares\.
    257273.RE
    258274.PP
    259275usershare prefix allow list
    260 .RS 3n
    261 Comma-separated list of absolute pathnames restricting what directories can be shared. Only directories below the pathnames in this list are permitted.
     276.RS 4
     277Comma\-separated list of absolute pathnames restricting what directories can be shared\. Only directories below the pathnames in this list are permitted\.
    262278.RE
    263279.PP
    264280usershare prefix deny list
    265 .RS 3n
    266 Comma-separated list of absolute pathnames restricting what directories can be shared. Directories below the pathnames in this list are prohibited.
     281.RS 4
     282Comma\-separated list of absolute pathnames restricting what directories can be shared\. Directories below the pathnames in this list are prohibited\.
    267283.RE
    268284.PP
    269285usershare template share
    270 .RS 3n
    271 Names a pre-existing share used as a template for creating new usershares. All other share parameters not specified in the user defined share definition are copied from this named share.
     286.RS 4
     287Names a pre\-existing share used as a template for creating new usershares\. All other share parameters not specified in the user defined share definition are copied from this named share\.
    272288.RE
    273289.PP
    … …  
    277293.PP
    278294Become root:
    279 
     295.sp
     296.RS 4
    280297.nf
    281 
    282298mkdir /usr/local/samba/lib/usershares
    283299chgrp foo /usr/local/samba/lib/usershares
    284300chmod 1770 /usr/local/samba/lib/usershares
    285 
    286301.fi
     302.RE
    287303.PP
    288304Then add the parameters
    289 
    290 .sp
    291 
     305.sp
     306.RS 4
    292307.nf
    293 
    294         usershare path = /usr/local/samba/lib/usershares
    295         usershare max shares = 10 # (or the desired number of shares)
    296 
     308        \fIusershare path = /usr/local/samba/lib/usershares\fR
     309        \fIusershare max shares = 10\fR # (or the desired number of shares)
    297310.fi
     311.RE
     312.sp
    298313to the global section of your
    299 \fIsmb.conf\fR. Members of the group foo may then manipulate the user defined shares using the following commands.
     314\fIsmb\.conf\fR\. Members of the group foo may then manipulate the user defined shares using the following commands\.
    300315.PP
    301316net usershare add sharename path [comment] [acl] [guest_ok=[y|n]]
    302 .RS 3n
    303 To create or modify (overwrite) a user defined share.
     317.RS 4
     318To create or modify (overwrite) a user defined share\.
    304319.RE
    305320.PP
    306321net usershare delete sharename
    307 .RS 3n
    308 To delete a user defined share.
    309 .RE
    310 .PP
    311 net usershare list wildcard-sharename
    312 .RS 3n
    313 To list user defined shares.
    314 .RE
    315 .PP
    316 net usershare info wildcard-sharename
    317 .RS 3n
    318 To print information about user defined shares.
     322.RS 4
     323To delete a user defined share\.
     324.RE
     325.PP
     326net usershare list wildcard\-sharename
     327.RS 4
     328To list user defined shares\.
     329.RE
     330.PP
     331net usershare info wildcard\-sharename
     332.RS 4
     333To print information about user defined shares\.
    319334.RE
    320335.SH "PARAMETERS"
    321336.PP
    322 Parameters define the specific attributes of sections.
    323 .PP
    324 Some parameters are specific to the [global] section (e.g.,
    325 \fBsecurity\fR). Some parameters are usable in all sections (e.g.,
    326 \fBcreate mask\fR). All others are permissible only in normal sections. For the purposes of the following descriptions the [homes] and [printers] sections will be considered normal. The letter
    327 \fBG\fR
    328 in parentheses indicates that a parameter is specific to the [global] section. The letter
    329 \fBS\fR
    330 indicates that a parameter can be specified in a service specific section. All
    331 \fBS\fR
    332 parameters can also be specified in the [global] section - in which case they will define the default behavior for all services.
    333 .PP
    334 Parameters are arranged here in alphabetical order - this may not create best bedfellows, but at least you can find them! Where there are synonyms, the preferred synonym is described, others refer to the preferred synonym.
     337Parameters define the specific attributes of sections\.
     338.PP
     339Some parameters are specific to the [global] section (e\.g\.,
     340\fIsecurity\fR)\. Some parameters are usable in all sections (e\.g\.,
     341\fIcreate mask\fR)\. All others are permissible only in normal sections\. For the purposes of the following descriptions the [homes] and [printers] sections will be considered normal\. The letter
     342\fIG\fR
     343in parentheses indicates that a parameter is specific to the [global] section\. The letter
     344\fIS\fR
     345indicates that a parameter can be specified in a service specific section\. All
     346\fIS\fR
     347parameters can also be specified in the [global] section \- in which case they will define the default behavior for all services\.
     348.PP
     349Parameters are arranged here in alphabetical order \- this may not create best bedfellows, but at least you can find them! Where there are synonyms, the preferred synonym is described, others refer to the preferred synonym\.
    335350.SH "VARIABLE SUBSTITUTIONS"
    336351.PP
    337 Many of the strings that are settable in the config file can take substitutions. For example the option
    338 \fBpath = /tmp/%u\fR
     352Many of the strings that are settable in the config file can take substitutions\. For example the option
     353\(lqpath = /tmp/%u\(rq
    339354is interpreted as
    340 \fBpath = /tmp/john\fR
    341 if the user connected with the username john.
    342 .PP
    343 These substitutions are mostly noted in the descriptions below, but there are some general substitutions which apply whenever they might be relevant. These are:
     355\(lqpath = /tmp/john\(rq
     356if the user connected with the username john\.
     357.PP
     358These substitutions are mostly noted in the descriptions below, but there are some general substitutions which apply whenever they might be relevant\. These are:
    344359.PP
    345360%U
    346 .RS 3n
    347 session username (the username that the client wanted, not necessarily the same as the one they got).
     361.RS 4
     362session username (the username that the client wanted, not necessarily the same as the one they got)\.
    348363.RE
    349364.PP
    350365%G
    351 .RS 3n
    352 primary group name of %U.
     366.RS 4
     367primary group name of %U\.
    353368.RE
    354369.PP
    355370%h
    356 .RS 3n
    357 the Internet hostname that Samba is running on.
     371.RS 4
     372the Internet hostname that Samba is running on\.
    358373.RE
    359374.PP
    360375%m
    361 .RS 3n
    362 the NetBIOS name of the client machine (very useful).
    363 .sp
    364 This parameter is not available when Samba listens on port 445, as clients no longer send this information. If you use this macro in an include statement on a domain that has a Samba domain controller be sure to set in the [global] section
    365 \fIsmb ports = 139\fR. This will cause Samba to not listen on port 445 and will permit include functionality to function as it did with Samba 2.x.
     376.RS 4
     377the NetBIOS name of the client machine (very useful)\.
     378.sp
     379This parameter is not available when Samba listens on port 445, as clients no longer send this information\. If you use this macro in an include statement on a domain that has a Samba domain controller be sure to set in the [global] section
     380\fIsmb ports = 139\fR\. This will cause Samba to not listen on port 445 and will permit include functionality to function as it did with Samba 2\.x\.
    366381.RE
    367382.PP
    368383%L
    369 .RS 3n
    370 the NetBIOS name of the server. This allows you to change your config based on what the client calls you. Your server can have a
    371 \fBdual personality\fR.
     384.RS 4
     385the NetBIOS name of the server\. This allows you to change your config based on what the client calls you\. Your server can have a
     386\(lqdual personality\(rq\.
    372387.RE
    373388.PP
    374389%M
    375 .RS 3n
    376 the Internet name of the client machine.
     390.RS 4
     391the Internet name of the client machine\.
    377392.RE
    378393.PP
    379394%R
    380 .RS 3n
    381 the selected protocol level after protocol negotiation. It can be one of CORE, COREPLUS, LANMAN1, LANMAN2 or NT1.
     395.RS 4
     396the selected protocol level after protocol negotiation\. It can be one of CORE, COREPLUS, LANMAN1, LANMAN2 or NT1\.
    382397.RE
    383398.PP
    384399%d
    385 .RS 3n
    386 the process id of the current server process.
     400.RS 4
     401the process id of the current server process\.
    387402.RE
    388403.PP
    389404%a
    390 .RS 3n
    391 the architecture of the remote machine. It currently recognizes Samba (\fBSamba\fR), the Linux CIFS file system (\fBCIFSFS\fR), OS/2, (\fBOS2\fR), Windows for Workgroups (\fBWfWg\fR), Windows 9x/ME (\fBWin95\fR), Windows NT (\fBWinNT\fR), Windows 2000 (\fBWin2K\fR), Windows XP (\fBWinXP\fR), and Windows 2003 (\fBWin2K3\fR). Anything else will be known as
    392 \fBUNKNOWN\fR.
     405.RS 4
     406The architecture of the remote machine\. It currently recognizes Samba (\fBSamba\fR), the Linux CIFS file system (\fBCIFSFS\fR), OS/2, (\fBOS2\fR), Windows for Workgroups (\fBWfWg\fR), Windows 9x/ME (\fBWin95\fR), Windows NT (\fBWinNT\fR), Windows 2000 (\fBWin2K\fR), Windows XP (\fBWinXP\fR), Windows XP 64\-bit(\fBWinXP64\fR), Windows 2003 including 2003R2 (\fBWin2K3\fR), and Windows Vista (\fBVista\fR)\. Anything else will be known as
     407\fBUNKNOWN\fR\.
    393408.RE
    394409.PP
    395410%I
    396 .RS 3n
    397 the IP address of the client machine.
     411.RS 4
     412the IP address of the client machine\.
    398413.RE
    399414.PP
    400415%i
    401 .RS 3n
    402 the local IP address to which a client connected.
     416.RS 4
     417the local IP address to which a client connected\.
    403418.RE
    404419.PP
    405420%T
    406 .RS 3n
    407 the current date and time.
     421.RS 4
     422the current date and time\.
    408423.RE
    409424.PP
    410425%D
    411 .RS 3n
    412 name of the domain or workgroup of the current user.
     426.RS 4
     427name of the domain or workgroup of the current user\.
    413428.RE
    414429.PP
    415430%w
    416 .RS 3n
    417 the winbind separator.
     431.RS 4
     432the winbind separator\.
    418433.RE
    419434.PP
    420435%$(\fIenvvar\fR)
    421 .RS 3n
     436.RS 4
    422437the value of the environment variable
    423 \fIenvar\fR.
     438\fIenvar\fR\.
    424439.RE
    425440.PP
    … …  
    427442.PP
    428443%S
    429 .RS 3n
    430 the name of the current service, if any.
     444.RS 4
     445the name of the current service, if any\.
    431446.RE
    432447.PP
    433448%P
    434 .RS 3n
    435 the root directory of the current service, if any.
     449.RS 4
     450the root directory of the current service, if any\.
    436451.RE
    437452.PP
    438453%u
    439 .RS 3n
    440 username of the current service, if any.
     454.RS 4
     455username of the current service, if any\.
    441456.RE
    442457.PP
    443458%g
    444 .RS 3n
    445 primary group name of %u.
     459.RS 4
     460primary group name of %u\.
    446461.RE
    447462.PP
    448463%H
    449 .RS 3n
    450 the home directory of the user given by %u.
     464.RS 4
     465the home directory of the user given by %u\.
    451466.RE
    452467.PP
    453468%N
    454 .RS 3n
    455 the name of your NIS home directory server. This is obtained from your NIS auto.map entry. If you have not compiled Samba with the
    456 \fB--with-automount\fR
    457 option, this value will be the same as %L.
     469.RS 4
     470the name of your NIS home directory server\. This is obtained from your NIS auto\.map entry\. If you have not compiled Samba with the
     471\fI\-\-with\-automount\fR
     472option, this value will be the same as %L\.
    458473.RE
    459474.PP
    460475%p
    461 .RS 3n
    462 the path of the service's home directory, obtained from your NIS auto.map entry. The NIS auto.map entry is split up as
    463 %N:%p.
     476.RS 4
     477the path of the service\'s home directory, obtained from your NIS auto\.map entry\. The NIS auto\.map entry is split up as
     478%N:%p\.
    464479.RE
    465480.PP
    466481There are some quite creative things that can be done with these substitutions and other
    467 \fIsmb.conf\fR
    468 options.
     482\fIsmb\.conf\fR
     483options\.
    469484.SH "NAME MANGLING"
    470485.PP
    471486Samba supports
    472487name mangling
    473 so that DOS and Windows clients can use files that don't conform to the 8.3 format. It can also be set to adjust the case of 8.3 format filenames.
    474 .PP
    475 There are several options that control the way mangling is performed, and they are grouped here rather than listed separately. For the defaults look at the output of the testparm program.
    476 .PP
    477 These options can be set separately for each service.
     488so that DOS and Windows clients can use files that don\'t conform to the 8\.3 format\. It can also be set to adjust the case of 8\.3 format filenames\.
     489.PP
     490There are several options that control the way mangling is performed, and they are grouped here rather than listed separately\. For the defaults look at the output of the testparm program\.
     491.PP
     492These options can be set separately for each service\.
    478493.PP
    479494The options are:
    480495.PP
    481496case sensitive = yes/no/auto
    482 .RS 3n
    483 controls whether filenames are case sensitive. If they aren't, Samba must do a filename search and match on passed names. The default setting of auto allows clients that support case sensitive filenames (Linux CIFSVFS and smbclient 3.0.5 and above currently) to tell the Samba server on a per-packet basis that they wish to access the file system in a case-sensitive manner (to support UNIX case sensitive semantics). No Windows or DOS system supports case-sensitive filename so setting this option to auto is that same as setting it to no for them. Default
    484 \fBauto\fR.
     497.RS 4
     498controls whether filenames are case sensitive\. If they aren\'t, Samba must do a filename search and match on passed names\. The default setting of auto allows clients that support case sensitive filenames (Linux CIFSVFS and smbclient 3\.0\.5 and above currently) to tell the Samba server on a per\-packet basis that they wish to access the file system in a case\-sensitive manner (to support UNIX case sensitive semantics)\. No Windows or DOS system supports case\-sensitive filename so setting this option to auto is that same as setting it to no for them\. Default
     499\fIauto\fR\.
    485500.RE
    486501.PP
    487502default case = upper/lower
    488 .RS 3n
    489 controls what the default case is for new filenames (ie. files that don't currently exist in the filesystem). Default
    490 \fBlower\fR. IMPORTANT NOTE: This option will be used to modify the case of
    491 \fBall\fR
     503.RS 4
     504controls what the default case is for new filenames (ie\. files that don\'t currently exist in the filesystem)\. Default
     505\fIlower\fR\. IMPORTANT NOTE: This option will be used to modify the case of
     506\fIall\fR
    492507incoming client filenames, not just new filenames if the options
    493 case sensitive = yes,
    494 preserve case = No,
    495 short preserve case = No are set. This change is needed as part of the optimisations for directories containing large numbers of files.
     508\fIcase sensitive = yes\fR,
     509\fIpreserve case = No\fR,
     510\fIshort preserve case = No\fR
     511are set\. This change is needed as part of the optimisations for directories containing large numbers of files\.
    496512.RE
    497513.PP
    498514preserve case = yes/no
    499 .RS 3n
    500 controls whether new files (ie. files that don't currently exist in the filesystem) are created with the case that the client passes, or if they are forced to be the
     515.RS 4
     516controls whether new files (ie\. files that don\'t currently exist in the filesystem) are created with the case that the client passes, or if they are forced to be the
    501517default
    502 case. Default
    503 \fByes\fR.
     518case\. Default
     519\fIyes\fR\.
    504520.RE
    505521.PP
    506522short preserve case = yes/no
    507 .RS 3n
    508 controls if new files (ie. files that don't currently exist in the filesystem) which conform to 8.3 syntax, that is all in upper case and of suitable length, are created upper case, or if they are forced to be the
     523.RS 4
     524controls if new files (ie\. files that don\'t currently exist in the filesystem) which conform to 8\.3 syntax, that is all in upper case and of suitable length, are created upper case, or if they are forced to be the
    509525default
    510 case. This option can be used with
     526case\. This option can be used with
    511527preserve case = yes
    512 to permit long filenames to retain their case, while short names are lowercased. Default
    513 \fByes\fR.
    514 .RE
    515 .PP
    516 By default, Samba 3.0 has the same semantics as a Windows NT server, in that it is case insensitive but case preserving. As a special case for directories with large numbers of files, if the case options are set as follows, "case sensitive = yes", "case preserve = no", "short preserve case = no" then the "default case" option will be applied and will modify all filenames sent from the client when accessing this share.
     528to permit long filenames to retain their case, while short names are lowercased\. Default
     529\fIyes\fR\.
     530.RE
     531.PP
     532By default, Samba 3\.0 has the same semantics as a Windows NT server, in that it is case insensitive but case preserving\. As a special case for directories with large numbers of files, if the case options are set as follows, "case sensitive = yes", "case preserve = no", "short preserve case = no" then the "default case" option will be applied and will modify all filenames sent from the client when accessing this share\.
    517533.SH "NOTE ABOUT USERNAME/PASSWORD VALIDATION"
    518534.PP
    519 There are a number of ways in which a user can connect to a service. The server uses the following steps in determining if it will allow a connection to a specified service. If all the steps fail, the connection request is rejected. However, if one of the steps succeeds, the following steps are not checked.
     535There are a number of ways in which a user can connect to a service\. The server uses the following steps in determining if it will allow a connection to a specified service\. If all the steps fail, the connection request is rejected\. However, if one of the steps succeeds, the following steps are not checked\.
    520536.PP
    521537If the service is marked
    522 \fBguest only = yes\fR
    523 and the server is running with share-level security (\fBsecurity = share\fR, steps 1 to 5 are skipped.
    524 .TP 3n
    525 1.
    526 If the client has passed a username/password pair and that username/password pair is validated by the UNIX system's password programs, the connection is made as that username. This includes the
    527 \\\\server\\service%\fIusername\fR
    528 method of passing a username.
    529 .TP 3n
    530 2.
    531 If the client has previously registered a username with the system and now supplies a correct password for that username, the connection is allowed.
    532 .TP 3n
    533 3.
    534 The client's NetBIOS name and any previously used usernames are checked against the supplied password. If they match, the connection is allowed as the corresponding user.
    535 .TP 3n
    536 4.
    537 If the client has previously validated a username/password pair with the server and the client has passed the validation token, that username is used.
    538 .TP 3n
    539 5.
    540 If a
     538\(lqguest only = yes\(rq
     539and the server is running with share\-level security (\(lqsecurity = share\(rq, steps 1 to 5 are skipped\.
     540.sp
     541.RS 4
     542\h'-04' 1.\h'+02'If the client has passed a username/password pair and that username/password pair is validated by the UNIX system\'s password programs, the connection is made as that username\. This includes the
     543\e\eserver\eservice%\fIusername\fR
     544method of passing a username\.
     545.RE
     546.sp
     547.RS 4
     548\h'-04' 2.\h'+02'If the client has previously registered a username with the system and now supplies a correct password for that username, the connection is allowed\.
     549.RE
     550.sp
     551.RS 4
     552\h'-04' 3.\h'+02'The client\'s NetBIOS name and any previously used usernames are checked against the supplied password\. If they match, the connection is allowed as the corresponding user\.
     553.RE
     554.sp
     555.RS 4
     556\h'-04' 4.\h'+02'If the client has previously validated a username/password pair with the server and the client has passed the validation token, that username is used\.
     557.RE
     558.sp
     559.RS 4
     560\h'-04' 5.\h'+02'If a
    541561user =
    542562field is given in the
    543 \fIsmb.conf\fR
    544 file for the service and the client has supplied a password, and that password matches (according to the UNIX system's password checking) with one of the usernames from the
     563\fIsmb\.conf\fR
     564file for the service and the client has supplied a password, and that password matches (according to the UNIX system\'s password checking) with one of the usernames from the
    545565user =
    546566field, the connection is made as the username in the
    547567user =
    548 line. If one of the usernames in the
     568line\. If one of the usernames in the
    549569user =
    550570list begins with a
    551 @, that name expands to a list of names in the group of the same name.
    552 .TP 3n
    553 6.
    554 If the service is a guest service, a connection is made as the username given in the
     571@, that name expands to a list of names in the group of the same name\.
     572.RE
     573.sp
     574.RS 4
     575\h'-04' 6.\h'+02'If the service is a guest service, a connection is made as the username given in the
    555576guest account =
    556 for the service, irrespective of the supplied password.
     577for the service, irrespective of the supplied password\.
     578.RE
    557579.SH "EXPLANATION OF EACH PARAMETER"
    558 .PP
     580
     581
    559582abort shutdown script (G)
    560 .RS 3n
     583.PP
     584.RS 4
    561585This a full path name to a script called by
    562586\fBsmbd\fR(8)
    563587that should stop a shutdown procedure issued by the
    564 shutdown script.
     588\fIshutdown script\fR\.
    565589.sp
    566590If the connected user posseses the
    567 \fBSeRemoteShutdownPrivilege\fR, right, this command will be run as user.
    568 .sp
    569 Default:
    570 \fB\fIabort shutdown script\fR = "" \fR
    571 .sp
    572 Example:
    573 \fB\fIabort shutdown script\fR = /sbin/shutdown -c \fR
    574 .RE
    575 .PP
     591\fBSeRemoteShutdownPrivilege\fR, right, this command will be run as user\.
     592.sp
     593Default:
     594\fI\fIabort shutdown script\fR\fR\fI = \fR\fI""\fR\fI \fR
     595.sp
     596Example:
     597\fI\fIabort shutdown script\fR\fR\fI = \fR\fI/sbin/shutdown \-c\fR\fI \fR
     598.RE
     599
    576600acl check permissions (S)
    577 .RS 3n
     601.PP
     602.RS 4
    578603This boolean parameter controls what
    579 \fBsmbd\fR(8)does on receiving a protocol request of "open for delete" from a Windows client. If a Windows client doesn't have permissions to delete a file then they expect this to be denied at open time. POSIX systems normally only detect restrictions on delete by actually attempting to delete the file or directory. As Windows clients can (and do) "back out" a delete request by unsetting the "delete on close" bit Samba cannot delete the file immediately on "open for delete" request as we cannot restore such a deleted file. With this parameter set to true (the default) then smbd checks the file system permissions directly on "open for delete" and denies the request without actually deleting the file if the file system permissions would seem to deny it. This is not perfect, as it's possible a user could have deleted a file without Samba being able to check the permissions correctly, but it is close enough to Windows semantics for mostly correct behaviour. Samba will correctly check POSIX ACL semantics in this case.
    580 .sp
    581 If this parameter is set to "false" Samba doesn't check permissions on "open for delete" and allows the open. If the user doesn't have permission to delete the file this will only be discovered at close time, which is too late for the Windows user tools to display an error message to the user. The symptom of this is files that appear to have been deleted "magically" re-appearing on a Windows explorer refersh. This is an extremely advanced protocol option which should not need to be changed. This parameter was introduced in its final form in 3.0.21, an earlier version with slightly different semantics was introduced in 3.0.20. That older version is not documented here.
    582 .sp
    583 Default:
    584 \fB\fIacl check permissions\fR = True \fR
    585 .RE
    586 .PP
     604\fBsmbd\fR(8)does on receiving a protocol request of "open for delete" from a Windows client\. If a Windows client doesn\'t have permissions to delete a file then they expect this to be denied at open time\. POSIX systems normally only detect restrictions on delete by actually attempting to delete the file or directory\. As Windows clients can (and do) "back out" a delete request by unsetting the "delete on close" bit Samba cannot delete the file immediately on "open for delete" request as we cannot restore such a deleted file\. With this parameter set to true (the default) then smbd checks the file system permissions directly on "open for delete" and denies the request without actually deleting the file if the file system permissions would seem to deny it\. This is not perfect, as it\'s possible a user could have deleted a file without Samba being able to check the permissions correctly, but it is close enough to Windows semantics for mostly correct behaviour\. Samba will correctly check POSIX ACL semantics in this case\.
     605.sp
     606If this parameter is set to "false" Samba doesn\'t check permissions on "open for delete" and allows the open\. If the user doesn\'t have permission to delete the file this will only be discovered at close time, which is too late for the Windows user tools to display an error message to the user\. The symptom of this is files that appear to have been deleted "magically" re\-appearing on a Windows explorer refersh\. This is an extremely advanced protocol option which should not need to be changed\. This parameter was introduced in its final form in 3\.0\.21, an earlier version with slightly different semantics was introduced in 3\.0\.20\. That older version is not documented here\.
     607.sp
     608Default:
     609\fI\fIacl check permissions\fR\fR\fI = \fR\fITrue\fR\fI \fR
     610.RE
     611
    587612acl compatibility (S)
    588 .RS 3n
    589 This parameter specifies what OS ACL semantics should be compatible with. Possible values are
    590 \fBwinnt\fR
     613.PP
     614.RS 4
     615This parameter specifies what OS ACL semantics should be compatible with\. Possible values are
     616\fIwinnt\fR
    591617for Windows NT 4,
    592 \fBwin2k\fR
     618\fIwin2k\fR
    593619for Windows 2000 and above and
    594 \fBauto\fR. If you specify
    595 \fBauto\fR, the value for this parameter will be based upon the version of the client. There should be no reason to change this parameter from the default.
    596 .sp
    597 Default:
    598 \fB\fIacl compatibility\fR = Auto \fR
    599 .sp
    600 Example:
    601 \fB\fIacl compatibility\fR = win2k \fR
    602 .RE
    603 .PP
     620\fIauto\fR\. If you specify
     621\fIauto\fR, the value for this parameter will be based upon the version of the client\. There should be no reason to change this parameter from the default\.
     622.sp
     623Default:
     624\fI\fIacl compatibility\fR\fR\fI = \fR\fIAuto\fR\fI \fR
     625.sp
     626Example:
     627\fI\fIacl compatibility\fR\fR\fI = \fR\fIwin2k\fR\fI \fR
     628.RE
     629
    604630acl group control (S)
    605 .RS 3n
    606 In a POSIX filesystem, only the owner of a file or directory and the superuser can modify the permissions and ACLs on a file. If this parameter is set, then Samba overrides this restriction, and also allows the
    607 \fBprimary group owner\fR
    608 of a file or directory to modify the permissions and ACLs on that file.
    609 .sp
    610 On a Windows server, groups may be the owner of a file or directory - thus allowing anyone in that group to modify the permissions on it. This allows the delegation of security controls on a point in the filesystem to the group owner of a directory and anything below it also owned by that group. This means there are multiple people with permissions to modify ACLs on a file or directory, easing managability.
    611 .sp
    612 This parameter allows Samba to also permit delegation of the control over a point in the exported directory hierarchy in much the same was as Windows. This allows all members of a UNIX group to control the permissions on a file or directory they have group ownership on.
     631.PP
     632.RS 4
     633In a POSIX filesystem, only the owner of a file or directory and the superuser can modify the permissions and ACLs on a file\. If this parameter is set, then Samba overrides this restriction, and also allows the
     634\fIprimary group owner\fR
     635of a file or directory to modify the permissions and ACLs on that file\.
     636.sp
     637On a Windows server, groups may be the owner of a file or directory \- thus allowing anyone in that group to modify the permissions on it\. This allows the delegation of security controls on a point in the filesystem to the group owner of a directory and anything below it also owned by that group\. This means there are multiple people with permissions to modify ACLs on a file or directory, easing managability\.
     638.sp
     639This parameter allows Samba to also permit delegation of the control over a point in the exported directory hierarchy in much the same way as Windows\. This allows all members of a UNIX group to control the permissions on a file or directory they have group ownership on\.
    613640.sp
    614641This parameter is best used with the
    615 inherit owner option and also on on a share containing directories with the UNIX
    616 \fBsetgid bit\fR
    617 bit set on them, which causes new files and directories created within it to inherit the group ownership from the containing directory.
    618 .sp
    619 This is parameter has been marked deprecated in Samba 3.0.23. The same behavior is now implemented by the
     642\fIinherit owner\fR
     643option and also on on a share containing directories with the UNIX
     644\fIsetgid bit\fR
     645set on them, which causes new files and directories created within it to inherit the group ownership from the containing directory\.
     646.sp
     647This is parameter has been marked deprecated in Samba 3\.0\.23\. The same behavior is now implemented by the
    620648\fIdos filemode\fR
    621 option.
    622 .sp
    623 Default:
    624 \fB\fIacl group control\fR = no \fR
    625 .RE
    626 .PP
     649option\.
     650.sp
     651Default:
     652\fI\fIacl group control\fR\fR\fI = \fR\fIno\fR\fI \fR
     653.RE
     654
    627655acl map full control (S)
    628 .RS 3n
     656.PP
     657.RS 4
    629658This boolean parameter controls whether
    630 \fBsmbd\fR(8)maps a POSIX ACE entry of "rwx" (read/write/execute), the maximum allowed POSIX permission set, into a Windows ACL of "FULL CONTROL". If this parameter is set to true any POSIX ACE entry of "rwx" will be returned in a Windows ACL as "FULL CONTROL", is this parameter is set to false any POSIX ACE entry of "rwx" will be returned as the specific Windows ACL bits representing read, write and execute.
    631 .sp
    632 Default:
    633 \fB\fIacl map full control\fR = True \fR
    634 .RE
    635 .PP
     659\fBsmbd\fR(8)maps a POSIX ACE entry of "rwx" (read/write/execute), the maximum allowed POSIX permission set, into a Windows ACL of "FULL CONTROL"\. If this parameter is set to true any POSIX ACE entry of "rwx" will be returned in a Windows ACL as "FULL CONTROL", is this parameter is set to false any POSIX ACE entry of "rwx" will be returned as the specific Windows ACL bits representing read, write and execute\.
     660.sp
     661Default:
     662\fI\fIacl map full control\fR\fR\fI = \fR\fITrue\fR\fI \fR
     663.RE
     664
    636665add group script (G)
    637 .RS 3n
     666.PP
     667.RS 4
    638668This is the full pathname to a script that will be run
    639 \fBAS ROOT\fR
     669\fIAS ROOT\fR
    640670by
    641671\fBsmbd\fR(8)
    642 when a new group is requested. It will expand any
     672when a new group is requested\. It will expand any
    643673\fI%g\fR
    644 to the group name passed. This script is only useful for installations using the Windows NT domain administration tools. The script is free to create a group with an arbitrary name to circumvent unix group name restrictions. In that case the script must print the numeric gid of the created group on stdout.
    645 .sp
    646 Default:
    647 \fB\fIadd group script\fR = \fR
    648 .sp
    649 Example:
    650 \fB\fIadd group script\fR = /usr/sbin/groupadd %g \fR
    651 .RE
    652 .PP
     674to the group name passed\. This script is only useful for installations using the Windows NT domain administration tools\. The script is free to create a group with an arbitrary name to circumvent unix group name restrictions\. In that case the script must print the numeric gid of the created group on stdout\.
     675.sp
     676Default:
     677\fI\fIadd group script\fR\fR\fI = \fR\fI\fR\fI \fR
     678.sp
     679Example:
     680\fI\fIadd group script\fR\fR\fI = \fR\fI/usr/sbin/groupadd %g\fR\fI \fR
     681.RE
     682
    653683add machine script (G)
    654 .RS 3n
     684.PP
     685.RS 4
    655686This is the full pathname to a script that will be run by
    656687\fBsmbd\fR(8)
    657 when a machine is added to Samba's domain and a Unix account matching the machine's name appended with a "$" does not already exist.
     688when a machine is added to Samba\'s domain and a Unix account matching the machine\'s name appended with a "$" does not already exist\.
    658689.sp
    659690This option is very similar to the
    660 add user script, and likewise uses the %u substitution for the account name. Do not use the %m substitution.
    661 .sp
    662 Default:
    663 \fB\fIadd machine script\fR = \fR
    664 .sp
    665 Example:
    666 \fB\fIadd machine script\fR = /usr/sbin/adduser -n -g machines -c Machine -d /var/lib/nobody -s /bin/false %u \fR
    667 .RE
    668 .PP
     691\fIadd user script\fR, and likewise uses the %u substitution for the account name\. Do not use the %m substitution\.
     692.sp
     693Default:
     694\fI\fIadd machine script\fR\fR\fI = \fR\fI\fR\fI \fR
     695.sp
     696Example:
     697\fI\fIadd machine script\fR\fR\fI = \fR\fI/usr/sbin/adduser \-n \-g machines \-c Machine \-d /var/lib/nobody \-s /bin/false %u\fR\fI \fR
     698.RE
     699
    669700add port command (G)
    670 .RS 3n
    671 Samba 3.0.23 introduces support for adding printer ports remotely using the Windows "Add Standard TCP/IP Port Wizard". This option defines an external program to be executed when smbd receives a request to add a new Port to the system. he script is passed two parameters:
    672 .RS 3n
    673 .TP 3n
    674 \(bu
     701.PP
     702.RS 4
     703Samba 3\.0\.23 introduced support for adding printer ports remotely using the Windows "Add Standard TCP/IP Port Wizard"\. This option defines an external program to be executed when smbd receives a request to add a new Port to the system\. The script is passed two parameters:
     704.sp
     705.RS 4
     706.ie n \{\
     707\h'-04'\(bu\h'+03'\c
     708.\}
     709.el \{\
     710.sp -1
     711.IP \(bu 2.3
     712.\}
    675713\fIport name\fR
    676 .TP 3n
    677 \(bu
     714.RE
     715.sp
     716.RS 4
     717.ie n \{\
     718\h'-04'\(bu\h'+03'\c
     719.\}
     720.el \{\
     721.sp -1
     722.IP \(bu 2.3
     723.\}
    678724\fIdevice URI\fR
    679 .RE
    680 .IP "" 3n
    681 The deviceURI is in the for of socket://<hostname>[:<portnumber>] or lpd://<hostname>/<queuename>.
    682 .sp
    683 Default:
    684 \fB\fIadd port command\fR = \fR
    685 .sp
    686 Example:
    687 \fB\fIadd port command\fR = /etc/samba/scripts/addport.sh \fR
    688 .RE
    689 .PP
     725.sp
     726.RE
     727The deviceURI is in the for of socket://<hostname>[:<portnumber>] or lpd://<hostname>/<queuename>\.
     728.sp
     729Default:
     730\fI\fIadd port command\fR\fR\fI = \fR\fI\fR\fI \fR
     731.sp
     732Example:
     733\fI\fIadd port command\fR\fR\fI = \fR\fI/etc/samba/scripts/addport\.sh\fR\fI \fR
     734.RE
     735
    690736add printer command (G)
    691 .RS 3n
    692 With the introduction of MS-RPC based printing support for Windows NT/2000 clients in Samba 2.2, The MS Add Printer Wizard (APW) icon is now also available in the "Printers..." folder displayed a share listing. The APW allows for printers to be add remotely to a Samba or Windows NT/2000 print server.
    693 .sp
    694 For a Samba host this means that the printer must be physically added to the underlying printing system. The
     737.PP
     738.RS 4
     739With the introduction of MS\-RPC based printing support for Windows NT/2000 clients in Samba 2\.2, The MS Add Printer Wizard (APW) icon is now also available in the "Printers\.\.\." folder displayed a share listing\. The APW allows for printers to be add remotely to a Samba or Windows NT/2000 print server\.
     740.sp
     741For a Samba host this means that the printer must be physically added to the underlying printing system\. The
    695742\fIadd printer command\fR
    696743defines a script to be run which will perform the necessary operations for adding the printer to the print system and to add the appropriate service definition to the
    697 \fIsmb.conf\fR
     744\fIsmb\.conf\fR
    698745file in order that it can be shared by
    699 \fBsmbd\fR(8).
     746\fBsmbd\fR(8)\.
    700747.sp
    701748The
    702749\fIaddprinter command\fR
    703750is automatically invoked with the following parameter (in order):
    704 .RS 3n
    705 .TP 3n
    706 \(bu
     751.sp
     752.RS 4
     753.ie n \{\
     754\h'-04'\(bu\h'+03'\c
     755.\}
     756.el \{\
     757.sp -1
     758.IP \(bu 2.3
     759.\}
    707760\fIprinter name\fR
    708 .TP 3n
    709 \(bu
     761.RE
     762.sp
     763.RS 4
     764.ie n \{\
     765\h'-04'\(bu\h'+03'\c
     766.\}
     767.el \{\
     768.sp -1
     769.IP \(bu 2.3
     770.\}
    710771\fIshare name\fR
    711 .TP 3n
    712 \(bu
     772.RE
     773.sp
     774.RS 4
     775.ie n \{\
     776\h'-04'\(bu\h'+03'\c
     777.\}
     778.el \{\
     779.sp -1
     780.IP \(bu 2.3
     781.\}
    713782\fIport name\fR
    714 .TP 3n
    715 \(bu
     783.RE
     784.sp
     785.RS 4
     786.ie n \{\
     787\h'-04'\(bu\h'+03'\c
     788.\}
     789.el \{\
     790.sp -1
     791.IP \(bu 2.3
     792.\}
    716793\fIdriver name\fR
    717 .TP 3n
    718 \(bu
     794.RE
     795.sp
     796.RS 4
     797.ie n \{\
     798\h'-04'\(bu\h'+03'\c
     799.\}
     800.el \{\
     801.sp -1
     802.IP \(bu 2.3
     803.\}
    719804\fIlocation\fR
    720 .TP 3n
    721 \(bu
     805.RE
     806.sp
     807.RS 4
     808.ie n \{\
     809\h'-04'\(bu\h'+03'\c
     810.\}
     811.el \{\
     812.sp -1
     813.IP \(bu 2.3
     814.\}
    722815\fIWindows 9x driver location\fR
    723 .RE
    724 .IP "" 3n
    725 All parameters are filled in from the PRINTER_INFO_2 structure sent by the Windows NT/2000 client with one exception. The "Windows 9x driver location" parameter is included for backwards compatibility only. The remaining fields in the structure are generated from answers to the APW questions.
     816.sp
     817.RE
     818All parameters are filled in from the PRINTER_INFO_2 structure sent by the Windows NT/2000 client with one exception\. The "Windows 9x driver location" parameter is included for backwards compatibility only\. The remaining fields in the structure are generated from answers to the APW questions\.
    726819.sp
    727820Once the
    … …  
    730823smbd
    731824will reparse the
    732 \fI smb.conf\fR
    733 to determine if the share defined by the APW exists. If the sharename is still invalid, then
     825\fI smb\.conf\fR
     826to determine if the share defined by the APW exists\. If the sharename is still invalid, then
    734827smbd
    735 will return an ACCESS_DENIED error to the client.
    736 .sp
    737 The "add printer command" program can output a single line of text, which Samba will set as the port the new printer is connected to. If this line isn't output, Samba won't reload its printer shares.
    738 .sp
    739 Default:
    740 \fB\fIadd printer command\fR = \fR
    741 .sp
    742 Example:
    743 \fB\fIadd printer command\fR = /usr/bin/addprinter \fR
    744 .RE
    745 .PP
     828will return an ACCESS_DENIED error to the client\.
     829.sp
     830The "add printer command" program can output a single line of text, which Samba will set as the port the new printer is connected to\. If this line isn\'t output, Samba won\'t reload its printer shares\.
     831.sp
     832Default:
     833\fI\fIadd printer command\fR\fR\fI = \fR\fI\fR\fI \fR
     834.sp
     835Example:
     836\fI\fIadd printer command\fR\fR\fI = \fR\fI/usr/bin/addprinter\fR\fI \fR
     837.RE
     838
    746839add share command (G)
    747 .RS 3n
    748 Samba 2.2.0 introduced the ability to dynamically add and delete shares via the Windows NT 4.0 Server Manager. The
     840.PP
     841.RS 4
     842Samba 2\.2\.0 introduced the ability to dynamically add and delete shares via the Windows NT 4\.0 Server Manager\. The
    749843\fIadd share command\fR
    750844is used to define an external program or script which will add a new service definition to
    751 \fIsmb.conf\fR. In order to successfully execute the
     845\fIsmb\.conf\fR\. In order to successfully execute the
    752846\fIadd share command\fR,
    753847smbd
    754 requires that the administrator be connected using a root account (i.e. uid == 0).
     848requires that the administrator be connected using a root account (i\.e\. uid == 0)\.
     849.sp
     850If the connected account has
     851SeDiskOperatorPrivilege, scripts defined in
     852\fIchange share\fR
     853parameter are executed as root\.
    755854.sp
    756855When executed,
    … …  
    758857will automatically invoke the
    759858\fIadd share command\fR
    760 with five parameters.
    761 .RS 3n
    762 .TP 3n
    763 \(bu
     859with five parameters\.
     860.sp
     861.RS 4
     862.ie n \{\
     863\h'-04'\(bu\h'+03'\c
     864.\}
     865.el \{\
     866.sp -1
     867.IP \(bu 2.3
     868.\}
    764869\fIconfigFile\fR
    765 - the location of the global
    766 \fIsmb.conf\fR
    767 file.
    768 .TP 3n
    769 \(bu
     870\- the location of the global
     871\fIsmb\.conf\fR
     872file\.
     873.RE
     874.sp
     875.RS 4
     876.ie n \{\
     877\h'-04'\(bu\h'+03'\c
     878.\}
     879.el \{\
     880.sp -1
     881.IP \(bu 2.3
     882.\}
    770883\fIshareName\fR
    771 - the name of the new share.
    772 .TP 3n
    773 \(bu
     884\- the name of the new share\.
     885.RE
     886.sp
     887.RS 4
     888.ie n \{\
     889\h'-04'\(bu\h'+03'\c
     890.\}
     891.el \{\
     892.sp -1
     893.IP \(bu 2.3
     894.\}
    774895\fIpathName\fR
    775 - path to an **existing** directory on disk.
    776 .TP 3n
    777 \(bu
     896\- path to an **existing** directory on disk\.
     897.RE
     898.sp
     899.RS 4
     900.ie n \{\
     901\h'-04'\(bu\h'+03'\c
     902.\}
     903.el \{\
     904.sp -1
     905.IP \(bu 2.3
     906.\}
    778907\fIcomment\fR
    779 - comment string to associate with the new share.
    780 .TP 3n
    781 \(bu
     908\- comment string to associate with the new share\.
     909.RE
     910.sp
     911.RS 4
     912.ie n \{\
     913\h'-04'\(bu\h'+03'\c
     914.\}
     915.el \{\
     916.sp -1
     917.IP \(bu 2.3
     918.\}
    782919\fImax connections\fR
    783 Number of maximum simultaneous connections to this share.
    784 .RE
    785 .IP "" 3n
    786 This parameter is only used for add file shares. To add printer shares, see the
    787 addprinter command.
    788 .sp
    789 Default:
    790 \fB\fIadd share command\fR = \fR
    791 .sp
    792 Example:
    793 \fB\fIadd share command\fR = /usr/local/bin/addshare \fR
    794 .RE
    795 .PP
     920Number of maximum simultaneous connections to this share\.
     921.sp
     922.RE
     923This parameter is only used for add file shares\. To add printer shares, see the
     924\fIaddprinter command\fR\.
     925.sp
     926Default:
     927\fI\fIadd share command\fR\fR\fI = \fR\fI\fR\fI \fR
     928.sp
     929Example:
     930\fI\fIadd share command\fR\fR\fI = \fR\fI/usr/local/bin/addshare\fR\fI \fR
     931.RE
     932
    796933add user script (G)
    797 .RS 3n
     934.PP
     935.RS 4
    798936This is the full pathname to a script that will be run
    799 \fBAS ROOT\fR
     937\fIAS ROOT\fR
    800938by
    801939\fBsmbd\fR(8)
    802 under special circumstances described below.
    803 .sp
    804 Normally, a Samba server requires that UNIX users are created for all users accessing files on this server. For sites that use Windows NT account databases as their primary user database creating these users and keeping the user list in sync with the Windows NT PDC is an onerous task. This option allows smbd to create the required UNIX users
    805 \fBON DEMAND\fR
    806 when a user accesses the Samba server.
     940under special circumstances described below\.
     941.sp
     942Normally, a Samba server requires that UNIX users are created for all users accessing files on this server\. For sites that use Windows NT account databases as their primary user database creating these users and keeping the user list in sync with the Windows NT PDC is an onerous task\. This option allows smbd to create the required UNIX users
     943\fION DEMAND\fR
     944when a user accesses the Samba server\.
    807945.sp
    808946In order to use this option,
    809947\fBsmbd\fR(8)
    810948must
    811 \fBNOT\fR
     949\fINOT\fR
    812950be set to
    813 security = share and
    814 add user script must be set to a full pathname for a script that will create a UNIX user given one argument of
    815 \fI%u\fR, which expands into the UNIX user name to create.
     951\fIsecurity = share\fR
     952and
     953\fIadd user script\fR
     954must be set to a full pathname for a script that will create a UNIX user given one argument of
     955\fI%u\fR, which expands into the UNIX user name to create\.
    816956.sp
    817957When the Windows user attempts to access the Samba server, at login (session setup in the SMB protocol) time,
    818958\fBsmbd\fR(8)
    819959contacts the
    820 password server and attempts to authenticate the given user with the given password. If the authentication succeeds then
     960\fIpassword server\fR
     961and attempts to authenticate the given user with the given password\. If the authentication succeeds then
    821962smbd
    822 attempts to find a UNIX user in the UNIX password database to map the Windows user into. If this lookup fails, and
    823 add user script is set then
     963attempts to find a UNIX user in the UNIX password database to map the Windows user into\. If this lookup fails, and
     964\fIadd user script\fR
     965is set then
    824966smbd
    825967will call the specified script
    826 \fBAS ROOT\fR, expanding any
     968\fIAS ROOT\fR, expanding any
    827969\fI%u\fR
    828 argument to be the user name to create.
     970argument to be the user name to create\.
    829971.sp
    830972If this script successfully creates the user then
    831973smbd
    832 will continue on as though the UNIX user already existed. In this way, UNIX users are dynamically created to match existing Windows NT accounts.
     974will continue on as though the UNIX user already existed\. In this way, UNIX users are dynamically created to match existing Windows NT accounts\.
    833975.sp
    834976See also
    835 security,
    836 password server,
    837 delete user script.
    838 .sp
    839 Default:
    840 \fB\fIadd user script\fR = \fR
    841 .sp
    842 Example:
    843 \fB\fIadd user script\fR = /usr/local/samba/bin/add_user %u \fR
    844 .RE
    845 .PP
     977\fIsecurity\fR,
     978\fIpassword server\fR,
     979\fIdelete user script\fR\.
     980.sp
     981Default:
     982\fI\fIadd user script\fR\fR\fI = \fR\fI\fR\fI \fR
     983.sp
     984Example:
     985\fI\fIadd user script\fR\fR\fI = \fR\fI/usr/local/samba/bin/add_user %u\fR\fI \fR
     986.RE
     987
    846988add user to group script (G)
    847 .RS 3n
    848 Full path to the script that will be called when a user is added to a group using the Windows NT domain administration tools. It will be run by
     989.PP
     990.RS 4
     991Full path to the script that will be called when a user is added to a group using the Windows NT domain administration tools\. It will be run by
    849992\fBsmbd\fR(8)
    850 \fBAS ROOT\fR. Any
     993\fIAS ROOT\fR\. Any
    851994\fI%g\fR
    852995will be replaced with the group name and any
    853996\fI%u\fR
    854 will be replaced with the user name.
     997will be replaced with the user name\.
    855998.sp
    856999Note that the
    8571000adduser
    858 command used in the example below does not support the used syntax on all systems.
    859 .sp
    860 Default:
    861 \fB\fIadd user to group script\fR = \fR
    862 .sp
    863 Example:
    864 \fB\fIadd user to group script\fR = /usr/sbin/adduser %u %g \fR
    865 .RE
    866 .PP
     1001command used in the example below does not support the used syntax on all systems\.
     1002.sp
     1003Default:
     1004\fI\fIadd user to group script\fR\fR\fI = \fR\fI\fR\fI \fR
     1005.sp
     1006Example:
     1007\fI\fIadd user to group script\fR\fR\fI = \fR\fI/usr/sbin/adduser %u %g\fR\fI \fR
     1008.RE
     1009
    8671010admin users (S)
    868 .RS 3n
    869 This is a list of users who will be granted administrative privileges on the share. This means that they will do all file operations as the super-user (root).
    870 .sp
    871 You should use this option very carefully, as any user in this list will be able to do anything they like on the share, irrespective of file permissions.
     1011.PP
     1012.RS 4
     1013This is a list of users who will be granted administrative privileges on the share\. This means that they will do all file operations as the super\-user (root)\.
     1014.sp
     1015You should use this option very carefully, as any user in this list will be able to do anything they like on the share, irrespective of file permissions\.
    8721016.sp
    8731017This parameter will not work with the
    874 security = share in Samba 3.0. This is by design.
    875 .sp
    876 Default:
    877 \fB\fIadmin users\fR = \fR
    878 .sp
    879 Example:
    880 \fB\fIadmin users\fR = jason \fR
    881 .RE
    882 .PP
     1018\fIsecurity = share\fR
     1019in Samba 3\.0\. This is by design\.
     1020.sp
     1021Default:
     1022\fI\fIadmin users\fR\fR\fI = \fR\fI\fR\fI \fR
     1023.sp
     1024Example:
     1025\fI\fIadmin users\fR\fR\fI = \fR\fIjason\fR\fI \fR
     1026.RE
     1027
    8831028afs share (S)
    884 .RS 3n
    885 This parameter controls whether special AFS features are enabled for this share. If enabled, it assumes that the directory exported via the
     1029.PP
     1030.RS 4
     1031This parameter controls whether special AFS features are enabled for this share\. If enabled, it assumes that the directory exported via the
    8861032\fIpath\fR
    887 parameter is a local AFS import. The special AFS features include the attempt to hand-craft an AFS token if you enabled --with-fake-kaserver in configure.
    888 .sp
    889 Default:
    890 \fB\fIafs share\fR = no \fR
    891 .RE
    892 .PP
     1033parameter is a local AFS import\. The special AFS features include the attempt to hand\-craft an AFS token if you enabled \-\-with\-fake\-kaserver in configure\.
     1034.sp
     1035Default:
     1036\fI\fIafs share\fR\fR\fI = \fR\fIno\fR\fI \fR
     1037.RE
     1038
    8931039afs username map (G)
    894 .RS 3n
    895 If you are using the fake kaserver AFS feature, you might want to hand-craft the usernames you are creating tokens for. For example this is necessary if you have users from several domain in your AFS Protection Database. One possible scheme to code users as DOMAIN+User as it is done by winbind with the + as a separator.
    896 .sp
    897 The mapped user name must contain the cell name to log into, so without setting this parameter there will be no token.
    898 .sp
    899 Default:
    900 \fB\fIafs username map\fR = \fR
    901 .sp
    902 Example:
    903 \fB\fIafs username map\fR = %u@afs.samba.org \fR
    904 .RE
    905 .PP
     1040.PP
     1041.RS 4
     1042If you are using the fake kaserver AFS feature, you might want to hand\-craft the usernames you are creating tokens for\. For example this is necessary if you have users from several domain in your AFS Protection Database\. One possible scheme to code users as DOMAIN+User as it is done by winbind with the + as a separator\.
     1043.sp
     1044The mapped user name must contain the cell name to log into, so without setting this parameter there will be no token\.
     1045.sp
     1046Default:
     1047\fI\fIafs username map\fR\fR\fI = \fR\fI\fR\fI \fR
     1048.sp
     1049Example:
     1050\fI\fIafs username map\fR\fR\fI = \fR\fI%u@afs\.samba\.org\fR\fI \fR
     1051.RE
     1052
    9061053aio read size (S)
    907 .RS 3n
    908 If Samba has been built with asynchronous I/O support and this integer parameter is set to non-zero value, Samba will read from file asynchronously when size of request is bigger than this value. Note that it happens only for non-chained and non-chaining reads and when not using write cache.
    909 .sp
    910 Current implementation of asynchronous I/O in Samba 3.0 does support only up to 10 outstanding asynchronous requests, read and write combined.
    911 .sp
    912 
    913 
    914   write cache size
    915   aio write size
    916 
    917 Default:
    918 \fB\fIaio read size\fR = 0 \fR
    919 .sp
    920 Example:
    921 \fB\fIaio read size\fR = 16384 # Use asynchronous I/O for reads bigger than 16KB request size \fR
    922 .RE
    923 .PP
     1054.PP
     1055.RS 4
     1056If Samba has been built with asynchronous I/O support and this integer parameter is set to non\-zero value, Samba will read from file asynchronously when size of request is bigger than this value\. Note that it happens only for non\-chained and non\-chaining reads and when not using write cache\.
     1057.sp
     1058Current implementation of asynchronous I/O in Samba 3\.0 does support only up to 10 outstanding asynchronous requests, read and write combined\.
     1059.sp
     1060Related command:
     1061\fIwrite cache size\fR
     1062.sp
     1063Related command:
     1064\fIaio write size\fR
     1065.sp
     1066Default:
     1067\fI\fIaio read size\fR\fR\fI = \fR\fI0\fR\fI \fR
     1068.sp
     1069Example:
     1070\fI\fIaio read size\fR\fR\fI = \fR\fI16384 # Use asynchronous I/O for reads bigger than 16KB request size\fR\fI \fR
     1071.RE
     1072
    9241073aio write size (S)
    925 .RS 3n
    926 If Samba has been built with asynchronous I/O support and this integer parameter is set to non-zero value, Samba will write to file asynchronously when size of request is bigger than this value. Note that it happens only for non-chained and non-chaining reads and when not using write cache.
    927 .sp
    928 Current implementation of asynchronous I/O in Samba 3.0 does support only up to 10 outstanding asynchronous requests, read and write combined.
    929 .sp
    930 
    931  
    932   write cache size
    933   aio read size
    934 
    935 Default:
    936 \fB\fIaio write size\fR = 0 \fR
    937 .sp
    938 Example:
    939 \fB\fIaio write size\fR = 16384 # Use asynchronous I/O for writes bigger than 16KB request size \fR
    940 .RE
    941 .PP
     1074.PP
     1075.RS 4
     1076If Samba has been built with asynchronous I/O support and this integer parameter is set to non\-zero value, Samba will write to file asynchronously when size of request is bigger than this value\. Note that it happens only for non\-chained and non\-chaining reads and when not using write cache\.
     1077.sp
     1078Current implementation of asynchronous I/O in Samba 3\.0 does support only up to 10 outstanding asynchronous requests, read and write combined\.
     1079.sp
     1080Related command:
     1081\fIwrite cache size\fR
     1082.sp
     1083Related command:
     1084\fIaio read size\fR
     1085.sp
     1086Default:
     1087\fI\fIaio write size\fR\fR\fI = \fR\fI0\fR\fI \fR
     1088.sp
     1089Example:
     1090\fI\fIaio write size\fR\fR\fI = \fR\fI16384 # Use asynchronous I/O for writes bigger than 16KB request size\fR\fI \fR
     1091.RE
     1092
    9421093algorithmic rid base (G)
    943 .RS 3n
    944 This determines how Samba will use its algorithmic mapping from uids/gid to the RIDs needed to construct NT Security Identifiers.
    945 .sp
    946 Setting this option to a larger value could be useful to sites transitioning from WinNT and Win2k, as existing user and group rids would otherwise clash with sytem users etc.
    947 .sp
    948 All UIDs and GIDs must be able to be resolved into SIDs for the correct operation of ACLs on the server. As such the algorithmic mapping can't be 'turned off', but pushing it 'out of the way' should resolve the issues. Users and groups can then be assigned 'low' RIDs in arbitary-rid supporting backends.
    949 .sp
    950 Default:
    951 \fB\fIalgorithmic rid base\fR = 1000 \fR
    952 .sp
    953 Example:
    954 \fB\fIalgorithmic rid base\fR = 100000 \fR
    955 .RE
    956 .PP
     1094.PP
     1095.RS 4
     1096This determines how Samba will use its algorithmic mapping from uids/gid to the RIDs needed to construct NT Security Identifiers\.
     1097.sp
     1098Setting this option to a larger value could be useful to sites transitioning from WinNT and Win2k, as existing user and group rids would otherwise clash with sytem users etc\.
     1099.sp
     1100All UIDs and GIDs must be able to be resolved into SIDs for the correct operation of ACLs on the server\. As such the algorithmic mapping can\'t be \'turned off\', but pushing it \'out of the way\' should resolve the issues\. Users and groups can then be assigned \'low\' RIDs in arbitrary\-rid supporting backends\.
     1101.sp
     1102Default:
     1103\fI\fIalgorithmic rid base\fR\fR\fI = \fR\fI1000\fR\fI \fR
     1104.sp
     1105Example:
     1106\fI\fIalgorithmic rid base\fR\fR\fI = \fR\fI100000\fR\fI \fR
     1107.RE
     1108
    9571109allocation roundup size (S)
    958 .RS 3n
    959 This parameter allows an administrator to tune the allocation size reported to Windows clients. The default size of 1Mb generally results in improved Windows client performance. However, rounding the allocation size may cause difficulties for some applications, e.g. MS Visual Studio. If the MS Visual Studio compiler starts to crash with an internal error, set this parameter to zero for this share.
    960 .sp
    961 The integer parameter specifies the roundup size in bytes.
    962 .sp
    963 Default:
    964 \fB\fIallocation roundup size\fR = 1048576 \fR
    965 .sp
    966 Example:
    967 \fB\fIallocation roundup size\fR = 0 # (to disable roundups) \fR
    968 .RE
    969 .PP
     1110.PP
     1111.RS 4
     1112This parameter allows an administrator to tune the allocation size reported to Windows clients\. The default size of 1Mb generally results in improved Windows client performance\. However, rounding the allocation size may cause difficulties for some applications, e\.g\. MS Visual Studio\. If the MS Visual Studio compiler starts to crash with an internal error, set this parameter to zero for this share\.
     1113.sp
     1114The integer parameter specifies the roundup size in bytes\.
     1115.sp
     1116Default:
     1117\fI\fIallocation roundup size\fR\fR\fI = \fR\fI1048576\fR\fI \fR
     1118.sp
     1119Example:
     1120\fI\fIallocation roundup size\fR\fR\fI = \fR\fI0 # (to disable roundups)\fR\fI \fR
     1121.RE
     1122
    9701123allow trusted domains (G)
    971 .RS 3n
     1124.PP
     1125.RS 4
    9721126This option only takes effect when the
    973 security option is set to
     1127\fIsecurity\fR
     1128option is set to
    9741129\fBserver\fR,
    9751130\fBdomain\fR
    9761131or
    977 \fBads\fR. If it is set to no, then attempts to connect to a resource from a domain or workgroup other than the one which smbd is running in will fail, even if that domain is trusted by the remote server doing the authentication.
    978 .sp
    979 This is useful if you only want your Samba server to serve resources to users in the domain it is a member of. As an example, suppose that there are two domains DOMA and DOMB. DOMB is trusted by DOMA, which contains the Samba server. Under normal circumstances, a user with an account in DOMB can then access the resources of a UNIX account with the same account name on the Samba server even if they do not have an account in DOMA. This can make implementing a security boundary difficult.
    980 .sp
    981 Default:
    982 \fB\fIallow trusted domains\fR = yes \fR
    983 .RE
    984 .PP
     1132\fBads\fR\. If it is set to no, then attempts to connect to a resource from a domain or workgroup other than the one which smbd is running in will fail, even if that domain is trusted by the remote server doing the authentication\.
     1133.sp
     1134This is useful if you only want your Samba server to serve resources to users in the domain it is a member of\. As an example, suppose that there are two domains DOMA and DOMB\. DOMB is trusted by DOMA, which contains the Samba server\. Under normal circumstances, a user with an account in DOMB can then access the resources of a UNIX account with the same account name on the Samba server even if they do not have an account in DOMA\. This can make implementing a security boundary difficult\.
     1135.sp
     1136Default:
     1137\fI\fIallow trusted domains\fR\fR\fI = \fR\fIyes\fR\fI \fR
     1138.RE
     1139
    9851140announce as (G)
    986 .RS 3n
     1141.PP
     1142.RS 4
    9871143This specifies what type of server
    9881144\fBnmbd\fR(8)
    989 will announce itself as, to a network neighborhood browse list. By default this is set to Windows NT. The valid options are : "NT Server" (which can also be written as "NT"), "NT Workstation", "Win95" or "WfW" meaning Windows NT Server, Windows NT Workstation, Windows 95 and Windows for Workgroups respectively. Do not change this parameter unless you have a specific need to stop Samba appearing as an NT server as this may prevent Samba servers from participating as browser servers correctly.
    990 .sp
    991 Default:
    992 \fB\fIannounce as\fR = NT Server \fR
    993 .sp
    994 Example:
    995 \fB\fIannounce as\fR = Win95 \fR
    996 .RE
    997 .PP
     1145will announce itself as, to a network neighborhood browse list\. By default this is set to Windows NT\. The valid options are : "NT Server" (which can also be written as "NT"), "NT Workstation", "Win95" or "WfW" meaning Windows NT Server, Windows NT Workstation, Windows 95 and Windows for Workgroups respectively\. Do not change this parameter unless you have a specific need to stop Samba appearing as an NT server as this may prevent Samba servers from participating as browser servers correctly\.
     1146.sp
     1147Default:
     1148\fI\fIannounce as\fR\fR\fI = \fR\fINT Server\fR\fI \fR
     1149.sp
     1150Example:
     1151\fI\fIannounce as\fR\fR\fI = \fR\fIWin95\fR\fI \fR
     1152.RE
     1153
    9981154announce version (G)
    999 .RS 3n
    1000 This specifies the major and minor version numbers that nmbd will use when announcing itself as a server. The default is 4.9. Do not change this parameter unless you have a specific need to set a Samba server to be a downlevel server.
    1001 .sp
    1002 Default:
    1003 \fB\fIannounce version\fR = 4.9 \fR
    1004 .sp
    1005 Example:
    1006 \fB\fIannounce version\fR = 2.0 \fR
    1007 .RE
    1008 .PP
     1155.PP
     1156.RS 4
     1157This specifies the major and minor version numbers that nmbd will use when announcing itself as a server\. The default is 4\.9\. Do not change this parameter unless you have a specific need to set a Samba server to be a downlevel server\.
     1158.sp
     1159Default:
     1160\fI\fIannounce version\fR\fR\fI = \fR\fI4\.9\fR\fI \fR
     1161.sp
     1162Example:
     1163\fI\fIannounce version\fR\fR\fI = \fR\fI2\.0\fR\fI \fR
     1164.RE
     1165
    10091166auth methods (G)
    1010 .RS 3n
     1167.PP
     1168.RS 4
    10111169This option allows the administrator to chose what authentication methods
    10121170smbd
    1013 will use when authenticating a user. This option defaults to sensible values based on
    1014 security. This should be considered a developer option and used only in rare circumstances. In the majority (if not all) of production servers, the default setting should be adequate.
    1015 .sp
    1016 Each entry in the list attempts to authenticate the user in turn, until the user authenticates. In practice only one method will ever actually be able to complete the authentication.
     1171will use when authenticating a user\. This option defaults to sensible values based on
     1172\fIsecurity\fR\. This should be considered a developer option and used only in rare circumstances\. In the majority (if not all) of production servers, the default setting should be adequate\.
     1173.sp
     1174Each entry in the list attempts to authenticate the user in turn, until the user authenticates\. In practice only one method will ever actually be able to complete the authentication\.
    10171175.sp
    10181176Possible options include
    … …  
    10241182(relay authentication requests for remote users through winbindd),
    10251183\fBntdomain\fR
    1026 (pre-winbindd method of authentication for remote domain users; deprecated in favour of winbind method),
     1184(pre\-winbindd method of authentication for remote domain users; deprecated in favour of winbind method),
    10271185\fBtrustdomain\fR
    1028 (authenticate trusted users by contacting the remote DC directly from smbd; deprecated in favour of winbind method).
    1029 .sp
    1030 Default:
    1031 \fB\fIauth methods\fR = \fR
    1032 .sp
    1033 Example:
    1034 \fB\fIauth methods\fR = guest sam winbind \fR
    1035 .RE
    1036 .PP
     1186(authenticate trusted users by contacting the remote DC directly from smbd; deprecated in favour of winbind method)\.
     1187.sp
     1188Default:
     1189\fI\fIauth methods\fR\fR\fI = \fR\fI\fR\fI \fR
     1190.sp
     1191Example:
     1192\fI\fIauth methods\fR\fR\fI = \fR\fIguest sam winbind\fR\fI \fR
     1193.RE
     1194
    10371195available (S)
    1038 .RS 3n
    1039 This parameter lets you "turn off" a service. If
     1196.PP
     1197.RS 4
     1198This parameter lets you "turn off" a service\. If
    10401199\fIavailable = no\fR, then
    1041 \fBALL\fR
    1042 attempts to connect to the service will fail. Such failures are logged.
    1043 .sp
    1044 Default:
    1045 \fB\fIavailable\fR = yes \fR
    1046 .RE
    1047 .PP
     1200\fIALL\fR
     1201attempts to connect to the service will fail\. Such failures are logged\.
     1202.sp
     1203Default:
     1204\fI\fIavailable\fR\fR\fI = \fR\fIyes\fR\fI \fR
     1205.RE
     1206
    10481207bind interfaces only (G)
    1049 .RS 3n
    1050 This global parameter allows the Samba admin to limit what interfaces on a machine will serve SMB requests. It affects file service
     1208.PP
     1209.RS 4
     1210This global parameter allows the Samba admin to limit what interfaces on a machine will serve SMB requests\. It affects file service
    10511211\fBsmbd\fR(8)
    10521212and name service
    10531213\fBnmbd\fR(8)
    1054 in a slightly different ways.
     1214in a slightly different ways\.
    10551215.sp
    10561216For name service it causes
    10571217nmbd
    10581218to bind to ports 137 and 138 on the interfaces listed in the
    1059 interfaces parameter.
     1219\fIinterfaces\fR
     1220parameter\.
    10601221nmbd
    1061 also binds to the "all addresses" interface (0.0.0.0) on ports 137 and 138 for the purposes of reading broadcast messages. If this option is not set then
     1222also binds to the "all addresses" interface (0\.0\.0\.0) on ports 137 and 138 for the purposes of reading broadcast messages\. If this option is not set then
    10621223nmbd
    1063 will service name requests on all of these sockets. If
    1064 bind interfaces only is set then
     1224will service name requests on all of these sockets\. If
     1225\fIbind interfaces only\fR
     1226is set then
    10651227nmbd
    1066 will check the source address of any packets coming in on the broadcast sockets and discard any that don't match the broadcast addresses of the interfaces in the
    1067 interfaces parameter list. As unicast packets are received on the other sockets it allows
     1228will check the source address of any packets coming in on the broadcast sockets and discard any that don\'t match the broadcast addresses of the interfaces in the
     1229\fIinterfaces\fR
     1230parameter list\. As unicast packets are received on the other sockets it allows
    10681231nmbd
    10691232to refuse to serve names to machines that send packets that arrive through any interfaces not listed in the
    1070 interfaces list. IP Source address spoofing does defeat this simple check, however, so it must not be used seriously as a security feature for
    1071 nmbd.
     1233\fIinterfaces\fR
     1234list\. IP Source address spoofing does defeat this simple check, however, so it must not be used seriously as a security feature for
     1235nmbd\.
    10721236.sp
    10731237For file service it causes
    10741238\fBsmbd\fR(8)
    10751239to bind only to the interface list given in the
    1076 interfaces parameter. This restricts the networks that
     1240\fIinterfaces\fR
     1241parameter\. This restricts the networks that
    10771242smbd
    1078 will serve to packets coming in those interfaces. Note that you should not use this parameter for machines that are serving PPP or other intermittent or non-broadcast network interfaces as it will not cope with non-permanent interfaces.
     1243will serve to packets coming in those interfaces\. Note that you should not use this parameter for machines that are serving PPP or other intermittent or non\-broadcast network interfaces as it will not cope with non\-permanent interfaces\.
    10791244.sp
    10801245If
    1081 bind interfaces only is set then unless the network address
    1082 \fB127.0.0.1\fR
     1246\fIbind interfaces only\fR
     1247is set then unless the network address
     1248\fI127\.0\.0\.1\fR
    10831249is added to the
    1084 interfaces parameter list
     1250\fIinterfaces\fR
     1251parameter list
    10851252\fBsmbpasswd\fR(8)
    10861253and
    10871254\fBswat\fR(8)
    1088 may not work as expected due to the reasons covered below.
     1255may not work as expected due to the reasons covered below\.
    10891256.sp
    10901257To change a users SMB password, the
    10911258smbpasswd
    10921259by default connects to the
    1093 \fBlocalhost - 127.0.0.1\fR
    1094 address as an SMB client to issue the password change request. If
    1095 bind interfaces only is set then unless the network address
    1096 \fB127.0.0.1\fR
     1260\fIlocalhost \- 127\.0\.0\.1\fR
     1261address as an SMB client to issue the password change request\. If
     1262\fIbind interfaces only\fR
     1263is set then unless the network address
     1264\fI127\.0\.0\.1\fR
    10971265is added to the
    1098 interfaces parameter list then
     1266\fIinterfaces\fR
     1267parameter list then
    10991268smbpasswd
    1100 will fail to connect in it's default mode.
     1269will fail to connect in it\'s default mode\.
    11011270smbpasswd
    11021271can be forced to use the primary IP interface of the local host by using its
    11031272\fBsmbpasswd\fR(8)
    1104 \fI-r \fR\fI\fIremote machine\fR\fR
     1273\fI\-r \fR\fI\fIremote machine\fR\fR
    11051274parameter, with
    11061275\fIremote machine\fR
    1107 set to the IP name of the primary interface of the local host.
     1276set to the IP name of the primary interface of the local host\.
    11081277.sp
    11091278The
    … …  
    11141283nmbd
    11151284at the address
    1116 \fB127.0.0.1\fR
    1117 to determine if they are running. Not adding
    1118 \fB127.0.0.1\fR
     1285\fI127\.0\.0\.1\fR
     1286to determine if they are running\. Not adding
     1287\fI127\.0\.0\.1\fR
    11191288will cause
    11201289smbd
    11211290and
    11221291nmbd
    1123 to always show "not running" even if they really are. This can prevent
     1292to always show "not running" even if they really are\. This can prevent
    11241293swat
    11251294from starting/stopping/restarting
    11261295smbd
    11271296and
    1128 nmbd.
    1129 .sp
    1130 Default:
    1131 \fB\fIbind interfaces only\fR = no \fR
    1132 .RE
    1133 .PP
     1297nmbd\.
     1298.sp
     1299Default:
     1300\fI\fIbind interfaces only\fR\fR\fI = \fR\fIno\fR\fI \fR
     1301.RE
     1302
    11341303blocking locks (S)
    1135 .RS 3n
     1304.PP
     1305.RS 4
    11361306This parameter controls the behavior of
    11371307\fBsmbd\fR(8)
    1138 when given a request by a client to obtain a byte range lock on a region of an open file, and the request has a time limit associated with it.
    1139 .sp
    1140 If this parameter is set and the lock range requested cannot be immediately satisfied, samba will internally queue the lock request, and periodically attempt to obtain the lock until the timeout period expires.
     1308when given a request by a client to obtain a byte range lock on a region of an open file, and the request has a time limit associated with it\.
     1309.sp
     1310If this parameter is set and the lock range requested cannot be immediately satisfied, samba will internally queue the lock request, and periodically attempt to obtain the lock until the timeout period expires\.
    11411311.sp
    11421312If this parameter is set to
    1143 \fBno\fR, then samba will behave as previous versions of Samba would and will fail the lock request immediately if the lock range cannot be obtained.
    1144 .sp
    1145 Default:
    1146 \fB\fIblocking locks\fR = yes \fR
    1147 .RE
    1148 .PP
     1313\fBno\fR, then samba will behave as previous versions of Samba would and will fail the lock request immediately if the lock range cannot be obtained\.
     1314.sp
     1315Default:
     1316\fI\fIblocking locks\fR\fR\fI = \fR\fIyes\fR\fI \fR
     1317.RE
     1318
    11491319block size (S)
    1150 .RS 3n
     1320.PP
     1321.RS 4
    11511322This parameter controls the behavior of
    11521323\fBsmbd\fR(8)
    1153 when reporting disk free sizes. By default, this reports a disk block size of 1024 bytes.
    1154 .sp
    1155 Changing this parameter may have some effect on the efficiency of client writes, this is not yet confirmed. This parameter was added to allow advanced administrators to change it (usually to a higher value) and test the effect it has on client write performance without re-compiling the code. As this is an experimental option it may be removed in a future release.
    1156 .sp
    1157 Changing this option does not change the disk free reporting size, just the block size unit reported to the client.
    1158 .sp
    1159 Default:
    1160 \fB\fIblock size\fR = 1024 \fR
    1161 .sp
    1162 Example:
    1163 \fB\fIblock size\fR = 4096 \fR
    1164 .RE
    1165 .PP
    1166 browsable
    1167 .RS 3n
    1168 This parameter is a synonym for browseable.
    1169 .RE
    1170 .PP
     1324when reporting disk free sizes\. By default, this reports a disk block size of 1024 bytes\.
     1325.sp
     1326Changing this parameter may have some effect on the efficiency of client writes, this is not yet confirmed\. This parameter was added to allow advanced administrators to change it (usually to a higher value) and test the effect it has on client write performance without re\-compiling the code\. As this is an experimental option it may be removed in a future release\.
     1327.sp
     1328Changing this option does not change the disk free reporting size, just the block size unit reported to the client\.
     1329.sp
     1330Default:
     1331\fI\fIblock size\fR\fR\fI = \fR\fI1024\fR\fI \fR
     1332.sp
     1333Example:
     1334\fI\fIblock size\fR\fR\fI = \fR\fI4096\fR\fI \fR
     1335.RE
     1336browsable.PP
     1337.RS 4
     1338This parameter is a synonym for
     1339browseable\.
     1340.RE
     1341
    11711342browseable (S)
    1172 .RS 3n
    1173 This controls whether this share is seen in the list of available shares in a net view and in the browse list.
    1174 .sp
    1175 Default:
    1176 \fB\fIbrowseable\fR = yes \fR
    1177 .RE
    1178 .PP
     1343.PP
     1344.RS 4
     1345This controls whether this share is seen in the list of available shares in a net view and in the browse list\.
     1346.sp
     1347Default:
     1348\fI\fIbrowseable\fR\fR\fI = \fR\fIyes\fR\fI \fR
     1349.RE
     1350
    11791351browse list (G)
    1180 .RS 3n
     1352.PP
     1353.RS 4
    11811354This controls whether
    11821355\fBsmbd\fR(8)
    11831356will serve a browse list to a client doing a
    11841357NetServerEnum
    1185 call. Normally set to
    1186 \fByes\fR. You should never need to change this.
    1187 .sp
    1188 Default:
    1189 \fB\fIbrowse list\fR = yes \fR
    1190 .RE
    1191 .PP
    1192 casesignames
    1193 .RS 3n
    1194 This parameter is a synonym for case sensitive.
    1195 .RE
    1196 .PP
     1358call\. Normally set to
     1359\fByes\fR\. You should never need to change this\.
     1360.sp
     1361Default:
     1362\fI\fIbrowse list\fR\fR\fI = \fR\fIyes\fR\fI \fR
     1363.RE
     1364casesignames.PP
     1365.RS 4
     1366This parameter is a synonym for
     1367case sensitive\.
     1368.RE
     1369
    11971370case sensitive (S)
    1198 .RS 3n
     1371.PP
     1372.RS 4
    11991373See the discussion in the section
    1200 name mangling.
    1201 .sp
    1202 Default:
    1203 \fB\fIcase sensitive\fR = no \fR
    1204 .RE
    1205 .PP
     1374\fIname mangling\fR\.
     1375.sp
     1376Default:
     1377\fI\fIcase sensitive\fR\fR\fI = \fR\fIno\fR\fI \fR
     1378.RE
     1379
    12061380change notify (S)
    1207 .RS 3n
    1208 This parameter specifies whether Samba should reply to a client's file change notify requests.
     1381.PP
     1382.RS 4
     1383This parameter specifies whether Samba should reply to a client\'s file change notify requests\.
    12091384.sp
    12101385You should never need to change this parameter
    12111386.sp
    12121387Default:
    1213 \fB\fIchange notify\fR = no \fR
    1214 .RE
    1215 .PP
     1388\fI\fIchange notify\fR\fR\fI = \fR\fIyes\fR\fI \fR
     1389.RE
     1390
    12161391change share command (G)
    1217 .RS 3n
    1218 Samba 2.2.0 introduced the ability to dynamically add and delete shares via the Windows NT 4.0 Server Manager. The
     1392.PP
     1393.RS 4
     1394Samba 2\.2\.0 introduced the ability to dynamically add and delete shares via the Windows NT 4\.0 Server Manager\. The
    12191395\fIchange share command\fR
    12201396is used to define an external program or script which will modify an existing service definition in
    1221 \fIsmb.conf\fR. In order to successfully execute the
     1397\fIsmb\.conf\fR\. In order to successfully execute the
    12221398\fIchange share command\fR,
    12231399smbd
    1224 requires that the administrator be connected using a root account (i.e. uid == 0).
     1400requires that the administrator be connected using a root account (i\.e\. uid == 0)\.
     1401.sp
     1402If the connected account has
     1403SeDiskOperatorPrivilege, scripts defined in
     1404\fIchange share\fR
     1405parameter are executed as root\.
    12251406.sp
    12261407When executed,
    … …  
    12281409will automatically invoke the
    12291410\fIchange share command\fR
    1230 with five parameters.
    1231 .RS 3n
    1232 .TP 3n
    1233 \(bu
     1411with five parameters\.
     1412.sp
     1413.RS 4
     1414.ie n \{\
     1415\h'-04'\(bu\h'+03'\c
     1416.\}
     1417.el \{\
     1418.sp -1
     1419.IP \(bu 2.3
     1420.\}
    12341421\fIconfigFile\fR
    1235 - the location of the global
    1236 \fIsmb.conf\fR
    1237 file.
    1238 .TP 3n
    1239 \(bu
     1422\- the location of the global
     1423\fIsmb\.conf\fR
     1424file\.
     1425.RE
     1426.sp
     1427.RS 4
     1428.ie n \{\
     1429\h'-04'\(bu\h'+03'\c
     1430.\}
     1431.el \{\
     1432.sp -1
     1433.IP \(bu 2.3
     1434.\}
    12401435\fIshareName\fR
    1241 - the name of the new share.
    1242 .TP 3n
    1243 \(bu
     1436\- the name of the new share\.
     1437.RE
     1438.sp
     1439.RS 4
     1440.ie n \{\
     1441\h'-04'\(bu\h'+03'\c
     1442.\}
     1443.el \{\
     1444.sp -1
     1445.IP \(bu 2.3
     1446.\}
    12441447\fIpathName\fR
    1245 - path to an **existing** directory on disk.
    1246 .TP 3n
    1247 \(bu
     1448\- path to an **existing** directory on disk\.
     1449.RE
     1450.sp
     1451.RS 4
     1452.ie n \{\
     1453\h'-04'\(bu\h'+03'\c
     1454.\}
     1455.el \{\
     1456.sp -1
     1457.IP \(bu 2.3
     1458.\}
    12481459\fIcomment\fR
    1249 - comment string to associate with the new share.
    1250 .TP 3n
    1251 \(bu
     1460\- comment string to associate with the new share\.
     1461.RE
     1462.sp
     1463.RS 4
     1464.ie n \{\
     1465\h'-04'\(bu\h'+03'\c
     1466.\}
     1467.el \{\
     1468.sp -1
     1469.IP \(bu 2.3
     1470.\}
    12521471\fImax connections\fR
    1253 Number of maximum simultaneous connections to this share.
    1254 .RE
    1255 .IP "" 3n
    1256 This parameter is only used modify existing file shares definitions. To modify printer shares, use the "Printers..." folder as seen when browsing the Samba host.
    1257 .sp
    1258 Default:
    1259 \fB\fIchange share command\fR = \fR
    1260 .sp
    1261 Example:
    1262 \fB\fIchange share command\fR = /usr/local/bin/addshare \fR
    1263 .RE
    1264 .PP
     1472Number of maximum simultaneous connections to this share\.
     1473.sp
     1474.RE
     1475This parameter is only used modify existing file shares definitions\. To modify printer shares, use the "Printers\.\.\." folder as seen when browsing the Samba host\.
     1476.sp
     1477Default:
     1478\fI\fIchange share command\fR\fR\fI = \fR\fI\fR\fI \fR
     1479.sp
     1480Example:
     1481\fI\fIchange share command\fR\fR\fI = \fR\fI/usr/local/bin/addshare\fR\fI \fR
     1482.RE
     1483
    12651484check password script (G)
    1266 .RS 3n
    1267 The name of a program that can be used to check password complexity. The password is sent to the program's standrad input.
    1268 .sp
    1269 The program must return 0 on good password any other value otherwise. In case the password is considered weak (the program do not return 0) the user will be notified and the password change will fail.
    1270 .sp
    1271 Note: In the example directory there is a sample program called crackcheck that uses cracklib to checkpassword quality
    1272 .sp
    1273 .
    1274 
    1275 
    1276 Default:
    1277 \fB\fIcheck password script\fR = Disabled \fR
    1278 .sp
    1279 Example:
    1280 \fB\fIcheck password script\fR = check password script = /usr/local/sbin/crackcheck \fR
    1281 .RE
    1282 .PP
     1485.PP
     1486.RS 4
     1487The name of a program that can be used to check password complexity\. The password is sent to the program\'s standrad input\.
     1488.sp
     1489The program must return 0 on good password any other value otherwise\. In case the password is considered weak (the program do not return 0) the user will be notified and the password change will fail\.
     1490.sp
     1491Note: In the example directory there is a sample program called crackcheck that uses cracklib to checkpassword quality\.
     1492.sp
     1493Default:
     1494\fI\fIcheck password script\fR\fR\fI = \fR\fIDisabled\fR\fI \fR
     1495.sp
     1496Example:
     1497\fI\fIcheck password script\fR\fR\fI = \fR\fIcheck password script = /usr/local/sbin/crackcheck\fR\fI \fR
     1498.RE
     1499
    12831500client lanman auth (G)
    1284 .RS 3n
     1501.PP
     1502.RS 4
    12851503This parameter determines whether or not
    12861504\fBsmbclient\fR(8)
    1287 and other samba client tools will attempt to authenticate itself to servers using the weaker LANMAN password hash. If disabled, only server which support NT password hashes (e.g. Windows NT/2000, Samba, etc... but not Windows 95/98) will be able to be connected from the Samba client.
    1288 .sp
    1289 The LANMAN encrypted response is easily broken, due to it's case-insensitive nature, and the choice of algorithm. Clients without Windows 95/98 servers are advised to disable this option.
     1505and other samba client tools will attempt to authenticate itself to servers using the weaker LANMAN password hash\. If disabled, only server which support NT password hashes (e\.g\. Windows NT/2000, Samba, etc\.\.\. but not Windows 95/98) will be able to be connected from the Samba client\.
     1506.sp
     1507The LANMAN encrypted response is easily broken, due to it\'s case\-insensitive nature, and the choice of algorithm\. Clients without Windows 95/98 servers are advised to disable this option\.
    12901508.sp
    12911509Disabling this option will also disable the
    … …  
    12951513Likewise, if the
    12961514client ntlmv2 auth
    1297 parameter is enabled, then only NTLMv2 logins will be attempted.
    1298 .sp
    1299 Default:
    1300 \fB\fIclient lanman auth\fR = yes \fR
    1301 .RE
    1302 .PP
     1515parameter is enabled, then only NTLMv2 logins will be attempted\.
     1516.sp
     1517Default:
     1518\fI\fIclient lanman auth\fR\fR\fI = \fR\fIyes\fR\fI \fR
     1519.RE
     1520
    13031521client ntlmv2 auth (G)
    1304 .RS 3n
     1522.PP
     1523.RS 4
    13051524This parameter determines whether or not
    13061525\fBsmbclient\fR(8)
    1307 will attempt to authenticate itself to servers using the NTLMv2 encrypted password response.
    1308 .sp
    1309 If enabled, only an NTLMv2 and LMv2 response (both much more secure than earlier versions) will be sent. Many servers (including NT4 < SP4, Win9x and Samba 2.2) are not compatible with NTLMv2.
     1526will attempt to authenticate itself to servers using the NTLMv2 encrypted password response\.
     1527.sp
     1528If enabled, only an NTLMv2 and LMv2 response (both much more secure than earlier versions) will be sent\. Many servers (including NT4 < SP4, Win9x and Samba 2\.2) are not compatible with NTLMv2\.
    13101529.sp
    13111530Similarly, if enabled, NTLMv1,
    … …  
    13131532and
    13141533client plaintext auth
    1315 authentication will be disabled. This also disables share-level authentication.
     1534authentication will be disabled\. This also disables share\-level authentication\.
    13161535.sp
    13171536If disabled, an NTLM response (and possibly a LANMAN response) will be sent by the client, depending on the value of
    1318 client lanman auth.
    1319 .sp
    1320 Note that some sites (particularly those following 'best practice' security polices) only allow NTLMv2 responses, and not the weaker LM or NTLM.
    1321 .sp
    1322 Default:
    1323 \fB\fIclient ntlmv2 auth\fR = no \fR
    1324 .RE
    1325 .PP
     1537client lanman auth\.
     1538.sp
     1539Note that some sites (particularly those following \'best practice\' security polices) only allow NTLMv2 responses, and not the weaker LM or NTLM\.
     1540.sp
     1541Default:
     1542\fI\fIclient ntlmv2 auth\fR\fR\fI = \fR\fIno\fR\fI \fR
     1543.RE
     1544
    13261545client plaintext auth (G)
    1327 .RS 3n
    1328 Specifies whether a client should send a plaintext password if the server does not support encrypted passwords.
    1329 .sp
    1330 Default:
    1331 \fB\fIclient plaintext auth\fR = yes \fR
    1332 .RE
    1333 .PP
     1546.PP
     1547.RS 4
     1548Specifies whether a client should send a plaintext password if the server does not support encrypted passwords\.
     1549.sp
     1550Default:
     1551\fI\fIclient plaintext auth\fR\fR\fI = \fR\fIyes\fR\fI \fR
     1552.RE
     1553
    13341554client schannel (G)
    1335 .RS 3n
    1336 This controls whether the client offers or even demands the use of the netlogon schannel.
    1337 client schannel = no does not offer the schannel,
    1338 client schannel = auto offers the schannel but does not enforce it, and
    1339 client schannel = yes denies access if the server is not able to speak netlogon schannel.
    1340 .sp
    1341 Default:
    1342 \fB\fIclient schannel\fR = auto \fR
    1343 .sp
    1344 Example:
    1345 \fB\fIclient schannel\fR = yes \fR
    1346 .RE
    1347 .PP
     1555.PP
     1556.RS 4
     1557This controls whether the client offers or even demands the use of the netlogon schannel\.
     1558\fIclient schannel = no\fR
     1559does not offer the schannel,
     1560\fIclient schannel = auto\fR
     1561offers the schannel but does not enforce it, and
     1562\fIclient schannel = yes\fR
     1563denies access if the server is not able to speak netlogon schannel\.
     1564.sp
     1565Default:
     1566\fI\fIclient schannel\fR\fR\fI = \fR\fIauto\fR\fI \fR
     1567.sp
     1568Example:
     1569\fI\fIclient schannel\fR\fR\fI = \fR\fIyes\fR\fI \fR
     1570.RE
     1571
    13481572client signing (G)
    1349 .RS 3n
    1350 This controls whether the client offers or requires the server it talks to to use SMB signing. Possible values are
    1351 \fBauto\fR,
    1352 \fBmandatory\fR
     1573.PP
     1574.RS 4
     1575This controls whether the client offers or requires the server it talks to to use SMB signing\. Possible values are
     1576\fIauto\fR,
     1577\fImandatory\fR
    13531578and
    1354 \fBdisabled\fR.
    1355 .sp
    1356 When set to auto, SMB signing is offered, but not enforced. When set to mandatory, SMB signing is required and if set to disabled, SMB signing is not offered either.
    1357 .sp
    1358 Default:
    1359 \fB\fIclient signing\fR = auto \fR
    1360 .RE
    1361 .PP
     1579\fIdisabled\fR\.
     1580.sp
     1581When set to auto, SMB signing is offered, but not enforced\. When set to mandatory, SMB signing is required and if set to disabled, SMB signing is not offered either\.
     1582.sp
     1583Default:
     1584\fI\fIclient signing\fR\fR\fI = \fR\fIauto\fR\fI \fR
     1585.RE
     1586
    13621587client use spnego (G)
    1363 .RS 3n
    1364 This variable controls whether Samba clients will try to use Simple and Protected NEGOciation (as specified by rfc2478) with supporting servers (including WindowsXP, Windows2000 and Samba 3.0) to agree upon an authentication mechanism. This enables Kerberos authentication in particular.
    1365 .sp
    1366 Default:
    1367 \fB\fIclient use spnego\fR = yes \fR
    1368 .RE
    1369 .PP
     1588.PP
     1589.RS 4
     1590This variable controls whether Samba clients will try to use Simple and Protected NEGOciation (as specified by rfc2478) with supporting servers (including WindowsXP, Windows2000 and Samba 3\.0) to agree upon an authentication mechanism\. This enables Kerberos authentication in particular\.
     1591.sp
     1592Default:
     1593\fI\fIclient use spnego\fR\fR\fI = \fR\fIyes\fR\fI \fR
     1594.RE
     1595
    13701596comment (S)
    1371 .RS 3n
     1597.PP
     1598.RS 4
    13721599This is a text field that is seen next to a share when a client does a queries the server, either via the network neighborhood or via
    13731600net view
    1374 to list what shares are available.
     1601to list what shares are available\.
    13751602.sp
    13761603If you want to set the string that is displayed next to the machine name then see the
    1377 server string parameter.
    1378 .sp
    1379 Default:
    1380 \fB\fIcomment\fR = # No comment \fR
    1381 .sp
    1382 Example:
    1383 \fB\fIcomment\fR = Fred's Files \fR
    1384 .RE
    1385 .PP
     1604\fIserver string\fR
     1605parameter\.
     1606.sp
     1607Default:
     1608\fI\fIcomment\fR\fR\fI = \fR\fI # No comment\fR\fI \fR
     1609.sp
     1610Example:
     1611\fI\fIcomment\fR\fR\fI = \fR\fIFred\'s Files\fR\fI \fR
     1612.RE
     1613
    13861614config file (G)
    1387 .RS 3n
     1615.PP
     1616.RS 4
    13881617This allows you to override the config file to use, instead of the default (usually
    1389 \fIsmb.conf\fR). There is a chicken and egg problem here as this option is set in the config file!
    1390 .sp
    1391 For this reason, if the name of the config file has changed when the parameters are loaded then it will reload them from the new config file.
    1392 .sp
    1393 This option takes the usual substitutions, which can be very useful.
    1394 .sp
    1395 If the config file doesn't exist then it won't be loaded (allowing you to special case the config files of just a few clients).
    1396 .sp
    1397 \fBNo default\fR
    1398 .sp
    1399 Example:
    1400 \fB\fIconfig file\fR = /usr/local/samba/lib/smb.conf.%m \fR
    1401 .RE
    1402 .PP
     1618\fIsmb\.conf\fR)\. There is a chicken and egg problem here as this option is set in the config file!
     1619.sp
     1620For this reason, if the name of the config file has changed when the parameters are loaded then it will reload them from the new config file\.
     1621.sp
     1622This option takes the usual substitutions, which can be very useful\.
     1623.sp
     1624If the config file doesn\'t exist then it won\'t be loaded (allowing you to special case the config files of just a few clients)\.
     1625.sp
     1626\fINo default\fR
     1627.sp
     1628Example:
     1629\fI\fIconfig file\fR\fR\fI = \fR\fI/usr/local/samba/lib/smb\.conf\.%m\fR\fI \fR
     1630.RE
     1631
    14031632copy (S)
    1404 .RS 3n
    1405 This parameter allows you to "clone" service entries. The specified service is simply duplicated under the current service's name. Any parameters specified in the current section will override those in the section being copied.
    1406 .sp
    1407 This feature lets you set up a 'template' service and create similar services easily. Note that the service being copied must occur earlier in the configuration file than the service doing the copying.
    1408 .sp
    1409 Default:
    1410 \fB\fIcopy\fR = \fR
    1411 .sp
    1412 Example:
    1413 \fB\fIcopy\fR = otherservice \fR
    1414 .RE
    1415 .PP
    1416 create mode
    1417 .RS 3n
    1418 This parameter is a synonym for create mask.
    1419 .RE
    1420 .PP
     1633.PP
     1634.RS 4
     1635This parameter allows you to "clone" service entries\. The specified service is simply duplicated under the current service\'s name\. Any parameters specified in the current section will override those in the section being copied\.
     1636.sp
     1637This feature lets you set up a \'template\' service and create similar services easily\. Note that the service being copied must occur earlier in the configuration file than the service doing the copying\.
     1638.sp
     1639Default:
     1640\fI\fIcopy\fR\fR\fI = \fR\fI\fR\fI \fR
     1641.sp
     1642Example:
     1643\fI\fIcopy\fR\fR\fI = \fR\fIotherservice\fR\fI \fR
     1644.RE
     1645create mode.PP
     1646.RS 4
     1647This parameter is a synonym for
     1648create mask\.
     1649.RE
     1650
    14211651create mask (S)
    1422 .RS 3n
    1423 When a file is created, the necessary permissions are calculated according to the mapping from DOS modes to UNIX permissions, and the resulting UNIX mode is then bit-wise 'AND'ed with this parameter. This parameter may be thought of as a bit-wise MASK for the UNIX modes of a file. Any bit
    1424 \fBnot\fR
    1425 set here will be removed from the modes set on a file when it is created.
     1652.PP
     1653.RS 4
     1654When a file is created, the necessary permissions are calculated according to the mapping from DOS modes to UNIX permissions, and the resulting UNIX mode is then bit\-wise \'AND\'ed with this parameter\. This parameter may be thought of as a bit\-wise MASK for the UNIX modes of a file\. Any bit
     1655\fInot\fR
     1656set here will be removed from the modes set on a file when it is created\.
    14261657.sp
    14271658The default value of this parameter removes the
    … …  
    14291660and
    14301661other
    1431 write and execute bits from the UNIX modes.
    1432 .sp
    1433 Following this Samba will bit-wise 'OR' the UNIX mode created from this parameter with the value of the
    1434 force create mode parameter which is set to 000 by default.
    1435 .sp
    1436 This parameter does not affect directory masks. See the parameter
    1437 directory mask for details.
    1438 .sp
    1439 Note that this parameter does not apply to permissions set by Windows NT/2000 ACL editors. If the administrator wishes to enforce a mask on access control lists also, they need to set the
    1440 security mask.
    1441 .sp
    1442 Default:
    1443 \fB\fIcreate mask\fR = 0744 \fR
    1444 .sp
    1445 Example:
    1446 \fB\fIcreate mask\fR = 0775 \fR
    1447 .RE
    1448 .PP
     1662write and execute bits from the UNIX modes\.
     1663.sp
     1664Following this Samba will bit\-wise \'OR\' the UNIX mode created from this parameter with the value of the
     1665\fIforce create mode\fR
     1666parameter which is set to 000 by default\.
     1667.sp
     1668This parameter does not affect directory masks\. See the parameter
     1669\fIdirectory mask\fR
     1670for details\.
     1671.sp
     1672Note that this parameter does not apply to permissions set by Windows NT/2000 ACL editors\. If the administrator wishes to enforce a mask on access control lists also, they need to set the
     1673\fIsecurity mask\fR\.
     1674.sp
     1675Default:
     1676\fI\fIcreate mask\fR\fR\fI = \fR\fI0744\fR\fI \fR
     1677.sp
     1678Example:
     1679\fI\fIcreate mask\fR\fR\fI = \fR\fI0775\fR\fI \fR
     1680.RE
     1681
    14491682csc policy (S)
    1450 .RS 3n
     1683.PP
     1684.RS 4
    14511685This stands for
    1452 \fBclient-side caching policy\fR, and specifies how clients capable of offline caching will cache the files in the share. The valid values are: manual, documents, programs, disable.
    1453 .sp
    1454 These values correspond to those used on Windows servers.
     1686\fIclient\-side caching policy\fR, and specifies how clients capable of offline caching will cache the files in the share\. The valid values are: manual, documents, programs, disable\.
     1687.sp
     1688These values correspond to those used on Windows servers\.
    14551689.sp
    14561690For example, shares containing roaming profiles can have offline caching disabled using
    1457 csc policy = disable.
    1458 .sp
    1459 Default:
    1460 \fB\fIcsc policy\fR = manual \fR
    1461 .sp
    1462 Example:
    1463 \fB\fIcsc policy\fR = programs \fR
    1464 .RE
    1465 .PP
     1691\fIcsc policy = disable\fR\.
     1692.sp
     1693Default:
     1694\fI\fIcsc policy\fR\fR\fI = \fR\fImanual\fR\fI \fR
     1695.sp
     1696Example:
     1697\fI\fIcsc policy\fR\fR\fI = \fR\fIprograms\fR\fI \fR
     1698.RE
     1699
    14661700cups options (S)
    1467 .RS 3n
     1701.PP
     1702.RS 4
    14681703This parameter is only applicable if
    1469 printing is set to
    1470 \fBcups\fR. Its value is a free form string of options passed directly to the cups library.
    1471 .sp
    1472 You can pass any generic print option known to CUPS (as listed in the CUPS "Software Users' Manual"). You can also pass any printer specific option (as listed in "lpoptions -d printername -l") valid for the target queue.
     1704\fIprinting\fR
     1705is set to
     1706\fBcups\fR\. Its value is a free form string of options passed directly to the cups library\.
     1707.sp
     1708You can pass any generic print option known to CUPS (as listed in the CUPS "Software Users\' Manual")\. You can also pass any printer specific option (as listed in "lpoptions \-d printername \-l") valid for the target queue\. Multiple parameters should be space\-delimited name/value pairs according to the PAPI text option ABNF specification\. Collection values ("name={a=\.\.\. b=\.\.\. c=\.\.\.}") are stored with the curley brackets intact\.
    14731709.sp
    14741710You should set this parameter to
    … …  
    14761712if your CUPS server
    14771713\fIerror_log\fR
    1478 file contains messages such as "Unsupported format 'application/octet-stream'" when printing from a Windows client through Samba. It is no longer necessary to enable system wide raw printing in
    1479 \fI/etc/cups/mime.{convs,types}\fR.
    1480 .sp
    1481 Default:
    1482 \fB\fIcups options\fR = "" \fR
    1483 .sp
    1484 Example:
    1485 \fB\fIcups options\fR = "raw,media=a4,job-sheets=secret,secret" \fR
    1486 .RE
    1487 .PP
     1714file contains messages such as "Unsupported format \'application/octet\-stream\'" when printing from a Windows client through Samba\. It is no longer necessary to enable system wide raw printing in
     1715\fI/etc/cups/mime\.{convs,types}\fR\.
     1716.sp
     1717Default:
     1718\fI\fIcups options\fR\fR\fI = \fR\fI""\fR\fI \fR
     1719.sp
     1720Example:
     1721\fI\fIcups options\fR\fR\fI = \fR\fI"raw media=a4"\fR\fI \fR
     1722.RE
     1723
    14881724cups server (G)
    1489 .RS 3n
     1725.PP
     1726.RS 4
    14901727This parameter is only applicable if
    1491 printing is set to
    1492 \fBcups\fR.
     1728\fIprinting\fR
     1729is set to
     1730\fBcups\fR\.
    14931731.sp
    14941732If set, this option overrides the ServerName option in the CUPS
    1495 \fIclient.conf\fR. This is necessary if you have virtual samba servers that connect to different CUPS daemons.
    1496 .sp
    1497 Optionally, a port can be specified by separating the server name and port number with a colon. If no port was specified, the default port for IPP (631) will be used.
    1498 .sp
    1499 Default:
    1500 \fB\fIcups server\fR = "" \fR
    1501 .sp
    1502 Example:
    1503 \fB\fIcups server\fR = mycupsserver \fR
    1504 .sp
    1505 Example:
    1506 \fB\fIcups server\fR = mycupsserver:1631 \fR
    1507 .RE
    1508 .PP
     1733\fIclient\.conf\fR\. This is necessary if you have virtual samba servers that connect to different CUPS daemons\.
     1734.sp
     1735Optionally, a port can be specified by separating the server name and port number with a colon\. If no port was specified, the default port for IPP (631) will be used\.
     1736.sp
     1737Default:
     1738\fI\fIcups server\fR\fR\fI = \fR\fI""\fR\fI \fR
     1739.sp
     1740Example:
     1741\fI\fIcups server\fR\fR\fI = \fR\fImycupsserver\fR\fI \fR
     1742.sp
     1743Example:
     1744\fI\fIcups server\fR\fR\fI = \fR\fImycupsserver:1631\fR\fI \fR
     1745.RE
     1746
    15091747deadtime (G)
    1510 .RS 3n
    1511 The value of the parameter (a decimal integer) represents the number of minutes of inactivity before a connection is considered dead, and it is disconnected. The deadtime only takes effect if the number of open files is zero.
    1512 .sp
    1513 This is useful to stop a server's resources being exhausted by a large number of inactive connections.
    1514 .sp
    1515 Most clients have an auto-reconnect feature when a connection is broken so in most cases this parameter should be transparent to users.
    1516 .sp
    1517 Using this parameter with a timeout of a few minutes is recommended for most systems.
    1518 .sp
    1519 A deadtime of zero indicates that no auto-disconnection should be performed.
    1520 .sp
    1521 Default:
    1522 \fB\fIdeadtime\fR = 0 \fR
    1523 .sp
    1524 Example:
    1525 \fB\fIdeadtime\fR = 15 \fR
    1526 .RE
    1527 .PP
     1748.PP
     1749.RS 4
     1750The value of the parameter (a decimal integer) represents the number of minutes of inactivity before a connection is considered dead, and it is disconnected\. The deadtime only takes effect if the number of open files is zero\.
     1751.sp
     1752This is useful to stop a server\'s resources being exhausted by a large number of inactive connections\.
     1753.sp
     1754Most clients have an auto\-reconnect feature when a connection is broken so in most cases this parameter should be transparent to users\.
     1755.sp
     1756Using this parameter with a timeout of a few minutes is recommended for most systems\.
     1757.sp
     1758A deadtime of zero indicates that no auto\-disconnection should be performed\.
     1759.sp
     1760Default:
     1761\fI\fIdeadtime\fR\fR\fI = \fR\fI0\fR\fI \fR
     1762.sp
     1763Example:
     1764\fI\fIdeadtime\fR\fR\fI = \fR\fI15\fR\fI \fR
     1765.RE
     1766
    15281767debug hires timestamp (G)
    1529 .RS 3n
    1530 Sometimes the timestamps in the log messages are needed with a resolution of higher that seconds, this boolean parameter adds microsecond resolution to the timestamp message header when turned on.
     1768.PP
     1769.RS 4
     1770Sometimes the timestamps in the log messages are needed with a resolution of higher that seconds, this boolean parameter adds microsecond resolution to the timestamp message header when turned on\.
    15311771.sp
    15321772Note that the parameter
    1533 debug timestamp must be on for this to have an effect.
    1534 .sp
    1535 Default:
    1536 \fB\fIdebug hires timestamp\fR = no \fR
    1537 .RE
    1538 .PP
     1773\fIdebug timestamp\fR
     1774must be on for this to have an effect\.
     1775.sp
     1776Default:
     1777\fI\fIdebug hires timestamp\fR\fR\fI = \fR\fIno\fR\fI \fR
     1778.RE
     1779
    15391780debug pid (G)
    1540 .RS 3n
     1781.PP
     1782.RS 4
    15411783When using only one log file for more then one forked
    1542 \fBsmbd\fR(8)-process there may be hard to follow which process outputs which message. This boolean parameter is adds the process-id to the timestamp message headers in the logfile when turned on.
     1784\fBsmbd\fR(8)\-process there may be hard to follow which process outputs which message\. This boolean parameter is adds the process\-id to the timestamp message headers in the logfile when turned on\.
    15431785.sp
    15441786Note that the parameter
    1545 debug timestamp must be on for this to have an effect.
    1546 .sp
    1547 Default:
    1548 \fB\fIdebug pid\fR = no \fR
    1549 .RE
    1550 .PP
     1787\fIdebug timestamp\fR
     1788must be on for this to have an effect\.
     1789.sp
     1790Default:
     1791\fI\fIdebug pid\fR\fR\fI = \fR\fIno\fR\fI \fR
     1792.RE
     1793
    15511794debug prefix timestamp (G)
    1552 .RS 3n
     1795.PP
     1796.RS 4
    15531797With this option enabled, the timestamp message header is prefixed to the debug message without the filename and function information that is included with the
    1554 debug timestamp parameter. This gives timestamps to the messages without adding an additional line.
     1798\fIdebug timestamp\fR
     1799parameter\. This gives timestamps to the messages without adding an additional line\.
    15551800.sp
    15561801Note that this parameter overrides the
    1557 debug timestamp parameter.
    1558 .sp
    1559 Default:
    1560 \fB\fIdebug prefix timestamp\fR = no \fR
    1561 .RE
    1562 .PP
    1563 timestamp logs
    1564 .RS 3n
    1565 This parameter is a synonym for debug timestamp.
    1566 .RE
    1567 .PP
     1802\fIdebug timestamp\fR
     1803parameter\.
     1804.sp
     1805Default:
     1806\fI\fIdebug prefix timestamp\fR\fR\fI = \fR\fIno\fR\fI \fR
     1807.RE
     1808timestamp logs.PP
     1809.RS 4
     1810This parameter is a synonym for
     1811debug timestamp\.
     1812.RE
     1813
    15681814debug timestamp (G)
    1569 .RS 3n
    1570 Samba debug log messages are timestamped by default. If you are running at a high
    1571 debug level these timestamps can be distracting. This boolean parameter allows timestamping to be turned off.
    1572 .sp
    1573 Default:
    1574 \fB\fIdebug timestamp\fR = yes \fR
    1575 .RE
    1576 .PP
     1815.PP
     1816.RS 4
     1817Samba debug log messages are timestamped by default\. If you are running at a high
     1818\fIdebug level\fR
     1819these timestamps can be distracting\. This boolean parameter allows timestamping to be turned off\.
     1820.sp
     1821Default:
     1822\fI\fIdebug timestamp\fR\fR\fI = \fR\fIyes\fR\fI \fR
     1823.RE
     1824
    15771825debug uid (G)
    1578 .RS 3n
    1579 Samba is sometimes run as root and sometime run as the connected user, this boolean parameter inserts the current euid, egid, uid and gid to the timestamp message headers in the log file if turned on.
     1826.PP
     1827.RS 4
     1828Samba is sometimes run as root and sometime run as the connected user, this boolean parameter inserts the current euid, egid, uid and gid to the timestamp message headers in the log file if turned on\.
    15801829.sp
    15811830Note that the parameter
    1582 debug timestamp must be on for this to have an effect.
    1583 .sp
    1584 Default:
    1585 \fB\fIdebug uid\fR = no \fR
    1586 .RE
    1587 .PP
     1831\fIdebug timestamp\fR
     1832must be on for this to have an effect\.
     1833.sp
     1834Default:
     1835\fI\fIdebug uid\fR\fR\fI = \fR\fIno\fR\fI \fR
     1836.RE
     1837
    15881838default case (S)
    1589 .RS 3n
     1839.PP
     1840.RS 4
    15901841See the section on
    1591 name mangling. Also note the
    1592 short preserve case parameter.
    1593 .sp
    1594 Default:
    1595 \fB\fIdefault case\fR = lower \fR
    1596 .RE
    1597 .PP
     1842\fIname mangling\fR\. Also note the
     1843\fIshort preserve case\fR
     1844parameter\.
     1845.sp
     1846Default:
     1847\fI\fIdefault case\fR\fR\fI = \fR\fIlower\fR\fI \fR
     1848.RE
     1849
    15981850default devmode (S)
    1599 .RS 3n
     1851.PP
     1852.RS 4
    16001853This parameter is only applicable to
    1601 printable services. When smbd is serving Printer Drivers to Windows NT/2k/XP clients, each printer on the Samba server has a Device Mode which defines things such as paper size and orientation and duplex settings. The device mode can only correctly be generated by the printer driver itself (which can only be executed on a Win32 platform). Because smbd is unable to execute the driver code to generate the device mode, the default behavior is to set this field to NULL.
    1602 .sp
    1603 Most problems with serving printer drivers to Windows NT/2k/XP clients can be traced to a problem with the generated device mode. Certain drivers will do things such as crashing the client's Explorer.exe with a NULL devmode. However, other printer drivers can cause the client's spooler service (spoolsv.exe) to die if the devmode was not created by the driver itself (i.e. smbd generates a default devmode).
    1604 .sp
    1605 This parameter should be used with care and tested with the printer driver in question. It is better to leave the device mode to NULL and let the Windows client set the correct values. Because drivers do not do this all the time, setting
     1854\fIprintable\fR
     1855services\. When smbd is serving Printer Drivers to Windows NT/2k/XP clients, each printer on the Samba server has a Device Mode which defines things such as paper size and orientation and duplex settings\. The device mode can only correctly be generated by the printer driver itself (which can only be executed on a Win32 platform)\. Because smbd is unable to execute the driver code to generate the device mode, the default behavior is to set this field to NULL\.
     1856.sp
     1857Most problems with serving printer drivers to Windows NT/2k/XP clients can be traced to a problem with the generated device mode\. Certain drivers will do things such as crashing the client\'s Explorer\.exe with a NULL devmode\. However, other printer drivers can cause the client\'s spooler service (spoolsv\.exe) to die if the devmode was not created by the driver itself (i\.e\. smbd generates a default devmode)\.
     1858.sp
     1859This parameter should be used with care and tested with the printer driver in question\. It is better to leave the device mode to NULL and let the Windows client set the correct values\. Because drivers do not do this all the time, setting
    16061860default devmode = yes
    1607 will instruct smbd to generate a default one.
     1861will instruct smbd to generate a default one\.
    16081862.sp
    16091863For more information on Windows NT/2k printing and Device Modes, see the
    1610 MSDN documentation.
    1611 .sp
    1612 Default:
    1613 \fB\fIdefault devmode\fR = yes \fR
    1614 .RE
    1615 .PP
    1616 default
    1617 .RS 3n
    1618 This parameter is a synonym for default service.
    1619 .RE
    1620 .PP
     1864MSDN documentation\.
     1865.sp
     1866Default:
     1867\fI\fIdefault devmode\fR\fR\fI = \fR\fIyes\fR\fI \fR
     1868.RE
     1869default.PP
     1870.RS 4
     1871This parameter is a synonym for
     1872default service\.
     1873.RE
     1874
    16211875default service (G)
    1622 .RS 3n
    1623 This parameter specifies the name of a service which will be connected to if the service actually requested cannot be found. Note that the square brackets are
    1624 \fBNOT\fR
    1625 given in the parameter value (see example below).
    1626 .sp
    1627 There is no default value for this parameter. If this parameter is not given, attempting to connect to a nonexistent service results in an error.
     1876.PP
     1877.RS 4
     1878This parameter specifies the name of a service which will be connected to if the service actually requested cannot be found\. Note that the square brackets are
     1879\fINOT\fR
     1880given in the parameter value (see example below)\.
     1881.sp
     1882There is no default value for this parameter\. If this parameter is not given, attempting to connect to a nonexistent service results in an error\.
    16281883.sp
    16291884Typically the default service would be a
    1630 guest ok,
    1631 read-only service.
     1885\fIguest ok\fR,
     1886\fIread\-only\fR
     1887service\.
    16321888.sp
    16331889Also note that the apparent service name will be changed to equal that of the requested service, this is very useful as it allows you to use macros like
    16341890\fI%S\fR
    1635 to make a wildcard service.
    1636 .sp
    1637 Note also that any "_" characters in the name of the service used in the default service will get mapped to a "/". This allows for interesting things.
    1638 .sp
    1639 Default:
    1640 \fB\fIdefault service\fR = \fR
    1641 .sp
    1642 Example:
    1643 \fB\fIdefault service\fR = pub \fR
    1644 .RE
    1645 .PP
     1891to make a wildcard service\.
     1892.sp
     1893Note also that any "_" characters in the name of the service used in the default service will get mapped to a "/"\. This allows for interesting things\.
     1894.sp
     1895Default:
     1896\fI\fIdefault service\fR\fR\fI = \fR\fI\fR\fI \fR
     1897.sp
     1898Example:
     1899\fI\fIdefault service\fR\fR\fI = \fR\fIpub\fR\fI \fR
     1900.RE
     1901
    16461902defer sharing violations (G)
    1647 .RS 3n
    1648 Windows allows specifying how a file will be shared with other processes when it is opened. Sharing violations occur when a file is opened by a different process using options that violate the share settings specified by other processes. This parameter causes smbd to act as a Windows server does, and defer returning a "sharing violation" error message for up to one second, allowing the client to close the file causing the violation in the meantime.
    1649 .sp
    1650 UNIX by default does not have this behaviour.
    1651 .sp
    1652 There should be no reason to turn off this parameter, as it is designed to enable Samba to more correctly emulate Windows.
    1653 .sp
    1654 Default:
    1655 \fB\fIdefer sharing violations\fR = True \fR
    1656 .RE
    1657 .PP
     1903.PP
     1904.RS 4
     1905Windows allows specifying how a file will be shared with other processes when it is opened\. Sharing violations occur when a file is opened by a different process using options that violate the share settings specified by other processes\. This parameter causes smbd to act as a Windows server does, and defer returning a "sharing violation" error message for up to one second, allowing the client to close the file causing the violation in the meantime\.
     1906.sp
     1907UNIX by default does not have this behaviour\.
     1908.sp
     1909There should be no reason to turn off this parameter, as it is designed to enable Samba to more correctly emulate Windows\.
     1910.sp
     1911Default:
     1912\fI\fIdefer sharing violations\fR\fR\fI = \fR\fITrue\fR\fI \fR
     1913.RE
     1914
    16581915delete group script (G)
    1659 .RS 3n
     1916.PP
     1917.RS 4
    16601918This is the full pathname to a script that will be run
    1661 \fBAS ROOT\fR
     1919\fIAS ROOT\fR
    16621920\fBsmbd\fR(8)
    1663 when a group is requested to be deleted. It will expand any
     1921when a group is requested to be deleted\. It will expand any
    16641922\fI%g\fR
    1665 to the group name passed. This script is only useful for installations using the Windows NT domain administration tools.
    1666 .sp
    1667 Default:
    1668 \fB\fIdelete group script\fR = \fR
    1669 .RE
    1670 .PP
     1923to the group name passed\. This script is only useful for installations using the Windows NT domain administration tools\.
     1924.sp
     1925Default:
     1926\fI\fIdelete group script\fR\fR\fI = \fR\fI\fR\fI \fR
     1927.RE
     1928
    16711929deleteprinter command (G)
    1672 .RS 3n
    1673 With the introduction of MS-RPC based printer support for Windows NT/2000 clients in Samba 2.2, it is now possible to delete printer at run time by issuing the DeletePrinter() RPC call.
    1674 .sp
    1675 For a Samba host this means that the printer must be physically deleted from underlying printing system. The
    1676 deleteprinter command defines a script to be run which will perform the necessary operations for removing the printer from the print system and from
    1677 \fIsmb.conf\fR.
     1930.PP
     1931.RS 4
     1932With the introduction of MS\-RPC based printer support for Windows NT/2000 clients in Samba 2\.2, it is now possible to delete printer at run time by issuing the DeletePrinter() RPC call\.
     1933.sp
     1934For a Samba host this means that the printer must be physically deleted from underlying printing system\. The
     1935\fIdeleteprinter command\fR
     1936defines a script to be run which will perform the necessary operations for removing the printer from the print system and from
     1937\fIsmb\.conf\fR\.
    16781938.sp
    16791939The
    1680 deleteprinter command is automatically called with only one parameter:
    1681 printer name.
     1940\fIdeleteprinter command\fR
     1941is automatically called with only one parameter:
     1942\fIprinter name\fR\.
    16821943.sp
    16831944Once the
    1684 deleteprinter command has been executed,
     1945\fIdeleteprinter command\fR
     1946has been executed,
    16851947smbd
    16861948will reparse the
    1687 \fI smb.conf\fR
    1688 to associated printer no longer exists. If the sharename is still valid, then
     1949\fI smb\.conf\fR
     1950to associated printer no longer exists\. If the sharename is still valid, then
    16891951smbd
    1690 will return an ACCESS_DENIED error to the client.
    1691 .sp
    1692 Default:
    1693 \fB\fIdeleteprinter command\fR = \fR
    1694 .sp
    1695 Example:
    1696 \fB\fIdeleteprinter command\fR = /usr/bin/removeprinter \fR
    1697 .RE
    1698 .PP
     1952will return an ACCESS_DENIED error to the client\.
     1953.sp
     1954Default:
     1955\fI\fIdeleteprinter command\fR\fR\fI = \fR\fI\fR\fI \fR
     1956.sp
     1957Example:
     1958\fI\fIdeleteprinter command\fR\fR\fI = \fR\fI/usr/bin/removeprinter\fR\fI \fR
     1959.RE
     1960
    16991961delete readonly (S)
    1700 .RS 3n
    1701 This parameter allows readonly files to be deleted. This is not normal DOS semantics, but is allowed by UNIX.
    1702 .sp
    1703 This option may be useful for running applications such as rcs, where UNIX file ownership prevents changing file permissions, and DOS semantics prevent deletion of a read only file.
    1704 .sp
    1705 Default:
    1706 \fB\fIdelete readonly\fR = no \fR
    1707 .RE
    1708 .PP
     1962.PP
     1963.RS 4
     1964This parameter allows readonly files to be deleted\. This is not normal DOS semantics, but is allowed by UNIX\.
     1965.sp
     1966This option may be useful for running applications such as rcs, where UNIX file ownership prevents changing file permissions, and DOS semantics prevent deletion of a read only file\.
     1967.sp
     1968Default:
     1969\fI\fIdelete readonly\fR\fR\fI = \fR\fIno\fR\fI \fR
     1970.RE
     1971
    17091972delete share command (G)
    1710 .RS 3n
    1711 Samba 2.2.0 introduced the ability to dynamically add and delete shares via the Windows NT 4.0 Server Manager. The
     1973.PP
     1974.RS 4
     1975Samba 2\.2\.0 introduced the ability to dynamically add and delete shares via the Windows NT 4\.0 Server Manager\. The
    17121976\fIdelete share command\fR
    17131977is used to define an external program or script which will remove an existing service definition from
    1714 \fIsmb.conf\fR. In order to successfully execute the
     1978\fIsmb\.conf\fR\. In order to successfully execute the
    17151979\fIdelete share command\fR,
    17161980smbd
    1717 requires that the administrator be connected using a root account (i.e. uid == 0).
     1981requires that the administrator be connected using a root account (i\.e\. uid == 0)\.
     1982.sp
     1983If the connected account has
     1984SeDiskOperatorPrivilege, scripts defined in
     1985\fIchange share\fR
     1986parameter are executed as root\.
    17181987.sp
    17191988When executed,
    … …  
    17211990will automatically invoke the
    17221991\fIdelete share command\fR
    1723 with two parameters.
    1724 .RS 3n
    1725 .TP 3n
    1726 \(bu
     1992with two parameters\.
     1993.sp
     1994.RS 4
     1995.ie n \{\
     1996\h'-04'\(bu\h'+03'\c
     1997.\}
     1998.el \{\
     1999.sp -1
     2000.IP \(bu 2.3
     2001.\}
    17272002\fIconfigFile\fR
    1728 - the location of the global
    1729 \fIsmb.conf\fR
    1730 file.
    1731 .TP 3n
    1732 \(bu
     2003\- the location of the global
     2004\fIsmb\.conf\fR
     2005file\.
     2006.RE
     2007.sp
     2008.RS 4
     2009.ie n \{\
     2010\h'-04'\(bu\h'+03'\c
     2011.\}
     2012.el \{\
     2013.sp -1
     2014.IP \(bu 2.3
     2015.\}
    17332016\fIshareName\fR
    1734 - the name of the existing service.
    1735 .RE
    1736 .IP "" 3n
    1737 This parameter is only used to remove file shares. To delete printer shares, see the
    1738 deleteprinter command.
    1739 .sp
    1740 Default:
    1741 \fB\fIdelete share command\fR = \fR
    1742 .sp
    1743 Example:
    1744 \fB\fIdelete share command\fR = /usr/local/bin/delshare \fR
    1745 .RE
    1746 .PP
     2017\- the name of the existing service\.
     2018.sp
     2019.RE
     2020This parameter is only used to remove file shares\. To delete printer shares, see the
     2021\fIdeleteprinter command\fR\.
     2022.sp
     2023Default:
     2024\fI\fIdelete share command\fR\fR\fI = \fR\fI\fR\fI \fR
     2025.sp
     2026Example:
     2027\fI\fIdelete share command\fR\fR\fI = \fR\fI/usr/local/bin/delshare\fR\fI \fR
     2028.RE
     2029
    17472030delete user from group script (G)
    1748 .RS 3n
    1749 Full path to the script that will be called when a user is removed from a group using the Windows NT domain administration tools. It will be run by
     2031.PP
     2032.RS 4
     2033Full path to the script that will be called when a user is removed from a group using the Windows NT domain administration tools\. It will be run by
    17502034\fBsmbd\fR(8)
    1751 \fBAS ROOT\fR. Any
     2035\fIAS ROOT\fR\. Any
    17522036\fI%g\fR
    17532037will be replaced with the group name and any
    17542038\fI%u\fR
    1755 will be replaced with the user name.
    1756 .sp
    1757 Default:
    1758 \fB\fIdelete user from group script\fR = \fR
    1759 .sp
    1760 Example:
    1761 \fB\fIdelete user from group script\fR = /usr/sbin/deluser %u %g \fR
    1762 .RE
    1763 .PP
     2039will be replaced with the user name\.
     2040.sp
     2041Default:
     2042\fI\fIdelete user from group script\fR\fR\fI = \fR\fI\fR\fI \fR
     2043.sp
     2044Example:
     2045\fI\fIdelete user from group script\fR\fR\fI = \fR\fI/usr/sbin/deluser %u %g\fR\fI \fR
     2046.RE
     2047
    17642048delete user script (G)
    1765 .RS 3n
     2049.PP
     2050.RS 4
    17662051This is the full pathname to a script that will be run by
    17672052\fBsmbd\fR(8)
    1768 when managing users with remote RPC (NT) tools.
    1769 .sp
    1770 This script is called when a remote client removes a user from the server, normally using 'User Manager for Domains' or
    1771 rpcclient.
    1772 .sp
    1773 This script should delete the given UNIX username.
    1774 .sp
    1775 Default:
    1776 \fB\fIdelete user script\fR = \fR
    1777 .sp
    1778 Example:
    1779 \fB\fIdelete user script\fR = /usr/local/samba/bin/del_user %u \fR
    1780 .RE
    1781 .PP
     2053when managing users with remote RPC (NT) tools\.
     2054.sp
     2055This script is called when a remote client removes a user from the server, normally using \'User Manager for Domains\' or
     2056rpcclient\.
     2057.sp
     2058This script should delete the given UNIX username\.
     2059.sp
     2060Default:
     2061\fI\fIdelete user script\fR\fR\fI = \fR\fI\fR\fI \fR
     2062.sp
     2063Example:
     2064\fI\fIdelete user script\fR\fR\fI = \fR\fI/usr/local/samba/bin/del_user %u\fR\fI \fR
     2065.RE
     2066
    17822067delete veto files (S)
    1783 .RS 3n
     2068.PP
     2069.RS 4
    17842070This option is used when Samba is attempting to delete a directory that contains one or more vetoed directories (see the
    1785 veto files option). If this option is set to
     2071\fIveto files\fR
     2072option)\. If this option is set to
    17862073\fBno\fR
    1787 (the default) then if a vetoed directory contains any non-vetoed files or directories then the directory delete will fail. This is usually what you want.
     2074(the default) then if a vetoed directory contains any non\-vetoed files or directories then the directory delete will fail\. This is usually what you want\.
    17882075.sp
    17892076If this option is set to
    1790 \fByes\fR, then Samba will attempt to recursively delete any files and directories within the vetoed directory. This can be useful for integration with file serving systems such as NetAtalk which create meta-files within directories you might normally veto DOS/Windows users from seeing (e.g.
    1791 \fI.AppleDouble\fR)
     2077\fByes\fR, then Samba will attempt to recursively delete any files and directories within the vetoed directory\. This can be useful for integration with file serving systems such as NetAtalk which create meta\-files within directories you might normally veto DOS/Windows users from seeing (e\.g\.
     2078\fI\.AppleDouble\fR)
    17922079.sp
    17932080Setting
    1794 delete veto files = yes allows these directories to be transparently deleted when the parent directory is deleted (so long as the user has permissions to do so).
    1795 .sp
    1796 Default:
    1797 \fB\fIdelete veto files\fR = no \fR
    1798 .RE
    1799 .PP
     2081\fIdelete veto files = yes\fR
     2082allows these directories to be transparently deleted when the parent directory is deleted (so long as the user has permissions to do so)\.
     2083.sp
     2084Default:
     2085\fI\fIdelete veto files\fR\fR\fI = \fR\fIno\fR\fI \fR
     2086.RE
     2087
    18002088dfree cache time (S)
    1801 .RS 3n
     2089.PP
     2090.RS 4
    18022091The
    18032092\fIdfree cache time\fR
    1804 should only be used on systems where a problem occurs with the internal disk space calculations. This has been known to happen with Ultrix, but may occur with other operating systems. The symptom that was seen was an error of "Abort Retry Ignore" at the end of each directory listing.
    1805 .sp
    1806 This is a new parameter introduced in Samba version 3.0.21. It specifies in seconds the time that smbd will cache the output of a disk free query. If set to zero (the default) no caching is done. This allows a heavily loaded server to prevent rapid spawning of
    1807 dfree command scripts increasing the load.
    1808 .sp
    1809 By default this parameter is zero, meaning no caching will be done.
    1810 .sp
    1811 \fBNo default\fR
    1812 .sp
    1813 Example:
    1814 \fB\fIdfree cache time\fR = dfree cache time = 60 \fR
    1815 .RE
    1816 .PP
     2093should only be used on systems where a problem occurs with the internal disk space calculations\. This has been known to happen with Ultrix, but may occur with other operating systems\. The symptom that was seen was an error of "Abort Retry Ignore" at the end of each directory listing\.
     2094.sp
     2095This is a new parameter introduced in Samba version 3\.0\.21\. It specifies in seconds the time that smbd will cache the output of a disk free query\. If set to zero (the default) no caching is done\. This allows a heavily loaded server to prevent rapid spawning of
     2096\fIdfree command\fR
     2097scripts increasing the load\.
     2098.sp
     2099By default this parameter is zero, meaning no caching will be done\.
     2100.sp
     2101\fINo default\fR
     2102.sp
     2103Example:
     2104\fI\fIdfree cache time\fR\fR\fI = \fR\fIdfree cache time = 60\fR\fI \fR
     2105.RE
     2106
    18172107dfree command (S)
    1818 .RS 3n
     2108.PP
     2109.RS 4
    18192110The
    18202111\fIdfree command\fR
    1821 setting should only be used on systems where a problem occurs with the internal disk space calculations. This has been known to happen with Ultrix, but may occur with other operating systems. The symptom that was seen was an error of "Abort Retry Ignore" at the end of each directory listing.
    1822 .sp
    1823 This setting allows the replacement of the internal routines to calculate the total disk space and amount available with an external routine. The example below gives a possible script that might fulfill this function.
    1824 .sp
    1825 In Samba version 3.0.21 this parameter has been changed to be a per-share parameter, and in addition the parameter
    1826 dfree cache time was added to allow the output of this script to be cached for systems under heavy load.
    1827 .sp
    1828 The external program will be passed a single parameter indicating a directory in the filesystem being queried. This will typically consist of the string
    1829 \fI./\fR. The script should return two integers in ASCII. The first should be the total disk space in blocks, and the second should be the number of available blocks. An optional third return value can give the block size in bytes. The default blocksize is 1024 bytes.
     2112setting should only be used on systems where a problem occurs with the internal disk space calculations\. This has been known to happen with Ultrix, but may occur with other operating systems\. The symptom that was seen was an error of "Abort Retry Ignore" at the end of each directory listing\.
     2113.sp
     2114This setting allows the replacement of the internal routines to calculate the total disk space and amount available with an external routine\. The example below gives a possible script that might fulfill this function\.
     2115.sp
     2116In Samba version 3\.0\.21 this parameter has been changed to be a per\-share parameter, and in addition the parameter
     2117\fIdfree cache time\fR
     2118was added to allow the output of this script to be cached for systems under heavy load\.
     2119.sp
     2120The external program will be passed a single parameter indicating a directory in the filesystem being queried\. This will typically consist of the string
     2121\fI\./\fR\. The script should return two integers in ASCII\. The first should be the total disk space in blocks, and the second should be the number of available blocks\. An optional third return value can give the block size in bytes\. The default blocksize is 1024 bytes\.
    18302122.sp
    18312123Note: Your script should
    1832 \fBNOT\fR
     2124\fINOT\fR
    18332125be setuid or setgid and should be owned by (and writeable only by) root!
    18342126.sp
    18352127Where the script dfree (which must be made executable) could be:
    1836 
    1837 .sp
    1838 
     2128.sp
     2129.RS 4
    18392130.nf
    18402131 
    18412132#!/bin/sh
    1842 df $1 | tail -1 | awk '{print $2" "$4}'
    1843 
     2133df $1 | tail \-1 | awk \'{print $(NF\-4),$(NF\-2)}\'
    18442134.fi
     2135.RE
     2136.sp
    18452137or perhaps (on Sys V based systems):
    1846 
    1847 .sp
    1848 
     2138.sp
     2139.RS 4
    18492140.nf
    18502141 
    18512142#!/bin/sh
    1852 /usr/bin/df -k $1 | tail -1 | awk '{print $3" "$5}'
    1853 
     2143/usr/bin/df \-k $1 | tail \-1 | awk \'{print $3" "$5}\'
    18542144.fi
    1855 Note that you may have to replace the command names with full path names on some systems.
    1856 .sp
    1857 By default internal routines for determining the disk capacity and remaining space will be used.
    1858 .sp
    1859 \fBNo default\fR
    1860 .sp
    1861 Example:
    1862 \fB\fIdfree command\fR = /usr/local/samba/bin/dfree \fR
    1863 .RE
    1864 .PP
    1865 directory mode
    1866 .RS 3n
    1867 This parameter is a synonym for directory mask.
    1868 .RE
    1869 .PP
     2145.RE
     2146.sp
     2147Note that you may have to replace the command names with full path names on some systems\.
     2148.sp
     2149By default internal routines for determining the disk capacity and remaining space will be used\.
     2150.sp
     2151\fINo default\fR
     2152.sp
     2153Example:
     2154\fI\fIdfree command\fR\fR\fI = \fR\fI/usr/local/samba/bin/dfree\fR\fI \fR
     2155.RE
     2156directory mode.PP
     2157.RS 4
     2158This parameter is a synonym for
     2159directory mask\.
     2160.RE
     2161
    18702162directory mask (S)
    1871 .RS 3n
    1872 This parameter is the octal modes which are used when converting DOS modes to UNIX modes when creating UNIX directories.
    1873 .sp
    1874 When a directory is created, the necessary permissions are calculated according to the mapping from DOS modes to UNIX permissions, and the resulting UNIX mode is then bit-wise 'AND'ed with this parameter. This parameter may be thought of as a bit-wise MASK for the UNIX modes of a directory. Any bit
    1875 \fBnot\fR
    1876 set here will be removed from the modes set on a directory when it is created.
    1877 .sp
    1878 The default value of this parameter removes the 'group' and 'other' write bits from the UNIX mode, allowing only the user who owns the directory to modify it.
    1879 .sp
    1880 Following this Samba will bit-wise 'OR' the UNIX mode created from this parameter with the value of the
    1881 force directory mode parameter. This parameter is set to 000 by default (i.e. no extra mode bits are added).
    1882 .sp
    1883 Note that this parameter does not apply to permissions set by Windows NT/2000 ACL editors. If the administrator wishes to enforce a mask on access control lists also, they need to set the
    1884 directory security mask.
    1885 .sp
    1886 Default:
    1887 \fB\fIdirectory mask\fR = 0755 \fR
    1888 .sp
    1889 Example:
    1890 \fB\fIdirectory mask\fR = 0775 \fR
    1891 .RE
    1892 .PP
     2163.PP
     2164.RS 4
     2165This parameter is the octal modes which are used when converting DOS modes to UNIX modes when creating UNIX directories\.
     2166.sp
     2167When a directory is created, the necessary permissions are calculated according to the mapping from DOS modes to UNIX permissions, and the resulting UNIX mode is then bit\-wise \'AND\'ed with this parameter\. This parameter may be thought of as a bit\-wise MASK for the UNIX modes of a directory\. Any bit
     2168\fInot\fR
     2169set here will be removed from the modes set on a directory when it is created\.
     2170.sp
     2171The default value of this parameter removes the \'group\' and \'other\' write bits from the UNIX mode, allowing only the user who owns the directory to modify it\.
     2172.sp
     2173Following this Samba will bit\-wise \'OR\' the UNIX mode created from this parameter with the value of the
     2174\fIforce directory mode\fR
     2175parameter\. This parameter is set to 000 by default (i\.e\. no extra mode bits are added)\.
     2176.sp
     2177Note that this parameter does not apply to permissions set by Windows NT/2000 ACL editors\. If the administrator wishes to enforce a mask on access control lists also, they need to set the
     2178\fIdirectory security mask\fR\.
     2179.sp
     2180Default:
     2181\fI\fIdirectory mask\fR\fR\fI = \fR\fI0755\fR\fI \fR
     2182.sp
     2183Example:
     2184\fI\fIdirectory mask\fR\fR\fI = \fR\fI0775\fR\fI \fR
     2185.RE
     2186
    18932187directory security mask (S)
    1894 .RS 3n
    1895 This parameter controls what UNIX permission bits can be modified when a Windows NT client is manipulating the UNIX permission on a directory using the native NT security dialog box.
    1896 .sp
    1897 This parameter is applied as a mask (AND'ed with) to the changed permission bits, thus preventing any bits not in this mask from being modified. Make sure not to mix up this parameter with
    1898 force directory security mode, which works similar like this one but uses logical OR instead of AND. Essentially, zero bits in this mask may be treated as a set of bits the user is not allowed to change.
    1899 .sp
    1900 If not set explicitly this parameter is set to 0777 meaning a user is allowed to modify all the user/group/world permissions on a directory.
    1901 .sp
    1902 \fBNote\fR
    1903 that users who can access the Samba server through other means can easily bypass this restriction, so it is primarily useful for standalone "appliance" systems. Administrators of most normal systems will probably want to leave it as the default of
    1904 \fB0777\fR.
    1905 .sp
    1906 Default:
    1907 \fB\fIdirectory security mask\fR = 0777 \fR
    1908 .sp
    1909 Example:
    1910 \fB\fIdirectory security mask\fR = 0700 \fR
    1911 .RE
    1912 .PP
     2188.PP
     2189.RS 4
     2190This parameter controls what UNIX permission bits will be set when a Windows NT client is manipulating the UNIX permission on a directory using the native NT security dialog box\.
     2191.sp
     2192This parameter is applied as a mask (AND\'ed with) to the incoming permission bits, thus resetting any bits not in this mask\. Make sure not to mix up this parameter with
     2193\fIforce directory security mode\fR, which works similar like this one but uses logical OR instead of AND\. Essentially, zero bits in this mask are a set of bits that will always be set to zero\.
     2194.sp
     2195Essentially, all bits set to zero in this mask will result in setting to zero the corresponding bits on the file permissions regardless of the previous status of this bits on the file\.
     2196.sp
     2197If not set explicitly this parameter is set to 0777 meaning a user is allowed to set all the user/group/world permissions on a directory\.
     2198.sp
     2199\fINote\fR
     2200that users who can access the Samba server through other means can easily bypass this restriction, so it is primarily useful for standalone "appliance" systems\. Administrators of most normal systems will probably want to leave it as the default of
     2201\fB0777\fR\.
     2202.sp
     2203Default:
     2204\fI\fIdirectory security mask\fR\fR\fI = \fR\fI0777\fR\fI \fR
     2205.sp
     2206Example:
     2207\fI\fIdirectory security mask\fR\fR\fI = \fR\fI0700\fR\fI \fR
     2208.RE
     2209
    19132210disable netbios (G)
    1914 .RS 3n
    1915 Enabling this parameter will disable netbios support in Samba. Netbios is the only available form of browsing in all windows versions except for 2000 and XP.
     2211.PP
     2212.RS 4
     2213Enabling this parameter will disable netbios support in Samba\. Netbios is the only available form of browsing in all windows versions except for 2000 and XP\.
    19162214.sp
    19172215.it 1 an-trap
    … …  
    19192217.nr an-break-flag 1
    19202218.br
    1921 \fBNote\fR
    1922 Clients that only support netbios won't be able to see your samba server when netbios support is disabled.
    1923 Default:
    1924 \fB\fIdisable netbios\fR = no \fR
    1925 .RE
    1926 .PP
     2219Note
     2220Clients that only support netbios won\'t be able to see your samba server when netbios support is disabled\.
     2221
     2222Default:
     2223\fI\fIdisable netbios\fR\fR\fI = \fR\fIno\fR\fI \fR
     2224.RE
     2225
    19272226disable spoolss (G)
    1928 .RS 3n
    1929 Enabling this parameter will disable Samba's support for the SPOOLSS set of MS-RPC's and will yield identical behavior as Samba 2.0.x. Windows NT/2000 clients will downgrade to using Lanman style printing commands. Windows 9x/ME will be unaffected by the parameter. However, this will also disable the ability to upload printer drivers to a Samba server via the Windows NT Add Printer Wizard or by using the NT printer properties dialog window. It will also disable the capability of Windows NT/2000 clients to download print drivers from the Samba host upon demand.
    1930 \fBBe very careful about enabling this parameter.\fR
    1931 .sp
    1932 Default:
    1933 \fB\fIdisable spoolss\fR = no \fR
    1934 .RE
    1935 .PP
     2227.PP
     2228.RS 4
     2229Enabling this parameter will disable Samba\'s support for the SPOOLSS set of MS\-RPC\'s and will yield identical behavior as Samba 2\.0\.x\. Windows NT/2000 clients will downgrade to using Lanman style printing commands\. Windows 9x/ME will be unaffected by the parameter\. However, this will also disable the ability to upload printer drivers to a Samba server via the Windows NT Add Printer Wizard or by using the NT printer properties dialog window\. It will also disable the capability of Windows NT/2000 clients to download print drivers from the Samba host upon demand\.
     2230\fIBe very careful about enabling this parameter\.\fR
     2231.sp
     2232Default:
     2233\fI\fIdisable spoolss\fR\fR\fI = \fR\fIno\fR\fI \fR
     2234.RE
     2235
    19362236display charset (G)
    1937 .RS 3n
    1938 Specifies the charset that samba will use to print messages to stdout and stderr. The default value is "LOCALE", which means automatically set, depending on the current locale. The value should generally be the same as the value of the parameter
    1939 unix charset.
    1940 .sp
    1941 Default:
    1942 \fB\fIdisplay charset\fR = "LOCALE" or "ASCII" (depending on the system) \fR
    1943 .sp
    1944 Example:
    1945 \fB\fIdisplay charset\fR = UTF8 \fR
    1946 .RE
    1947 .PP
     2237.PP
     2238.RS 4
     2239Specifies the charset that samba will use to print messages to stdout and stderr\. The default value is "LOCALE", which means automatically set, depending on the current locale\. The value should generally be the same as the value of the parameter
     2240\fIunix charset\fR\.
     2241.sp
     2242Default:
     2243\fI\fIdisplay charset\fR\fR\fI = \fR\fI"LOCALE" or "ASCII" (depending on the system)\fR\fI \fR
     2244.sp
     2245Example:
     2246\fI\fIdisplay charset\fR\fR\fI = \fR\fIUTF8\fR\fI \fR
     2247.RE
     2248
    19482249dmapi support (S)
    1949 .RS 3n
    1950 This parameter specifies whether Samba should use DMAPI to determine whether a file is offline or not. This would typically be used in conjunction with a hierarchical storage system that automatically migrates files to tape.
    1951 .sp
    1952 Note that Samba infers the status of a file by examining the events that a DMAPI application has registered interest in. This heuristic is satisfactory for a number of hierarchical storage systems, but there may be system for which it will fail. In this case, Samba may erroneously report files to be offline.
    1953 .sp
    1954 This parameter is only available if a supported DMAPI implementation was found at compilation time. It will only be used if DMAPI is found to enabled on the system at run time.
    1955 .sp
    1956 
    1957 .sp
    1958 Default:
    1959 \fB\fIdmapi support\fR = no \fR
    1960 .RE
    1961 .PP
     2250.PP
     2251.RS 4
     2252This parameter specifies whether Samba should use DMAPI to determine whether a file is offline or not\. This would typically be used in conjunction with a hierarchical storage system that automatically migrates files to tape\.
     2253.sp
     2254Note that Samba infers the status of a file by examining the events that a DMAPI application has registered interest in\. This heuristic is satisfactory for a number of hierarchical storage systems, but there may be system for which it will fail\. In this case, Samba may erroneously report files to be offline\.
     2255.sp
     2256This parameter is only available if a supported DMAPI implementation was found at compilation time\. It will only be used if DMAPI is found to enabled on the system at run time\.
     2257.sp
     2258.sp
     2259Default:
     2260\fI\fIdmapi support\fR\fR\fI = \fR\fIno\fR\fI \fR
     2261.RE
     2262
    19622263dns proxy (G)
    1963 .RS 3n
     2264.PP
     2265.RS 4
    19642266Specifies that
    19652267\fBnmbd\fR(8)
    1966 when acting as a WINS server and finding that a NetBIOS name has not been registered, should treat the NetBIOS name word-for-word as a DNS name and do a lookup with the DNS server for that name on behalf of the name-querying client.
    1967 .sp
    1968 Note that the maximum length for a NetBIOS name is 15 characters, so the DNS name (or DNS alias) can likewise only be 15 characters, maximum.
     2268when acting as a WINS server and finding that a NetBIOS name has not been registered, should treat the NetBIOS name word\-for\-word as a DNS name and do a lookup with the DNS server for that name on behalf of the name\-querying client\.
     2269.sp
     2270Note that the maximum length for a NetBIOS name is 15 characters, so the DNS name (or DNS alias) can likewise only be 15 characters, maximum\.
    19692271.sp
    19702272nmbd
    1971 spawns a second copy of itself to do the DNS name lookup requests, as doing a name lookup is a blocking action.
    1972 .sp
    1973 Default:
    1974 \fB\fIdns proxy\fR = yes \fR
    1975 .RE
    1976 .PP
     2273spawns a second copy of itself to do the DNS name lookup requests, as doing a name lookup is a blocking action\.
     2274.sp
     2275Default:
     2276\fI\fIdns proxy\fR\fR\fI = \fR\fIyes\fR\fI \fR
     2277.RE
     2278
    19772279domain logons (G)
    1978 .RS 3n
     2280.PP
     2281.RS 4
    19792282If set to
    19802283\fByes\fR, the Samba server will provide the netlogon service for Windows 9X network logons for the
    1981 workgroup it is in. This will also cause the Samba server to act as a domain controller for NT4 style domain services. For more details on setting up this feature see the Domain Control chapter of the Samba HOWTO Collection.
    1982 .sp
    1983 Default:
    1984 \fB\fIdomain logons\fR = no \fR
    1985 .RE
    1986 .PP
     2284\fIworkgroup\fR
     2285it is in\. This will also cause the Samba server to act as a domain controller for NT4 style domain services\. For more details on setting up this feature see the Domain Control chapter of the Samba HOWTO Collection\.
     2286.sp
     2287Default:
     2288\fI\fIdomain logons\fR\fR\fI = \fR\fIno\fR\fI \fR
     2289.RE
     2290
    19872291domain master (G)
    1988 .RS 3n
     2292.PP
     2293.RS 4
    19892294Tell
    19902295\fBsmbd\fR(8)
    1991 to enable WAN-wide browse list collation. Setting this option causes
     2296to enable WAN\-wide browse list collation\. Setting this option causes
    19922297nmbd
    19932298to claim a special domain specific NetBIOS name that identifies it as a domain master browser for its given
    1994 workgroup. Local master browsers in the same
    1995 workgroup on broadcast-isolated subnets will give this
     2299\fIworkgroup\fR\. Local master browsers in the same
     2300\fIworkgroup\fR
     2301on broadcast\-isolated subnets will give this
    19962302nmbd
    19972303their local browse lists, and then ask
    19982304\fBsmbd\fR(8)
    1999 for a complete copy of the browse list for the whole wide area network. Browser clients will then contact their local master browser, and will receive the domain-wide browse list, instead of just the list for their broadcast-isolated subnet.
     2305for a complete copy of the browse list for the whole wide area network\. Browser clients will then contact their local master browser, and will receive the domain\-wide browse list, instead of just the list for their broadcast\-isolated subnet\.
    20002306.sp
    20012307Note that Windows NT Primary Domain Controllers expect to be able to claim this
    2002 workgroup specific special NetBIOS name that identifies them as domain master browsers for that
    2003 workgroup by default (i.e. there is no way to prevent a Windows NT PDC from attempting to do this). This means that if this parameter is set and
     2308\fIworkgroup\fR
     2309specific special NetBIOS name that identifies them as domain master browsers for that
     2310\fIworkgroup\fR
     2311by default (i\.e\. there is no way to prevent a Windows NT PDC from attempting to do this)\. This means that if this parameter is set and
    20042312nmbd
    20052313claims the special name for a
    2006 workgroup before a Windows NT PDC is able to do so then cross subnet browsing will behave strangely and may fail.
     2314\fIworkgroup\fR
     2315before a Windows NT PDC is able to do so then cross subnet browsing will behave strangely and may fail\.
    20072316.sp
    20082317If
    2009 domain logons = yes, then the default behavior is to enable the
    2010 domain master parameter. If
    2011 domain logons is not enabled (the default setting), then neither will
    2012 domain master be enabled by default.
     2318\fIdomain logons = yes\fR, then the default behavior is to enable the
     2319\fIdomain master\fR
     2320parameter\. If
     2321\fIdomain logons\fR
     2322is not enabled (the default setting), then neither will
     2323\fIdomain master\fR
     2324be enabled by default\.
    20132325.sp
    20142326When
    2015 domain logons = Yes the default setting for this parameter is Yes, with the result that Samba will be a PDC. If
    2016 domain master = No, Samba will function as a BDC. In general, this parameter should be set to 'No' only on a BDC.
    2017 .sp
    2018 Default:
    2019 \fB\fIdomain master\fR = auto \fR
    2020 .RE
    2021 .PP
     2327\fIdomain logons = Yes\fR
     2328the default setting for this parameter is Yes, with the result that Samba will be a PDC\. If
     2329\fIdomain master = No\fR, Samba will function as a BDC\. In general, this parameter should be set to \'No\' only on a BDC\.
     2330.sp
     2331Default:
     2332\fI\fIdomain master\fR\fR\fI = \fR\fIauto\fR\fI \fR
     2333.RE
     2334
    20222335dont descend (S)
    2023 .RS 3n
    2024 There are certain directories on some systems (e.g., the
     2336.PP
     2337.RS 4
     2338There are certain directories on some systems (e\.g\., the
    20252339\fI/proc\fR
    2026 tree under Linux) that are either not of interest to clients or are infinitely deep (recursive). This parameter allows you to specify a comma-delimited list of directories that the server should always show as empty.
    2027 .sp
    2028 Note that Samba can be very fussy about the exact format of the "dont descend" entries. For example you may need
    2029 \fI ./proc\fR
     2340tree under Linux) that are either not of interest to clients or are infinitely deep (recursive)\. This parameter allows you to specify a comma\-delimited list of directories that the server should always show as empty\.
     2341.sp
     2342Note that Samba can be very fussy about the exact format of the "dont descend" entries\. For example you may need
     2343\fI \./proc\fR
    20302344instead of just
    2031 \fI/proc\fR. Experimentation is the best policy :-)
    2032 .sp
    2033 Default:
    2034 \fB\fIdont descend\fR = \fR
    2035 .sp
    2036 Example:
    2037 \fB\fIdont descend\fR = /proc,/dev \fR
    2038 .RE
    2039 .PP
     2345\fI/proc\fR\. Experimentation is the best policy :\-)
     2346.sp
     2347Default:
     2348\fI\fIdont descend\fR\fR\fI = \fR\fI\fR\fI \fR
     2349.sp
     2350Example:
     2351\fI\fIdont descend\fR\fR\fI = \fR\fI/proc,/dev\fR\fI \fR
     2352.RE
     2353
    20402354dos charset (G)
    2041 .RS 3n
    2042 DOS SMB clients assume the server has the same charset as they do. This option specifies which charset Samba should talk to DOS clients.
    2043 .sp
    2044 The default depends on which charsets you have installed. Samba tries to use charset 850 but falls back to ASCII in case it is not available. Run
     2355.PP
     2356.RS 4
     2357DOS SMB clients assume the server has the same charset as they do\. This option specifies which charset Samba should talk to DOS clients\.
     2358.sp
     2359The default depends on which charsets you have installed\. Samba tries to use charset 850 but falls back to ASCII in case it is not available\. Run
    20452360\fBtestparm\fR(1)
    2046 to check the default on your system.
    2047 .sp
    2048 \fBNo default\fR
    2049 .RE
    2050 .PP
     2361to check the default on your system\.
     2362.sp
     2363\fINo default\fR
     2364.RE
     2365
    20512366dos filemode (S)
    2052 .RS 3n
    2053 The default behavior in Samba is to provide UNIX-like behavior where only the owner of a file/directory is able to change the permissions on it. However, this behavior is often confusing to DOS/Windows users. Enabling this parameter allows a user who has write access to the file (by whatever means) to modify the permissions (including ACL) on it. Note that a user belonging to the group owning the file will not be allowed to change permissions if the group is only granted read access. Ownership of the file/directory may also be changed.
    2054 .sp
    2055 Default:
    2056 \fB\fIdos filemode\fR = no \fR
    2057 .RE
    2058 .PP
     2367.PP
     2368.RS 4
     2369The default behavior in Samba is to provide UNIX\-like behavior where only the owner of a file/directory is able to change the permissions on it\. However, this behavior is often confusing to DOS/Windows users\. Enabling this parameter allows a user who has write access to the file (by whatever means) to modify the permissions (including ACL) on it\. Note that a user belonging to the group owning the file will not be allowed to change permissions if the group is only granted read access\. Ownership of the file/directory may also be changed\.
     2370.sp
     2371Default:
     2372\fI\fIdos filemode\fR\fR\fI = \fR\fIno\fR\fI \fR
     2373.RE
     2374
    20592375dos filetime resolution (S)
    2060 .RS 3n
    2061 Under the DOS and Windows FAT filesystem, the finest granularity on time resolution is two seconds. Setting this parameter for a share causes Samba to round the reported time down to the nearest two second boundary when a query call that requires one second resolution is made to
    2062 \fBsmbd\fR(8).
    2063 .sp
    2064 This option is mainly used as a compatibility option for Visual C++ when used against Samba shares. If oplocks are enabled on a share, Visual C++ uses two different time reading calls to check if a file has changed since it was last read. One of these calls uses a one-second granularity, the other uses a two second granularity. As the two second call rounds any odd second down, then if the file has a timestamp of an odd number of seconds then the two timestamps will not match and Visual C++ will keep reporting the file has changed. Setting this option causes the two timestamps to match, and Visual C++ is happy.
    2065 .sp
    2066 Default:
    2067 \fB\fIdos filetime resolution\fR = no \fR
    2068 .RE
    2069 .PP
     2376.PP
     2377.RS 4
     2378Under the DOS and Windows FAT filesystem, the finest granularity on time resolution is two seconds\. Setting this parameter for a share causes Samba to round the reported time down to the nearest two second boundary when a query call that requires one second resolution is made to
     2379\fBsmbd\fR(8)\.
     2380.sp
     2381This option is mainly used as a compatibility option for Visual C++ when used against Samba shares\. If oplocks are enabled on a share, Visual C++ uses two different time reading calls to check if a file has changed since it was last read\. One of these calls uses a one\-second granularity, the other uses a two second granularity\. As the two second call rounds any odd second down, then if the file has a timestamp of an odd number of seconds then the two timestamps will not match and Visual C++ will keep reporting the file has changed\. Setting this option causes the two timestamps to match, and Visual C++ is happy\.
     2382.sp
     2383Default:
     2384\fI\fIdos filetime resolution\fR\fR\fI = \fR\fIno\fR\fI \fR
     2385.RE
     2386
    20702387dos filetimes (S)
    2071 .RS 3n
    2072 Under DOS and Windows, if a user can write to a file they can change the timestamp on it. Under POSIX semantics, only the owner of the file or root may change the timestamp. By default, Samba runs with POSIX semantics and refuses to change the timestamp on a file if the user
     2388.PP
     2389.RS 4
     2390Under DOS and Windows, if a user can write to a file they can change the timestamp on it\. Under POSIX semantics, only the owner of the file or root may change the timestamp\. By default, Samba runs with POSIX semantics and refuses to change the timestamp on a file if the user
    20732391smbd
    2074 is acting on behalf of is not the file owner. Setting this option to
     2392is acting on behalf of is not the file owner\. Setting this option to
    20752393\fB yes\fR
    20762394allows DOS semantics and
    20772395\fBsmbd\fR(8)
    2078 will change the file timestamp as DOS requires. Due to changes in Microsoft Office 2000 and beyond, the default for this parameter has been changed from "no" to "yes" in Samba 3.0.14 and above. Microsoft Excel will display dialog box warnings about the file being changed by another user if this parameter is not set to "yes" and files are being shared between users.
    2079 .sp
    2080 Default:
    2081 \fB\fIdos filetimes\fR = yes \fR
    2082 .RE
    2083 .PP
     2396will change the file timestamp as DOS requires\. Due to changes in Microsoft Office 2000 and beyond, the default for this parameter has been changed from "no" to "yes" in Samba 3\.0\.14 and above\. Microsoft Excel will display dialog box warnings about the file being changed by another user if this parameter is not set to "yes" and files are being shared between users\.
     2397.sp
     2398Default:
     2399\fI\fIdos filetimes\fR\fR\fI = \fR\fIyes\fR\fI \fR
     2400.RE
     2401
    20842402ea support (S)
    2085 .RS 3n
     2403.PP
     2404.RS 4
    20862405This boolean parameter controls whether
    20872406\fBsmbd\fR(8)
    2088 will allow clients to attempt to store OS/2 style Extended attributes on a share. In order to enable this parameter the underlying filesystem exported by the share must support extended attributes (such as provided on XFS and EXT3 on Linux, with the correct kernel patches). On Linux the filesystem must have been mounted with the mount option user_xattr in order for extended attributes to work, also extended attributes must be compiled into the Linux kernel.
    2089 .sp
    2090 Default:
    2091 \fB\fIea support\fR = no \fR
    2092 .RE
    2093 .PP
     2407will allow clients to attempt to store OS/2 style Extended attributes on a share\. In order to enable this parameter the underlying filesystem exported by the share must support extended attributes (such as provided on XFS and EXT3 on Linux, with the correct kernel patches)\. On Linux the filesystem must have been mounted with the mount option user_xattr in order for extended attributes to work, also extended attributes must be compiled into the Linux kernel\.
     2408.sp
     2409Default:
     2410\fI\fIea support\fR\fR\fI = \fR\fIno\fR\fI \fR
     2411.RE
     2412
    20942413enable asu support (G)
    2095 .RS 3n
    2096 Hosts running the "Advanced Server for Unix (ASU)" product require some special accomodations such as creating a builting [ADMIN$] share that only supports IPC connections. The has been the default behavior in smbd for many years. However, certain Microsoft applications such as the Print Migrator tool require that the remote server support an [ADMIN$} file share. Disabling this parameter allows for creating an [ADMIN$] file share in smb.conf.
    2097 .sp
    2098 Default:
    2099 \fB\fIenable asu support\fR = no \fR
    2100 .RE
    2101 .PP
     2414.PP
     2415.RS 4
     2416Hosts running the "Advanced Server for Unix (ASU)" product require some special accomodations such as creating a builting [ADMIN$] share that only supports IPC connections\. The has been the default behavior in smbd for many years\. However, certain Microsoft applications such as the Print Migrator tool require that the remote server support an [ADMIN$} file share\. Disabling this parameter allows for creating an [ADMIN$] file share in smb\.conf\.
     2417.sp
     2418Default:
     2419\fI\fIenable asu support\fR\fR\fI = \fR\fIno\fR\fI \fR
     2420.RE
     2421
    21022422enable privileges (G)
    2103 .RS 3n
     2423.PP
     2424.RS 4
    21042425This parameter controls whether or not smbd will honor privileges assigned to specific SIDs via either
    21052426net rpc rights
    2106 or one of the Windows user and group manager tools. This parameter is enabled by default. It can be disabled to prevent members of the Domain Admins group from being able to assign privileges to users or groups which can then result in certain smbd operations running as root that would normally run under the context of the connected user.
    2107 .sp
    2108 An example of how privileges can be used is to assign the right to join clients to a Samba controlled domain without providing root access to the server via smbd.
    2109 .sp
    2110 Please read the extended description provided in the Samba HOWTO documentation.
    2111 .sp
    2112 Default:
    2113 \fB\fIenable privileges\fR = yes \fR
    2114 .RE
    2115 .PP
     2427or one of the Windows user and group manager tools\. This parameter is enabled by default\. It can be disabled to prevent members of the Domain Admins group from being able to assign privileges to users or groups which can then result in certain smbd operations running as root that would normally run under the context of the connected user\.
     2428.sp
     2429An example of how privileges can be used is to assign the right to join clients to a Samba controlled domain without providing root access to the server via smbd\.
     2430.sp
     2431Please read the extended description provided in the Samba HOWTO documentation\.
     2432.sp
     2433Default:
     2434\fI\fIenable privileges\fR\fR\fI = \fR\fIyes\fR\fI \fR
     2435.RE
     2436
    21162437encrypt passwords (G)
    2117 .RS 3n
    2118 This boolean controls whether encrypted passwords will be negotiated with the client. Note that Windows NT 4.0 SP3 and above and also Windows 98 will by default expect encrypted passwords unless a registry entry is changed. To use encrypted passwords in Samba see the chapter "User Database" in the Samba HOWTO Collection.
    2119 .sp
    2120 MS Windows clients that expect Microsoft encrypted passwords and that do not have plain text password support enabled will be able to connect only to a Samba server that has encrypted password support enabled and for which the user accounts have a valid encrypted password. Refer to the smbpasswd command man page for information regarding the creation of encrypted passwords for user accounts.
    2121 .sp
    2122 The use of plain text passwords is NOT advised as support for this feature is no longer maintained in Microsoft Windows products. If you want to use plain text passwords you must set this parameter to no.
     2438.PP
     2439.RS 4
     2440This boolean controls whether encrypted passwords will be negotiated with the client\. Note that Windows NT 4\.0 SP3 and above and also Windows 98 will by default expect encrypted passwords unless a registry entry is changed\. To use encrypted passwords in Samba see the chapter "User Database" in the Samba HOWTO Collection\.
     2441.sp
     2442MS Windows clients that expect Microsoft encrypted passwords and that do not have plain text password support enabled will be able to connect only to a Samba server that has encrypted password support enabled and for which the user accounts have a valid encrypted password\. Refer to the smbpasswd command man page for information regarding the creation of encrypted passwords for user accounts\.
     2443.sp
     2444The use of plain text passwords is NOT advised as support for this feature is no longer maintained in Microsoft Windows products\. If you want to use plain text passwords you must set this parameter to no\.
    21232445.sp
    21242446In order for encrypted passwords to work correctly
    … …  
    21292451\fBsmbpasswd\fR(8)
    21302452program for information on how to set up and maintain this file), or set the
    2131 security = [server|domain|ads] parameter which causes
     2453\fIsecurity = [server|domain|ads]\fR
     2454parameter which causes
    21322455smbd
    2133 to authenticate against another server.
    2134 .sp
    2135 Default:
    2136 \fB\fIencrypt passwords\fR = yes \fR
    2137 .RE
    2138 .PP
     2456to authenticate against another server\.
     2457.sp
     2458Default:
     2459\fI\fIencrypt passwords\fR\fR\fI = \fR\fIyes\fR\fI \fR
     2460.RE
     2461
    21392462enhanced browsing (G)
    2140 .RS 3n
    2141 This option enables a couple of enhancements to cross-subnet browse propagation that have been added in Samba but which are not standard in Microsoft implementations.
    2142 .sp
    2143 The first enhancement to browse propagation consists of a regular wildcard query to a Samba WINS server for all Domain Master Browsers, followed by a browse synchronization with each of the returned DMBs. The second enhancement consists of a regular randomised browse synchronization with all currently known DMBs.
    2144 .sp
    2145 You may wish to disable this option if you have a problem with empty workgroups not disappearing from browse lists. Due to the restrictions of the browse protocols these enhancements can cause a empty workgroup to stay around forever which can be annoying.
    2146 .sp
    2147 In general you should leave this option enabled as it makes cross-subnet browse propagation much more reliable.
    2148 .sp
    2149 Default:
    2150 \fB\fIenhanced browsing\fR = yes \fR
    2151 .RE
    2152 .PP
     2463.PP
     2464.RS 4
     2465This option enables a couple of enhancements to cross\-subnet browse propagation that have been added in Samba but which are not standard in Microsoft implementations\.
     2466.sp
     2467The first enhancement to browse propagation consists of a regular wildcard query to a Samba WINS server for all Domain Master Browsers, followed by a browse synchronization with each of the returned DMBs\. The second enhancement consists of a regular randomised browse synchronization with all currently known DMBs\.
     2468.sp
     2469You may wish to disable this option if you have a problem with empty workgroups not disappearing from browse lists\. Due to the restrictions of the browse protocols these enhancements can cause a empty workgroup to stay around forever which can be annoying\.
     2470.sp
     2471In general you should leave this option enabled as it makes cross\-subnet browse propagation much more reliable\.
     2472.sp
     2473Default:
     2474\fI\fIenhanced browsing\fR\fR\fI = \fR\fIyes\fR\fI \fR
     2475.RE
     2476
    21532477enumports command (G)
    2154 .RS 3n
    2155 The concept of a "port" is fairly foreign to UNIX hosts. Under Windows NT/2000 print servers, a port is associated with a port monitor and generally takes the form of a local port (i.e. LPT1:, COM1:, FILE:) or a remote port (i.e. LPD Port Monitor, etc...). By default, Samba has only one port defined--\fB"Samba Printer Port"\fR. Under Windows NT/2000, all printers must have a valid port name. If you wish to have a list of ports displayed (smbd
     2478.PP
     2479.RS 4
     2480The concept of a "port" is fairly foreign to UNIX hosts\. Under Windows NT/2000 print servers, a port is associated with a port monitor and generally takes the form of a local port (i\.e\. LPT1:, COM1:, FILE:) or a remote port (i\.e\. LPD Port Monitor, etc\.\.\.)\. By default, Samba has only one port defined\-\-\fB"Samba Printer Port"\fR\. Under Windows NT/2000, all printers must have a valid port name\. If you wish to have a list of ports displayed (smbd
    21562481does not use a port name for anything) other than the default
    21572482\fB"Samba Printer Port"\fR, you can define
    21582483\fIenumports command\fR
    2159 to point to a program which should generate a list of ports, one per line, to standard output. This listing will then be used in response to the level 1 and 2 EnumPorts() RPC.
    2160 .sp
    2161 Default:
    2162 \fB\fIenumports command\fR = \fR
    2163 .sp
    2164 Example:
    2165 \fB\fIenumports command\fR = /usr/bin/listports \fR
    2166 .RE
    2167 .PP
     2484to point to a program which should generate a list of ports, one per line, to standard output\. This listing will then be used in response to the level 1 and 2 EnumPorts() RPC\.
     2485.sp
     2486Default:
     2487\fI\fIenumports command\fR\fR\fI = \fR\fI\fR\fI \fR
     2488.sp
     2489Example:
     2490\fI\fIenumports command\fR\fR\fI = \fR\fI/usr/bin/listports\fR\fI \fR
     2491.RE
     2492
    21682493eventlog list (G)
    2169 .RS 3n
    2170 This option defines a list of log names that Samba will report to the Microsoft EventViewer utility. The listed eventlogs will be associated with tdb file on disk in the
    2171 \fI$(lockdir)/eventlog\fR.
     2494.PP
     2495.RS 4
     2496This option defines a list of log names that Samba will report to the Microsoft EventViewer utility\. The listed eventlogs will be associated with tdb file on disk in the
     2497\fI$(lockdir)/eventlog\fR\.
    21722498.sp
    21732499The administrator must use an external process to parse the normal Unix logs such as
    21742500\fI/var/log/messages\fR
    2175 and write then entries to the eventlog tdb files. Refer to the eventlogadm(8) utility for how to write eventlog entries.
    2176 .sp
    2177 Default:
    2178 \fB\fIeventlog list\fR = \fR
    2179 .sp
    2180 Example:
    2181 \fB\fIeventlog list\fR = Security Application Syslog Apache \fR
    2182 .RE
    2183 .PP
     2501and write then entries to the eventlog tdb files\. Refer to the eventlogadm(8) utility for how to write eventlog entries\.
     2502.sp
     2503Default:
     2504\fI\fIeventlog list\fR\fR\fI = \fR\fI\fR\fI \fR
     2505.sp
     2506Example:
     2507\fI\fIeventlog list\fR\fR\fI = \fR\fISecurity Application Syslog Apache\fR\fI \fR
     2508.RE
     2509
    21842510fake directory create times (S)
    2185 .RS 3n
    2186 NTFS and Windows VFAT file systems keep a create time for all files and directories. This is not the same as the ctime - status change time - that Unix keeps, so Samba by default reports the earliest of the various times Unix does keep. Setting this parameter for a share causes Samba to always report midnight 1-1-1980 as the create time for directories.
    2187 .sp
    2188 This option is mainly used as a compatibility option for Visual C++ when used against Samba shares. Visual C++ generated makefiles have the object directory as a dependency for each object file, and a make rule to create the directory. Also, when NMAKE compares timestamps it uses the creation time when examining a directory. Thus the object directory will be created if it does not exist, but once it does exist it will always have an earlier timestamp than the object files it contains.
    2189 .sp
    2190 However, Unix time semantics mean that the create time reported by Samba will be updated whenever a file is created or or deleted in the directory. NMAKE finds all object files in the object directory. The timestamp of the last one built is then compared to the timestamp of the object directory. If the directory's timestamp if newer, then all object files will be rebuilt. Enabling this option ensures directories always predate their contents and an NMAKE build will proceed as expected.
    2191 .sp
    2192 Default:
    2193 \fB\fIfake directory create times\fR = no \fR
    2194 .RE
    2195 .PP
     2511.PP
     2512.RS 4
     2513NTFS and Windows VFAT file systems keep a create time for all files and directories\. This is not the same as the ctime \- status change time \- that Unix keeps, so Samba by default reports the earliest of the various times Unix does keep\. Setting this parameter for a share causes Samba to always report midnight 1\-1\-1980 as the create time for directories\.
     2514.sp
     2515This option is mainly used as a compatibility option for Visual C++ when used against Samba shares\. Visual C++ generated makefiles have the object directory as a dependency for each object file, and a make rule to create the directory\. Also, when NMAKE compares timestamps it uses the creation time when examining a directory\. Thus the object directory will be created if it does not exist, but once it does exist it will always have an earlier timestamp than the object files it contains\.
     2516.sp
     2517However, Unix time semantics mean that the create time reported by Samba will be updated whenever a file is created or or deleted in the directory\. NMAKE finds all object files in the object directory\. The timestamp of the last one built is then compared to the timestamp of the object directory\. If the directory\'s timestamp if newer, then all object files will be rebuilt\. Enabling this option ensures directories always predate their contents and an NMAKE build will proceed as expected\.
     2518.sp
     2519Default:
     2520\fI\fIfake directory create times\fR\fR\fI = \fR\fIno\fR\fI \fR
     2521.RE
     2522
    21962523fake oplocks (S)
    2197 .RS 3n
    2198 Oplocks are the way that SMB clients get permission from a server to locally cache file operations. If a server grants an oplock (opportunistic lock) then the client is free to assume that it is the only one accessing the file and it will aggressively cache file data. With some oplock types the client may even cache file open/close operations. This can give enormous performance benefits.
     2524.PP
     2525.RS 4
     2526Oplocks are the way that SMB clients get permission from a server to locally cache file operations\. If a server grants an oplock (opportunistic lock) then the client is free to assume that it is the only one accessing the file and it will aggressively cache file data\. With some oplock types the client may even cache file open/close operations\. This can give enormous performance benefits\.
    21992527.sp
    22002528When you set
    22012529fake oplocks = yes,
    22022530\fBsmbd\fR(8)
    2203 will always grant oplock requests no matter how many clients are using the file.
     2531will always grant oplock requests no matter how many clients are using the file\.
    22042532.sp
    22052533It is generally much better to use the real
    2206 oplocks support rather than this parameter.
    2207 .sp
    2208 If you enable this option on all read-only shares or shares that you know will only be accessed from one client at a time such as physically read-only media like CDROMs, you will see a big performance improvement on many operations. If you enable this option on shares where multiple clients may be accessing the files read-write at the same time you can get data corruption. Use this option carefully!
    2209 .sp
    2210 Default:
    2211 \fB\fIfake oplocks\fR = no \fR
    2212 .RE
    2213 .PP
     2534\fIoplocks\fR
     2535support rather than this parameter\.
     2536.sp
     2537If you enable this option on all read\-only shares or shares that you know will only be accessed from one client at a time such as physically read\-only media like CDROMs, you will see a big performance improvement on many operations\. If you enable this option on shares where multiple clients may be accessing the files read\-write at the same time you can get data corruption\. Use this option carefully!
     2538.sp
     2539Default:
     2540\fI\fIfake oplocks\fR\fR\fI = \fR\fIno\fR\fI \fR
     2541.RE
     2542
    22142543follow symlinks (S)
    2215 .RS 3n
     2544.PP
     2545.RS 4
    22162546This parameter allows the Samba administrator to stop
    22172547\fBsmbd\fR(8)
    2218 from following symbolic links in a particular share. Setting this parameter to
     2548from following symbolic links in a particular share\. Setting this parameter to
    22192549\fBno\fR
    2220 prevents any file or directory that is a symbolic link from being followed (the user will get an error). This option is very useful to stop users from adding a symbolic link to
     2550prevents any file or directory that is a symbolic link from being followed (the user will get an error)\. This option is very useful to stop users from adding a symbolic link to
    22212551\fI/etc/passwd\fR
    2222 in their home directory for instance. However it will slow filename lookups down slightly.
    2223 .sp
    2224 This option is enabled (i.e.
     2552in their home directory for instance\. However it will slow filename lookups down slightly\.
     2553.sp
     2554This option is enabled (i\.e\.
    22252555smbd
    2226 will follow symbolic links) by default.
    2227 .sp
    2228 Default:
    2229 \fB\fIfollow symlinks\fR = yes \fR
    2230 .RE
    2231 .PP
     2556will follow symbolic links) by default\.
     2557.sp
     2558Default:
     2559\fI\fIfollow symlinks\fR\fR\fI = \fR\fIyes\fR\fI \fR
     2560.RE
     2561
    22322562force create mode (S)
    2233 .RS 3n
     2563.PP
     2564.RS 4
    22342565This parameter specifies a set of UNIX mode bit permissions that will
    2235 \fBalways\fR
    2236 be set on a file created by Samba. This is done by bitwise 'OR'ing these bits onto the mode bits of a file that is being created or having its permissions changed. The default for this parameter is (in octal) 000. The modes in this parameter are bitwise 'OR'ed onto the file mode after the mask set in the
     2566\fIalways\fR
     2567be set on a file created by Samba\. This is done by bitwise \'OR\'ing these bits onto the mode bits of a file that is being created or having its permissions changed\. The default for this parameter is (in octal) 000\. The modes in this parameter are bitwise \'OR\'ed onto the file mode after the mask set in the
    22372568\fIcreate mask\fR
    2238 parameter is applied.
    2239 .sp
    2240 The example below would force all created files to have read and execute permissions set for 'group' and 'other' as well as the read/write/execute bits set for the 'user'.
    2241 .sp
    2242 Default:
    2243 \fB\fIforce create mode\fR = 000 \fR
    2244 .sp
    2245 Example:
    2246 \fB\fIforce create mode\fR = 0755 \fR
    2247 .RE
    2248 .PP
     2569parameter is applied\.
     2570.sp
     2571The example below would force all created files to have read and execute permissions set for \'group\' and \'other\' as well as the read/write/execute bits set for the \'user\'\.
     2572.sp
     2573Default:
     2574\fI\fIforce create mode\fR\fR\fI = \fR\fI000\fR\fI \fR
     2575.sp
     2576Example:
     2577\fI\fIforce create mode\fR\fR\fI = \fR\fI0755\fR\fI \fR
     2578.RE
     2579
    22492580force directory mode (S)
    2250 .RS 3n
     2581.PP
     2582.RS 4
    22512583This parameter specifies a set of UNIX mode bit permissions that will
    2252 \fBalways\fR
    2253 be set on a directory created by Samba. This is done by bitwise 'OR'ing these bits onto the mode bits of a directory that is being created. The default for this parameter is (in octal) 0000 which will not add any extra permission bits to a created directory. This operation is done after the mode mask in the parameter
     2584\fIalways\fR
     2585be set on a directory created by Samba\. This is done by bitwise \'OR\'ing these bits onto the mode bits of a directory that is being created\. The default for this parameter is (in octal) 0000 which will not add any extra permission bits to a created directory\. This operation is done after the mode mask in the parameter
    22542586\fIdirectory mask\fR
    2255 is applied.
    2256 .sp
    2257 The example below would force all created directories to have read and execute permissions set for 'group' and 'other' as well as the read/write/execute bits set for the 'user'.
    2258 .sp
    2259 Default:
    2260 \fB\fIforce directory mode\fR = 000 \fR
    2261 .sp
    2262 Example:
    2263 \fB\fIforce directory mode\fR = 0755 \fR
    2264 .RE
    2265 .PP
     2587is applied\.
     2588.sp
     2589The example below would force all created directories to have read and execute permissions set for \'group\' and \'other\' as well as the read/write/execute bits set for the \'user\'\.
     2590.sp
     2591Default:
     2592\fI\fIforce directory mode\fR\fR\fI = \fR\fI000\fR\fI \fR
     2593.sp
     2594Example:
     2595\fI\fIforce directory mode\fR\fR\fI = \fR\fI0755\fR\fI \fR
     2596.RE
     2597
    22662598force directory security mode (S)
    2267 .RS 3n
    2268 This parameter controls what UNIX permission bits can be modified when a Windows NT client is manipulating the UNIX permission on a directory using the native NT security dialog box.
    2269 .sp
    2270 This parameter is applied as a mask (OR'ed with) to the changed permission bits, thus forcing any bits in this mask that the user may have modified to be on. Make sure not to mix up this parameter with
    2271 directory security mask, which works in a similar manner to this one, but uses a logical AND instead of an OR.
    2272 .sp
    2273 Essentially, this mask may be treated as a set of bits that, when modifying security on a directory, to will enable (1) any flags that are off (0) but which the mask has set to on (1).
    2274 .sp
    2275 If not set explicitly this parameter is 0000, which allows a user to modify all the user/group/world permissions on a directory without restrictions.
     2599.PP
     2600.RS 4
     2601This parameter controls what UNIX permission bits can be modified when a Windows NT client is manipulating the UNIX permission on a directory using the native NT security dialog box\.
     2602.sp
     2603This parameter is applied as a mask (OR\'ed with) to the changed permission bits, thus forcing any bits in this mask that the user may have modified to be on\. Make sure not to mix up this parameter with
     2604\fIdirectory security mask\fR, which works in a similar manner to this one, but uses a logical AND instead of an OR\.
     2605.sp
     2606Essentially, this mask may be treated as a set of bits that, when modifying security on a directory, to will enable (1) any flags that are off (0) but which the mask has set to on (1)\.
     2607.sp
     2608If not set explicitly this parameter is 0000, which allows a user to modify all the user/group/world permissions on a directory without restrictions\.
    22762609.sp
    22772610.it 1 an-trap
    … …  
    22792612.nr an-break-flag 1
    22802613.br
    2281 \fBNote\fR
    2282 Users who can access the Samba server through other means can easily bypass this restriction, so it is primarily useful for standalone "appliance" systems. Administrators of most normal systems will probably want to leave it set as 0000.
    2283 Default:
    2284 \fB\fIforce directory security mode\fR = 0 \fR
    2285 .sp
    2286 Example:
    2287 \fB\fIforce directory security mode\fR = 700 \fR
    2288 .RE
    2289 .PP
    2290 group
    2291 .RS 3n
    2292 This parameter is a synonym for force group.
    2293 .RE
    2294 .PP
     2614Note
     2615Users who can access the Samba server through other means can easily bypass this restriction, so it is primarily useful for standalone "appliance" systems\. Administrators of most normal systems will probably want to leave it set as 0000\.
     2616
     2617Default:
     2618\fI\fIforce directory security mode\fR\fR\fI = \fR\fI0\fR\fI \fR
     2619.sp
     2620Example:
     2621\fI\fIforce directory security mode\fR\fR\fI = \fR\fI700\fR\fI \fR
     2622.RE
     2623group.PP
     2624.RS 4
     2625This parameter is a synonym for
     2626force group\.
     2627.RE
     2628
    22952629force group (S)
    2296 .RS 3n
    2297 This specifies a UNIX group name that will be assigned as the default primary group for all users connecting to this service. This is useful for sharing files by ensuring that all access to files on service will use the named group for their permissions checking. Thus, by assigning permissions for this group to the files and directories within this service the Samba administrator can restrict or allow sharing of these files.
    2298 .sp
    2299 In Samba 2.0.5 and above this parameter has extended functionality in the following way. If the group name listed here has a '+' character prepended to it then the current user accessing the share only has the primary group default assigned to this group if they are already assigned as a member of that group. This allows an administrator to decide that only users who are already in a particular group will create files with group ownership set to that group. This gives a finer granularity of ownership assignment. For example, the setting
     2630.PP
     2631.RS 4
     2632This specifies a UNIX group name that will be assigned as the default primary group for all users connecting to this service\. This is useful for sharing files by ensuring that all access to files on service will use the named group for their permissions checking\. Thus, by assigning permissions for this group to the files and directories within this service the Samba administrator can restrict or allow sharing of these files\.
     2633.sp
     2634In Samba 2\.0\.5 and above this parameter has extended functionality in the following way\. If the group name listed here has a \'+\' character prepended to it then the current user accessing the share only has the primary group default assigned to this group if they are already assigned as a member of that group\. This allows an administrator to decide that only users who are already in a particular group will create files with group ownership set to that group\. This gives a finer granularity of ownership assignment\. For example, the setting
    23002635\fIforce group = +sys\fR
    2301 means that only users who are already in group sys will have their default primary group assigned to sys when accessing this Samba share. All other users will retain their ordinary primary group.
     2636means that only users who are already in group sys will have their default primary group assigned to sys when accessing this Samba share\. All other users will retain their ordinary primary group\.
    23022637.sp
    23032638If the
    2304 force user parameter is also set the group specified in
     2639\fIforce user\fR
     2640parameter is also set the group specified in
    23052641\fIforce group\fR
    23062642will override the primary group set in
    2307 \fIforce user\fR.
    2308 .sp
    2309 Default:
    2310 \fB\fIforce group\fR = \fR
    2311 .sp
    2312 Example:
    2313 \fB\fIforce group\fR = agroup \fR
    2314 .RE
    2315 .PP
     2643\fIforce user\fR\.
     2644.sp
     2645Default:
     2646\fI\fIforce group\fR\fR\fI = \fR\fI\fR\fI \fR
     2647.sp
     2648Example:
     2649\fI\fIforce group\fR\fR\fI = \fR\fIagroup\fR\fI \fR
     2650.RE
     2651
    23162652force printername (S)
    2317 .RS 3n
     2653.PP
     2654.RS 4
    23182655When printing from Windows NT (or later), each printer in
    2319 \fIsmb.conf\fR
    2320 has two associated names which can be used by the client. The first is the sharename (or shortname) defined in smb.conf. This is the only printername available for use by Windows 9x clients. The second name associated with a printer can be seen when browsing to the "Printers" (or "Printers and Faxes") folder on the Samba server. This is referred to simply as the printername (not to be confused with the
     2656\fIsmb\.conf\fR
     2657has two associated names which can be used by the client\. The first is the sharename (or shortname) defined in smb\.conf\. This is the only printername available for use by Windows 9x clients\. The second name associated with a printer can be seen when browsing to the "Printers" (or "Printers and Faxes") folder on the Samba server\. This is referred to simply as the printername (not to be confused with the
    23212658\fIprinter name\fR
    2322 option).
    2323 .sp
    2324 When assigning a new driver to a printer on a remote Windows compatible print server such as Samba, the Windows client will rename the printer to match the driver name just uploaded. This can result in confusion for users when multiple printers are bound to the same driver. To prevent Samba from allowing the printer's printername to differ from the sharename defined in smb.conf, set
    2325 \fIforce printername = yes\fR.
    2326 .sp
    2327 Be aware that enabling this parameter may affect migrating printers from a Windows server to Samba since Windows has no way to force the sharename and printername to match.
    2328 .sp
    2329 It is recommended that this parameter's value not be changed once the printer is in use by clients as this could cause a user not be able to delete printer connections from their local Printers folder.
    2330 .sp
    2331 Default:
    2332 \fB\fIforce printername\fR = no \fR
    2333 .RE
    2334 .PP
     2659option)\.
     2660.sp
     2661When assigning a new driver to a printer on a remote Windows compatible print server such as Samba, the Windows client will rename the printer to match the driver name just uploaded\. This can result in confusion for users when multiple printers are bound to the same driver\. To prevent Samba from allowing the printer\'s printername to differ from the sharename defined in smb\.conf, set
     2662\fIforce printername = yes\fR\.
     2663.sp
     2664Be aware that enabling this parameter may affect migrating printers from a Windows server to Samba since Windows has no way to force the sharename and printername to match\.
     2665.sp
     2666It is recommended that this parameter\'s value not be changed once the printer is in use by clients as this could cause a user not be able to delete printer connections from their local Printers folder\.
     2667.sp
     2668Default:
     2669\fI\fIforce printername\fR\fR\fI = \fR\fIno\fR\fI \fR
     2670.RE
     2671
    23352672force security mode (S)
    2336 .RS 3n
    2337 This parameter controls what UNIX permission bits can be modified when a Windows NT client is manipulating the UNIX permission on a file using the native NT security dialog box.
    2338 .sp
    2339 This parameter is applied as a mask (OR'ed with) to the changed permission bits, thus forcing any bits in this mask that the user may have modified to be on. Make sure not to mix up this parameter with
    2340 security mask, which works similar like this one but uses logical AND instead of OR.
    2341 .sp
    2342 Essentially, one bits in this mask may be treated as a set of bits that, when modifying security on a file, the user has always set to be on.
    2343 .sp
    2344 If not set explicitly this parameter is set to 0, and allows a user to modify all the user/group/world permissions on a file, with no restrictions.
    2345 .sp
    2346 \fB Note\fR
    2347 that users who can access the Samba server through other means can easily bypass this restriction, so it is primarily useful for standalone "appliance" systems. Administrators of most normal systems will probably want to leave this set to 0000.
    2348 .sp
    2349 Default:
    2350 \fB\fIforce security mode\fR = 0 \fR
    2351 .sp
    2352 Example:
    2353 \fB\fIforce security mode\fR = 700 \fR
    2354 .RE
    2355 .PP
     2673.PP
     2674.RS 4
     2675This parameter controls what UNIX permission bits can be modified when a Windows NT client is manipulating the UNIX permission on a file using the native NT security dialog box\.
     2676.sp
     2677This parameter is applied as a mask (OR\'ed with) to the changed permission bits, thus forcing any bits in this mask that the user may have modified to be on\. Make sure not to mix up this parameter with
     2678\fIsecurity mask\fR, which works similar like this one but uses logical AND instead of OR\.
     2679.sp
     2680Essentially, one bits in this mask may be treated as a set of bits that, when modifying security on a file, the user has always set to be on\.
     2681.sp
     2682If not set explicitly this parameter is set to 0, and allows a user to modify all the user/group/world permissions on a file, with no restrictions\.
     2683.sp
     2684\fI Note\fR
     2685that users who can access the Samba server through other means can easily bypass this restriction, so it is primarily useful for standalone "appliance" systems\. Administrators of most normal systems will probably want to leave this set to 0000\.
     2686.sp
     2687Default:
     2688\fI\fIforce security mode\fR\fR\fI = \fR\fI0\fR\fI \fR
     2689.sp
     2690Example:
     2691\fI\fIforce security mode\fR\fR\fI = \fR\fI700\fR\fI \fR
     2692.RE
     2693
    23562694force unknown acl user (S)
    2357 .RS 3n
    2358 If this parameter is set, a Windows NT ACL that contains an unknown SID (security descriptor, or representation of a user or group id) as the owner or group owner of the file will be silently mapped into the current UNIX uid or gid of the currently connected user.
    2359 .sp
    2360 This is designed to allow Windows NT clients to copy files and folders containing ACLs that were created locally on the client machine and contain users local to that machine only (no domain users) to be copied to a Samba server (usually with XCOPY /O) and have the unknown userid and groupid of the file owner map to the current connected user. This can only be fixed correctly when winbindd allows arbitrary mapping from any Windows NT SID to a UNIX uid or gid.
    2361 .sp
    2362 Try using this parameter when XCOPY /O gives an ACCESS_DENIED error.
    2363 .sp
    2364 Default:
    2365 \fB\fIforce unknown acl user\fR = no \fR
    2366 .RE
    2367 .PP
     2695.PP
     2696.RS 4
     2697If this parameter is set, a Windows NT ACL that contains an unknown SID (security descriptor, or representation of a user or group id) as the owner or group owner of the file will be silently mapped into the current UNIX uid or gid of the currently connected user\.
     2698.sp
     2699This is designed to allow Windows NT clients to copy files and folders containing ACLs that were created locally on the client machine and contain users local to that machine only (no domain users) to be copied to a Samba server (usually with XCOPY /O) and have the unknown userid and groupid of the file owner map to the current connected user\. This can only be fixed correctly when winbindd allows arbitrary mapping from any Windows NT SID to a UNIX uid or gid\.
     2700.sp
     2701Try using this parameter when XCOPY /O gives an ACCESS_DENIED error\.
     2702.sp
     2703Default:
     2704\fI\fIforce unknown acl user\fR\fR\fI = \fR\fIno\fR\fI \fR
     2705.RE
     2706
    23682707force user (S)
    2369 .RS 3n
    2370 This specifies a UNIX user name that will be assigned as the default user for all users connecting to this service. This is useful for sharing files. You should also use it carefully as using it incorrectly can cause security problems.
    2371 .sp
    2372 This user name only gets used once a connection is established. Thus clients still need to connect as a valid user and supply a valid password. Once connected, all file operations will be performed as the "forced user", no matter what username the client connected as. This can be very useful.
    2373 .sp
    2374 In Samba 2.0.5 and above this parameter also causes the primary group of the forced user to be used as the primary group for all file activity. Prior to 2.0.5 the primary group was left as the primary group of the connecting user (this was a bug).
    2375 .sp
    2376 Default:
    2377 \fB\fIforce user\fR = \fR
    2378 .sp
    2379 Example:
    2380 \fB\fIforce user\fR = auser \fR
    2381 .RE
    2382 .PP
     2708.PP
     2709.RS 4
     2710This specifies a UNIX user name that will be assigned as the default user for all users connecting to this service\. This is useful for sharing files\. You should also use it carefully as using it incorrectly can cause security problems\.
     2711.sp
     2712This user name only gets used once a connection is established\. Thus clients still need to connect as a valid user and supply a valid password\. Once connected, all file operations will be performed as the "forced user", no matter what username the client connected as\. This can be very useful\.
     2713.sp
     2714In Samba 2\.0\.5 and above this parameter also causes the primary group of the forced user to be used as the primary group for all file activity\. Prior to 2\.0\.5 the primary group was left as the primary group of the connecting user (this was a bug)\.
     2715.sp
     2716Default:
     2717\fI\fIforce user\fR\fR\fI = \fR\fI\fR\fI \fR
     2718.sp
     2719Example:
     2720\fI\fIforce user\fR\fR\fI = \fR\fIauser\fR\fI \fR
     2721.RE
     2722
    23832723fstype (S)
    2384 .RS 3n
     2724.PP
     2725.RS 4
    23852726This parameter allows the administrator to configure the string that specifies the type of filesystem a share is using that is reported by
    23862727\fBsmbd\fR(8)
    2387 when a client queries the filesystem type for a share. The default type is
     2728when a client queries the filesystem type for a share\. The default type is
    23882729\fBNTFS\fR
    23892730for compatibility with Windows NT but this can be changed to other strings such as
    … …  
    23912732or
    23922733\fBFAT\fR
    2393 if required.
    2394 .sp
    2395 Default:
    2396 \fB\fIfstype\fR = NTFS \fR
    2397 .sp
    2398 Example:
    2399 \fB\fIfstype\fR = Samba \fR
    2400 .RE
    2401 .PP
     2734if required\.
     2735.sp
     2736Default:
     2737\fI\fIfstype\fR\fR\fI = \fR\fINTFS\fR\fI \fR
     2738.sp
     2739Example:
     2740\fI\fIfstype\fR\fR\fI = \fR\fISamba\fR\fI \fR
     2741.RE
     2742
    24022743get quota command (G)
    2403 .RS 3n
     2744.PP
     2745.RS 4
    24042746The
    24052747get quota command
    2406 should only be used whenever there is no operating system API available from the OS that samba can use.
     2748should only be used whenever there is no operating system API available from the OS that samba can use\.
    24072749.sp
    24082750This option is only available with
    2409 ./configure --with-sys-quotas. Or on linux when
    2410 ./configure --with-quotas
    2411 was used and a working quota api was found in the system.
    2412 .sp
    2413 This parameter should specify the path to a script that queries the quota information for the specified user/group for the partition that the specified directory is on.
     2751\./configure \-\-with\-sys\-quotas\. Or on linux when
     2752\./configure \-\-with\-quotas
     2753was used and a working quota api was found in the system\.
     2754.sp
     2755This parameter should specify the path to a script that queries the quota information for the specified user/group for the partition that the specified directory is on\.
    24142756.sp
    24152757Such a script should take 3 arguments:
    2416 .RS 3n
    2417 .TP 3n
    2418 \(bu
     2758.sp
     2759.RS 4
     2760.ie n \{\
     2761\h'-04'\(bu\h'+03'\c
     2762.\}
     2763.el \{\
     2764.sp -1
     2765.IP \(bu 2.3
     2766.\}
    24192767directory
    2420 .TP 3n
    2421 \(bu
     2768.RE
     2769.sp
     2770.RS 4
     2771.ie n \{\
     2772\h'-04'\(bu\h'+03'\c
     2773.\}
     2774.el \{\
     2775.sp -1
     2776.IP \(bu 2.3
     2777.\}
    24222778type of query
    2423 .TP 3n
    2424 \(bu
     2779.RE
     2780.sp
     2781.RS 4
     2782.ie n \{\
     2783\h'-04'\(bu\h'+03'\c
     2784.\}
     2785.el \{\
     2786.sp -1
     2787.IP \(bu 2.3
     2788.\}
    24252789uid of user or gid of group
    2426 .RE
    2427 .IP "" 3n
     2790.sp
     2791.RE
    24282792The type of query can be one of :
    2429 .RS 3n
    2430 .TP 3n
    2431 \(bu
    2432 1 - user quotas
    2433 .TP 3n
    2434 \(bu
    2435 2 - user default quotas (uid = -1)
    2436 .TP 3n
    2437 \(bu
    2438 3 - group quotas
    2439 .TP 3n
    2440 \(bu
    2441 4 - group default quotas (gid = -1)
    2442 .RE
    2443 .IP "" 3n
    2444 This script should print one line as output with spaces between the arguments. The arguments are:
    2445 .RS 3n
    2446 .TP 3n
    2447 \(bu
    2448 Arg 1 - quota flags (0 = no quotas, 1 = quotas enabled, 2 = quotas enabled and enforced)
    2449 .TP 3n
    2450 \(bu
    2451 Arg 2 - number of currently used blocks
    2452 .TP 3n
    2453 \(bu
    2454 Arg 3 - the softlimit number of blocks
    2455 .TP 3n
    2456 \(bu
    2457 Arg 4 - the hardlimit number of blocks
    2458 .TP 3n
    2459 \(bu
    2460 Arg 5 - currently used number of inodes
    2461 .TP 3n
    2462 \(bu
    2463 Arg 6 - the softlimit number of inodes
    2464 .TP 3n
    2465 \(bu
    2466 Arg 7 - the hardlimit number of inodes
    2467 .TP 3n
    2468 \(bu
    2469 Arg 8(optional) - the number of bytes in a block(default is 1024)
    2470 .RE
    2471 .IP "" 3n
    2472 Default:
    2473 \fB\fIget quota command\fR = \fR
    2474 .sp
    2475 Example:
    2476 \fB\fIget quota command\fR = /usr/local/sbin/query_quota \fR
    2477 .RE
    2478 .PP
     2793.sp
     2794.RS 4
     2795.ie n \{\
     2796\h'-04'\(bu\h'+03'\c
     2797.\}
     2798.el \{\
     2799.sp -1
     2800.IP \(bu 2.3
     2801.\}
     28021 \- user quotas
     2803.RE
     2804.sp
     2805.RS 4
     2806.ie n \{\
     2807\h'-04'\(bu\h'+03'\c
     2808.\}
     2809.el \{\
     2810.sp -1
     2811.IP \(bu 2.3
     2812.\}
     28132 \- user default quotas (uid = \-1)
     2814.RE
     2815.sp
     2816.RS 4
     2817.ie n \{\
     2818\h'-04'\(bu\h'+03'\c
     2819.\}
     2820.el \{\
     2821.sp -1
     2822.IP \(bu 2.3
     2823.\}
     28243 \- group quotas
     2825.RE
     2826.sp
     2827.RS 4
     2828.ie n \{\
     2829\h'-04'\(bu\h'+03'\c
     2830.\}
     2831.el \{\
     2832.sp -1
     2833.IP \(bu 2.3
     2834.\}
     28354 \- group default quotas (gid = \-1)
     2836.sp
     2837.RE
     2838This script should print one line as output with spaces between the arguments\. The arguments are:
     2839.sp
     2840.RS 4
     2841.ie n \{\
     2842\h'-04'\(bu\h'+03'\c
     2843.\}
     2844.el \{\
     2845.sp -1
     2846.IP \(bu 2.3
     2847.\}
     2848Arg 1 \- quota flags (0 = no quotas, 1 = quotas enabled, 2 = quotas enabled and enforced)
     2849.RE
     2850.sp
     2851.RS 4
     2852.ie n \{\
     2853\h'-04'\(bu\h'+03'\c
     2854.\}
     2855.el \{\
     2856.sp -1
     2857.IP \(bu 2.3
     2858.\}
     2859Arg 2 \- number of currently used blocks
     2860.RE
     2861.sp
     2862.RS 4
     2863.ie n \{\
     2864\h'-04'\(bu\h'+03'\c
     2865.\}
     2866.el \{\
     2867.sp -1
     2868.IP \(bu 2.3
     2869.\}
     2870Arg 3 \- the softlimit number of blocks
     2871.RE
     2872.sp
     2873.RS 4
     2874.ie n \{\
     2875\h'-04'\(bu\h'+03'\c
     2876.\}
     2877.el \{\
     2878.sp -1
     2879.IP \(bu 2.3
     2880.\}
     2881Arg 4 \- the hardlimit number of blocks
     2882.RE
     2883.sp
     2884.RS 4
     2885.ie n \{\
     2886\h'-04'\(bu\h'+03'\c
     2887.\}
     2888.el \{\
     2889.sp -1
     2890.IP \(bu 2.3
     2891.\}
     2892Arg 5 \- currently used number of inodes
     2893.RE
     2894.sp
     2895.RS 4
     2896.ie n \{\
     2897\h'-04'\(bu\h'+03'\c
     2898.\}
     2899.el \{\
     2900.sp -1
     2901.IP \(bu 2.3
     2902.\}
     2903Arg 6 \- the softlimit number of inodes
     2904.RE
     2905.sp
     2906.RS 4
     2907.ie n \{\
     2908\h'-04'\(bu\h'+03'\c
     2909.\}
     2910.el \{\
     2911.sp -1
     2912.IP \(bu 2.3
     2913.\}
     2914Arg 7 \- the hardlimit number of inodes
     2915.RE
     2916.sp
     2917.RS 4
     2918.ie n \{\
     2919\h'-04'\(bu\h'+03'\c
     2920.\}
     2921.el \{\
     2922.sp -1
     2923.IP \(bu 2.3
     2924.\}
     2925Arg 8(optional) \- the number of bytes in a block(default is 1024)
     2926.sp
     2927.RE
     2928Default:
     2929\fI\fIget quota command\fR\fR\fI = \fR\fI\fR\fI \fR
     2930.sp
     2931Example:
     2932\fI\fIget quota command\fR\fR\fI = \fR\fI/usr/local/sbin/query_quota\fR\fI \fR
     2933.RE
     2934
    24792935getwd cache (G)
    2480 .RS 3n
    2481 This is a tuning option. When this is enabled a caching algorithm will be used to reduce the time taken for getwd() calls. This can have a significant impact on performance, especially when the
    2482 wide smbconfoptions parameter is set to
    2483 \fBno\fR.
    2484 .sp
    2485 Default:
    2486 \fB\fIgetwd cache\fR = yes \fR
    2487 .RE
    2488 .PP
     2936.PP
     2937.RS 4
     2938This is a tuning option\. When this is enabled a caching algorithm will be used to reduce the time taken for getwd() calls\. This can have a significant impact on performance, especially when the
     2939\fIwide smbconfoptions\fR
     2940parameter is set to
     2941\fBno\fR\.
     2942.sp
     2943Default:
     2944\fI\fIgetwd cache\fR\fR\fI = \fR\fIyes\fR\fI \fR
     2945.RE
     2946
    24892947guest account (G)
    2490 .RS 3n
     2948.PP
     2949.RS 4
    24912950This is a username which will be used for access to services which are specified as
    2492 guest ok (see below). Whatever privileges this user has will be available to any client connecting to the guest service. This user must exist in the password file, but does not require a valid login. The user account "ftp" is often a good choice for this parameter.
    2493 .sp
    2494 On some systems the default guest account "nobody" may not be able to print. Use another account in this case. You should test this by trying to log in as your guest user (perhaps by using the
    2495 su -
     2951\fIguest ok\fR
     2952(see below)\. Whatever privileges this user has will be available to any client connecting to the guest service\. This user must exist in the password file, but does not require a valid login\. The user account "ftp" is often a good choice for this parameter\.
     2953.sp
     2954On some systems the default guest account "nobody" may not be able to print\. Use another account in this case\. You should test this by trying to log in as your guest user (perhaps by using the
     2955su \-
    24962956command) and trying to print using the system print command such as
    24972957lpr(1)
    24982958or
    2499 lp(1).
    2500 .sp
    2501 This parameter does not accept % macros, because many parts of the system require this value to be constant for correct operation.
    2502 .sp
    2503 Default:
    2504 \fB\fIguest account\fR = nobody # default can be changed at compile-time \fR
    2505 .sp
    2506 Example:
    2507 \fB\fIguest account\fR = ftp \fR
    2508 .RE
    2509 .PP
    2510 public
    2511 .RS 3n
    2512 This parameter is a synonym for guest ok.
    2513 .RE
    2514 .PP
     2959lp(1)\.
     2960.sp
     2961This parameter does not accept % macros, because many parts of the system require this value to be constant for correct operation\.
     2962.sp
     2963Default:
     2964\fI\fIguest account\fR\fR\fI = \fR\fInobody # default can be changed at compile\-time\fR\fI \fR
     2965.sp
     2966Example:
     2967\fI\fIguest account\fR\fR\fI = \fR\fIftp\fR\fI \fR
     2968.RE
     2969public.PP
     2970.RS 4
     2971This parameter is a synonym for
     2972guest ok\.
     2973.RE
     2974
    25152975guest ok (S)
    2516 .RS 3n
     2976.PP
     2977.RS 4
    25172978If this parameter is
    25182979\fByes\fR
    2519 for a service, then no password is required to connect to the service. Privileges will be those of the
    2520 guest account.
     2980for a service, then no password is required to connect to the service\. Privileges will be those of the
     2981\fIguest account\fR\.
    25212982.sp
    25222983This paramater nullifies the benifits of setting
    2523 restrict anonymous = 2
     2984\fIrestrict anonymous = 2\fR
    25242985.sp
    25252986See the section below on
    2526 security for more information about this option.
    2527 .sp
    2528 Default:
    2529 \fB\fIguest ok\fR = no \fR
    2530 .RE
    2531 .PP
    2532 only guest
    2533 .RS 3n
    2534 This parameter is a synonym for guest only.
    2535 .RE
    2536 .PP
     2987\fIsecurity\fR
     2988for more information about this option\.
     2989.sp
     2990Default:
     2991\fI\fIguest ok\fR\fR\fI = \fR\fIno\fR\fI \fR
     2992.RE
     2993only guest.PP
     2994.RS 4
     2995This parameter is a synonym for
     2996guest only\.
     2997.RE
     2998
    25372999guest only (S)
    2538 .RS 3n
     3000.PP
     3001.RS 4
    25393002If this parameter is
    25403003\fByes\fR
    2541 for a service, then only guest connections to the service are permitted. This parameter will have no effect if
    2542 guest ok is not set for the service.
     3004for a service, then only guest connections to the service are permitted\. This parameter will have no effect if
     3005\fIguest ok\fR
     3006is not set for the service\.
    25433007.sp
    25443008See the section below on
    2545 security for more information about this option.
    2546 .sp
    2547 Default:
    2548 \fB\fIguest only\fR = no \fR
    2549 .RE
    2550 .PP
     3009\fIsecurity\fR
     3010for more information about this option\.
     3011.sp
     3012Default:
     3013\fI\fIguest only\fR\fR\fI = \fR\fIno\fR\fI \fR
     3014.RE
     3015
    25513016hide dot files (S)
    2552 .RS 3n
    2553 This is a boolean parameter that controls whether files starting with a dot appear as hidden files.
    2554 .sp
    2555 Default:
    2556 \fB\fIhide dot files\fR = yes \fR
    2557 .RE
    2558 .PP
     3017.PP
     3018.RS 4
     3019This is a boolean parameter that controls whether files starting with a dot appear as hidden files\.
     3020.sp
     3021Default:
     3022\fI\fIhide dot files\fR\fR\fI = \fR\fIyes\fR\fI \fR
     3023.RE
     3024
    25593025hide files (S)
    2560 .RS 3n
    2561 This is a list of files or directories that are not visible but are accessible. The DOS 'hidden' attribute is applied to any files or directories that match.
    2562 .sp
    2563 Each entry in the list must be separated by a '/', which allows spaces to be included in the entry. '*' and '?' can be used to specify multiple files or directories as in DOS wildcards.
    2564 .sp
    2565 Each entry must be a Unix path, not a DOS path and must not include the Unix directory separator '/'.
    2566 .sp
    2567 Note that the case sensitivity option is applicable in hiding files.
    2568 .sp
    2569 Setting this parameter will affect the performance of Samba, as it will be forced to check all files and directories for a match as they are scanned.
     3026.PP
     3027.RS 4
     3028This is a list of files or directories that are not visible but are accessible\. The DOS \'hidden\' attribute is applied to any files or directories that match\.
     3029.sp
     3030Each entry in the list must be separated by a \'/\', which allows spaces to be included in the entry\. \'*\' and \'?\' can be used to specify multiple files or directories as in DOS wildcards\.
     3031.sp
     3032Each entry must be a Unix path, not a DOS path and must not include the Unix directory separator \'/\'\.
     3033.sp
     3034Note that the case sensitivity option is applicable in hiding files\.
     3035.sp
     3036Setting this parameter will affect the performance of Samba, as it will be forced to check all files and directories for a match as they are scanned\.
    25703037.sp
    25713038The example shown above is based on files that the Macintosh SMB client (DAVE) available from
    25723039Thursby
    2573 creates for internal use, and also still hides all files beginning with a dot.
     3040creates for internal use, and also still hides all files beginning with a dot\.
    25743041.sp
    25753042An example of us of this parameter is:
    2576 
    2577 .sp
    2578 
     3043.sp
     3044.RS 4
    25793045.nf
    2580 
    2581 hide files = /.*/DesktopFolderDB/TrashFor%m/resource.frk/
    2582 
     3046hide files = /\.*/DesktopFolderDB/TrashFor%m/resource\.frk/
    25833047.fi
    2584 
    2585 .sp
    2586 Default:
    2587 \fB\fIhide files\fR = # no file are hidden \fR
    2588 .RE
    2589 .PP
     3048.RE
     3049.sp
     3050.sp
     3051Default:
     3052\fI\fIhide files\fR\fR\fI = \fR\fI # no file are hidden\fR\fI \fR
     3053.RE
     3054
    25903055hide special files (S)
    2591 .RS 3n
    2592 This parameter prevents clients from seeing special files such as sockets, devices and fifo's in directory listings.
    2593 .sp
    2594 Default:
    2595 \fB\fIhide special files\fR = no \fR
    2596 .RE
    2597 .PP
     3056.PP
     3057.RS 4
     3058This parameter prevents clients from seeing special files such as sockets, devices and fifo\'s in directory listings\.
     3059.sp
     3060Default:
     3061\fI\fIhide special files\fR\fR\fI = \fR\fIno\fR\fI \fR
     3062.RE
     3063
    25983064hide unreadable (S)
    2599 .RS 3n
    2600 This parameter prevents clients from seeing the existance of files that cannot be read. Defaults to off.
    2601 .sp
    2602 Default:
    2603 \fB\fIhide unreadable\fR = no \fR
    2604 .RE
    2605 .PP
     3065.PP
     3066.RS 4
     3067This parameter prevents clients from seeing the existance of files that cannot be read\. Defaults to off\.
     3068.sp
     3069Default:
     3070\fI\fIhide unreadable\fR\fR\fI = \fR\fIno\fR\fI \fR
     3071.RE
     3072
    26063073hide unwriteable files (S)
    2607 .RS 3n
    2608 This parameter prevents clients from seeing the existance of files that cannot be written to. Defaults to off. Note that unwriteable directories are shown as usual.
    2609 .sp
    2610 Default:
    2611 \fB\fIhide unwriteable files\fR = no \fR
    2612 .RE
    2613 .PP
     3074.PP
     3075.RS 4
     3076This parameter prevents clients from seeing the existance of files that cannot be written to\. Defaults to off\. Note that unwriteable directories are shown as usual\.
     3077.sp
     3078Default:
     3079\fI\fIhide unwriteable files\fR\fR\fI = \fR\fIno\fR\fI \fR
     3080.RE
     3081
    26143082homedir map (G)
    2615 .RS 3n
     3083.PP
     3084.RS 4
    26163085If
    2617 nis homedir is
     3086\fInis homedir\fR
     3087is
    26183088\fByes\fR, and
    26193089\fBsmbd\fR(8)
    26203090is also acting as a Win95/98
    26213091\fIlogon server\fR
    2622 then this parameter specifies the NIS (or YP) map from which the server for the user's home directory should be extracted. At present, only the Sun auto.home map format is understood. The form of the map is:
    2623 
    2624 .sp
    2625 
     3092then this parameter specifies the NIS (or YP) map from which the server for the user\'s home directory should be extracted\. At present, only the Sun auto\.home map format is understood\. The form of the map is:
     3093.sp
     3094.RS 4
    26263095.nf
    2627 
    26283096username server:/some/file/system
    2629 
    26303097.fi
    2631 and the program will extract the servername from before the first ':'. There should probably be a better parsing system that copes with different map formats and also Amd (another automounter) maps.
     3098.RE
     3099.sp
     3100and the program will extract the servername from before the first \':\'\. There should probably be a better parsing system that copes with different map formats and also Amd (another automounter) maps\.
    26323101.sp
    26333102.it 1 an-trap
    … …  
    26353104.nr an-break-flag 1
    26363105.br
    2637 \fBNote\fR
    2638 A working NIS client is required on the system for this option to work.
    2639 Default:
    2640 \fB\fIhomedir map\fR = \fR
    2641 .sp
    2642 Example:
    2643 \fB\fIhomedir map\fR = amd.homedir \fR
    2644 .RE
    2645 .PP
     3106Note
     3107A working NIS client is required on the system for this option to work\.
     3108
     3109Default:
     3110\fI\fIhomedir map\fR\fR\fI = \fR\fI\fR\fI \fR
     3111.sp
     3112Example:
     3113\fI\fIhomedir map\fR\fR\fI = \fR\fIamd\.homedir\fR\fI \fR
     3114.RE
     3115
    26463116host msdfs (G)
    2647 .RS 3n
     3117.PP
     3118.RS 4
    26483119If set to
    2649 \fByes\fR, Samba will act as a Dfs server, and allow Dfs-aware clients to browse Dfs trees hosted on the server.
     3120\fByes\fR, Samba will act as a Dfs server, and allow Dfs\-aware clients to browse Dfs trees hosted on the server\.
    26503121.sp
    26513122See also the
    2652 msdfs root share level parameter. For more information on setting up a Dfs tree on Samba, refer to the MSFDS chapter in the book Samba3-HOWTO.
    2653 .sp
    2654 Default:
    2655 \fB\fIhost msdfs\fR = yes \fR
    2656 .RE
    2657 .PP
     3123\fImsdfs root\fR
     3124share level parameter\. For more information on setting up a Dfs tree on Samba, refer to the MSFDS chapter in the book Samba3\-HOWTO\.
     3125.sp
     3126Default:
     3127\fI\fIhost msdfs\fR\fR\fI = \fR\fIyes\fR\fI \fR
     3128.RE
     3129
    26583130hostname lookups (G)
    2659 .RS 3n
    2660 Specifies whether samba should use (expensive) hostname lookups or use the ip addresses instead. An example place where hostname lookups are currently used is when checking the
     3131.PP
     3132.RS 4
     3133Specifies whether samba should use (expensive) hostname lookups or use the ip addresses instead\. An example place where hostname lookups are currently used is when checking the
    26613134hosts deny
    26623135and
    2663 hosts allow.
    2664 .sp
    2665 Default:
    2666 \fB\fIhostname lookups\fR = no \fR
    2667 .sp
    2668 Example:
    2669 \fB\fIhostname lookups\fR = yes \fR
    2670 .RE
    2671 .PP
    2672 allow hosts
    2673 .RS 3n
    2674 This parameter is a synonym for hosts allow.
    2675 .RE
    2676 .PP
     3136hosts allow\.
     3137.sp
     3138Default:
     3139\fI\fIhostname lookups\fR\fR\fI = \fR\fIno\fR\fI \fR
     3140.sp
     3141Example:
     3142\fI\fIhostname lookups\fR\fR\fI = \fR\fIyes\fR\fI \fR
     3143.RE
     3144allow hosts.PP
     3145.RS 4
     3146This parameter is a synonym for
     3147hosts allow\.
     3148.RE
     3149
    26773150hosts allow (S)
    2678 .RS 3n
     3151.PP
     3152.RS 4
    26793153A synonym for this parameter is
    2680 allow hosts.
    2681 .sp
    2682 This parameter is a comma, space, or tab delimited set of hosts which are permitted to access a service.
    2683 .sp
    2684 If specified in the [global] section then it will apply to all services, regardless of whether the individual service has a different setting.
    2685 .sp
    2686 You can specify the hosts by name or IP number. For example, you could restrict access to only the hosts on a Class C subnet with something like
    2687 allow hosts = 150.203.5.. The full syntax of the list is described in the man page
    2688 \fIhosts_access(5)\fR. Note that this man page may not be present on your system, so a brief description will be given here also.
    2689 .sp
    2690 Note that the localhost address 127.0.0.1 will always be allowed access unless specifically denied by a
    2691 hosts deny option.
    2692 .sp
    2693 You can also specify hosts by network/netmask pairs and by netgroup names if your system supports netgroups. The
    2694 \fBEXCEPT\fR
    2695 keyword can also be used to limit a wildcard list. The following examples may provide some help:
    2696 .sp
    2697 Example 1: allow all IPs in 150.203.*.*; except one
    2698 .sp
    2699 hosts allow = 150.203. EXCEPT 150.203.6.66
     3154\fIallow hosts\fR\.
     3155.sp
     3156This parameter is a comma, space, or tab delimited set of hosts which are permitted to access a service\.
     3157.sp
     3158If specified in the [global] section then it will apply to all services, regardless of whether the individual service has a different setting\.
     3159.sp
     3160You can specify the hosts by name or IP number\. For example, you could restrict access to only the hosts on a Class C subnet with something like
     3161allow hosts = 150\.203\.5\.\. The full syntax of the list is described in the man page
     3162\fIhosts_access(5)\fR\. Note that this man page may not be present on your system, so a brief description will be given here also\.
     3163.sp
     3164Note that the localhost address 127\.0\.0\.1 will always be allowed access unless specifically denied by a
     3165\fIhosts deny\fR
     3166option\.
     3167.sp
     3168You can also specify hosts by network/netmask pairs and by netgroup names if your system supports netgroups\. The
     3169\fIEXCEPT\fR
     3170keyword can also be used to limit a wildcard list\. The following examples may provide some help:
     3171.sp
     3172Example 1: allow all IPs in 150\.203\.*\.*; except one
     3173.sp
     3174hosts allow = 150\.203\. EXCEPT 150\.203\.6\.66
    27003175.sp
    27013176Example 2: allow hosts that match the given network/netmask
    27023177.sp
    2703 hosts allow = 150.203.15.0/255.255.255.0
     3178hosts allow = 150\.203\.15\.0/255\.255\.255\.0
    27043179.sp
    27053180Example 3: allow a couple of hosts
    … …  
    27173192.nr an-break-flag 1
    27183193.br
    2719 \fBNote\fR
    2720 Note that access still requires suitable user-level passwords.
     3194Note
     3195Note that access still requires suitable user\-level passwords\.
     3196
    27213197See
    27223198\fBtestparm\fR(1)
    2723 for a way of testing your host access to see if it does what you expect.
    2724 .sp
    2725 Default:
    2726 \fB\fIhosts allow\fR = # none (i.e., all hosts permitted access) \fR
    2727 .sp
    2728 Example:
    2729 \fB\fIhosts allow\fR = 150.203.5. myhost.mynet.edu.au \fR
    2730 .RE
    2731 .PP
    2732 deny hosts
    2733 .RS 3n
    2734 This parameter is a synonym for hosts deny.
    2735 .RE
    2736 .PP
     3199for a way of testing your host access to see if it does what you expect\.
     3200.sp
     3201Default:
     3202\fI\fIhosts allow\fR\fR\fI = \fR\fI # none (i\.e\., all hosts permitted access)\fR\fI \fR
     3203.sp
     3204Example:
     3205\fI\fIhosts allow\fR\fR\fI = \fR\fI150\.203\.5\. myhost\.mynet\.edu\.au\fR\fI \fR
     3206.RE
     3207deny hosts.PP
     3208.RS 4
     3209This parameter is a synonym for
     3210hosts deny\.
     3211.RE
     3212
    27373213hosts deny (S)
    2738 .RS 3n
     3214.PP
     3215.RS 4
    27393216The opposite of
    27403217\fIhosts allow\fR
    2741 - hosts listed here are
    2742 \fBNOT\fR
    2743 permitted access to services unless the specific services have their own lists to override this one. Where the lists conflict, the
     3218\- hosts listed here are
     3219\fINOT\fR
     3220permitted access to services unless the specific services have their own lists to override this one\. Where the lists conflict, the
    27443221\fIallow\fR
    2745 list takes precedence.
     3222list takes precedence\.
    27463223.sp
    27473224In the event that it is necessary to deny all by default, use the keyword ALL (or the netmask
    2748 0.0.0.0/0) and then explicitly specify to the
    2749 hosts allow = hosts allow parameter those hosts that should be permitted access.
    2750 .sp
    2751 Default:
    2752 \fB\fIhosts deny\fR = # none (i.e., no hosts specifically excluded) \fR
    2753 .sp
    2754 Example:
    2755 \fB\fIhosts deny\fR = 150.203.4. badhost.mynet.edu.au \fR
    2756 .RE
    2757 .PP
     32250\.0\.0\.0/0) and then explicitly specify to the
     3226\fIhosts allow = hosts allow\fR
     3227parameter those hosts that should be permitted access\.
     3228.sp
     3229Default:
     3230\fI\fIhosts deny\fR\fR\fI = \fR\fI # none (i\.e\., no hosts specifically excluded)\fR\fI \fR
     3231.sp
     3232Example:
     3233\fI\fIhosts deny\fR\fR\fI = \fR\fI150\.203\.4\. badhost\.mynet\.edu\.au\fR\fI \fR
     3234.RE
     3235
    27583236idmap alloc backend (G)
    2759 .RS 3n
    2760 The idmap alloc backend provides a plugin interface for Winbind to use when allocating Unix uids/gids for Windows SIDs. This option is to be used in conjunction with the
    2761 idmap domains parameter and refers to the name of the idmap module which will provide the id allocation functionality. Please refer to the man page for each idmap plugin to determine whether or not the module implements the allocation feature. The most common plugins are the tdb (\fBidmap_tdb\fR(8)) and ldap (\fBidmap_ldap\fR(8)) libraries.
     3237.PP
     3238.RS 4
     3239The idmap alloc backend provides a plugin interface for Winbind to use when allocating Unix uids/gids for Windows SIDs\. This option is to be used in conjunction with the
     3240\fIidmap domains\fR
     3241parameter and refers to the name of the idmap module which will provide the id allocation functionality\. Please refer to the man page for each idmap plugin to determine whether or not the module implements the allocation feature\. The most common plugins are the tdb (\fBidmap_tdb\fR(8)) and ldap (\fBidmap_ldap\fR(8)) libraries\.
    27623242.sp
    27633243Also refer to the
    2764 idmap alloc config option.
    2765 .sp
    2766 \fBNo default\fR
    2767 .sp
    2768 Example:
    2769 \fB\fIidmap alloc backend\fR = tdb \fR
    2770 .RE
    2771 .PP
     3244\fIidmap alloc config\fR
     3245option\.
     3246.sp
     3247\fINo default\fR
     3248.sp
     3249Example:
     3250\fI\fIidmap alloc backend\fR\fR\fI = \fR\fItdb\fR\fI \fR
     3251.RE
     3252
    27723253idmap alloc config (G)
    2773 .RS 3n
     3254.PP
     3255.RS 4
    27743256The idmap alloc config prefix provides a means of managing settings for the backend defined by the
    2775 idmap alloc backend parameter. Refer to the man page for each idmap plugin regarding specific configuration details.
    2776 .sp
    2777 \fBNo default\fR
    2778 .RE
    2779 .PP
     3257\fIidmap alloc backend\fR
     3258parameter\. Refer to the man page for each idmap plugin regarding specific configuration details\.
     3259.sp
     3260\fINo default\fR
     3261.RE
     3262
    27803263idmap backend (G)
    2781 .RS 3n
    2782 The idmap backend provides a plugin interface for Winbind to use varying backends to store SID/uid/gid mapping tables. This option is mutually exclusive with the newer and more flexible
    2783 idmap domains parameter. The main difference between the "idmap backend" and the "idmap domains" is that the former only allows on backend for all domains while the latter supports configuring backends on a per domain basis.
    2784 .sp
    2785 Examples of SID/uid/gid backends include tdb (\fBidmap_tdb\fR(8)), ldap (\fBidmap_ldap\fR(8)), rid (\fBidmap_rid\fR(8)), and ad (\fBidmap_tdb\fR(8)).
    2786 .sp
    2787 Default:
    2788 \fB\fIidmap backend\fR = tdb \fR
    2789 .RE
    2790 .PP
     3264.PP
     3265.RS 4
     3266The idmap backend provides a plugin interface for Winbind to use varying backends to store SID/uid/gid mapping tables\. This option is mutually exclusive with the newer and more flexible
     3267\fIidmap domains\fR
     3268parameter\. The main difference between the "idmap backend" and the "idmap domains" is that the former only allows on backend for all domains while the latter supports configuring backends on a per domain basis\.
     3269.sp
     3270Examples of SID/uid/gid backends include tdb (\fBidmap_tdb\fR(8)), ldap (\fBidmap_ldap\fR(8)), rid (\fBidmap_rid\fR(8)), and ad (\fBidmap_tdb\fR(8))\.
     3271.sp
     3272Default:
     3273\fI\fIidmap backend\fR\fR\fI = \fR\fItdb\fR\fI \fR
     3274.RE
     3275
    27913276idmap cache time (G)
    2792 .RS 3n
    2793 This parameter specifies the number of seconds that Winbind's idmap interface will cache positive SID/uid/gid query results.
    2794 .sp
    2795 Default:
    2796 \fB\fIidmap cache time\fR = 900 \fR
    2797 .RE
    2798 .PP
     3277.PP
     3278.RS 4
     3279This parameter specifies the number of seconds that Winbind\'s idmap interface will cache positive SID/uid/gid query results\.
     3280.sp
     3281Default:
     3282\fI\fIidmap cache time\fR\fR\fI = \fR\fI900\fR\fI \fR
     3283.RE
     3284
    27993285idmap config (G)
    2800 .RS 3n
     3286.PP
     3287.RS 4
    28013288The idmap config prefix provides a means of managing each domain defined by the
    2802 idmap domains option using Samba's parameteric option support. The idmap config prefix should be followed by the name of the domain, a colon, and a setting specific to the chosen backend. There are three options available for all domains:
    2803 
    2804 .RS 3n
     3289\fIidmap domains\fR
     3290option using Samba\'s parameteric option support\. The idmap config prefix should be followed by the name of the domain, a colon, and a setting specific to the chosen backend\. There are three options available for all domains:
    28053291.PP
    28063292backend = backend_name
    2807 .RS 3n
    2808 Specifies the name of the idmap plugin to use as the SID/uid/gid backend for this domain.
     3293.RS 4
     3294Specifies the name of the idmap plugin to use as the SID/uid/gid backend for this domain\.
    28093295.RE
    28103296.PP
    28113297default = [yes|no]
    2812 .RS 3n
    2813 The default domain/backend will be used for searching for users and groups not belonging to one of the explicitly listed domains (matched by comparing the account SID and the domain SID).
     3298.RS 4
     3299The default domain/backend will be used for searching for users and groups not belonging to one of the explicitly listed domains (matched by comparing the account SID and the domain SID)\.
    28143300.RE
    28153301.PP
    28163302readonly = [yes|no]
    2817 .RS 3n
     3303.RS 4
    28183304Mark the domain as readonly which means that no attempts to allocate a uid or gid (by the
    2819 idmap alloc backend) for any user or group in that domain will be attempted.
    2820 .RE
    2821 .RE
    2822 .IP "" 3n
     3305\fIidmap alloc backend\fR) for any user or group in that domain will be attempted\.
     3306.RE
     3307.sp
    28233308The following example illustrates how to configure the
    28243309\fBidmap_ad\fR(8)
    28253310for the CORP domain and the
    28263311\fBidmap_tdb\fR(8)
    2827 backend for all other domains. The TRUSTEDDOMAINS string is simply a key used to reference the "idmap config" settings and does not represent the actual name of a domain.
    2828 
     3312backend for all other domains\. The TRUSTEDDOMAINS string is simply a key used to reference the "idmap config" settings and does not represent the actual name of a domain\.
     3313.sp
     3314.RS 4
    28293315.nf
    2830 
    28313316        idmap domains = CORP TRUSTEDDOMAINS
    28323317
    … …  
    28363321        idmap config TRUSTEDDOMAINS:backend = tdb
    28373322        idmap config TRUSTEDDOMAINS:default = yes
    2838         idmap config TRUSTEDDOMAINS:range   = 1000 - 9999
     3323        idmap config TRUSTEDDOMAINS:range   = 1000 \- 9999
    28393324       
    28403325.fi
    2841 \fBNo default\fR
    2842 .RE
    2843 .PP
     3326.RE
     3327\fINo default\fR
     3328.RE
     3329
    28443330idmap domains (G)
    2845 .RS 3n
    2846 The idmap domains option defines a list of Windows domains which will each have a separately configured backend for managing Winbind's SID/uid/gid tables. This parameter is mutually exclusive with the older
    2847 idmap backend option.
    2848 .sp
    2849 Values consist of the short domain name for Winbind's primary or collection of trusted domains. You may also use an arbitrary string to represent a catchall domain backend for any domain not explicitly listed.
     3331.PP
     3332.RS 4
     3333The idmap domains option defines a list of Windows domains which will each have a separately configured backend for managing Winbind\'s SID/uid/gid tables\. This parameter is mutually exclusive with the older
     3334\fIidmap backend\fR
     3335option\.
     3336.sp
     3337Values consist of the short domain name for Winbind\'s primary or collection of trusted domains\. You may also use an arbitrary string to represent a catchall domain backend for any domain not explicitly listed\.
    28503338.sp
    28513339Refer to the
    2852 idmap config for details about managing the SID/uid/gid backend for each domain.
    2853 .sp
    2854 \fBNo default\fR
    2855 .sp
    2856 Example:
    2857 \fB\fIidmap domains\fR = default AD CORP \fR
    2858 .RE
    2859 .PP
    2860 winbind gid
    2861 .RS 3n
    2862 This parameter is a synonym for idmap gid.
    2863 .RE
    2864 .PP
     3340\fIidmap config\fR
     3341for details about managing the SID/uid/gid backend for each domain\.
     3342.sp
     3343\fINo default\fR
     3344.sp
     3345Example:
     3346\fI\fIidmap domains\fR\fR\fI = \fR\fIdefault AD CORP\fR\fI \fR
     3347.RE
     3348winbind gid.PP
     3349.RS 4
     3350This parameter is a synonym for
     3351idmap gid\.
     3352.RE
     3353
    28653354idmap gid (G)
    2866 .RS 3n
    2867 The idmap gid parameter specifies the range of group ids that are allocated for the purpose of mapping UNX groups to NT group SIDs. This range of group ids should have no existing local or NIS groups within it as strange conflicts can occur otherwise.
     3355.PP
     3356.RS 4
     3357The idmap gid parameter specifies the range of group ids that are allocated for the purpose of mapping UNX groups to NT group SIDs\. This range of group ids should have no existing local or NIS groups within it as strange conflicts can occur otherwise\.
    28683358.sp
    28693359See also the
    2870 idmap backend,
    2871 idmap domains, and
    2872 idmap config options.
    2873 .sp
    2874 Default:
    2875 \fB\fIidmap gid\fR = \fR
    2876 .sp
    2877 Example:
    2878 \fB\fIidmap gid\fR = 10000-20000 \fR
    2879 .RE
    2880 .PP
     3360\fIidmap backend\fR,
     3361\fIidmap domains\fR, and
     3362\fIidmap config\fR
     3363options\.
     3364.sp
     3365Default:
     3366\fI\fIidmap gid\fR\fR\fI = \fR\fI\fR\fI \fR
     3367.sp
     3368Example:
     3369\fI\fIidmap gid\fR\fR\fI = \fR\fI10000\-20000\fR\fI \fR
     3370.RE
     3371
    28813372idmap negative cache time (G)
    2882 .RS 3n
    2883 This parameter specifies the number of seconds that Winbind's idmap interface will cache negative SID/uid/gid query results.
    2884 .sp
    2885 Default:
    2886 \fB\fIidmap negative cache time\fR = 120 \fR
    2887 .RE
    2888 .PP
    2889 winbind uid
    2890 .RS 3n
    2891 This parameter is a synonym for idmap uid.
    2892 .RE
    2893 .PP
     3373.PP
     3374.RS 4
     3375This parameter specifies the number of seconds that Winbind\'s idmap interface will cache negative SID/uid/gid query results\.
     3376.sp
     3377Default:
     3378\fI\fIidmap negative cache time\fR\fR\fI = \fR\fI120\fR\fI \fR
     3379.RE
     3380winbind uid.PP
     3381.RS 4
     3382This parameter is a synonym for
     3383idmap uid\.
     3384.RE
     3385
    28943386idmap uid (G)
    2895 .RS 3n
    2896 The idmap uid parameter specifies the range of user ids that are allocated for use in mapping UNIX users to NT user SIDs. This range of ids should have no existing local or NIS users within it as strange conflicts can occur otherwise.
     3387.PP
     3388.RS 4
     3389The idmap uid parameter specifies the range of user ids that are allocated for use in mapping UNIX users to NT user SIDs\. This range of ids should have no existing local or NIS users within it as strange conflicts can occur otherwise\.
    28973390.sp
    28983391See also the
    2899 idmap backend,
    2900 idmap domains, and
    2901 idmap config options.
    2902 .sp
    2903 Default:
    2904 \fB\fIidmap uid\fR = \fR
    2905 .sp
    2906 Example:
    2907 \fB\fIidmap uid\fR = 10000-20000 \fR
    2908 .RE
    2909 .PP
     3392\fIidmap backend\fR,
     3393\fIidmap domains\fR, and
     3394\fIidmap config\fR
     3395options\.
     3396.sp
     3397Default:
     3398\fI\fIidmap uid\fR\fR\fI = \fR\fI\fR\fI \fR
     3399.sp
     3400Example:
     3401\fI\fIidmap uid\fR\fR\fI = \fR\fI10000\-20000\fR\fI \fR
     3402.RE
     3403
    29103404include (G)
    2911 .RS 3n
    2912 This allows you to include one config file inside another. The file is included literally, as though typed in place.
     3405.PP
     3406.RS 4
     3407This allows you to include one config file inside another\. The file is included literally, as though typed in place\.
    29133408.sp
    29143409It takes the standard substitutions, except
    … …  
    29163411\fI%P\fR
    29173412and
    2918 \fI%S\fR.
    2919 .sp
    2920 Default:
    2921 \fB\fIinclude\fR = \fR
    2922 .sp
    2923 Example:
    2924 \fB\fIinclude\fR = /usr/local/samba/lib/admin_smb.conf \fR
    2925 .RE
    2926 .PP
     3413\fI%S\fR\.
     3414.sp
     3415Default:
     3416\fI\fIinclude\fR\fR\fI = \fR\fI\fR\fI \fR
     3417.sp
     3418Example:
     3419\fI\fIinclude\fR\fR\fI = \fR\fI/usr/local/samba/lib/admin_smb\.conf\fR\fI \fR
     3420.RE
     3421
    29273422inherit acls (S)
    2928 .RS 3n
    2929 This parameter can be used to ensure that if default acls exist on parent directories, they are always honored when creating a new file or subdirectory in these parent directories. The default behavior is to use the unix mode specified when creating the directory. Enabling this option sets the unix mode to 0777, thus guaranteeing that default directory acls are propagated.
    2930 .sp
    2931 Default:
    2932 \fB\fIinherit acls\fR = no \fR
    2933 .RE
    2934 .PP
     3423.PP
     3424.RS 4
     3425This parameter can be used to ensure that if default acls exist on parent directories, they are always honored when creating a new file or subdirectory in these parent directories\. The default behavior is to use the unix mode specified when creating the directory\. Enabling this option sets the unix mode to 0777, thus guaranteeing that default directory acls are propagated\.
     3426.sp
     3427Default:
     3428\fI\fIinherit acls\fR\fR\fI = \fR\fIno\fR\fI \fR
     3429.RE
     3430
    29353431inherit owner (S)
    2936 .RS 3n
    2937 The ownership of new files and directories is normally governed by effective uid of the connected user. This option allows the Samba administrator to specify that the ownership for new files and directories should be controlled by the ownership of the parent directory.
    2938 .sp
    2939 Common scenarios where this behavior is useful is in implementing drop-boxes where users can create and edit files but not delete them and to ensure that newly create files in a user's roaming profile directory are actually owner by the user.
    2940 .sp
    2941 Default:
    2942 \fB\fIinherit owner\fR = no \fR
    2943 .RE
    2944 .PP
     3432.PP
     3433.RS 4
     3434The ownership of new files and directories is normally governed by effective uid of the connected user\. This option allows the Samba administrator to specify that the ownership for new files and directories should be controlled by the ownership of the parent directory\.
     3435.sp
     3436Common scenarios where this behavior is useful is in implementing drop\-boxes where users can create and edit files but not delete them and to ensure that newly create files in a user\'s roaming profile directory are actually owner by the user\.
     3437.sp
     3438Default:
     3439\fI\fIinherit owner\fR\fR\fI = \fR\fIno\fR\fI \fR
     3440.RE
     3441
    29453442inherit permissions (S)
    2946 .RS 3n
     3443.PP
     3444.RS 4
    29473445The permissions on new files and directories are normally governed by
    2948 create mask,
    2949 directory mask,
    2950 force create mode and
    2951 force directory mode but the boolean inherit permissions parameter overrides this.
    2952 .sp
    2953 New directories inherit the mode of the parent directory, including bits such as setgid.
    2954 .sp
    2955 New files inherit their read/write bits from the parent directory. Their execute bits continue to be determined by
    2956 map archive,
    2957 map hidden and
    2958 map system as usual.
     3446\fIcreate mask\fR,
     3447\fIdirectory mask\fR,
     3448\fIforce create mode\fR
     3449and
     3450\fIforce directory mode\fR
     3451but the boolean inherit permissions parameter overrides this\.
     3452.sp
     3453New directories inherit the mode of the parent directory, including bits such as setgid\.
     3454.sp
     3455New files inherit their read/write bits from the parent directory\. Their execute bits continue to be determined by
     3456\fImap archive\fR,
     3457\fImap hidden\fR
     3458and
     3459\fImap system\fR
     3460as usual\.
    29593461.sp
    29603462Note that the setuid bit is
    2961 \fBnever\fR
    2962 set via inheritance (the code explicitly prohibits this).
    2963 .sp
    2964 This can be particularly useful on large systems with many users, perhaps several thousand, to allow a single [homes] share to be used flexibly by each user.
    2965 .sp
    2966 Default:
    2967 \fB\fIinherit permissions\fR = no \fR
    2968 .RE
    2969 .PP
     3463\fInever\fR
     3464set via inheritance (the code explicitly prohibits this)\.
     3465.sp
     3466This can be particularly useful on large systems with many users, perhaps several thousand, to allow a single [homes] share to be used flexibly by each user\.
     3467.sp
     3468Default:
     3469\fI\fIinherit permissions\fR\fR\fI = \fR\fIno\fR\fI \fR
     3470.RE
     3471
    29703472interfaces (G)
    2971 .RS 3n
    2972 This option allows you to override the default network interfaces list that Samba will use for browsing, name registration and other NBT traffic. By default Samba will query the kernel for the list of all active interfaces and use any interfaces except 127.0.0.1 that are broadcast capable.
    2973 .sp
    2974 The option takes a list of interface strings. Each string can be in any of the following forms:
    2975 .RS 3n
    2976 .TP 3n
    2977 \(bu
    2978 a network interface name (such as eth0). This may include shell-like wildcards so eth* will match any interface starting with the substring "eth"
    2979 .TP 3n
    2980 \(bu
    2981 an IP address. In this case the netmask is determined from the list of interfaces obtained from the kernel
    2982 .TP 3n
    2983 \(bu
    2984 an IP/mask pair.
    2985 .TP 3n
    2986 \(bu
    2987 a broadcast/mask pair.
    2988 .RE
    2989 .IP "" 3n
    2990 The "mask" parameters can either be a bit length (such as 24 for a C class network) or a full netmask in dotted decimal form.
    2991 .sp
    2992 The "IP" parameters above can either be a full dotted decimal IP address or a hostname which will be looked up via the OS's normal hostname resolution mechanisms.
    2993 .sp
    2994 By default Samba enables all active interfaces that are broadcast capable except the loopback adaptor (IP address 127.0.0.1).
    2995 .sp
    2996 The example below configures three network interfaces corresponding to the eth0 device and IP addresses 192.168.2.10 and 192.168.3.10. The netmasks of the latter two interfaces would be set to 255.255.255.0.
    2997 .sp
    2998 Default:
    2999 \fB\fIinterfaces\fR = \fR
    3000 .sp
    3001 Example:
    3002 \fB\fIinterfaces\fR = eth0 192.168.2.10/24 192.168.3.10/255.255.255.0 \fR
    3003 .RE
    3004 .PP
     3473.PP
     3474.RS 4
     3475This option allows you to override the default network interfaces list that Samba will use for browsing, name registration and other NBT traffic\. By default Samba will query the kernel for the list of all active interfaces and use any interfaces except 127\.0\.0\.1 that are broadcast capable\.
     3476.sp
     3477The option takes a list of interface strings\. Each string can be in any of the following forms:
     3478.sp
     3479.RS 4
     3480.ie n \{\
     3481\h'-04'\(bu\h'+03'\c
     3482.\}
     3483.el \{\
     3484.sp -1
     3485.IP \(bu 2.3
     3486.\}
     3487a network interface name (such as eth0)\. This may include shell\-like wildcards so eth* will match any interface starting with the substring "eth"
     3488.RE
     3489.sp
     3490.RS 4
     3491.ie n \{\
     3492\h'-04'\(bu\h'+03'\c
     3493.\}
     3494.el \{\
     3495.sp -1
     3496.IP \(bu 2.3
     3497.\}
     3498an IP address\. In this case the netmask is determined from the list of interfaces obtained from the kernel
     3499.RE
     3500.sp
     3501.RS 4
     3502.ie n \{\
     3503\h'-04'\(bu\h'+03'\c
     3504.\}
     3505.el \{\
     3506.sp -1
     3507.IP \(bu 2.3
     3508.\}
     3509an IP/mask pair\.
     3510.RE
     3511.sp
     3512.RS 4
     3513.ie n \{\
     3514\h'-04'\(bu\h'+03'\c
     3515.\}
     3516.el \{\
     3517.sp -1
     3518.IP \(bu 2.3
     3519.\}
     3520a broadcast/mask pair\.
     3521.sp
     3522.RE
     3523The "mask" parameters can either be a bit length (such as 24 for a C class network) or a full netmask in dotted decimal form\.
     3524.sp
     3525The "IP" parameters above can either be a full dotted decimal IP address or a hostname which will be looked up via the OS\'s normal hostname resolution mechanisms\.
     3526.sp
     3527By default Samba enables all active interfaces that are broadcast capable except the loopback adaptor (IP address 127\.0\.0\.1)\.
     3528.sp
     3529The example below configures three network interfaces corresponding to the eth0 device and IP addresses 192\.168\.2\.10 and 192\.168\.3\.10\. The netmasks of the latter two interfaces would be set to 255\.255\.255\.0\.
     3530.sp
     3531Default:
     3532\fI\fIinterfaces\fR\fR\fI = \fR\fI\fR\fI \fR
     3533.sp
     3534Example:
     3535\fI\fIinterfaces\fR\fR\fI = \fR\fIeth0 192\.168\.2\.10/24 192\.168\.3\.10/255\.255\.255\.0\fR\fI \fR
     3536.RE
     3537
    30053538invalid users (S)
    3006 .RS 3n
    3007 This is a list of users that should not be allowed to login to this service. This is really a
    3008 \fBparanoid\fR
    3009 check to absolutely ensure an improper setting does not breach your security.
    3010 .sp
    3011 A name starting with a '@' is interpreted as an NIS netgroup first (if your system supports NIS), and then as a UNIX group if the name was not found in the NIS netgroup database.
    3012 .sp
    3013 A name starting with '+' is interpreted only by looking in the UNIX group database via the NSS getgrnam() interface. A name starting with '&' is interpreted only by looking in the NIS netgroup database (this requires NIS to be working on your system). The characters '+' and '&' may be used at the start of the name in either order so the value
     3539.PP
     3540.RS 4
     3541This is a list of users that should not be allowed to login to this service\. This is really a
     3542\fIparanoid\fR
     3543check to absolutely ensure an improper setting does not breach your security\.
     3544.sp
     3545A name starting with a \'@\' is interpreted as an NIS netgroup first (if your system supports NIS), and then as a UNIX group if the name was not found in the NIS netgroup database\.
     3546.sp
     3547A name starting with \'+\' is interpreted only by looking in the UNIX group database via the NSS getgrnam() interface\. A name starting with \'&\' is interpreted only by looking in the NIS netgroup database (this requires NIS to be working on your system)\. The characters \'+\' and \'&\' may be used at the start of the name in either order so the value
    30143548\fI+&group\fR
    30153549means check the UNIX group database, followed by the NIS netgroup database, and the value
    30163550\fI&+group\fR
    3017 means check the NIS netgroup database, followed by the UNIX group database (the same as the '@' prefix).
     3551means check the NIS netgroup database, followed by the UNIX group database (the same as the \'@\' prefix)\.
    30183552.sp
    30193553The current servicename is substituted for
    3020 \fI%S\fR. This is useful in the [homes] section.
    3021 .sp
    3022 Default:
    3023 \fB\fIinvalid users\fR = # no invalid users \fR
    3024 .sp
    3025 Example:
    3026 \fB\fIinvalid users\fR = root fred admin @wheel \fR
    3027 .RE
    3028 .PP
     3554\fI%S\fR\. This is useful in the [homes] section\.
     3555.sp
     3556Default:
     3557\fI\fIinvalid users\fR\fR\fI = \fR\fI # no invalid users\fR\fI \fR
     3558.sp
     3559Example:
     3560\fI\fIinvalid users\fR\fR\fI = \fR\fIroot fred admin @wheel\fR\fI \fR
     3561.RE
     3562
    30293563iprint server (G)
    3030 .RS 3n
     3564.PP
     3565.RS 4
    30313566This parameter is only applicable if
    3032 printing is set to
    3033 \fBiprint\fR.
     3567\fIprinting\fR
     3568is set to
     3569\fBiprint\fR\.
    30343570.sp
    30353571If set, this option overrides the ServerName option in the CUPS
    3036 \fIclient.conf\fR. This is necessary if you have virtual samba servers that connect to different CUPS daemons.
    3037 .sp
    3038 Default:
    3039 \fB\fIiprint server\fR = "" \fR
    3040 .sp
    3041 Example:
    3042 \fB\fIiprint server\fR = MYCUPSSERVER \fR
    3043 .RE
    3044 .PP
     3572\fIclient\.conf\fR\. This is necessary if you have virtual samba servers that connect to different CUPS daemons\.
     3573.sp
     3574Default:
     3575\fI\fIiprint server\fR\fR\fI = \fR\fI""\fR\fI \fR
     3576.sp
     3577Example:
     3578\fI\fIiprint server\fR\fR\fI = \fR\fIMYCUPSSERVER\fR\fI \fR
     3579.RE
     3580
    30453581keepalive (G)
    3046 .RS 3n
     3582.PP
     3583.RS 4
    30473584The value of the parameter (an integer) represents the number of seconds between
    30483585\fIkeepalive\fR
    3049 packets. If this parameter is zero, no keepalive packets will be sent. Keepalive packets, if sent, allow the server to tell whether a client is still present and responding.
    3050 .sp
    3051 Keepalives should, in general, not be needed if the socket has the SO_KEEPALIVE attribute set on it by default. (see
    3052 socket options). Basically you should only use this option if you strike difficulties.
    3053 .sp
    3054 Default:
    3055 \fB\fIkeepalive\fR = 300 \fR
    3056 .sp
    3057 Example:
    3058 \fB\fIkeepalive\fR = 600 \fR
    3059 .RE
    3060 .PP
     3586packets\. If this parameter is zero, no keepalive packets will be sent\. Keepalive packets, if sent, allow the server to tell whether a client is still present and responding\.
     3587.sp
     3588Keepalives should, in general, not be needed if the socket has the SO_KEEPALIVE attribute set on it by default\. (see
     3589\fIsocket options\fR)\. Basically you should only use this option if you strike difficulties\.
     3590.sp
     3591Default:
     3592\fI\fIkeepalive\fR\fR\fI = \fR\fI300\fR\fI \fR
     3593.sp
     3594Example:
     3595\fI\fIkeepalive\fR\fR\fI = \fR\fI600\fR\fI \fR
     3596.RE
     3597
    30613598kernel change notify (S)
    3062 .RS 3n
    3063 This parameter specifies whether Samba should ask the kernel for change notifications in directories so that SMB clients can refresh whenever the data on the server changes.
    3064 .sp
    3065 This parameter is only used when your kernel supports change notification to user programs using the inotify interface.
    3066 .sp
    3067 Default:
    3068 \fB\fIkernel change notify\fR = yes \fR
    3069 .RE
    3070 .PP
     3599.PP
     3600.RS 4
     3601This parameter specifies whether Samba should ask the kernel for change notifications in directories so that SMB clients can refresh whenever the data on the server changes\.
     3602.sp
     3603This parameter is only used when your kernel supports change notification to user programs using the inotify interface\.
     3604.sp
     3605Default:
     3606\fI\fIkernel change notify\fR\fR\fI = \fR\fIyes\fR\fI \fR
     3607.RE
     3608
    30713609kernel oplocks (G)
    3072 .RS 3n
     3610.PP
     3611.RS 4
    30733612For UNIXes that support kernel based
    3074 oplocks (currently only IRIX and the Linux 2.4 kernel), this parameter allows the use of them to be turned on or off.
     3613\fIoplocks\fR
     3614(currently only IRIX and the Linux 2\.4 kernel), this parameter allows the use of them to be turned on or off\.
    30753615.sp
    30763616Kernel oplocks support allows Samba
    … …  
    30783618to be broken whenever a local UNIX process or NFS operation accesses a file that
    30793619\fBsmbd\fR(8)
    3080 has oplocked. This allows complete data consistency between SMB/CIFS, NFS and local file access (and is a
    3081 \fBvery\fR
    3082 cool feature :-).
     3620has oplocked\. This allows complete data consistency between SMB/CIFS, NFS and local file access (and is a
     3621\fIvery\fR
     3622cool feature :\-)\.
    30833623.sp
    30843624This parameter defaults to
    3085 \fBon\fR, but is translated to a no-op on systems that no not have the necessary kernel support. You should never need to touch this parameter.
    3086 .sp
    3087 Default:
    3088 \fB\fIkernel oplocks\fR = yes \fR
    3089 .RE
    3090 .PP
     3625\fBon\fR, but is translated to a no\-op on systems that no not have the necessary kernel support\. You should never need to touch this parameter\.
     3626.sp
     3627Default:
     3628\fI\fIkernel oplocks\fR\fR\fI = \fR\fIyes\fR\fI \fR
     3629.RE
     3630
    30913631lanman auth (G)
    3092 .RS 3n
     3632.PP
     3633.RS 4
    30933634This parameter determines whether or not
    30943635\fBsmbd\fR(8)
    3095 will attempt to authenticate users or permit password changes using the LANMAN password hash. If disabled, only clients which support NT password hashes (e.g. Windows NT/2000 clients, smbclient, but not Windows 95/98 or the MS DOS network client) will be able to connect to the Samba host.
    3096 .sp
    3097 The LANMAN encrypted response is easily broken, due to it's case-insensitive nature, and the choice of algorithm. Servers without Windows 95/98/ME or MS DOS clients are advised to disable this option.
     3636will attempt to authenticate users or permit password changes using the LANMAN password hash\. If disabled, only clients which support NT password hashes (e\.g\. Windows NT/2000 clients, smbclient, but not Windows 95/98 or the MS DOS network client) will be able to connect to the Samba host\.
     3637.sp
     3638The LANMAN encrypted response is easily broken, due to it\'s case\-insensitive nature, and the choice of algorithm\. Servers without Windows 95/98/ME or MS DOS clients are advised to disable this option\.
    30983639.sp
    30993640Unlike the
    31003641encrypt passwords
    3101 option, this parameter cannot alter client behaviour, and the LANMAN response will still be sent over the network. See the
     3642option, this parameter cannot alter client behaviour, and the LANMAN response will still be sent over the network\. See the
    31023643client lanman auth
    3103 to disable this for Samba's clients (such as smbclient)
     3644to disable this for Samba\'s clients (such as smbclient)
    31043645.sp
    31053646If this option, and
    31063647ntlm auth
    3107 are both disabled, then only NTLMv2 logins will be permited. Not all clients support NTLMv2, and most will require special configuration to use it.
    3108 .sp
    3109 Default:
    3110 \fB\fIlanman auth\fR = yes \fR
    3111 .RE
    3112 .PP
     3648are both disabled, then only NTLMv2 logins will be permited\. Not all clients support NTLMv2, and most will require special configuration to use it\.
     3649.sp
     3650Default:
     3651\fI\fIlanman auth\fR\fR\fI = \fR\fIyes\fR\fI \fR
     3652.RE
     3653
    31133654large readwrite (G)
    3114 .RS 3n
     3655.PP
     3656.RS 4
    31153657This parameter determines whether or not
    31163658\fBsmbd\fR(8)
    3117 supports the new 64k streaming read and write varient SMB requests introduced with Windows 2000. Note that due to Windows 2000 client redirector bugs this requires Samba to be running on a 64-bit capable operating system such as IRIX, Solaris or a Linux 2.4 kernel. Can improve performance by 10% with Windows 2000 clients. Defaults to on. Not as tested as some other Samba code paths.
    3118 .sp
    3119 Default:
    3120 \fB\fIlarge readwrite\fR = yes \fR
    3121 .RE
    3122 .PP
     3659supports the new 64k streaming read and write varient SMB requests introduced with Windows 2000\. Note that due to Windows 2000 client redirector bugs this requires Samba to be running on a 64\-bit capable operating system such as IRIX, Solaris or a Linux 2\.4 kernel\. Can improve performance by 10% with Windows 2000 clients\. Defaults to on\. Not as tested as some other Samba code paths\.
     3660.sp
     3661Default:
     3662\fI\fIlarge readwrite\fR\fR\fI = \fR\fIyes\fR\fI \fR
     3663.RE
     3664
    31233665ldap admin dn (G)
    3124 .RS 3n
     3666.PP
     3667.RS 4
    31253668The
    3126 ldap admin dn defines the Distinguished Name (DN) name used by Samba to contact the ldap server when retreiving user account information. The
    3127 ldap admin dn is used in conjunction with the admin dn password stored in the
    3128 \fIprivate/secrets.tdb\fR
    3129 file. See the
     3669\fIldap admin dn\fR
     3670defines the Distinguished Name (DN) name used by Samba to contact the ldap server when retreiving user account information\. The
     3671\fIldap admin dn\fR
     3672is used in conjunction with the admin dn password stored in the
     3673\fIprivate/secrets\.tdb\fR
     3674file\. See the
    31303675\fBsmbpasswd\fR(8)
    3131 man page for more information on how to accomplish this.
     3676man page for more information on how to accomplish this\.
    31323677.sp
    31333678The
    3134 ldap admin dn requires a fully specified DN. The
    3135 ldap suffix is not appended to the
    3136 ldap admin dn.
    3137 .sp
    3138 \fBNo default\fR
    3139 .RE
    3140 .PP
     3679\fIldap admin dn\fR
     3680requires a fully specified DN\. The
     3681\fIldap suffix\fR
     3682is not appended to the
     3683\fIldap admin dn\fR\.
     3684.sp
     3685\fINo default\fR
     3686.RE
     3687
    31413688ldap delete dn (G)
    3142 .RS 3n
    3143 This parameter specifies whether a delete operation in the ldapsam deletes the complete entry or only the attributes specific to Samba.
    3144 .sp
    3145 Default:
    3146 \fB\fIldap delete dn\fR = no \fR
    3147 .RE
    3148 .PP
     3689.PP
     3690.RS 4
     3691This parameter specifies whether a delete operation in the ldapsam deletes the complete entry or only the attributes specific to Samba\.
     3692.sp
     3693Default:
     3694\fI\fIldap delete dn\fR\fR\fI = \fR\fIno\fR\fI \fR
     3695.RE
     3696
    31493697ldap group suffix (G)
    3150 .RS 3n
    3151 This parameter specifies the suffix that is used for groups when these are added to the LDAP directory. If this parameter is unset, the value of
    3152 ldap suffix will be used instead. The suffix string is pre-pended to the
    3153 ldap suffix string so use a partial DN.
    3154 .sp
    3155 Default:
    3156 \fB\fIldap group suffix\fR = \fR
    3157 .sp
    3158 Example:
    3159 \fB\fIldap group suffix\fR = ou=Groups \fR
    3160 .RE
    3161 .PP
     3698.PP
     3699.RS 4
     3700This parameter specifies the suffix that is used for groups when these are added to the LDAP directory\. If this parameter is unset, the value of
     3701\fIldap suffix\fR
     3702will be used instead\. The suffix string is pre\-pended to the
     3703\fIldap suffix\fR
     3704string so use a partial DN\.
     3705.sp
     3706Default:
     3707\fI\fIldap group suffix\fR\fR\fI = \fR\fI\fR\fI \fR
     3708.sp
     3709Example:
     3710\fI\fIldap group suffix\fR\fR\fI = \fR\fIou=Groups\fR\fI \fR
     3711.RE
     3712
    31623713ldap idmap suffix (G)
    3163 .RS 3n
    3164 This parameters specifies the suffix that is used when storing idmap mappings. If this parameter is unset, the value of
    3165 ldap suffix will be used instead. The suffix string is pre-pended to the
    3166 ldap suffix string so use a partial DN.
    3167 .sp
    3168 Default:
    3169 \fB\fIldap idmap suffix\fR = \fR
    3170 .sp
    3171 Example:
    3172 \fB\fIldap idmap suffix\fR = ou=Idmap \fR
    3173 .RE
    3174 .PP
     3714.PP
     3715.RS 4
     3716This parameters specifies the suffix that is used when storing idmap mappings\. If this parameter is unset, the value of
     3717\fIldap suffix\fR
     3718will be used instead\. The suffix string is pre\-pended to the
     3719\fIldap suffix\fR
     3720string so use a partial DN\.
     3721.sp
     3722Default:
     3723\fI\fIldap idmap suffix\fR\fR\fI = \fR\fI\fR\fI \fR
     3724.sp
     3725Example:
     3726\fI\fIldap idmap suffix\fR\fR\fI = \fR\fIou=Idmap\fR\fI \fR
     3727.RE
     3728
    31753729ldap machine suffix (G)
    3176 .RS 3n
    3177 It specifies where machines should be added to the ldap tree. If this parameter is unset, the value of
    3178 ldap suffix will be used instead. The suffix string is pre-pended to the
    3179 ldap suffix string so use a partial DN.
    3180 .sp
    3181 Default:
    3182 \fB\fIldap machine suffix\fR = \fR
    3183 .sp
    3184 Example:
    3185 \fB\fIldap machine suffix\fR = ou=Computers \fR
    3186 .RE
    3187 .PP
     3730.PP
     3731.RS 4
     3732It specifies where machines should be added to the ldap tree\. If this parameter is unset, the value of
     3733\fIldap suffix\fR
     3734will be used instead\. The suffix string is pre\-pended to the
     3735\fIldap suffix\fR
     3736string so use a partial DN\.
     3737.sp
     3738Default:
     3739\fI\fIldap machine suffix\fR\fR\fI = \fR\fI\fR\fI \fR
     3740.sp
     3741Example:
     3742\fI\fIldap machine suffix\fR\fR\fI = \fR\fIou=Computers\fR\fI \fR
     3743.RE
     3744
    31883745ldap passwd sync (G)
    3189 .RS 3n
    3190 This option is used to define whether or not Samba should sync the LDAP password with the NT and LM hashes for normal accounts (NOT for workstation, server or domain trusts) on a password change via SAMBA.
     3746.PP
     3747.RS 4
     3748This option is used to define whether or not Samba should sync the LDAP password with the NT and LM hashes for normal accounts (NOT for workstation, server or domain trusts) on a password change via SAMBA\.
    31913749.sp
    31923750The
    3193 ldap passwd sync can be set to one of three values:
    3194 .RS 3n
    3195 .TP 3n
    3196 \(bu
     3751\fIldap passwd sync\fR
     3752can be set to one of three values:
     3753.sp
     3754.RS 4
     3755.ie n \{\
     3756\h'-04'\(bu\h'+03'\c
     3757.\}
     3758.el \{\
     3759.sp -1
     3760.IP \(bu 2.3
     3761.\}
    31973762\fIYes\fR
    3198 = Try to update the LDAP, NT and LM passwords and update the pwdLastSet time.
    3199 .TP 3n
    3200 \(bu
     3763= Try to update the LDAP, NT and LM passwords and update the pwdLastSet time\.
     3764.RE
     3765.sp
     3766.RS 4
     3767.ie n \{\
     3768\h'-04'\(bu\h'+03'\c
     3769.\}
     3770.el \{\
     3771.sp -1
     3772.IP \(bu 2.3
     3773.\}
    32013774\fINo\fR
    3202 = Update NT and LM passwords and update the pwdLastSet time.
    3203 .TP 3n
    3204 \(bu
     3775= Update NT and LM passwords and update the pwdLastSet time\.
     3776.RE
     3777.sp
     3778.RS 4
     3779.ie n \{\
     3780\h'-04'\(bu\h'+03'\c
     3781.\}
     3782.el \{\
     3783.sp -1
     3784.IP \(bu 2.3
     3785.\}
    32053786\fIOnly\fR
    3206 = Only update the LDAP password and let the LDAP server do the rest.
    3207 .RE
    3208 .IP "" 3n
    3209 Default:
    3210 \fB\fIldap passwd sync\fR = no \fR
    3211 .RE
    3212 .PP
     3787= Only update the LDAP password and let the LDAP server do the rest\.
     3788.sp
     3789.RE
     3790Default:
     3791\fI\fIldap passwd sync\fR\fR\fI = \fR\fIno\fR\fI \fR
     3792.RE
     3793
    32133794ldap replication sleep (G)
    3214 .RS 3n
    3215 When Samba is asked to write to a read-only LDAP replica, we are redirected to talk to the read-write master server. This server then replicates our changes back to the 'local' server, however the replication might take some seconds, especially over slow links. Certain client activities, particularly domain joins, can become confused by the 'success' that does not immediately change the LDAP back-end's data.
    3216 .sp
    3217 This option simply causes Samba to wait a short time, to allow the LDAP server to catch up. If you have a particularly high-latency network, you may wish to time the LDAP replication with a network sniffer, and increase this value accordingly. Be aware that no checking is performed that the data has actually replicated.
    3218 .sp
    3219 The value is specified in milliseconds, the maximum value is 5000 (5 seconds).
    3220 .sp
    3221 Default:
    3222 \fB\fIldap replication sleep\fR = 1000 \fR
    3223 .RE
    3224 .PP
     3795.PP
     3796.RS 4
     3797When Samba is asked to write to a read\-only LDAP replica, we are redirected to talk to the read\-write master server\. This server then replicates our changes back to the \'local\' server, however the replication might take some seconds, especially over slow links\. Certain client activities, particularly domain joins, can become confused by the \'success\' that does not immediately change the LDAP back\-end\'s data\.
     3798.sp
     3799This option simply causes Samba to wait a short time, to allow the LDAP server to catch up\. If you have a particularly high\-latency network, you may wish to time the LDAP replication with a network sniffer, and increase this value accordingly\. Be aware that no checking is performed that the data has actually replicated\.
     3800.sp
     3801The value is specified in milliseconds, the maximum value is 5000 (5 seconds)\.
     3802.sp
     3803Default:
     3804\fI\fIldap replication sleep\fR\fR\fI = \fR\fI1000\fR\fI \fR
     3805.RE
     3806
    32253807ldapsam:editposix (G)
    3226 .RS 3n
    3227 Editposix is an option that leverages ldapsam:trusted to make it simpler to manage a domain controller eliminating the need to set up custom scripts to add and manage the posix users and groups. This option will instead directly manipulate the ldap tree to create, remove and modify user and group entries. This option also requires a running winbindd as it is used to allocate new uids/gids on user/group creation. The allocation range must be therefore configured.
    3228 .sp
    3229 To use this option, a basic ldap tree must be provided and the ldap suffix parameters must be properly configured. On virgin servers the default users and groups (Administrator, Guest, Domain Users, Domain Admins, Domain Guests) can be precreated with the command
    3230 net sam provision. To run this command the ldap server must be running, Winindd must be running and the smb.conf ldap options must be properly configured. The typical ldap setup used with the
    3231 ldapsam:trusted = yes option is usually sufficient to use
    3232 ldapsam:editposix = yes as well.
     3808.PP
     3809.RS 4
     3810Editposix is an option that leverages ldapsam:trusted to make it simpler to manage a domain controller eliminating the need to set up custom scripts to add and manage the posix users and groups\. This option will instead directly manipulate the ldap tree to create, remove and modify user and group entries\. This option also requires a running winbindd as it is used to allocate new uids/gids on user/group creation\. The allocation range must be therefore configured\.
     3811.sp
     3812To use this option, a basic ldap tree must be provided and the ldap suffix parameters must be properly configured\. On virgin servers the default users and groups (Administrator, Guest, Domain Users, Domain Admins, Domain Guests) can be precreated with the command
     3813net sam provision\. To run this command the ldap server must be running, Winindd must be running and the smb\.conf ldap options must be properly configured\. The typical ldap setup used with the
     3814\fIldapsam:trusted = yes\fR
     3815option is usually sufficient to use
     3816\fIldapsam:editposix = yes\fR
     3817as well\.
    32333818.sp
    32343819An example configuration can be the following:
    3235 
    3236 .sp
    3237 
     3820.sp
     3821.RS 4
    32383822.nf
    3239 
    32403823        encrypt passwords = true
    32413824        passdb backend = ldapsam
    … …  
    32543837        idmap backend = ldap:"ldap://localhost"
    32553838
    3256         idmap uid = 5000-50000
    3257         idmap gid = 5000-50000
     3839        idmap uid = 5000\-50000
     3840        idmap gid = 5000\-50000
    32583841       
    32593842.fi
     3843.RE
     3844.sp
    32603845This configuration assume the ldap server have been loaded with a base tree like described in the following ldif:
    3261 
    3262 .sp
    3263 
     3846.sp
     3847.RS 4
    32643848.nf
    3265 
    32663849        dn: dc=samba,dc=org
    32673850        objectClass: top
    32683851        objectClass: dcObject
    32693852        objectClass: organization
    3270         o: samba.org
     3853        o: samba\.org
    32713854        dc: samba
    32723855
    … …  
    32993882       
    33003883.fi
    3301 
    3302 .sp
    3303 Default:
    3304 \fB\fIldapsam:editposix\fR = no \fR
    3305 .RE
    3306 .PP
     3884.RE
     3885.sp
     3886.sp
     3887Default:
     3888\fI\fIldapsam:editposix\fR\fR\fI = \fR\fIno\fR\fI \fR
     3889.RE
     3890
    33073891ldapsam:trusted (G)
    3308 .RS 3n
    3309 By default, Samba as a Domain Controller with an LDAP backend needs to use the Unix-style NSS subsystem to access user and group information. Due to the way Unix stores user information in /etc/passwd and /etc/group this inevitably leads to inefficiencies. One important question a user needs to know is the list of groups he is member of. The plain UNIX model involves a complete enumeration of the file /etc/group and its NSS counterparts in LDAP. UNIX has optimized functions to enumerate group membership. Sadly, other functions that are used to deal with user and group attributes lack such optimization.
     3892.PP
     3893.RS 4
     3894By default, Samba as a Domain Controller with an LDAP backend needs to use the Unix\-style NSS subsystem to access user and group information\. Due to the way Unix stores user information in /etc/passwd and /etc/group this inevitably leads to inefficiencies\. One important question a user needs to know is the list of groups he is member of\. The plain UNIX model involves a complete enumeration of the file /etc/group and its NSS counterparts in LDAP\. UNIX has optimized functions to enumerate group membership\. Sadly, other functions that are used to deal with user and group attributes lack such optimization\.
    33103895.sp
    33113896To make Samba scale well in large environments, the
    3312 ldapsam:trusted = yes option assumes that the complete user and group database that is relevant to Samba is stored in LDAP with the standard posixAccount/posixGroup attributes. It further assumes that the Samba auxiliary object classes are stored together with the POSIX data in the same LDAP object. If these assumptions are met,
    3313 ldapsam:trusted = yes can be activated and Samba can bypass the NSS system to query user group memberships. Optimized LDAP queries can greatly speed up domain logon and administration tasks. Depending on the size of the LDAP database a factor of 100 or more for common queries is easily achieved.
    3314 .sp
    3315 Default:
    3316 \fB\fIldapsam:trusted\fR = no \fR
    3317 .RE
    3318 .PP
     3897\fIldapsam:trusted = yes\fR
     3898option assumes that the complete user and group database that is relevant to Samba is stored in LDAP with the standard posixAccount/posixGroup attributes\. It further assumes that the Samba auxiliary object classes are stored together with the POSIX data in the same LDAP object\. If these assumptions are met,
     3899\fIldapsam:trusted = yes\fR
     3900can be activated and Samba can bypass the NSS system to query user group memberships\. Optimized LDAP queries can greatly speed up domain logon and administration tasks\. Depending on the size of the LDAP database a factor of 100 or more for common queries is easily achieved\.
     3901.sp
     3902Default:
     3903\fI\fIldapsam:trusted\fR\fR\fI = \fR\fIno\fR\fI \fR
     3904.RE
     3905
    33193906ldap ssl (G)
    3320 .RS 3n
     3907.PP
     3908.RS 4
    33213909This option is used to define whether or not Samba should use SSL when connecting to the ldap server This is
    3322 \fBNOT\fR
    3323 related to Samba's previous SSL support which was enabled by specifying the
    3324 --with-ssl
     3910\fINOT\fR
     3911related to Samba\'s previous SSL support which was enabled by specifying the
     3912\-\-with\-ssl
    33253913option to the
    33263914\fIconfigure\fR
    3327 script.
     3915script\.
    33283916.sp
    33293917The
    3330 ldap ssl can be set to one of three values:
    3331 .RS 3n
    3332 .TP 3n
    3333 \(bu
     3918\fIldap ssl\fR
     3919can be set to one of three values:
     3920.sp
     3921.RS 4
     3922.ie n \{\
     3923\h'-04'\(bu\h'+03'\c
     3924.\}
     3925.el \{\
     3926.sp -1
     3927.IP \(bu 2.3
     3928.\}
    33343929\fIOff\fR
    3335 = Never use SSL when querying the directory.
    3336 .TP 3n
    3337 \(bu
     3930= Never use SSL when querying the directory\.
     3931.RE
     3932.sp
     3933.RS 4
     3934.ie n \{\
     3935\h'-04'\(bu\h'+03'\c
     3936.\}
     3937.el \{\
     3938.sp -1
     3939.IP \(bu 2.3
     3940.\}
    33383941\fIStart_tls\fR
    3339 = Use the LDAPv3 StartTLS extended operation (RFC2830) for communicating with the directory server.
    3340 .TP 3n
    3341 \(bu
     3942= Use the LDAPv3 StartTLS extended operation (RFC2830) for communicating with the directory server\.
     3943.RE
     3944.sp
     3945.RS 4
     3946.ie n \{\
     3947\h'-04'\(bu\h'+03'\c
     3948.\}
     3949.el \{\
     3950.sp -1
     3951.IP \(bu 2.3
     3952.\}
    33423953\fIOn\fR
    33433954= Use SSL on the ldaps port when contacting the
    3344 \fIldap server\fR. Only available when the backwards-compatiblity
    3345 --with-ldapsam
    3346 option is specified to configure. See
    3347 passdb backend
    3348 .
    3349                 .RE
    3350 .IP "" 3n
    3351 Default:
    3352 \fB\fIldap ssl\fR = start_tls \fR
    3353 .RE
    3354 .PP
     3955\fIldap server\fR\. Only available when the backwards\-compatiblity
     3956\-\-with\-ldapsam
     3957option is specified to configure\. See
     3958\fIpassdb backend\fR
     3959\.
     3960                .sp
     3961.RE
     3962Default:
     3963\fI\fIldap ssl\fR\fR\fI = \fR\fIstart_tls\fR\fI \fR
     3964.RE
     3965
    33553966ldap suffix (G)
    3356 .RS 3n
    3357 Specifies the base for all ldap suffixes and for storing the sambaDomain object.
     3967.PP
     3968.RS 4
     3969Specifies the base for all ldap suffixes and for storing the sambaDomain object\.
    33583970.sp
    33593971The ldap suffix will be appended to the values specified for the
    3360 ldap user suffix,
    3361 ldap group suffix,
    3362 ldap machine suffix, and the
    3363 ldap idmap suffix. Each of these should be given only a DN relative to the
    3364 ldap suffix.
    3365 .sp
    3366 Default:
    3367 \fB\fIldap suffix\fR = \fR
    3368 .sp
    3369 Example:
    3370 \fB\fIldap suffix\fR = dc=samba,dc=org \fR
    3371 .RE
    3372 .PP
     3972\fIldap user suffix\fR,
     3973\fIldap group suffix\fR,
     3974\fIldap machine suffix\fR, and the
     3975\fIldap idmap suffix\fR\. Each of these should be given only a DN relative to the
     3976\fIldap suffix\fR\.
     3977.sp
     3978Default:
     3979\fI\fIldap suffix\fR\fR\fI = \fR\fI\fR\fI \fR
     3980.sp
     3981Example:
     3982\fI\fIldap suffix\fR\fR\fI = \fR\fIdc=samba,dc=org\fR\fI \fR
     3983.RE
     3984
    33733985ldap timeout (G)
    3374 .RS 3n
    3375 When Samba connects to an ldap server that servermay be down or unreachable. To prevent Samba from hanging whilst waiting for the connection this parameter specifies in seconds how long Samba should wait before failing the connect. The default is to only wait fifteen seconds for the ldap server to respond to the connect request.
    3376 .sp
    3377 Default:
    3378 \fB\fIldap timeout\fR = 15 \fR
    3379 .RE
    3380 .PP
     3986.PP
     3987.RS 4
     3988When Samba connects to an ldap server that servermay be down or unreachable\. To prevent Samba from hanging whilst waiting for the connection this parameter specifies in seconds how long Samba should wait before failing the connect\. The default is to only wait fifteen seconds for the ldap server to respond to the connect request\.
     3989.sp
     3990Default:
     3991\fI\fIldap timeout\fR\fR\fI = \fR\fI15\fR\fI \fR
     3992.RE
     3993
    33813994ldap user suffix (G)
    3382 .RS 3n
    3383 This parameter specifies where users are added to the tree. If this parameter is unset, the value of
    3384 ldap suffix will be used instead. The suffix string is pre-pended to the
    3385 ldap suffix string so use a partial DN.
    3386 .sp
    3387 Default:
    3388 \fB\fIldap user suffix\fR = \fR
    3389 .sp
    3390 Example:
    3391 \fB\fIldap user suffix\fR = ou=people \fR
    3392 .RE
    3393 .PP
     3995.PP
     3996.RS 4
     3997This parameter specifies where users are added to the tree\. If this parameter is unset, the value of
     3998\fIldap suffix\fR
     3999will be used instead\. The suffix string is pre\-pended to the
     4000\fIldap suffix\fR
     4001string so use a partial DN\.
     4002.sp
     4003Default:
     4004\fI\fIldap user suffix\fR\fR\fI = \fR\fI\fR\fI \fR
     4005.sp
     4006Example:
     4007\fI\fIldap user suffix\fR\fR\fI = \fR\fIou=people\fR\fI \fR
     4008.RE
     4009
    33944010level2 oplocks (S)
    3395 .RS 3n
    3396 This parameter controls whether Samba supports level2 (read-only) oplocks on a share.
    3397 .sp
    3398 Level2, or read-only oplocks allow Windows NT clients that have an oplock on a file to downgrade from a read-write oplock to a read-only oplock once a second client opens the file (instead of releasing all oplocks on a second open, as in traditional, exclusive oplocks). This allows all openers of the file that support level2 oplocks to cache the file for read-ahead only (ie. they may not cache writes or lock requests) and increases performance for many accesses of files that are not commonly written (such as application .EXE files).
    3399 .sp
    3400 Once one of the clients which have a read-only oplock writes to the file all clients are notified (no reply is needed or waited for) and told to break their oplocks to "none" and delete any read-ahead caches.
    3401 .sp
    3402 It is recommended that this parameter be turned on to speed access to shared executables.
    3403 .sp
    3404 For more discussions on level2 oplocks see the CIFS spec.
     4011.PP
     4012.RS 4
     4013This parameter controls whether Samba supports level2 (read\-only) oplocks on a share\.
     4014.sp
     4015Level2, or read\-only oplocks allow Windows NT clients that have an oplock on a file to downgrade from a read\-write oplock to a read\-only oplock once a second client opens the file (instead of releasing all oplocks on a second open, as in traditional, exclusive oplocks)\. This allows all openers of the file that support level2 oplocks to cache the file for read\-ahead only (ie\. they may not cache writes or lock requests) and increases performance for many accesses of files that are not commonly written (such as application \.EXE files)\.
     4016.sp
     4017Once one of the clients which have a read\-only oplock writes to the file all clients are notified (no reply is needed or waited for) and told to break their oplocks to "none" and delete any read\-ahead caches\.
     4018.sp
     4019It is recommended that this parameter be turned on to speed access to shared executables\.
     4020.sp
     4021For more discussions on level2 oplocks see the CIFS spec\.
    34054022.sp
    34064023Currently, if
    3407 kernel oplocks are supported then level2 oplocks are not granted (even if this parameter is set to
    3408 \fByes\fR). Note also, the
    3409 oplocks parameter must be set to
     4024\fIkernel oplocks\fR
     4025are supported then level2 oplocks are not granted (even if this parameter is set to
     4026\fByes\fR)\. Note also, the
     4027\fIoplocks\fR
     4028parameter must be set to
    34104029\fByes\fR
    3411 on this share in order for this parameter to have any effect.
    3412 .sp
    3413 Default:
    3414 \fB\fIlevel2 oplocks\fR = yes \fR
    3415 .RE
    3416 .PP
     4030on this share in order for this parameter to have any effect\.
     4031.sp
     4032Default:
     4033\fI\fIlevel2 oplocks\fR\fR\fI = \fR\fIyes\fR\fI \fR
     4034.RE
     4035
    34174036lm announce (G)
    3418 .RS 3n
     4037.PP
     4038.RS 4
    34194039This parameter determines if
    34204040\fBnmbd\fR(8)
    3421 will produce Lanman announce broadcasts that are needed by OS/2 clients in order for them to see the Samba server in their browse list. This parameter can have three values,
     4041will produce Lanman announce broadcasts that are needed by OS/2 clients in order for them to see the Samba server in their browse list\. This parameter can have three values,
    34224042\fByes\fR,
    34234043\fBno\fR, or
    3424 \fBauto\fR. The default is
    3425 \fBauto\fR. If set to
     4044\fBauto\fR\. The default is
     4045\fBauto\fR\. If set to
    34264046\fBno\fR
    3427 Samba will never produce these broadcasts. If set to
     4047Samba will never produce these broadcasts\. If set to
    34284048\fByes\fR
    34294049Samba will produce Lanman announce broadcasts at a frequency set by the parameter
    3430 lm interval. If set to
     4050\fIlm interval\fR\. If set to
    34314051\fBauto\fR
    3432 Samba will not send Lanman announce broadcasts by default but will listen for them. If it hears such a broadcast on the wire it will then start sending them at a frequency set by the parameter
    3433 lm interval.
    3434 .sp
    3435 Default:
    3436 \fB\fIlm announce\fR = auto \fR
    3437 .sp
    3438 Example:
    3439 \fB\fIlm announce\fR = yes \fR
    3440 .RE
    3441 .PP
     4052Samba will not send Lanman announce broadcasts by default but will listen for them\. If it hears such a broadcast on the wire it will then start sending them at a frequency set by the parameter
     4053\fIlm interval\fR\.
     4054.sp
     4055Default:
     4056\fI\fIlm announce\fR\fR\fI = \fR\fIauto\fR\fI \fR
     4057.sp
     4058Example:
     4059\fI\fIlm announce\fR\fR\fI = \fR\fIyes\fR\fI \fR
     4060.RE
     4061
    34424062lm interval (G)
    3443 .RS 3n
     4063.PP
     4064.RS 4
    34444065If Samba is set to produce Lanman announce broadcasts needed by OS/2 clients (see the
    3445 lm announce parameter) then this parameter defines the frequency in seconds with which they will be made. If this is set to zero then no Lanman announcements will be made despite the setting of the
    3446 lm announce parameter.
    3447 .sp
    3448 Default:
    3449 \fB\fIlm interval\fR = 60 \fR
    3450 .sp
    3451 Example:
    3452 \fB\fIlm interval\fR = 120 \fR
    3453 .RE
    3454 .PP
     4066\fIlm announce\fR
     4067parameter) then this parameter defines the frequency in seconds with which they will be made\. If this is set to zero then no Lanman announcements will be made despite the setting of the
     4068\fIlm announce\fR
     4069parameter\.
     4070.sp
     4071Default:
     4072\fI\fIlm interval\fR\fR\fI = \fR\fI60\fR\fI \fR
     4073.sp
     4074Example:
     4075\fI\fIlm interval\fR\fR\fI = \fR\fI120\fR\fI \fR
     4076.RE
     4077
    34554078load printers (G)
    3456 .RS 3n
    3457 A boolean variable that controls whether all printers in the printcap will be loaded for browsing by default. See the
    3458 printers section for more details.
    3459 .sp
    3460 Default:
    3461 \fB\fIload printers\fR = yes \fR
    3462 .RE
    3463 .PP
     4079.PP
     4080.RS 4
     4081A boolean variable that controls whether all printers in the printcap will be loaded for browsing by default\. See the
     4082\fIprinters\fR
     4083section for more details\.
     4084.sp
     4085Default:
     4086\fI\fIload printers\fR\fR\fI = \fR\fIyes\fR\fI \fR
     4087.RE
     4088
    34644089local master (G)
    3465 .RS 3n
     4090.PP
     4091.RS 4
    34664092This option allows
    34674093\fBnmbd\fR(8)
    3468 to try and become a local master browser on a subnet. If set to
     4094to try and become a local master browser on a subnet\. If set to
    34694095\fBno\fR
    34704096then
    34714097nmbd
    3472 will not attempt to become a local master browser on a subnet and will also lose in all browsing elections. By default this value is set to
    3473 \fByes\fR. Setting this value to
     4098will not attempt to become a local master browser on a subnet and will also lose in all browsing elections\. By default this value is set to
     4099\fByes\fR\. Setting this value to
    34744100\fByes\fR
    3475 doesn't mean that Samba will
    3476 \fBbecome\fR
     4101doesn\'t mean that Samba will
     4102\fIbecome\fR
    34774103the local master browser on a subnet, just that
    34784104nmbd
    34794105will
    3480 \fBparticipate\fR
    3481 in elections for local master browser.
     4106\fIparticipate\fR
     4107in elections for local master browser\.
    34824108.sp
    34834109Setting this value to
    … …  
    34854111will cause
    34864112nmbd
    3487 \fBnever\fR
    3488 to become a local master browser.
    3489 .sp
    3490 Default:
    3491 \fB\fIlocal master\fR = yes \fR
    3492 .RE
    3493 .PP
    3494 lock dir
    3495 .RS 3n
    3496 This parameter is a synonym for lock directory.
    3497 .RE
    3498 .PP
     4113\fInever\fR
     4114to become a local master browser\.
     4115.sp
     4116Default:
     4117\fI\fIlocal master\fR\fR\fI = \fR\fIyes\fR\fI \fR
     4118.RE
     4119lock dir.PP
     4120.RS 4
     4121This parameter is a synonym for
     4122lock directory\.
     4123.RE
     4124
    34994125lock directory (G)
    3500 .RS 3n
    3501 This option specifies the directory where lock files will be placed. The lock files are used to implement the
    3502 max connections option.
    3503 .sp
    3504 Default:
    3505 \fB\fIlock directory\fR = ${prefix}/var/locks \fR
    3506 .sp
    3507 Example:
    3508 \fB\fIlock directory\fR = /var/run/samba/locks \fR
    3509 .RE
    3510 .PP
     4126.PP
     4127.RS 4
     4128This option specifies the directory where lock files will be placed\. The lock files are used to implement the
     4129\fImax connections\fR
     4130option\.
     4131.sp
     4132Default:
     4133\fI\fIlock directory\fR\fR\fI = \fR\fI${prefix}/var/locks\fR\fI \fR
     4134.sp
     4135Example:
     4136\fI\fIlock directory\fR\fR\fI = \fR\fI/var/run/samba/locks\fR\fI \fR
     4137.RE
     4138
    35114139locking (S)
    3512 .RS 3n
    3513 This controls whether or not locking will be performed by the server in response to lock requests from the client.
     4140.PP
     4141.RS 4
     4142This controls whether or not locking will be performed by the server in response to lock requests from the client\.
    35144143.sp
    35154144If
    3516 locking = no, all lock and unlock requests will appear to succeed and all lock queries will report that the file in question is available for locking.
     4145locking = no, all lock and unlock requests will appear to succeed and all lock queries will report that the file in question is available for locking\.
    35174146.sp
    35184147If
    3519 locking = yes, real locking will be performed by the server.
     4148locking = yes, real locking will be performed by the server\.
    35204149.sp
    35214150This option
    3522 \fBmay\fR
    3523 be useful for read-only filesystems which
    3524 \fBmay\fR
     4151\fImay\fR
     4152be useful for read\-only filesystems which
     4153\fImay\fR
    35254154not need locking (such as CDROM drives), although setting this parameter of
    35264155\fBno\fR
    3527 is not really recommended even in this case.
    3528 .sp
    3529 Be careful about disabling locking either globally or in a specific service, as lack of locking may result in data corruption. You should never need to set this parameter.
    3530 .sp
    3531 \fBNo default\fR
    3532 .RE
    3533 .PP
     4156is not really recommended even in this case\.
     4157.sp
     4158Be careful about disabling locking either globally or in a specific service, as lack of locking may result in data corruption\. You should never need to set this parameter\.
     4159.sp
     4160\fINo default\fR
     4161.RE
     4162
    35344163lock spin count (G)
    3535 .RS 3n
    3536 This parameter has been made inoperative in Samba 3.0.24. The functionality it contolled is now controlled by the parameter
    3537 lock spin time.
    3538 .sp
    3539 Default:
    3540 \fB\fIlock spin count\fR = 0 \fR
    3541 .RE
    3542 .PP
     4164.PP
     4165.RS 4
     4166This parameter has been made inoperative in Samba 3\.0\.24\. The functionality it contolled is now controlled by the parameter
     4167\fIlock spin time\fR\.
     4168.sp
     4169Default:
     4170\fI\fIlock spin count\fR\fR\fI = \fR\fI0\fR\fI \fR
     4171.RE
     4172
    35434173lock spin time (G)
    3544 .RS 3n
    3545 The time in microseconds that smbd should keep waiting to see if a failed lock request can be granted. This parameter has changed in default value from Samba 3.0.23 from 10 to 200. The associated
    3546 lock spin count parameter is no longer used in Samba 3.0.24. You should not need to change the value of this parameter.
    3547 .sp
    3548 Default:
    3549 \fB\fIlock spin time\fR = 200 \fR
    3550 .RE
    3551 .PP
     4174.PP
     4175.RS 4
     4176The time in microseconds that smbd should keep waiting to see if a failed lock request can be granted\. This parameter has changed in default value from Samba 3\.0\.23 from 10 to 200\. The associated
     4177\fIlock spin count\fR
     4178parameter is no longer used in Samba 3\.0\.24\. You should not need to change the value of this parameter\.
     4179.sp
     4180Default:
     4181\fI\fIlock spin time\fR\fR\fI = \fR\fI200\fR\fI \fR
     4182.RE
     4183
    35524184log file (G)
    3553 .RS 3n
    3554 This option allows you to override the name of the Samba log file (also known as the debug file).
    3555 .sp
    3556 This option takes the standard substitutions, allowing you to have separate log files for each user or machine.
    3557 .sp
    3558 \fBNo default\fR
    3559 .sp
    3560 Example:
    3561 \fB\fIlog file\fR = /usr/local/samba/var/log.%m \fR
    3562 .RE
    3563 .PP
    3564 debuglevel
    3565 .RS 3n
    3566 This parameter is a synonym for log level.
    3567 .RE
    3568 .PP
     4185.PP
     4186.RS 4
     4187This option allows you to override the name of the Samba log file (also known as the debug file)\.
     4188.sp
     4189This option takes the standard substitutions, allowing you to have separate log files for each user or machine\.
     4190.sp
     4191\fINo default\fR
     4192.sp
     4193Example:
     4194\fI\fIlog file\fR\fR\fI = \fR\fI/usr/local/samba/var/log\.%m\fR\fI \fR
     4195.RE
     4196debuglevel.PP
     4197.RS 4
     4198This parameter is a synonym for
     4199log level\.
     4200.RE
     4201
    35694202log level (G)
    3570 .RS 3n
     4203.PP
     4204.RS 4
    35714205The value of the parameter (a astring) allows the debug level (logging level) to be specified in the
    3572 \fIsmb.conf\fR
    3573 file. This parameter has been extended since the 2.2.x series, now it allow to specify the debug level for multiple debug classes. This is to give greater flexibility in the configuration of the system.
    3574 .sp
    3575 The default will be the log level specified on the command line or level zero if none was specified.
    3576 .sp
    3577 \fBNo default\fR
    3578 .sp
    3579 Example:
    3580 \fB\fIlog level\fR = 3 passdb:5 auth:10 winbind:2 \fR
    3581 .RE
    3582 .PP
     4206\fIsmb\.conf\fR
     4207file\.
     4208.sp
     4209This parameter has been extended since the 2\.2\.x series, now it allows to specify the debug level for multiple debug classes\. This is to give greater flexibility in the configuration of the system\. The following debug classes are currently implemented:
     4210.sp
     4211.RS 4
     4212.ie n \{\
     4213\h'-04'\(bu\h'+03'\c
     4214.\}
     4215.el \{\
     4216.sp -1
     4217.IP \(bu 2.3
     4218.\}
     4219\fIall\fR
     4220.RE
     4221.sp
     4222.RS 4
     4223.ie n \{\
     4224\h'-04'\(bu\h'+03'\c
     4225.\}
     4226.el \{\
     4227.sp -1
     4228.IP \(bu 2.3
     4229.\}
     4230\fItdb\fR
     4231.RE
     4232.sp
     4233.RS 4
     4234.ie n \{\
     4235\h'-04'\(bu\h'+03'\c
     4236.\}
     4237.el \{\
     4238.sp -1
     4239.IP \(bu 2.3
     4240.\}
     4241\fIprintdrivers\fR
     4242.RE
     4243.sp
     4244.RS 4
     4245.ie n \{\
     4246\h'-04'\(bu\h'+03'\c
     4247.\}
     4248.el \{\
     4249.sp -1
     4250.IP \(bu 2.3
     4251.\}
     4252\fIlanman\fR
     4253.RE
     4254.sp
     4255.RS 4
     4256.ie n \{\
     4257\h'-04'\(bu\h'+03'\c
     4258.\}
     4259.el \{\
     4260.sp -1
     4261.IP \(bu 2.3
     4262.\}
     4263\fIsmb\fR
     4264.RE
     4265.sp
     4266.RS 4
     4267.ie n \{\
     4268\h'-04'\(bu\h'+03'\c
     4269.\}
     4270.el \{\
     4271.sp -1
     4272.IP \(bu 2.3
     4273.\}
     4274\fIrpc_parse\fR
     4275.RE
     4276.sp
     4277.RS 4
     4278.ie n \{\
     4279\h'-04'\(bu\h'+03'\c
     4280.\}
     4281.el \{\
     4282.sp -1
     4283.IP \(bu 2.3
     4284.\}
     4285\fIrpc_srv\fR
     4286.RE
     4287.sp
     4288.RS 4
     4289.ie n \{\
     4290\h'-04'\(bu\h'+03'\c
     4291.\}
     4292.el \{\
     4293.sp -1
     4294.IP \(bu 2.3
     4295.\}
     4296\fIrpc_cli\fR
     4297.RE
     4298.sp
     4299.RS 4
     4300.ie n \{\
     4301\h'-04'\(bu\h'+03'\c
     4302.\}
     4303.el \{\
     4304.sp -1
     4305.IP \(bu 2.3
     4306.\}
     4307\fIpassdb\fR
     4308.RE
     4309.sp
     4310.RS 4
     4311.ie n \{\
     4312\h'-04'\(bu\h'+03'\c
     4313.\}
     4314.el \{\
     4315.sp -1
     4316.IP \(bu 2.3
     4317.\}
     4318\fIsam\fR
     4319.RE
     4320.sp
     4321.RS 4
     4322.ie n \{\
     4323\h'-04'\(bu\h'+03'\c
     4324.\}
     4325.el \{\
     4326.sp -1
     4327.IP \(bu 2.3
     4328.\}
     4329\fIauth\fR
     4330.RE
     4331.sp
     4332.RS 4
     4333.ie n \{\
     4334\h'-04'\(bu\h'+03'\c
     4335.\}
     4336.el \{\
     4337.sp -1
     4338.IP \(bu 2.3
     4339.\}
     4340\fIwinbind\fR
     4341.RE
     4342.sp
     4343.RS 4
     4344.ie n \{\
     4345\h'-04'\(bu\h'+03'\c
     4346.\}
     4347.el \{\
     4348.sp -1
     4349.IP \(bu 2.3
     4350.\}
     4351\fIvfs\fR
     4352.RE
     4353.sp
     4354.RS 4
     4355.ie n \{\
     4356\h'-04'\(bu\h'+03'\c
     4357.\}
     4358.el \{\
     4359.sp -1
     4360.IP \(bu 2.3
     4361.\}
     4362\fIidmap\fR
     4363.RE
     4364.sp
     4365.RS 4
     4366.ie n \{\
     4367\h'-04'\(bu\h'+03'\c
     4368.\}
     4369.el \{\
     4370.sp -1
     4371.IP \(bu 2.3
     4372.\}
     4373\fIquota\fR
     4374.RE
     4375.sp
     4376.RS 4
     4377.ie n \{\
     4378\h'-04'\(bu\h'+03'\c
     4379.\}
     4380.el \{\
     4381.sp -1
     4382.IP \(bu 2.3
     4383.\}
     4384\fIacls\fR
     4385.RE
     4386.sp
     4387.RS 4
     4388.ie n \{\
     4389\h'-04'\(bu\h'+03'\c
     4390.\}
     4391.el \{\
     4392.sp -1
     4393.IP \(bu 2.3
     4394.\}
     4395\fIlocking\fR
     4396.RE
     4397.sp
     4398.RS 4
     4399.ie n \{\
     4400\h'-04'\(bu\h'+03'\c
     4401.\}
     4402.el \{\
     4403.sp -1
     4404.IP \(bu 2.3
     4405.\}
     4406\fImsdfs\fR
     4407.RE
     4408.sp
     4409.RS 4
     4410.ie n \{\
     4411\h'-04'\(bu\h'+03'\c
     4412.\}
     4413.el \{\
     4414.sp -1
     4415.IP \(bu 2.3
     4416.\}
     4417\fIdmapi\fR
     4418.RE
     4419.sp
     4420.RS 4
     4421.ie n \{\
     4422\h'-04'\(bu\h'+03'\c
     4423.\}
     4424.el \{\
     4425.sp -1
     4426.IP \(bu 2.3
     4427.\}
     4428\fIregistry\fR
     4429.sp
     4430.RE
     4431Default:
     4432\fI\fIlog level\fR\fR\fI = \fR\fI0\fR\fI \fR
     4433.sp
     4434Example:
     4435\fI\fIlog level\fR\fR\fI = \fR\fI3 passdb:5 auth:10 winbind:2\fR\fI \fR
     4436.RE
     4437
    35834438logon drive (G)
    3584 .RS 3n
     4439.PP
     4440.RS 4
    35854441This parameter specifies the local path to which the home directory will be connected (see
    3586 logon home) and is only used by NT Workstations.
    3587 .sp
    3588 Note that this option is only useful if Samba is set up as a logon server.
    3589 .sp
    3590 Default:
    3591 \fB\fIlogon drive\fR = \fR
    3592 .sp
    3593 Example:
    3594 \fB\fIlogon drive\fR = h: \fR
    3595 .RE
    3596 .PP
     4442\fIlogon home\fR) and is only used by NT Workstations\.
     4443.sp
     4444Note that this option is only useful if Samba is set up as a logon server\.
     4445.sp
     4446Default:
     4447\fI\fIlogon drive\fR\fR\fI = \fR\fI\fR\fI \fR
     4448.sp
     4449Example:
     4450\fI\fIlogon drive\fR\fR\fI = \fR\fIh:\fR\fI \fR
     4451.RE
     4452
    35974453logon home (G)
    3598 .RS 3n
    3599 This parameter specifies the home directory location when a Win95/98 or NT Workstation logs into a Samba PDC. It allows you to do
    3600 .sp
    3601 
    3602 C:\>\fBNET USE H: /HOME\fR
    3603 .sp
    3604 from a command prompt, for example.
    3605 .sp
    3606 This option takes the standard substitutions, allowing you to have separate logon scripts for each user or machine.
    3607 .sp
    3608 This parameter can be used with Win9X workstations to ensure that roaming profiles are stored in a subdirectory of the user's home directory. This is done in the following way:
    3609 .sp
    3610 
    3611 logon home = \\\\%N\\%U\\profile
    3612 .sp
    3613 This tells Samba to return the above string, with substitutions made when a client requests the info, generally in a NetUserGetInfo request. Win9X clients truncate the info to \\server\share when a user does
     4454.PP
     4455.RS 4
     4456This parameter specifies the home directory location when a Win95/98 or NT Workstation logs into a Samba PDC\. It allows you to do
     4457.sp
     4458
     4459C:\e>\fBNET USE H: /HOME\fR
     4460.sp
     4461from a command prompt, for example\.
     4462.sp
     4463This option takes the standard substitutions, allowing you to have separate logon scripts for each user or machine\.
     4464.sp
     4465This parameter can be used with Win9X workstations to ensure that roaming profiles are stored in a subdirectory of the user\'s home directory\. This is done in the following way:
     4466.sp
     4467
     4468logon home = \e\e%N\e%U\eprofile
     4469.sp
     4470This tells Samba to return the above string, with substitutions made when a client requests the info, generally in a NetUserGetInfo request\. Win9X clients truncate the info to \e\eserver\eshare when a user does
    36144471net use /home
    3615 but use the whole string when dealing with profiles.
     4472but use the whole string when dealing with profiles\.
    36164473.sp
    36174474Note that in prior versions of Samba, the
    3618 logon path was returned rather than
    3619 \fIlogon home\fR. This broke
     4475\fIlogon path\fR
     4476was returned rather than
     4477\fIlogon home\fR\. This broke
    36204478net use /home
    3621 but allowed profiles outside the home directory. The current implementation is correct, and can be used for profiles if you use the above trick.
     4479but allowed profiles outside the home directory\. The current implementation is correct, and can be used for profiles if you use the above trick\.
    36224480.sp
    36234481Disable this feature by setting
    3624 logon home = "" - using the empty string.
    3625 .sp
    3626 This option is only useful if Samba is set up as a logon server.
    3627 .sp
    3628 Default:
    3629 \fB\fIlogon home\fR = \\\\%N\\%U \fR
    3630 .sp
    3631 Example:
    3632 \fB\fIlogon home\fR = \\\\remote_smb_server\\%U \fR
    3633 .RE
    3634 .PP
     4482\fIlogon home = ""\fR
     4483\- using the empty string\.
     4484.sp
     4485This option is only useful if Samba is set up as a logon server\.
     4486.sp
     4487Default:
     4488\fI\fIlogon home\fR\fR\fI = \fR\fI\e\e%N\e%U\fR\fI \fR
     4489.sp
     4490Example:
     4491\fI\fIlogon home\fR\fR\fI = \fR\fI\e\eremote_smb_server\e%U\fR\fI \fR
     4492.RE
     4493
    36354494logon path (G)
    3636 .RS 3n
    3637 This parameter specifies the directory where roaming profiles (Desktop, NTuser.dat, etc) are stored. Contrary to previous versions of these manual pages, it has nothing to do with Win 9X roaming profiles. To find out how to handle roaming profiles for Win 9X system, see the
    3638 logon home parameter.
    3639 .sp
    3640 This option takes the standard substitutions, allowing you to have separate logon scripts for each user or machine. It also specifies the directory from which the "Application Data",
     4495.PP
     4496.RS 4
     4497This parameter specifies the directory where roaming profiles (Desktop, NTuser\.dat, etc) are stored\. Contrary to previous versions of these manual pages, it has nothing to do with Win 9X roaming profiles\. To find out how to handle roaming profiles for Win 9X system, see the
     4498\fIlogon home\fR
     4499parameter\.
     4500.sp
     4501This option takes the standard substitutions, allowing you to have separate logon scripts for each user or machine\. It also specifies the directory from which the "Application Data",
    36414502\fIdesktop\fR,
    36424503\fIstart menu\fR,
    36434504\fInetwork neighborhood\fR,
    36444505\fIprograms\fR
    3645 and other folders, and their contents, are loaded and displayed on your Windows NT client.
    3646 .sp
    3647 The share and the path must be readable by the user for the preferences and directories to be loaded onto the Windows NT client. The share must be writeable when the user logs in for the first time, in order that the Windows NT client can create the NTuser.dat and other directories. Thereafter, the directories and any of the contents can, if required, be made read-only. It is not advisable that the NTuser.dat file be made read-only - rename it to NTuser.man to achieve the desired effect (a
    3648 \fBMAN\fRdatory profile).
    3649 .sp
    3650 Windows clients can sometimes maintain a connection to the [homes] share, even though there is no user logged in. Therefore, it is vital that the logon path does not include a reference to the homes share (i.e. setting this parameter to \\%N\homes\profile_path will cause problems).
    3651 .sp
    3652 This option takes the standard substitutions, allowing you to have separate logon scripts for each user or machine.
     4506and other folders, and their contents, are loaded and displayed on your Windows NT client\.
     4507.sp
     4508The share and the path must be readable by the user for the preferences and directories to be loaded onto the Windows NT client\. The share must be writeable when the user logs in for the first time, in order that the Windows NT client can create the NTuser\.dat and other directories\. Thereafter, the directories and any of the contents can, if required, be made read\-only\. It is not advisable that the NTuser\.dat file be made read\-only \- rename it to NTuser\.man to achieve the desired effect (a
     4509\fIMAN\fRdatory profile)\.
     4510.sp
     4511Windows clients can sometimes maintain a connection to the [homes] share, even though there is no user logged in\. Therefore, it is vital that the logon path does not include a reference to the homes share (i\.e\. setting this parameter to \e\e%N\ehomes\eprofile_path will cause problems)\.
     4512.sp
     4513This option takes the standard substitutions, allowing you to have separate logon scripts for each user or machine\.
    36534514.sp
    36544515.it 1 an-trap
    … …  
    36564517.nr an-break-flag 1
    36574518.br
    3658 \fBWarning\fR
    3659 Do not quote the value. Setting this as
    3660 \fB\\%N\profile\%U\fR
    3661 will break profile handling. Where the tdbsam or ldapsam passdb backend is used, at the time the user account is created the value configured for this parameter is written to the passdb backend and that value will over-ride the parameter value present in the smb.conf file. Any error present in the passdb backend account record must be editted using the appropriate tool (pdbedit on the command-line, or any other locally provided system tool).
    3662 Note that this option is only useful if Samba is set up as a domain controller.
    3663 .sp
    3664 Disable the use of roaming profiles by setting the value of this parameter to the empty string. For example,
    3665 logon path = "". Take note that even if the default setting in the smb.conf file is the empty string, any value specified in the user account settings in the passdb backend will over-ride the effect of setting this parameter to null. Disabling of all roaming profile use requires that the user account settings must also be blank.
     4519Warning
     4520Do not quote the value\. Setting this as
     4521\(lq\e\e%N\eprofile\e%U\(rq
     4522will break profile handling\. Where the tdbsam or ldapsam passdb backend is used, at the time the user account is created the value configured for this parameter is written to the passdb backend and that value will over\-ride the parameter value present in the smb\.conf file\. Any error present in the passdb backend account record must be editted using the appropriate tool (pdbedit on the command\-line, or any other locally provided system tool)\.
     4523
     4524Note that this option is only useful if Samba is set up as a domain controller\.
     4525.sp
     4526Disable the use of roaming profiles by setting the value of this parameter to the empty string\. For example,
     4527\fIlogon path = ""\fR\. Take note that even if the default setting in the smb\.conf file is the empty string, any value specified in the user account settings in the passdb backend will over\-ride the effect of setting this parameter to null\. Disabling of all roaming profile use requires that the user account settings must also be blank\.
    36664528.sp
    36674529An example of use is:
    3668 
    3669 .sp
    3670 
     4530.sp
     4531.RS 4
    36714532.nf
    3672 
    3673 logon path = \\PROFILESERVER\PROFILE\%U
    3674 
     4533logon path = \e\ePROFILESERVER\ePROFILE\e%U
    36754534.fi
    3676 
    3677 .sp
    3678 Default:
    3679 \fB\fIlogon path\fR = \\\\%N\\%U\\profile \fR
    3680 .RE
    3681 .PP
     4535.RE
     4536.sp
     4537.sp
     4538Default:
     4539\fI\fIlogon path\fR\fR\fI = \fR\fI\e\e%N\e%U\eprofile\fR\fI \fR
     4540.RE
     4541
    36824542logon script (G)
    3683 .RS 3n
    3684 This parameter specifies the batch file (\fI.bat\fR) or NT command file (\fI.cmd\fR) to be downloaded and run on a machine when a user successfully logs in. The file must contain the DOS style CR/LF line endings. Using a DOS-style editor to create the file is recommended.
     4543.PP
     4544.RS 4
     4545This parameter specifies the batch file (\fI\.bat\fR) or NT command file (\fI\.cmd\fR) to be downloaded and run on a machine when a user successfully logs in\. The file must contain the DOS style CR/LF line endings\. Using a DOS\-style editor to create the file is recommended\.
    36854546.sp
    36864547The script must be a relative path to the
    36874548\fI[netlogon]\fR
    3688 service. If the [netlogon] service specifies a
    3689 path of
     4549service\. If the [netlogon] service specifies a
     4550\fIpath\fR
     4551of
    36904552\fI/usr/local/samba/netlogon\fR, and
    3691 logon script = STARTUP.BAT, then the file that will be downloaded is:
    3692 
    3693 .sp
    3694 
     4553\fIlogon script = STARTUP\.BAT\fR, then the file that will be downloaded is:
     4554.sp
     4555.RS 4
    36954556.nf
    3696 
    3697         /usr/local/samba/netlogon/STARTUP.BAT
    3698 
     4557        /usr/local/samba/netlogon/STARTUP\.BAT
    36994558.fi
    3700 
    3701 .sp
    3702 The contents of the batch file are entirely your choice. A suggested command would be to add
    3703 NET TIME \\\\SERVER /SET /YES, to force every machine to synchronize clocks with the same time server. Another use would be to add
    3704 NET USE U: \\\\SERVER\\UTILS
     4559.RE
     4560.sp
     4561.sp
     4562The contents of the batch file are entirely your choice\. A suggested command would be to add
     4563NET TIME \e\eSERVER /SET /YES, to force every machine to synchronize clocks with the same time server\. Another use would be to add
     4564NET USE U: \e\eSERVER\eUTILS
    37054565for commonly used utilities, or
    3706 
    3707 .sp
    3708 
     4566.sp
     4567.RS 4
    37094568.nf
    3710 
    3711 \fBNET USE Q: \\SERVER\ISO9001_QA\fR
    3712 
     4569\fBNET USE Q: \e\eSERVER\eISO9001_QA\fR
    37134570.fi
    3714 for example.
    3715 .sp
    3716 Note that it is particularly important not to allow write access to the [netlogon] share, or to grant users write permission on the batch files in a secure environment, as this would allow the batch files to be arbitrarily modified and security to be breached.
    3717 .sp
    3718 This option takes the standard substitutions, allowing you to have separate logon scripts for each user or machine.
    3719 .sp
    3720 This option is only useful if Samba is set up as a logon server.
    3721 .sp
    3722 Default:
    3723 \fB\fIlogon script\fR = \fR
    3724 .sp
    3725 Example:
    3726 \fB\fIlogon script\fR = scripts\\%U.bat \fR
    3727 .RE
    3728 .PP
     4571.RE
     4572.sp
     4573for example\.
     4574.sp
     4575Note that it is particularly important not to allow write access to the [netlogon] share, or to grant users write permission on the batch files in a secure environment, as this would allow the batch files to be arbitrarily modified and security to be breached\.
     4576.sp
     4577This option takes the standard substitutions, allowing you to have separate logon scripts for each user or machine\.
     4578.sp
     4579This option is only useful if Samba is set up as a logon server\.
     4580.sp
     4581Default:
     4582\fI\fIlogon script\fR\fR\fI = \fR\fI\fR\fI \fR
     4583.sp
     4584Example:
     4585\fI\fIlogon script\fR\fR\fI = \fR\fIscripts\e%U\.bat\fR\fI \fR
     4586.RE
     4587
    37294588lppause command (S)
    3730 .RS 3n
    3731 This parameter specifies the command to be executed on the server host in order to stop printing or spooling a specific print job.
    3732 .sp
    3733 This command should be a program or script which takes a printer name and job number to pause the print job. One way of implementing this is by using job priorities, where jobs having a too low priority won't be sent to the printer.
     4589.PP
     4590.RS 4
     4591This parameter specifies the command to be executed on the server host in order to stop printing or spooling a specific print job\.
     4592.sp
     4593This command should be a program or script which takes a printer name and job number to pause the print job\. One way of implementing this is by using job priorities, where jobs having a too low priority won\'t be sent to the printer\.
    37344594.sp
    37354595If a
    37364596\fI%p\fR
    3737 is given then the printer name is put in its place. A
     4597is given then the printer name is put in its place\. A
    37384598\fI%j\fR
    3739 is replaced with the job number (an integer). On HPUX (see
     4599is replaced with the job number (an integer)\. On HPUX (see
    37404600\fIprinting=hpux \fR), if the
    3741 \fI-p%p\fR
    3742 option is added to the lpq command, the job will show up with the correct status, i.e. if the job priority is lower than the set fence priority it will have the PAUSED status, whereas if the priority is equal or higher it will have the SPOOLED or PRINTING status.
    3743 .sp
    3744 Note that it is good practice to include the absolute path in the lppause command as the PATH may not be available to the server.
    3745 .sp
    3746 Default:
    3747 \fB\fIlppause command\fR = # Currently no default value is given to this string, unless the value of the printing parameter is \\fBSYSV\\fR, in which case the default is : lp -i %p-%j -H hold or if the value of the \\fIprinting\\fR parameter is \\fBSOFTQ\\fR, then the default is: qstat -s -j%j -h. \fR
    3748 .sp
    3749 Example:
    3750 \fB\fIlppause command\fR = /usr/bin/lpalt %p-%j -p0 \fR
    3751 .RE
    3752 .PP
     4601\fI\-p%p\fR
     4602option is added to the lpq command, the job will show up with the correct status, i\.e\. if the job priority is lower than the set fence priority it will have the PAUSED status, whereas if the priority is equal or higher it will have the SPOOLED or PRINTING status\.
     4603.sp
     4604Note that it is good practice to include the absolute path in the lppause command as the PATH may not be available to the server\.
     4605.sp
     4606Default:
     4607\fI\fIlppause command\fR\fR\fI = \fR\fI # Currently no default value is given to this string, unless the value of the \fIprinting\fR parameter is \fBSYSV\fR, in which case the default is : lp \-i %p\-%j \-H hold or if the value of the \fIprinting\fR parameter is \fBSOFTQ\fR, then the default is: qstat \-s \-j%j \-h\. \fR\fI \fR
     4608.sp
     4609Example:
     4610\fI\fIlppause command\fR\fR\fI = \fR\fI/usr/bin/lpalt %p\-%j \-p0\fR\fI \fR
     4611.RE
     4612
    37534613lpq cache time (G)
    3754 .RS 3n
     4614.PP
     4615.RS 4
    37554616This controls how long lpq info will be cached for to prevent the
    37564617lpq
    3757 command being called too often. A separate cache is kept for each variation of the
     4618command being called too often\. A separate cache is kept for each variation of the
    37584619lpq
    37594620command used by the system, so if you use different
    37604621lpq
    3761 commands for different users then they won't share cache information.
     4622commands for different users then they won\'t share cache information\.
    37624623.sp
    37634624The cache files are stored in
    3764 \fI/tmp/lpq.xxxx\fR
     4625\fI/tmp/lpq\.xxxx\fR
    37654626where xxxx is a hash of the
    37664627lpq
    3767 command in use.
     4628command in use\.
    37684629.sp
    37694630The default is 30 seconds, meaning that the cached results of a previous identical
    37704631lpq
    3771 command will be used if the cached data is less than 30 seconds old. A large value may be advisable if your
     4632command will be used if the cached data is less than 30 seconds old\. A large value may be advisable if your
    37724633lpq
    3773 command is very slow.
    3774 .sp
    3775 A value of 0 will disable caching completely.
    3776 .sp
    3777 Default:
    3778 \fB\fIlpq cache time\fR = 30 \fR
    3779 .sp
    3780 Example:
    3781 \fB\fIlpq cache time\fR = 10 \fR
    3782 .RE
    3783 .PP
     4634command is very slow\.
     4635.sp
     4636A value of 0 will disable caching completely\.
     4637.sp
     4638Default:
     4639\fI\fIlpq cache time\fR\fR\fI = \fR\fI30\fR\fI \fR
     4640.sp
     4641Example:
     4642\fI\fIlpq cache time\fR\fR\fI = \fR\fI10\fR\fI \fR
     4643.RE
     4644
    37844645lpq command (S)
    3785 .RS 3n
     4646.PP
     4647.RS 4
    37864648This parameter specifies the command to be executed on the server host in order to obtain
    3787 lpq-style printer status information.
    3788 .sp
    3789 This command should be a program or script which takes a printer name as its only parameter and outputs printer status information.
    3790 .sp
    3791 Currently nine styles of printer status information are supported; BSD, AIX, LPRNG, PLP, SYSV, HPUX, QNX, CUPS, and SOFTQ. This covers most UNIX systems. You control which type is expected using the
     4649lpq\-style printer status information\.
     4650.sp
     4651This command should be a program or script which takes a printer name as its only parameter and outputs printer status information\.
     4652.sp
     4653Currently nine styles of printer status information are supported; BSD, AIX, LPRNG, PLP, SYSV, HPUX, QNX, CUPS, and SOFTQ\. This covers most UNIX systems\. You control which type is expected using the
    37924654\fIprinting =\fR
    3793 option.
    3794 .sp
    3795 Some clients (notably Windows for Workgroups) may not correctly send the connection number for the printer they are requesting status information about. To get around this, the server reports on the first printer service connected to by the client. This only happens if the connection number sent is invalid.
     4655option\.
     4656.sp
     4657Some clients (notably Windows for Workgroups) may not correctly send the connection number for the printer they are requesting status information about\. To get around this, the server reports on the first printer service connected to by the client\. This only happens if the connection number sent is invalid\.
    37964658.sp
    37974659If a
    37984660\fI%p\fR
    3799 is given then the printer name is put in its place. Otherwise it is placed at the end of the command.
     4661is given then the printer name is put in its place\. Otherwise it is placed at the end of the command\.
    38004662.sp
    38014663Note that it is good practice to include the absolute path in the
    … …  
    38034665as the
    38044666\fB$PATH \fR
    3805 may not be available to the server. When compiled with the CUPS libraries, no
     4667may not be available to the server\. When compiled with the CUPS libraries, no
    38064668\fIlpq command\fR
    3807 is needed because smbd will make a library call to obtain the print queue listing.
    3808 .sp
    3809 Default:
    3810 \fB\fIlpq command\fR = \fR
    3811 .sp
    3812 Example:
    3813 \fB\fIlpq command\fR = /usr/bin/lpq -P%p \fR
    3814 .RE
    3815 .PP
     4669is needed because smbd will make a library call to obtain the print queue listing\.
     4670.sp
     4671Default:
     4672\fI\fIlpq command\fR\fR\fI = \fR\fI\fR\fI \fR
     4673.sp
     4674Example:
     4675\fI\fIlpq command\fR\fR\fI = \fR\fI/usr/bin/lpq \-P%p\fR\fI \fR
     4676.RE
     4677
    38164678lpresume command (S)
    3817 .RS 3n
    3818 This parameter specifies the command to be executed on the server host in order to restart or continue printing or spooling a specific print job.
    3819 .sp
    3820 This command should be a program or script which takes a printer name and job number to resume the print job. See also the
    3821 lppause command parameter.
     4679.PP
     4680.RS 4
     4681This parameter specifies the command to be executed on the server host in order to restart or continue printing or spooling a specific print job\.
     4682.sp
     4683This command should be a program or script which takes a printer name and job number to resume the print job\. See also the
     4684\fIlppause command\fR
     4685parameter\.
    38224686.sp
    38234687If a
    38244688\fI%p\fR
    3825 is given then the printer name is put in its place. A
     4689is given then the printer name is put in its place\. A
    38264690\fI%j\fR
    3827 is replaced with the job number (an integer).
     4691is replaced with the job number (an integer)\.
    38284692.sp
    38294693Note that it is good practice to include the absolute path in the
    38304694\fIlpresume command\fR
    3831 as the PATH may not be available to the server.
     4695as the PATH may not be available to the server\.
    38324696.sp
    38334697See also the
    3834 printing parameter.
     4698\fIprinting\fR
     4699parameter\.
    38354700.sp
    38364701Default: Currently no default value is given to this string, unless the value of the
    38374702\fIprinting\fR
    38384703parameter is
    3839 \fBSYSV\fR, in which case the default is :
    3840 .sp
    3841 lp -i %p-%j -H resume
     4704\fBSYSV\fR, in which case the default is:
     4705.sp
     4706lp \-i %p\-%j \-H resume
    38424707.sp
    38434708or if the value of the
    … …  
    38464711\fBSOFTQ\fR, then the default is:
    38474712.sp
    3848 qstat -s -j%j -r
    3849 .sp
    3850 Default:
    3851 \fB\fIlpresume command\fR = lpresume command = /usr/bin/lpalt %p-%j -p2 \fR
    3852 .RE
    3853 .PP
     4713qstat \-s \-j%j \-r
     4714.sp
     4715\fINo default\fR
     4716.sp
     4717Example:
     4718\fI\fIlpresume command\fR\fR\fI = \fR\fI/usr/bin/lpalt %p\-%j \-p2\fR\fI \fR
     4719.RE
     4720
    38544721lprm command (S)
    3855 .RS 3n
    3856 This parameter specifies the command to be executed on the server host in order to delete a print job.
    3857 .sp
    3858 This command should be a program or script which takes a printer name and job number, and deletes the print job.
     4722.PP
     4723.RS 4
     4724This parameter specifies the command to be executed on the server host in order to delete a print job\.
     4725.sp
     4726This command should be a program or script which takes a printer name and job number, and deletes the print job\.
    38594727.sp
    38604728If a
    38614729\fI%p\fR
    3862 is given then the printer name is put in its place. A
     4730is given then the printer name is put in its place\. A
    38634731\fI%j\fR
    3864 is replaced with the job number (an integer).
     4732is replaced with the job number (an integer)\.
    38654733.sp
    38664734Note that it is good practice to include the absolute path in the
    38674735\fIlprm command\fR
    3868 as the PATH may not be available to the server.
     4736as the PATH may not be available to the server\.
    38694737.sp
    38704738Examples of use are:
    3871 
    3872 .sp
    3873 
     4739.sp
     4740.RS 4
    38744741.nf
    3875 
    3876 lprm command = /usr/bin/lprm -P%p %j
     4742lprm command = /usr/bin/lprm \-P%p %j
    38774743
    38784744or
    38794745
    3880 lprm command = /usr/bin/cancel %p-%j
    3881 
     4746lprm command = /usr/bin/cancel %p\-%j
    38824747.fi
    3883 
    3884 .sp
    3885 Default:
    3886 \fB\fIlprm command\fR = determined by printing parameter \fR
    3887 .RE
    3888 .PP
     4748.RE
     4749.sp
     4750.sp
     4751Default:
     4752\fI\fIlprm command\fR\fR\fI = \fR\fI determined by printing parameter\fR\fI \fR
     4753.RE
     4754
    38894755machine password timeout (G)
    3890 .RS 3n
     4756.PP
     4757.RS 4
    38914758If a Samba server is a member of a Windows NT Domain (see the
    3892 security = domain parameter) then periodically a running smbd process will try and change the MACHINE ACCOUNT PASSWORD stored in the TDB called
    3893 \fIprivate/secrets.tdb \fR. This parameter specifies how often this password will be changed, in seconds. The default is one week (expressed in seconds), the same as a Windows NT Domain member server.
     4759\fIsecurity = domain\fR
     4760parameter) then periodically a running smbd process will try and change the MACHINE ACCOUNT PASSWORD stored in the TDB called
     4761\fIprivate/secrets\.tdb \fR\. This parameter specifies how often this password will be changed, in seconds\. The default is one week (expressed in seconds), the same as a Windows NT Domain member server\.
    38944762.sp
    38954763See also
    38964764\fBsmbpasswd\fR(8), and the
    3897 security = domain parameter.
    3898 .sp
    3899 Default:
    3900 \fB\fImachine password timeout\fR = 604800 \fR
    3901 .RE
    3902 .PP
     4765\fIsecurity = domain\fR
     4766parameter\.
     4767.sp
     4768Default:
     4769\fI\fImachine password timeout\fR\fR\fI = \fR\fI604800\fR\fI \fR
     4770.RE
     4771
    39034772magic output (S)
    3904 .RS 3n
     4773.PP
     4774.RS 4
    39054775This parameter specifies the name of a file which will contain output created by a magic script (see the
    3906 magic script parameter below).
     4776\fImagic script\fR
     4777parameter below)\.
    39074778.sp
    39084779.it 1 an-trap
    … …  
    39104781.nr an-break-flag 1
    39114782.br
    3912 \fBWarning\fR
     4783Warning
    39134784If two clients use the same
    39144785\fImagic script \fR
    3915 in the same directory the output file content is undefined.
    3916 Default:
    3917 \fB\fImagic output\fR = <magic script name>.out \fR
    3918 .sp
    3919 Example:
    3920 \fB\fImagic output\fR = myfile.txt \fR
    3921 .RE
    3922 .PP
     4786in the same directory the output file content is undefined\.
     4787
     4788Default:
     4789\fI\fImagic output\fR\fR\fI = \fR\fI<magic script name>\.out\fR\fI \fR
     4790.sp
     4791Example:
     4792\fI\fImagic output\fR\fR\fI = \fR\fImyfile\.txt\fR\fI \fR
     4793.RE
     4794
    39234795magic script (S)
    3924 .RS 3n
    3925 This parameter specifies the name of a file which, if opened, will be executed by the server when the file is closed. This allows a UNIX script to be sent to the Samba host and executed on behalf of the connected user.
    3926 .sp
    3927 Scripts executed in this way will be deleted upon completion assuming that the user has the appropriate level of privilege and the file permissions allow the deletion.
     4796.PP
     4797.RS 4
     4798This parameter specifies the name of a file which, if opened, will be executed by the server when the file is closed\. This allows a UNIX script to be sent to the Samba host and executed on behalf of the connected user\.
     4799.sp
     4800Scripts executed in this way will be deleted upon completion assuming that the user has the appropriate level of privilege and the file permissions allow the deletion\.
    39284801.sp
    39294802If the script generates output, output will be sent to the file specified by the
    3930 magic output parameter (see above).
    3931 .sp
    3932 Note that some shells are unable to interpret scripts containing CR/LF instead of CR as the end-of-line marker. Magic scripts must be executable
    3933 \fBas is\fR
    3934 on the host, which for some hosts and some shells will require filtering at the DOS end.
     4803\fImagic output\fR
     4804parameter (see above)\.
     4805.sp
     4806Note that some shells are unable to interpret scripts containing CR/LF instead of CR as the end\-of\-line marker\. Magic scripts must be executable
     4807\fIas is\fR
     4808on the host, which for some hosts and some shells will require filtering at the DOS end\.
    39354809.sp
    39364810Magic scripts are
    3937 \fBEXPERIMENTAL\fR
     4811\fIEXPERIMENTAL\fR
    39384812and should
    3939 \fBNOT\fR
    3940 be relied upon.
    3941 .sp
    3942 Default:
    3943 \fB\fImagic script\fR = \fR
    3944 .sp
    3945 Example:
    3946 \fB\fImagic script\fR = user.csh \fR
    3947 .RE
    3948 .PP
     4813\fINOT\fR
     4814be relied upon\.
     4815.sp
     4816Default:
     4817\fI\fImagic script\fR\fR\fI = \fR\fI\fR\fI \fR
     4818.sp
     4819Example:
     4820\fI\fImagic script\fR\fR\fI = \fR\fIuser\.csh\fR\fI \fR
     4821.RE
     4822
    39494823mangled map (S)
    3950 .RS 3n
    3951 This is for those who want to directly map UNIX file names which cannot be represented on Windows/DOS. The mangling of names is not always what is needed. In particular you may have documents with file extensions that differ between DOS and UNIX. For example, under UNIX it is common to use
    3952 \fI.html\fR
     4824.PP
     4825.RS 4
     4826This is for those who want to directly map UNIX file names which cannot be represented on Windows/DOS\. The mangling of names is not always what is needed\. In particular you may have documents with file extensions that differ between DOS and UNIX\. For example, under UNIX it is common to use
     4827\fI\.html\fR
    39534828for HTML files, whereas under Windows/DOS
    3954 \fI.htm\fR
    3955 is more commonly used.
     4829\fI\.htm\fR
     4830is more commonly used\.
    39564831.sp
    39574832So to map
    … …  
    39624837.sp
    39634838
    3964 mangled map = (*.html *.htm).
     4839\fImangled map = (*\.html *\.htm)\fR\.
    39654840.sp
    39664841One very useful case is to remove the annoying
    39674842\fI;1\fR
    3968 off the ends of filenames on some CDROMs (only visible under some UNIXes). To do this use a map of (*;1 *;).
    3969 .sp
    3970 Default:
    3971 \fB\fImangled map\fR = # no mangled map \fR
    3972 .sp
    3973 Example:
    3974 \fB\fImangled map\fR = (*;1 *;) \fR
    3975 .RE
    3976 .PP
     4843off the ends of filenames on some CDROMs (only visible under some UNIXes)\. To do this use a map of (*;1 *;)\.
     4844.sp
     4845Default:
     4846\fI\fImangled map\fR\fR\fI = \fR\fI # no mangled map\fR\fI \fR
     4847.sp
     4848Example:
     4849\fI\fImangled map\fR\fR\fI = \fR\fI(*;1 *;)\fR\fI \fR
     4850.RE
     4851
    39774852mangled names (S)
    3978 .RS 3n
    3979 This controls whether non-DOS names under UNIX should be mapped to DOS-compatible names ("mangled") and made visible, or whether non-DOS names should simply be ignored.
     4853.PP
     4854.RS 4
     4855This controls whether non\-DOS names under UNIX should be mapped to DOS\-compatible names ("mangled") and made visible, or whether non\-DOS names should simply be ignored\.
    39804856.sp
    39814857See the section on
    3982 name mangling for details on how to control the mangling process.
     4858\fIname mangling\fR
     4859for details on how to control the mangling process\.
    39834860.sp
    39844861If mangling is used then the mangling algorithm is as follows:
    3985 .RS 3n
    3986 .TP 3n
    3987 \(bu
    3988 The first (up to) five alphanumeric characters before the rightmost dot of the filename are preserved, forced to upper case, and appear as the first (up to) five characters of the mangled name.
    3989 .TP 3n
    3990 \(bu
    3991 A tilde "~" is appended to the first part of the mangled name, followed by a two-character unique sequence, based on the original root name (i.e., the original filename minus its final extension). The final extension is included in the hash calculation only if it contains any upper case characters or is longer than three characters.
     4862.sp
     4863.RS 4
     4864.ie n \{\
     4865\h'-04'\(bu\h'+03'\c
     4866.\}
     4867.el \{\
     4868.sp -1
     4869.IP \(bu 2.3
     4870.\}
     4871The first (up to) five alphanumeric characters before the rightmost dot of the filename are preserved, forced to upper case, and appear as the first (up to) five characters of the mangled name\.
     4872.RE
     4873.sp
     4874.RS 4
     4875.ie n \{\
     4876\h'-04'\(bu\h'+03'\c
     4877.\}
     4878.el \{\
     4879.sp -1
     4880.IP \(bu 2.3
     4881.\}
     4882A tilde "~" is appended to the first part of the mangled name, followed by a two\-character unique sequence, based on the original root name (i\.e\., the original filename minus its final extension)\. The final extension is included in the hash calculation only if it contains any upper case characters or is longer than three characters\.
    39924883.sp
    39934884Note that the character to use may be specified using the
    3994 mangling char option, if you don't like '~'.
    3995 .TP 3n
    3996 \(bu
    3997 Files whose UNIX name begins with a dot will be presented as DOS hidden files. The mangled name will be created as for other filenames, but with the leading dot removed and "___" as its extension regardless of actual original extension (that's three underscores).
    3998 .RE
    3999 .IP "" 3n
    4000 The two-digit hash value consists of upper case alphanumeric characters.
    4001 .sp
    4002 This algorithm can cause name collisions only if files in a directory share the same first five alphanumeric characters. The probability of such a clash is 1/1300.
    4003 .sp
    4004 The name mangling (if enabled) allows a file to be copied between UNIX directories from Windows/DOS while retaining the long UNIX filename. UNIX files can be renamed to a new extension from Windows/DOS and will retain the same basename. Mangled names do not change between sessions.
    4005 .sp
    4006 Default:
    4007 \fB\fImangled names\fR = yes \fR
    4008 .RE
    4009 .PP
     4885\fImangling char\fR
     4886option, if you don\'t like \'~\'\.
     4887.RE
     4888.sp
     4889.RS 4
     4890.ie n \{\
     4891\h'-04'\(bu\h'+03'\c
     4892.\}
     4893.el \{\
     4894.sp -1
     4895.IP \(bu 2.3
     4896.\}
     4897Files whose UNIX name begins with a dot will be presented as DOS hidden files\. The mangled name will be created as for other filenames, but with the leading dot removed and "___" as its extension regardless of actual original extension (that\'s three underscores)\.
     4898.sp
     4899.RE
     4900The two\-digit hash value consists of upper case alphanumeric characters\.
     4901.sp
     4902This algorithm can cause name collisions only if files in a directory share the same first five alphanumeric characters\. The probability of such a clash is 1/1300\.
     4903.sp
     4904The name mangling (if enabled) allows a file to be copied between UNIX directories from Windows/DOS while retaining the long UNIX filename\. UNIX files can be renamed to a new extension from Windows/DOS and will retain the same basename\. Mangled names do not change between sessions\.
     4905.sp
     4906Default:
     4907\fI\fImangled names\fR\fR\fI = \fR\fIyes\fR\fI \fR
     4908.RE
     4909
    40104910mangle prefix (G)
    4011 .RS 3n
    4012 controls the number of prefix characters from the original name used when generating the mangled names. A larger value will give a weaker hash and therefore more name collisions. The minimum value is 1 and the maximum value is 6.
    4013 .sp
    4014 mangle prefix is effective only when mangling method is hash2.
    4015 .sp
    4016 Default:
    4017 \fB\fImangle prefix\fR = 1 \fR
    4018 .sp
    4019 Example:
    4020 \fB\fImangle prefix\fR = 4 \fR
    4021 .RE
    4022 .PP
     4911.PP
     4912.RS 4
     4913controls the number of prefix characters from the original name used when generating the mangled names\. A larger value will give a weaker hash and therefore more name collisions\. The minimum value is 1 and the maximum value is 6\.
     4914.sp
     4915mangle prefix is effective only when mangling method is hash2\.
     4916.sp
     4917Default:
     4918\fI\fImangle prefix\fR\fR\fI = \fR\fI1\fR\fI \fR
     4919.sp
     4920Example:
     4921\fI\fImangle prefix\fR\fR\fI = \fR\fI4\fR\fI \fR
     4922.RE
     4923
    40234924mangling char (S)
    4024 .RS 3n
     4925.PP
     4926.RS 4
    40254927This controls what character is used as the
    4026 \fBmagic\fR
     4928\fImagic\fR
    40274929character in
    4028 name mangling. The default is a '~' but this may interfere with some software. Use this option to set it to whatever you prefer. This is effective only when mangling method is hash.
    4029 .sp
    4030 Default:
    4031 \fB\fImangling char\fR = ~ \fR
    4032 .sp
    4033 Example:
    4034 \fB\fImangling char\fR = ^ \fR
    4035 .RE
    4036 .PP
     4930\fIname mangling\fR\. The default is a \'~\' but this may interfere with some software\. Use this option to set it to whatever you prefer\. This is effective only when mangling method is hash\.
     4931.sp
     4932Default:
     4933\fI\fImangling char\fR\fR\fI = \fR\fI~\fR\fI \fR
     4934.sp
     4935Example:
     4936\fI\fImangling char\fR\fR\fI = \fR\fI^\fR\fI \fR
     4937.RE
     4938
    40374939mangling method (G)
    4038 .RS 3n
    4039 controls the algorithm used for the generating the mangled names. Can take two different values, "hash" and "hash2". "hash" is the algorithm that was used used in Samba for many years and was the default in Samba 2.2.x "hash2" is now the default and is newer and considered a better algorithm (generates less collisions) in the names. Many Win32 applications store the mangled names and so changing to algorithms must not be done lightly as these applications may break unless reinstalled.
    4040 .sp
    4041 Default:
    4042 \fB\fImangling method\fR = hash2 \fR
    4043 .sp
    4044 Example:
    4045 \fB\fImangling method\fR = hash \fR
    4046 .RE
    4047 .PP
     4940.PP
     4941.RS 4
     4942controls the algorithm used for the generating the mangled names\. Can take two different values, "hash" and "hash2"\. "hash" is the algorithm that was used used in Samba for many years and was the default in Samba 2\.2\.x "hash2" is now the default and is newer and considered a better algorithm (generates less collisions) in the names\. Many Win32 applications store the mangled names and so changing to algorithms must not be done lightly as these applications may break unless reinstalled\.
     4943.sp
     4944Default:
     4945\fI\fImangling method\fR\fR\fI = \fR\fIhash2\fR\fI \fR
     4946.sp
     4947Example:
     4948\fI\fImangling method\fR\fR\fI = \fR\fIhash\fR\fI \fR
     4949.RE
     4950
    40484951map acl inherit (S)
    4049 .RS 3n
     4952.PP
     4953.RS 4
    40504954This boolean parameter controls whether
    40514955\fBsmbd\fR(8)
    4052 will attempt to map the 'inherit' and 'protected' access control entry flags stored in Windows ACLs into an extended attribute called user.SAMBA_PAI. This parameter only takes effect if Samba is being run on a platform that supports extended attributes (Linux and IRIX so far) and allows the Windows 2000 ACL editor to correctly use inheritance with the Samba POSIX ACL mapping code.
    4053 .sp
    4054 Default:
    4055 \fB\fImap acl inherit\fR = no \fR
    4056 .RE
    4057 .PP
     4956will attempt to map the \'inherit\' and \'protected\' access control entry flags stored in Windows ACLs into an extended attribute called user\.SAMBA_PAI\. This parameter only takes effect if Samba is being run on a platform that supports extended attributes (Linux and IRIX so far) and allows the Windows 2000 ACL editor to correctly use inheritance with the Samba POSIX ACL mapping code\.
     4957.sp
     4958Default:
     4959\fI\fImap acl inherit\fR\fR\fI = \fR\fIno\fR\fI \fR
     4960.RE
     4961
    40584962map archive (S)
    4059 .RS 3n
    4060 This controls whether the DOS archive attribute should be mapped to the UNIX owner execute bit. The DOS archive bit is set when a file has been modified since its last backup. One motivation for this option is to keep Samba/your PC from making any file it touches from becoming executable under UNIX. This can be quite annoying for shared source code, documents, etc...
     4963.PP
     4964.RS 4
     4965This controls whether the DOS archive attribute should be mapped to the UNIX owner execute bit\. The DOS archive bit is set when a file has been modified since its last backup\. One motivation for this option is to keep Samba/your PC from making any file it touches from becoming executable under UNIX\. This can be quite annoying for shared source code, documents, etc\.\.\.
    40614966.sp
    40624967Note that this requires the
    4063 create mask parameter to be set such that owner execute bit is not masked out (i.e. it must include 100). See the parameter
    4064 create mask for details.
    4065 .sp
    4066 Default:
    4067 \fB\fImap archive\fR = yes \fR
    4068 .RE
    4069 .PP
     4968\fIcreate mask\fR
     4969parameter to be set such that owner execute bit is not masked out (i\.e\. it must include 100)\. See the parameter
     4970\fIcreate mask\fR
     4971for details\.
     4972.sp
     4973Default:
     4974\fI\fImap archive\fR\fR\fI = \fR\fIyes\fR\fI \fR
     4975.RE
     4976
    40704977map hidden (S)
    4071 .RS 3n
    4072 This controls whether DOS style hidden files should be mapped to the UNIX world execute bit.
     4978.PP
     4979.RS 4
     4980This controls whether DOS style hidden files should be mapped to the UNIX world execute bit\.
    40734981.sp
    40744982Note that this requires the
    4075 create mask to be set such that the world execute bit is not masked out (i.e. it must include 001). See the parameter
    4076 create mask for details.
    4077 .sp
    4078 \fBNo default\fR
    4079 .RE
    4080 .PP
     4983\fIcreate mask\fR
     4984to be set such that the world execute bit is not masked out (i\.e\. it must include 001)\. See the parameter
     4985\fIcreate mask\fR
     4986for details\.
     4987.sp
     4988\fINo default\fR
     4989.RE
     4990
    40814991map read only (S)
    4082 .RS 3n
    4083 This controls how the DOS read only attribute should be mapped from a UNIX filesystem.
     4992.PP
     4993.RS 4
     4994This controls how the DOS read only attribute should be mapped from a UNIX filesystem\.
    40844995.sp
    40854996This parameter can take three different values, which tell
    40864997\fBsmbd\fR(8)
    40874998how to display the read only attribute on files, where either
    4088 store dos attributes is set to
    4089 \fBNo\fR, or no extended attribute is present. If
    4090 store dos attributes is set to
     4999\fIstore dos attributes\fR
     5000is set to
     5001\fBNo\fR, or no extended attribute is present\. If
     5002\fIstore dos attributes\fR
     5003is set to
    40915004\fByes\fR
    40925005then this parameter is
    4093 \fBignored\fR. This is a new parameter introduced in Samba version 3.0.21.
     5006\fIignored\fR\. This is a new parameter introduced in Samba version 3\.0\.21\.
    40945007.sp
    40955008The three settings are :
    4096 .RS 3n
    4097 .TP 3n
    4098 \(bu
     5009.sp
     5010.RS 4
     5011.ie n \{\
     5012\h'-04'\(bu\h'+03'\c
     5013.\}
     5014.el \{\
     5015.sp -1
     5016.IP \(bu 2.3
     5017.\}
    40995018
    41005019\fBYes\fR
    4101 - The read only DOS attribute is mapped to the inverse of the user or owner write bit in the unix permission mode set. If the owner write bit is not set, the read only attribute is reported as being set on the file.
    4102 .TP 3n
    4103 \(bu
     5020\- The read only DOS attribute is mapped to the inverse of the user or owner write bit in the unix permission mode set\. If the owner write bit is not set, the read only attribute is reported as being set on the file\.
     5021.RE
     5022.sp
     5023.RS 4
     5024.ie n \{\
     5025\h'-04'\(bu\h'+03'\c
     5026.\}
     5027.el \{\
     5028.sp -1
     5029.IP \(bu 2.3
     5030.\}
    41045031
    41055032\fBPermissions\fR
    4106 - The read only DOS attribute is mapped to the effective permissions of the connecting user, as evaluated by
     5033\- The read only DOS attribute is mapped to the effective permissions of the connecting user, as evaluated by
    41075034\fBsmbd\fR(8)
    4108 by reading the unix permissions and POSIX ACL (if present). If the connecting user does not have permission to modify the file, the read only attribute is reported as being set on the file.
    4109 .TP 3n
    4110 \(bu
     5035by reading the unix permissions and POSIX ACL (if present)\. If the connecting user does not have permission to modify the file, the read only attribute is reported as being set on the file\.
     5036.RE
     5037.sp
     5038.RS 4
     5039.ie n \{\
     5040\h'-04'\(bu\h'+03'\c
     5041.\}
     5042.el \{\
     5043.sp -1
     5044.IP \(bu 2.3
     5045.\}
    41115046
    41125047\fBNo\fR
    4113 - The read only DOS attribute is unaffected by permissions, and can only be set by the
    4114 store dos attributes method. This may be useful for exporting mounted CDs.
    4115 .RE
    4116 .IP "" 3n
    4117 Default:
    4118 \fB\fImap read only\fR = yes \fR
    4119 .RE
    4120 .PP
     5048\- The read only DOS attribute is unaffected by permissions, and can only be set by the
     5049\fIstore dos attributes\fR
     5050method\. This may be useful for exporting mounted CDs\.
     5051.sp
     5052.RE
     5053Default:
     5054\fI\fImap read only\fR\fR\fI = \fR\fIyes\fR\fI \fR
     5055.RE
     5056
    41215057map system (S)
    4122 .RS 3n
    4123 This controls whether DOS style system files should be mapped to the UNIX group execute bit.
     5058.PP
     5059.RS 4
     5060This controls whether DOS style system files should be mapped to the UNIX group execute bit\.
    41245061.sp
    41255062Note that this requires the
    4126 create mask to be set such that the group execute bit is not masked out (i.e. it must include 010). See the parameter
    4127 create mask for details.
    4128 .sp
    4129 Default:
    4130 \fB\fImap system\fR = no \fR
    4131 .RE
    4132 .PP
     5063\fIcreate mask\fR
     5064to be set such that the group execute bit is not masked out (i\.e\. it must include 010)\. See the parameter
     5065\fIcreate mask\fR
     5066for details\.
     5067.sp
     5068Default:
     5069\fI\fImap system\fR\fR\fI = \fR\fIno\fR\fI \fR
     5070.RE
     5071
    41335072map to guest (G)
    4134 .RS 3n
     5073.PP
     5074.RS 4
    41355075This parameter is only useful in
    4136 SECURITY = security modes other than
     5076\fISECURITY = security\fR
     5077modes other than
    41375078\fIsecurity = share\fR
    41385079and
    41395080\fIsecurity = server\fR
    4140 - i.e.
     5081\- i\.e\.
    41415082\fBuser\fR, and
    4142 \fBdomain\fR.
     5083\fBdomain\fR\.
    41435084.sp
    41445085This parameter can take four different values, which tell
    41455086\fBsmbd\fR(8)
    4146 what to do with user login requests that don't match a valid UNIX user in some way.
     5087what to do with user login requests that don\'t match a valid UNIX user in some way\.
    41475088.sp
    41485089The four settings are :
    4149 .RS 3n
    4150 .TP 3n
    4151 \(bu
     5090.sp
     5091.RS 4
     5092.ie n \{\
     5093\h'-04'\(bu\h'+03'\c
     5094.\}
     5095.el \{\
     5096.sp -1
     5097.IP \(bu 2.3
     5098.\}
    41525099\fBNever\fR
    4153 - Means user login requests with an invalid password are rejected. This is the default.
    4154 .TP 3n
    4155 \(bu
     5100\- Means user login requests with an invalid password are rejected\. This is the default\.
     5101.RE
     5102.sp
     5103.RS 4
     5104.ie n \{\
     5105\h'-04'\(bu\h'+03'\c
     5106.\}
     5107.el \{\
     5108.sp -1
     5109.IP \(bu 2.3
     5110.\}
    41565111\fBBad User\fR
    4157 - Means user logins with an invalid password are rejected, unless the username does not exist, in which case it is treated as a guest login and mapped into the
    4158 guest account.
    4159 .TP 3n
    4160 \(bu
     5112\- Means user logins with an invalid password are rejected, unless the username does not exist, in which case it is treated as a guest login and mapped into the
     5113\fIguest account\fR\.
     5114.RE
     5115.sp
     5116.RS 4
     5117.ie n \{\
     5118\h'-04'\(bu\h'+03'\c
     5119.\}
     5120.el \{\
     5121.sp -1
     5122.IP \(bu 2.3
     5123.\}
    41615124\fBBad Password\fR
    4162 - Means user logins with an invalid password are treated as a guest login and mapped into the
    4163 guest account. Note that this can cause problems as it means that any user incorrectly typing their password will be silently logged on as "guest" - and will not know the reason they cannot access files they think they should - there will have been no message given to them that they got their password wrong. Helpdesk services will
    4164 \fBhate\fR
     5125\- Means user logins with an invalid password are treated as a guest login and mapped into the
     5126\fIguest account\fR\. Note that this can cause problems as it means that any user incorrectly typing their password will be silently logged on as "guest" \- and will not know the reason they cannot access files they think they should \- there will have been no message given to them that they got their password wrong\. Helpdesk services will
     5127\fIhate\fR
    41655128you if you set the
    41665129\fImap to guest\fR
    4167 parameter this way :-).
    4168 .TP 3n
    4169 \(bu
     5130parameter this way :\-)\.
     5131.RE
     5132.sp
     5133.RS 4
     5134.ie n \{\
     5135\h'-04'\(bu\h'+03'\c
     5136.\}
     5137.el \{\
     5138.sp -1
     5139.IP \(bu 2.3
     5140.\}
    41705141\fBBad Uid\fR
    4171 - Is only applicable when Samba is configured in some type of domain mode security (security = {domain|ads}) and means that user logins which are successfully authenticated but which have no valid Unix user account (and smbd is unable to create one) should be mapped to the defined guest account. This was the default behavior of Samba 2.x releases. Note that if a member server is running winbindd, this option should never be required because the nss_winbind library will export the Windows domain users and groups to the underlying OS via the Name Service Switch interface.
    4172 .RE
    4173 .IP "" 3n
     5142\- Is only applicable when Samba is configured in some type of domain mode security (security = {domain|ads}) and means that user logins which are successfully authenticated but which have no valid Unix user account (and smbd is unable to create one) should be mapped to the defined guest account\. This was the default behavior of Samba 2\.x releases\. Note that if a member server is running winbindd, this option should never be required because the nss_winbind library will export the Windows domain users and groups to the underlying OS via the Name Service Switch interface\.
     5143.sp
     5144.RE
    41745145Note that this parameter is needed to set up "Guest" share services when using
    41755146\fIsecurity\fR
    4176 modes other than share and server. This is because in these modes the name of the resource being requested is
    4177 \fBnot\fR
    4178 sent to the server until after the server has successfully authenticated the client so the server cannot make authentication decisions at the correct time (connection to the share) for "Guest" shares. This parameter is not useful with
     5147modes other than share and server\. This is because in these modes the name of the resource being requested is
     5148\fInot\fR
     5149sent to the server until after the server has successfully authenticated the client so the server cannot make authentication decisions at the correct time (connection to the share) for "Guest" shares\. This parameter is not useful with
    41795150\fIsecurity = server\fR
    4180 as in this security mode no information is returned about whether a user logon failed due to a bad username or bad password, the same error is returned from a modern server in both cases.
    4181 .sp
    4182 For people familiar with the older Samba releases, this parameter maps to the old compile-time setting of the
     5151as in this security mode no information is returned about whether a user logon failed due to a bad username or bad password, the same error is returned from a modern server in both cases\.
     5152.sp
     5153For people familiar with the older Samba releases, this parameter maps to the old compile\-time setting of the
    41835154\fB GUEST_SESSSETUP\fR
    4184 value in local.h.
    4185 .sp
    4186 Default:
    4187 \fB\fImap to guest\fR = Never \fR
    4188 .sp
    4189 Example:
    4190 \fB\fImap to guest\fR = Bad User \fR
    4191 .RE
    4192 .PP
     5155value in local\.h\.
     5156.sp
     5157Default:
     5158\fI\fImap to guest\fR\fR\fI = \fR\fINever\fR\fI \fR
     5159.sp
     5160Example:
     5161\fI\fImap to guest\fR\fR\fI = \fR\fIBad User\fR\fI \fR
     5162.RE
     5163
    41935164max connections (S)
    4194 .RS 3n
    4195 This option allows the number of simultaneous connections to a service to be limited. If
     5165.PP
     5166.RS 4
     5167This option allows the number of simultaneous connections to a service to be limited\. If
    41965168\fImax connections\fR
    4197 is greater than 0 then connections will be refused if this number of connections to the service are already open. A value of zero mean an unlimited number of connections may be made.
    4198 .sp
    4199 Record lock files are used to implement this feature. The lock files will be stored in the directory specified by the
    4200 lock directory option.
    4201 .sp
    4202 Default:
    4203 \fB\fImax connections\fR = 0 \fR
    4204 .sp
    4205 Example:
    4206 \fB\fImax connections\fR = 10 \fR
    4207 .RE
    4208 .PP
     5169is greater than 0 then connections will be refused if this number of connections to the service are already open\. A value of zero mean an unlimited number of connections may be made\.
     5170.sp
     5171Record lock files are used to implement this feature\. The lock files will be stored in the directory specified by the
     5172\fIlock directory\fR
     5173option\.
     5174.sp
     5175Default:
     5176\fI\fImax connections\fR\fR\fI = \fR\fI0\fR\fI \fR
     5177.sp
     5178Example:
     5179\fI\fImax connections\fR\fR\fI = \fR\fI10\fR\fI \fR
     5180.RE
     5181
    42095182max disk size (G)
    4210 .RS 3n
    4211 This option allows you to put an upper limit on the apparent size of disks. If you set this option to 100 then all shares will appear to be not larger than 100 MB in size.
    4212 .sp
    4213 Note that this option does not limit the amount of data you can put on the disk. In the above case you could still store much more than 100 MB on the disk, but if a client ever asks for the amount of free disk space or the total disk size then the result will be bounded by the amount specified in
    4214 \fImax disk size\fR.
    4215 .sp
    4216 This option is primarily useful to work around bugs in some pieces of software that can't handle very large disks, particularly disks over 1GB in size.
     5183.PP
     5184.RS 4
     5185This option allows you to put an upper limit on the apparent size of disks\. If you set this option to 100 then all shares will appear to be not larger than 100 MB in size\.
     5186.sp
     5187Note that this option does not limit the amount of data you can put on the disk\. In the above case you could still store much more than 100 MB on the disk, but if a client ever asks for the amount of free disk space or the total disk size then the result will be bounded by the amount specified in
     5188\fImax disk size\fR\.
     5189.sp
     5190This option is primarily useful to work around bugs in some pieces of software that can\'t handle very large disks, particularly disks over 1GB in size\.
    42175191.sp
    42185192A
    42195193\fImax disk size\fR
    4220 of 0 means no limit.
    4221 .sp
    4222 Default:
    4223 \fB\fImax disk size\fR = 0 \fR
    4224 .sp
    4225 Example:
    4226 \fB\fImax disk size\fR = 1000 \fR
    4227 .RE
    4228 .PP
     5194of 0 means no limit\.
     5195.sp
     5196Default:
     5197\fI\fImax disk size\fR\fR\fI = \fR\fI0\fR\fI \fR
     5198.sp
     5199Example:
     5200\fI\fImax disk size\fR\fR\fI = \fR\fI1000\fR\fI \fR
     5201.RE
     5202
    42295203max log size (G)
    4230 .RS 3n
    4231 This option (an integer in kilobytes) specifies the max size the log file should grow to. Samba periodically checks the size and if it is exceeded it will rename the file, adding a
    4232 \fI.old\fR
    4233 extension.
    4234 .sp
    4235 A size of 0 means no limit.
    4236 .sp
    4237 Default:
    4238 \fB\fImax log size\fR = 5000 \fR
    4239 .sp
    4240 Example:
    4241 \fB\fImax log size\fR = 1000 \fR
    4242 .RE
    4243 .PP
     5204.PP
     5205.RS 4
     5206This option (an integer in kilobytes) specifies the max size the log file should grow to\. Samba periodically checks the size and if it is exceeded it will rename the file, adding a
     5207\fI\.old\fR
     5208extension\.
     5209.sp
     5210A size of 0 means no limit\.
     5211.sp
     5212Default:
     5213\fI\fImax log size\fR\fR\fI = \fR\fI5000\fR\fI \fR
     5214.sp
     5215Example:
     5216\fI\fImax log size\fR\fR\fI = \fR\fI1000\fR\fI \fR
     5217.RE
     5218
    42445219max mux (G)
    4245 .RS 3n
    4246 This option controls the maximum number of outstanding simultaneous SMB operations that Samba tells the client it will allow. You should never need to set this parameter.
    4247 .sp
    4248 Default:
    4249 \fB\fImax mux\fR = 50 \fR
    4250 .RE
    4251 .PP
     5220.PP
     5221.RS 4
     5222This option controls the maximum number of outstanding simultaneous SMB operations that Samba tells the client it will allow\. You should never need to set this parameter\.
     5223.sp
     5224Default:
     5225\fI\fImax mux\fR\fR\fI = \fR\fI50\fR\fI \fR
     5226.RE
     5227
    42525228max open files (G)
    4253 .RS 3n
     5229.PP
     5230.RS 4
    42545231This parameter limits the maximum number of open files that one
    42555232\fBsmbd\fR(8)
    4256 file serving process may have open for a client at any one time. The default for this parameter is set very high (10,000) as Samba uses only one bit per unopened file.
    4257 .sp
    4258 The limit of the number of open files is usually set by the UNIX per-process file descriptor limit rather than this parameter so you should never need to touch this parameter.
    4259 .sp
    4260 Default:
    4261 \fB\fImax open files\fR = 10000 \fR
    4262 .RE
    4263 .PP
     5233file serving process may have open for a client at any one time\. The default for this parameter is set very high (10,000) as Samba uses only one bit per unopened file\.
     5234.sp
     5235The limit of the number of open files is usually set by the UNIX per\-process file descriptor limit rather than this parameter so you should never need to touch this parameter\.
     5236.sp
     5237Default:
     5238\fI\fImax open files\fR\fR\fI = \fR\fI10000\fR\fI \fR
     5239.RE
     5240
    42645241max print jobs (S)
    4265 .RS 3n
    4266 This parameter limits the maximum number of jobs allowable in a Samba printer queue at any given moment. If this number is exceeded,
     5242.PP
     5243.RS 4
     5244This parameter limits the maximum number of jobs allowable in a Samba printer queue at any given moment\. If this number is exceeded,
    42675245\fBsmbd\fR(8)
    4268 will remote "Out of Space" to the client.
    4269 .sp
    4270 Default:
    4271 \fB\fImax print jobs\fR = 1000 \fR
    4272 .sp
    4273 Example:
    4274 \fB\fImax print jobs\fR = 5000 \fR
    4275 .RE
    4276 .PP
    4277 protocol
    4278 .RS 3n
    4279 This parameter is a synonym for max protocol.
    4280 .RE
    4281 .PP
     5246will remote "Out of Space" to the client\.
     5247.sp
     5248Default:
     5249\fI\fImax print jobs\fR\fR\fI = \fR\fI1000\fR\fI \fR
     5250.sp
     5251Example:
     5252\fI\fImax print jobs\fR\fR\fI = \fR\fI5000\fR\fI \fR
     5253.RE
     5254protocol.PP
     5255.RS 4
     5256This parameter is a synonym for
     5257max protocol\.
     5258.RE
     5259
    42825260max protocol (G)
    4283 .RS 3n
    4284 The value of the parameter (a string) is the highest protocol level that will be supported by the server.
     5261.PP
     5262.RS 4
     5263The value of the parameter (a string) is the highest protocol level that will be supported by the server\.
    42855264.sp
    42865265Possible values are :
    4287 .RS 3n
    4288 .TP 3n
    4289 \(bu
    4290 \fBCORE\fR: Earliest version. No concept of user names.
    4291 .TP 3n
    4292 \(bu
    4293 \fBCOREPLUS\fR: Slight improvements on CORE for efficiency.
    4294 .TP 3n
    4295 \(bu
     5266.sp
     5267.RS 4
     5268.ie n \{\
     5269\h'-04'\(bu\h'+03'\c
     5270.\}
     5271.el \{\
     5272.sp -1
     5273.IP \(bu 2.3
     5274.\}
     5275\fBCORE\fR: Earliest version\. No concept of user names\.
     5276.RE
     5277.sp
     5278.RS 4
     5279.ie n \{\
     5280\h'-04'\(bu\h'+03'\c
     5281.\}
     5282.el \{\
     5283.sp -1
     5284.IP \(bu 2.3
     5285.\}
     5286\fBCOREPLUS\fR: Slight improvements on CORE for efficiency\.
     5287.RE
     5288.sp
     5289.RS 4
     5290.ie n \{\
     5291\h'-04'\(bu\h'+03'\c
     5292.\}
     5293.el \{\
     5294.sp -1
     5295.IP \(bu 2.3
     5296.\}
    42965297\fBLANMAN1\fR: First
    4297 \fB modern\fR
    4298 version of the protocol. Long filename support.
    4299 .TP 3n
    4300 \(bu
    4301 \fBLANMAN2\fR: Updates to Lanman1 protocol.
    4302 .TP 3n
    4303 \(bu
    4304 \fBNT1\fR: Current up to date version of the protocol. Used by Windows NT. Known as CIFS.
    4305 .RE
    4306 .IP "" 3n
    4307 Normally this option should not be set as the automatic negotiation phase in the SMB protocol takes care of choosing the appropriate protocol.
    4308 .sp
    4309 Default:
    4310 \fB\fImax protocol\fR = NT1 \fR
    4311 .sp
    4312 Example:
    4313 \fB\fImax protocol\fR = LANMAN1 \fR
    4314 .RE
    4315 .PP
     5298\fI modern\fR
     5299version of the protocol\. Long filename support\.
     5300.RE
     5301.sp
     5302.RS 4
     5303.ie n \{\
     5304\h'-04'\(bu\h'+03'\c
     5305.\}
     5306.el \{\
     5307.sp -1
     5308.IP \(bu 2.3
     5309.\}
     5310\fBLANMAN2\fR: Updates to Lanman1 protocol\.
     5311.RE
     5312.sp
     5313.RS 4
     5314.ie n \{\
     5315\h'-04'\(bu\h'+03'\c
     5316.\}
     5317.el \{\
     5318.sp -1
     5319.IP \(bu 2.3
     5320.\}
     5321\fBNT1\fR: Current up to date version of the protocol\. Used by Windows NT\. Known as CIFS\.
     5322.sp
     5323.RE
     5324Normally this option should not be set as the automatic negotiation phase in the SMB protocol takes care of choosing the appropriate protocol\.
     5325.sp
     5326Default:
     5327\fI\fImax protocol\fR\fR\fI = \fR\fINT1\fR\fI \fR
     5328.sp
     5329Example:
     5330\fI\fImax protocol\fR\fR\fI = \fR\fILANMAN1\fR\fI \fR
     5331.RE
     5332
    43165333max reported print jobs (S)
    4317 .RS 3n
    4318 This parameter limits the maximum number of jobs displayed in a port monitor for Samba printer queue at any given moment. If this number is exceeded, the excess jobs will not be shown. A value of zero means there is no limit on the number of print jobs reported.
    4319 .sp
    4320 Default:
    4321 \fB\fImax reported print jobs\fR = 0 \fR
    4322 .sp
    4323 Example:
    4324 \fB\fImax reported print jobs\fR = 1000 \fR
    4325 .RE
    4326 .PP
     5334.PP
     5335.RS 4
     5336This parameter limits the maximum number of jobs displayed in a port monitor for Samba printer queue at any given moment\. If this number is exceeded, the excess jobs will not be shown\. A value of zero means there is no limit on the number of print jobs reported\.
     5337.sp
     5338Default:
     5339\fI\fImax reported print jobs\fR\fR\fI = \fR\fI0\fR\fI \fR
     5340.sp
     5341Example:
     5342\fI\fImax reported print jobs\fR\fR\fI = \fR\fI1000\fR\fI \fR
     5343.RE
     5344
    43275345max smbd processes (G)
    4328 .RS 3n
     5346.PP
     5347.RS 4
    43295348This parameter limits the maximum number of
    43305349\fBsmbd\fR(8)
    4331 processes concurrently running on a system and is intended as a stopgap to prevent degrading service to clients in the event that the server has insufficient resources to handle more than this number of connections. Remember that under normal operating conditions, each user will have an
     5350processes concurrently running on a system and is intended as a stopgap to prevent degrading service to clients in the event that the server has insufficient resources to handle more than this number of connections\. Remember that under normal operating conditions, each user will have an
    43325351\fBsmbd\fR(8)
    4333 associated with him or her to handle connections to all shares from a given host.
    4334 .sp
    4335 Default:
    4336 \fB\fImax smbd processes\fR = 0 \fR
    4337 .sp
    4338 Example:
    4339 \fB\fImax smbd processes\fR = 1000 \fR
    4340 .RE
    4341 .PP
     5352associated with him or her to handle connections to all shares from a given host\.
     5353.sp
     5354Default:
     5355\fI\fImax smbd processes\fR\fR\fI = \fR\fI0\fR\fI \fR
     5356.sp
     5357Example:
     5358\fI\fImax smbd processes\fR\fR\fI = \fR\fI1000\fR\fI \fR
     5359.RE
     5360
    43425361max stat cache size (G)
    4343 .RS 3n
     5362.PP
     5363.RS 4
    43445364This parameter limits the size in memory of any
    43455365\fIstat cache\fR
    4346 being used to speed up case insensitive name mappings. This parameter is the number of kilobyte (1024) units the stat cache can use. A value of zero means unlimited which is not advised a&#1109; it can use a lot of memory. You should not need to change this parameter.
    4347 .sp
    4348 Default:
    4349 \fB\fImax stat cache size\fR = 1024 \fR
    4350 .sp
    4351 Example:
    4352 \fB\fImax stat cache size\fR = 100 \fR
    4353 .RE
    4354 .PP
     5366being used to speed up case insensitive name mappings\. It represents the number of kilobyte (1024) units the stat cache can use\. A value of zero, meaning unlimited, is not advisable due to increased memory useage\. You should not need to change this parameter\.
     5367.sp
     5368Default:
     5369\fI\fImax stat cache size\fR\fR\fI = \fR\fI256\fR\fI \fR
     5370.sp
     5371Example:
     5372\fI\fImax stat cache size\fR\fR\fI = \fR\fI100\fR\fI \fR
     5373.RE
     5374
    43555375max ttl (G)
    4356 .RS 3n
     5376.PP
     5377.RS 4
    43575378This option tells
    43585379\fBnmbd\fR(8)
    4359 what the default 'time to live' of NetBIOS names should be (in seconds) when
     5380what the default \'time to live\' of NetBIOS names should be (in seconds) when
    43605381nmbd
    4361 is requesting a name using either a broadcast packet or from a WINS server. You should never need to change this parameter. The default is 3 days.
    4362 .sp
    4363 Default:
    4364 \fB\fImax ttl\fR = 259200 \fR
    4365 .RE
    4366 .PP
     5382is requesting a name using either a broadcast packet or from a WINS server\. You should never need to change this parameter\. The default is 3 days\.
     5383.sp
     5384Default:
     5385\fI\fImax ttl\fR\fR\fI = \fR\fI259200\fR\fI \fR
     5386.RE
     5387
    43675388max wins ttl (G)
    4368 .RS 3n
     5389.PP
     5390.RS 4
    43695391This option tells
    43705392\fBsmbd\fR(8)
    4371 when acting as a WINS server (wins support = yes) what the maximum 'time to live' of NetBIOS names that
     5393when acting as a WINS server (\fIwins support = yes\fR) what the maximum \'time to live\' of NetBIOS names that
    43725394nmbd
    4373 will grant will be (in seconds). You should never need to change this parameter. The default is 6 days (518400 seconds).
    4374 .sp
    4375 Default:
    4376 \fB\fImax wins ttl\fR = 518400 \fR
    4377 .RE
    4378 .PP
     5395will grant will be (in seconds)\. You should never need to change this parameter\. The default is 6 days (518400 seconds)\.
     5396.sp
     5397Default:
     5398\fI\fImax wins ttl\fR\fR\fI = \fR\fI518400\fR\fI \fR
     5399.RE
     5400
    43795401max xmit (G)
    4380 .RS 3n
    4381 This option controls the maximum packet size that will be negotiated by Samba. The default is 16644, which matches the behavior of Windows 2000. A value below 2048 is likely to cause problems. You should never need to change this parameter from its default value.
    4382 .sp
    4383 Default:
    4384 \fB\fImax xmit\fR = 16644 \fR
    4385 .sp
    4386 Example:
    4387 \fB\fImax xmit\fR = 8192 \fR
    4388 .RE
    4389 .PP
     5402.PP
     5403.RS 4
     5404This option controls the maximum packet size that will be negotiated by Samba\. The default is 16644, which matches the behavior of Windows 2000\. A value below 2048 is likely to cause problems\. You should never need to change this parameter from its default value\.
     5405.sp
     5406Default:
     5407\fI\fImax xmit\fR\fR\fI = \fR\fI16644\fR\fI \fR
     5408.sp
     5409Example:
     5410\fI\fImax xmit\fR\fR\fI = \fR\fI8192\fR\fI \fR
     5411.RE
     5412
    43905413message command (G)
    4391 .RS 3n
    4392 This specifies what command to run when the server receives a WinPopup style message.
    4393 .sp
    4394 This would normally be a command that would deliver the message somehow. How this is to be done is up to your imagination.
     5414.PP
     5415.RS 4
     5416This specifies what command to run when the server receives a WinPopup style message\.
     5417.sp
     5418This would normally be a command that would deliver the message somehow\. How this is to be done is up to your imagination\.
    43955419.sp
    43965420An example is:
    4397 
    4398 .sp
    4399 
     5421.sp
     5422.RS 4
    44005423.nf
    4401 
    4402 message command = csh -c 'xedit %s;rm %s' &
    4403 
     5424message command = csh \-c \'xedit %s;rm %s\' &
    44045425.fi
    4405 
     5426.RE
     5427.sp
    44065428.sp
    44075429This delivers the message using
    4408 xedit, then removes it afterwards.
    4409 \fBNOTE THAT IT IS VERY IMPORTANT THAT THIS COMMAND RETURN IMMEDIATELY\fR. That's why I have the '&' on the end. If it doesn't return immediately then your PCs may freeze when sending messages (they should recover after 30 seconds, hopefully).
    4410 .sp
    4411 All messages are delivered as the global guest user. The command takes the standard substitutions, although
     5430xedit, then removes it afterwards\.
     5431\fINOTE THAT IT IS VERY IMPORTANT THAT THIS COMMAND RETURN IMMEDIATELY\fR\. That\'s why I have the \'&\' on the end\. If it doesn\'t return immediately then your PCs may freeze when sending messages (they should recover after 30 seconds, hopefully)\.
     5432.sp
     5433All messages are delivered as the global guest user\. The command takes the standard substitutions, although
    44125434\fI %u\fR
    4413 won't work (\fI%U\fR
    4414 may be better in this case).
    4415 .sp
    4416 Apart from the standard substitutions, some additional ones apply. In particular:
    4417 .RS 3n
    4418 .TP 3n
    4419 \(bu
     5435won\'t work (\fI%U\fR
     5436may be better in this case)\.
     5437.sp
     5438Apart from the standard substitutions, some additional ones apply\. In particular:
     5439.sp
     5440.RS 4
     5441.ie n \{\
     5442\h'-04'\(bu\h'+03'\c
     5443.\}
     5444.el \{\
     5445.sp -1
     5446.IP \(bu 2.3
     5447.\}
    44205448\fI%s\fR
    4421 = the filename containing the message.
    4422 .TP 3n
    4423 \(bu
     5449= the filename containing the message\.
     5450.RE
     5451.sp
     5452.RS 4
     5453.ie n \{\
     5454\h'-04'\(bu\h'+03'\c
     5455.\}
     5456.el \{\
     5457.sp -1
     5458.IP \(bu 2.3
     5459.\}
    44245460\fI%t\fR
    4425 = the destination that the message was sent to (probably the server name).
    4426 .TP 3n
    4427 \(bu
     5461= the destination that the message was sent to (probably the server name)\.
     5462.RE
     5463.sp
     5464.RS 4
     5465.ie n \{\
     5466\h'-04'\(bu\h'+03'\c
     5467.\}
     5468.el \{\
     5469.sp -1
     5470.IP \(bu 2.3
     5471.\}
    44285472\fI%f\fR
    4429 = who the message is from.
    4430 .RE
    4431 .IP "" 3n
    4432 You could make this command send mail, or whatever else takes your fancy. Please let us know of any really interesting ideas you have.
    4433 .sp
    4434 Here's a way of sending the messages as mail to root:
    4435 
    4436 .sp
    4437 
     5473= who the message is from\.
     5474.sp
     5475.RE
     5476You could make this command send mail, or whatever else takes your fancy\. Please let us know of any really interesting ideas you have\.
     5477.sp
     5478Here\'s a way of sending the messages as mail to root:
     5479.sp
     5480.RS 4
    44385481.nf
    4439 
    4440 message command = /bin/mail -s 'message from %f on %m' root < %s; rm %s
    4441 
     5482message command = /bin/mail \-s \'message from %f on %m\' root < %s; rm %s
    44425483.fi
    4443 
    4444 .sp
    4445 If you don't have a message command then the message won't be delivered and Samba will tell the sender there was an error. Unfortunately WfWg totally ignores the error code and carries on regardless, saying that the message was delivered.
     5484.RE
     5485.sp
     5486.sp
     5487If you don\'t have a message command then the message won\'t be delivered and Samba will tell the sender there was an error\. Unfortunately WfWg totally ignores the error code and carries on regardless, saying that the message was delivered\.
    44465488.sp
    44475489If you want to silently delete it then try:
    4448 
    4449 .sp
    4450 
     5490.sp
     5491.RS 4
    44515492.nf
    4452 
    44535493message command = rm %s
    4454 
    44555494.fi
    4456 
    4457 .sp
    4458 Default:
    4459 \fB\fImessage command\fR = \fR
    4460 .sp
    4461 Example:
    4462 \fB\fImessage command\fR = csh -c 'xedit %s; rm %s' & \fR
    4463 .RE
    4464 .PP
     5495.RE
     5496.sp
     5497.sp
     5498Default:
     5499\fI\fImessage command\fR\fR\fI = \fR\fI\fR\fI \fR
     5500.sp
     5501Example:
     5502\fI\fImessage command\fR\fR\fI = \fR\fIcsh \-c \'xedit %s; rm %s\' &\fR\fI \fR
     5503.RE
     5504
    44655505min print space (S)
    4466 .RS 3n
    4467 This sets the minimum amount of free disk space that must be available before a user will be able to spool a print job. It is specified in kilobytes. The default is 0, which means a user can always spool a print job.
    4468 .sp
    4469 Default:
    4470 \fB\fImin print space\fR = 0 \fR
    4471 .sp
    4472 Example:
    4473 \fB\fImin print space\fR = 2000 \fR
    4474 .RE
    4475 .PP
     5506.PP
     5507.RS 4
     5508This sets the minimum amount of free disk space that must be available before a user will be able to spool a print job\. It is specified in kilobytes\. The default is 0, which means a user can always spool a print job\.
     5509.sp
     5510Default:
     5511\fI\fImin print space\fR\fR\fI = \fR\fI0\fR\fI \fR
     5512.sp
     5513Example:
     5514\fI\fImin print space\fR\fR\fI = \fR\fI2000\fR\fI \fR
     5515.RE
     5516
    44765517min protocol (G)
    4477 .RS 3n
    4478 The value of the parameter (a string) is the lowest SMB protocol dialect than Samba will support. Please refer to the
    4479 max protocol parameter for a list of valid protocol names and a brief description of each. You may also wish to refer to the C source code in
    4480 \fIsource/smbd/negprot.c\fR
    4481 for a listing of known protocol dialects supported by clients.
     5518.PP
     5519.RS 4
     5520The value of the parameter (a string) is the lowest SMB protocol dialect than Samba will support\. Please refer to the
     5521\fImax protocol\fR
     5522parameter for a list of valid protocol names and a brief description of each\. You may also wish to refer to the C source code in
     5523\fIsource/smbd/negprot\.c\fR
     5524for a listing of known protocol dialects supported by clients\.
    44825525.sp
    44835526If you are viewing this parameter as a security measure, you should also refer to the
    4484 lanman auth parameter. Otherwise, you should never need to change this parameter.
    4485 .sp
    4486 Default:
    4487 \fB\fImin protocol\fR = CORE \fR
    4488 .sp
    4489 Example:
    4490 \fB\fImin protocol\fR = NT1 \fR
    4491 .RE
    4492 .PP
     5527\fIlanman auth\fR
     5528parameter\. Otherwise, you should never need to change this parameter\.
     5529.sp
     5530Default:
     5531\fI\fImin protocol\fR\fR\fI = \fR\fICORE\fR\fI \fR
     5532.sp
     5533Example:
     5534\fI\fImin protocol\fR\fR\fI = \fR\fINT1\fR\fI \fR
     5535.RE
     5536
    44935537min wins ttl (G)
    4494 .RS 3n
     5538.PP
     5539.RS 4
    44955540This option tells
    44965541\fBnmbd\fR(8)
    4497 when acting as a WINS server (wins support = yes) what the minimum 'time to live' of NetBIOS names that
     5542when acting as a WINS server (\fIwins support = yes\fR) what the minimum \'time to live\' of NetBIOS names that
    44985543nmbd
    4499 will grant will be (in seconds). You should never need to change this parameter. The default is 6 hours (21600 seconds).
    4500 .sp
    4501 Default:
    4502 \fB\fImin wins ttl\fR = 21600 \fR
    4503 .RE
    4504 .PP
     5544will grant will be (in seconds)\. You should never need to change this parameter\. The default is 6 hours (21600 seconds)\.
     5545.sp
     5546Default:
     5547\fI\fImin wins ttl\fR\fR\fI = \fR\fI21600\fR\fI \fR
     5548.RE
     5549
    45055550msdfs proxy (S)
    4506 .RS 3n
    4507 This parameter indicates that the share is a stand-in for another CIFS share whose location is specified by the value of the parameter. When clients attempt to connect to this share, they are redirected to the proxied share using the SMB-Dfs protocol.
    4508 .sp
    4509 Only Dfs roots can act as proxy shares. Take a look at the
    4510 msdfs root and
    4511 host msdfs options to find out how to set up a Dfs root share.
    4512 .sp
    4513 \fBNo default\fR
    4514 .sp
    4515 Example:
    4516 \fB\fImsdfs proxy\fR = \\\\otherserver\\someshare \fR
    4517 .RE
    4518 .PP
     5551.PP
     5552.RS 4
     5553This parameter indicates that the share is a stand\-in for another CIFS share whose location is specified by the value of the parameter\. When clients attempt to connect to this share, they are redirected to the proxied share using the SMB\-Dfs protocol\.
     5554.sp
     5555Only Dfs roots can act as proxy shares\. Take a look at the
     5556\fImsdfs root\fR
     5557and
     5558\fIhost msdfs\fR
     5559options to find out how to set up a Dfs root share\.
     5560.sp
     5561\fINo default\fR
     5562.sp
     5563Example:
     5564\fI\fImsdfs proxy\fR\fR\fI = \fR\fI\eotherserver\esomeshare\fR\fI \fR
     5565.RE
     5566
    45195567msdfs root (S)
    4520 .RS 3n
     5568.PP
     5569.RS 4
    45215570If set to
    4522 \fByes\fR, Samba treats the share as a Dfs root and allows clients to browse the distributed file system tree rooted at the share directory. Dfs links are specified in the share directory by symbolic links of the form
    4523 \fImsdfs:serverA\\shareA,serverB\\shareB\fR
    4524 and so on. For more information on setting up a Dfs tree on Samba, refer to the MSDFS chapter in the Samba3-HOWTO book.
    4525 .sp
    4526 Default:
    4527 \fB\fImsdfs root\fR = no \fR
    4528 .RE
    4529 .PP
     5571\fByes\fR, Samba treats the share as a Dfs root and allows clients to browse the distributed file system tree rooted at the share directory\. Dfs links are specified in the share directory by symbolic links of the form
     5572\fImsdfs:serverA\e\eshareA,serverB\e\eshareB\fR
     5573and so on\. For more information on setting up a Dfs tree on Samba, refer to the MSDFS chapter in the Samba3\-HOWTO book\.
     5574.sp
     5575Default:
     5576\fI\fImsdfs root\fR\fR\fI = \fR\fIno\fR\fI \fR
     5577.RE
     5578
    45305579name cache timeout (G)
    4531 .RS 3n
    4532 Specifies the number of seconds it takes before entries in samba's hostname resolve cache time out. If the timeout is set to 0. the caching is disabled.
    4533 .sp
    4534 Default:
    4535 \fB\fIname cache timeout\fR = 660 \fR
    4536 .sp
    4537 Example:
    4538 \fB\fIname cache timeout\fR = 0 \fR
    4539 .RE
    4540 .PP
     5580.PP
     5581.RS 4
     5582Specifies the number of seconds it takes before entries in samba\'s hostname resolve cache time out\. If the timeout is set to 0\. the caching is disabled\.
     5583.sp
     5584Default:
     5585\fI\fIname cache timeout\fR\fR\fI = \fR\fI660\fR\fI \fR
     5586.sp
     5587Example:
     5588\fI\fIname cache timeout\fR\fR\fI = \fR\fI0\fR\fI \fR
     5589.RE
     5590
    45415591name resolve order (G)
    4542 .RS 3n
    4543 This option is used by the programs in the Samba suite to determine what naming services to use and in what order to resolve host names to IP addresses. Its main purpose to is to control how netbios name resolution is performed. The option takes a space separated string of name resolution options.
    4544 .sp
    4545 The options are: "lmhosts", "host", "wins" and "bcast". They cause names to be resolved as follows:
    4546 .RS 3n
    4547 .TP 3n
    4548 \(bu
     5592.PP
     5593.RS 4
     5594This option is used by the programs in the Samba suite to determine what naming services to use and in what order to resolve host names to IP addresses\. Its main purpose to is to control how netbios name resolution is performed\. The option takes a space separated string of name resolution options\.
     5595.sp
     5596The options are: "lmhosts", "host", "wins" and "bcast"\. They cause names to be resolved as follows:
     5597.sp
     5598.RS 4
     5599.ie n \{\
     5600\h'-04'\(bu\h'+03'\c
     5601.\}
     5602.el \{\
     5603.sp -1
     5604.IP \(bu 2.3
     5605.\}
    45495606
    45505607\fBlmhosts\fR
    4551 : Lookup an IP address in the Samba lmhosts file. If the line in lmhosts has no name type attached to the NetBIOS name (see the manpage for lmhosts for details) then any name type matches for lookup.
    4552 .TP 3n
    4553 \(bu
     5608: Lookup an IP address in the Samba lmhosts file\. If the line in lmhosts has no name type attached to the NetBIOS name (see the manpage for lmhosts for details) then any name type matches for lookup\.
     5609.RE
     5610.sp
     5611.RS 4
     5612.ie n \{\
     5613\h'-04'\(bu\h'+03'\c
     5614.\}
     5615.el \{\
     5616.sp -1
     5617.IP \(bu 2.3
     5618.\}
    45545619
    45555620\fBhost\fR
    45565621: Do a standard host name to IP address resolution, using the system
    4557 \fI/etc/hosts \fR, NIS, or DNS lookups. This method of name resolution is operating system depended for instance on IRIX or Solaris this may be controlled by the
    4558 \fI/etc/nsswitch.conf\fR
    4559 file. Note that this method is used only if the NetBIOS name type being queried is the 0x20 (server) name type or 0x1c (domain controllers). The latter case is only useful for active directory domains and results in a DNS query for the SRV RR entry matching _ldap._tcp.domain.
    4560 .TP 3n
    4561 \(bu
     5622\fI/etc/hosts \fR, NIS, or DNS lookups\. This method of name resolution is operating system depended for instance on IRIX or Solaris this may be controlled by the
     5623\fI/etc/nsswitch\.conf\fR
     5624file\. Note that this method is used only if the NetBIOS name type being queried is the 0x20 (server) name type or 0x1c (domain controllers)\. The latter case is only useful for active directory domains and results in a DNS query for the SRV RR entry matching _ldap\._tcp\.domain\.
     5625.RE
     5626.sp
     5627.RS 4
     5628.ie n \{\
     5629\h'-04'\(bu\h'+03'\c
     5630.\}
     5631.el \{\
     5632.sp -1
     5633.IP \(bu 2.3
     5634.\}
    45625635\fBwins\fR
    45635636: Query a name with the IP address listed in the
    4564 WINSSERVER parameter. If no WINS server has been specified this method will be ignored.
    4565 .TP 3n
    4566 \(bu
     5637\fIWINSSERVER\fR
     5638parameter\. If no WINS server has been specified this method will be ignored\.
     5639.RE
     5640.sp
     5641.RS 4
     5642.ie n \{\
     5643\h'-04'\(bu\h'+03'\c
     5644.\}
     5645.el \{\
     5646.sp -1
     5647.IP \(bu 2.3
     5648.\}
    45675649\fBbcast\fR
    45685650: Do a broadcast on each of the known local interfaces listed in the
    4569 interfaces parameter. This is the least reliable of the name resolution methods as it depends on the target host being on a locally connected subnet.
    4570 .RE
    4571 .IP "" 3n
    4572 The example below will cause the local lmhosts file to be examined first, followed by a broadcast attempt, followed by a normal system hostname lookup.
     5651\fIinterfaces\fR
     5652parameter\. This is the least reliable of the name resolution methods as it depends on the target host being on a locally connected subnet\.
     5653.sp
     5654.RE
     5655The example below will cause the local lmhosts file to be examined first, followed by a broadcast attempt, followed by a normal system hostname lookup\.
    45735656.sp
    45745657When Samba is functioning in ADS security mode (security = ads) it is advised to use following settings for
    … …  
    45775660name resolve order = wins bcast
    45785661.sp
    4579 DC lookups will still be done via DNS, but fallbacks to netbios names will not inundate your DNS servers with needless querys for DOMAIN<0x1c> lookups.
    4580 .sp
    4581 Default:
    4582 \fB\fIname resolve order\fR = lmhosts host wins bcast \fR
    4583 .sp
    4584 Example:
    4585 \fB\fIname resolve order\fR = lmhosts bcast host \fR
    4586 .RE
    4587 .PP
     5662DC lookups will still be done via DNS, but fallbacks to netbios names will not inundate your DNS servers with needless querys for DOMAIN<0x1c> lookups\.
     5663.sp
     5664Default:
     5665\fI\fIname resolve order\fR\fR\fI = \fR\fIlmhosts host wins bcast\fR\fI \fR
     5666.sp
     5667Example:
     5668\fI\fIname resolve order\fR\fR\fI = \fR\fIlmhosts bcast host\fR\fI \fR
     5669.RE
     5670
    45885671netbios aliases (G)
    4589 .RS 3n
    4590 This is a list of NetBIOS names that nmbd will advertise as additional names by which the Samba server is known. This allows one machine to appear in browse lists under multiple names. If a machine is acting as a browse server or logon server none of these names will be advertised as either browse server or logon servers, only the primary name of the machine will be advertised with these capabilities.
    4591 .sp
    4592 Default:
    4593 \fB\fInetbios aliases\fR = # empty string (no additional names) \fR
    4594 .sp
    4595 Example:
    4596 \fB\fInetbios aliases\fR = TEST TEST1 TEST2 \fR
    4597 .RE
    4598 .PP
     5672.PP
     5673.RS 4
     5674This is a list of NetBIOS names that nmbd will advertise as additional names by which the Samba server is known\. This allows one machine to appear in browse lists under multiple names\. If a machine is acting as a browse server or logon server none of these names will be advertised as either browse server or logon servers, only the primary name of the machine will be advertised with these capabilities\.
     5675.sp
     5676Default:
     5677\fI\fInetbios aliases\fR\fR\fI = \fR\fI # empty string (no additional names)\fR\fI \fR
     5678.sp
     5679Example:
     5680\fI\fInetbios aliases\fR\fR\fI = \fR\fITEST TEST1 TEST2\fR\fI \fR
     5681.RE
     5682
    45995683netbios name (G)
    4600 .RS 3n
    4601 This sets the NetBIOS name by which a Samba server is known. By default it is the same as the first component of the host's DNS name. If a machine is a browse server or logon server this name (or the first component of the hosts DNS name) will be the name that these services are advertised under.
    4602 .sp
    4603 There is a bug in Samba-3 that breaks operation of browsing and access to shares if the netbios name is set to the literal name
    4604 PIPE. To avoid this problem, do not name your Samba-3 server
    4605 PIPE.
    4606 .sp
    4607 Default:
    4608 \fB\fInetbios name\fR = # machine DNS name \fR
    4609 .sp
    4610 Example:
    4611 \fB\fInetbios name\fR = MYNAME \fR
    4612 .RE
    4613 .PP
     5684.PP
     5685.RS 4
     5686This sets the NetBIOS name by which a Samba server is known\. By default it is the same as the first component of the host\'s DNS name\. If a machine is a browse server or logon server this name (or the first component of the hosts DNS name) will be the name that these services are advertised under\.
     5687.sp
     5688There is a bug in Samba\-3 that breaks operation of browsing and access to shares if the netbios name is set to the literal name
     5689PIPE\. To avoid this problem, do not name your Samba\-3 server
     5690PIPE\.
     5691.sp
     5692Default:
     5693\fI\fInetbios name\fR\fR\fI = \fR\fI # machine DNS name\fR\fI \fR
     5694.sp
     5695Example:
     5696\fI\fInetbios name\fR\fR\fI = \fR\fIMYNAME\fR\fI \fR
     5697.RE
     5698
    46145699netbios scope (G)
    4615 .RS 3n
    4616 This sets the NetBIOS scope that Samba will operate under. This should not be set unless every machine on your LAN also sets this value.
    4617 .sp
    4618 Default:
    4619 \fB\fInetbios scope\fR = \fR
    4620 .RE
    4621 .PP
     5700.PP
     5701.RS 4
     5702This sets the NetBIOS scope that Samba will operate under\. This should not be set unless every machine on your LAN also sets this value\.
     5703.sp
     5704Default:
     5705\fI\fInetbios scope\fR\fR\fI = \fR\fI\fR\fI \fR
     5706.RE
     5707
    46225708nis homedir (G)
    4623 .RS 3n
    4624 Get the home share server from a NIS map. For UNIX systems that use an automounter, the user's home directory will often be mounted on a workstation on demand from a remote server.
    4625 .sp
    4626 When the Samba logon server is not the actual home directory server, but is mounting the home directories via NFS then two network hops would be required to access the users home directory if the logon server told the client to use itself as the SMB server for home directories (one over SMB and one over NFS). This can be very slow.
    4627 .sp
    4628 This option allows Samba to return the home share as being on a different server to the logon server and as long as a Samba daemon is running on the home directory server, it will be mounted on the Samba client directly from the directory server. When Samba is returning the home share to the client, it will consult the NIS map specified in
    4629 homedir map and return the server listed there.
    4630 .sp
    4631 Note that for this option to work there must be a working NIS system and the Samba server with this option must also be a logon server.
    4632 .sp
    4633 Default:
    4634 \fB\fInis homedir\fR = no \fR
    4635 .RE
    4636 .PP
     5709.PP
     5710.RS 4
     5711Get the home share server from a NIS map\. For UNIX systems that use an automounter, the user\'s home directory will often be mounted on a workstation on demand from a remote server\.
     5712.sp
     5713When the Samba logon server is not the actual home directory server, but is mounting the home directories via NFS then two network hops would be required to access the users home directory if the logon server told the client to use itself as the SMB server for home directories (one over SMB and one over NFS)\. This can be very slow\.
     5714.sp
     5715This option allows Samba to return the home share as being on a different server to the logon server and as long as a Samba daemon is running on the home directory server, it will be mounted on the Samba client directly from the directory server\. When Samba is returning the home share to the client, it will consult the NIS map specified in
     5716\fIhomedir map\fR
     5717and return the server listed there\.
     5718.sp
     5719Note that for this option to work there must be a working NIS system and the Samba server with this option must also be a logon server\.
     5720.sp
     5721Default:
     5722\fI\fInis homedir\fR\fR\fI = \fR\fIno\fR\fI \fR
     5723.RE
     5724
    46375725nt acl support (S)
    4638 .RS 3n
     5726.PP
     5727.RS 4
    46395728This boolean parameter controls whether
    46405729\fBsmbd\fR(8)
    4641 will attempt to map UNIX permissions into Windows NT access control lists. The UNIX permissions considered are the the traditional UNIX owner and group permissions, as well as POSIX ACLs set on any files or directories. This parameter was formally a global parameter in releases prior to 2.2.2.
    4642 .sp
    4643 Default:
    4644 \fB\fInt acl support\fR = yes \fR
    4645 .RE
    4646 .PP
     5730will attempt to map UNIX permissions into Windows NT access control lists\. The UNIX permissions considered are the the traditional UNIX owner and group permissions, as well as POSIX ACLs set on any files or directories\. This parameter was formally a global parameter in releases prior to 2\.2\.2\.
     5731.sp
     5732Default:
     5733\fI\fInt acl support\fR\fR\fI = \fR\fIyes\fR\fI \fR
     5734.RE
     5735
    46475736ntlm auth (G)
    4648 .RS 3n
     5737.PP
     5738.RS 4
    46495739This parameter determines whether or not
    46505740\fBsmbd\fR(8)
    4651 will attempt to authenticate users using the NTLM encrypted password response. If disabled, either the lanman password hash or an NTLMv2 response will need to be sent by the client.
     5741will attempt to authenticate users using the NTLM encrypted password response\. If disabled, either the lanman password hash or an NTLMv2 response will need to be sent by the client\.
    46525742.sp
    46535743If this option, and
    46545744lanman auth
    4655 are both disabled, then only NTLMv2 logins will be permited. Not all clients support NTLMv2, and most will require special configuration to us it.
    4656 .sp
    4657 Default:
    4658 \fB\fIntlm auth\fR = yes \fR
    4659 .RE
    4660 .PP
     5745are both disabled, then only NTLMv2 logins will be permited\. Not all clients support NTLMv2, and most will require special configuration to us it\.
     5746.sp
     5747Default:
     5748\fI\fIntlm auth\fR\fR\fI = \fR\fIyes\fR\fI \fR
     5749.RE
     5750
    46615751nt pipe support (G)
    4662 .RS 3n
     5752.PP
     5753.RS 4
    46635754This boolean parameter controls whether
    46645755\fBsmbd\fR(8)
    46655756will allow Windows NT clients to connect to the NT SMB specific
    46665757\fBIPC$\fR
    4667 pipes. This is a developer debugging option and can be left alone.
    4668 .sp
    4669 Default:
    4670 \fB\fInt pipe support\fR = yes \fR
    4671 .RE
    4672 .PP
     5758pipes\. This is a developer debugging option and can be left alone\.
     5759.sp
     5760Default:
     5761\fI\fInt pipe support\fR\fR\fI = \fR\fIyes\fR\fI \fR
     5762.RE
     5763
    46735764nt status support (G)
    4674 .RS 3n
     5765.PP
     5766.RS 4
    46755767This boolean parameter controls whether
    46765768\fBsmbd\fR(8)
    4677 will negotiate NT specific status support with Windows NT/2k/XP clients. This is a developer debugging option and should be left alone. If this option is set to
     5769will negotiate NT specific status support with Windows NT/2k/XP clients\. This is a developer debugging option and should be left alone\. If this option is set to
    46785770\fBno\fR
    4679 then Samba offers exactly the same DOS error codes that versions prior to Samba 2.2.3 reported.
    4680 .sp
    4681 You should not need to ever disable this parameter.
    4682 .sp
    4683 Default:
    4684 \fB\fInt status support\fR = yes \fR
    4685 .RE
    4686 .PP
     5771then Samba offers exactly the same DOS error codes that versions prior to Samba 2\.2\.3 reported\.
     5772.sp
     5773You should not need to ever disable this parameter\.
     5774.sp
     5775Default:
     5776\fI\fInt status support\fR\fR\fI = \fR\fIyes\fR\fI \fR
     5777.RE
     5778
    46875779null passwords (G)
    4688 .RS 3n
    4689 Allow or disallow client access to accounts that have null passwords.
     5780.PP
     5781.RS 4
     5782Allow or disallow client access to accounts that have null passwords\.
    46905783.sp
    46915784See also
    4692 \fBsmbpasswd\fR(5).
    4693 .sp
    4694 Default:
    4695 \fB\fInull passwords\fR = no \fR
    4696 .RE
    4697 .PP
     5785\fBsmbpasswd\fR(5)\.
     5786.sp
     5787Default:
     5788\fI\fInull passwords\fR\fR\fI = \fR\fIno\fR\fI \fR
     5789.RE
     5790
    46985791obey pam restrictions (G)
    4699 .RS 3n
    4700 When Samba 3.0 is configured to enable PAM support (i.e. --with-pam), this parameter will control whether or not Samba should obey PAM's account and session management directives. The default behavior is to use PAM for clear text authentication only and to ignore any account or session management. Note that Samba always ignores PAM for authentication in the case of
    4701 encrypt passwords = yes. The reason is that PAM modules cannot support the challenge/response authentication mechanism needed in the presence of SMB password encryption.
    4702 .sp
    4703 Default:
    4704 \fB\fIobey pam restrictions\fR = no \fR
    4705 .RE
    4706 .PP
     5792.PP
     5793.RS 4
     5794When Samba 3\.0 is configured to enable PAM support (i\.e\. \-\-with\-pam), this parameter will control whether or not Samba should obey PAM\'s account and session management directives\. The default behavior is to use PAM for clear text authentication only and to ignore any account or session management\. Note that Samba always ignores PAM for authentication in the case of
     5795\fIencrypt passwords = yes\fR\. The reason is that PAM modules cannot support the challenge/response authentication mechanism needed in the presence of SMB password encryption\.
     5796.sp
     5797Default:
     5798\fI\fIobey pam restrictions\fR\fR\fI = \fR\fIno\fR\fI \fR
     5799.RE
     5800
    47075801only user (S)
    4708 .RS 3n
     5802.PP
     5803.RS 4
    47095804This is a boolean option that controls whether connections with usernames not in the
    47105805\fIuser\fR
    4711 list will be allowed. By default this option is disabled so that a client can supply a username to be used by the server. Enabling this parameter will force the server to only use the login names from the
     5806list will be allowed\. By default this option is disabled so that a client can supply a username to be used by the server\. Enabling this parameter will force the server to only use the login names from the
    47125807\fIuser\fR
    47135808list and is only really useful in
    4714 security = share level security.
    4715 .sp
    4716 Note that this also means Samba won't try to deduce usernames from the service name. This can be annoying for the [homes] section. To get around this you could use
     5809\fIsecurity = share\fR
     5810level security\.
     5811.sp
     5812Note that this also means Samba won\'t try to deduce usernames from the service name\. This can be annoying for the [homes] section\. To get around this you could use
    47175813user = %S
    47185814which means your
    47195815\fIuser\fR
    4720 list will be just the service name, which for home directories is the name of the user.
    4721 .sp
    4722 Default:
    4723 \fB\fIonly user\fR = no \fR
    4724 .RE
    4725 .PP
     5816list will be just the service name, which for home directories is the name of the user\.
     5817.sp
     5818Default:
     5819\fI\fIonly user\fR\fR\fI = \fR\fIno\fR\fI \fR
     5820.RE
     5821
    47265822open files database hash size (G)
    4727 .RS 3n
    4728 This parameter was added in Samba 3.0.23. This is an internal tuning parameter that sets the hash size of the tdb used for the open file databases. The presence of this parameter allows tuning of the system for very large (thousands of concurrent users) Samba setups. The default setting of this parameter should be sufficient for most normal environments. It is advised not to change this parameter unless advised to by a Samba Team member.
    4729 .sp
    4730 Default:
    4731 \fB\fIopen files database hash size\fR = 10007 \fR
    4732 .sp
    4733 Example:
    4734 \fB\fIopen files database hash size\fR = 1338457 \fR
    4735 .RE
    4736 .PP
     5823.PP
     5824.RS 4
     5825This parameter was added in Samba 3\.0\.23\. This is an internal tuning parameter that sets the hash size of the tdb used for the open file databases\. The presence of this parameter allows tuning of the system for very large (thousands of concurrent users) Samba setups\. The default setting of this parameter should be sufficient for most normal environments\. It is advised not to change this parameter unless advised to by a Samba Team member\.
     5826.sp
     5827Default:
     5828\fI\fIopen files database hash size\fR\fR\fI = \fR\fI10007\fR\fI \fR
     5829.sp
     5830Example:
     5831\fI\fIopen files database hash size\fR\fR\fI = \fR\fI1338457\fR\fI \fR
     5832.RE
     5833
    47375834oplock break wait time (G)
    4738 .RS 3n
    4739 This is a tuning parameter added due to bugs in both Windows 9x and WinNT. If Samba responds to a client too quickly when that client issues an SMB that can cause an oplock break request, then the network client can fail and not respond to the break request. This tuning parameter (which is set in milliseconds) is the amount of time Samba will wait before sending an oplock break request to such (broken) clients.
     5835.PP
     5836.RS 4
     5837This is a tuning parameter added due to bugs in both Windows 9x and WinNT\. If Samba responds to a client too quickly when that client issues an SMB that can cause an oplock break request, then the network client can fail and not respond to the break request\. This tuning parameter (which is set in milliseconds) is the amount of time Samba will wait before sending an oplock break request to such (broken) clients\.
    47405838.sp
    47415839.it 1 an-trap
    … …  
    47435841.nr an-break-flag 1
    47445842.br
    4745 \fBWarning\fR
    4746 DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE.
    4747 Default:
    4748 \fB\fIoplock break wait time\fR = 0 \fR
    4749 .RE
    4750 .PP
     5843Warning
     5844DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE\.
     5845
     5846Default:
     5847\fI\fIoplock break wait time\fR\fR\fI = \fR\fI0\fR\fI \fR
     5848.RE
     5849
    47515850oplock contention limit (S)
    4752 .RS 3n
     5851.PP
     5852.RS 4
    47535853This is a
    4754 \fBvery\fR
     5854\fIvery\fR
    47555855advanced
    47565856\fBsmbd\fR(8)
    4757 tuning option to improve the efficiency of the granting of oplocks under multiple client contention for the same file.
     5857tuning option to improve the efficiency of the granting of oplocks under multiple client contention for the same file\.
    47585858.sp
    47595859In brief it specifies a number, which causes
    4760 \fBsmbd\fR(8)not to grant an oplock even when requested if the approximate number of clients contending for an oplock on the same file goes over this limit. This causes
     5860\fBsmbd\fR(8)not to grant an oplock even when requested if the approximate number of clients contending for an oplock on the same file goes over this limit\. This causes
    47615861smbd
    4762 to behave in a similar way to Windows NT.
     5862to behave in a similar way to Windows NT\.
    47635863.sp
    47645864.it 1 an-trap
    … …  
    47665866.nr an-break-flag 1
    47675867.br
    4768 \fBWarning\fR
    4769 DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE.
    4770 Default:
    4771 \fB\fIoplock contention limit\fR = 2 \fR
    4772 .RE
    4773 .PP
     5868Warning
     5869DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE\.
     5870
     5871Default:
     5872\fI\fIoplock contention limit\fR\fR\fI = \fR\fI2\fR\fI \fR
     5873.RE
     5874
    47745875oplocks (S)
    4775 .RS 3n
     5876.PP
     5877.RS 4
    47765878This boolean option tells
    47775879smbd
    4778 whether to issue oplocks (opportunistic locks) to file open requests on this share. The oplock code can dramatically (approx. 30% or more) improve the speed of access to files on Samba servers. It allows the clients to aggressively cache files locally and you may want to disable this option for unreliable network environments (it is turned on by default in Windows NT Servers). For more information see the file
    4779 \fISpeed.txt\fR
     5880whether to issue oplocks (opportunistic locks) to file open requests on this share\. The oplock code can dramatically (approx\. 30% or more) improve the speed of access to files on Samba servers\. It allows the clients to aggressively cache files locally and you may want to disable this option for unreliable network environments (it is turned on by default in Windows NT Servers)\. For more information see the file
     5881\fISpeed\.txt\fR
    47805882in the Samba
    47815883\fIdocs/\fR
    4782 directory.
    4783 .sp
    4784 Oplocks may be selectively turned off on certain files with a share. See the
    4785 veto oplock files parameter. On some systems oplocks are recognized by the underlying operating system. This allows data synchronization between all access to oplocked files, whether it be via Samba or NFS or a local UNIX process. See the
    4786 kernel oplocks parameter for details.
    4787 .sp
    4788 Default:
    4789 \fB\fIoplocks\fR = yes \fR
    4790 .RE
    4791 .PP
     5884directory\.
     5885.sp
     5886Oplocks may be selectively turned off on certain files with a share\. See the
     5887\fIveto oplock files\fR
     5888parameter\. On some systems oplocks are recognized by the underlying operating system\. This allows data synchronization between all access to oplocked files, whether it be via Samba or NFS or a local UNIX process\. See the
     5889\fIkernel oplocks\fR
     5890parameter for details\.
     5891.sp
     5892Default:
     5893\fI\fIoplocks\fR\fR\fI = \fR\fIyes\fR\fI \fR
     5894.RE
     5895
    47925896os2 driver map (G)
    4793 .RS 3n
    4794 The parameter is used to define the absolute path to a file containing a mapping of Windows NT printer driver names to OS/2 printer driver names. The format is:
    4795 .sp
    4796 <nt driver name> = <os2 driver name>.<device name>
     5897.PP
     5898.RS 4
     5899The parameter is used to define the absolute path to a file containing a mapping of Windows NT printer driver names to OS/2 printer driver names\. The format is:
     5900.sp
     5901<nt driver name> = <os2 driver name>\.<device name>
    47975902.sp
    47985903For example, a valid entry using the HP LaserJet 5 printer driver would appear as
    4799 HP LaserJet 5L = LASERJET.HP LaserJet 5L.
    4800 .sp
    4801 The need for the file is due to the printer driver namespace problem described in the chapter on Classical Printing in the Samba3-HOWTO book. For more details on OS/2 clients, please refer to chapter on other clients in the Samba3-HOWTO book.
    4802 .sp
    4803 Default:
    4804 \fB\fIos2 driver map\fR = \fR
    4805 .RE
    4806 .PP
     5904HP LaserJet 5L = LASERJET\.HP LaserJet 5L\.
     5905.sp
     5906The need for the file is due to the printer driver namespace problem described in the chapter on Classical Printing in the Samba3\-HOWTO book\. For more details on OS/2 clients, please refer to chapter on other clients in the Samba3\-HOWTO book\.
     5907.sp
     5908Default:
     5909\fI\fIos2 driver map\fR\fR\fI = \fR\fI\fR\fI \fR
     5910.RE
     5911
    48075912os level (G)
    4808 .RS 3n
    4809 This integer value controls what level Samba advertises itself as for browse elections. The value of this parameter determines whether
     5913.PP
     5914.RS 4
     5915This integer value controls what level Samba advertises itself as for browse elections\. The value of this parameter determines whether
    48105916\fBnmbd\fR(8)
    48115917has a chance of becoming a local master browser for the
    4812 workgroup in the local broadcast area.
    4813 .sp
    4814 \fB Note :\fRBy default, Samba will win a local master browsing election over all Microsoft operating systems except a Windows NT 4.0/2000 Domain Controller. This means that a misconfigured Samba host can effectively isolate a subnet for browsing purposes. This parameter is largely auto-configured in the Samba-3 release series and it is seldom necessary to manually over-ride the default setting. Please refer to chapter 9 of the Samba-3 HOWTO document for further information regarding the use of this parameter.
    4815 .sp
    4816 Default:
    4817 \fB\fIos level\fR = 20 \fR
    4818 .sp
    4819 Example:
    4820 \fB\fIos level\fR = 65 \fR
    4821 .RE
    4822 .PP
     5918\fIworkgroup\fR
     5919in the local broadcast area\.
     5920.sp
     5921\fI Note:\fR
     5922By default, Samba will win a local master browsing election over all Microsoft operating systems except a Windows NT 4\.0/2000 Domain Controller\. This means that a misconfigured Samba host can effectively isolate a subnet for browsing purposes\. This parameter is largely auto\-configured in the Samba\-3 release series and it is seldom necessary to manually override the default setting\. Please refer to chapter 9 of the Samba\-3 HOWTO document for further information regarding the use of this parameter\.
     5923\fINote:\fR
     5924The maximum value for this parameter is 255\. If you use higher values, counting will start at 0!
     5925.sp
     5926Default:
     5927\fI\fIos level\fR\fR\fI = \fR\fI20\fR\fI \fR
     5928.sp
     5929Example:
     5930\fI\fIos level\fR\fR\fI = \fR\fI65\fR\fI \fR
     5931.RE
     5932
    48235933pam password change (G)
    4824 .RS 3n
    4825 With the addition of better PAM support in Samba 2.2, this parameter, it is possible to use PAM's password change control flag for Samba. If enabled, then PAM will be used for password changes when requested by an SMB client instead of the program listed in
    4826 passwd program. It should be possible to enable this without changing your
    4827 passwd chat parameter for most setups.
    4828 .sp
    4829 Default:
    4830 \fB\fIpam password change\fR = no \fR
    4831 .RE
    4832 .PP
     5934.PP
     5935.RS 4
     5936With the addition of better PAM support in Samba 2\.2, this parameter, it is possible to use PAM\'s password change control flag for Samba\. If enabled, then PAM will be used for password changes when requested by an SMB client instead of the program listed in
     5937\fIpasswd program\fR\. It should be possible to enable this without changing your
     5938\fIpasswd chat\fR
     5939parameter for most setups\.
     5940.sp
     5941Default:
     5942\fI\fIpam password change\fR\fR\fI = \fR\fIno\fR\fI \fR
     5943.RE
     5944
    48335945panic action (G)
    4834 .RS 3n
     5946.PP
     5947.RS 4
    48355948This is a Samba developer option that allows a system command to be called when either
    48365949\fBsmbd\fR(8)
    48375950or
    4838 \fBsmbd\fR(8)
    4839 crashes. This is usually used to draw attention to the fact that a problem occurred.
    4840 .sp
    4841 Default:
    4842 \fB\fIpanic action\fR = \fR
    4843 .sp
    4844 Example:
    4845 \fB\fIpanic action\fR = "/bin/sleep 90000" \fR
    4846 .RE
    4847 .PP
     5951\fBnmbd\fR(8)
     5952crashes\. This is usually used to draw attention to the fact that a problem occurred\.
     5953.sp
     5954Default:
     5955\fI\fIpanic action\fR\fR\fI = \fR\fI\fR\fI \fR
     5956.sp
     5957Example:
     5958\fI\fIpanic action\fR\fR\fI = \fR\fI"/bin/sleep 90000"\fR\fI \fR
     5959.RE
     5960
    48485961paranoid server security (G)
    4849 .RS 3n
    4850 Some version of NT 4.x allow non-guest users with a bad passowrd. When this option is enabled, samba will not use a broken NT 4.x server as password server, but instead complain to the logs and exit.
    4851 .sp
    4852 Disabling this option prevents Samba from making this check, which involves deliberatly attempting a bad logon to the remote server.
    4853 .sp
    4854 Default:
    4855 \fB\fIparanoid server security\fR = yes \fR
    4856 .RE
    4857 .PP
     5962.PP
     5963.RS 4
     5964Some version of NT 4\.x allow non\-guest users with a bad passowrd\. When this option is enabled, samba will not use a broken NT 4\.x server as password server, but instead complain to the logs and exit\.
     5965.sp
     5966Disabling this option prevents Samba from making this check, which involves deliberatly attempting a bad logon to the remote server\.
     5967.sp
     5968Default:
     5969\fI\fIparanoid server security\fR\fR\fI = \fR\fIyes\fR\fI \fR
     5970.RE
     5971
    48585972passdb backend (G)
    4859 .RS 3n
    4860 This option allows the administrator to chose which backend will be used for storing user and possibly group information. This allows you to swap between dfferent storage mechanisms without recompile.
    4861 .sp
    4862 The parameter value is divided into two parts, the backend's name, and a 'location' string that has meaning only to that particular backed. These are separated by a : character.
     5973.PP
     5974.RS 4
     5975This option allows the administrator to chose which backend will be used for storing user and possibly group information\. This allows you to swap between different storage mechanisms without recompile\.
     5976.sp
     5977The parameter value is divided into two parts, the backend\'s name, and a \'location\' string that has meaning only to that particular backed\. These are separated by a : character\.
    48635978.sp
    48645979Available backends can include:
    4865 .RS 3n
    4866 .TP 3n
    4867 \(bu
     5980.sp
     5981.RS 4
     5982.ie n \{\
     5983\h'-04'\(bu\h'+03'\c
     5984.\}
     5985.el \{\
     5986.sp -1
     5987.IP \(bu 2.3
     5988.\}
    48685989smbpasswd
    4869 - The default smbpasswd backend. Takes a path to the smbpasswd file as an optional argument.
    4870 .TP 3n
    4871 \(bu
     5990\- The default smbpasswd backend\. Takes a path to the smbpasswd file as an optional argument\.
     5991.RE
     5992.sp
     5993.RS 4
     5994.ie n \{\
     5995\h'-04'\(bu\h'+03'\c
     5996.\}
     5997.el \{\
     5998.sp -1
     5999.IP \(bu 2.3
     6000.\}
    48726001tdbsam
    4873 - The TDB based password storage backend. Takes a path to the TDB as an optional argument (defaults to passdb.tdb in the
    4874 private dir directory.
    4875 .TP 3n
    4876 \(bu
     6002\- The TDB based password storage backend\. Takes a path to the TDB as an optional argument (defaults to passdb\.tdb in the
     6003\fIprivate dir\fR
     6004directory\.
     6005.RE
     6006.sp
     6007.RS 4
     6008.ie n \{\
     6009\h'-04'\(bu\h'+03'\c
     6010.\}
     6011.el \{\
     6012.sp -1
     6013.IP \(bu 2.3
     6014.\}
    48776015ldapsam
    4878 - The LDAP based passdb backend. Takes an LDAP URL as an optional argument (defaults to
     6016\- The LDAP based passdb backend\. Takes an LDAP URL as an optional argument (defaults to
    48796017ldap://localhost)
    48806018.sp
    4881 LDAP connections should be secured where possible. This may be done using either Start-TLS (see
    4882 ldap ssl) or by specifying
     6019LDAP connections should be secured where possible\. This may be done using either Start\-TLS (see
     6020\fIldap ssl\fR) or by specifying
    48836021\fIldaps://\fR
    4884 in the URL argument.
    4885 .sp
    4886 Multiple servers may also be specified in double-quotes, if your LDAP libraries supports the LDAP URL notation. (OpenLDAP does).
    4887 .RE
    4888 .IP "" 3n
    4889 
     6022in the URL argument\.
     6023.sp
     6024Multiple servers may also be specified in double\-quotes\. Whether multiple servers are supported or not and the exact syntax depends on the LDAP library you use\.
     6025.sp
     6026.RE
    48906027
    48916028        Examples of use are:
    4892 
     6029.sp
     6030.RS 4
    48936031.nf
    4894 
    4895 passdb backend = tdbsam:/etc/samba/private/passdb.tdb
    4896 
    4897 or
    4898 
    4899 passdb backend = ldapsam:"ldap://ldap-1.example.com ldap://ldap-2.example.com"
    4900 
     6032passdb backend = tdbsam:/etc/samba/private/passdb\.tdb
     6033
     6034or multi server LDAP URL with OpenLDAP library:
     6035
     6036passdb backend = ldapsam:"ldap://ldap\-1\.example\.com ldap://ldap\-2\.example\.com"
     6037
     6038or multi server LDAP URL with Netscape based LDAP library:
     6039
     6040passdb backend = ldapsam:"ldap://ldap\-1\.example\.com ldap\-2\.example\.com"
    49016041.fi
    4902 Default:
    4903 \fB\fIpassdb backend\fR = smbpasswd \fR
    4904 .RE
    4905 .PP
     6042.RE
     6043Default:
     6044\fI\fIpassdb backend\fR\fR\fI = \fR\fIsmbpasswd\fR\fI \fR
     6045.RE
     6046
    49066047passdb expand explicit (G)
    4907 .RS 3n
    4908 This parameter controls whether Samba substitutes %-macros in the passdb fields if they are explicitly set. We used to expand macros here, but this turned out to be a bug because the Windows client can expand a variable %G_osver% in which %G would have been substituted by the user's primary group.
    4909 .sp
    4910 Default:
    4911 \fB\fIpassdb expand explicit\fR = no \fR
    4912 .RE
    4913 .PP
    4914 passwd chat (G)
    4915 .RS 3n
    4916 This string controls the
    4917 \fB"chat"\fR
    4918 conversation that takes places between
    4919 \fBsmbd\fR(8)
    4920 and the local password changing program to change the user's password. The string describes a sequence of response-receive pairs that
    4921 \fBsmbd\fR(8)
    4922 uses to determine what to send to the
    4923 passwd program and what to expect back. If the expected output is not received then the password is not changed.
    4924 .sp
    4925 This chat sequence is often quite site specific, depending on what local methods are used for password control (such as NIS etc).
    4926 .sp
    4927 Note that this parameter only is only used if the
    4928 unix password sync parameter is set to
    4929 \fByes\fR. This sequence is then called
    4930 \fBAS ROOT\fR
    4931 when the SMB password in the smbpasswd file is being changed, without access to the old password cleartext. This means that root must be able to reset the user's password without knowing the text of the previous password. In the presence of NIS/YP, this means that the
    4932 passwd program must be executed on the NIS master.
    4933 .sp
    4934 The string can contain the macro
    4935 \fI%n\fR
    4936 which is substituted for the new password. The chat sequence can also contain the standard macros \n, \r, \t and \s to give line-feed, carriage-return, tab and space. The chat sequence string can also contain a '*' which matches any sequence of characters. Double quotes can be used to collect strings with spaces in them into a single string.
    4937 .sp
    4938 If the send string in any part of the chat sequence is a full stop ".", then no string is sent. Similarly, if the expect string is a full stop then no string is expected.
    4939 .sp
    4940 If the
    4941 pam password change parameter is set to
    4942 \fByes\fR, the chat pairs may be matched in any order, and success is determined by the PAM result, not any particular output. The \n macro is ignored for PAM conversions.
    4943 .sp
    4944 Default:
    4945 \fB\fIpasswd chat\fR = *new*password* %n\\n*new*password* %n\\n *changed* \fR
    4946 .sp
    4947 Example:
    4948 \fB\fIpasswd chat\fR = "*Enter OLD password*" %o\\n "*Enter NEW password*" %n\\n "*Reenter NEW password*" %n\\n "*Password changed*" \fR
    4949 .RE
    4950 .PP
     6048.PP
     6049.RS 4
     6050This parameter controls whether Samba substitutes %\-macros in the passdb fields if they are explicitly set\. We used to expand macros here, but this turned out to be a bug because the Windows client can expand a variable %G_osver% in which %G would have been substituted by the user\'s primary group\.
     6051.sp
     6052Default:
     6053\fI\fIpassdb expand explicit\fR\fR\fI = \fR\fIno\fR\fI \fR
     6054.RE
     6055
    49516056passwd chat debug (G)
    4952 .RS 3n
     6057.PP
     6058.RS 4
    49536059This boolean specifies if the passwd chat script parameter is run in
    4954 \fBdebug\fR
    4955 mode. In this mode the strings passed to and received from the passwd chat are printed in the
     6060\fIdebug\fR
     6061mode\. In this mode the strings passed to and received from the passwd chat are printed in the
    49566062\fBsmbd\fR(8)
    49576063log with a
    4958 debug level of 100. This is a dangerous option as it will allow plaintext passwords to be seen in the
     6064\fIdebug level\fR
     6065of 100\. This is a dangerous option as it will allow plaintext passwords to be seen in the
    49596066smbd
    4960 log. It is available to help Samba admins debug their
     6067log\. It is available to help Samba admins debug their
    49616068\fIpasswd chat\fR
    49626069scripts when calling the
    49636070\fIpasswd program\fR
    4964 and should be turned off after this has been done. This option has no effect if the
    4965 pam password change paramter is set. This parameter is off by default.
    4966 .sp
    4967 Default:
    4968 \fB\fIpasswd chat debug\fR = no \fR
    4969 .RE
    4970 .PP
     6071and should be turned off after this has been done\. This option has no effect if the
     6072\fIpam password change\fR
     6073parameter is set\. This parameter is off by default\.
     6074.sp
     6075Default:
     6076\fI\fIpasswd chat debug\fR\fR\fI = \fR\fIno\fR\fI \fR
     6077.RE
     6078
    49716079passwd chat timeout (G)
    4972 .RS 3n
    4973 This integer specifies the number of seconds smbd will wait for an initial answer from a passwd chat script being run. Once the initial answer is received the subsequent answers must be received in one tenth of this time. The default it two seconds.
    4974 .sp
    4975 Default:
    4976 \fB\fIpasswd chat timeout\fR = 2 \fR
    4977 .RE
    4978 .PP
     6080.PP
     6081.RS 4
     6082This integer specifies the number of seconds smbd will wait for an initial answer from a passwd chat script being run\. Once the initial answer is received the subsequent answers must be received in one tenth of this time\. The default it two seconds\.
     6083.sp
     6084Default:
     6085\fI\fIpasswd chat timeout\fR\fR\fI = \fR\fI2\fR\fI \fR
     6086.RE
     6087
     6088passwd chat (G)
     6089.PP
     6090.RS 4
     6091This string controls the
     6092\fI"chat"\fR
     6093conversation that takes places between
     6094\fBsmbd\fR(8)
     6095and the local password changing program to change the user\'s password\. The string describes a sequence of response\-receive pairs that
     6096\fBsmbd\fR(8)
     6097uses to determine what to send to the
     6098\fIpasswd program\fR
     6099and what to expect back\. If the expected output is not received then the password is not changed\.
     6100.sp
     6101This chat sequence is often quite site specific, depending on what local methods are used for password control (such as NIS etc)\.
     6102.sp
     6103Note that this parameter only is only used if the
     6104\fIunix password sync\fR
     6105parameter is set to
     6106\fByes\fR\. This sequence is then called
     6107\fIAS ROOT\fR
     6108when the SMB password in the smbpasswd file is being changed, without access to the old password cleartext\. This means that root must be able to reset the user\'s password without knowing the text of the previous password\. In the presence of NIS/YP, this means that the
     6109\fIpasswd program\fR
     6110must be executed on the NIS master\.
     6111.sp
     6112The string can contain the macro
     6113\fI%n\fR
     6114which is substituted for the new password\. The old passsword (\fI%o\fR) is only available when
     6115\fIencrypt passwords\fR
     6116has been disabled\. The chat sequence can also contain the standard macros \en, \er, \et and \es to give line\-feed, carriage\-return, tab and space\. The chat sequence string can also contain a \'*\' which matches any sequence of characters\. Double quotes can be used to collect strings with spaces in them into a single string\.
     6117.sp
     6118If the send string in any part of the chat sequence is a full stop "\.", then no string is sent\. Similarly, if the expect string is a full stop then no string is expected\.
     6119.sp
     6120If the
     6121\fIpam password change\fR
     6122parameter is set to
     6123\fByes\fR, the chat pairs may be matched in any order, and success is determined by the PAM result, not any particular output\. The \en macro is ignored for PAM conversions\.
     6124.sp
     6125Default:
     6126\fI\fIpasswd chat\fR\fR\fI = \fR\fI*new*password* %n\en*new*password* %n\en *changed*\fR\fI \fR
     6127.sp
     6128Example:
     6129\fI\fIpasswd chat\fR\fR\fI = \fR\fI"*Enter NEW password*" %n\en "*Reenter NEW password*" %n\en "*Password changed*"\fR\fI \fR
     6130.RE
     6131
    49796132passwd program (G)
    4980 .RS 3n
    4981 The name of a program that can be used to set UNIX user passwords. Any occurrences of
     6133.PP
     6134.RS 4
     6135The name of a program that can be used to set UNIX user passwords\. Any occurrences of
    49826136\fI%u\fR
    4983 will be replaced with the user name. The user name is checked for existence before calling the password changing program.
     6137will be replaced with the user name\. The user name is checked for existence before calling the password changing program\.
    49846138.sp
    49856139Also note that many passwd programs insist in
    4986 \fBreasonable \fR
    4987 passwords, such as a minimum length, or the inclusion of mixed case chars and digits. This can pose a problem as some clients (such as Windows for Workgroups) uppercase the password before sending it.
    4988 .sp
    4989 \fBNote\fR
     6140\fIreasonable \fR
     6141passwords, such as a minimum length, or the inclusion of mixed case chars and digits\. This can pose a problem as some clients (such as Windows for Workgroups) uppercase the password before sending it\.
     6142.sp
     6143\fINote\fR
    49906144that if the
    49916145\fIunix password sync\fR
    … …  
    49936147\fByes \fR
    49946148then this program is called
    4995 \fBAS ROOT\fR
    4996 before the SMB password in the smbpasswd file is changed. If this UNIX password change fails, then
     6149\fIAS ROOT\fR
     6150before the SMB password in the smbpasswd file is changed\. If this UNIX password change fails, then
    49976151smbd
    4998 will fail to change the SMB password also (this is by design).
     6152will fail to change the SMB password also (this is by design)\.
    49996153.sp
    50006154If the
    50016155\fIunix password sync\fR
    50026156parameter is set this parameter
    5003 \fBMUST USE ABSOLUTE PATHS\fR
     6157\fIMUST USE ABSOLUTE PATHS\fR
    50046158for
    5005 \fBALL\fR
    5006 programs called, and must be examined for security implications. Note that by default
     6159\fIALL\fR
     6160programs called, and must be examined for security implications\. Note that by default
    50076161\fIunix password sync\fR
    50086162is set to
    5009 \fBno\fR.
    5010 .sp
    5011 Default:
    5012 \fB\fIpasswd program\fR = \fR
    5013 .sp
    5014 Example:
    5015 \fB\fIpasswd program\fR = /bin/passwd %u \fR
    5016 .RE
    5017 .PP
     6163\fBno\fR\.
     6164.sp
     6165Default:
     6166\fI\fIpasswd program\fR\fR\fI = \fR\fI\fR\fI \fR
     6167.sp
     6168Example:
     6169\fI\fIpasswd program\fR\fR\fI = \fR\fI/bin/passwd %u\fR\fI \fR
     6170.RE
     6171
    50186172password level (G)
    5019 .RS 3n
    5020 Some client/server combinations have difficulty with mixed-case passwords. One offending client is Windows for Workgroups, which for some reason forces passwords to upper case when using the LANMAN1 protocol, but leaves them alone when using COREPLUS! Another problem child is the Windows 95/98 family of operating systems. These clients upper case clear text passwords even when NT LM 0.12 selected by the protocol negotiation request/response.
    5021 .sp
    5022 This parameter defines the maximum number of characters that may be upper case in passwords.
    5023 .sp
    5024 For example, say the password given was "FRED". If
     6173.PP
     6174.RS 4
     6175Some client/server combinations have difficulty with mixed\-case passwords\. One offending client is Windows for Workgroups, which for some reason forces passwords to upper case when using the LANMAN1 protocol, but leaves them alone when using COREPLUS! Another problem child is the Windows 95/98 family of operating systems\. These clients upper case clear text passwords even when NT LM 0\.12 selected by the protocol negotiation request/response\.
     6176.sp
     6177This parameter defines the maximum number of characters that may be upper case in passwords\.
     6178.sp
     6179For example, say the password given was "FRED"\. If
    50256180\fI password level\fR
    50266181is set to 1, the following combinations would be tried if "FRED" failed:
    … …  
    50326187was set to 2, the following combinations would also be tried:
    50336188.sp
    5034 "FRed", "FrEd", "FreD", "fREd", "fReD", "frED", ..
    5035 .sp
    5036 And so on.
    5037 .sp
    5038 The higher value this parameter is set to the more likely it is that a mixed case password will be matched against a single case password. However, you should be aware that use of this parameter reduces security and increases the time taken to process a new connection.
    5039 .sp
    5040 A value of zero will cause only two attempts to be made - the password as is and the password in all-lower case.
    5041 .sp
    5042 This parameter is used only when using plain-text passwords. It is not at all used when encrypted passwords as in use (that is the default since samba-3.0.0). Use this only when
    5043 encrypt passwords = No.
    5044 .sp
    5045 Default:
    5046 \fB\fIpassword level\fR = 0 \fR
    5047 .sp
    5048 Example:
    5049 \fB\fIpassword level\fR = 4 \fR
    5050 .RE
    5051 .PP
     6189"FRed", "FrEd", "FreD", "fREd", "fReD", "frED", \.\.
     6190.sp
     6191And so on\.
     6192.sp
     6193The higher value this parameter is set to the more likely it is that a mixed case password will be matched against a single case password\. However, you should be aware that use of this parameter reduces security and increases the time taken to process a new connection\.
     6194.sp
     6195A value of zero will cause only two attempts to be made \- the password as is and the password in all\-lower case\.
     6196.sp
     6197This parameter is used only when using plain\-text passwords\. It is not at all used when encrypted passwords as in use (that is the default since samba\-3\.0\.0)\. Use this only when
     6198\fIencrypt passwords = No\fR\.
     6199.sp
     6200Default:
     6201\fI\fIpassword level\fR\fR\fI = \fR\fI0\fR\fI \fR
     6202.sp
     6203Example:
     6204\fI\fIpassword level\fR\fR\fI = \fR\fI4\fR\fI \fR
     6205.RE
     6206
    50526207password server (G)
    5053 .RS 3n
     6208.PP
     6209.RS 4
    50546210By specifying the name of another SMB server or Active Directory domain controller with this option, and using
    50556211security = [ads|domain|server]
    5056 it is possible to get Samba to to do all its username/password validation using a specific remote server.
    5057 .sp
    5058 This option sets the name or IP address of the password server to use. New syntax has been added to support defining the port to use when connecting to the server the case of an ADS realm. To define a port other than the default LDAP port of 389, add the port number using a colon after the name or IP address (e.g. 192.168.1.100:389). If you do not specify a port, Samba will use the standard LDAP port of tcp/389. Note that port numbers have no effect on password servers for Windows NT 4.0 domains or netbios connections.
     6212it is possible to get Samba to to do all its username/password validation using a specific remote server\.
     6213.sp
     6214This option sets the name or IP address of the password server to use\. New syntax has been added to support defining the port to use when connecting to the server the case of an ADS realm\. To define a port other than the default LDAP port of 389, add the port number using a colon after the name or IP address (e\.g\. 192\.168\.1\.100:389)\. If you do not specify a port, Samba will use the standard LDAP port of tcp/389\. Note that port numbers have no effect on password servers for Windows NT 4\.0 domains or netbios connections\.
    50596215.sp
    50606216If parameter is a name, it is looked up using the parameter
    5061 name resolve order and so may resolved by any method and order described in that parameter.
    5062 .sp
    5063 The password server must be a machine capable of using the "LM1.2X002" or the "NT LM 0.12" protocol, and it must be in user level security mode.
     6217\fIname resolve order\fR
     6218and so may resolved by any method and order described in that parameter\.
     6219.sp
     6220The password server must be a machine capable of using the "LM1\.2X002" or the "NT LM 0\.12" protocol, and it must be in user level security mode\.
    50646221.sp
    50656222.it 1 an-trap
    … …  
    50676224.nr an-break-flag 1
    50686225.br
    5069 \fBNote\fR
    5070 Using a password server means your UNIX box (running Samba) is only as secure as your password server.
    5071 \fBDO NOT CHOOSE A PASSWORD SERVER THAT YOU DON'T COMPLETELY TRUST\fR.
    5072 Never point a Samba server at itself for password serving. This will cause a loop and could lock up your Samba server!
     6226Note
     6227Using a password server means your UNIX box (running Samba) is only as secure as your password server\.
     6228\fIDO NOT CHOOSE A PASSWORD SERVER THAT YOU DON\'T COMPLETELY TRUST\fR\.
     6229
     6230Never point a Samba server at itself for password serving\. This will cause a loop and could lock up your Samba server!
    50736231.sp
    50746232The name of the password server takes the standard substitutions, but probably the only useful one is
    5075 \fI%m \fR, which means the Samba server will use the incoming client as the password server. If you use this then you better trust your clients, and you had better restrict them with hosts allow!
     6233\fI%m \fR, which means the Samba server will use the incoming client as the password server\. If you use this then you better trust your clients, and you had better restrict them with hosts allow!
    50766234.sp
    50776235If the
    … …  
    50806238\fBdomain\fR
    50816239or
    5082 \fBads\fR, then the list of machines in this option must be a list of Primary or Backup Domain controllers for the Domain or the character '*', as the Samba server is effectively in that domain, and will use cryptographically authenticated RPC calls to authenticate the user logging on. The advantage of using
     6240\fBads\fR, then the list of machines in this option must be a list of Primary or Backup Domain controllers for the Domain or the character \'*\', as the Samba server is effectively in that domain, and will use cryptographically authenticated RPC calls to authenticate the user logging on\. The advantage of using
    50836241security = domain
    50846242is that if you list several hosts in the
    … …  
    50866244option then
    50876245smbd
    5088 will try each in turn till it finds one that responds. This is useful in case your primary server goes down.
     6246will try each in turn till it finds one that responds\. This is useful in case your primary server goes down\.
    50896247.sp
    50906248If the
    50916249\fIpassword server\fR
    5092 option is set to the character '*', then Samba will attempt to auto-locate the Primary or Backup Domain controllers to authenticate against by doing a query for the name
     6250option is set to the character \'*\', then Samba will attempt to auto\-locate the Primary or Backup Domain controllers to authenticate against by doing a query for the name
    50936251\fBWORKGROUP<1C>\fR
    5094 and then contacting each server returned in the list of IP addresses from the name resolution source.
    5095 .sp
    5096 If the list of servers contains both names/IP's and the '*' character, the list is treated as a list of preferred domain controllers, but an auto lookup of all remaining DC's will be added to the list as well. Samba will not attempt to optimize this list by locating the closest DC.
     6252and then contacting each server returned in the list of IP addresses from the name resolution source\.
     6253.sp
     6254If the list of servers contains both names/IP\'s and the \'*\' character, the list is treated as a list of preferred domain controllers, but an auto lookup of all remaining DC\'s will be added to the list as well\. Samba will not attempt to optimize this list by locating the closest DC\.
    50976255.sp
    50986256If the
    … …  
    51016259\fBserver\fR, then there are different restrictions that
    51026260security = domain
    5103 doesn't suffer from:
    5104 .RS 3n
    5105 .TP 3n
    5106 \(bu
     6261doesn\'t suffer from:
     6262.sp
     6263.RS 4
     6264.ie n \{\
     6265\h'-04'\(bu\h'+03'\c
     6266.\}
     6267.el \{\
     6268.sp -1
     6269.IP \(bu 2.3
     6270.\}
    51076271You may list several password servers in the
    51086272\fIpassword server\fR
    … …  
    51106274smbd
    51116275makes a connection to a password server, and then the password server fails, no more users will be able to be authenticated from this
    5112 smbd. This is a restriction of the SMB/CIFS protocol when in
     6276smbd\. This is a restriction of the SMB/CIFS protocol when in
    51136277security = server
    5114 mode and cannot be fixed in Samba.
    5115 .TP 3n
    5116 \(bu
     6278mode and cannot be fixed in Samba\.
     6279.RE
     6280.sp
     6281.RS 4
     6282.ie n \{\
     6283\h'-04'\(bu\h'+03'\c
     6284.\}
     6285.el \{\
     6286.sp -1
     6287.IP \(bu 2.3
     6288.\}
    51176289If you are using a Windows NT server as your password server then you will have to ensure that your users are able to login from the Samba server, as when in
    51186290security = server
    5119 mode the network logon will appear to come from there rather than from the users workstation.
    5120 .RE
    5121 .IP "" 3n
    5122 Default:
    5123 \fB\fIpassword server\fR = \fR
    5124 .sp
    5125 Example:
    5126 \fB\fIpassword server\fR = NT-PDC, NT-BDC1, NT-BDC2, * \fR
    5127 .sp
    5128 Example:
    5129 \fB\fIpassword server\fR = windc.mydomain.com:389 192.168.1.101 * \fR
    5130 .sp
    5131 Example:
    5132 \fB\fIpassword server\fR = * \fR
    5133 .RE
    5134 .PP
    5135 directory
    5136 .RS 3n
    5137 This parameter is a synonym for path.
    5138 .RE
    5139 .PP
     6291mode the network logon will appear to come from there rather than from the users workstation\.
     6292.sp
     6293.RE
     6294Default:
     6295\fI\fIpassword server\fR\fR\fI = \fR\fI\fR\fI \fR
     6296.sp
     6297Example:
     6298\fI\fIpassword server\fR\fR\fI = \fR\fINT\-PDC, NT\-BDC1, NT\-BDC2, *\fR\fI \fR
     6299.sp
     6300Example:
     6301\fI\fIpassword server\fR\fR\fI = \fR\fIwindc\.mydomain\.com:389 192\.168\.1\.101 *\fR\fI \fR
     6302.sp
     6303Example:
     6304\fI\fIpassword server\fR\fR\fI = \fR\fI*\fR\fI \fR
     6305.RE
     6306directory.PP
     6307.RS 4
     6308This parameter is a synonym for
     6309path\.
     6310.RE
     6311
    51406312path (S)
    5141 .RS 3n
    5142 This parameter specifies a directory to which the user of the service is to be given access. In the case of printable services, this is where print data will spool prior to being submitted to the host for printing.
    5143 .sp
    5144 For a printable service offering guest access, the service should be readonly and the path should be world-writeable and have the sticky bit set. This is not mandatory of course, but you probably won't get the results you expect if you do otherwise.
     6313.PP
     6314.RS 4
     6315This parameter specifies a directory to which the user of the service is to be given access\. In the case of printable services, this is where print data will spool prior to being submitted to the host for printing\.
     6316.sp
     6317For a printable service offering guest access, the service should be readonly and the path should be world\-writeable and have the sticky bit set\. This is not mandatory of course, but you probably won\'t get the results you expect if you do otherwise\.
    51456318.sp
    51466319Any occurrences of
    51476320\fI%u\fR
    5148 in the path will be replaced with the UNIX username that the client is using on this connection. Any occurrences of
     6321in the path will be replaced with the UNIX username that the client is using on this connection\. Any occurrences of
    51496322\fI%m\fR
    5150 will be replaced by the NetBIOS name of the machine they are connecting from. These replacements are very useful for setting up pseudo home directories for users.
     6323will be replaced by the NetBIOS name of the machine they are connecting from\. These replacements are very useful for setting up pseudo home directories for users\.
    51516324.sp
    51526325Note that this path will be based on
    5153 root dir if one was specified.
    5154 .sp
    5155 Default:
    5156 \fB\fIpath\fR = \fR
    5157 .sp
    5158 Example:
    5159 \fB\fIpath\fR = /home/fred \fR
    5160 .RE
    5161 .PP
     6326\fIroot dir\fR
     6327if one was specified\.
     6328.sp
     6329Default:
     6330\fI\fIpath\fR\fR\fI = \fR\fI\fR\fI \fR
     6331.sp
     6332Example:
     6333\fI\fIpath\fR\fR\fI = \fR\fI/home/fred\fR\fI \fR
     6334.RE
     6335
    51626336pid directory (G)
    5163 .RS 3n
    5164 This option specifies the directory where pid files will be placed.
    5165 .sp
    5166 Default:
    5167 \fB\fIpid directory\fR = ${prefix}/var/locks \fR
    5168 .sp
    5169 Example:
    5170 \fB\fIpid directory\fR = pid directory = /var/run/ \fR
    5171 .RE
    5172 .PP
     6337.PP
     6338.RS 4
     6339This option specifies the directory where pid files will be placed\.
     6340.sp
     6341Default:
     6342\fI\fIpid directory\fR\fR\fI = \fR\fI${prefix}/var/locks\fR\fI \fR
     6343.sp
     6344Example:
     6345\fI\fIpid directory\fR\fR\fI = \fR\fIpid directory = /var/run/\fR\fI \fR
     6346.RE
     6347
    51736348posix locking (S)
    5174 .RS 3n
     6349.PP
     6350.RS 4
    51756351The
    51766352\fBsmbd\fR(8)
    5177 daemon maintains an database of file locks obtained by SMB clients. The default behavior is to map this internal database to POSIX locks. This means that file locks obtained by SMB clients are consistent with those seen by POSIX compliant applications accessing the files via a non-SMB method (e.g. NFS or local file access). You should never need to disable this parameter.
    5178 .sp
    5179 Default:
    5180 \fB\fIposix locking\fR = yes \fR
    5181 .RE
    5182 .PP
     6353daemon maintains an database of file locks obtained by SMB clients\. The default behavior is to map this internal database to POSIX locks\. This means that file locks obtained by SMB clients are consistent with those seen by POSIX compliant applications accessing the files via a non\-SMB method (e\.g\. NFS or local file access)\. You should never need to disable this parameter\.
     6354.sp
     6355Default:
     6356\fI\fIposix locking\fR\fR\fI = \fR\fIyes\fR\fI \fR
     6357.RE
     6358
    51836359postexec (S)
    5184 .RS 3n
    5185 This option specifies a command to be run whenever the service is disconnected. It takes the usual substitutions. The command may be run as the root on some systems.
     6360.PP
     6361.RS 4
     6362This option specifies a command to be run whenever the service is disconnected\. It takes the usual substitutions\. The command may be run as the root on some systems\.
    51866363.sp
    51876364An interesting example may be to unmount server resources:
    … …  
    51906367.sp
    51916368Default:
    5192 \fB\fIpostexec\fR = \fR
    5193 .sp
    5194 Example:
    5195 \fB\fIpostexec\fR = echo \\"%u disconnected from %S from %m (%I)\\" >> /tmp/log \fR
    5196 .RE
    5197 .PP
    5198 exec
    5199 .RS 3n
    5200 This parameter is a synonym for preexec.
    5201 .RE
    5202 .PP
     6369\fI\fIpostexec\fR\fR\fI = \fR\fI\fR\fI \fR
     6370.sp
     6371Example:
     6372\fI\fIpostexec\fR\fR\fI = \fR\fIecho \e"%u disconnected from %S from %m (%I)\e" >> /tmp/log\fR\fI \fR
     6373.RE
     6374
     6375preexec close (S)
     6376.PP
     6377.RS 4
     6378This boolean option controls whether a non\-zero return code from
     6379\fIpreexec\fR
     6380should close the service being connected to\.
     6381.sp
     6382Default:
     6383\fI\fIpreexec close\fR\fR\fI = \fR\fIno\fR\fI \fR
     6384.RE
     6385exec.PP
     6386.RS 4
     6387This parameter is a synonym for
     6388preexec\.
     6389.RE
     6390
    52036391preexec (S)
    5204 .RS 3n
    5205 This option specifies a command to be run whenever the service is connected to. It takes the usual substitutions.
    5206 .sp
    5207 An interesting example is to send the users a welcome message every time they log in. Maybe a message of the day? Here is an example:
    5208 .sp
    5209 
    5210 preexec = csh -c 'echo \\"Welcome to %S!\\" | /usr/local/samba/bin/smbclient -M %m -I %I' &
    5211 .sp
    5212 Of course, this could get annoying after a while :-)
     6392.PP
     6393.RS 4
     6394This option specifies a command to be run whenever the service is connected to\. It takes the usual substitutions\.
     6395.sp
     6396An interesting example is to send the users a welcome message every time they log in\. Maybe a message of the day? Here is an example:
     6397.sp
     6398
     6399preexec = csh \-c \'echo \e"Welcome to %S!\e" | /usr/local/samba/bin/smbclient \-M %m \-I %I\' &
     6400.sp
     6401Of course, this could get annoying after a while :\-)
    52136402.sp
    52146403See also
    5215 preexec close and
    5216 postexec.
    5217 .sp
    5218 Default:
    5219 \fB\fIpreexec\fR = \fR
    5220 .sp
    5221 Example:
    5222 \fB\fIpreexec\fR = echo \\"%u connected to %S from %m (%I)\\" >> /tmp/log \fR
    5223 .RE
    5224 .PP
    5225 preexec close (S)
    5226 .RS 3n
    5227 This boolean option controls whether a non-zero return code from
    5228 preexec should close the service being connected to.
    5229 .sp
    5230 Default:
    5231 \fB\fIpreexec close\fR = no \fR
    5232 .RE
    5233 .PP
    5234 prefered master
    5235 .RS 3n
    5236 This parameter is a synonym for preferred master.
    5237 .RE
    5238 .PP
     6404\fIpreexec close\fR
     6405and
     6406\fIpostexec\fR\.
     6407.sp
     6408Default:
     6409\fI\fIpreexec\fR\fR\fI = \fR\fI\fR\fI \fR
     6410.sp
     6411Example:
     6412\fI\fIpreexec\fR\fR\fI = \fR\fIecho \e"%u connected to %S from %m (%I)\e" >> /tmp/log\fR\fI \fR
     6413.RE
     6414prefered master.PP
     6415.RS 4
     6416This parameter is a synonym for
     6417preferred master\.
     6418.RE
     6419
    52396420preferred master (G)
    5240 .RS 3n
     6421.PP
     6422.RS 4
    52416423This boolean parameter controls if
    52426424\fBnmbd\fR(8)
    5243 is a preferred master browser for its workgroup.
     6425is a preferred master browser for its workgroup\.
    52446426.sp
    52456427If this is set to
    52466428\fByes\fR, on startup,
    52476429nmbd
    5248 will force an election, and it will have a slight advantage in winning the election. It is recommended that this parameter is used in conjunction with
    5249 domain master = yes, so that
     6430will force an election, and it will have a slight advantage in winning the election\. It is recommended that this parameter is used in conjunction with
     6431\fIdomain master = yes\fR, so that
    52506432nmbd
    5251 can guarantee becoming a domain master.
    5252 .sp
    5253 Use this option with caution, because if there are several hosts (whether Samba servers, Windows 95 or NT) that are preferred master browsers on the same subnet, they will each periodically and continuously attempt to become the local master browser. This will result in unnecessary broadcast traffic and reduced browsing capabilities.
    5254 .sp
    5255 Default:
    5256 \fB\fIpreferred master\fR = auto \fR
    5257 .RE
    5258 .PP
    5259 auto services
    5260 .RS 3n
    5261 This parameter is a synonym for preload.
    5262 .RE
    5263 .PP
     6433can guarantee becoming a domain master\.
     6434.sp
     6435Use this option with caution, because if there are several hosts (whether Samba servers, Windows 95 or NT) that are preferred master browsers on the same subnet, they will each periodically and continuously attempt to become the local master browser\. This will result in unnecessary broadcast traffic and reduced browsing capabilities\.
     6436.sp
     6437Default:
     6438\fI\fIpreferred master\fR\fR\fI = \fR\fIauto\fR\fI \fR
     6439.RE
     6440
     6441preload modules (G)
     6442.PP
     6443.RS 4
     6444This is a list of paths to modules that should be loaded into smbd before a client connects\. This improves the speed of smbd when reacting to new connections somewhat\.
     6445.sp
     6446Default:
     6447\fI\fIpreload modules\fR\fR\fI = \fR\fI\fR\fI \fR
     6448.sp
     6449Example:
     6450\fI\fIpreload modules\fR\fR\fI = \fR\fI/usr/lib/samba/passdb/mysql\.so\fR\fI \fR
     6451.RE
     6452auto services.PP
     6453.RS 4
     6454This parameter is a synonym for
     6455preload\.
     6456.RE
     6457
    52646458preload (G)
    5265 .RS 3n
    5266 This is a list of services that you want to be automatically added to the browse lists. This is most useful for homes and printers services that would otherwise not be visible.
     6459.PP
     6460.RS 4
     6461This is a list of services that you want to be automatically added to the browse lists\. This is most useful for homes and printers services that would otherwise not be visible\.
    52676462.sp
    52686463Note that if you just want all printers in your printcap file loaded then the
    5269 load printers option is easier.
    5270 .sp
    5271 Default:
    5272 \fB\fIpreload\fR = \fR
    5273 .sp
    5274 Example:
    5275 \fB\fIpreload\fR = fred lp colorlp \fR
    5276 .RE
    5277 .PP
    5278 preload modules (G)
    5279 .RS 3n
    5280 This is a list of paths to modules that should be loaded into smbd before a client connects. This improves the speed of smbd when reacting to new connections somewhat.
    5281 .sp
    5282 Default:
    5283 \fB\fIpreload modules\fR = \fR
    5284 .sp
    5285 Example:
    5286 \fB\fIpreload modules\fR = /usr/lib/samba/passdb/mysql.so \fR
    5287 .RE
    5288 .PP
     6464\fIload printers\fR
     6465option is easier\.
     6466.sp
     6467Default:
     6468\fI\fIpreload\fR\fR\fI = \fR\fI\fR\fI \fR
     6469.sp
     6470Example:
     6471\fI\fIpreload\fR\fR\fI = \fR\fIfred lp colorlp\fR\fI \fR
     6472.RE
     6473
    52896474preserve case (S)
    5290 .RS 3n
     6475.PP
     6476.RS 4
    52916477This controls if new filenames are created with the case that the client passes, or if they are forced to be the
    5292 default case.
     6478\fIdefault case\fR\.
    52936479.sp
    52946480See the section on
    52956481NAME MANGLING
    5296 for a fuller discussion.
    5297 .sp
    5298 Default:
    5299 \fB\fIpreserve case\fR = yes \fR
    5300 .RE
    5301 .PP
    5302 print ok
    5303 .RS 3n
    5304 This parameter is a synonym for printable.
    5305 .RE
    5306 .PP
     6482for a fuller discussion\.
     6483.sp
     6484Default:
     6485\fI\fIpreserve case\fR\fR\fI = \fR\fIyes\fR\fI \fR
     6486.RE
     6487print ok.PP
     6488.RS 4
     6489This parameter is a synonym for
     6490printable\.
     6491.RE
     6492
    53076493printable (S)
    5308 .RS 3n
     6494.PP
     6495.RS 4
    53096496If this parameter is
    5310 \fByes\fR, then clients may open, write to and submit spool files on the directory specified for the service.
    5311 .sp
    5312 Note that a printable service will ALWAYS allow writing to the service path (user privileges permitting) via the spooling of print data. The
    5313 read only parameter controls only non-printing access to the resource.
    5314 .sp
    5315 Default:
    5316 \fB\fIprintable\fR = no \fR
    5317 .RE
    5318 .PP
     6497\fByes\fR, then clients may open, write to and submit spool files on the directory specified for the service\.
     6498.sp
     6499Note that a printable service will ALWAYS allow writing to the service path (user privileges permitting) via the spooling of print data\. The
     6500\fIread only\fR
     6501parameter controls only non\-printing access to the resource\.
     6502.sp
     6503Default:
     6504\fI\fIprintable\fR\fR\fI = \fR\fIno\fR\fI \fR
     6505.RE
     6506
    53196507printcap cache time (G)
    5320 .RS 3n
    5321 This option specifies the number of seconds before the printing subsystem is again asked for the known printers. If the value is greater than 60 the initial waiting time is set to 60 seconds to allow an earlier first rescan of the printing subsystem.
    5322 .sp
    5323 Setting this parameter to 0 disables any rescanning for new or removed printers after the initial startup.
    5324 .sp
    5325 Default:
    5326 \fB\fIprintcap cache time\fR = 750 \fR
    5327 .sp
    5328 Example:
    5329 \fB\fIprintcap cache time\fR = 600 \fR
    5330 .RE
    5331 .PP
    5332 printcap
    5333 .RS 3n
    5334 This parameter is a synonym for printcap name.
    5335 .RE
    5336 .PP
     6508.PP
     6509.RS 4
     6510This option specifies the number of seconds before the printing subsystem is again asked for the known printers\. If the value is greater than 60 the initial waiting time is set to 60 seconds to allow an earlier first rescan of the printing subsystem\.
     6511.sp
     6512Setting this parameter to 0 disables any rescanning for new or removed printers after the initial startup\.
     6513.sp
     6514Default:
     6515\fI\fIprintcap cache time\fR\fR\fI = \fR\fI750\fR\fI \fR
     6516.sp
     6517Example:
     6518\fI\fIprintcap cache time\fR\fR\fI = \fR\fI600\fR\fI \fR
     6519.RE
     6520printcap.PP
     6521.RS 4
     6522This parameter is a synonym for
     6523printcap name\.
     6524.RE
     6525
    53376526printcap name (S)
    5338 .RS 3n
    5339 This parameter may be used to override the compiled-in default printcap name used by the server (usually
    5340 \fI /etc/printcap\fR). See the discussion of the
     6527.PP
     6528.RS 4
     6529This parameter may be used to override the compiled\-in default printcap name used by the server (usually
     6530\fI /etc/printcap\fR)\. See the discussion of the
    53416531[printers]
    5342 section above for reasons why you might want to do this.
     6532section above for reasons why you might want to do this\.
    53436533.sp
    53446534To use the CUPS printing interface set
    5345 printcap name = cups. This should be supplemented by an addtional setting
    5346 printing = cups in the [global] section.
     6535printcap name = cups\. This should be supplemented by an addtional setting
     6536\fIprinting = cups\fR
     6537in the [global] section\.
    53476538printcap name = cups
    5348 will use the "dummy" printcap created by CUPS, as specified in your CUPS configuration file.
     6539will use the "dummy" printcap created by CUPS, as specified in your CUPS configuration file\.
    53496540.sp
    53506541On System V systems that use
    … …  
    53526543to list available printers you can use
    53536544printcap name = lpstat
    5354 to automatically obtain lists of available printers. This is the default for systems that define SYSV at configure time in Samba (this includes most System V based systems). If
     6545to automatically obtain lists of available printers\. This is the default for systems that define SYSV at configure time in Samba (this includes most System V based systems)\. If
    53556546\fI printcap name\fR
    53566547is set to
    53576548lpstat
    53586549on these systems then Samba will launch
    5359 lpstat -v
    5360 and attempt to parse the output to obtain a printer list.
     6550lpstat \-v
     6551and attempt to parse the output to obtain a printer list\.
    53616552.sp
    53626553A minimal printcap file would look something like this:
    5363 
    5364 .sp
    5365 
     6554.sp
     6555.RS 4
    53666556.nf
    5367 
    53686557print1|My Printer 1
    53696558print2|My Printer 2
    … …  
    53716560print4|My Printer 4
    53726561print5|My Printer 5
    5373 
    53746562.fi
    5375 where the '|' separates aliases of a printer. The fact that the second alias has a space in it gives a hint to Samba that it's a comment.
     6563.RE
     6564.sp
     6565where the \'|\' separates aliases of a printer\. The fact that the second alias has a space in it gives a hint to Samba that it\'s a comment\.
    53766566.sp
    53776567.it 1 an-trap
    … …  
    53796569.nr an-break-flag 1
    53806570.br
    5381 \fBNote\fR
     6571Note
    53826572Under AIX the default printcap name is
    5383 \fI/etc/qconfig\fR. Samba will assume the file is in AIX
     6573\fI/etc/qconfig\fR\. Samba will assume the file is in AIX
    53846574\fIqconfig\fR
    53856575format if the string
    53866576\fIqconfig\fR
    5387 appears in the printcap filename.
    5388 Default:
    5389 \fB\fIprintcap name\fR = /etc/printcap \fR
    5390 .sp
    5391 Example:
    5392 \fB\fIprintcap name\fR = /etc/myprintcap \fR
    5393 .RE
    5394 .PP
     6577appears in the printcap filename\.
     6578
     6579Default:
     6580\fI\fIprintcap name\fR\fR\fI = \fR\fI/etc/printcap\fR\fI \fR
     6581.sp
     6582Example:
     6583\fI\fIprintcap name\fR\fR\fI = \fR\fI/etc/myprintcap\fR\fI \fR
     6584.RE
     6585
    53956586print command (S)
    5396 .RS 3n
     6587.PP
     6588.RS 4
    53976589After a print job has finished spooling to a service, this command will be used via a
    53986590system()
    5399 call to process the spool file. Typically the command specified will submit the spool file to the host's printing subsystem, but there is no requirement that this be the case. The server will not remove the spool file, so whatever command you specify should remove the spool file when it has been processed, otherwise you will need to manually remove old spool files.
    5400 .sp
    5401 The print command is simply a text string. It will be used verbatim after macro substitutions have been made:
    5402 .sp
    5403 %s, %f - the path to the spool file name
    5404 .sp
    5405 %p - the appropriate printer name
    5406 .sp
    5407 %J - the job name as transmitted by the client.
    5408 .sp
    5409 %c - The number of printed pages of the spooled job (if known).
    5410 .sp
    5411 %z - the size of the spooled print job (in bytes)
     6591call to process the spool file\. Typically the command specified will submit the spool file to the host\'s printing subsystem, but there is no requirement that this be the case\. The server will not remove the spool file, so whatever command you specify should remove the spool file when it has been processed, otherwise you will need to manually remove old spool files\.
     6592.sp
     6593The print command is simply a text string\. It will be used verbatim after macro substitutions have been made:
     6594.sp
     6595%s, %f \- the path to the spool file name
     6596.sp
     6597%p \- the appropriate printer name
     6598.sp
     6599%J \- the job name as transmitted by the client\.
     6600.sp
     6601%c \- The number of printed pages of the spooled job (if known)\.
     6602.sp
     6603%z \- the size of the spooled print job (in bytes)
    54126604.sp
    54136605The print command
    5414 \fBMUST\fR
     6606\fIMUST\fR
    54156607contain at least one occurrence of
    54166608\fI%s\fR
    54176609or
    54186610\fI%f \fR
    5419 - the
     6611\- the
    54206612\fI%p\fR
    5421 is optional. At the time a job is submitted, if no printer name is supplied the
     6613is optional\. At the time a job is submitted, if no printer name is supplied the
    54226614\fI%p \fR
    5423 will be silently removed from the printer command.
    5424 .sp
    5425 If specified in the [global] section, the print command given will be used for any printable service that does not have its own print command specified.
    5426 .sp
    5427 If there is neither a specified print command for a printable service nor a global print command, spool files will be created but not processed and (most importantly) not removed.
     6615will be silently removed from the printer command\.
     6616.sp
     6617If specified in the [global] section, the print command given will be used for any printable service that does not have its own print command specified\.
     6618.sp
     6619If there is neither a specified print command for a printable service nor a global print command, spool files will be created but not processed and (most importantly) not removed\.
    54286620.sp
    54296621Note that printing may fail on some UNIXes from the
    54306622\fBnobody\fR
    5431 account. If this happens then create an alternative guest account that can print and set the
    5432 guest account in the [global] section.
    5433 .sp
    5434 You can form quite complex print commands by realizing that they are just passed to a shell. For example the following will log a print job, print the file, then remove it. Note that ';' is the usual separator for command in shell scripts.
    5435 .sp
    5436 print command = echo Printing %s >> /tmp/print.log; lpr -P %p %s; rm %s
    5437 .sp
    5438 You may have to vary this command considerably depending on how you normally print files on your system. The default for the parameter varies depending on the setting of the
    5439 printing parameter.
     6623account\. If this happens then create an alternative guest account that can print and set the
     6624\fIguest account\fR
     6625in the [global] section\.
     6626.sp
     6627You can form quite complex print commands by realizing that they are just passed to a shell\. For example the following will log a print job, print the file, then remove it\. Note that \';\' is the usual separator for command in shell scripts\.
     6628.sp
     6629print command = echo Printing %s >> /tmp/print\.log; lpr \-P %p %s; rm %s
     6630.sp
     6631You may have to vary this command considerably depending on how you normally print files on your system\. The default for the parameter varies depending on the setting of the
     6632\fIprinting\fR
     6633parameter\.
    54406634.sp
    54416635Default: For
    54426636printing = BSD, AIX, QNX, LPRNG or PLP :
    54436637.sp
    5444 print command = lpr -r -P%p %s
     6638print command = lpr \-r \-P%p %s
    54456639.sp
    54466640For
    54476641printing = SYSV or HPUX :
    54486642.sp
    5449 print command = lp -c -d%p %s; rm %s
     6643print command = lp \-c \-d%p %s; rm %s
    54506644.sp
    54516645For
    54526646printing = SOFTQ :
    54536647.sp
    5454 print command = lp -d%p -s %s; rm %s
     6648print command = lp \-d%p \-s %s; rm %s
    54556649.sp
    54566650For printing = CUPS : If SAMBA is compiled against libcups, then
    5457 printcap = cups uses the CUPS API to submit jobs, etc. Otherwise it maps to the System V commands with the -oraw option for printing, i.e. it uses
    5458 lp -c -d%p -oraw; rm %s. With
    5459 printing = cups, and if SAMBA is compiled against libcups, any manually set print command will be ignored.
    5460 .sp
    5461 \fBNo default\fR
    5462 .sp
    5463 Example:
    5464 \fB\fIprint command\fR = /usr/local/samba/bin/myprintscript %p %s \fR
    5465 .RE
    5466 .PP
     6651\fIprintcap = cups\fR
     6652uses the CUPS API to submit jobs, etc\. Otherwise it maps to the System V commands with the \-oraw option for printing, i\.e\. it uses
     6653lp \-c \-d%p \-oraw; rm %s\. With
     6654printing = cups, and if SAMBA is compiled against libcups, any manually set print command will be ignored\.
     6655.sp
     6656\fINo default\fR
     6657.sp
     6658Example:
     6659\fI\fIprint command\fR\fR\fI = \fR\fI/usr/local/samba/bin/myprintscript %p %s\fR\fI \fR
     6660.RE
     6661
    54676662printer admin (S)
    5468 .RS 3n
    5469 This lists users who can do anything to printers via the remote administration interfaces offered by MS-RPC (usually using a NT workstation). This parameter can be set per-share or globally. Note: The root user always has admin rights. Use caution with use in the global stanza as this can cause side effects.
    5470 .sp
    5471 This parameter has been marked deprecated in favor of using the SePrintOperatorPrivilege and individual print security descriptors. It will be removed in a future release.
    5472 .sp
    5473 Default:
    5474 \fB\fIprinter admin\fR = \fR
    5475 .sp
    5476 Example:
    5477 \fB\fIprinter admin\fR = admin, @staff \fR
    5478 .RE
    5479 .PP
    5480 printer
    5481 .RS 3n
    5482 This parameter is a synonym for printer name.
    5483 .RE
    5484 .PP
     6663.PP
     6664.RS 4
     6665This lists users who can do anything to printers via the remote administration interfaces offered by MS\-RPC (usually using a NT workstation)\. This parameter can be set per\-share or globally\. Note: The root user always has admin rights\. Use caution with use in the global stanza as this can cause side effects\.
     6666.sp
     6667This parameter has been marked deprecated in favor of using the SePrintOperatorPrivilege and individual print security descriptors\. It will be removed in a future release\.
     6668.sp
     6669Default:
     6670\fI\fIprinter admin\fR\fR\fI = \fR\fI\fR\fI \fR
     6671.sp
     6672Example:
     6673\fI\fIprinter admin\fR\fR\fI = \fR\fIadmin, @staff\fR\fI \fR
     6674.RE
     6675printer.PP
     6676.RS 4
     6677This parameter is a synonym for
     6678printer name\.
     6679.RE
     6680
    54856681printer name (S)
    5486 .RS 3n
    5487 This parameter specifies the name of the printer to which print jobs spooled through a printable service will be sent.
    5488 .sp
    5489 If specified in the [global] section, the printer name given will be used for any printable service that does not have its own printer name specified.
     6682.PP
     6683.RS 4
     6684This parameter specifies the name of the printer to which print jobs spooled through a printable service will be sent\.
     6685.sp
     6686If specified in the [global] section, the printer name given will be used for any printable service that does not have its own printer name specified\.
    54906687.sp
    54916688The default value of the
    5492 printer name may be
     6689\fIprinter name\fR
     6690may be
    54936691lp
    5494 on many systems.
    5495 .sp
    5496 Default:
    5497 \fB\fIprinter name\fR = none \fR
    5498 .sp
    5499 Example:
    5500 \fB\fIprinter name\fR = laserwriter \fR
    5501 .RE
    5502 .PP
     6692on many systems\.
     6693.sp
     6694Default:
     6695\fI\fIprinter name\fR\fR\fI = \fR\fInone\fR\fI \fR
     6696.sp
     6697Example:
     6698\fI\fIprinter name\fR\fR\fI = \fR\fIlaserwriter\fR\fI \fR
     6699.RE
     6700
    55036701printing (S)
    5504 .RS 3n
    5505 This parameters controls how printer status information is interpreted on your system. It also affects the default values for the
     6702.PP
     6703.RS 4
     6704This parameters controls how printer status information is interpreted on your system\. It also affects the default values for the
    55066705\fIprint command\fR,
    55076706\fIlpq command\fR,
    … …  
    55096708\fIlpresume command\fR, and
    55106709\fIlprm command\fR
    5511 if specified in the [global] section.
    5512 .sp
    5513 Currently nine printing styles are supported. They are
     6710if specified in the [global] section\.
     6711.sp
     6712Currently nine printing styles are supported\. They are
    55146713\fBBSD\fR,
    55156714\fBAIX\fR,
    … …  
    55206719\fBQNX\fR,
    55216720\fBSOFTQ\fR, and
    5522 \fBCUPS\fR.
     6721\fBCUPS\fR\.
    55236722.sp
    55246723To see what the defaults are for the other print commands when using the various options use the
    55256724\fBtestparm\fR(1)
    5526 program.
    5527 .sp
    5528 This option can be set on a per printer basis. Please be aware however, that you must place any of the various printing commands (e.g. print command, lpq command, etc...) after defining the value for the
     6725program\.
     6726.sp
     6727This option can be set on a per printer basis\. Please be aware however, that you must place any of the various printing commands (e\.g\. print command, lpq command, etc\.\.\.) after defining the value for the
    55296728\fIprinting\fR
    5530 option since it will reset the printing commands to default values.
     6729option since it will reset the printing commands to default values\.
    55316730.sp
    55326731See also the discussion in the
    55336732[printers]
    5534 section.
    5535 .sp
    5536 \fBNo default\fR
    5537 .RE
    5538 .PP
     6733section\.
     6734.sp
     6735\fINo default\fR
     6736.RE
     6737
    55396738printjob username (S)
    5540 .RS 3n
    5541 This parameter specifies which user information will be passed to the printing system. Usually, the username is sent, but in some cases, e.g. the domain prefix is useful, too.
    5542 .sp
    5543 Default:
    5544 \fB\fIprintjob username\fR = %U \fR
    5545 .sp
    5546 Example:
    5547 \fB\fIprintjob username\fR = %D\\%U \fR
    5548 .RE
    5549 .PP
     6739.PP
     6740.RS 4
     6741This parameter specifies which user information will be passed to the printing system\. Usually, the username is sent, but in some cases, e\.g\. the domain prefix is useful, too\.
     6742.sp
     6743Default:
     6744\fI\fIprintjob username\fR\fR\fI = \fR\fI%U\fR\fI \fR
     6745.sp
     6746Example:
     6747\fI\fIprintjob username\fR\fR\fI = \fR\fI%D\e%U\fR\fI \fR
     6748.RE
     6749
    55506750private dir (G)
    5551 .RS 3n
     6751.PP
     6752.RS 4
    55526753This parameters defines the directory smbd will use for storing such files as
    55536754\fIsmbpasswd\fR
    55546755and
    5555 \fIsecrets.tdb\fR.
    5556 .sp
    5557 Default:
    5558 \fB\fIprivate dir\fR = ${prefix}/private \fR
    5559 .RE
    5560 .PP
     6756\fIsecrets\.tdb\fR\.
     6757.sp
     6758Default:
     6759\fI\fIprivate dir\fR\fR\fI = \fR\fI${prefix}/private\fR\fI \fR
     6760.RE
     6761
    55616762profile acls (S)
    5562 .RS 3n
    5563 This boolean parameter was added to fix the problems that people have been having with storing user profiles on Samba shares from Windows 2000 or Windows XP clients. New versions of Windows 2000 or Windows XP service packs do security ACL checking on the owner and ability to write of the profile directory stored on a local workstation when copied from a Samba share.
    5564 .sp
    5565 When not in domain mode with winbindd then the security info copied onto the local workstation has no meaning to the logged in user (SID) on that workstation so the profile storing fails. Adding this parameter onto a share used for profile storage changes two things about the returned Windows ACL. Firstly it changes the owner and group owner of all reported files and directories to be BUILTIN\\Administrators, BUILTIN\\Users respectively (SIDs S-1-5-32-544, S-1-5-32-545). Secondly it adds an ACE entry of "Full Control" to the SID BUILTIN\\Users to every returned ACL. This will allow any Windows 2000 or XP workstation user to access the profile.
    5566 .sp
    5567 Note that if you have multiple users logging on to a workstation then in order to prevent them from being able to access each others profiles you must remove the "Bypass traverse checking" advanced user right. This will prevent access to other users profile directories as the top level profile directory (named after the user) is created by the workstation profile code and has an ACL restricting entry to the directory tree to the owning user.
    5568 .sp
    5569 Default:
    5570 \fB\fIprofile acls\fR = no \fR
    5571 .RE
    5572 .PP
     6763.PP
     6764.RS 4
     6765This boolean parameter was added to fix the problems that people have been having with storing user profiles on Samba shares from Windows 2000 or Windows XP clients\. New versions of Windows 2000 or Windows XP service packs do security ACL checking on the owner and ability to write of the profile directory stored on a local workstation when copied from a Samba share\.
     6766.sp
     6767When not in domain mode with winbindd then the security info copied onto the local workstation has no meaning to the logged in user (SID) on that workstation so the profile storing fails\. Adding this parameter onto a share used for profile storage changes two things about the returned Windows ACL\. Firstly it changes the owner and group owner of all reported files and directories to be BUILTIN\e\eAdministrators, BUILTIN\e\eUsers respectively (SIDs S\-1\-5\-32\-544, S\-1\-5\-32\-545)\. Secondly it adds an ACE entry of "Full Control" to the SID BUILTIN\e\eUsers to every returned ACL\. This will allow any Windows 2000 or XP workstation user to access the profile\.
     6768.sp
     6769Note that if you have multiple users logging on to a workstation then in order to prevent them from being able to access each others profiles you must remove the "Bypass traverse checking" advanced user right\. This will prevent access to other users profile directories as the top level profile directory (named after the user) is created by the workstation profile code and has an ACL restricting entry to the directory tree to the owning user\.
     6770.sp
     6771Default:
     6772\fI\fIprofile acls\fR\fR\fI = \fR\fIno\fR\fI \fR
     6773.RE
     6774
    55736775queuepause command (S)
    5574 .RS 3n
    5575 This parameter specifies the command to be executed on the server host in order to pause the printer queue.
    5576 .sp
    5577 This command should be a program or script which takes a printer name as its only parameter and stops the printer queue, such that no longer jobs are submitted to the printer.
    5578 .sp
    5579 This command is not supported by Windows for Workgroups, but can be issued from the Printers window under Windows 95 and NT.
     6776.PP
     6777.RS 4
     6778This parameter specifies the command to be executed on the server host in order to pause the printer queue\.
     6779.sp
     6780This command should be a program or script which takes a printer name as its only parameter and stops the printer queue, such that no longer jobs are submitted to the printer\.
     6781.sp
     6782This command is not supported by Windows for Workgroups, but can be issued from the Printers window under Windows 95 and NT\.
    55806783.sp
    55816784If a
    55826785\fI%p\fR
    5583 is given then the printer name is put in its place. Otherwise it is placed at the end of the command.
    5584 .sp
    5585 Note that it is good practice to include the absolute path in the command as the PATH may not be available to the server.
    5586 .sp
    5587 \fBNo default\fR
    5588 .sp
    5589 Example:
    5590 \fB\fIqueuepause command\fR = disable %p \fR
    5591 .RE
    5592 .PP
     6786is given then the printer name is put in its place\. Otherwise it is placed at the end of the command\.
     6787.sp
     6788Note that it is good practice to include the absolute path in the command as the PATH may not be available to the server\.
     6789.sp
     6790\fINo default\fR
     6791.sp
     6792Example:
     6793\fI\fIqueuepause command\fR\fR\fI = \fR\fIdisable %p\fR\fI \fR
     6794.RE
     6795
    55936796queueresume command (S)
    5594 .RS 3n
    5595 This parameter specifies the command to be executed on the server host in order to resume the printer queue. It is the command to undo the behavior that is caused by the previous parameter (queuepause command).
    5596 .sp
    5597 This command should be a program or script which takes a printer name as its only parameter and resumes the printer queue, such that queued jobs are resubmitted to the printer.
    5598 .sp
    5599 This command is not supported by Windows for Workgroups, but can be issued from the Printers window under Windows 95 and NT.
     6797.PP
     6798.RS 4
     6799This parameter specifies the command to be executed on the server host in order to resume the printer queue\. It is the command to undo the behavior that is caused by the previous parameter (\fIqueuepause command\fR)\.
     6800.sp
     6801This command should be a program or script which takes a printer name as its only parameter and resumes the printer queue, such that queued jobs are resubmitted to the printer\.
     6802.sp
     6803This command is not supported by Windows for Workgroups, but can be issued from the Printers window under Windows 95 and NT\.
    56006804.sp
    56016805If a
    56026806\fI%p\fR
    5603 is given then the printer name is put in its place. Otherwise it is placed at the end of the command.
    5604 .sp
    5605 Note that it is good practice to include the absolute path in the command as the PATH may not be available to the server.
    5606 .sp
    5607 Default:
    5608 \fB\fIqueueresume command\fR = \fR
    5609 .sp
    5610 Example:
    5611 \fB\fIqueueresume command\fR = enable %p \fR
    5612 .RE
    5613 .PP
     6807is given then the printer name is put in its place\. Otherwise it is placed at the end of the command\.
     6808.sp
     6809Note that it is good practice to include the absolute path in the command as the PATH may not be available to the server\.
     6810.sp
     6811Default:
     6812\fI\fIqueueresume command\fR\fR\fI = \fR\fI\fR\fI \fR
     6813.sp
     6814Example:
     6815\fI\fIqueueresume command\fR\fR\fI = \fR\fIenable %p\fR\fI \fR
     6816.RE
     6817
    56146818read bmpx (G)
    5615 .RS 3n
     6819.PP
     6820.RS 4
    56166821This boolean parameter controls whether
    56176822\fBsmbd\fR(8)
    5618 will support the "Read Block Multiplex" SMB. This is now rarely used and defaults to
    5619 \fBno\fR. You should never need to set this parameter.
    5620 .sp
    5621 Default:
    5622 \fB\fIread bmpx\fR = no \fR
    5623 .RE
    5624 .PP
     6823will support the "Read Block Multiplex" SMB\. This is now rarely used and defaults to
     6824\fBno\fR\. You should never need to set this parameter\.
     6825.sp
     6826Default:
     6827\fI\fIread bmpx\fR\fR\fI = \fR\fIno\fR\fI \fR
     6828.RE
     6829
    56256830read list (S)
    5626 .RS 3n
    5627 This is a list of users that are given read-only access to a service. If the connecting user is in this list then they will not be given write access, no matter what the
    5628 read only option is set to. The list can include group names using the syntax described in the
    5629 invalid users parameter.
     6831.PP
     6832.RS 4
     6833This is a list of users that are given read\-only access to a service\. If the connecting user is in this list then they will not be given write access, no matter what the
     6834\fIread only\fR
     6835option is set to\. The list can include group names using the syntax described in the
     6836\fIinvalid users\fR
     6837parameter\.
    56306838.sp
    56316839This parameter will not work with the
    5632 security = share in Samba 3.0. This is by design.
    5633 .sp
    5634 Default:
    5635 \fB\fIread list\fR = \fR
    5636 .sp
    5637 Example:
    5638 \fB\fIread list\fR = mary, @students \fR
    5639 .RE
    5640 .PP
     6840\fIsecurity = share\fR
     6841in Samba 3\.0\. This is by design\.
     6842.sp
     6843Default:
     6844\fI\fIread list\fR\fR\fI = \fR\fI\fR\fI \fR
     6845.sp
     6846Example:
     6847\fI\fIread list\fR\fR\fI = \fR\fImary, @students\fR\fI \fR
     6848.RE
     6849
    56416850read only (S)
    5642 .RS 3n
     6851.PP
     6852.RS 4
    56436853An inverted synonym is
    5644 writeable.
     6854\fIwriteable\fR\.
    56456855.sp
    56466856If this parameter is
    5647 \fByes\fR, then users of a service may not create or modify files in the service's directory.
     6857\fByes\fR, then users of a service may not create or modify files in the service\'s directory\.
    56486858.sp
    56496859Note that a printable service (printable = yes) will
    5650 \fBALWAYS\fR
    5651 allow writing to the directory (user privileges permitting), but only via spooling operations.
    5652 .sp
    5653 Default:
    5654 \fB\fIread only\fR = yes \fR
    5655 .RE
    5656 .PP
     6860\fIALWAYS\fR
     6861allow writing to the directory (user privileges permitting), but only via spooling operations\.
     6862.sp
     6863Default:
     6864\fI\fIread only\fR\fR\fI = \fR\fIyes\fR\fI \fR
     6865.RE
     6866
    56576867read raw (G)
    5658 .RS 3n
    5659 This parameter controls whether or not the server will support the raw read SMB requests when transferring data to clients.
    5660 .sp
    5661 If enabled, raw reads allow reads of 65535 bytes in one packet. This typically provides a major performance benefit.
    5662 .sp
    5663 However, some clients either negotiate the allowable block size incorrectly or are incapable of supporting larger block sizes, and for these clients you may need to disable raw reads.
    5664 .sp
    5665 In general this parameter should be viewed as a system tuning tool and left severely alone.
    5666 .sp
    5667 Default:
    5668 \fB\fIread raw\fR = yes \fR
    5669 .RE
    5670 .PP
     6868.PP
     6869.RS 4
     6870This parameter controls whether or not the server will support the raw read SMB requests when transferring data to clients\.
     6871.sp
     6872If enabled, raw reads allow reads of 65535 bytes in one packet\. This typically provides a major performance benefit\.
     6873.sp
     6874However, some clients either negotiate the allowable block size incorrectly or are incapable of supporting larger block sizes, and for these clients you may need to disable raw reads\.
     6875.sp
     6876In general this parameter should be viewed as a system tuning tool and left severely alone\.
     6877.sp
     6878Default:
     6879\fI\fIread raw\fR\fR\fI = \fR\fIyes\fR\fI \fR
     6880.RE
     6881
    56716882realm (G)
    5672 .RS 3n
    5673 This option specifies the kerberos realm to use. The realm is used as the ADS equivalent of the NT4
    5674 domain. It is usually set to the DNS name of the kerberos server.
    5675 .sp
    5676 Default:
    5677 \fB\fIrealm\fR = \fR
    5678 .sp
    5679 Example:
    5680 \fB\fIrealm\fR = mysambabox.mycompany.com \fR
    5681 .RE
    5682 .PP
     6883.PP
     6884.RS 4
     6885This option specifies the kerberos realm to use\. The realm is used as the ADS equivalent of the NT4
     6886domain\. It is usually set to the DNS name of the kerberos server\.
     6887.sp
     6888Default:
     6889\fI\fIrealm\fR\fR\fI = \fR\fI\fR\fI \fR
     6890.sp
     6891Example:
     6892\fI\fIrealm\fR\fR\fI = \fR\fImysambabox\.mycompany\.com\fR\fI \fR
     6893.RE
     6894
    56836895remote announce (G)
    5684 .RS 3n
     6896.PP
     6897.RS 4
    56856898This option allows you to setup
    5686 \fBnmbd\fR(8)to periodically announce itself to arbitrary IP addresses with an arbitrary workgroup name.
    5687 .sp
    5688 This is useful if you want your Samba server to appear in a remote workgroup for which the normal browse propagation rules don't work. The remote workgroup can be anywhere that you can send IP packets to.
     6899\fBnmbd\fR(8)to periodically announce itself to arbitrary IP addresses with an arbitrary workgroup name\.
     6900.sp
     6901This is useful if you want your Samba server to appear in a remote workgroup for which the normal browse propagation rules don\'t work\. The remote workgroup can be anywhere that you can send IP packets to\.
    56896902.sp
    56906903For example:
    5691 
    5692 .sp
    5693 
     6904.sp
     6905.RS 4
    56946906.nf
    5695 
    5696 remote announce = 192.168.2.255/SERVERS 192.168.4.255/STAFF
    5697 
     6907remote announce = 192\.168\.2\.255/SERVERS 192\.168\.4\.255/STAFF
    56986908.fi
     6909.RE
     6910.sp
    56996911the above line would cause
    57006912nmbd
    5701 to announce itself to the two given IP addresses using the given workgroup names. If you leave out the workgroup name then the one given in the
    5702 workgroup parameter is used instead.
    5703 .sp
    5704 The IP addresses you choose would normally be the broadcast addresses of the remote networks, but can also be the IP addresses of known browse masters if your network config is that stable.
    5705 .sp
    5706 See the chapter on Network Browsing in the Samba-HOWTO book.
    5707 .sp
    5708 Default:
    5709 \fB\fIremote announce\fR = \fR
    5710 .RE
    5711 .PP
     6913to announce itself to the two given IP addresses using the given workgroup names\. If you leave out the workgroup name then the one given in the
     6914\fIworkgroup\fR
     6915parameter is used instead\.
     6916.sp
     6917The IP addresses you choose would normally be the broadcast addresses of the remote networks, but can also be the IP addresses of known browse masters if your network config is that stable\.
     6918.sp
     6919See the chapter on Network Browsing in the Samba\-HOWTO book\.
     6920.sp
     6921Default:
     6922\fI\fIremote announce\fR\fR\fI = \fR\fI\fR\fI \fR
     6923.RE
     6924
    57126925remote browse sync (G)
    5713 .RS 3n
     6926.PP
     6927.RS 4
    57146928This option allows you to setup
    57156929\fBnmbd\fR(8)
    5716 to periodically request synchronization of browse lists with the master browser of a Samba server that is on a remote segment. This option will allow you to gain browse lists for multiple workgroups across routed networks. This is done in a manner that does not work with any non-Samba servers.
    5717 .sp
    5718 This is useful if you want your Samba server and all local clients to appear in a remote workgroup for which the normal browse propagation rules don't work. The remote workgroup can be anywhere that you can send IP packets to.
     6930to periodically request synchronization of browse lists with the master browser of a Samba server that is on a remote segment\. This option will allow you to gain browse lists for multiple workgroups across routed networks\. This is done in a manner that does not work with any non\-Samba servers\.
     6931.sp
     6932This is useful if you want your Samba server and all local clients to appear in a remote workgroup for which the normal browse propagation rules don\'t work\. The remote workgroup can be anywhere that you can send IP packets to\.
    57196933.sp
    57206934For example:
    5721 
    5722 .sp
    5723 
     6935.sp
     6936.RS 4
    57246937.nf
    5725 
    5726 \fIremote browse sync = 192.168.2.255 192.168.4.255\fR
    5727 
     6938\fIremote browse sync = 192\.168\.2\.255 192\.168\.4\.255\fR
    57286939.fi
     6940.RE
     6941.sp
    57296942the above line would cause
    57306943nmbd
    5731 to request the master browser on the specified subnets or addresses to synchronize their browse lists with the local server.
    5732 .sp
    5733 The IP addresses you choose would normally be the broadcast addresses of the remote networks, but can also be the IP addresses of known browse masters if your network config is that stable. If a machine IP address is given Samba makes NO attempt to validate that the remote machine is available, is listening, nor that it is in fact the browse master on its segment.
     6944to request the master browser on the specified subnets or addresses to synchronize their browse lists with the local server\.
     6945.sp
     6946The IP addresses you choose would normally be the broadcast addresses of the remote networks, but can also be the IP addresses of known browse masters if your network config is that stable\. If a machine IP address is given Samba makes NO attempt to validate that the remote machine is available, is listening, nor that it is in fact the browse master on its segment\.
    57346947.sp
    57356948The
    5736 remote browse sync may be used on networks where there is no WINS server, and may be used on disjoint networks where each network has its own WINS server.
    5737 .sp
    5738 Default:
    5739 \fB\fIremote browse sync\fR = \fR
    5740 .RE
    5741 .PP
     6949\fIremote browse sync\fR
     6950may be used on networks where there is no WINS server, and may be used on disjoint networks where each network has its own WINS server\.
     6951.sp
     6952Default:
     6953\fI\fIremote browse sync\fR\fR\fI = \fR\fI\fR\fI \fR
     6954.RE
     6955
    57426956rename user script (G)
    5743 .RS 3n
     6957.PP
     6958.RS 4
    57446959This is the full pathname to a script that will be run as root by
    57456960\fBsmbd\fR(8)
    5746 under special circumstances described below.
    5747 .sp
    5748 When a user with admin authority or SeAddUserPrivilege rights renames a user (e.g.: from the NT4 User Manager for Domains), this script will be run to rename the POSIX user. Two variables,
     6961under special circumstances described below\.
     6962.sp
     6963When a user with admin authority or SeAddUserPrivilege rights renames a user (e\.g\.: from the NT4 User Manager for Domains), this script will be run to rename the POSIX user\. Two variables,
    57496964%uold
    57506965and
    5751 %unew, will be substituted with the old and new usernames, respectively. The script should return 0 upon successful completion, and nonzero otherwise.
     6966%unew, will be substituted with the old and new usernames, respectively\. The script should return 0 upon successful completion, and nonzero otherwise\.
    57526967.sp
    57536968.it 1 an-trap
    … …  
    57556970.nr an-break-flag 1
    57566971.br
    5757 \fBNote\fR
    5758 The script has all responsibility to rename all the necessary data that is accessible in this posix method. This can mean different requirements for different backends. The tdbsam and smbpasswd backends will take care of the contents of their respective files, so the script is responsible only for changing the POSIX username, and other data that may required for your circumstances, such as home directory. Please also consider whether or not you need to rename the actual home directories themselves. The ldapsam backend will not make any changes, because of the potential issues with renaming the LDAP naming attribute. In this case the script is responsible for changing the attribute that samba uses (uid) for locating users, as well as any data that needs to change for other applications using the same directory.
    5759 Default:
    5760 \fB\fIrename user script\fR = no \fR
    5761 .RE
    5762 .PP
     6972Note
     6973The script has all responsibility to rename all the necessary data that is accessible in this posix method\. This can mean different requirements for different backends\. The tdbsam and smbpasswd backends will take care of the contents of their respective files, so the script is responsible only for changing the POSIX username, and other data that may required for your circumstances, such as home directory\. Please also consider whether or not you need to rename the actual home directories themselves\. The ldapsam backend will not make any changes, because of the potential issues with renaming the LDAP naming attribute\. In this case the script is responsible for changing the attribute that samba uses (uid) for locating users, as well as any data that needs to change for other applications using the same directory\.
     6974
     6975Default:
     6976\fI\fIrename user script\fR\fR\fI = \fR\fIno\fR\fI \fR
     6977.RE
     6978
    57636979reset on zero vc (G)
    5764 .RS 3n
    5765 This boolean option controls whether an incoming session setup should kill other connections coming from the same IP. This matches the default Windows 2003 behaviour. Setting this parameter to yes becomes necessary when you have a flaky network and windows decides to reconnect while the old connection still has files with share modes open. These files become inaccessible over the new connection. The client sends a zero VC on the new connection, and Windows 2003 kills all other connections coming from the same IP. This way the locked files are accessible again. Please be aware that enabling this option will kill connections behind a masquerading router.
    5766 .sp
    5767 Default:
    5768 \fB\fIreset on zero vc\fR = no \fR
    5769 .RE
    5770 .PP
     6980.PP
     6981.RS 4
     6982This boolean option controls whether an incoming session setup should kill other connections coming from the same IP\. This matches the default Windows 2003 behaviour\. Setting this parameter to yes becomes necessary when you have a flaky network and windows decides to reconnect while the old connection still has files with share modes open\. These files become inaccessible over the new connection\. The client sends a zero VC on the new connection, and Windows 2003 kills all other connections coming from the same IP\. This way the locked files are accessible again\. Please be aware that enabling this option will kill connections behind a masquerading router\.
     6983.sp
     6984Default:
     6985\fI\fIreset on zero vc\fR\fR\fI = \fR\fIno\fR\fI \fR
     6986.RE
     6987
    57716988restrict anonymous (G)
    5772 .RS 3n
    5773 The setting of this parameter determines whether user and group list information is returned for an anonymous connection. and mirrors the effects of the
    5774 
    5775 .sp
    5776 
     6989.PP
     6990.RS 4
     6991The setting of this parameter determines whether user and group list information is returned for an anonymous connection\. and mirrors the effects of the
     6992.sp
     6993.RS 4
    57776994.nf
    5778 
    5779 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
    5780            Control\LSA\RestrictAnonymous
    5781 
     6995HKEY_LOCAL_MACHINE\eSYSTEM\eCurrentControlSet\e
     6996           Control\eLSA\eRestrictAnonymous
    57826997.fi
    5783 registry key in Windows 2000 and Windows NT. When set to 0, user and group list information is returned to anyone who asks. When set to 1, only an authenticated user can retrive user and group list information. For the value 2, supported by Windows 2000/XP and Samba, no anonymous connections are allowed at all. This can break third party and Microsoft applications which expect to be allowed to perform operations anonymously.
    5784 .sp
    5785 The security advantage of using restrict anonymous = 1 is dubious, as user and group list information can be obtained using other means.
     6998.RE
     6999.sp
     7000registry key in Windows 2000 and Windows NT\. When set to 0, user and group list information is returned to anyone who asks\. When set to 1, only an authenticated user can retrive user and group list information\. For the value 2, supported by Windows 2000/XP and Samba, no anonymous connections are allowed at all\. This can break third party and Microsoft applications which expect to be allowed to perform operations anonymously\.
     7001.sp
     7002The security advantage of using restrict anonymous = 1 is dubious, as user and group list information can be obtained using other means\.
    57867003.sp
    57877004.it 1 an-trap
    … …  
    57897006.nr an-break-flag 1
    57907007.br
    5791 \fBNote\fR
     7008Note
    57927009The security advantage of using restrict anonymous = 2 is removed by setting
    5793 guest ok = yes on any share.
    5794 Default:
    5795 \fB\fIrestrict anonymous\fR = 0 \fR
    5796 .RE
    5797 .PP
    5798 root
    5799 .RS 3n
    5800 This parameter is a synonym for root directory.
    5801 .RE
    5802 .PP
    5803 root dir
    5804 .RS 3n
    5805 This parameter is a synonym for root directory.
    5806 .RE
    5807 .PP
     7010\fIguest ok = yes\fR
     7011on any share\.
     7012
     7013Default:
     7014\fI\fIrestrict anonymous\fR\fR\fI = \fR\fI0\fR\fI \fR
     7015.RE
     7016root.PP
     7017.RS 4
     7018This parameter is a synonym for
     7019root directory\.
     7020.RE
     7021root dir.PP
     7022.RS 4
     7023This parameter is a synonym for
     7024root directory\.
     7025.RE
     7026
    58087027root directory (G)
    5809 .RS 3n
     7028.PP
     7029.RS 4
    58107030The server will
    58117031chroot()
    5812 (i.e. Change its root directory) to this directory on startup. This is not strictly necessary for secure operation. Even without it the server will deny access to files not in one of the service entries. It may also check for, and deny access to, soft links to other parts of the filesystem, or attempts to use ".." in file names to access other directories (depending on the setting of the
    5813 wide smbconfoptions parameter).
     7032(i\.e\. Change its root directory) to this directory on startup\. This is not strictly necessary for secure operation\. Even without it the server will deny access to files not in one of the service entries\. It may also check for, and deny access to, soft links to other parts of the filesystem, or attempts to use "\.\." in file names to access other directories (depending on the setting of the
     7033\fIwide smbconfoptions\fR
     7034parameter)\.
    58147035.sp
    58157036Adding a
    58167037\fIroot directory\fR
    5817 entry other than "/" adds an extra level of security, but at a price. It absolutely ensures that no access is given to files not in the sub-tree specified in the
     7038entry other than "/" adds an extra level of security, but at a price\. It absolutely ensures that no access is given to files not in the sub\-tree specified in the
    58187039\fIroot directory\fR
    58197040option,
    5820 \fBincluding\fR
    5821 some files needed for complete operation of the server. To maintain full operability of the server you will need to mirror some system files into the
     7041\fIincluding\fR
     7042some files needed for complete operation of the server\. To maintain full operability of the server you will need to mirror some system files into the
    58227043\fIroot directory\fR
    5823 tree. In particular you will need to mirror
     7044tree\. In particular you will need to mirror
    58247045\fI/etc/passwd\fR
    5825 (or a subset of it), and any binaries or configuration files needed for printing (if required). The set of files that must be mirrored is operating system dependent.
    5826 .sp
    5827 Default:
    5828 \fB\fIroot directory\fR = / \fR
    5829 .sp
    5830 Example:
    5831 \fB\fIroot directory\fR = /homes/smb \fR
    5832 .RE
    5833 .PP
     7046(or a subset of it), and any binaries or configuration files needed for printing (if required)\. The set of files that must be mirrored is operating system dependent\.
     7047.sp
     7048Default:
     7049\fI\fIroot directory\fR\fR\fI = \fR\fI/\fR\fI \fR
     7050.sp
     7051Example:
     7052\fI\fIroot directory\fR\fR\fI = \fR\fI/homes/smb\fR\fI \fR
     7053.RE
     7054
    58347055root postexec (S)
    5835 .RS 3n
     7056.PP
     7057.RS 4
    58367058This is the same as the
    58377059\fIpostexec\fR
    5838 parameter except that the command is run as root. This is useful for unmounting filesystems (such as CDROMs) after a connection is closed.
    5839 .sp
    5840 Default:
    5841 \fB\fIroot postexec\fR = \fR
    5842 .RE
    5843 .PP
     7060parameter except that the command is run as root\. This is useful for unmounting filesystems (such as CDROMs) after a connection is closed\.
     7061.sp
     7062Default:
     7063\fI\fIroot postexec\fR\fR\fI = \fR\fI\fR\fI \fR
     7064.RE
     7065
     7066root preexec close (S)
     7067.PP
     7068.RS 4
     7069This is the same as the
     7070\fIpreexec close \fR
     7071parameter except that the command is run as root\.
     7072.sp
     7073Default:
     7074\fI\fIroot preexec close\fR\fR\fI = \fR\fIno\fR\fI \fR
     7075.RE
     7076
    58447077root preexec (S)
    5845 .RS 3n
     7078.PP
     7079.RS 4
    58467080This is the same as the
    58477081\fIpreexec\fR
    5848 parameter except that the command is run as root. This is useful for mounting filesystems (such as CDROMs) when a connection is opened.
    5849 .sp
    5850 Default:
    5851 \fB\fIroot preexec\fR = \fR
    5852 .RE
    5853 .PP
    5854 root preexec close (S)
    5855 .RS 3n
    5856 This is the same as the
    5857 \fIpreexec close \fR
    5858 parameter except that the command is run as root.
    5859 .sp
    5860 Default:
    5861 \fB\fIroot preexec close\fR = no \fR
    5862 .RE
    5863 .PP
     7082parameter except that the command is run as root\. This is useful for mounting filesystems (such as CDROMs) when a connection is opened\.
     7083.sp
     7084Default:
     7085\fI\fIroot preexec\fR\fR\fI = \fR\fI\fR\fI \fR
     7086.RE
     7087
     7088security mask (S)
     7089.PP
     7090.RS 4
     7091This parameter controls what UNIX permission bits will be set when a Windows NT client is manipulating the UNIX permission on a file using the native NT security dialog box\.
     7092.sp
     7093This parameter is applied as a mask (AND\'ed with) to the incoming permission bits, thus resetting any bits not in this mask\. Make sure not to mix up this parameter with
     7094\fIforce security mode\fR, which works in a manner similar to this one but uses a logical OR instead of an AND\.
     7095.sp
     7096Essentially, all bits set to zero in this mask will result in setting to zero the corresponding bits on the file permissions regardless of the previous status of this bits on the file\.
     7097.sp
     7098If not set explicitly this parameter is 0777, allowing a user to set all the user/group/world permissions on a file\.
     7099.sp
     7100\fI Note\fR
     7101that users who can access the Samba server through other means can easily bypass this restriction, so it is primarily useful for standalone "appliance" systems\. Administrators of most normal systems will probably want to leave it set to
     7102\fB0777\fR\.
     7103.sp
     7104Default:
     7105\fI\fIsecurity mask\fR\fR\fI = \fR\fI0777\fR\fI \fR
     7106.sp
     7107Example:
     7108\fI\fIsecurity mask\fR\fR\fI = \fR\fI0770\fR\fI \fR
     7109.RE
     7110
    58647111security (G)
    5865 .RS 3n
     7112.PP
     7113.RS 4
    58667114This option affects how clients respond to Samba and is one of the most important settings in the
    5867 \fI smb.conf\fR
    5868 file.
     7115\fI smb\.conf\fR
     7116file\.
    58697117.sp
    58707118The option sets the "security mode bit" in replies to protocol negotiations with
    58717119\fBsmbd\fR(8)
    5872 to turn share level security on or off. Clients decide based on this bit whether (and how) to transfer user and password information to the server.
     7120to turn share level security on or off\. Clients decide based on this bit whether (and how) to transfer user and password information to the server\.
    58737121.sp
    58747122The default is
    5875 security = user, as this is the most common setting needed when talking to Windows 98 and Windows NT.
     7123security = user, as this is the most common setting needed when talking to Windows 98 and Windows NT\.
    58767124.sp
    58777125The alternatives are
    … …  
    58797127security = server
    58807128or
    5881 security = domain.
    5882 .sp
    5883 In versions of Samba prior to 2.0.0, the default was
     7129security = domain\.
     7130.sp
     7131In versions of Samba prior to 2\.0\.0, the default was
    58847132security = share
    5885 mainly because that was the only option at one stage.
    5886 .sp
    5887 There is a bug in WfWg that has relevance to this setting. When in user or server level security a WfWg client will totally ignore the username and password you type in the "connect drive" dialog box. This makes it very difficult (if not impossible) to connect to a Samba service as anyone except the user that you are logged into WfWg as.
     7133mainly because that was the only option at one stage\.
     7134.sp
     7135There is a bug in WfWg that has relevance to this setting\. When in user or server level security a WfWg client will totally ignore the username and password you type in the "connect drive" dialog box\. This makes it very difficult (if not impossible) to connect to a Samba service as anyone except the user that you are logged into WfWg as\.
    58887136.sp
    58897137If your PCs use usernames that are the same as their usernames on the UNIX machine then you will want to use
    5890 security = user. If you mostly use usernames that don't exist on the UNIX box then use
    5891 security = share.
     7138security = user\. If you mostly use usernames that don\'t exist on the UNIX box then use
     7139security = share\.
    58927140.sp
    58937141You should also use
    58947142security = share
    5895 if you want to mainly setup shares without a password (guest shares). This is commonly used for a shared printer server. It is more difficult to setup guest shares with
     7143if you want to mainly setup shares without a password (guest shares)\. This is commonly used for a shared printer server\. It is more difficult to setup guest shares with
    58967144security = user, see the
    5897 map to guestparameter for details.
     7145\fImap to guest\fRparameter for details\.
    58987146.sp
    58997147It is possible to use
    59007148smbd
    59017149in a
    5902 \fB hybrid mode\fR
     7150\fI hybrid mode\fR
    59037151where it is offers both user and share level security under different
    5904 NetBIOS aliases.
    5905 .sp
    5906 The different settings will now be explained.
    5907 .sp
    5908 \fBSECURITY = SHARE\fR
     7152\fINetBIOS aliases\fR\.
     7153.sp
     7154The different settings will now be explained\.
     7155.sp
     7156\fISECURITY = SHARE\fR
    59097157.sp
    59107158When clients connect to a share level security server they need not log onto the server with a valid username and password before attempting to connect to a shared resource (although modern clients such as Windows 95/98 and Windows NT will send a logon request with a username but no password when talking to a
    59117159security = share
    5912 server). Instead, the clients send authentication information (passwords) on a per-share basis, at the time they attempt to connect to that share.
     7160server)\. Instead, the clients send authentication information (passwords) on a per\-share basis, at the time they attempt to connect to that share\.
    59137161.sp
    59147162Note that
    59157163smbd
    5916 \fBALWAYS\fR
     7164\fIALWAYS\fR
    59177165uses a valid UNIX user to act on behalf of the client, even in
    59187166security = share
    5919 level security.
     7167level security\.
    59207168.sp
    59217169As clients are not required to send a username to the server in share level security,
    59227170smbd
    5923 uses several techniques to determine the correct UNIX user to use on behalf of the client.
     7171uses several techniques to determine the correct UNIX user to use on behalf of the client\.
    59247172.sp
    59257173A list of possible UNIX usernames to match with the given client password is constructed using the following methods :
    5926 .RS 3n
    5927 .TP 3n
    5928 \(bu
    5929 If the
    5930 guest only parameter is set, then all the other stages are missed and only the
    5931 guest account username is checked.
    5932 .TP 3n
    5933 \(bu
    5934 Is a username is sent with the share connection request, then this username (after mapping - see
    5935 username map), is added as a potential username.
    5936 .TP 3n
    5937 \(bu
    5938 If the client did a previous
    5939 \fBlogon \fR
    5940 request (the SessionSetup SMB call) then the username sent in this SMB will be added as a potential username.
    5941 .TP 3n
    5942 \(bu
    5943 The name of the service the client requested is added as a potential username.
    5944 .TP 3n
    5945 \(bu
    5946 The NetBIOS name of the client is added to the list as a potential username.
    5947 .TP 3n
    5948 \(bu
    5949 Any users on the
    5950 user list are added as potential usernames.
    5951 .RE
    5952 .IP "" 3n
     7174.sp
     7175.RS 4
     7176.ie n \{\
     7177\h'-04'\(bu\h'+03'\c
     7178.\}
     7179.el \{\
     7180.sp -1
     7181.IP \(bu 2.3
     7182.\}
    59537183If the
    59547184\fIguest only\fR
    5955 parameter is not set, then this list is then tried with the supplied password. The first user for whom the password matches will be used as the UNIX user.
     7185parameter is set, then all the other stages are missed and only the
     7186\fIguest account\fR
     7187username is checked\.
     7188.RE
     7189.sp
     7190.RS 4
     7191.ie n \{\
     7192\h'-04'\(bu\h'+03'\c
     7193.\}
     7194.el \{\
     7195.sp -1
     7196.IP \(bu 2.3
     7197.\}
     7198Is a username is sent with the share connection request, then this username (after mapping \- see
     7199\fIusername map\fR), is added as a potential username\.
     7200.RE
     7201.sp
     7202.RS 4
     7203.ie n \{\
     7204\h'-04'\(bu\h'+03'\c
     7205.\}
     7206.el \{\
     7207.sp -1
     7208.IP \(bu 2.3
     7209.\}
     7210If the client did a previous
     7211\fIlogon \fR
     7212request (the SessionSetup SMB call) then the username sent in this SMB will be added as a potential username\.
     7213.RE
     7214.sp
     7215.RS 4
     7216.ie n \{\
     7217\h'-04'\(bu\h'+03'\c
     7218.\}
     7219.el \{\
     7220.sp -1
     7221.IP \(bu 2.3
     7222.\}
     7223The name of the service the client requested is added as a potential username\.
     7224.RE
     7225.sp
     7226.RS 4
     7227.ie n \{\
     7228\h'-04'\(bu\h'+03'\c
     7229.\}
     7230.el \{\
     7231.sp -1
     7232.IP \(bu 2.3
     7233.\}
     7234The NetBIOS name of the client is added to the list as a potential username\.
     7235.RE
     7236.sp
     7237.RS 4
     7238.ie n \{\
     7239\h'-04'\(bu\h'+03'\c
     7240.\}
     7241.el \{\
     7242.sp -1
     7243.IP \(bu 2.3
     7244.\}
     7245Any users on the
     7246\fIuser\fR
     7247list are added as potential usernames\.
     7248.sp
     7249.RE
     7250If the
     7251\fIguest only\fR
     7252parameter is not set, then this list is then tried with the supplied password\. The first user for whom the password matches will be used as the UNIX user\.
    59567253.sp
    59577254If the
    59587255\fIguest only\fR
    59597256parameter is set, or no username can be determined then if the share is marked as available to the
    5960 \fIguest account\fR, then this guest user will be used, otherwise access is denied.
     7257\fIguest account\fR, then this guest user will be used, otherwise access is denied\.
    59617258.sp
    59627259Note that it can be
    5963 \fBvery\fR
    5964 confusing in share-level security as to which UNIX username will eventually be used in granting access.
     7260\fIvery\fR
     7261confusing in share\-level security as to which UNIX username will eventually be used in granting access\.
    59657262.sp
    59667263See also the section
    5967 NOTE ABOUT USERNAME/PASSWORD VALIDATION.
    5968 .sp
    5969 \fBSECURITY = USER\fR
    5970 .sp
    5971 This is the default security setting in Samba 3.0. With user-level security a client must first "log-on" with a valid username and password (which can be mapped using the
    5972 username map parameter). Encrypted passwords (see the
    5973 encrypted passwords parameter) can also be used in this security mode. Parameters such as
    5974 user and
    5975 guest only if set are then applied and may change the UNIX user to use on this connection, but only after the user has been successfully authenticated.
    5976 .sp
    5977 \fBNote\fR
     7264NOTE ABOUT USERNAME/PASSWORD VALIDATION\.
     7265.sp
     7266\fISECURITY = USER\fR
     7267.sp
     7268This is the default security setting in Samba 3\.0\. With user\-level security a client must first "log\-on" with a valid username and password (which can be mapped using the
     7269\fIusername map\fR
     7270parameter)\. Encrypted passwords (see the
     7271\fIencrypted passwords\fR
     7272parameter) can also be used in this security mode\. Parameters such as
     7273\fIuser\fR
     7274and
     7275\fIguest only\fR
     7276if set are then applied and may change the UNIX user to use on this connection, but only after the user has been successfully authenticated\.
     7277.sp
     7278\fINote\fR
    59787279that the name of the resource being requested is
    5979 \fBnot\fR
    5980 sent to the server until after the server has successfully authenticated the client. This is why guest shares don't work in user level security without allowing the server to automatically map unknown users into the
    5981 guest account. See the
    5982 map to guest parameter for details on doing this.
     7280\fInot\fR
     7281sent to the server until after the server has successfully authenticated the client\. This is why guest shares don\'t work in user level security without allowing the server to automatically map unknown users into the
     7282\fIguest account\fR\. See the
     7283\fImap to guest\fR
     7284parameter for details on doing this\.
    59837285.sp
    59847286See also the section
    5985 NOTE ABOUT USERNAME/PASSWORD VALIDATION.
    5986 .sp
    5987 \fBSECURITY = DOMAIN\fR
     7287NOTE ABOUT USERNAME/PASSWORD VALIDATION\.
     7288.sp
     7289\fISECURITY = DOMAIN\fR
    59887290.sp
    59897291This mode will only work correctly if
    59907292\fBnet\fR(8)
    5991 has been used to add this machine into a Windows NT Domain. It expects the
    5992 encrypted passwords parameter to be set to
    5993 \fByes\fR. In this mode Samba will try to validate the username/password by passing it to a Windows NT Primary or Backup Domain Controller, in exactly the same way that a Windows NT Server would do.
    5994 .sp
    5995 \fBNote\fR
    5996 that a valid UNIX user must still exist as well as the account on the Domain Controller to allow Samba to have a valid UNIX account to map file access to.
    5997 .sp
    5998 \fBNote\fR
    5999 that from the client's point of view
     7293has been used to add this machine into a Windows NT Domain\. It expects the
     7294\fIencrypted passwords\fR
     7295parameter to be set to
     7296\fByes\fR\. In this mode Samba will try to validate the username/password by passing it to a Windows NT Primary or Backup Domain Controller, in exactly the same way that a Windows NT Server would do\.
     7297.sp
     7298\fINote\fR
     7299that a valid UNIX user must still exist as well as the account on the Domain Controller to allow Samba to have a valid UNIX account to map file access to\.
     7300.sp
     7301\fINote\fR
     7302that from the client\'s point of view
    60007303security = domain
    60017304is the same as
    6002 security = user. It only affects how the server deals with the authentication, it does not in any way affect what the client sees.
    6003 .sp
    6004 \fBNote\fR
     7305security = user\. It only affects how the server deals with the authentication, it does not in any way affect what the client sees\.
     7306.sp
     7307\fINote\fR
    60057308that the name of the resource being requested is
    6006 \fBnot\fR
    6007 sent to the server until after the server has successfully authenticated the client. This is why guest shares don't work in user level security without allowing the server to automatically map unknown users into the
    6008 guest account. See the
    6009 map to guest parameter for details on doing this.
     7309\fInot\fR
     7310sent to the server until after the server has successfully authenticated the client\. This is why guest shares don\'t work in user level security without allowing the server to automatically map unknown users into the
     7311\fIguest account\fR\. See the
     7312\fImap to guest\fR
     7313parameter for details on doing this\.
    60107314.sp
    60117315See also the section
    6012 NOTE ABOUT USERNAME/PASSWORD VALIDATION.
     7316NOTE ABOUT USERNAME/PASSWORD VALIDATION\.
    60137317.sp
    60147318See also the
    6015 password server parameter and the
    6016 encrypted passwords parameter.
    6017 .sp
    6018 \fBSECURITY = SERVER\fR
    6019 .sp
    6020 In this mode Samba will try to validate the username/password by passing it to another SMB server, such as an NT box. If this fails it will revert to
    6021 security = user. It expects the
    6022 encrypted passwords parameter to be set to
    6023 \fByes\fR, unless the remote server does not support them. However note that if encrypted passwords have been negotiated then Samba cannot revert back to checking the UNIX password file, it must have a valid
     7319\fIpassword server\fR
     7320parameter and the
     7321\fIencrypted passwords\fR
     7322parameter\.
     7323.sp
     7324\fISECURITY = SERVER\fR
     7325.sp
     7326In this mode Samba will try to validate the username/password by passing it to another SMB server, such as an NT box\. If this fails it will revert to
     7327security = user\. It expects the
     7328\fIencrypted passwords\fR
     7329parameter to be set to
     7330\fByes\fR, unless the remote server does not support them\. However note that if encrypted passwords have been negotiated then Samba cannot revert back to checking the UNIX password file, it must have a valid
    60247331\fIsmbpasswd\fR
    6025 file to check users against. See the chapter about the User Database in the Samba HOWTO Collection for details on how to set this up.
     7332file to check users against\. See the chapter about the User Database in the Samba HOWTO Collection for details on how to set this up\.
    60267333.sp
    60277334.it 1 an-trap
    … …  
    60297336.nr an-break-flag 1
    60307337.br
    6031 \fBNote\fR
    6032 This mode of operation has significant pitfalls since it is more vulnerable to man-in-the-middle attacks and server impersonation. In particular, this mode of operation can cause significant resource consuption on the PDC, as it must maintain an active connection for the duration of the user's session. Furthermore, if this connection is lost, there is no way to reestablish it, and futher authentications to the Samba server may fail (from a single client, till it disconnects).
     7338Note
     7339This mode of operation has significant pitfalls since it is more vulnerable to man\-in\-the\-middle attacks and server impersonation\. In particular, this mode of operation can cause significant resource consuption on the PDC, as it must maintain an active connection for the duration of the user\'s session\. Furthermore, if this connection is lost, there is no way to reestablish it, and futher authentications to the Samba server may fail (from a single client, till it disconnects)\.
    60337340.sp
    60347341.it 1 an-trap
    … …  
    60367343.nr an-break-flag 1
    60377344.br
    6038 \fBNote\fR
    6039 From the client's point of view
     7345Note
     7346From the client\'s point of view
    60407347security = server
    60417348is the same as
    6042 security = user. It only affects how the server deals with the authentication, it does not in any way affect what the client sees.
    6043 \fBNote\fR
     7349security = user\. It only affects how the server deals with the authentication, it does not in any way affect what the client sees\.
     7350
     7351\fINote\fR
    60447352that the name of the resource being requested is
    6045 \fBnot\fR
    6046 sent to the server until after the server has successfully authenticated the client. This is why guest shares don't work in user level security without allowing the server to automatically map unknown users into the
    6047 guest account. See the
    6048 map to guest parameter for details on doing this.
     7353\fInot\fR
     7354sent to the server until after the server has successfully authenticated the client\. This is why guest shares don\'t work in user level security without allowing the server to automatically map unknown users into the
     7355\fIguest account\fR\. See the
     7356\fImap to guest\fR
     7357parameter for details on doing this\.
    60497358.sp
    60507359See also the section
    6051 NOTE ABOUT USERNAME/PASSWORD VALIDATION.
     7360NOTE ABOUT USERNAME/PASSWORD VALIDATION\.
    60527361.sp
    60537362See also the
    6054 password server parameter and the
    6055 encrypted passwords parameter.
    6056 .sp
    6057 \fBSECURITY = ADS\fR
    6058 .sp
    6059 In this mode, Samba will act as a domain member in an ADS realm. To operate in this mode, the machine running Samba will need to have Kerberos installed and configured and Samba will need to be joined to the ADS realm using the net utility.
    6060 .sp
    6061 Note that this mode does NOT make Samba operate as a Active Directory Domain Controller.
    6062 .sp
    6063 Read the chapter about Domain Membership in the HOWTO for details.
    6064 .sp
    6065 Default:
    6066 \fB\fIsecurity\fR = USER \fR
    6067 .sp
    6068 Example:
    6069 \fB\fIsecurity\fR = DOMAIN \fR
    6070 .RE
    6071 .PP
    6072 security mask (S)
    6073 .RS 3n
    6074 This parameter controls what UNIX permission bits can be modified when a Windows NT client is manipulating the UNIX permission on a file using the native NT security dialog box.
    6075 .sp
    6076 This parameter is applied as a mask (AND'ed with) to the changed permission bits, thus preventing any bits not in this mask from being modified. Make sure not to mix up this parameter with
    6077 force security mode, which works in a manner similar to this one but uses a logical OR instead of an AND.
    6078 .sp
    6079 Essentially, zero bits in this mask may be treated as a set of bits the user is not allowed to change.
    6080 .sp
    6081 If not set explicitly this parameter is 0777, allowing a user to modify all the user/group/world permissions on a file.
    6082 .sp
    6083 \fB Note\fR
    6084 that users who can access the Samba server through other means can easily bypass this restriction, so it is primarily useful for standalone "appliance" systems. Administrators of most normal systems will probably want to leave it set to
    6085 \fB0777\fR.
    6086 .sp
    6087 Default:
    6088 \fB\fIsecurity mask\fR = 0777 \fR
    6089 .sp
    6090 Example:
    6091 \fB\fIsecurity mask\fR = 0770 \fR
    6092 .RE
    6093 .PP
     7363\fIpassword server\fR
     7364parameter and the
     7365\fIencrypted passwords\fR
     7366parameter\.
     7367.sp
     7368\fISECURITY = ADS\fR
     7369.sp
     7370In this mode, Samba will act as a domain member in an ADS realm\. To operate in this mode, the machine running Samba will need to have Kerberos installed and configured and Samba will need to be joined to the ADS realm using the net utility\.
     7371.sp
     7372Note that this mode does NOT make Samba operate as a Active Directory Domain Controller\.
     7373.sp
     7374Read the chapter about Domain Membership in the HOWTO for details\.
     7375.sp
     7376Default:
     7377\fI\fIsecurity\fR\fR\fI = \fR\fIUSER\fR\fI \fR
     7378.sp
     7379Example:
     7380\fI\fIsecurity\fR\fR\fI = \fR\fIDOMAIN\fR\fI \fR
     7381.RE
     7382
    60947383server schannel (G)
    6095 .RS 3n
    6096 This controls whether the server offers or even demands the use of the netlogon schannel.
    6097 server schannel = no does not offer the schannel,
    6098 server schannel = auto offers the schannel but does not enforce it, and
    6099 server schannel = yes denies access if the client is not able to speak netlogon schannel. This is only the case for Windows NT4 before SP4.
     7384.PP
     7385.RS 4
     7386This controls whether the server offers or even demands the use of the netlogon schannel\.
     7387\fIserver schannel = no\fR
     7388does not offer the schannel,
     7389\fIserver schannel = auto\fR
     7390offers the schannel but does not enforce it, and
     7391\fIserver schannel = yes\fR
     7392denies access if the client is not able to speak netlogon schannel\. This is only the case for Windows NT4 before SP4\.
    61007393.sp
    61017394Please note that with this set to
    61027395no
    61037396you will have to apply the WindowsXP
    6104 \fIWinXP_SignOrSeal.reg\fR
    6105 registry patch found in the docs/registry subdirectory of the Samba distribution tarball.
    6106 .sp
    6107 Default:
    6108 \fB\fIserver schannel\fR = auto \fR
    6109 .sp
    6110 Example:
    6111 \fB\fIserver schannel\fR = yes \fR
    6112 .RE
    6113 .PP
     7397\fIWinXP_SignOrSeal\.reg\fR
     7398registry patch found in the docs/registry subdirectory of the Samba distribution tarball\.
     7399.sp
     7400Default:
     7401\fI\fIserver schannel\fR\fR\fI = \fR\fIauto\fR\fI \fR
     7402.sp
     7403Example:
     7404\fI\fIserver schannel\fR\fR\fI = \fR\fIyes\fR\fI \fR
     7405.RE
     7406
    61147407server signing (G)
    6115 .RS 3n
    6116 This controls whether the server offers or requires the client it talks to to use SMB signing. Possible values are
    6117 \fBauto\fR,
    6118 \fBmandatory\fR
     7408.PP
     7409.RS 4
     7410This controls whether the server offers or requires the client it talks to to use SMB signing\. Possible values are
     7411\fIauto\fR,
     7412\fImandatory\fR
    61197413and
    6120 \fBdisabled\fR.
    6121 .sp
    6122 When set to auto, SMB signing is offered, but not enforced. When set to mandatory, SMB signing is required and if set to disabled, SMB signing is not offered either.
    6123 .sp
    6124 Default:
    6125 \fB\fIserver signing\fR = Disabled \fR
    6126 .RE
    6127 .PP
     7414\fIdisabled\fR\.
     7415.sp
     7416When set to auto, SMB signing is offered, but not enforced\. When set to mandatory, SMB signing is required and if set to disabled, SMB signing is not offered either\.
     7417.sp
     7418Default:
     7419\fI\fIserver signing\fR\fR\fI = \fR\fIDisabled\fR\fI \fR
     7420.RE
     7421
    61287422server string (G)
    6129 .RS 3n
     7423.PP
     7424.RS 4
    61307425This controls what string will show up in the printer comment box in print manager and next to the IPC connection in
    6131 net view. It can be any string that you wish to show to your users.
    6132 .sp
    6133 It also sets what will appear in browse lists next to the machine name.
     7426net view\. It can be any string that you wish to show to your users\.
     7427.sp
     7428It also sets what will appear in browse lists next to the machine name\.
    61347429.sp
    61357430A
    61367431\fI%v\fR
    6137 will be replaced with the Samba version number.
     7432will be replaced with the Samba version number\.
    61387433.sp
    61397434A
    61407435\fI%h\fR
    6141 will be replaced with the hostname.
    6142 .sp
    6143 Default:
    6144 \fB\fIserver string\fR = Samba %v \fR
    6145 .sp
    6146 Example:
    6147 \fB\fIserver string\fR = University of GNUs Samba Server \fR
    6148 .RE
    6149 .PP
     7436will be replaced with the hostname\.
     7437.sp
     7438Default:
     7439\fI\fIserver string\fR\fR\fI = \fR\fISamba %v\fR\fI \fR
     7440.sp
     7441Example:
     7442\fI\fIserver string\fR\fR\fI = \fR\fIUniversity of GNUs Samba Server\fR\fI \fR
     7443.RE
     7444
    61507445set directory (S)
    6151 .RS 3n
     7446.PP
     7447.RS 4
    61527448If
    6153 set directory = no, then users of the service may not use the setdir command to change directory.
     7449set directory = no, then users of the service may not use the setdir command to change directory\.
    61547450.sp
    61557451The
    61567452setdir
    6157 command is only implemented in the Digital Pathworks client. See the Pathworks documentation for details.
    6158 .sp
    6159 Default:
    6160 \fB\fIset directory\fR = no \fR
    6161 .RE
    6162 .PP
     7453command is only implemented in the Digital Pathworks client\. See the Pathworks documentation for details\.
     7454.sp
     7455Default:
     7456\fI\fIset directory\fR\fR\fI = \fR\fIno\fR\fI \fR
     7457.RE
     7458
    61637459set primary group script (G)
    6164 .RS 3n
    6165 Thanks to the Posix subsystem in NT a Windows User has a primary group in addition to the auxiliary groups. This script sets the primary group in the unix userdatase when an administrator sets the primary group from the windows user manager or when fetching a SAM with
    6166 net rpc vampire.
     7460.PP
     7461.RS 4
     7462Thanks to the Posix subsystem in NT a Windows User has a primary group in addition to the auxiliary groups\. This script sets the primary group in the unix userdatase when an administrator sets the primary group from the windows user manager or when fetching a SAM with
     7463net rpc vampire\.
    61677464\fI%u\fR
    6168 will be replaced with the user whose primary group is to be set.
     7465will be replaced with the user whose primary group is to be set\.
    61697466\fI%g\fR
    6170 will be replaced with the group to set.
    6171 .sp
    6172 Default:
    6173 \fB\fIset primary group script\fR = \fR
    6174 .sp
    6175 Example:
    6176 \fB\fIset primary group script\fR = /usr/sbin/usermod -g '%g' '%u' \fR
    6177 .RE
    6178 .PP
     7467will be replaced with the group to set\.
     7468.sp
     7469Default:
     7470\fI\fIset primary group script\fR\fR\fI = \fR\fI\fR\fI \fR
     7471.sp
     7472Example:
     7473\fI\fIset primary group script\fR\fR\fI = \fR\fI/usr/sbin/usermod \-g \'%g\' \'%u\'\fR\fI \fR
     7474.RE
     7475
    61797476set quota command (G)
    6180 .RS 3n
     7477.PP
     7478.RS 4
    61817479The
    61827480set quota command
    6183 should only be used whenever there is no operating system API available from the OS that samba can use.
     7481should only be used whenever there is no operating system API available from the OS that samba can use\.
    61847482.sp
    61857483This option is only available if Samba was configured with the argument
    6186 --with-sys-quotas
     7484\-\-with\-sys\-quotas
    61877485or on linux when
    6188 ./configure --with-quotas
    6189 was used and a working quota api was found in the system. Most packages are configured with these options already.
    6190 .sp
    6191 This parameter should specify the path to a script that can set quota for the specified arguments.
     7486\./configure \-\-with\-quotas
     7487was used and a working quota api was found in the system\. Most packages are configured with these options already\.
     7488.sp
     7489This parameter should specify the path to a script that can set quota for the specified arguments\.
    61927490.sp
    61937491The specified script should take the following arguments:
    6194 .RS 3n
    6195 .TP 3n
    6196 \(bu
    6197 1 - quota type
    6198 .RS 3n
    6199 .TP 3n
    6200 \(bu
    6201 1 - user quotas
    6202 .TP 3n
    6203 \(bu
    6204 2 - user default quotas (uid = -1)
    6205 .TP 3n
    6206 \(bu
    6207 3 - group quotas
    6208 .TP 3n
    6209 \(bu
    6210 4 - group default quotas (gid = -1)
    6211 .RE
    6212 .IP "" 3n
    6213 
    6214 .TP 3n
    6215 \(bu
    6216 2 - id (uid for user, gid for group, -1 if N/A)
    6217 .TP 3n
    6218 \(bu
    6219 3 - quota state (0 = disable, 1 = enable, 2 = enable and enforce)
    6220 .TP 3n
    6221 \(bu
    6222 4 - block softlimit
    6223 .TP 3n
    6224 \(bu
    6225 5 - block hardlimit
    6226 .TP 3n
    6227 \(bu
    6228 6 - inode softlimit
    6229 .TP 3n
    6230 \(bu
    6231 7 - inode hardlimit
    6232 .TP 3n
    6233 \(bu
    6234 8(optional) - block size, defaults to 1024
    6235 .RE
    6236 .IP "" 3n
    6237 The script should output at least one line of data on success. And nothing on failure.
    6238 .sp
    6239 Default:
    6240 \fB\fIset quota command\fR = \fR
    6241 .sp
    6242 Example:
    6243 \fB\fIset quota command\fR = /usr/local/sbin/set_quota \fR
    6244 .RE
    6245 .PP
     7492.sp
     7493.RS 4
     7494.ie n \{\
     7495\h'-04'\(bu\h'+03'\c
     7496.\}
     7497.el \{\
     7498.sp -1
     7499.IP \(bu 2.3
     7500.\}
     75011 \- quota type
     7502.sp
     7503.RS 4
     7504.ie n \{\
     7505\h'-04'\(bu\h'+03'\c
     7506.\}
     7507.el \{\
     7508.sp -1
     7509.IP \(bu 2.3
     7510.\}
     75111 \- user quotas
     7512.RE
     7513.sp
     7514.RS 4
     7515.ie n \{\
     7516\h'-04'\(bu\h'+03'\c
     7517.\}
     7518.el \{\
     7519.sp -1
     7520.IP \(bu 2.3
     7521.\}
     75222 \- user default quotas (uid = \-1)
     7523.RE
     7524.sp
     7525.RS 4
     7526.ie n \{\
     7527\h'-04'\(bu\h'+03'\c
     7528.\}
     7529.el \{\
     7530.sp -1
     7531.IP \(bu 2.3
     7532.\}
     75333 \- group quotas
     7534.RE
     7535.sp
     7536.RS 4
     7537.ie n \{\
     7538\h'-04'\(bu\h'+03'\c
     7539.\}
     7540.el \{\
     7541.sp -1
     7542.IP \(bu 2.3
     7543.\}
     75444 \- group default quotas (gid = \-1)
     7545.sp
     7546.RE
     7547.RE
     7548.sp
     7549.RS 4
     7550.ie n \{\
     7551\h'-04'\(bu\h'+03'\c
     7552.\}
     7553.el \{\
     7554.sp -1
     7555.IP \(bu 2.3
     7556.\}
     75572 \- id (uid for user, gid for group, \-1 if N/A)
     7558.RE
     7559.sp
     7560.RS 4
     7561.ie n \{\
     7562\h'-04'\(bu\h'+03'\c
     7563.\}
     7564.el \{\
     7565.sp -1
     7566.IP \(bu 2.3
     7567.\}
     75683 \- quota state (0 = disable, 1 = enable, 2 = enable and enforce)
     7569.RE
     7570.sp
     7571.RS 4
     7572.ie n \{\
     7573\h'-04'\(bu\h'+03'\c
     7574.\}
     7575.el \{\
     7576.sp -1
     7577.IP \(bu 2.3
     7578.\}
     75794 \- block softlimit
     7580.RE
     7581.sp
     7582.RS 4
     7583.ie n \{\
     7584\h'-04'\(bu\h'+03'\c
     7585.\}
     7586.el \{\
     7587.sp -1
     7588.IP \(bu 2.3
     7589.\}
     75905 \- block hardlimit
     7591.RE
     7592.sp
     7593.RS 4
     7594.ie n \{\
     7595\h'-04'\(bu\h'+03'\c
     7596.\}
     7597.el \{\
     7598.sp -1
     7599.IP \(bu 2.3
     7600.\}
     76016 \- inode softlimit
     7602.RE
     7603.sp
     7604.RS 4
     7605.ie n \{\
     7606\h'-04'\(bu\h'+03'\c
     7607.\}
     7608.el \{\
     7609.sp -1
     7610.IP \(bu 2.3
     7611.\}
     76127 \- inode hardlimit
     7613.RE
     7614.sp
     7615.RS 4
     7616.ie n \{\
     7617\h'-04'\(bu\h'+03'\c
     7618.\}
     7619.el \{\
     7620.sp -1
     7621.IP \(bu 2.3
     7622.\}
     76238(optional) \- block size, defaults to 1024
     7624.sp
     7625.RE
     7626The script should output at least one line of data on success\. And nothing on failure\.
     7627.sp
     7628Default:
     7629\fI\fIset quota command\fR\fR\fI = \fR\fI\fR\fI \fR
     7630.sp
     7631Example:
     7632\fI\fIset quota command\fR\fR\fI = \fR\fI/usr/local/sbin/set_quota\fR\fI \fR
     7633.RE
     7634
    62467635share modes (S)
    6247 .RS 3n
     7636.PP
     7637.RS 4
    62487638This enables or disables the honoring of the
    62497639\fIshare modes\fR
    6250 during a file open. These modes are used by clients to gain exclusive read or write access to a file.
    6251 .sp
    6252 These open modes are not directly supported by UNIX, so they are simulated using shared memory, or lock files if your UNIX doesn't support shared memory (almost all do).
     7640during a file open\. These modes are used by clients to gain exclusive read or write access to a file\.
     7641.sp
     7642These open modes are not directly supported by UNIX, so they are simulated using shared memory, or lock files if your UNIX doesn\'t support shared memory (almost all do)\.
    62537643.sp
    62547644The share modes that are enabled by this option are
    … …  
    62597649\fBDENY_NONE\fR
    62607650and
    6261 \fBDENY_FCB\fR.
    6262 .sp
    6263 This option gives full share compatibility and enabled by default.
     7651\fBDENY_FCB\fR\.
     7652.sp
     7653This option gives full share compatibility and enabled by default\.
    62647654.sp
    62657655You should
    6266 \fBNEVER\fR
    6267 turn this parameter off as many Windows applications will break if you do so.
    6268 .sp
    6269 Default:
    6270 \fB\fIshare modes\fR = yes \fR
    6271 .RE
    6272 .PP
     7656\fINEVER\fR
     7657turn this parameter off as many Windows applications will break if you do so\.
     7658.sp
     7659Default:
     7660\fI\fIshare modes\fR\fR\fI = \fR\fIyes\fR\fI \fR
     7661.RE
     7662
    62737663short preserve case (S)
    6274 .RS 3n
    6275 This boolean parameter controls if new files which conform to 8.3 syntax, that is all in upper case and of suitable length, are created upper case, or if they are forced to be the
    6276 default case. This option can be use with
    6277 preserve case = yes to permit long filenames to retain their case, while short names are lowered.
     7664.PP
     7665.RS 4
     7666This boolean parameter controls if new files which conform to 8\.3 syntax, that is all in upper case and of suitable length, are created upper case, or if they are forced to be the
     7667\fIdefault case\fR\. This option can be use with
     7668\fIpreserve case = yes\fR
     7669to permit long filenames to retain their case, while short names are lowered\.
    62787670.sp
    62797671See the section on
    6280 NAME MANGLING.
    6281 .sp
    6282 Default:
    6283 \fB\fIshort preserve case\fR = yes \fR
    6284 .RE
    6285 .PP
     7672NAME MANGLING\.
     7673.sp
     7674Default:
     7675\fI\fIshort preserve case\fR\fR\fI = \fR\fIyes\fR\fI \fR
     7676.RE
     7677
    62867678show add printer wizard (G)
    6287 .RS 3n
    6288 With the introduction of MS-RPC based printing support for Windows NT/2000 client in Samba 2.2, a "Printers..." folder will appear on Samba hosts in the share listing. Normally this folder will contain an icon for the MS Add Printer Wizard (APW). However, it is possible to disable this feature regardless of the level of privilege of the connected user.
    6289 .sp
    6290 Under normal circumstances, the Windows NT/2000 client will open a handle on the printer server with OpenPrinterEx() asking for Administrator privileges. If the user does not have administrative access on the print server (i.e is not root or a member of the
     7679.PP
     7680.RS 4
     7681With the introduction of MS\-RPC based printing support for Windows NT/2000 client in Samba 2\.2, a "Printers\.\.\." folder will appear on Samba hosts in the share listing\. Normally this folder will contain an icon for the MS Add Printer Wizard (APW)\. However, it is possible to disable this feature regardless of the level of privilege of the connected user\.
     7682.sp
     7683Under normal circumstances, the Windows NT/2000 client will open a handle on the printer server with OpenPrinterEx() asking for Administrator privileges\. If the user does not have administrative access on the print server (i\.e is not root or a member of the
    62917684\fIprinter admin\fR
    6292 group), the OpenPrinterEx() call fails and the client makes another open call with a request for a lower privilege level. This should succeed, however the APW icon will not be displayed.
     7685group), the OpenPrinterEx() call fails and the client makes another open call with a request for a lower privilege level\. This should succeed, however the APW icon will not be displayed\.
    62937686.sp
    62947687Disabling the
    62957688\fIshow add printer wizard\fR
    6296 parameter will always cause the OpenPrinterEx() on the server to fail. Thus the APW icon will never be displayed.
     7689parameter will always cause the OpenPrinterEx() on the server to fail\. Thus the APW icon will never be displayed\.
    62977690.sp
    62987691.it 1 an-trap
    … …  
    63007693.nr an-break-flag 1
    63017694.br
    6302 \fBNote\fR
    6303 This does not prevent the same user from having administrative privilege on an individual printer.
    6304 Default:
    6305 \fB\fIshow add printer wizard\fR = yes \fR
    6306 .RE
    6307 .PP
     7695Note
     7696This does not prevent the same user from having administrative privilege on an individual printer\.
     7697
     7698Default:
     7699\fI\fIshow add printer wizard\fR\fR\fI = \fR\fIyes\fR\fI \fR
     7700.RE
     7701
    63087702shutdown script (G)
    6309 .RS 3n
     7703.PP
     7704.RS 4
    63107705This a full path name to a script called by
    63117706\fBsmbd\fR(8)
    6312 that should start a shutdown procedure.
     7707that should start a shutdown procedure\.
    63137708.sp
    63147709If the connected user posseses the
    6315 \fBSeRemoteShutdownPrivilege\fR, right, this command will be run as user.
     7710\fBSeRemoteShutdownPrivilege\fR, right, this command will be run as user\.
    63167711.sp
    63177712The %z %t %r %f variables are expanded as follows:
    6318 .RS 3n
    6319 .TP 3n
    6320 \(bu
     7713.sp
     7714.RS 4
     7715.ie n \{\
     7716\h'-04'\(bu\h'+03'\c
     7717.\}
     7718.el \{\
     7719.sp -1
     7720.IP \(bu 2.3
     7721.\}
    63217722\fI%z\fR
    6322 will be substituted with the shutdown message sent to the server.
    6323 .TP 3n
    6324 \(bu
     7723will be substituted with the shutdown message sent to the server\.
     7724.RE
     7725.sp
     7726.RS 4
     7727.ie n \{\
     7728\h'-04'\(bu\h'+03'\c
     7729.\}
     7730.el \{\
     7731.sp -1
     7732.IP \(bu 2.3
     7733.\}
    63257734\fI%t\fR
    6326 will be substituted with the number of seconds to wait before effectively starting the shutdown procedure.
    6327 .TP 3n
    6328 \(bu
     7735will be substituted with the number of seconds to wait before effectively starting the shutdown procedure\.
     7736.RE
     7737.sp
     7738.RS 4
     7739.ie n \{\
     7740\h'-04'\(bu\h'+03'\c
     7741.\}
     7742.el \{\
     7743.sp -1
     7744.IP \(bu 2.3
     7745.\}
    63297746\fI%r\fR
    63307747will be substituted with the switch
    6331 \fB-r\fR. It means reboot after shutdown for NT.
    6332 .TP 3n
    6333 \(bu
     7748\fI\-r\fR\. It means reboot after shutdown for NT\.
     7749.RE
     7750.sp
     7751.RS 4
     7752.ie n \{\
     7753\h'-04'\(bu\h'+03'\c
     7754.\}
     7755.el \{\
     7756.sp -1
     7757.IP \(bu 2.3
     7758.\}
    63347759\fI%f\fR
    63357760will be substituted with the switch
    6336 \fB-f\fR. It means force the shutdown even if applications do not respond for NT.
    6337 .RE
    6338 .IP "" 3n
     7761\fI\-f\fR\. It means force the shutdown even if applications do not respond for NT\.
     7762.sp
     7763.RE
    63397764Shutdown script example:
    6340 
    6341 .sp
    6342 
     7765.sp
     7766.RS 4
    63437767.nf
    6344 
    63457768#!/bin/bash
    63467769               
    … …  
    63507773
    63517774/sbin/shutdown $3 $4 +$time $1 &
    6352 
    63537775.fi
    6354 Shutdown does not return so we need to launch it in background.
    6355 .sp
    6356 Default:
    6357 \fB\fIshutdown script\fR = \fR
    6358 .sp
    6359 Example:
    6360 \fB\fIshutdown script\fR = /usr/local/samba/sbin/shutdown %m %t %r %f \fR
    6361 .RE
    6362 .PP
     7776.RE
     7777.sp
     7778Shutdown does not return so we need to launch it in background\.
     7779.sp
     7780Default:
     7781\fI\fIshutdown script\fR\fR\fI = \fR\fI\fR\fI \fR
     7782.sp
     7783Example:
     7784\fI\fIshutdown script\fR\fR\fI = \fR\fI/usr/local/samba/sbin/shutdown %m %t %r %f\fR\fI \fR
     7785.RE
     7786
    63637787smb passwd file (G)
    6364 .RS 3n
    6365 This option sets the path to the encrypted smbpasswd file. By default the path to the smbpasswd file is compiled into Samba.
     7788.PP
     7789.RS 4
     7790This option sets the path to the encrypted smbpasswd file\. By default the path to the smbpasswd file is compiled into Samba\.
    63667791.sp
    63677792An example of use is:
    6368 
    6369 .sp
    6370 
     7793.sp
     7794.RS 4
    63717795.nf
    6372 
    63737796smb passwd file = /etc/samba/smbpasswd
    6374 
    63757797.fi
    6376 
    6377 .sp
    6378 Default:
    6379 \fB\fIsmb passwd file\fR = ${prefix}/private/smbpasswd \fR
    6380 .RE
    6381 .PP
     7798.RE
     7799.sp
     7800.sp
     7801Default:
     7802\fI\fIsmb passwd file\fR\fR\fI = \fR\fI${prefix}/private/smbpasswd\fR\fI \fR
     7803.RE
     7804
    63827805smb ports (G)
    6383 .RS 3n
    6384 Specifies which ports the server should listen on for SMB traffic.
    6385 .sp
    6386 Default:
    6387 \fB\fIsmb ports\fR = 445 139 \fR
    6388 .RE
    6389 .PP
     7806.PP
     7807.RS 4
     7808Specifies which ports the server should listen on for SMB traffic\.
     7809.sp
     7810Default:
     7811\fI\fIsmb ports\fR\fR\fI = \fR\fI445 139\fR\fI \fR
     7812.RE
     7813
    63907814socket address (G)
    6391 .RS 3n
    6392 This option allows you to control what address Samba will listen for connections on. This is used to support multiple virtual interfaces on the one server, each with a different configuration.
    6393 .sp
    6394 By default Samba will accept connections on any address.
    6395 .sp
    6396 Default:
    6397 \fB\fIsocket address\fR = \fR
    6398 .sp
    6399 Example:
    6400 \fB\fIsocket address\fR = 192.168.2.20 \fR
    6401 .RE
    6402 .PP
     7815.PP
     7816.RS 4
     7817This option allows you to control what address Samba will listen for connections on\. This is used to support multiple virtual interfaces on the one server, each with a different configuration\.
     7818.sp
     7819By default Samba will accept connections on any address\.
     7820.sp
     7821Default:
     7822\fI\fIsocket address\fR\fR\fI = \fR\fI\fR\fI \fR
     7823.sp
     7824Example:
     7825\fI\fIsocket address\fR\fR\fI = \fR\fI192\.168\.2\.20\fR\fI \fR
     7826.RE
     7827
    64037828socket options (G)
    6404 .RS 3n
    6405 This option allows you to set socket options to be used when talking with the client.
    6406 .sp
    6407 Socket options are controls on the networking layer of the operating systems which allow the connection to be tuned.
    6408 .sp
    6409 This option will typically be used to tune your Samba server for optimal performance for your local network. There is no way that Samba can know what the optimal parameters are for your net, so you must experiment and choose them yourself. We strongly suggest you read the appropriate documentation for your operating system first (perhaps
     7829.PP
     7830.RS 4
     7831This option allows you to set socket options to be used when talking with the client\.
     7832.sp
     7833Socket options are controls on the networking layer of the operating systems which allow the connection to be tuned\.
     7834.sp
     7835This option will typically be used to tune your Samba server for optimal performance for your local network\. There is no way that Samba can know what the optimal parameters are for your net, so you must experiment and choose them yourself\. We strongly suggest you read the appropriate documentation for your operating system first (perhaps
    64107836man setsockopt
    6411 will help).
    6412 .sp
    6413 You may find that on some systems Samba will say "Unknown socket option" when you supply an option. This means you either incorrectly typed it or you need to add an include file to includes.h for your OS. If the latter is the case please send the patch to
    6414 samba-technical@samba.org.
    6415 .sp
    6416 Any of the supported socket options may be combined in any way you like, as long as your OS allows it.
     7837will help)\.
     7838.sp
     7839You may find that on some systems Samba will say "Unknown socket option" when you supply an option\. This means you either incorrectly typed it or you need to add an include file to includes\.h for your OS\. If the latter is the case please send the patch to
     7840samba\-technical@samba\.org\.
     7841.sp
     7842Any of the supported socket options may be combined in any way you like, as long as your OS allows it\.
    64177843.sp
    64187844This is the list of socket options currently settable using this option:
    6419 .RS 3n
    6420 .TP 3n
    6421 \(bu
     7845.sp
     7846.RS 4
     7847.ie n \{\
     7848\h'-04'\(bu\h'+03'\c
     7849.\}
     7850.el \{\
     7851.sp -1
     7852.IP \(bu 2.3
     7853.\}
    64227854SO_KEEPALIVE
    6423 .TP 3n
    6424 \(bu
     7855.RE
     7856.sp
     7857.RS 4
     7858.ie n \{\
     7859\h'-04'\(bu\h'+03'\c
     7860.\}
     7861.el \{\
     7862.sp -1
     7863.IP \(bu 2.3
     7864.\}
    64257865SO_REUSEADDR
    6426 .TP 3n
    6427 \(bu
     7866.RE
     7867.sp
     7868.RS 4
     7869.ie n \{\
     7870\h'-04'\(bu\h'+03'\c
     7871.\}
     7872.el \{\
     7873.sp -1
     7874.IP \(bu 2.3
     7875.\}
    64287876SO_BROADCAST
    6429 .TP 3n
    6430 \(bu
     7877.RE
     7878.sp
     7879.RS 4
     7880.ie n \{\
     7881\h'-04'\(bu\h'+03'\c
     7882.\}
     7883.el \{\
     7884.sp -1
     7885.IP \(bu 2.3
     7886.\}
    64317887TCP_NODELAY
    6432 .TP 3n
    6433 \(bu
     7888.RE
     7889.sp
     7890.RS 4
     7891.ie n \{\
     7892\h'-04'\(bu\h'+03'\c
     7893.\}
     7894.el \{\
     7895.sp -1
     7896.IP \(bu 2.3
     7897.\}
    64347898IPTOS_LOWDELAY
    6435 .TP 3n
    6436 \(bu
     7899.RE
     7900.sp
     7901.RS 4
     7902.ie n \{\
     7903\h'-04'\(bu\h'+03'\c
     7904.\}
     7905.el \{\
     7906.sp -1
     7907.IP \(bu 2.3
     7908.\}
    64377909IPTOS_THROUGHPUT
    6438 .TP 3n
    6439 \(bu
     7910.RE
     7911.sp
     7912.RS 4
     7913.ie n \{\
     7914\h'-04'\(bu\h'+03'\c
     7915.\}
     7916.el \{\
     7917.sp -1
     7918.IP \(bu 2.3
     7919.\}
    64407920SO_SNDBUF *
    6441 .TP 3n
    6442 \(bu
     7921.RE
     7922.sp
     7923.RS 4
     7924.ie n \{\
     7925\h'-04'\(bu\h'+03'\c
     7926.\}
     7927.el \{\
     7928.sp -1
     7929.IP \(bu 2.3
     7930.\}
    64437931SO_RCVBUF *
    6444 .TP 3n
    6445 \(bu
     7932.RE
     7933.sp
     7934.RS 4
     7935.ie n \{\
     7936\h'-04'\(bu\h'+03'\c
     7937.\}
     7938.el \{\
     7939.sp -1
     7940.IP \(bu 2.3
     7941.\}
    64467942SO_SNDLOWAT *
    6447 .TP 3n
    6448 \(bu
     7943.RE
     7944.sp
     7945.RS 4
     7946.ie n \{\
     7947\h'-04'\(bu\h'+03'\c
     7948.\}
     7949.el \{\
     7950.sp -1
     7951.IP \(bu 2.3
     7952.\}
    64497953SO_RCVLOWAT *
    6450 .RE
    6451 .IP "" 3n
     7954.sp
     7955.RE
    64527956Those marked with a
    6453 \fB'*'\fR
    6454 take an integer argument. The others can optionally take a 1 or 0 argument to enable or disable the option, by default they will be enabled if you don't specify 1 or 0.
     7957\fI\'*\'\fR
     7958take an integer argument\. The others can optionally take a 1 or 0 argument to enable or disable the option, by default they will be enabled if you don\'t specify 1 or 0\.
    64557959.sp
    64567960To specify an argument use the syntax SOME_OPTION = VALUE for example
    6457 SO_SNDBUF = 8192. Note that you must not have any spaces before or after the = sign.
     7961SO_SNDBUF = 8192\. Note that you must not have any spaces before or after the = sign\.
    64587962.sp
    64597963If you are on a local network then a sensible option might be:
    … …  
    64657969socket options = IPTOS_LOWDELAY TCP_NODELAY
    64667970.sp
    6467 If you are on a wide area network then perhaps try setting IPTOS_THROUGHPUT.
    6468 .sp
    6469 Note that several of the options may cause your Samba server to fail completely. Use these options with caution!
    6470 .sp
    6471 Default:
    6472 \fB\fIsocket options\fR = TCP_NODELAY \fR
    6473 .sp
    6474 Example:
    6475 \fB\fIsocket options\fR = IPTOS_LOWDELAY \fR
    6476 .RE
    6477 .PP
     7971If you are on a wide area network then perhaps try setting IPTOS_THROUGHPUT\.
     7972.sp
     7973Note that several of the options may cause your Samba server to fail completely\. Use these options with caution!
     7974.sp
     7975Default:
     7976\fI\fIsocket options\fR\fR\fI = \fR\fITCP_NODELAY\fR\fI \fR
     7977.sp
     7978Example:
     7979\fI\fIsocket options\fR\fR\fI = \fR\fIIPTOS_LOWDELAY\fR\fI \fR
     7980.RE
     7981
    64787982stat cache (G)
    6479 .RS 3n
     7983.PP
     7984.RS 4
    64807985This parameter determines if
    64817986\fBsmbd\fR(8)
    6482 will use a cache in order to speed up case insensitive name mappings. You should never need to change this parameter.
    6483 .sp
    6484 Default:
    6485 \fB\fIstat cache\fR = yes \fR
    6486 .RE
    6487 .PP
     7987will use a cache in order to speed up case insensitive name mappings\. You should never need to change this parameter\.
     7988.sp
     7989Default:
     7990\fI\fIstat cache\fR\fR\fI = \fR\fIyes\fR\fI \fR
     7991.RE
     7992
    64887993store dos attributes (S)
    6489 .RS 3n
    6490 If this parameter is set Samba attempts to first read DOS attributes (SYSTEM, HIDDEN, ARCHIVE or READ-ONLY) from a filesystem extended attribute, before mapping DOS attributes to UNIX permission bits (such as occurs with
    6491 map hidden and
    6492 map readonly). When set, DOS attributes will be stored onto an extended attribute in the UNIX filesystem, associated with the file or directory. For no other mapping to occur as a fall-back, the parameters
    6493 map hidden,
    6494 map system,
    6495 map archive and
    6496 map readonly must be set to off. This parameter writes the DOS attributes as a string into the extended attribute named "user.DOSATTRIB". This extended attribute is explicitly hidden from smbd clients requesting an EA list. On Linux the filesystem must have been mounted with the mount option user_xattr in order for extended attributes to work, also extended attributes must be compiled into the Linux kernel.
    6497 .sp
    6498 Default:
    6499 \fB\fIstore dos attributes\fR = no \fR
    6500 .RE
    6501 .PP
     7994.PP
     7995.RS 4
     7996If this parameter is set Samba attempts to first read DOS attributes (SYSTEM, HIDDEN, ARCHIVE or READ\-ONLY) from a filesystem extended attribute, before mapping DOS attributes to UNIX permission bits (such as occurs with
     7997\fImap hidden\fR
     7998and
     7999\fImap readonly\fR)\. When set, DOS attributes will be stored onto an extended attribute in the UNIX filesystem, associated with the file or directory\. For no other mapping to occur as a fall\-back, the parameters
     8000\fImap hidden\fR,
     8001\fImap system\fR,
     8002\fImap archive\fR
     8003and
     8004\fImap readonly\fR
     8005must be set to off\. This parameter writes the DOS attributes as a string into the extended attribute named "user\.DOSATTRIB"\. This extended attribute is explicitly hidden from smbd clients requesting an EA list\. On Linux the filesystem must have been mounted with the mount option user_xattr in order for extended attributes to work, also extended attributes must be compiled into the Linux kernel\.
     8006.sp
     8007Default:
     8008\fI\fIstore dos attributes\fR\fR\fI = \fR\fIno\fR\fI \fR
     8009.RE
     8010
    65028011strict allocate (S)
    6503 .RS 3n
    6504 This is a boolean that controls the handling of disk space allocation in the server. When this is set to
     8012.PP
     8013.RS 4
     8014This is a boolean that controls the handling of disk space allocation in the server\. When this is set to
    65058015\fByes\fR
    6506 the server will change from UNIX behaviour of not committing real disk storage blocks when a file is extended to the Windows behaviour of actually forcing the disk system to allocate real storage blocks when a file is created or extended to be a given size. In UNIX terminology this means that Samba will stop creating sparse files. This can be slow on some systems.
     8016the server will change from UNIX behaviour of not committing real disk storage blocks when a file is extended to the Windows behaviour of actually forcing the disk system to allocate real storage blocks when a file is created or extended to be a given size\. In UNIX terminology this means that Samba will stop creating sparse files\. This can be slow on some systems\.
    65078017.sp
    65088018When strict allocate is
    65098019\fBno\fR
    6510 the server does sparse disk block allocation when a file is extended.
     8020the server does sparse disk block allocation when a file is extended\.
    65118021.sp
    65128022Setting this to
    65138023\fByes\fR
    6514 can help Samba return out of quota messages on systems that are restricting the disk quota of users.
    6515 .sp
    6516 Default:
    6517 \fB\fIstrict allocate\fR = no \fR
    6518 .RE
    6519 .PP
     8024can help Samba return out of quota messages on systems that are restricting the disk quota of users\.
     8025.sp
     8026Default:
     8027\fI\fIstrict allocate\fR\fR\fI = \fR\fIno\fR\fI \fR
     8028.RE
     8029
    65208030strict locking (S)
    6521 .RS 3n
    6522 This is an enumerated type that controls the handling of file locking in the server. When this is set to
    6523 \fByes\fR, the server will check every read and write access for file locks, and deny access if locks exist. This can be slow on some systems.
    6524 .sp
    6525 When strict locking is set to Auto (the default), the server performs file lock checks only on non-oplocked files. As most Windows redirectors perform file locking checks locally on oplocked files this is a good trade off for inproved performance.
    6526 .sp
    6527 When strict locking is disabled, the server performs file lock checks only when the client explicitly asks for them.
    6528 .sp
    6529 Well-behaved clients always ask for lock checks when it is important. So in the vast majority of cases,
     8031.PP
     8032.RS 4
     8033This is an enumerated type that controls the handling of file locking in the server\. When this is set to
     8034\fByes\fR, the server will check every read and write access for file locks, and deny access if locks exist\. This can be slow on some systems\.
     8035.sp
     8036When strict locking is set to Auto (the default), the server performs file lock checks only on non\-oplocked files\. As most Windows redirectors perform file locking checks locally on oplocked files this is a good trade off for inproved performance\.
     8037.sp
     8038When strict locking is disabled, the server performs file lock checks only when the client explicitly asks for them\.
     8039.sp
     8040Well\-behaved clients always ask for lock checks when it is important\. So in the vast majority of cases,
    65308041strict locking = Auto
    65318042or
    65328043strict locking = no
    6533 is acceptable.
    6534 .sp
    6535 Default:
    6536 \fB\fIstrict locking\fR = Auto \fR
    6537 .RE
    6538 .PP
     8044is acceptable\.
     8045.sp
     8046Default:
     8047\fI\fIstrict locking\fR\fR\fI = \fR\fIAuto\fR\fI \fR
     8048.RE
     8049
    65398050strict sync (S)
    6540 .RS 3n
    6541 Many Windows applications (including the Windows 98 explorer shell) seem to confuse flushing buffer contents to disk with doing a sync to disk. Under UNIX, a sync call forces the process to be suspended until the kernel has ensured that all outstanding data in kernel disk buffers has been safely stored onto stable storage. This is very slow and should only be done rarely. Setting this parameter to
     8051.PP
     8052.RS 4
     8053Many Windows applications (including the Windows 98 explorer shell) seem to confuse flushing buffer contents to disk with doing a sync to disk\. Under UNIX, a sync call forces the process to be suspended until the kernel has ensured that all outstanding data in kernel disk buffers has been safely stored onto stable storage\. This is very slow and should only be done rarely\. Setting this parameter to
    65428054\fBno\fR
    65438055(the default) means that
    65448056\fBsmbd\fR(8)
    6545 ignores the Windows applications requests for a sync call. There is only a possibility of losing data if the operating system itself that Samba is running on crashes, so there is little danger in this default setting. In addition, this fixes many performance problems that people have reported with the new Windows98 explorer shell file copies.
    6546 .sp
    6547 Default:
    6548 \fB\fIstrict sync\fR = no \fR
    6549 .RE
    6550 .PP
     8057ignores the Windows applications requests for a sync call\. There is only a possibility of losing data if the operating system itself that Samba is running on crashes, so there is little danger in this default setting\. In addition, this fixes many performance problems that people have reported with the new Windows98 explorer shell file copies\.
     8058.sp
     8059Default:
     8060\fI\fIstrict sync\fR\fR\fI = \fR\fIno\fR\fI \fR
     8061.RE
     8062
    65518063svcctl list (G)
    6552 .RS 3n
    6553 This option defines a list of init scripts that smbd will use for starting and stopping Unix services via the Win32 ServiceControl API. This allows Windows administrators to utilize the MS Management Console plug-ins to manage a Unix server running Samba.
     8064.PP
     8065.RS 4
     8066This option defines a list of init scripts that smbd will use for starting and stopping Unix services via the Win32 ServiceControl API\. This allows Windows administrators to utilize the MS Management Console plug\-ins to manage a Unix server running Samba\.
    65548067.sp
    65558068The administrator must create a directory name
    65568069\fIsvcctl\fR
    6557 in Samba's $(libdir) and create symbolic links to the init scripts in
    6558 \fI/etc/init.d/\fR. The name of the links must match the names given as part of the
    6559 \fIsvcctl list\fR.
    6560 .sp
    6561 Default:
    6562 \fB\fIsvcctl list\fR = \fR
    6563 .sp
    6564 Example:
    6565 \fB\fIsvcctl list\fR = cups postfix portmap httpd \fR
    6566 .RE
    6567 .PP
     8070in Samba\'s $(libdir) and create symbolic links to the init scripts in
     8071\fI/etc/init\.d/\fR\. The name of the links must match the names given as part of the
     8072\fIsvcctl list\fR\.
     8073.sp
     8074Default:
     8075\fI\fIsvcctl list\fR\fR\fI = \fR\fI\fR\fI \fR
     8076.sp
     8077Example:
     8078\fI\fIsvcctl list\fR\fR\fI = \fR\fIcups postfix portmap httpd\fR\fI \fR
     8079.RE
     8080
    65688081sync always (S)
    6569 .RS 3n
    6570 This is a boolean parameter that controls whether writes will always be written to stable storage before the write call returns. If this is
     8082.PP
     8083.RS 4
     8084This is a boolean parameter that controls whether writes will always be written to stable storage before the write call returns\. If this is
    65718085\fBno\fR
    6572 then the server will be guided by the client's request in each write call (clients can set a bit indicating that a particular write should be synchronous). If this is
     8086then the server will be guided by the client\'s request in each write call (clients can set a bit indicating that a particular write should be synchronous)\. If this is
    65738087\fByes\fR
    65748088then every write will be followed by a
    65758089fsync()
    6576 call to ensure the data is written to disk. Note that the
     8090call to ensure the data is written to disk\. Note that the
    65778091\fIstrict sync\fR
    65788092parameter must be set to
    65798093\fByes\fR
    6580 in order for this parameter to have any affect.
    6581 .sp
    6582 Default:
    6583 \fB\fIsync always\fR = no \fR
    6584 .RE
    6585 .PP
     8094in order for this parameter to have any affect\.
     8095.sp
     8096Default:
     8097\fI\fIsync always\fR\fR\fI = \fR\fIno\fR\fI \fR
     8098.RE
     8099
     8100syslog only (G)
     8101.PP
     8102.RS 4
     8103If this parameter is set then Samba debug messages are logged into the system syslog only, and not to the debug log files\. There still will be some logging to log\.[sn]mbd even if
     8104\fIsyslog only\fR
     8105is enabled\.
     8106.sp
     8107Default:
     8108\fI\fIsyslog only\fR\fR\fI = \fR\fIno\fR\fI \fR
     8109.RE
     8110
    65868111syslog (G)
    6587 .RS 3n
    6588 This parameter maps how Samba debug messages are logged onto the system syslog logging levels. Samba debug level zero maps onto syslog
     8112.PP
     8113.RS 4
     8114This parameter maps how Samba debug messages are logged onto the system syslog logging levels\. Samba debug level zero maps onto syslog
    65898115\fBLOG_ERR\fR, debug level one maps onto
    65908116\fBLOG_WARNING\fR, debug level two maps onto
    6591 \fBLOG_NOTICE\fR, debug level three maps onto LOG_INFO. All higher levels are mapped to
    6592 \fBLOG_DEBUG\fR.
    6593 .sp
    6594 This parameter sets the threshold for sending messages to syslog. Only messages with debug level less than this value will be sent to syslog.
    6595 .sp
    6596 Default:
    6597 \fB\fIsyslog\fR = 1 \fR
    6598 .RE
    6599 .PP
    6600 syslog only (G)
    6601 .RS 3n
    6602 If this parameter is set then Samba debug messages are logged into the system syslog only, and not to the debug log files.
    6603 .sp
    6604 Default:
    6605 \fB\fIsyslog only\fR = no \fR
    6606 .RE
    6607 .PP
     8117\fBLOG_NOTICE\fR, debug level three maps onto LOG_INFO\. All higher levels are mapped to
     8118\fBLOG_DEBUG\fR\.
     8119.sp
     8120This parameter sets the threshold for sending messages to syslog\. Only messages with debug level less than this value will be sent to syslog\. There still will be some logging to log\.[sn]mbd even if
     8121\fIsyslog only\fR
     8122is enabled\.
     8123.sp
     8124Default:
     8125\fI\fIsyslog\fR\fR\fI = \fR\fI1\fR\fI \fR
     8126.RE
     8127
    66088128template homedir (G)
    6609 .RS 3n
     8129.PP
     8130.RS 4
    66108131When filling out the user information for a Windows NT user, the
    66118132\fBwinbindd\fR(8)
    6612 daemon uses this parameter to fill in the home directory for that user. If the string
     8133daemon uses this parameter to fill in the home directory for that user\. If the string
    66138134\fI%D\fR
    6614 is present it is substituted with the user's Windows NT domain name. If the string
     8135is present it is substituted with the user\'s Windows NT domain name\. If the string
    66158136\fI%U\fR
    6616 is present it is substituted with the user's Windows NT user name.
    6617 .sp
    6618 Default:
    6619 \fB\fItemplate homedir\fR = /home/%D/%U \fR
    6620 .RE
    6621 .PP
     8137is present it is substituted with the user\'s Windows NT user name\.
     8138.sp
     8139Default:
     8140\fI\fItemplate homedir\fR\fR\fI = \fR\fI/home/%D/%U\fR\fI \fR
     8141.RE
     8142
    66228143template shell (G)
    6623 .RS 3n
     8144.PP
     8145.RS 4
    66248146When filling out the user information for a Windows NT user, the
    66258147\fBwinbindd\fR(8)
    6626 daemon uses this parameter to fill in the login shell for that user.
    6627 .sp
    6628 \fBNo default\fR
    6629 .RE
    6630 .PP
     8148daemon uses this parameter to fill in the login shell for that user\.
     8149.sp
     8150\fINo default\fR
     8151.RE
     8152
    66318153time offset (G)
    6632 .RS 3n
    6633 This parameter is a setting in minutes to add to the normal GMT to local time conversion. This is useful if you are serving a lot of PCs that have incorrect daylight saving time handling.
    6634 .sp
    6635 Default:
    6636 \fB\fItime offset\fR = 0 \fR
    6637 .sp
    6638 Example:
    6639 \fB\fItime offset\fR = 60 \fR
    6640 .RE
    6641 .PP
     8154.PP
     8155.RS 4
     8156This parameter is a setting in minutes to add to the normal GMT to local time conversion\. This is useful if you are serving a lot of PCs that have incorrect daylight saving time handling\.
     8157.sp
     8158Default:
     8159\fI\fItime offset\fR\fR\fI = \fR\fI0\fR\fI \fR
     8160.sp
     8161Example:
     8162\fI\fItime offset\fR\fR\fI = \fR\fI60\fR\fI \fR
     8163.RE
     8164
    66428165time server (G)
    6643 .RS 3n
     8166.PP
     8167.RS 4
    66448168This parameter determines if
    66458169\fBnmbd\fR(8)
    6646 advertises itself as a time server to Windows clients.
    6647 .sp
    6648 Default:
    6649 \fB\fItime server\fR = no \fR
    6650 .RE
    6651 .PP
     8170advertises itself as a time server to Windows clients\.
     8171.sp
     8172Default:
     8173\fI\fItime server\fR\fR\fI = \fR\fIno\fR\fI \fR
     8174.RE
     8175
    66528176unix charset (G)
    6653 .RS 3n
    6654 Specifies the charset the unix machine Samba runs on uses. Samba needs to know this in order to be able to convert text to the charsets other SMB clients use.
    6655 .sp
    6656 This is also the charset Samba will use when specifying arguments to scripts that it invokes.
    6657 .sp
    6658 Default:
    6659 \fB\fIunix charset\fR = UTF8 \fR
    6660 .sp
    6661 Example:
    6662 \fB\fIunix charset\fR = ASCII \fR
    6663 .RE
    6664 .PP
     8177.PP
     8178.RS 4
     8179Specifies the charset the unix machine Samba runs on uses\. Samba needs to know this in order to be able to convert text to the charsets other SMB clients use\.
     8180.sp
     8181This is also the charset Samba will use when specifying arguments to scripts that it invokes\.
     8182.sp
     8183Default:
     8184\fI\fIunix charset\fR\fR\fI = \fR\fIUTF8\fR\fI \fR
     8185.sp
     8186Example:
     8187\fI\fIunix charset\fR\fR\fI = \fR\fIASCII\fR\fI \fR
     8188.RE
     8189
    66658190unix extensions (G)
    6666 .RS 3n
    6667 This boolean parameter controls whether Samba implments the CIFS UNIX extensions, as defined by HP. These extensions enable Samba to better serve UNIX CIFS clients by supporting features such as symbolic links, hard links, etc... These extensions require a similarly enabled client, and are of no current use to Windows clients.
    6668 .sp
    6669 Default:
    6670 \fB\fIunix extensions\fR = yes \fR
    6671 .RE
    6672 .PP
     8191.PP
     8192.RS 4
     8193This boolean parameter controls whether Samba implments the CIFS UNIX extensions, as defined by HP\. These extensions enable Samba to better serve UNIX CIFS clients by supporting features such as symbolic links, hard links, etc\.\.\. These extensions require a similarly enabled client, and are of no current use to Windows clients\.
     8194.sp
     8195Default:
     8196\fI\fIunix extensions\fR\fR\fI = \fR\fIyes\fR\fI \fR
     8197.RE
     8198
    66738199unix password sync (G)
    6674 .RS 3n
    6675 This boolean parameter controls whether Samba attempts to synchronize the UNIX password with the SMB password when the encrypted SMB password in the smbpasswd file is changed. If this is set to
     8200.PP
     8201.RS 4
     8202This boolean parameter controls whether Samba attempts to synchronize the UNIX password with the SMB password when the encrypted SMB password in the smbpasswd file is changed\. If this is set to
    66768203\fByes\fR
    66778204the program specified in the
    66788205\fIpasswd program\fRparameter is called
    6679 \fBAS ROOT\fR
    6680 - to allow the new UNIX password to be set without access to the old UNIX password (as the SMB password change code has no access to the old password cleartext, only the new).
    6681 .sp
    6682 Default:
    6683 \fB\fIunix password sync\fR = no \fR
    6684 .RE
    6685 .PP
     8206\fIAS ROOT\fR
     8207\- to allow the new UNIX password to be set without access to the old UNIX password (as the SMB password change code has no access to the old password cleartext, only the new)\.
     8208.sp
     8209Default:
     8210\fI\fIunix password sync\fR\fR\fI = \fR\fIno\fR\fI \fR
     8211.RE
     8212
    66868213update encrypted (G)
    6687 .RS 3n
    6688 This boolean parameter allows a user logging on with a plaintext password to have their encrypted (hashed) password in the smbpasswd file to be updated automatically as they log on. This option allows a site to migrate from plaintext password authentication (users authenticate with plaintext password over the wire, and are checked against a UNIX account atabase) to encrypted password authentication (the SMB challenge/response authentication mechanism) without forcing all users to re-enter their passwords via smbpasswd at the time the change is made. This is a convenience option to allow the change over to encrypted passwords to be made over a longer period. Once all users have encrypted representations of their passwords in the smbpasswd file this parameter should be set to
    6689 \fBno\fR.
     8214.PP
     8215.RS 4
     8216This boolean parameter allows a user logging on with a plaintext password to have their encrypted (hashed) password in the smbpasswd file to be updated automatically as they log on\. This option allows a site to migrate from plaintext password authentication (users authenticate with plaintext password over the wire, and are checked against a UNIX account atabase) to encrypted password authentication (the SMB challenge/response authentication mechanism) without forcing all users to re\-enter their passwords via smbpasswd at the time the change is made\. This is a convenience option to allow the change over to encrypted passwords to be made over a longer period\. Once all users have encrypted representations of their passwords in the smbpasswd file this parameter should be set to
     8217\fBno\fR\.
    66908218.sp
    66918219In order for this parameter to be operative the
    6692 encrypt passwords parameter must be set to
    6693 \fBno\fR. The default value of
    6694 encrypt passwords = Yes. Note: This must be set to
     8220\fIencrypt passwords\fR
     8221parameter must be set to
     8222\fBno\fR\. The default value of
     8223\fIencrypt passwords = Yes\fR\. Note: This must be set to
    66958224\fBno\fR
    66968225for this
    6697 update encrypted to work.
     8226\fIupdate encrypted\fR
     8227to work\.
    66988228.sp
    66998229Note that even when this parameter is set a user authenticating to
    67008230smbd
    6701 must still enter a valid password in order to connect correctly, and to update their hashed (smbpasswd) passwords.
    6702 .sp
    6703 Default:
    6704 \fB\fIupdate encrypted\fR = no \fR
    6705 .RE
    6706 .PP
     8231must still enter a valid password in order to connect correctly, and to update their hashed (smbpasswd) passwords\.
     8232.sp
     8233Default:
     8234\fI\fIupdate encrypted\fR\fR\fI = \fR\fIno\fR\fI \fR
     8235.RE
     8236
    67078237use client driver (S)
    6708 .RS 3n
    6709 This parameter applies only to Windows NT/2000 clients. It has no effect on Windows 95/98/ME clients. When serving a printer to Windows NT/2000 clients without first installing a valid printer driver on the Samba host, the client will be required to install a local printer driver. From this point on, the client will treat the print as a local printer and not a network printer connection. This is much the same behavior that will occur when
    6710 disable spoolss = yes.
    6711 .sp
    6712 The differentiating factor is that under normal circumstances, the NT/2000 client will attempt to open the network printer using MS-RPC. The problem is that because the client considers the printer to be local, it will attempt to issue the OpenPrinterEx() call requesting access rights associated with the logged on user. If the user possesses local administator rights but not root privilege on the Samba host (often the case), the OpenPrinterEx() call will fail. The result is that the client will now display an "Access Denied; Unable to connect" message in the printer queue window (even though jobs may successfully be printed).
    6713 .sp
    6714 If this parameter is enabled for a printer, then any attempt to open the printer with the PRINTER_ACCESS_ADMINISTER right is mapped to PRINTER_ACCESS_USE instead. Thus allowing the OpenPrinterEx() call to succeed.
    6715 \fBThis parameter MUST not be able enabled on a print share which has valid print driver installed on the Samba server.\fR
    6716 .sp
    6717 Default:
    6718 \fB\fIuse client driver\fR = no \fR
    6719 .RE
    6720 .PP
     8238.PP
     8239.RS 4
     8240This parameter applies only to Windows NT/2000 clients\. It has no effect on Windows 95/98/ME clients\. When serving a printer to Windows NT/2000 clients without first installing a valid printer driver on the Samba host, the client will be required to install a local printer driver\. From this point on, the client will treat the print as a local printer and not a network printer connection\. This is much the same behavior that will occur when
     8241disable spoolss = yes\.
     8242.sp
     8243The differentiating factor is that under normal circumstances, the NT/2000 client will attempt to open the network printer using MS\-RPC\. The problem is that because the client considers the printer to be local, it will attempt to issue the OpenPrinterEx() call requesting access rights associated with the logged on user\. If the user possesses local administator rights but not root privilege on the Samba host (often the case), the OpenPrinterEx() call will fail\. The result is that the client will now display an "Access Denied; Unable to connect" message in the printer queue window (even though jobs may successfully be printed)\.
     8244.sp
     8245If this parameter is enabled for a printer, then any attempt to open the printer with the PRINTER_ACCESS_ADMINISTER right is mapped to PRINTER_ACCESS_USE instead\. Thus allowing the OpenPrinterEx() call to succeed\.
     8246\fIThis parameter MUST not be able enabled on a print share which has valid print driver installed on the Samba server\.\fR
     8247.sp
     8248Default:
     8249\fI\fIuse client driver\fR\fR\fI = \fR\fIno\fR\fI \fR
     8250.RE
     8251
    67218252use kerberos keytab (G)
    6722 .RS 3n
     8253.PP
     8254.RS 4
    67238255Specifies whether Samba should attempt to maintain service principals in the systems keytab file for
    67248256\fBhost/FQDN\fR
    67258257and
    6726 \fBcifs/FQDN\fR.
     8258\fBcifs/FQDN\fR\.
    67278259.sp
    67288260When you are using the heimdal Kerberos libraries, you must also specify the following in
    6729 \fI/etc/krb5.conf\fR:
    6730 
    6731 .sp
    6732 
     8261\fI/etc/krb5\.conf\fR:
     8262.sp
     8263.RS 4
    67338264.nf
    6734 
    67358265[libdefaults]
    6736 default_keytab_name = FILE:/etc/krb5.keytab
    6737 
     8266default_keytab_name = FILE:/etc/krb5\.keytab
    67388267.fi
    6739 
    6740 .sp
    6741 Default:
    6742 \fB\fIuse kerberos keytab\fR = False \fR
    6743 .RE
    6744 .PP
     8268.RE
     8269.sp
     8270.sp
     8271Default:
     8272\fI\fIuse kerberos keytab\fR\fR\fI = \fR\fIFalse\fR\fI \fR
     8273.RE
     8274
    67458275use mmap (G)
    6746 .RS 3n
    6747 This global parameter determines if the tdb internals of Samba can depend on mmap working correctly on the running system. Samba requires a coherent mmap/read-write system memory cache. Currently only HPUX does not have such a coherent cache, and so this parameter is set to
     8276.PP
     8277.RS 4
     8278This global parameter determines if the tdb internals of Samba can depend on mmap working correctly on the running system\. Samba requires a coherent mmap/read\-write system memory cache\. Currently only HPUX does not have such a coherent cache, and so this parameter is set to
    67488279\fBno\fR
    6749 by default on HPUX. On all other systems this parameter should be left alone. This parameter is provided to help the Samba developers track down problems with the tdb internal code.
    6750 .sp
    6751 Default:
    6752 \fB\fIuse mmap\fR = yes \fR
    6753 .RE
    6754 .PP
    6755 user
    6756 .RS 3n
    6757 This parameter is a synonym for username.
    6758 .RE
    6759 .PP
    6760 users
    6761 .RS 3n
    6762 This parameter is a synonym for username.
    6763 .RE
    6764 .PP
    6765 username (S)
    6766 .RS 3n
    6767 Multiple users may be specified in a comma-delimited list, in which case the supplied password will be tested against each username in turn (left to right).
    6768 .sp
    6769 The
    6770 \fIusername\fR
    6771 line is needed only when the PC is unable to supply its own username. This is the case for the COREPLUS protocol or where your users have different WfWg usernames to UNIX usernames. In both these cases you may also be better using the \\server\share%user syntax instead.
    6772 .sp
    6773 The
    6774 \fIusername\fR
    6775 line is not a great solution in many cases as it means Samba will try to validate the supplied password against each of the usernames in the
    6776 \fIusername\fR
    6777 line in turn. This is slow and a bad idea for lots of users in case of duplicate passwords. You may get timeouts or security breaches using this parameter unwisely.
    6778 .sp
    6779 Samba relies on the underlying UNIX security. This parameter does not restrict who can login, it just offers hints to the Samba server as to what usernames might correspond to the supplied password. Users can login as whoever they please and they will be able to do no more damage than if they started a telnet session. The daemon runs as the user that they log in as, so they cannot do anything that user cannot do.
    6780 .sp
    6781 To restrict a service to a particular set of users you can use the
    6782 valid users parameter.
    6783 .sp
    6784 If any of the usernames begin with a '@' then the name will be looked up first in the NIS netgroups list (if Samba is compiled with netgroup support), followed by a lookup in the UNIX groups database and will expand to a list of all users in the group of that name.
    6785 .sp
    6786 If any of the usernames begin with a '+' then the name will be looked up only in the UNIX groups database and will expand to a list of all users in the group of that name.
    6787 .sp
    6788 If any of the usernames begin with a '&' then the name will be looked up only in the NIS netgroups database (if Samba is compiled with netgroup support) and will expand to a list of all users in the netgroup group of that name.
    6789 .sp
    6790 Note that searching though a groups database can take quite some time, and some clients may time out during the search.
    6791 .sp
    6792 See the section
    6793 NOTE ABOUT USERNAME/PASSWORD VALIDATION
    6794 for more information on how this parameter determines access to the services.
    6795 .sp
    6796 Default:
    6797 \fB\fIusername\fR = # The guest account if a guest service, else <empty string>. \fR
    6798 .sp
    6799 Example:
    6800 \fB\fIusername\fR = fred, mary, jack, jane, @users, @pcgroup \fR
    6801 .RE
    6802 .PP
     8280by default on HPUX\. On all other systems this parameter should be left alone\. This parameter is provided to help the Samba developers track down problems with the tdb internal code\.
     8281.sp
     8282Default:
     8283\fI\fIuse mmap\fR\fR\fI = \fR\fIyes\fR\fI \fR
     8284.RE
     8285
    68038286username level (G)
    6804 .RS 3n
    6805 This option helps Samba to try and 'guess' at the real UNIX username, as many DOS clients send an all-uppercase username. By default Samba tries all lowercase, followed by the username with the first letter capitalized, and fails if the username is not found on the UNIX machine.
    6806 .sp
    6807 If this parameter is set to non-zero the behavior changes. This parameter is a number that specifies the number of uppercase combinations to try while trying to determine the UNIX user name. The higher the number the more combinations will be tried, but the slower the discovery of usernames will be. Use this parameter when you have strange usernames on your UNIX machine, such as
    6808 \fBAstrangeUser \fR.
    6809 .sp
    6810 This parameter is needed only on UNIX systems that have case sensitive usernames.
    6811 .sp
    6812 Default:
    6813 \fB\fIusername level\fR = 0 \fR
    6814 .sp
    6815 Example:
    6816 \fB\fIusername level\fR = 5 \fR
    6817 .RE
    6818 .PP
     8287.PP
     8288.RS 4
     8289This option helps Samba to try and \'guess\' at the real UNIX username, as many DOS clients send an all\-uppercase username\. By default Samba tries all lowercase, followed by the username with the first letter capitalized, and fails if the username is not found on the UNIX machine\.
     8290.sp
     8291If this parameter is set to non\-zero the behavior changes\. This parameter is a number that specifies the number of uppercase combinations to try while trying to determine the UNIX user name\. The higher the number the more combinations will be tried, but the slower the discovery of usernames will be\. Use this parameter when you have strange usernames on your UNIX machine, such as
     8292\fBAstrangeUser \fR\.
     8293.sp
     8294This parameter is needed only on UNIX systems that have case sensitive usernames\.
     8295.sp
     8296Default:
     8297\fI\fIusername level\fR\fR\fI = \fR\fI0\fR\fI \fR
     8298.sp
     8299Example:
     8300\fI\fIusername level\fR\fR\fI = \fR\fI5\fR\fI \fR
     8301.RE
     8302
     8303username map script (G)
     8304.PP
     8305.RS 4
     8306This script is a mutually exclusive alternative to the
     8307\fIusername map\fR
     8308parameter\. This parameter specifies and external program or script that must accept a single command line option (the username transmitted in the authentication request) and return a line line on standard output (the name to which the account should mapped)\. In this way, it is possible to store username map tables in an LDAP or NIS directory services\.
     8309.sp
     8310Default:
     8311\fI\fIusername map script\fR\fR\fI = \fR\fI\fR\fI \fR
     8312.sp
     8313Example:
     8314\fI\fIusername map script\fR\fR\fI = \fR\fI/etc/samba/scripts/mapusers\.sh\fR\fI \fR
     8315.RE
     8316
    68198317username map (G)
    6820 .RS 3n
    6821 This option allows you to specify a file containing a mapping of usernames from the clients to the server. This can be used for several purposes. The most common is to map usernames that users use on DOS or Windows machines to those that the UNIX box uses. The other is to map multiple users to a single username so that they can more easily share files.
    6822 .sp
    6823 Please note that for user or share mode security, the username map is applied prior to validating the user credentials. Domain member servers (domain or ads) apply the username map after the user has been successfully authenticated by the domain controller and require fully qualified enties in the map table (e.g. biddle = DOMAIN\foo).
    6824 .sp
    6825 The map file is parsed line by line. Each line should contain a single UNIX username on the left then a '=' followed by a list of usernames on the right. The list of usernames on the right may contain names of the form @group in which case they will match any UNIX username in that group. The special client name '*' is a wildcard and matches any name. Each line of the map file may be up to 1023 characters long.
    6826 .sp
    6827 The file is processed on each line by taking the supplied username and comparing it with each username on the right hand side of the '=' signs. If the supplied name matches any of the names on the right hand side then it is replaced with the name on the left. Processing then continues with the next line.
    6828 .sp
    6829 If any line begins with a '#' or a ';' then it is ignored.
    6830 .sp
    6831 If any line begins with an '!' then the processing will stop after that line if a mapping was done by the line. Otherwise mapping continues with every line being processed. Using '!' is most useful when you have a wildcard mapping line later in the file.
     8318.PP
     8319.RS 4
     8320This option allows you to specify a file containing a mapping of usernames from the clients to the server\. This can be used for several purposes\. The most common is to map usernames that users use on DOS or Windows machines to those that the UNIX box uses\. The other is to map multiple users to a single username so that they can more easily share files\.
     8321.sp
     8322Please note that for user or share mode security, the username map is applied prior to validating the user credentials\. Domain member servers (domain or ads) apply the username map after the user has been successfully authenticated by the domain controller and require fully qualified enties in the map table (e\.g\. biddle =
     8323DOMAIN\efoo)\.
     8324.sp
     8325The map file is parsed line by line\. Each line should contain a single UNIX username on the left then a \'=\' followed by a list of usernames on the right\. The list of usernames on the right may contain names of the form @group in which case they will match any UNIX username in that group\. The special client name \'*\' is a wildcard and matches any name\. Each line of the map file may be up to 1023 characters long\.
     8326.sp
     8327The file is processed on each line by taking the supplied username and comparing it with each username on the right hand side of the \'=\' signs\. If the supplied name matches any of the names on the right hand side then it is replaced with the name on the left\. Processing then continues with the next line\.
     8328.sp
     8329If any line begins with a \'#\' or a \';\' then it is ignored\.
     8330.sp
     8331If any line begins with an \'!\' then the processing will stop after that line if a mapping was done by the line\. Otherwise mapping continues with every line being processed\. Using \'!\' is most useful when you have a wildcard mapping line later in the file\.
    68328332.sp
    68338333For example to map from the name
    … …  
    68388338\fB root\fR
    68398339you would use:
    6840 
    6841 .sp
    6842 
     8340.sp
     8341.RS 4
    68438342.nf
    6844 
    68458343root = admin administrator
    6846 
    68478344.fi
     8345.RE
     8346.sp
    68488347Or to map anyone in the UNIX group
    68498348\fBsystem\fR
    … …  
    68518350\fBsys\fR
    68528351you would use:
    6853 
    6854 .sp
    6855 
     8352.sp
     8353.RS 4
    68568354.nf
    6857 
    68588355sys = @system
    6859 
    68608356.fi
    6861 
    6862 .sp
    6863 You can have as many mappings as you like in a username map file.
     8357.RE
     8358.sp
     8359.sp
     8360You can have as many mappings as you like in a username map file\.
    68648361.sp
    68658362If your system supports the NIS NETGROUP option then the netgroup database is checked before the
    68668363\fI/etc/group \fR
    6867 database for matching groups.
    6868 .sp
    6869 You can map Windows usernames that have spaces in them by using double quotes around the name. For example:
    6870 
    6871 .sp
    6872 
     8364database for matching groups\.
     8365.sp
     8366You can map Windows usernames that have spaces in them by using double quotes around the name\. For example:
     8367.sp
     8368.RS 4
    68738369.nf
    6874 
    68758370tridge = "Andrew Tridgell"
    6876 
    68778371.fi
    6878 would map the windows username "Andrew Tridgell" to the unix username "tridge".
    6879 .sp
    6880 The following example would map mary and fred to the unix user sys, and map the rest to guest. Note the use of the '!' to tell Samba to stop processing if it gets a match on that line:
    6881 
    6882 .sp
    6883 
     8372.RE
     8373.sp
     8374would map the windows username "Andrew Tridgell" to the unix username "tridge"\.
     8375.sp
     8376The following example would map mary and fred to the unix user sys, and map the rest to guest\. Note the use of the \'!\' to tell Samba to stop processing if it gets a match on that line:
     8377.sp
     8378.RS 4
    68848379.nf
    6885 
    68868380!sys = mary fred
    68878381guest = *
    6888 
    68898382.fi
    6890 
    6891 .sp
    6892 Note that the remapping is applied to all occurrences of usernames. Thus if you connect to \\server\fred and
     8383.RE
     8384.sp
     8385.sp
     8386Note that the remapping is applied to all occurrences of usernames\. Thus if you connect to \e\eserver\efred and
    68938387\fBfred\fR
    68948388is remapped to
    68958389\fBmary\fR
    6896 then you will actually be connecting to \\server\mary and will need to supply a password suitable for
     8390then you will actually be connecting to \e\eserver\emary and will need to supply a password suitable for
    68978391\fBmary\fR
    68988392not
    6899 \fBfred\fR. The only exception to this is the username passed to the
    6900 password server (if you have one). The password server will receive whatever username the client supplies without modification.
    6901 .sp
    6902 Also note that no reverse mapping is done. The main effect this has is with printing. Users who have been mapped may have trouble deleting print jobs as PrintManager under WfWg will think they don't own the print job.
    6903 .sp
    6904 Samba versions prior to 3.0.8 would only support reading the fully qualified username (e.g.: DOMAIN\user) from the username map when performing a kerberos login from a client. However, when looking up a map entry for a user authenticated by NTLM[SSP], only the login name would be used for matches. This resulted in inconsistent behavior sometimes even on the same server.
    6905 .sp
    6906 The following functionality is obeyed in version 3.0.8 and later:
    6907 .sp
    6908 When performing local authentication, the username map is applied to the login name before attempting to authenticate the connection.
    6909 .sp
    6910 When relying upon a external domain controller for validating authentication requests, smbd will apply the username map to the fully qualified username (i.e. DOMAIN\user) only after the user has been successfully authenticated.
     8393\fBfred\fR\. The only exception to this is the username passed to the
     8394\fIpassword server\fR
     8395(if you have one)\. The password server will receive whatever username the client supplies without modification\.
     8396.sp
     8397Also note that no reverse mapping is done\. The main effect this has is with printing\. Users who have been mapped may have trouble deleting print jobs as PrintManager under WfWg will think they don\'t own the print job\.
     8398.sp
     8399Samba versions prior to 3\.0\.8 would only support reading the fully qualified username (e\.g\.:
     8400DOMAIN\euser) from the username map when performing a kerberos login from a client\. However, when looking up a map entry for a user authenticated by NTLM[SSP], only the login name would be used for matches\. This resulted in inconsistent behavior sometimes even on the same server\.
     8401.sp
     8402The following functionality is obeyed in version 3\.0\.8 and later:
     8403.sp
     8404When performing local authentication, the username map is applied to the login name before attempting to authenticate the connection\.
     8405.sp
     8406When relying upon a external domain controller for validating authentication requests, smbd will apply the username map to the fully qualified username (i\.e\.
     8407DOMAIN\euser) only after the user has been successfully authenticated\.
    69118408.sp
    69128409An example of use is:
    6913 
    6914 .sp
    6915 
     8410.sp
     8411.RS 4
    69168412.nf
    6917 
    6918 username map = /usr/local/samba/lib/users.map
    6919 
     8413username map = /usr/local/samba/lib/users\.map
    69208414.fi
    6921 
    6922 .sp
    6923 Default:
    6924 \fB\fIusername map\fR = # no username map \fR
    6925 .RE
    6926 .PP
    6927 username map script (G)
    6928 .RS 3n
    6929 This script is a mutually exclusive alternative to the
    6930 username map parameter. This parameter specifies and external program or script that must accept a single command line option (the username transmitted in the authentication request) and return a line line on standard output (the name to which the account should mapped). In this way, it is possible to store username map tables in an LDAP or NIS directory services.
    6931 .sp
    6932 Default:
    6933 \fB\fIusername map script\fR = \fR
    6934 .sp
    6935 Example:
    6936 \fB\fIusername map script\fR = /etc/samba/scripts/mapusers.sh \fR
    6937 .RE
    6938 .PP
     8415.RE
     8416.sp
     8417.sp
     8418Default:
     8419\fI\fIusername map\fR\fR\fI = \fR\fI # no username map\fR\fI \fR
     8420.RE
     8421user.PP
     8422.RS 4
     8423This parameter is a synonym for
     8424username\.
     8425.RE
     8426users.PP
     8427.RS 4
     8428This parameter is a synonym for
     8429username\.
     8430.RE
     8431
     8432username (S)
     8433.PP
     8434.RS 4
     8435Multiple users may be specified in a comma\-delimited list, in which case the supplied password will be tested against each username in turn (left to right)\.
     8436.sp
     8437The
     8438\fIusername\fR
     8439line is needed only when the PC is unable to supply its own username\. This is the case for the COREPLUS protocol or where your users have different WfWg usernames to UNIX usernames\. In both these cases you may also be better using the \e\eserver\eshare%user syntax instead\.
     8440.sp
     8441The
     8442\fIusername\fR
     8443line is not a great solution in many cases as it means Samba will try to validate the supplied password against each of the usernames in the
     8444\fIusername\fR
     8445line in turn\. This is slow and a bad idea for lots of users in case of duplicate passwords\. You may get timeouts or security breaches using this parameter unwisely\.
     8446.sp
     8447Samba relies on the underlying UNIX security\. This parameter does not restrict who can login, it just offers hints to the Samba server as to what usernames might correspond to the supplied password\. Users can login as whoever they please and they will be able to do no more damage than if they started a telnet session\. The daemon runs as the user that they log in as, so they cannot do anything that user cannot do\.
     8448.sp
     8449To restrict a service to a particular set of users you can use the
     8450\fIvalid users\fR
     8451parameter\.
     8452.sp
     8453If any of the usernames begin with a \'@\' then the name will be looked up first in the NIS netgroups list (if Samba is compiled with netgroup support), followed by a lookup in the UNIX groups database and will expand to a list of all users in the group of that name\.
     8454.sp
     8455If any of the usernames begin with a \'+\' then the name will be looked up only in the UNIX groups database and will expand to a list of all users in the group of that name\.
     8456.sp
     8457If any of the usernames begin with a \'&\' then the name will be looked up only in the NIS netgroups database (if Samba is compiled with netgroup support) and will expand to a list of all users in the netgroup group of that name\.
     8458.sp
     8459Note that searching though a groups database can take quite some time, and some clients may time out during the search\.
     8460.sp
     8461See the section
     8462NOTE ABOUT USERNAME/PASSWORD VALIDATION
     8463for more information on how this parameter determines access to the services\.
     8464.sp
     8465Default:
     8466\fI\fIusername\fR\fR\fI = \fR\fI # The guest account if a guest service, else <empty string>\.\fR\fI \fR
     8467.sp
     8468Example:
     8469\fI\fIusername\fR\fR\fI = \fR\fIfred, mary, jack, jane, @users, @pcgroup\fR\fI \fR
     8470.RE
     8471
    69398472usershare allow guests (G)
    6940 .RS 3n
    6941 This parameter controls whether user defined shares are allowed to be accessed by non-authenticated users or not. It is the equivalent of allowing people who can create a share the option of setting
     8473.PP
     8474.RS 4
     8475This parameter controls whether user defined shares are allowed to be accessed by non\-authenticated users or not\. It is the equivalent of allowing people who can create a share the option of setting
    69428476\fIguest ok = yes\fR
    6943 in a share definition. Due to the security sensitive nature of this the default is set to off.
    6944 .sp
    6945 Default:
    6946 \fB\fIusershare allow guests\fR = no \fR
    6947 .RE
    6948 .PP
     8477in a share definition\. Due to the security sensitive nature of this the default is set to off\.
     8478.sp
     8479Default:
     8480\fI\fIusershare allow guests\fR\fR\fI = \fR\fIno\fR\fI \fR
     8481.RE
     8482
    69498483usershare max shares (G)
    6950 .RS 3n
    6951 This parameter specifies the number of user defined shares that are allowed to be created by users belonging to the group owning the usershare directory. If set to zero (the default) user defined shares are ignored.
    6952 .sp
    6953 Default:
    6954 \fB\fIusershare max shares\fR = 0 \fR
    6955 .RE
    6956 .PP
     8484.PP
     8485.RS 4
     8486This parameter specifies the number of user defined shares that are allowed to be created by users belonging to the group owning the usershare directory\. If set to zero (the default) user defined shares are ignored\.
     8487.sp
     8488Default:
     8489\fI\fIusershare max shares\fR\fR\fI = \fR\fI0\fR\fI \fR
     8490.RE
     8491
    69578492usershare owner only (G)
    6958 .RS 3n
    6959 This parameter controls whether the pathname exported by a user defined shares must be owned by the user creating the user defined share or not. If set to True (the default) then smbd checks that the directory path being shared is owned by the user who owns the usershare file defining this share and refuses to create the share if not. If set to False then no such check is performed and any directory path may be exported regardless of who owns it.
    6960 .sp
    6961 Default:
    6962 \fB\fIusershare owner only\fR = True \fR
    6963 .RE
    6964 .PP
     8493.PP
     8494.RS 4
     8495This parameter controls whether the pathname exported by a user defined shares must be owned by the user creating the user defined share or not\. If set to True (the default) then smbd checks that the directory path being shared is owned by the user who owns the usershare file defining this share and refuses to create the share if not\. If set to False then no such check is performed and any directory path may be exported regardless of who owns it\.
     8496.sp
     8497Default:
     8498\fI\fIusershare owner only\fR\fR\fI = \fR\fITrue\fR\fI \fR
     8499.RE
     8500
    69658501usershare path (G)
    6966 .RS 3n
    6967 This parameter specifies the absolute path of the directory on the filesystem used to store the user defined share definition files. This directory must be owned by root, and have no access for other, and be writable only by the group owner. In addition the "sticky" bit must also be set, restricting rename and delete to owners of a file (in the same way the /tmp directory is usually configured). Members of the group owner of this directory are the users allowed to create usershares. If this parameter is undefined then no user defined shares are allowed.
    6968 .sp
    6969 For example, a valid usershare directory might be /usr/local/samba/lib/usershares, set up as follows.
    6970 .sp
    6971 
    6972 
    6973 .sp
    6974 
     8502.PP
     8503.RS 4
     8504This parameter specifies the absolute path of the directory on the filesystem used to store the user defined share definition files\. This directory must be owned by root, and have no access for other, and be writable only by the group owner\. In addition the "sticky" bit must also be set, restricting rename and delete to owners of a file (in the same way the /tmp directory is usually configured)\. Members of the group owner of this directory are the users allowed to create usershares\. If this parameter is undefined then no user defined shares are allowed\.
     8505.sp
     8506For example, a valid usershare directory might be /usr/local/samba/lib/usershares, set up as follows\.
     8507.sp
     8508
     8509.sp
     8510.RS 4
    69758511.nf
    6976 
    6977         ls -ld /usr/local/samba/lib/usershares/
    6978         drwxrwx--T  2 root power_users 4096 2006-05-05 12:27 /usr/local/samba/lib/usershares/
     8512        ls \-ld /usr/local/samba/lib/usershares/
     8513        drwxrwx\-\-T  2 root power_users 4096 2006\-05\-05 12:27 /usr/local/samba/lib/usershares/
    69798514       
    69808515.fi
    6981 
    6982 .sp
    6983 In this case, only members of the group "power_users" can create user defined shares.
    6984 .sp
    6985 Default:
    6986 \fB\fIusershare path\fR = NULL \fR
    6987 .RE
    6988 .PP
     8516.RE
     8517.sp
     8518.sp
     8519In this case, only members of the group "power_users" can create user defined shares\.
     8520.sp
     8521Default:
     8522\fI\fIusershare path\fR\fR\fI = \fR\fINULL\fR\fI \fR
     8523.RE
     8524
    69898525usershare prefix allow list (G)
    6990 .RS 3n
    6991 This parameter specifies a list of absolute pathnames the root of which are allowed to be exported by user defined share definitions. If the pathname exported doesn't start with one of the strings in this list the user defined share will not be allowed. This allows the Samba administrator to restrict the directories on the system that can be exported by user defined shares.
    6992 .sp
    6993 If there is a "usershare prefix deny list" and also a "usershare prefix allow list" the deny list is processed first, followed by the allow list, thus leading to the most restrictive interpretation.
    6994 .sp
    6995 Default:
    6996 \fB\fIusershare prefix allow list\fR = NULL \fR
    6997 .sp
    6998 Example:
    6999 \fB\fIusershare prefix allow list\fR = /home /data /space \fR
    7000 .RE
    7001 .PP
     8526.PP
     8527.RS 4
     8528This parameter specifies a list of absolute pathnames the root of which are allowed to be exported by user defined share definitions\. If the pathname exported doesn\'t start with one of the strings in this list the user defined share will not be allowed\. This allows the Samba administrator to restrict the directories on the system that can be exported by user defined shares\.
     8529.sp
     8530If there is a "usershare prefix deny list" and also a "usershare prefix allow list" the deny list is processed first, followed by the allow list, thus leading to the most restrictive interpretation\.
     8531.sp
     8532Default:
     8533\fI\fIusershare prefix allow list\fR\fR\fI = \fR\fINULL\fR\fI \fR
     8534.sp
     8535Example:
     8536\fI\fIusershare prefix allow list\fR\fR\fI = \fR\fI/home /data /space\fR\fI \fR
     8537.RE
     8538
    70028539usershare prefix deny list (G)
    7003 .RS 3n
    7004 This parameter specifies a list of absolute pathnames the root of which are NOT allowed to be exported by user defined share definitions. If the pathname exported starts with one of the strings in this list the user defined share will not be allowed. Any pathname not starting with one of these strings will be allowed to be exported as a usershare. This allows the Samba administrator to restrict the directories on the system that can be exported by user defined shares.
    7005 .sp
    7006 If there is a "usershare prefix deny list" and also a "usershare prefix allow list" the deny list is processed first, followed by the allow list, thus leading to the most restrictive interpretation.
    7007 .sp
    7008 Default:
    7009 \fB\fIusershare prefix deny list\fR = NULL \fR
    7010 .sp
    7011 Example:
    7012 \fB\fIusershare prefix deny list\fR = /etc /dev /private \fR
    7013 .RE
    7014 .PP
     8540.PP
     8541.RS 4
     8542This parameter specifies a list of absolute pathnames the root of which are NOT allowed to be exported by user defined share definitions\. If the pathname exported starts with one of the strings in this list the user defined share will not be allowed\. Any pathname not starting with one of these strings will be allowed to be exported as a usershare\. This allows the Samba administrator to restrict the directories on the system that can be exported by user defined shares\.
     8543.sp
     8544If there is a "usershare prefix deny list" and also a "usershare prefix allow list" the deny list is processed first, followed by the allow list, thus leading to the most restrictive interpretation\.
     8545.sp
     8546Default:
     8547\fI\fIusershare prefix deny list\fR\fR\fI = \fR\fINULL\fR\fI \fR
     8548.sp
     8549Example:
     8550\fI\fIusershare prefix deny list\fR\fR\fI = \fR\fI/etc /dev /private\fR\fI \fR
     8551.RE
     8552
    70158553usershare template share (G)
    7016 .RS 3n
    7017 User defined shares only have limited possible parameters such as path, guest ok etc. This parameter allows usershares to "cloned" from an existing share. If "usershare template share" is set to the name of an existing share, then all usershares created have their defaults set from the parameters set on this share.
    7018 .sp
    7019 The target share may be set to be invalid for real file sharing by setting the parameter "-valid = False" on the template share definition. This causes it not to be seen as a real exported share but to be able to be used as a template for usershares.
    7020 .sp
    7021 Default:
    7022 \fB\fIusershare template share\fR = NULL \fR
    7023 .sp
    7024 Example:
    7025 \fB\fIusershare template share\fR = template_share \fR
    7026 .RE
    7027 .PP
     8554.PP
     8555.RS 4
     8556User defined shares only have limited possible parameters such as path, guest ok etc\. This parameter allows usershares to "cloned" from an existing share\. If "usershare template share" is set to the name of an existing share, then all usershares created have their defaults set from the parameters set on this share\.
     8557.sp
     8558The target share may be set to be invalid for real file sharing by setting the parameter "\-valid = False" on the template share definition\. This causes it not to be seen as a real exported share but to be able to be used as a template for usershares\.
     8559.sp
     8560Default:
     8561\fI\fIusershare template share\fR\fR\fI = \fR\fINULL\fR\fI \fR
     8562.sp
     8563Example:
     8564\fI\fIusershare template share\fR\fR\fI = \fR\fItemplate_share\fR\fI \fR
     8565.RE
     8566
    70288567use sendfile (S)
    7029 .RS 3n
     8568.PP
     8569.RS 4
    70308570If this parameter is
    70318571\fByes\fR, and the
    70328572\fBsendfile()\fR
    7033 system call is supported by the underlying operating system, then some SMB read calls (mainly ReadAndX and ReadRaw) will use the more efficient sendfile system call for files that are exclusively oplocked. This may make more efficient use of the system CPU's and cause Samba to be faster. Samba automatically turns this off for clients that use protocol levels lower than NT LM 0.12 and when it detects a client is Windows 9x (using sendfile from Linux will cause these clients to fail).
    7034 .sp
    7035 Default:
    7036 \fB\fIuse sendfile\fR = false \fR
    7037 .RE
    7038 .PP
     8573system call is supported by the underlying operating system, then some SMB read calls (mainly ReadAndX and ReadRaw) will use the more efficient sendfile system call for files that are exclusively oplocked\. This may make more efficient use of the system CPU\'s and cause Samba to be faster\. Samba automatically turns this off for clients that use protocol levels lower than NT LM 0\.12 and when it detects a client is Windows 9x (using sendfile from Linux will cause these clients to fail)\.
     8574.sp
     8575Default:
     8576\fI\fIuse sendfile\fR\fR\fI = \fR\fIfalse\fR\fI \fR
     8577.RE
     8578
    70398579use spnego (G)
    7040 .RS 3n
    7041 This variable controls controls whether samba will try to use Simple and Protected NEGOciation (as specified by rfc2478) with WindowsXP and Windows2000 clients to agree upon an authentication mechanism.
    7042 .sp
    7043 Unless further issues are discovered with our SPNEGO implementation, there is no reason this should ever be disabled.
    7044 .sp
    7045 Default:
    7046 \fB\fIuse spnego\fR = yes \fR
    7047 .RE
    7048 .PP
     8580.PP
     8581.RS 4
     8582This variable controls controls whether samba will try to use Simple and Protected NEGOciation (as specified by rfc2478) with WindowsXP and Windows2000 clients to agree upon an authentication mechanism\.
     8583.sp
     8584Unless further issues are discovered with our SPNEGO implementation, there is no reason this should ever be disabled\.
     8585.sp
     8586Default:
     8587\fI\fIuse spnego\fR\fR\fI = \fR\fIyes\fR\fI \fR
     8588.RE
     8589
     8590utmp directory (G)
     8591.PP
     8592.RS 4
     8593This parameter is only available if Samba has been configured and compiled with the option
     8594\-\-with\-utmp\. It specifies a directory pathname that is used to store the utmp or utmpx files (depending on the UNIX system) that record user connections to a Samba server\. By default this is not set, meaning the system will use whatever utmp file the native system is set to use (usually
     8595\fI/var/run/utmp\fR
     8596on Linux)\.
     8597.sp
     8598Default:
     8599\fI\fIutmp directory\fR\fR\fI = \fR\fI # Determined automatically\fR\fI \fR
     8600.sp
     8601Example:
     8602\fI\fIutmp directory\fR\fR\fI = \fR\fI/var/run/utmp\fR\fI \fR
     8603.RE
     8604
    70498605utmp (G)
    7050 .RS 3n
     8606.PP
     8607.RS 4
    70518608This boolean parameter is only available if Samba has been configured and compiled with the option
    7052 --with-utmp. If set to
     8609\-\-with\-utmp\. If set to
    70538610\fByes\fR
    7054 then Samba will attempt to add utmp or utmpx records (depending on the UNIX system) whenever a connection is made to a Samba server. Sites may use this to record the user connecting to a Samba share.
    7055 .sp
    7056 Due to the requirements of the utmp record, we are required to create a unique identifier for the incoming user. Enabling this option creates an n^2 algorithm to find this number. This may impede performance on large installations.
    7057 .sp
    7058 Default:
    7059 \fB\fIutmp\fR = no \fR
    7060 .RE
    7061 .PP
    7062 utmp directory (G)
    7063 .RS 3n
    7064 This parameter is only available if Samba has been configured and compiled with the option
    7065 --with-utmp. It specifies a directory pathname that is used to store the utmp or utmpx files (depending on the UNIX system) that record user connections to a Samba server. By default this is not set, meaning the system will use whatever utmp file the native system is set to use (usually
    7066 \fI/var/run/utmp\fR
    7067 on Linux).
    7068 .sp
    7069 Default:
    7070 \fB\fIutmp directory\fR = # Determined automatically \fR
    7071 .sp
    7072 Example:
    7073 \fB\fIutmp directory\fR = /var/run/utmp \fR
    7074 .RE
    7075 .PP
    7076 -valid (S)
    7077 .RS 3n
    7078 This parameter indicates whether a share is valid and thus can be used. When this parameter is set to false, the share will be in no way visible nor accessible.
    7079 .sp
    7080 This option should not be used by regular users but might be of help to developers. Samba uses this option internally to mark shares as deleted.
    7081 .sp
    7082 Default:
    7083 \fB\fI-valid\fR = yes \fR
    7084 .RE
    7085 .PP
     8611then Samba will attempt to add utmp or utmpx records (depending on the UNIX system) whenever a connection is made to a Samba server\. Sites may use this to record the user connecting to a Samba share\.
     8612.sp
     8613Due to the requirements of the utmp record, we are required to create a unique identifier for the incoming user\. Enabling this option creates an n^2 algorithm to find this number\. This may impede performance on large installations\.
     8614.sp
     8615Default:
     8616\fI\fIutmp\fR\fR\fI = \fR\fIno\fR\fI \fR
     8617.RE
     8618
    70868619valid users (S)
    7087 .RS 3n
    7088 This is a list of users that should be allowed to login to this service. Names starting with '@', '+' and '&' are interpreted using the same rules as described in the
     8620.PP
     8621.RS 4
     8622This is a list of users that should be allowed to login to this service\. Names starting with \'@\', \'+\' and \'&\' are interpreted using the same rules as described in the
    70898623\fIinvalid users\fR
    7090 parameter.
    7091 .sp
    7092 If this is empty (the default) then any user can login. If a username is in both this list and the
     8624parameter\.
     8625.sp
     8626If this is empty (the default) then any user can login\. If a username is in both this list and the
    70938627\fIinvalid users\fR
    7094 list then access is denied for that user.
     8628list then access is denied for that user\.
    70958629.sp
    70968630The current servicename is substituted for
    7097 \fI%S\fR. This is useful in the [homes] section.
    7098 .sp
    7099 Default:
    7100 \fB\fIvalid users\fR = # No valid users list (anyone can login) \fR
    7101 .sp
    7102 Example:
    7103 \fB\fIvalid users\fR = greg, @pcusers \fR
    7104 .RE
    7105 .PP
     8631\fI%S\fR\. This is useful in the [homes] section\.
     8632.sp
     8633Default:
     8634\fI\fIvalid users\fR\fR\fI = \fR\fI # No valid users list (anyone can login) \fR\fI \fR
     8635.sp
     8636Example:
     8637\fI\fIvalid users\fR\fR\fI = \fR\fIgreg, @pcusers\fR\fI \fR
     8638.RE
     8639
     8640\-valid (S)
     8641.PP
     8642.RS 4
     8643This parameter indicates whether a share is valid and thus can be used\. When this parameter is set to false, the share will be in no way visible nor accessible\.
     8644.sp
     8645This option should not be used by regular users but might be of help to developers\. Samba uses this option internally to mark shares as deleted\.
     8646.sp
     8647Default:
     8648\fI\fI\-valid\fR\fR\fI = \fR\fIyes\fR\fI \fR
     8649.RE
     8650
    71068651veto files (S)
    7107 .RS 3n
    7108 This is a list of files and directories that are neither visible nor accessible. Each entry in the list must be separated by a '/', which allows spaces to be included in the entry. '*' and '?' can be used to specify multiple files or directories as in DOS wildcards.
     8652.PP
     8653.RS 4
     8654This is a list of files and directories that are neither visible nor accessible\. Each entry in the list must be separated by a \'/\', which allows spaces to be included in the entry\. \'*\' and \'?\' can be used to specify multiple files or directories as in DOS wildcards\.
    71098655.sp
    71108656Each entry must be a unix path, not a DOS path and must
    7111 \fBnot\fR
    7112 include the unix directory separator '/'.
     8657\fInot\fR
     8658include the unix directory separator \'/\'\.
    71138659.sp
    71148660Note that the
    7115 case sensitive option is applicable in vetoing files.
    7116 .sp
    7117 One feature of the veto files parameter that it is important to be aware of is Samba's behaviour when trying to delete a directory. If a directory that is to be deleted contains nothing but veto files this deletion will
    7118 \fBfail\fR
     8661\fIcase sensitive\fR
     8662option is applicable in vetoing files\.
     8663.sp
     8664One feature of the veto files parameter that it is important to be aware of is Samba\'s behaviour when trying to delete a directory\. If a directory that is to be deleted contains nothing but veto files this deletion will
     8665\fIfail\fR
    71198666unless you also set the
    7120 delete veto files parameter to
    7121 \fIyes\fR.
    7122 .sp
    7123 Setting this parameter will affect the performance of Samba, as it will be forced to check all files and directories for a match as they are scanned.
     8667\fIdelete veto files\fR
     8668parameter to
     8669\fIyes\fR\.
     8670.sp
     8671Setting this parameter will affect the performance of Samba, as it will be forced to check all files and directories for a match as they are scanned\.
    71248672.sp
    71258673Examples of use include:
    7126 
    7127 .sp
    7128 
     8674.sp
     8675.RS 4
    71298676.nf
    7130 
    71318677; Veto any files containing the word Security,
    7132 ; any ending in .tmp, and any directory containing the
    7133 ; word root.
    7134 veto files = /*Security*/*.tmp/*root*/
     8678; any ending in \.tmp, and any directory containing the
     8679; word root\.
     8680veto files = /*Security*/*\.tmp/*root*/
    71358681
    71368682; Veto the Apple specific files that a NetAtalk server
    7137 ; creates.
    7138 veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/
    7139 
     8683; creates\.
     8684veto files = /\.AppleDouble/\.bin/\.AppleDesktop/Network Trash Folder/
    71408685.fi
    7141 
    7142 .sp
    7143 Default:
    7144 \fB\fIveto files\fR = No files or directories are vetoed. \fR
    7145 .RE
    7146 .PP
     8686.RE
     8687.sp
     8688.sp
     8689Default:
     8690\fI\fIveto files\fR\fR\fI = \fR\fINo files or directories are vetoed\.\fR\fI \fR
     8691.RE
     8692
    71478693veto oplock files (S)
    7148 .RS 3n
     8694.PP
     8695.RS 4
    71498696This parameter is only valid when the
    7150 oplocks parameter is turned on for a share. It allows the Samba administrator to selectively turn off the granting of oplocks on selected files that match a wildcarded list, similar to the wildcarded list used in the
    7151 veto files parameter.
    7152 .sp
    7153 You might want to do this on files that you know will be heavily contended for by clients. A good example of this is in the NetBench SMB benchmark program, which causes heavy client contention for files ending in
    7154 \fI.SEM\fR. To cause Samba not to grant oplocks on these files you would use the line (either in the [global] section or in the section for the particular NetBench share.
     8697\fIoplocks\fR
     8698parameter is turned on for a share\. It allows the Samba administrator to selectively turn off the granting of oplocks on selected files that match a wildcarded list, similar to the wildcarded list used in the
     8699\fIveto files\fR
     8700parameter\.
     8701.sp
     8702You might want to do this on files that you know will be heavily contended for by clients\. A good example of this is in the NetBench SMB benchmark program, which causes heavy client contention for files ending in
     8703\fI\.SEM\fR\. To cause Samba not to grant oplocks on these files you would use the line (either in the [global] section or in the section for the particular NetBench share\.
    71558704.sp
    71568705An example of use is:
    7157 
    7158 .sp
    7159 
     8706.sp
     8707.RS 4
    71608708.nf
    7161 
    7162 veto oplock files = /.*SEM/
    7163 
     8709veto oplock files = /\.*SEM/
    71648710.fi
    7165 
    7166 .sp
    7167 Default:
    7168 \fB\fIveto oplock files\fR = # No files are vetoed for oplock grants \fR
    7169 .RE
    7170 .PP
    7171 vfs object
    7172 .RS 3n
    7173 This parameter is a synonym for vfs objects.
    7174 .RE
    7175 .PP
     8711.RE
     8712.sp
     8713.sp
     8714Default:
     8715\fI\fIveto oplock files\fR\fR\fI = \fR\fI # No files are vetoed for oplock grants\fR\fI \fR
     8716.RE
     8717vfs object.PP
     8718.RS 4
     8719This parameter is a synonym for
     8720vfs objects\.
     8721.RE
     8722
    71768723vfs objects (S)
    7177 .RS 3n
    7178 This parameter specifies the backend names which are used for Samba VFS I/O operations. By default, normal disk I/O operations are used but these can be overloaded with one or more VFS objects.
    7179 .sp
    7180 Default:
    7181 \fB\fIvfs objects\fR = \fR
    7182 .sp
    7183 Example:
    7184 \fB\fIvfs objects\fR = extd_audit recycle \fR
    7185 .RE
    7186 .PP
     8724.PP
     8725.RS 4
     8726This parameter specifies the backend names which are used for Samba VFS I/O operations\. By default, normal disk I/O operations are used but these can be overloaded with one or more VFS objects\.
     8727.sp
     8728Default:
     8729\fI\fIvfs objects\fR\fR\fI = \fR\fI\fR\fI \fR
     8730.sp
     8731Example:
     8732\fI\fIvfs objects\fR\fR\fI = \fR\fIextd_audit recycle\fR\fI \fR
     8733.RE
     8734
    71878735volume (S)
    7188 .RS 3n
    7189 This allows you to override the volume label returned for a share. Useful for CDROMs with installation programs that insist on a particular volume label.
    7190 .sp
    7191 Default:
    7192 \fB\fIvolume\fR = # the name of the share \fR
    7193 .RE
    7194 .PP
     8736.PP
     8737.RS 4
     8738This allows you to override the volume label returned for a share\. Useful for CDROMs with installation programs that insist on a particular volume label\.
     8739.sp
     8740Default:
     8741\fI\fIvolume\fR\fR\fI = \fR\fI # the name of the share\fR\fI \fR
     8742.RE
     8743
    71958744wide links (S)
    7196 .RS 3n
    7197 This parameter controls whether or not links in the UNIX file system may be followed by the server. Links that point to areas within the directory tree exported by the server are always allowed; this parameter controls access only to areas that are outside the directory tree being exported.
    7198 .sp
    7199 Note that setting this parameter can have a negative effect on your server performance due to the extra system calls that Samba has to do in order to perform the link checks.
    7200 .sp
    7201 Default:
    7202 \fB\fIwide links\fR = yes \fR
    7203 .RE
    7204 .PP
     8745.PP
     8746.RS 4
     8747This parameter controls whether or not links in the UNIX file system may be followed by the server\. Links that point to areas within the directory tree exported by the server are always allowed; this parameter controls access only to areas that are outside the directory tree being exported\.
     8748.sp
     8749Note that setting this parameter can have a negative effect on your server performance due to the extra system calls that Samba has to do in order to perform the link checks\.
     8750.sp
     8751Default:
     8752\fI\fIwide links\fR\fR\fI = \fR\fIyes\fR\fI \fR
     8753.RE
     8754
    72058755winbind cache time (G)
    7206 .RS 3n
     8756.PP
     8757.RS 4
    72078758This parameter specifies the number of seconds the
    72088759\fBwinbindd\fR(8)
    7209 daemon will cache user and group information before querying a Windows NT server again.
     8760daemon will cache user and group information before querying a Windows NT server again\.
    72108761.sp
    72118762This does not apply to authentication requests, these are always evaluated in real time unless the
    7212 winbind offline logon option has been enabled.
    7213 .sp
    7214 Default:
    7215 \fB\fIwinbind cache time\fR = 300 \fR
    7216 .RE
    7217 .PP
     8763\fIwinbind offline logon\fR
     8764option has been enabled\.
     8765.sp
     8766Default:
     8767\fI\fIwinbind cache time\fR\fR\fI = \fR\fI300\fR\fI \fR
     8768.RE
     8769
    72188770winbind enum groups (G)
    7219 .RS 3n
     8771.PP
     8772.RS 4
    72208773On large installations using
    72218774\fBwinbindd\fR(8)
    … …  
    72258778and
    72268779endgrent()
    7227 group of system calls. If the
     8780group of system calls\. If the
    72288781\fIwinbind enum groups\fR
    72298782parameter is
    72308783\fBno\fR, calls to the
    72318784getgrent()
    7232 system call will not return any data.
     8785system call will not return any data\.
    72338786.sp
    72348787.it 1 an-trap
    … …  
    72368789.nr an-break-flag 1
    72378790.br
    7238 \fBWarning\fR
    7239 Turning off group enumeration may cause some programs to behave oddly.
    7240 Default:
    7241 \fB\fIwinbind enum groups\fR = no \fR
    7242 .RE
    7243 .PP
     8791Warning
     8792Turning off group enumeration may cause some programs to behave oddly\.
     8793
     8794Default:
     8795\fI\fIwinbind enum groups\fR\fR\fI = \fR\fIno\fR\fI \fR
     8796.RE
     8797
    72448798winbind enum users (G)
    7245 .RS 3n
     8799.PP
     8800.RS 4
    72468801On large installations using
    72478802\fBwinbindd\fR(8)
    … …  
    72518806and
    72528807endpwent()
    7253 group of system calls. If the
     8808group of system calls\. If the
    72548809\fIwinbind enum users\fR
    72558810parameter is
    72568811\fBno\fR, calls to the
    72578812getpwent
    7258 system call will not return any data.
     8813system call will not return any data\.
    72598814.sp
    72608815.it 1 an-trap
    … …  
    72628817.nr an-break-flag 1
    72638818.br
    7264 \fBWarning\fR
    7265 Turning off user enumeration may cause some programs to behave oddly. For example, the finger program relies on having access to the full user list when searching for matching usernames.
    7266 Default:
    7267 \fB\fIwinbind enum users\fR = no \fR
    7268 .RE
    7269 .PP
    7270 winbind expand groups (G)
    7271 .RS 3n
    7272 This option controls the maximum depth that winbindd will traverse when flattening nested group memberships of Windows domain groups. This is different from the
    7273 winbind nested groups option which implements the Windows NT4 model of local group nesting. The "winbind expand groups" parameter specifically applies to the membership of domain groups.
    7274 .sp
    7275 Be aware that a high value for this parameter can result in system slowdown as the main parent winbindd daemon must perform the group unrolling and will be unable to answer incoming NSS or authentication requests during this time.
    7276 .sp
    7277 Default:
    7278 \fB\fIwinbind expand groups\fR = 1 \fR
    7279 .RE
    7280 .PP
     8819Warning
     8820Turning off user enumeration may cause some programs to behave oddly\. For example, the finger program relies on having access to the full user list when searching for matching usernames\.
     8821
     8822Default:
     8823\fI\fIwinbind enum users\fR\fR\fI = \fR\fIno\fR\fI \fR
     8824.RE
     8825
    72818826winbind nested groups (G)
    7282 .RS 3n
    7283 If set to yes, this parameter activates the support for nested groups. Nested groups are also called local groups or aliases. They work like their counterparts in Windows: Nested groups are defined locally on any machine (they are shared between DC's through their SAM) and can contain users and global groups from any trusted SAM. To be able to use nested groups, you need to run nss_winbind.
    7284 .sp
    7285 Default:
    7286 \fB\fIwinbind nested groups\fR = yes \fR
    7287 .RE
    7288 .PP
     8827.PP
     8828.RS 4
     8829If set to yes, this parameter activates the support for nested groups\. Nested groups are also called local groups or aliases\. They work like their counterparts in Windows: Nested groups are defined locally on any machine (they are shared between DC\'s through their SAM) and can contain users and global groups from any trusted SAM\. To be able to use nested groups, you need to run nss_winbind\.
     8830.sp
     8831Default:
     8832\fI\fIwinbind nested groups\fR\fR\fI = \fR\fIyes\fR\fI \fR
     8833.RE
     8834
    72898835winbind normalize names (G)
    7290 .RS 3n
    7291 This parameter controls whether winbindd will replace whitespace in user and group names with an underscore (_) character. For example, whether the name "Space Kadet" should be replaced with the string "space_kadet". Frequently Unix shell scripts will have difficulty with usernames contains whitespace due to the default field separator in the shell. Do not enable this option if the underscore character is used in account names within your domain
    7292 .sp
    7293 Default:
    7294 \fB\fIwinbind normalize names\fR = no \fR
    7295 .sp
    7296 Example:
    7297 \fB\fIwinbind normalize names\fR = yes \fR
    7298 .RE
    7299 .PP
     8836.PP
     8837.RS 4
     8838This parameter controls whether winbindd will replace whitespace in user and group names with an underscore (_) character\. For example, whether the name "Space Kadet" should be replaced with the string "space_kadet"\. Frequently Unix shell scripts will have difficulty with usernames contains whitespace due to the default field separator in the shell\. Do not enable this option if the underscore character is used in account names within your domain
     8839.sp
     8840Default:
     8841\fI\fIwinbind normalize names\fR\fR\fI = \fR\fIno\fR\fI \fR
     8842.sp
     8843Example:
     8844\fI\fIwinbind normalize names\fR\fR\fI = \fR\fIyes\fR\fI \fR
     8845.RE
     8846
    73008847winbind nss info (G)
    7301 .RS 3n
    7302 This parameter is designed to control how Winbind retrieves Name Service Information to construct a user's home directory and login shell. Currently the following settings are available:
    7303 .RS 3n
    7304 .TP 3n
    7305 \(bu
     8848.PP
     8849.RS 4
     8850This parameter is designed to control how Winbind retrieves Name Service Information to construct a user\'s home directory and login shell\. Currently the following settings are available:
     8851.sp
     8852.RS 4
     8853.ie n \{\
     8854\h'-04'\(bu\h'+03'\c
     8855.\}
     8856.el \{\
     8857.sp -1
     8858.IP \(bu 2.3
     8859.\}
    73068860\fItemplate\fR
    7307 - The default, using the parameters of
     8861\- The default, using the parameters of
    73088862\fItemplate shell\fR
    73098863and
    73108864\fItemplate homedir\fR)
    7311 .TP 3n
    7312 \(bu
    7313 \fIsfu\fR
    7314 - When Samba is running in security = ads and your Active Directory Domain Controller does support the Microsoft "Services for Unix" (SFU) LDAP schema, winbind can retrieve the login shell and the home directory attributes directly from your Directory Server. Note that retrieving UID and GID from your ADS-Server requires to use
     8865.RE
     8866.sp
     8867.RS 4
     8868.ie n \{\
     8869\h'-04'\(bu\h'+03'\c
     8870.\}
     8871.el \{\
     8872.sp -1
     8873.IP \(bu 2.3
     8874.\}
     8875\fI<sfu | rfc2307 >\fR
     8876\- When Samba is running in security = ads and your Active Directory Domain Controller does support the Microsoft "Services for Unix" (SFU) LDAP schema, winbind can retrieve the login shell and the home directory attributes directly from your Directory Server\. Note that retrieving UID and GID from your ADS\-Server requires to use
    73158877\fIidmap backend\fR
    7316 = idmap_ad as well.
    7317 .RE
    7318 .IP "" 3n
    7319 
    7320 .sp
    7321 Default:
    7322 \fB\fIwinbind nss info\fR = template \fR
    7323 .sp
    7324 Example:
    7325 \fB\fIwinbind nss info\fR = template sfu \fR
    7326 .RE
    7327 .PP
     8878= ad or
     8879\fIidmap config DOMAIN:backend\fR
     8880= ad as well\.
     8881.sp
     8882.RE
     8883.sp
     8884Default:
     8885\fI\fIwinbind nss info\fR\fR\fI = \fR\fItemplate\fR\fI \fR
     8886.sp
     8887Example:
     8888\fI\fIwinbind nss info\fR\fR\fI = \fR\fItemplate sfu\fR\fI \fR
     8889.RE
     8890
    73288891winbind offline logon (G)
    7329 .RS 3n
     8892.PP
     8893.RS 4
    73308894This parameter is designed to control whether Winbind should allow to login with the
    73318895\fIpam_winbind\fR
    7332 module using Cached Credentials. If enabled, winbindd will store user credentials from successful logins encrypted in a local cache.
    7333 .sp
    7334 Default:
    7335 \fB\fIwinbind offline logon\fR = false \fR
    7336 .sp
    7337 Example:
    7338 \fB\fIwinbind offline logon\fR = true \fR
    7339 .RE
    7340 .PP
     8896module using Cached Credentials\. If enabled, winbindd will store user credentials from successful logins encrypted in a local cache\.
     8897.sp
     8898Default:
     8899\fI\fIwinbind offline logon\fR\fR\fI = \fR\fIfalse\fR\fI \fR
     8900.sp
     8901Example:
     8902\fI\fIwinbind offline logon\fR\fR\fI = \fR\fItrue\fR\fI \fR
     8903.RE
     8904
    73418905winbind refresh tickets (G)
    7342 .RS 3n
     8906.PP
     8907.RS 4
    73438908This parameter is designed to control whether Winbind should refresh Kerberos Tickets retrieved using the
    73448909\fIpam_winbind\fR
    7345 module.
    7346 .sp
    7347 Default:
    7348 \fB\fIwinbind refresh tickets\fR = false \fR
    7349 .sp
    7350 Example:
    7351 \fB\fIwinbind refresh tickets\fR = true \fR
    7352 .RE
    7353 .PP
    7354 winbind rpc only (G)
    7355 .RS 3n
    7356 Setting this parameter to
    7357 yes
    7358 forces winbindd to use RPC instead of LDAP to retrieve information from Domain Controllers.
    7359 .sp
    7360 Default:
    7361 \fB\fIwinbind rpc only\fR = no \fR
    7362 .RE
    7363 .PP
     8910module\.
     8911.sp
     8912Default:
     8913\fI\fIwinbind refresh tickets\fR\fR\fI = \fR\fIfalse\fR\fI \fR
     8914.sp
     8915Example:
     8916\fI\fIwinbind refresh tickets\fR\fR\fI = \fR\fItrue\fR\fI \fR
     8917.RE
     8918
    73648919winbind separator (G)
    7365 .RS 3n
     8920.PP
     8921.RS 4
    73668922This parameter allows an admin to define the character used when listing a username of the form of
    7367 \fIDOMAIN \fR\\fIuser\fR. This parameter is only applicable when using the
    7368 \fIpam_winbind.so\fR
     8923\fIDOMAIN \fR\e\fIuser\fR\. This parameter is only applicable when using the
     8924\fIpam_winbind\.so\fR
    73698925and
    7370 \fInss_winbind.so\fR
    7371 modules for UNIX services.
    7372 .sp
    7373 Please note that setting this parameter to + causes problems with group membership at least on glibc systems, as the character + is used as a special character for NIS in /etc/group.
    7374 .sp
    7375 Default:
    7376 \fB\fIwinbind separator\fR = '\\' \fR
    7377 .sp
    7378 Example:
    7379 \fB\fIwinbind separator\fR = + \fR
    7380 .RE
    7381 .PP
     8926\fInss_winbind\.so\fR
     8927modules for UNIX services\.
     8928.sp
     8929Please note that setting this parameter to + causes problems with group membership at least on glibc systems, as the character + is used as a special character for NIS in /etc/group\.
     8930.sp
     8931Default:
     8932\fI\fIwinbind separator\fR\fR\fI = \fR\fI\'\e\'\fR\fI \fR
     8933.sp
     8934Example:
     8935\fI\fIwinbind separator\fR\fR\fI = \fR\fI+\fR\fI \fR
     8936.RE
     8937
    73828938winbind trusted domains only (G)
    7383 .RS 3n
    7384 This parameter is designed to allow Samba servers that are members of a Samba controlled domain to use UNIX accounts distributed via NIS, rsync, or LDAP as the uid's for winbindd users in the hosts primary domain. Therefore, the user
    7385 DOMAIN\\user1
    7386 would be mapped to the account user1 in /etc/passwd instead of allocating a new uid for him or her.
    7387 .sp
    7388 This parameter is now deprecated in favor of the newer idmap_nss backend. Refer to the
    7389 idmap domains smb.conf option and the
     8939.PP
     8940.RS 4
     8941This parameter is designed to allow Samba servers that are members of a Samba controlled domain to use UNIX accounts distributed via NIS, rsync, or LDAP as the uid\'s for winbindd users in the hosts primary domain\. Therefore, the user
     8942DOMAIN\euser1
     8943would be mapped to the account user1 in /etc/passwd instead of allocating a new uid for him or her\.
     8944.sp
     8945This parameter is now deprecated in favor of the newer idmap_nss backend\. Refer to the
     8946\fIidmap domains\fR
     8947smb\.conf option and the
    73908948\fBidmap_nss\fR(8)
    7391 man page for more information.
    7392 .sp
    7393 Default:
    7394 \fB\fIwinbind trusted domains only\fR = no \fR
    7395 .RE
    7396 .PP
     8949man page for more information\.
     8950.sp
     8951Default:
     8952\fI\fIwinbind trusted domains only\fR\fR\fI = \fR\fIno\fR\fI \fR
     8953.RE
     8954
    73978955winbind use default domain (G)
    7398 .RS 3n
     8956.PP
     8957.RS 4
    73998958This parameter specifies whether the
    74008959\fBwinbindd\fR(8)
    7401 daemon should operate on users without domain component in their username. Users without a domain component are treated as is part of the winbindd server's own domain. While this does not benifit Windows users, it makes SSH, FTP and e-mail function in a way much closer to the way they would in a native unix system.
    7402 .sp
    7403 Default:
    7404 \fB\fIwinbind use default domain\fR = no \fR
    7405 .sp
    7406 Example:
    7407 \fB\fIwinbind use default domain\fR = yes \fR
    7408 .RE
    7409 .PP
     8960daemon should operate on users without domain component in their username\. Users without a domain component are treated as is part of the winbindd server\'s own domain\. While this does not benifit Windows users, it makes SSH, FTP and e\-mail function in a way much closer to the way they would in a native unix system\.
     8961.sp
     8962Default:
     8963\fI\fIwinbind use default domain\fR\fR\fI = \fR\fIno\fR\fI \fR
     8964.sp
     8965Example:
     8966\fI\fIwinbind use default domain\fR\fR\fI = \fR\fIyes\fR\fI \fR
     8967.RE
     8968
    74108969wins hook (G)
    7411 .RS 3n
    7412 When Samba is running as a WINS server this allows you to call an external program for all changes to the WINS database. The primary use for this option is to allow the dynamic update of external name resolution databases such as dynamic DNS.
     8970.PP
     8971.RS 4
     8972When Samba is running as a WINS server this allows you to call an external program for all changes to the WINS database\. The primary use for this option is to allow the dynamic update of external name resolution databases such as dynamic DNS\.
    74138973.sp
    74148974The wins hook parameter specifies the name of a script or executable that will be called as follows:
    74158975.sp
    74168976wins_hook operation name nametype ttl IP_list
    7417 .RS 3n
    7418 .TP 3n
    7419 \(bu
    7420 The first argument is the operation and is one of "add", "delete", or "refresh". In most cases the operation can be ignored as the rest of the parameters provide sufficient information. Note that "refresh" may sometimes be called when the name has not previously been added, in that case it should be treated as an add.
    7421 .TP 3n
    7422 \(bu
    7423 The second argument is the NetBIOS name. If the name is not a legal name then the wins hook is not called. Legal names contain only letters, digits, hyphens, underscores and periods.
    7424 .TP 3n
    7425 \(bu
    7426 The third argument is the NetBIOS name type as a 2 digit hexadecimal number.
    7427 .TP 3n
    7428 \(bu
    7429 The fourth argument is the TTL (time to live) for the name in seconds.
    7430 .TP 3n
    7431 \(bu
    7432 The fifth and subsequent arguments are the IP addresses currently registered for that name. If this list is empty then the name should be deleted.
    7433 .RE
    7434 .IP "" 3n
     8977.sp
     8978.RS 4
     8979.ie n \{\
     8980\h'-04'\(bu\h'+03'\c
     8981.\}
     8982.el \{\
     8983.sp -1
     8984.IP \(bu 2.3
     8985.\}
     8986The first argument is the operation and is one of "add", "delete", or "refresh"\. In most cases the operation can be ignored as the rest of the parameters provide sufficient information\. Note that "refresh" may sometimes be called when the name has not previously been added, in that case it should be treated as an add\.
     8987.RE
     8988.sp
     8989.RS 4
     8990.ie n \{\
     8991\h'-04'\(bu\h'+03'\c
     8992.\}
     8993.el \{\
     8994.sp -1
     8995.IP \(bu 2.3
     8996.\}
     8997The second argument is the NetBIOS name\. If the name is not a legal name then the wins hook is not called\. Legal names contain only letters, digits, hyphens, underscores and periods\.
     8998.RE
     8999.sp
     9000.RS 4
     9001.ie n \{\
     9002\h'-04'\(bu\h'+03'\c
     9003.\}
     9004.el \{\
     9005.sp -1
     9006.IP \(bu 2.3
     9007.\}
     9008The third argument is the NetBIOS name type as a 2 digit hexadecimal number\.
     9009.RE
     9010.sp
     9011.RS 4
     9012.ie n \{\
     9013\h'-04'\(bu\h'+03'\c
     9014.\}
     9015.el \{\
     9016.sp -1
     9017.IP \(bu 2.3
     9018.\}
     9019The fourth argument is the TTL (time to live) for the name in seconds\.
     9020.RE
     9021.sp
     9022.RS 4
     9023.ie n \{\
     9024\h'-04'\(bu\h'+03'\c
     9025.\}
     9026.el \{\
     9027.sp -1
     9028.IP \(bu 2.3
     9029.\}
     9030The fifth and subsequent arguments are the IP addresses currently registered for that name\. If this list is empty then the name should be deleted\.
     9031.sp
     9032.RE
    74359033An example script that calls the BIND dynamic DNS update program
    74369034nsupdate
    7437 is provided in the examples directory of the Samba source code.
    7438 .sp
    7439 \fBNo default\fR
    7440 .RE
    7441 .PP
     9035is provided in the examples directory of the Samba source code\.
     9036.sp
     9037\fINo default\fR
     9038.RE
     9039
    74429040wins proxy (G)
    7443 .RS 3n
     9041.PP
     9042.RS 4
    74449043This is a boolean that controls if
    74459044\fBnmbd\fR(8)
    7446 will respond to broadcast name queries on behalf of other hosts. You may need to set this to
     9045will respond to broadcast name queries on behalf of other hosts\. You may need to set this to
    74479046\fByes\fR
    7448 for some older clients.
    7449 .sp
    7450 Default:
    7451 \fB\fIwins proxy\fR = no \fR
    7452 .RE
    7453 .PP
     9047for some older clients\.
     9048.sp
     9049Default:
     9050\fI\fIwins proxy\fR\fR\fI = \fR\fIno\fR\fI \fR
     9051.RE
     9052
    74549053wins server (G)
    7455 .RS 3n
     9054.PP
     9055.RS 4
    74569056This specifies the IP address (or DNS name: IP address for preference) of the WINS server that
    74579057\fBnmbd\fR(8)
    7458 should register with. If you have a WINS server on your network then you should set this to the WINS server's IP.
    7459 .sp
    7460 You should point this at your WINS server if you have a multi-subnetted network.
    7461 .sp
    7462 If you want to work in multiple namespaces, you can give every wins server a 'tag'. For each tag, only one (working) server will be queried for a name. The tag should be separated from the ip address by a colon.
     9058should register with\. If you have a WINS server on your network then you should set this to the WINS server\'s IP\.
     9059.sp
     9060You should point this at your WINS server if you have a multi\-subnetted network\.
     9061.sp
     9062If you want to work in multiple namespaces, you can give every wins server a \'tag\'\. For each tag, only one (working) server will be queried for a name\. The tag should be separated from the ip address by a colon\.
    74639063.sp
    74649064.it 1 an-trap
    … …  
    74669066.nr an-break-flag 1
    74679067.br
    7468 \fBNote\fR
    7469 You need to set up Samba to point to a WINS server if you have multiple subnets and wish cross-subnet browsing to work correctly.
    7470 See the chapter in the Samba3-HOWTO on Network Browsing.
    7471 .sp
    7472 Default:
    7473 \fB\fIwins server\fR = \fR
    7474 .sp
    7475 Example:
    7476 \fB\fIwins server\fR = mary:192.9.200.1 fred:192.168.3.199 mary:192.168.2.61 # For this example when querying a certain name, 192.19.200.1 will be asked first and if that doesn't respond 192.168.2.61. If either of those doesn't know the name 192.168.3.199 will be queried. \fR
    7477 .sp
    7478 Example:
    7479 \fB\fIwins server\fR = 192.9.200.1 192.168.2.61 \fR
    7480 .RE
    7481 .PP
     9068Note
     9069You need to set up Samba to point to a WINS server if you have multiple subnets and wish cross\-subnet browsing to work correctly\.
     9070
     9071See the chapter in the Samba3\-HOWTO on Network Browsing\.
     9072.sp
     9073Default:
     9074\fI\fIwins server\fR\fR\fI = \fR\fI\fR\fI \fR
     9075.sp
     9076Example:
     9077\fI\fIwins server\fR\fR\fI = \fR\fImary:192\.9\.200\.1 fred:192\.168\.3\.199 mary:192\.168\.2\.61 # For this example when querying a certain name, 192\.19\.200\.1 will be asked first and if that doesn\'t respond 192\.168\.2\.61\. If either of those doesn\'t know the name 192\.168\.3\.199 will be queried\.\fR\fI \fR
     9078.sp
     9079Example:
     9080\fI\fIwins server\fR\fR\fI = \fR\fI192\.9\.200\.1 192\.168\.2\.61\fR\fI \fR
     9081.RE
     9082
    74829083wins support (G)
    7483 .RS 3n
     9084.PP
     9085.RS 4
    74849086This boolean controls if the
    74859087\fBnmbd\fR(8)
    7486 process in Samba will act as a WINS server. You should not set this to
     9088process in Samba will act as a WINS server\. You should not set this to
    74879089\fByes\fR
    7488 unless you have a multi-subnetted network and you wish a particular
     9090unless you have a multi\-subnetted network and you wish a particular
    74899091nmbd
    7490 to be your WINS server. Note that you should
    7491 \fBNEVER\fR
     9092to be your WINS server\. Note that you should
     9093\fINEVER\fR
    74929094set this to
    74939095\fByes\fR
    7494 on more than one machine in your network.
    7495 .sp
    7496 Default:
    7497 \fB\fIwins support\fR = no \fR
    7498 .RE
    7499 .PP
     9096on more than one machine in your network\.
     9097.sp
     9098Default:
     9099\fI\fIwins support\fR\fR\fI = \fR\fIno\fR\fI \fR
     9100.RE
     9101
    75009102workgroup (G)
    7501 .RS 3n
    7502 This controls what workgroup your server will appear to be in when queried by clients. Note that this parameter also controls the Domain name used with the
    7503 security = domain setting.
    7504 .sp
    7505 Default:
    7506 \fB\fIworkgroup\fR = WORKGROUP \fR
    7507 .sp
    7508 Example:
    7509 \fB\fIworkgroup\fR = MYGROUP \fR
    7510 .RE
    7511 .PP
    7512 writable
    7513 .RS 3n
    7514 This parameter is a synonym for writeable.
    7515 .RE
    7516 .PP
     9103.PP
     9104.RS 4
     9105This controls what workgroup your server will appear to be in when queried by clients\. Note that this parameter also controls the Domain name used with the
     9106\fIsecurity = domain\fR
     9107setting\.
     9108.sp
     9109Default:
     9110\fI\fIworkgroup\fR\fR\fI = \fR\fIWORKGROUP\fR\fI \fR
     9111.sp
     9112Example:
     9113\fI\fIworkgroup\fR\fR\fI = \fR\fIMYGROUP\fR\fI \fR
     9114.RE
     9115writable.PP
     9116.RS 4
     9117This parameter is a synonym for
     9118writeable\.
     9119.RE
     9120
    75179121writeable (S)
    7518 .RS 3n
     9122.PP
     9123.RS 4
    75199124Inverted synonym for
    7520 read only.
    7521 .sp
    7522 \fBNo default\fR
    7523 .RE
    7524 .PP
     9125\fIread only\fR\.
     9126.sp
     9127\fINo default\fR
     9128.RE
     9129
    75259130write cache size (S)
    7526 .RS 3n
    7527 If this integer parameter is set to non-zero value, Samba will create an in-memory cache for each oplocked file (it does
    7528 \fBnot\fR
    7529 do this for non-oplocked files). All writes that the client does not request to be flushed directly to disk will be stored in this cache if possible. The cache is flushed onto disk when a write comes in whose offset would not fit into the cache or when the file is closed by the client. Reads for the file are also served from this cache if the data is stored within it.
    7530 .sp
    7531 This cache allows Samba to batch client writes into a more efficient write size for RAID disks (i.e. writes may be tuned to be the RAID stripe size) and can improve performance on systems where the disk subsystem is a bottleneck but there is free memory for userspace programs.
    7532 .sp
    7533 The integer parameter specifies the size of this cache (per oplocked file) in bytes.
    7534 .sp
    7535 Default:
    7536 \fB\fIwrite cache size\fR = 0 \fR
    7537 .sp
    7538 Example:
    7539 \fB\fIwrite cache size\fR = 262144 # for a 256k cache size per file \fR
    7540 .RE
    7541 .PP
     9131.PP
     9132.RS 4
     9133If this integer parameter is set to non\-zero value, Samba will create an in\-memory cache for each oplocked file (it does
     9134\fInot\fR
     9135do this for non\-oplocked files)\. All writes that the client does not request to be flushed directly to disk will be stored in this cache if possible\. The cache is flushed onto disk when a write comes in whose offset would not fit into the cache or when the file is closed by the client\. Reads for the file are also served from this cache if the data is stored within it\.
     9136.sp
     9137This cache allows Samba to batch client writes into a more efficient write size for RAID disks (i\.e\. writes may be tuned to be the RAID stripe size) and can improve performance on systems where the disk subsystem is a bottleneck but there is free memory for userspace programs\.
     9138.sp
     9139The integer parameter specifies the size of this cache (per oplocked file) in bytes\.
     9140.sp
     9141Default:
     9142\fI\fIwrite cache size\fR\fR\fI = \fR\fI0\fR\fI \fR
     9143.sp
     9144Example:
     9145\fI\fIwrite cache size\fR\fR\fI = \fR\fI262144 # for a 256k cache size per file\fR\fI \fR
     9146.RE
     9147
    75429148write list (S)
    7543 .RS 3n
    7544 This is a list of users that are given read-write access to a service. If the connecting user is in this list then they will be given write access, no matter what the
    7545 read only option is set to. The list can include group names using the @group syntax.
    7546 .sp
    7547 Note that if a user is in both the read list and the write list then they will be given write access.
     9149.PP
     9150.RS 4
     9151This is a list of users that are given read\-write access to a service\. If the connecting user is in this list then they will be given write access, no matter what the
     9152\fIread only\fR
     9153option is set to\. The list can include group names using the @group syntax\.
     9154.sp
     9155Note that if a user is in both the read list and the write list then they will be given write access\.
    75489156.sp
    75499157By design, this parameter will not work with the
    7550 security = share in Samba 3.0.
    7551 .sp
    7552 Default:
    7553 \fB\fIwrite list\fR = \fR
    7554 .sp
    7555 Example:
    7556 \fB\fIwrite list\fR = admin, root, @staff \fR
    7557 .RE
    7558 .PP
     9158\fIsecurity = share\fR
     9159in Samba 3\.0\.
     9160.sp
     9161Default:
     9162\fI\fIwrite list\fR\fR\fI = \fR\fI\fR\fI \fR
     9163.sp
     9164Example:
     9165\fI\fIwrite list\fR\fR\fI = \fR\fIadmin, root, @staff\fR\fI \fR
     9166.RE
     9167
    75599168write raw (G)
    7560 .RS 3n
    7561 This parameter controls whether or not the server will support raw write SMB's when transferring data from clients. You should never need to change this parameter.
    7562 .sp
    7563 Default:
    7564 \fB\fIwrite raw\fR = yes \fR
    7565 .RE
    7566 .PP
     9169.PP
     9170.RS 4
     9171This parameter controls whether or not the server will support raw write SMB\'s when transferring data from clients\. You should never need to change this parameter\.
     9172.sp
     9173Default:
     9174\fI\fIwrite raw\fR\fR\fI = \fR\fIyes\fR\fI \fR
     9175.RE
     9176
    75679177wtmp directory (G)
    7568 .RS 3n
     9178.PP
     9179.RS 4
    75699180This parameter is only available if Samba has been configured and compiled with the option
    7570 --with-utmp. It specifies a directory pathname that is used to store the wtmp or wtmpx files (depending on the UNIX system) that record user connections to a Samba server. The difference with the utmp directory is the fact that user info is kept after a user has logged out.
     9181\-\-with\-utmp\. It specifies a directory pathname that is used to store the wtmp or wtmpx files (depending on the UNIX system) that record user connections to a Samba server\. The difference with the utmp directory is the fact that user info is kept after a user has logged out\.
    75719182.sp
    75729183By default this is not set, meaning the system will use whatever utmp file the native system is set to use (usually
    75739184\fI/var/run/wtmp\fR
    7574 on Linux).
    7575 .sp
    7576 Default:
    7577 \fB\fIwtmp directory\fR = \fR
    7578 .sp
    7579 Example:
    7580 \fB\fIwtmp directory\fR = /var/log/wtmp \fR
     9185on Linux)\.
     9186.sp
     9187Default:
     9188\fI\fIwtmp directory\fR\fR\fI = \fR\fI\fR\fI \fR
     9189.sp
     9190Example:
     9191\fI\fIwtmp directory\fR\fR\fI = \fR\fI/var/log/wtmp\fR\fI \fR
    75819192.RE
    75829193.SH "WARNINGS"
    75839194.PP
    7584 Although the configuration file permits service names to contain spaces, your client software may not. Spaces will be ignored in comparisons anyway, so it shouldn't be a problem - but be aware of the possibility.
    7585 .PP
    7586 On a similar note, many clients - especially DOS clients - limit service names to eight characters.
     9195Although the configuration file permits service names to contain spaces, your client software may not\. Spaces will be ignored in comparisons anyway, so it shouldn\'t be a problem \- but be aware of the possibility\.
     9196.PP
     9197On a similar note, many clients \- especially DOS clients \- limit service names to eight characters\.
    75879198\fBsmbd\fR(8)
    7588 has no such limitation, but attempts to connect from such clients will fail if they truncate the service names. For this reason you should probably keep your service names down to eight characters in length.
     9199has no such limitation, but attempts to connect from such clients will fail if they truncate the service names\. For this reason you should probably keep your service names down to eight characters in length\.
    75899200.PP
    75909201Use of the
    … …  
    75929203and
    75939204[printers]
    7594 special sections make life for an administrator easy, but the various combinations of default attributes can be tricky. Take extreme care when designing these sections. In particular, ensure that the permissions on spool directories are correct.
     9205special sections make life for an administrator easy, but the various combinations of default attributes can be tricky\. Take extreme care when designing these sections\. In particular, ensure that the permissions on spool directories are correct\.
    75959206.SH "VERSION"
    75969207.PP
    7597 This man page is correct for version 3.0 of the Samba suite.
     9208This man page is correct for version 3\.0 of the Samba suite\.
    75989209.SH "SEE ALSO"
    75999210.PP
    … …  
    76079218\fBnmblookup\fR(1),
    76089219\fBtestparm\fR(1),
    7609 \fBtestprns\fR(1).
     9220\fBtestprns\fR(1)\.
    76109221.SH "AUTHOR"
    76119222.PP
    7612 The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.
    7613 .PP
    7614 The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another excellent piece of Open Source software, available at
    7615 ftp://ftp.icce.rug.nl/pub/unix/) and updated for the Samba 2.0 release by Jeremy Allison. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.
    7616 
     9223The original Samba software and related utilities were created by Andrew Tridgell\. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed\.
     9224.PP
     9225The original Samba man pages were written by Karl Auer\. The man page sources were converted to YODL format (another excellent piece of Open Source software, available at
     9226ftp://ftp\.icce\.rug\.nl/pub/unix/) and updated for the Samba 2\.0 release by Jeremy Allison\. The conversion to DocBook for Samba 2\.2 was done by Gerald Carter\. The conversion to DocBook XML 4\.2 for Samba 3\.0 was done by Alexander Bokovoy\.
Note: See TracChangeset for help on using the changeset viewer.