Changeset 411 for branches/samba-3.3.x/docs/manpages/smb.conf.5
- Timestamp:
- Mar 1, 2010, 3:05:48 PM (15 years ago)
- File:
-
- 1 edited
-
branches/samba-3.3.x/docs/manpages/smb.conf.5 (modified) (546 diffs)
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.3.x/docs/manpages/smb.conf.5
r368 r411 1 '\" t2 1 .\" Title: smb.conf 3 2 .\" Author: [see the "AUTHOR" section] 4 .\" Generator: DocBook XSL Stylesheets v1.7 5.2<http://docbook.sf.net/>5 .\" Date: 0 1/14/20103 .\" Generator: DocBook XSL Stylesheets v1.74.0 <http://docbook.sf.net/> 4 .\" Date: 02/22/2010 6 5 .\" Manual: File Formats and Conventions 7 6 .\" Source: Samba 3.3 8 7 .\" Language: English 9 8 .\" 10 .TH "SMB\&.CONF" "5" "01/14/2010" "Samba 3\&.3" "File Formats and Conventions" 9 .TH "SMB\&.CONF" "5" "02/22/2010" "Samba 3\&.3" "File Formats and Conventions" 10 .\" ----------------------------------------------------------------- 11 .\" * (re)Define some macros 12 .\" ----------------------------------------------------------------- 13 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 14 .\" toupper - uppercase a string (locale-aware) 15 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 16 .de toupper 17 .tr aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ 18 \\$* 19 .tr aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz 20 .. 21 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 22 .\" SH-xref - format a cross-reference to an SH section 23 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 24 .de SH-xref 25 .ie n \{\ 26 .\} 27 .toupper \\$* 28 .el \{\ 29 \\$* 30 .\} 31 .. 32 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 33 .\" SH - level-one heading that works better for non-TTY output 34 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 35 .de1 SH 36 .\" put an extra blank line of space above the head in non-TTY output 37 .if t \{\ 38 .sp 1 39 .\} 40 .sp \\n[PD]u 41 .nr an-level 1 42 .set-an-margin 43 .nr an-prevailing-indent \\n[IN] 44 .fi 45 .in \\n[an-margin]u 46 .ti 0 47 .HTML-TAG ".NH \\n[an-level]" 48 .it 1 an-trap 49 .nr an-no-space-flag 1 50 .nr an-break-flag 1 51 \." make the size of the head bigger 52 .ps +3 53 .ft B 54 .ne (2v + 1u) 55 .ie n \{\ 56 .\" if n (TTY output), use uppercase 57 .toupper \\$* 58 .\} 59 .el \{\ 60 .nr an-break-flag 0 61 .\" if not n (not TTY), use normal case (not uppercase) 62 \\$1 63 .in \\n[an-margin]u 64 .ti 0 65 .\" if not n (not TTY), put a border/line under subheading 66 .sp -.6 67 \l'\n(.lu' 68 .\} 69 .. 70 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 71 .\" SS - level-two heading that works better for non-TTY output 72 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 73 .de1 SS 74 .sp \\n[PD]u 75 .nr an-level 1 76 .set-an-margin 77 .nr an-prevailing-indent \\n[IN] 78 .fi 79 .in \\n[IN]u 80 .ti \\n[SN]u 81 .it 1 an-trap 82 .nr an-no-space-flag 1 83 .nr an-break-flag 1 84 .ps \\n[PS-SS]u 85 \." make the size of the head bigger 86 .ps +2 87 .ft B 88 .ne (2v + 1u) 89 .if \\n[.$] \&\\$* 90 .. 91 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 92 .\" BB/BE - put background/screen (filled box) around block of text 93 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 94 .de BB 95 .if t \{\ 96 .sp -.5 97 .br 98 .in +2n 99 .ll -2n 100 .gcolor red 101 .di BX 102 .\} 103 .. 104 .de EB 105 .if t \{\ 106 .if "\\$2"adjust-for-leading-newline" \{\ 107 .sp -1 108 .\} 109 .br 110 .di 111 .in 112 .ll 113 .gcolor 114 .nr BW \\n(.lu-\\n(.i 115 .nr BH \\n(dn+.5v 116 .ne \\n(BHu+.5v 117 .ie "\\$2"adjust-for-leading-newline" \{\ 118 \M[\\$1]\h'1n'\v'+.5v'\D'P \\n(BWu 0 0 \\n(BHu -\\n(BWu 0 0 -\\n(BHu'\M[] 119 .\} 120 .el \{\ 121 \M[\\$1]\h'1n'\v'-.5v'\D'P \\n(BWu 0 0 \\n(BHu -\\n(BWu 0 0 -\\n(BHu'\M[] 122 .\} 123 .in 0 124 .sp -.5v 125 .nf 126 .BX 127 .in 128 .sp .5v 129 .fi 130 .\} 131 .. 132 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 133 .\" BM/EM - put colored marker in margin next to block of text 134 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 135 .de BM 136 .if t \{\ 137 .br 138 .ll -2n 139 .gcolor red 140 .di BX 141 .\} 142 .. 143 .de EM 144 .if t \{\ 145 .br 146 .di 147 .ll 148 .gcolor 149 .nr BH \\n(dn 150 .ne \\n(BHu 151 \M[\\$1]\D'P -.75n 0 0 \\n(BHu -(\\n[.i]u - \\n(INu - .75n) 0 0 -\\n(BHu'\M[] 152 .in 0 153 .nf 154 .BX 155 .in 156 .fi 157 .\} 158 .. 11 159 .\" ----------------------------------------------------------------- 12 160 .\" * set default formatting … … 19 167 .\" * MAIN CONTENT STARTS HERE * 20 168 .\" ----------------------------------------------------------------- 21 .SH "N AME"169 .SH "Name" 22 170 smb.conf \- The configuration file for the Samba suite 23 171 .SH "SYNOPSIS" 24 172 .PP 25 173 The 26 smb\&.conf 174 \FCsmb\&.conf\F[] 27 175 file is a configuration file for the Samba suite\&. 28 smb\&.conf 176 \FCsmb\&.conf\F[] 29 177 contains runtime configuration information for the Samba programs\&. The 30 smb\&.conf 178 \FCsmb\&.conf\F[] 31 179 file is designed to be configured and administered by the 32 180 \fBswat\fR(8) … … 39 187 .RS 4 40 188 .\} 189 .fam C 190 .ps -1 41 191 .nf 192 .if t \{\ 193 .sp -1 194 .\} 195 .BB lightgray adjust-for-leading-newline 196 .sp -1 197 42 198 \fIname\fR = \fIvalue \fR 199 .EB lightgray adjust-for-leading-newline 200 .if t \{\ 201 .sp 1 202 .\} 43 203 .fi 204 .fam 205 .ps +1 44 206 .if n \{\ 45 207 .RE … … 55 217 .PP 56 218 Any line ending in a 57 \(lq\ e\(rq219 \(lq\FC\e\F[]\(rq 58 220 is continued on the next line in the customary UNIX fashion\&. 59 221 .PP … … 78 240 .PP 79 241 Sections other than guest services will require a password to access them\&. The client provides the username\&. As older clients only provide passwords and not usernames, you may specify a list of usernames to check against the password using the 80 user = 242 \FCuser =\F[] 81 243 option in the share definition\&. For modern clients such as Windows 95/98/ME/NT/2000, this should not be necessary\&. 82 244 .PP … … 84 246 .PP 85 247 The following sample section defines a file space share\&. The user has write access to the path 86 /home/bar\&. The share is accessed via the share name87 foo:248 \FC/home/bar\F[]\&. The share is accessed via the share name 249 \FCfoo\F[]: 88 250 .sp 89 251 .if n \{\ 90 252 .RS 4 91 253 .\} 254 .fam C 255 .ps -1 92 256 .nf 257 .if t \{\ 258 .sp -1 259 .\} 260 .BB lightgray adjust-for-leading-newline 261 .sp -1 262 93 263 \fI[foo]\fR 94 264 \m[blue]\fBpath = /home/bar\fR\m[] 95 265 \m[blue]\fBread only = no\fR\m[] 266 .EB lightgray adjust-for-leading-newline 267 .if t \{\ 268 .sp 1 269 .\} 96 270 .fi 271 .fam 272 .ps +1 97 273 .if n \{\ 98 274 .RE … … 106 282 .RS 4 107 283 .\} 284 .fam C 285 .ps -1 108 286 .nf 287 .if t \{\ 288 .sp -1 289 .\} 290 .BB lightgray adjust-for-leading-newline 291 .sp -1 292 109 293 \fI[aprinter]\fR 110 294 \m[blue]\fBpath = /usr/spool/public\fR\m[] … … 112 296 \m[blue]\fBprintable = yes\fR\m[] 113 297 \m[blue]\fBguest ok = yes\fR\m[] 298 .EB lightgray adjust-for-leading-newline 299 .if t \{\ 300 .sp 1 301 .\} 114 302 .fi 303 .fam 304 .ps +1 115 305 .if n \{\ 116 306 .RE … … 159 349 .RS 4 160 350 .\} 351 .fam C 352 .ps -1 161 353 .nf 354 .if t \{\ 355 .sp -1 356 .\} 357 .BB lightgray adjust-for-leading-newline 358 .sp -1 359 162 360 \fBpath = /data/pchome/%S\fR 361 .EB lightgray adjust-for-leading-newline 362 .if t \{\ 363 .sp 1 364 .\} 163 365 .fi 366 .fam 367 .ps +1 164 368 .if n \{\ 165 369 .RE … … 178 382 .RS 4 179 383 .\} 384 .fam C 385 .ps -1 180 386 .nf 387 .if t \{\ 388 .sp -1 389 .\} 390 .BB lightgray adjust-for-leading-newline 391 .sp -1 392 181 393 \fI[homes]\fR 182 394 \m[blue]\fBread only = no\fR\m[] 395 .EB lightgray adjust-for-leading-newline 396 .if t \{\ 397 .sp 1 398 .\} 183 399 .fi 400 .fam 401 .ps +1 184 402 .if n \{\ 185 403 .RE … … 246 464 .RS 4 247 465 .\} 466 .fam C 467 .ps -1 248 468 .nf 469 .if t \{\ 470 .sp -1 471 .\} 472 .BB lightgray adjust-for-leading-newline 473 .sp -1 474 249 475 \fI[printers]\fR 250 476 \m[blue]\fBpath = /usr/spool/public\fR\m[] 251 477 \m[blue]\fBguest ok = yes\fR\m[] 252 478 \m[blue]\fBprintable = yes\fR\m[] 479 .EB lightgray adjust-for-leading-newline 480 .if t \{\ 481 .sp 1 482 .\} 253 483 .fi 484 .fam 485 .ps +1 254 486 .if n \{\ 255 487 .RE … … 261 493 .RS 4 262 494 .\} 495 .fam C 496 .ps -1 263 497 .nf 498 .if t \{\ 499 .sp -1 500 .\} 501 .BB lightgray adjust-for-leading-newline 502 .sp -1 503 264 504 alias|alias|alias|alias\&.\&.\&. 505 .EB lightgray adjust-for-leading-newline 506 .if t \{\ 507 .sp 1 508 .\} 265 509 .fi 510 .fam 511 .ps +1 266 512 .if n \{\ 267 513 .RE … … 270 516 Each alias should be an acceptable printer name for your printing subsystem\&. In the [global] section, specify the new file as your printcap\&. The server will only recognize names found in your pseudo\-printcap, which of course can contain whatever aliases you like\&. The same technique could be used simply to limit access to a subset of your local printers\&. 271 517 .PP 272 An alias, by the way, is defined as any component of the first entry of a printcap record\&. Records are separated by newlines, components (if there are more than one) are separated by vertical bar symbols ( |)\&.518 An alias, by the way, is defined as any component of the first entry of a printcap record\&. Records are separated by newlines, components (if there are more than one) are separated by vertical bar symbols (\FC|\F[])\&. 273 519 .if n \{\ 274 520 .sp 275 521 .\} 276 522 .RS 4 523 .BM yellow 277 524 .it 1 an-trap 278 525 .nr an-no-space-flag 1 … … 285 532 .PP 286 533 On SYSV systems which use lpstat to determine what printers are defined on the system you may be able to use 287 printcap name = lpstat 534 \FCprintcap name = lpstat\F[] 288 535 to automatically obtain a list of printers\&. See the 289 printcap name 536 \FCprintcap name\F[] 290 537 option for more details\&. 291 538 .sp .5v 539 .EM yellow 292 540 .RE 293 541 .SH "USERSHARES" … … 333 581 .PP 334 582 To allow members of the UNIX group 335 foo 583 \FCfoo\F[] 336 584 to create user defined shares, create the directory to contain the share definitions as follows: 337 585 .PP … … 341 589 .RS 4 342 590 .\} 591 .fam C 592 .ps -1 343 593 .nf 594 .if t \{\ 595 .sp -1 596 .\} 597 .BB lightgray adjust-for-leading-newline 598 .sp -1 599 344 600 mkdir /usr/local/samba/lib/usershares 345 601 chgrp foo /usr/local/samba/lib/usershares 346 602 chmod 1770 /usr/local/samba/lib/usershares 603 .EB lightgray adjust-for-leading-newline 604 .if t \{\ 605 .sp 1 606 .\} 347 607 .fi 608 .fam 609 .ps +1 348 610 .if n \{\ 349 611 .RE … … 355 617 .RS 4 356 618 .\} 619 .fam C 620 .ps -1 357 621 .nf 622 .if t \{\ 623 .sp -1 624 .\} 625 .BB lightgray adjust-for-leading-newline 626 .sp -1 627 358 628 \m[blue]\fBusershare path = /usr/local/samba/lib/usershares\fR\m[] 359 629 \m[blue]\fBusershare max shares = 10\fR\m[] # (or the desired number of shares) 630 .EB lightgray adjust-for-leading-newline 631 .if t \{\ 632 .sp 1 633 .\} 360 634 .fi 635 .fam 636 .ps +1 361 637 .if n \{\ 362 638 .RE … … 364 640 .sp 365 641 to the global section of your 366 smb\&.conf\&. Members of the group foo may then manipulate the user defined shares using the following commands\&.642 \FCsmb\&.conf\F[]\&. Members of the group foo may then manipulate the user defined shares using the following commands\&. 367 643 .PP 368 644 net usershare add sharename path [comment] [acl] [guest_ok=[y|n]] … … 528 804 .RS 4 529 805 the path of the service\'s home directory, obtained from your NIS auto\&.map entry\&. The NIS auto\&.map entry is split up as 530 %N:%p\&.806 \FC%N:%p\F[]\&. 531 807 .RE 532 808 .PP 533 809 There are some quite creative things that can be done with these substitutions and other 534 smb\&.conf 810 \FCsmb\&.conf\F[] 535 811 options\&. 536 812 .SH "NAME MANGLING" 537 813 .PP 538 814 Samba supports 539 name mangling 815 \FCname mangling\F[] 540 816 so that DOS and Windows clients can use files that don\'t conform to the 8\&.3 format\&. It can also be set to adjust the case of 8\&.3 format filenames\&. 541 817 .PP … … 567 843 .RS 4 568 844 controls whether new files (ie\&. files that don\'t currently exist in the filesystem) are created with the case that the client passes, or if they are forced to be the 569 default 845 \FCdefault\F[] 570 846 case\&. Default 571 847 \fIyes\fR\&. … … 575 851 .RS 4 576 852 controls if new files (ie\&. files that don\'t currently exist in the filesystem) which conform to 8\&.3 syntax, that is all in upper case and of suitable length, are created upper case, or if they are forced to be the 577 default 853 \FCdefault\F[] 578 854 case\&. This option can be used with 579 preserve case = yes 855 \FCpreserve case = yes\F[] 580 856 to permit long filenames to retain their case, while short names are lowercased\&. Default 581 857 \fIyes\fR\&. … … 600 876 .\} 601 877 If the client has passed a username/password pair and that username/password pair is validated by the UNIX system\'s password programs, the connection is made as that username\&. This includes the 602 \ e\eserver\eservice%\fIusername\fR878 \FC\e\eserver\eservice\F[]%\fIusername\fR 603 879 method of passing a username\&. 604 880 .RE … … 646 922 .\} 647 923 If a 648 user = 924 \FCuser = \F[] 649 925 field is given in the 650 smb\&.conf 926 \FCsmb\&.conf\F[] 651 927 file for the service and the client has supplied a password, and that password matches (according to the UNIX system\'s password checking) with one of the usernames from the 652 user = 928 \FCuser =\F[] 653 929 field, the connection is made as the username in the 654 user = 930 \FCuser =\F[] 655 931 line\&. If one of the usernames in the 656 user = 932 \FCuser =\F[] 657 933 list begins with a 658 @, that name expands to a list of names in the group of the same name\&.934 \FC@\F[], that name expands to a list of names in the group of the same name\&. 659 935 .RE 660 936 .sp … … 668 944 .\} 669 945 If the service is a guest service, a connection is made as the username given in the 670 guest account = 946 \FCguest account =\F[] 671 947 for the service, irrespective of the supplied password\&. 672 948 .RE … … 674 950 .PP 675 951 Starting with Samba version 3\&.2\&.0, the capability to store Samba configuration in the registry is available\&. The configuration is stored in the registry key 676 \fI HKLM\eSoftware\eSamba\esmbconf\fR\&. There are two levels of registry configuration:952 \fI\FCHKLM\eSoftware\eSamba\esmbconf\F[]\fR\&. There are two levels of registry configuration: 677 953 .sp 678 954 .RS 4 … … 737 1013 \fInet (rpc) registry\fR 738 1014 in the key 739 \fI HKLM\eSoftware\eSamba\esmbconf\fR\&. More conveniently, the1015 \fI\FCHKLM\eSoftware\eSamba\esmbconf\F[]\fR\&. More conveniently, the 740 1016 \fIconf\fR 741 1017 subcommand of the … … 758 1034 .sp 759 1035 Default: 760 \fI\fIabort shutdown script\fR\fR\fI = \fR\fI ""\fR\fI \fR761 .sp 762 Example: 763 \fI\fIabort shutdown script\fR\fR\fI = \fR\fI /sbin/shutdown \-c\fR\fI \fR1036 \fI\fIabort shutdown script\fR\fR\fI = \fR\fI\FC""\F[]\fR\fI \fR 1037 .sp 1038 Example: 1039 \fI\fIabort shutdown script\fR\fR\fI = \fR\fI\FC/sbin/shutdown \-c\F[]\fR\fI \fR 764 1040 .RE 765 1041 … … 774 1050 .sp 775 1051 Default: 776 \fI\fIacl check permissions\fR\fR\fI = \fR\fI True\fR\fI \fR1052 \fI\fIacl check permissions\fR\fR\fI = \fR\fI\FCTrue\F[]\fR\fI \fR 777 1053 .RE 778 1054 … … 790 1066 .sp 791 1067 Default: 792 \fI\fIacl compatibility\fR\fR\fI = \fR\fI Auto\fR\fI \fR793 .sp 794 Example: 795 \fI\fIacl compatibility\fR\fR\fI = \fR\fI win2k\fR\fI \fR1068 \fI\fIacl compatibility\fR\fR\fI = \fR\fI\FCAuto\F[]\fR\fI \fR 1069 .sp 1070 Example: 1071 \fI\fIacl compatibility\fR\fR\fI = \fR\fI\FCwin2k\F[]\fR\fI \fR 796 1072 .RE 797 1073 … … 819 1095 .sp 820 1096 Default: 821 \fI\fIacl group control\fR\fR\fI = \fR\fI no\fR\fI \fR1097 \fI\fIacl group control\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 822 1098 .RE 823 1099 … … 830 1106 .sp 831 1107 Default: 832 \fI\fIacl map full control\fR\fR\fI = \fR\fI True\fR\fI \fR1108 \fI\fIacl map full control\fR\fR\fI = \fR\fI\FCTrue\F[]\fR\fI \fR 833 1109 .RE 834 1110 … … 846 1122 .sp 847 1123 Default: 848 \fI\fIadd group script\fR\fR\fI = \fR\fI\ fR\fI \fR849 .sp 850 Example: 851 \fI\fIadd group script\fR\fR\fI = \fR\fI /usr/sbin/groupadd %g\fR\fI \fR1124 \fI\fIadd group script\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 1125 .sp 1126 Example: 1127 \fI\fIadd group script\fR\fR\fI = \fR\fI\FC/usr/sbin/groupadd %g\F[]\fR\fI \fR 852 1128 .RE 853 1129 … … 864 1140 .sp 865 1141 Default: 866 \fI\fIadd machine script\fR\fR\fI = \fR\fI\ fR\fI \fR867 .sp 868 Example: 869 \fI\fIadd machine script\fR\fR\fI = \fR\fI /usr/sbin/adduser \-n \-g machines \-c Machine \-d /var/lib/nobody \-s /bin/false %u\fR\fI \fR1142 \fI\fIadd machine script\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 1143 .sp 1144 Example: 1145 \fI\fIadd machine script\fR\fR\fI = \fR\fI\FC/usr/sbin/adduser \-n \-g machines \-c Machine \-d /var/lib/nobody \-s /bin/false %u\F[]\fR\fI \fR 870 1146 .RE 871 1147 … … 901 1177 .sp 902 1178 Default: 903 \fI\fIadd port command\fR\fR\fI = \fR\fI\ fR\fI \fR904 .sp 905 Example: 906 \fI\fIadd port command\fR\fR\fI = \fR\fI /etc/samba/scripts/addport\&.sh\fR\fI \fR1179 \fI\fIadd port command\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 1180 .sp 1181 Example: 1182 \fI\fIadd port command\fR\fR\fI = \fR\fI\FC/etc/samba/scripts/addport\&.sh\F[]\fR\fI \fR 907 1183 .RE 908 1184 … … 916 1192 \fIaddprinter command\fR 917 1193 defines a script to be run which will perform the necessary operations for adding the printer to the print system and to add the appropriate service definition to the 918 smb\&.conf 1194 \FCsmb\&.conf\F[] 919 1195 file in order that it can be shared by 920 1196 \fBsmbd\fR(8)\&. … … 995 1271 \fIaddprinter command\fR 996 1272 has been executed, 997 smbd 1273 \FCsmbd\F[] 998 1274 will reparse the 999 smb\&.conf 1275 \FC smb\&.conf\F[] 1000 1276 to determine if the share defined by the APW exists\&. If the sharename is still invalid, then 1001 smbd 1277 \FCsmbd \F[] 1002 1278 will return an ACCESS_DENIED error to the client\&. 1003 1279 .sp … … 1007 1283 .sp 1008 1284 Default: 1009 \fI\fIaddprinter command\fR\fR\fI = \fR\fI\ fR\fI \fR1010 .sp 1011 Example: 1012 \fI\fIaddprinter command\fR\fR\fI = \fR\fI /usr/bin/addprinter\fR\fI \fR1285 \fI\fIaddprinter command\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 1286 .sp 1287 Example: 1288 \fI\fIaddprinter command\fR\fR\fI = \fR\fI\FC/usr/bin/addprinter\F[]\fR\fI \fR 1013 1289 .RE 1014 1290 … … 1020 1296 \fIadd share command\fR 1021 1297 is used to define an external program or script which will add a new service definition to 1022 smb\&.conf\&.1298 \FCsmb\&.conf\F[]\&. 1023 1299 .sp 1024 1300 In order to successfully execute the 1025 1301 \fIadd share command\fR, 1026 smbd 1302 \FCsmbd\F[] 1027 1303 requires that the administrator connects using a root account (i\&.e\&. uid == 0) or has the 1028 SeDiskOperatorPrivilege\&. Scripts defined in the1304 \FCSeDiskOperatorPrivilege\F[]\&. Scripts defined in the 1029 1305 \fIadd share command\fR 1030 1306 parameter are executed as root\&. 1031 1307 .sp 1032 1308 When executed, 1033 smbd 1309 \FCsmbd\F[] 1034 1310 will automatically invoke the 1035 1311 \fIadd share command\fR … … 1046 1322 \fIconfigFile\fR 1047 1323 \- the location of the global 1048 smb\&.conf 1324 \FCsmb\&.conf\F[] 1049 1325 file\&. 1050 1326 .RE … … 1102 1378 .sp 1103 1379 Default: 1104 \fI\fIadd share command\fR\fR\fI = \fR\fI\ fR\fI \fR1105 .sp 1106 Example: 1107 \fI\fIadd share command\fR\fR\fI = \fR\fI /usr/local/bin/addshare\fR\fI \fR1380 \fI\fIadd share command\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 1381 .sp 1382 Example: 1383 \fI\fIadd share command\fR\fR\fI = \fR\fI\FC/usr/local/bin/addshare\F[]\fR\fI \fR 1108 1384 .RE 1109 1385 … … 1138 1414 \m[blue]\fBpassword server\fR\m[] 1139 1415 and attempts to authenticate the given user with the given password\&. If the authentication succeeds then 1140 smbd 1416 \FCsmbd\F[] 1141 1417 attempts to find a UNIX user in the UNIX password database to map the Windows user into\&. If this lookup fails, and 1142 1418 \m[blue]\fBadd user script\fR\m[] 1143 1419 is set then 1144 smbd 1420 \FCsmbd\F[] 1145 1421 will call the specified script 1146 1422 \fIAS ROOT\fR, expanding any … … 1149 1425 .sp 1150 1426 If this script successfully creates the user then 1151 smbd 1427 \FCsmbd\F[] 1152 1428 will continue on as though the UNIX user already existed\&. In this way, UNIX users are dynamically created to match existing Windows NT accounts\&. 1153 1429 .sp … … 1158 1434 .sp 1159 1435 Default: 1160 \fI\fIadd user script\fR\fR\fI = \fR\fI\ fR\fI \fR1161 .sp 1162 Example: 1163 \fI\fIadd user script\fR\fR\fI = \fR\fI /usr/local/samba/bin/add_user %u\fR\fI \fR1436 \fI\fIadd user script\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 1437 .sp 1438 Example: 1439 \fI\fIadd user script\fR\fR\fI = \fR\fI\FC/usr/local/samba/bin/add_user %u\F[]\fR\fI \fR 1164 1440 .RE 1165 1441 … … 1177 1453 .sp 1178 1454 Note that the 1179 adduser 1455 \FCadduser\F[] 1180 1456 command used in the example below does not support the used syntax on all systems\&. 1181 1457 .sp 1182 1458 Default: 1183 \fI\fIadd user to group script\fR\fR\fI = \fR\fI\ fR\fI \fR1184 .sp 1185 Example: 1186 \fI\fIadd user to group script\fR\fR\fI = \fR\fI /usr/sbin/adduser %u %g\fR\fI \fR1459 \fI\fIadd user to group script\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 1460 .sp 1461 Example: 1462 \fI\fIadd user to group script\fR\fR\fI = \fR\fI\FC/usr/sbin/adduser %u %g\F[]\fR\fI \fR 1187 1463 .RE 1188 1464 … … 1200 1476 .sp 1201 1477 Default: 1202 \fI\fIadministrative share\fR\fR\fI = \fR\fI no\fR\fI \fR1478 \fI\fIadministrative share\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 1203 1479 .RE 1204 1480 … … 1216 1492 .sp 1217 1493 Default: 1218 \fI\fIadmin users\fR\fR\fI = \fR\fI\ fR\fI \fR1219 .sp 1220 Example: 1221 \fI\fIadmin users\fR\fR\fI = \fR\fI jason\fR\fI \fR1494 \fI\fIadmin users\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 1495 .sp 1496 Example: 1497 \fI\fIadmin users\fR\fR\fI = \fR\fI\FCjason\F[]\fR\fI \fR 1222 1498 .RE 1223 1499 … … 1231 1507 .sp 1232 1508 Default: 1233 \fI\fIafs share\fR\fR\fI = \fR\fI no\fR\fI \fR1509 \fI\fIafs share\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 1234 1510 .RE 1235 1511 … … 1243 1519 .sp 1244 1520 Default: 1245 \fI\fIafs username map\fR\fR\fI = \fR\fI\ fR\fI \fR1246 .sp 1247 Example: 1248 \fI\fIafs username map\fR\fR\fI = \fR\fI %u@afs\&.samba\&.org\fR\fI \fR1521 \fI\fIafs username map\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 1522 .sp 1523 Example: 1524 \fI\fIafs username map\fR\fR\fI = \fR\fI\FC%u@afs\&.samba\&.org\F[]\fR\fI \fR 1249 1525 .RE 1250 1526 … … 1264 1540 .sp 1265 1541 Default: 1266 \fI\fIaio read size\fR\fR\fI = \fR\fI 0\fR\fI \fR1267 .sp 1268 Example: 1269 \fI\fIaio read size\fR\fR\fI = \fR\fI 16384 # Use asynchronous I/O for reads bigger than 16KB request size\fR\fI \fR1542 \fI\fIaio read size\fR\fR\fI = \fR\fI\FC0\F[]\fR\fI \fR 1543 .sp 1544 Example: 1545 \fI\fIaio read size\fR\fR\fI = \fR\fI\FC16384 # Use asynchronous I/O for reads bigger than 16KB request size\F[]\fR\fI \fR 1270 1546 .RE 1271 1547 … … 1281 1557 .sp 1282 1558 Default: 1283 \fI\fIaio write behind\fR\fR\fI = \fR\fI\ fR\fI \fR1284 .sp 1285 Example: 1286 \fI\fIaio write behind\fR\fR\fI = \fR\fI /*\&.tmp/\fR\fI \fR1559 \fI\fIaio write behind\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 1560 .sp 1561 Example: 1562 \fI\fIaio write behind\fR\fR\fI = \fR\fI\FC/*\&.tmp/\F[]\fR\fI \fR 1287 1563 .RE 1288 1564 … … 1302 1578 .sp 1303 1579 Default: 1304 \fI\fIaio write size\fR\fR\fI = \fR\fI 0\fR\fI \fR1305 .sp 1306 Example: 1307 \fI\fIaio write size\fR\fR\fI = \fR\fI 16384 # Use asynchronous I/O for writes bigger than 16KB request size\fR\fI \fR1580 \fI\fIaio write size\fR\fR\fI = \fR\fI\FC0\F[]\fR\fI \fR 1581 .sp 1582 Example: 1583 \fI\fIaio write size\fR\fR\fI = \fR\fI\FC16384 # Use asynchronous I/O for writes bigger than 16KB request size\F[]\fR\fI \fR 1308 1584 .RE 1309 1585 … … 1319 1595 .sp 1320 1596 Default: 1321 \fI\fIalgorithmic rid base\fR\fR\fI = \fR\fI 1000\fR\fI \fR1322 .sp 1323 Example: 1324 \fI\fIalgorithmic rid base\fR\fR\fI = \fR\fI 100000\fR\fI \fR1597 \fI\fIalgorithmic rid base\fR\fR\fI = \fR\fI\FC1000\F[]\fR\fI \fR 1598 .sp 1599 Example: 1600 \fI\fIalgorithmic rid base\fR\fR\fI = \fR\fI\FC100000\F[]\fR\fI \fR 1325 1601 .RE 1326 1602 … … 1334 1610 .sp 1335 1611 Default: 1336 \fI\fIallocation roundup size\fR\fR\fI = \fR\fI 1048576\fR\fI \fR1337 .sp 1338 Example: 1339 \fI\fIallocation roundup size\fR\fR\fI = \fR\fI 0 # (to disable roundups)\fR\fI \fR1612 \fI\fIallocation roundup size\fR\fR\fI = \fR\fI\FC1048576\F[]\fR\fI \fR 1613 .sp 1614 Example: 1615 \fI\fIallocation roundup size\fR\fR\fI = \fR\fI\FC0 # (to disable roundups)\F[]\fR\fI \fR 1340 1616 .RE 1341 1617 … … 1355 1631 .sp 1356 1632 Default: 1357 \fI\fIallow trusted domains\fR\fR\fI = \fR\fI yes\fR\fI \fR1633 \fI\fIallow trusted domains\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 1358 1634 .RE 1359 1635 … … 1367 1643 .sp 1368 1644 Default: 1369 \fI\fIannounce as\fR\fR\fI = \fR\fI NT Server\fR\fI \fR1370 .sp 1371 Example: 1372 \fI\fIannounce as\fR\fR\fI = \fR\fI Win95\fR\fI \fR1645 \fI\fIannounce as\fR\fR\fI = \fR\fI\FCNT Server\F[]\fR\fI \fR 1646 .sp 1647 Example: 1648 \fI\fIannounce as\fR\fR\fI = \fR\fI\FCWin95\F[]\fR\fI \fR 1373 1649 .RE 1374 1650 … … 1380 1656 .sp 1381 1657 Default: 1382 \fI\fIannounce version\fR\fR\fI = \fR\fI 4\&.9\fR\fI \fR1383 .sp 1384 Example: 1385 \fI\fIannounce version\fR\fR\fI = \fR\fI 2\&.0\fR\fI \fR1658 \fI\fIannounce version\fR\fR\fI = \fR\fI\FC4\&.9\F[]\fR\fI \fR 1659 .sp 1660 Example: 1661 \fI\fIannounce version\fR\fR\fI = \fR\fI\FC2\&.0\F[]\fR\fI \fR 1386 1662 .RE 1387 1663 … … 1391 1667 .RS 4 1392 1668 This option allows the administrator to chose what authentication methods 1393 smbd 1669 \FCsmbd\F[] 1394 1670 will use when authenticating a user\&. This option defaults to sensible values based on 1395 1671 \m[blue]\fBsecurity\fR\m[]\&. This should be considered a developer option and used only in rare circumstances\&. In the majority (if not all) of production servers, the default setting should be adequate\&. … … 1410 1686 .sp 1411 1687 Default: 1412 \fI\fIauth methods\fR\fR\fI = \fR\fI\ fR\fI \fR1413 .sp 1414 Example: 1415 \fI\fIauth methods\fR\fR\fI = \fR\fI guest sam winbind\fR\fI \fR1688 \fI\fIauth methods\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 1689 .sp 1690 Example: 1691 \fI\fIauth methods\fR\fR\fI = \fR\fI\FCguest sam winbind\F[]\fR\fI \fR 1416 1692 .RE 1417 1693 … … 1426 1702 .sp 1427 1703 Default: 1428 \fI\fIavailable\fR\fR\fI = \fR\fI yes\fR\fI \fR1704 \fI\fIavailable\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 1429 1705 .RE 1430 1706 … … 1440 1716 .sp 1441 1717 For name service it causes 1442 nmbd 1718 \FCnmbd\F[] 1443 1719 to bind to ports 137 and 138 on the interfaces listed in the 1444 1720 \m[blue]\fBinterfaces\fR\m[] 1445 1721 parameter\&. 1446 nmbd 1722 \FCnmbd\F[] 1447 1723 also binds to the "all addresses" interface (0\&.0\&.0\&.0) on ports 137 and 138 for the purposes of reading broadcast messages\&. If this option is not set then 1448 nmbd 1724 \FCnmbd\F[] 1449 1725 will service name requests on all of these sockets\&. If 1450 1726 \m[blue]\fBbind interfaces only\fR\m[] 1451 1727 is set then 1452 nmbd 1728 \FCnmbd\F[] 1453 1729 will check the source address of any packets coming in on the broadcast sockets and discard any that don\'t match the broadcast addresses of the interfaces in the 1454 1730 \m[blue]\fBinterfaces\fR\m[] 1455 1731 parameter list\&. As unicast packets are received on the other sockets it allows 1456 nmbd 1732 \FCnmbd\F[] 1457 1733 to refuse to serve names to machines that send packets that arrive through any interfaces not listed in the 1458 1734 \m[blue]\fBinterfaces\fR\m[] 1459 1735 list\&. IP Source address spoofing does defeat this simple check, however, so it must not be used seriously as a security feature for 1460 nmbd\&.1736 \FCnmbd\F[]\&. 1461 1737 .sp 1462 1738 For file service it causes … … 1465 1741 \m[blue]\fBinterfaces\fR\m[] 1466 1742 parameter\&. This restricts the networks that 1467 smbd 1743 \FCsmbd\F[] 1468 1744 will serve, to packets coming in on those interfaces\&. Note that you should not use this parameter for machines that are serving PPP or other intermittent or non\-broadcast network interfaces as it will not cope with non\-permanent interfaces\&. 1469 1745 .sp … … 1481 1757 .sp 1482 1758 To change a users SMB password, the 1483 smbpasswd 1759 \FCsmbpasswd\F[] 1484 1760 by default connects to the 1485 1761 \fIlocalhost \- 127\&.0\&.0\&.1\fR … … 1491 1767 \m[blue]\fBinterfaces\fR\m[] 1492 1768 parameter list then 1493 smbpasswd 1769 \FC smbpasswd\F[] 1494 1770 will fail to connect in it\'s default mode\&. 1495 smbpasswd 1771 \FCsmbpasswd\F[] 1496 1772 can be forced to use the primary IP interface of the local host by using its 1497 1773 \fBsmbpasswd\fR(8) … … 1502 1778 .sp 1503 1779 The 1504 swat 1780 \FCswat\F[] 1505 1781 status page tries to connect with 1506 smbd 1782 \FCsmbd\F[] 1507 1783 and 1508 nmbd 1784 \FCnmbd\F[] 1509 1785 at the address 1510 1786 \fI127\&.0\&.0\&.1\fR … … 1512 1788 \fI127\&.0\&.0\&.1\fR 1513 1789 will cause 1514 smbd 1790 \FC smbd\F[] 1515 1791 and 1516 nmbd 1792 \FCnmbd\F[] 1517 1793 to always show "not running" even if they really are\&. This can prevent 1518 swat 1794 \FC swat\F[] 1519 1795 from starting/stopping/restarting 1520 smbd 1796 \FCsmbd\F[] 1521 1797 and 1522 nmbd\&.1523 .sp 1524 Default: 1525 \fI\fIbind interfaces only\fR\fR\fI = \fR\fI no\fR\fI \fR1798 \FCnmbd\F[]\&. 1799 .sp 1800 Default: 1801 \fI\fIbind interfaces only\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 1526 1802 .RE 1527 1803 … … 1540 1816 .sp 1541 1817 Default: 1542 \fI\fIblocking locks\fR\fR\fI = \fR\fI yes\fR\fI \fR1818 \fI\fIblocking locks\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 1543 1819 .RE 1544 1820 … … 1556 1832 .sp 1557 1833 Default: 1558 \fI\fIblock size\fR\fR\fI = \fR\fI 1024\fR\fI \fR1559 .sp 1560 Example: 1561 \fI\fIblock size\fR\fR\fI = \fR\fI 4096\fR\fI \fR1834 \fI\fIblock size\fR\fR\fI = \fR\fI\FC1024\F[]\fR\fI \fR 1835 .sp 1836 Example: 1837 \fI\fIblock size\fR\fR\fI = \fR\fI\FC4096\F[]\fR\fI \fR 1562 1838 .RE 1563 1839 … … 1577 1853 .sp 1578 1854 Default: 1579 \fI\fIbrowseable\fR\fR\fI = \fR\fI yes\fR\fI \fR1855 \fI\fIbrowseable\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 1580 1856 .RE 1581 1857 … … 1587 1863 \fBsmbd\fR(8) 1588 1864 will serve a browse list to a client doing a 1589 NetServerEnum 1865 \FCNetServerEnum\F[] 1590 1866 call\&. Normally set to 1591 1867 \fByes\fR\&. You should never need to change this\&. 1592 1868 .sp 1593 1869 Default: 1594 \fI\fIbrowse list\fR\fR\fI = \fR\fI yes\fR\fI \fR1870 \fI\fIbrowse list\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 1595 1871 .RE 1596 1872 … … 1611 1887 .sp 1612 1888 Default: 1613 \fI\fIcase sensitive\fR\fR\fI = \fR\fI no\fR\fI \fR1889 \fI\fIcase sensitive\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 1614 1890 .RE 1615 1891 … … 1623 1899 .sp 1624 1900 Default: 1625 \fI\fIchange notify\fR\fR\fI = \fR\fI yes\fR\fI \fR1901 \fI\fIchange notify\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 1626 1902 .RE 1627 1903 … … 1633 1909 \fIchange share command\fR 1634 1910 is used to define an external program or script which will modify an existing service definition in 1635 smb\&.conf\&.1911 \FCsmb\&.conf\F[]\&. 1636 1912 .sp 1637 1913 In order to successfully execute the 1638 1914 \fIchange share command\fR, 1639 smbd 1915 \FCsmbd\F[] 1640 1916 requires that the administrator connects using a root account (i\&.e\&. uid == 0) or has the 1641 SeDiskOperatorPrivilege\&. Scripts defined in the1917 \FCSeDiskOperatorPrivilege\F[]\&. Scripts defined in the 1642 1918 \fIchange share command\fR 1643 1919 parameter are executed as root\&. 1644 1920 .sp 1645 1921 When executed, 1646 smbd 1922 \FCsmbd\F[] 1647 1923 will automatically invoke the 1648 1924 \fIchange share command\fR … … 1659 1935 \fIconfigFile\fR 1660 1936 \- the location of the global 1661 smb\&.conf 1937 \FCsmb\&.conf\F[] 1662 1938 file\&. 1663 1939 .RE … … 1714 1990 .sp 1715 1991 Default: 1716 \fI\fIchange share command\fR\fR\fI = \fR\fI\ fR\fI \fR1717 .sp 1718 Example: 1719 \fI\fIchange share command\fR\fR\fI = \fR\fI /usr/local/bin/changeshare\fR\fI \fR1992 \fI\fIchange share command\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 1993 .sp 1994 Example: 1995 \fI\fIchange share command\fR\fR\fI = \fR\fI\FC/usr/local/bin/changeshare\F[]\fR\fI \fR 1720 1996 .RE 1721 1997 … … 1729 2005 .sp 1730 2006 Note: In the example directory is a sample program called 1731 crackcheck 2007 \FCcrackcheck\F[] 1732 2008 that uses cracklib to check the password quality\&. 1733 2009 .sp 1734 2010 Default: 1735 \fI\fIcheck password script\fR\fR\fI = \fR\fI Disabled\fR\fI \fR1736 .sp 1737 Example: 1738 \fI\fIcheck password script\fR\fR\fI = \fR\fI /usr/local/sbin/crackcheck\fR\fI \fR2011 \fI\fIcheck password script\fR\fR\fI = \fR\fI\FCDisabled\F[]\fR\fI \fR 2012 .sp 2013 Example: 2014 \fI\fIcheck password script\fR\fR\fI = \fR\fI\FC/usr/local/sbin/crackcheck\F[]\fR\fI \fR 1739 2015 .RE 1740 2016 … … 1750 2026 .sp 1751 2027 Disabling this option will also disable the 1752 client plaintext auth 2028 \FCclient plaintext auth\F[] 1753 2029 option\&. 1754 2030 .sp 1755 2031 Likewise, if the 1756 client ntlmv2 auth 2032 \FCclient ntlmv2 auth\F[] 1757 2033 parameter is enabled, then only NTLMv2 logins will be attempted\&. 1758 2034 .sp 1759 2035 Default: 1760 \fI\fIclient lanman auth\fR\fR\fI = \fR\fI no\fR\fI \fR2036 \fI\fIclient lanman auth\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 1761 2037 .RE 1762 2038 … … 1779 2055 are only available if Samba has been compiled against a modern OpenLDAP version (2\&.3\&.x or higher)\&. 1780 2056 .sp 1781 This option is needed in the case of Domain Controllers enforcing the usage of signed LDAP connections (e\&.g\&. Windows 2000 SP3 or higher)\&. LDAP sign and seal can be controlled with the registry key " HKLM\eSystem\eCurrentControlSet\eServices\e1782 NTDS\eParameters\eLDAPServerIntegrity" on the Windows server side\&.2057 This option is needed in the case of Domain Controllers enforcing the usage of signed LDAP connections (e\&.g\&. Windows 2000 SP3 or higher)\&. LDAP sign and seal can be controlled with the registry key "\FCHKLM\eSystem\eCurrentControlSet\eServices\e\F[] 2058 \FCNTDS\eParameters\eLDAPServerIntegrity\F[]" on the Windows server side\&. 1783 2059 .sp 1784 2060 Depending on the used KRB5 library (MIT and older Heimdal versions) it is possible that the message "integrity only" is not supported\&. In this case, … … 1795 2071 .sp 1796 2072 Default: 1797 \fI\fIclient ldap sasl wrapping\fR\fR\fI = \fR\fI plain\fR\fI \fR2073 \fI\fIclient ldap sasl wrapping\fR\fR\fI = \fR\fI\FCplain\F[]\fR\fI \fR 1798 2074 .RE 1799 2075 … … 1809 2085 .sp 1810 2086 Similarly, if enabled, NTLMv1, 1811 client lanman auth 2087 \FCclient lanman auth\F[] 1812 2088 and 1813 client plaintext auth 2089 \FCclient plaintext auth\F[] 1814 2090 authentication will be disabled\&. This also disables share\-level authentication\&. 1815 2091 .sp 1816 2092 If disabled, an NTLM response (and possibly a LANMAN response) will be sent by the client, depending on the value of 1817 client lanman auth\&.2093 \FCclient lanman auth\F[]\&. 1818 2094 .sp 1819 2095 Note that some sites (particularly those following \'best practice\' security polices) only allow NTLMv2 responses, and not the weaker LM or NTLM\&. 1820 2096 .sp 1821 2097 Default: 1822 \fI\fIclient ntlmv2 auth\fR\fR\fI = \fR\fI no\fR\fI \fR2098 \fI\fIclient ntlmv2 auth\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 1823 2099 .RE 1824 2100 … … 1830 2106 .sp 1831 2107 Default: 1832 \fI\fIclient plaintext auth\fR\fR\fI = \fR\fI no\fR\fI \fR2108 \fI\fIclient plaintext auth\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 1833 2109 .RE 1834 2110 … … 1846 2122 .sp 1847 2123 Default: 1848 \fI\fIclient schannel\fR\fR\fI = \fR\fI auto\fR\fI \fR1849 .sp 1850 Example: 1851 \fI\fIclient schannel\fR\fR\fI = \fR\fI yes\fR\fI \fR2124 \fI\fIclient schannel\fR\fR\fI = \fR\fI\FCauto\F[]\fR\fI \fR 2125 .sp 2126 Example: 2127 \fI\fIclient schannel\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 1852 2128 .RE 1853 2129 … … 1865 2141 .sp 1866 2142 Default: 1867 \fI\fIclient signing\fR\fR\fI = \fR\fI auto\fR\fI \fR2143 \fI\fIclient signing\fR\fR\fI = \fR\fI\FCauto\F[]\fR\fI \fR 1868 2144 .RE 1869 2145 … … 1875 2151 .sp 1876 2152 Default: 1877 \fI\fIclient use spnego\fR\fR\fI = \fR\fI yes\fR\fI \fR2153 \fI\fIclient use spnego\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 1878 2154 .RE 1879 2155 … … 1885 2161 .sp 1886 2162 Default: 1887 \fI\fIcluster addresses\fR\fR\fI = \fR\fI\ fR\fI \fR1888 .sp 1889 Example: 1890 \fI\fIcluster addresses\fR\fR\fI = \fR\fI 10\&.0\&.0\&.1 10\&.0\&.0\&.2 10\&.0\&.0\&.3\fR\fI \fR2163 \fI\fIcluster addresses\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 2164 .sp 2165 Example: 2166 \fI\fIcluster addresses\fR\fR\fI = \fR\fI\FC10\&.0\&.0\&.1 10\&.0\&.0\&.2 10\&.0\&.0\&.3\F[]\fR\fI \fR 1891 2167 .RE 1892 2168 … … 1898 2174 .sp 1899 2175 Set this parameter to 1900 yes 2176 \FCyes\F[] 1901 2177 only if you have a cluster setup with ctdb running\&. 1902 2178 .sp 1903 2179 Default: 1904 \fI\fIclustering\fR\fR\fI = \fR\fI no\fR\fI \fR2180 \fI\fIclustering\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 1905 2181 .RE 1906 2182 … … 1910 2186 .RS 4 1911 2187 This is a text field that is seen next to a share when a client does a queries the server, either via the network neighborhood or via 1912 net view 2188 \FCnet view\F[] 1913 2189 to list what shares are available\&. 1914 2190 .sp … … 1918 2194 .sp 1919 2195 Default: 1920 \fI\fIcomment\fR\fR\fI = \fR\fI # No comment\fR\fI \fR1921 .sp 1922 Example: 1923 \fI\fIcomment\fR\fR\fI = \fR\fI Fred\'s Files\fR\fI \fR2196 \fI\fIcomment\fR\fR\fI = \fR\fI\FC # No comment\F[]\fR\fI \fR 2197 .sp 2198 Example: 2199 \fI\fIcomment\fR\fR\fI = \fR\fI\FCFred\'s Files\F[]\fR\fI \fR 1924 2200 .RE 1925 2201 … … 1942 2218 .sp 1943 2219 Default: 1944 \fI\fIconfig backend\fR\fR\fI = \fR\fI file\fR\fI \fR1945 .sp 1946 Example: 1947 \fI\fIconfig backend\fR\fR\fI = \fR\fI registry\fR\fI \fR2220 \fI\fIconfig backend\fR\fR\fI = \fR\fI\FCfile\F[]\fR\fI \fR 2221 .sp 2222 Example: 2223 \fI\fIconfig backend\fR\fR\fI = \fR\fI\FCregistry\F[]\fR\fI \fR 1948 2224 .RE 1949 2225 … … 1953 2229 .RS 4 1954 2230 This allows you to override the config file to use, instead of the default (usually 1955 smb\&.conf)\&. There is a chicken and egg problem here as this option is set in the config file!2231 \FCsmb\&.conf\F[])\&. There is a chicken and egg problem here as this option is set in the config file! 1956 2232 .sp 1957 2233 For this reason, if the name of the config file has changed when the parameters are loaded then it will reload them from the new config file\&. … … 1964 2240 .sp 1965 2241 Example: 1966 \fI\fIconfig file\fR\fR\fI = \fR\fI /usr/local/samba/lib/smb\&.conf\&.%m\fR\fI \fR2242 \fI\fIconfig file\fR\fR\fI = \fR\fI\FC/usr/local/samba/lib/smb\&.conf\&.%m\F[]\fR\fI \fR 1967 2243 .RE 1968 2244 … … 1976 2252 .sp 1977 2253 Default: 1978 \fI\fIcopy\fR\fR\fI = \fR\fI\ fR\fI \fR1979 .sp 1980 Example: 1981 \fI\fIcopy\fR\fR\fI = \fR\fI otherservice\fR\fI \fR2254 \fI\fIcopy\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 2255 .sp 2256 Example: 2257 \fI\fIcopy\fR\fR\fI = \fR\fI\FCotherservice\F[]\fR\fI \fR 1982 2258 .RE 1983 2259 … … 1999 2275 .sp 2000 2276 The default value of this parameter removes the 2001 group 2277 \FCgroup\F[] 2002 2278 and 2003 other 2279 \FCother\F[] 2004 2280 write and execute bits from the UNIX modes\&. 2005 2281 .sp … … 2016 2292 .sp 2017 2293 Default: 2018 \fI\fIcreate mask\fR\fR\fI = \fR\fI 0744\fR\fI \fR2019 .sp 2020 Example: 2021 \fI\fIcreate mask\fR\fR\fI = \fR\fI 0775\fR\fI \fR2294 \fI\fIcreate mask\fR\fR\fI = \fR\fI\FC0744\F[]\fR\fI \fR 2295 .sp 2296 Example: 2297 \fI\fIcreate mask\fR\fR\fI = \fR\fI\FC0775\F[]\fR\fI \fR 2022 2298 .RE 2023 2299 … … 2035 2311 .sp 2036 2312 Default: 2037 \fI\fIcsc policy\fR\fR\fI = \fR\fI manual\fR\fI \fR2038 .sp 2039 Example: 2040 \fI\fIcsc policy\fR\fR\fI = \fR\fI programs\fR\fI \fR2313 \fI\fIcsc policy\fR\fR\fI = \fR\fI\FCmanual\F[]\fR\fI \fR 2314 .sp 2315 Example: 2316 \fI\fIcsc policy\fR\fR\fI = \fR\fI\FCprograms\F[]\fR\fI \fR 2041 2317 .RE 2042 2318 … … 2046 2322 .RS 4 2047 2323 If you set 2048 clustering=yes, you need to tell Samba where ctdbd listens on its unix domain socket\&. The default path as of ctdb 1\&.0 is /tmp/ctdb\&.socket which you have to explicitly set for Samba in smb\&.conf\&.2049 .sp 2050 Default: 2051 \fI\fIctdbd socket\fR\fR\fI = \fR\fI\ fR\fI \fR2052 .sp 2053 Example: 2054 \fI\fIctdbd socket\fR\fR\fI = \fR\fI /tmp/ctdb\&.socket\fR\fI \fR2324 \FCclustering=yes\F[], you need to tell Samba where ctdbd listens on its unix domain socket\&. The default path as of ctdb 1\&.0 is /tmp/ctdb\&.socket which you have to explicitly set for Samba in smb\&.conf\&. 2325 .sp 2326 Default: 2327 \fI\fIctdbd socket\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 2328 .sp 2329 Example: 2330 \fI\fIctdbd socket\fR\fR\fI = \fR\fI\FC/tmp/ctdb\&.socket\F[]\fR\fI \fR 2055 2331 .RE 2056 2332 … … 2067 2343 .sp 2068 2344 Default: 2069 \fI\fIcups connection timeout\fR\fR\fI = \fR\fI 30\fR\fI \fR2070 .sp 2071 Example: 2072 \fI\fIcups connection timeout\fR\fR\fI = \fR\fI 60\fR\fI \fR2345 \fI\fIcups connection timeout\fR\fR\fI = \fR\fI\FC30\F[]\fR\fI \fR 2346 .sp 2347 Example: 2348 \fI\fIcups connection timeout\fR\fR\fI = \fR\fI\FC60\F[]\fR\fI \fR 2073 2349 .RE 2074 2350 … … 2087 2363 \fBraw\fR 2088 2364 if your CUPS server 2089 error_log 2365 \FCerror_log\F[] 2090 2366 file contains messages such as "Unsupported format \'application/octet\-stream\'" when printing from a Windows client through Samba\&. It is no longer necessary to enable system wide raw printing in 2091 /etc/cups/mime\&.{convs,types}\&.2092 .sp 2093 Default: 2094 \fI\fIcups options\fR\fR\fI = \fR\fI ""\fR\fI \fR2095 .sp 2096 Example: 2097 \fI\fIcups options\fR\fR\fI = \fR\fI "raw media=a4"\fR\fI \fR2367 \FC/etc/cups/mime\&.{convs,types}\F[]\&. 2368 .sp 2369 Default: 2370 \fI\fIcups options\fR\fR\fI = \fR\fI\FC""\F[]\fR\fI \fR 2371 .sp 2372 Example: 2373 \fI\fIcups options\fR\fR\fI = \fR\fI\FC"raw media=a4"\F[]\fR\fI \fR 2098 2374 .RE 2099 2375 … … 2108 2384 .sp 2109 2385 If set, this option overrides the ServerName option in the CUPS 2110 client\&.conf\&. This is necessary if you have virtual samba servers that connect to different CUPS daemons\&.2386 \FCclient\&.conf\F[]\&. This is necessary if you have virtual samba servers that connect to different CUPS daemons\&. 2111 2387 .sp 2112 2388 Optionally, a port can be specified by separating the server name and port number with a colon\&. If no port was specified, the default port for IPP (631) will be used\&. 2113 2389 .sp 2114 2390 Default: 2115 \fI\fIcups server\fR\fR\fI = \fR\fI ""\fR\fI \fR2116 .sp 2117 Example: 2118 \fI\fIcups server\fR\fR\fI = \fR\fI mycupsserver\fR\fI \fR2119 .sp 2120 Example: 2121 \fI\fIcups server\fR\fR\fI = \fR\fI mycupsserver:1631\fR\fI \fR2391 \fI\fIcups server\fR\fR\fI = \fR\fI\FC""\F[]\fR\fI \fR 2392 .sp 2393 Example: 2394 \fI\fIcups server\fR\fR\fI = \fR\fI\FCmycupsserver\F[]\fR\fI \fR 2395 .sp 2396 Example: 2397 \fI\fIcups server\fR\fR\fI = \fR\fI\FCmycupsserver:1631\F[]\fR\fI \fR 2122 2398 .RE 2123 2399 … … 2137 2413 .sp 2138 2414 Default: 2139 \fI\fIdeadtime\fR\fR\fI = \fR\fI 0\fR\fI \fR2140 .sp 2141 Example: 2142 \fI\fIdeadtime\fR\fR\fI = \fR\fI 15\fR\fI \fR2415 \fI\fIdeadtime\fR\fR\fI = \fR\fI\FC0\F[]\fR\fI \fR 2416 .sp 2417 Example: 2418 \fI\fIdeadtime\fR\fR\fI = \fR\fI\FC15\F[]\fR\fI \fR 2143 2419 .RE 2144 2420 … … 2153 2429 .sp 2154 2430 Default: 2155 \fI\fIdebug class\fR\fR\fI = \fR\fI no\fR\fI \fR2431 \fI\fIdebug class\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 2156 2432 .RE 2157 2433 … … 2167 2443 .sp 2168 2444 Default: 2169 \fI\fIdebug hires timestamp\fR\fR\fI = \fR\fI no\fR\fI \fR2445 \fI\fIdebug hires timestamp\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 2170 2446 .RE 2171 2447 … … 2182 2458 .sp 2183 2459 Default: 2184 \fI\fIdebug pid\fR\fR\fI = \fR\fI no\fR\fI \fR2460 \fI\fIdebug pid\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 2185 2461 .RE 2186 2462 … … 2198 2474 .sp 2199 2475 Default: 2200 \fI\fIdebug prefix timestamp\fR\fR\fI = \fR\fI no\fR\fI \fR2476 \fI\fIdebug prefix timestamp\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 2201 2477 .RE 2202 2478 … … 2218 2494 .sp 2219 2495 Default: 2220 \fI\fIdebug timestamp\fR\fR\fI = \fR\fI yes\fR\fI \fR2496 \fI\fIdebug timestamp\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 2221 2497 .RE 2222 2498 … … 2232 2508 .sp 2233 2509 Default: 2234 \fI\fIdebug uid\fR\fR\fI = \fR\fI no\fR\fI \fR2510 \fI\fIdebug uid\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 2235 2511 .RE 2236 2512 … … 2245 2521 .sp 2246 2522 Default: 2247 \fI\fIdefault case\fR\fR\fI = \fR\fI lower\fR\fI \fR2523 \fI\fIdefault case\fR\fR\fI = \fR\fI\FClower\F[]\fR\fI \fR 2248 2524 .RE 2249 2525 … … 2259 2535 .sp 2260 2536 This parameter should be used with care and tested with the printer driver in question\&. It is better to leave the device mode to NULL and let the Windows client set the correct values\&. Because drivers do not do this all the time, setting 2261 default devmode = yes 2537 \FCdefault devmode = yes\F[] 2262 2538 will instruct smbd to generate a default one\&. 2263 2539 .sp … … 2266 2542 .sp 2267 2543 Default: 2268 \fI\fIdefault devmode\fR\fR\fI = \fR\fI yes\fR\fI \fR2544 \fI\fIdefault devmode\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 2269 2545 .RE 2270 2546 … … 2299 2575 .sp 2300 2576 Default: 2301 \fI\fIdefault service\fR\fR\fI = \fR\fI\ fR\fI \fR2302 .sp 2303 Example: 2304 \fI\fIdefault service\fR\fR\fI = \fR\fI pub\fR\fI \fR2577 \fI\fIdefault service\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 2578 .sp 2579 Example: 2580 \fI\fIdefault service\fR\fR\fI = \fR\fI\FCpub\F[]\fR\fI \fR 2305 2581 .RE 2306 2582 … … 2316 2592 .sp 2317 2593 Default: 2318 \fI\fIdefer sharing violations\fR\fR\fI = \fR\fI True\fR\fI \fR2594 \fI\fIdefer sharing violations\fR\fR\fI = \fR\fI\FCTrue\F[]\fR\fI \fR 2319 2595 .RE 2320 2596 … … 2331 2607 .sp 2332 2608 Default: 2333 \fI\fIdelete group script\fR\fR\fI = \fR\fI\ fR\fI \fR2609 \fI\fIdelete group script\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 2334 2610 .RE 2335 2611 … … 2343 2619 \m[blue]\fBdeleteprinter command\fR\m[] 2344 2620 defines a script to be run which will perform the necessary operations for removing the printer from the print system and from 2345 smb\&.conf\&.2621 \FCsmb\&.conf\F[]\&. 2346 2622 .sp 2347 2623 The … … 2353 2629 \m[blue]\fBdeleteprinter command\fR\m[] 2354 2630 has been executed, 2355 smbd 2631 \FCsmbd\F[] 2356 2632 will reparse the 2357 smb\&.conf 2633 \FC smb\&.conf\F[] 2358 2634 to check that the associated printer no longer exists\&. If the sharename is still valid, then 2359 smbd 2635 \FCsmbd \F[] 2360 2636 will return an ACCESS_DENIED error to the client\&. 2361 2637 .sp 2362 2638 Default: 2363 \fI\fIdeleteprinter command\fR\fR\fI = \fR\fI\ fR\fI \fR2364 .sp 2365 Example: 2366 \fI\fIdeleteprinter command\fR\fR\fI = \fR\fI /usr/bin/removeprinter\fR\fI \fR2639 \fI\fIdeleteprinter command\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 2640 .sp 2641 Example: 2642 \fI\fIdeleteprinter command\fR\fR\fI = \fR\fI\FC/usr/bin/removeprinter\F[]\fR\fI \fR 2367 2643 .RE 2368 2644 … … 2376 2652 .sp 2377 2653 Default: 2378 \fI\fIdelete readonly\fR\fR\fI = \fR\fI no\fR\fI \fR2654 \fI\fIdelete readonly\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 2379 2655 .RE 2380 2656 … … 2386 2662 \fIdelete share command\fR 2387 2663 is used to define an external program or script which will remove an existing service definition from 2388 smb\&.conf\&.2664 \FCsmb\&.conf\F[]\&. 2389 2665 .sp 2390 2666 In order to successfully execute the 2391 2667 \fIdelete share command\fR, 2392 smbd 2668 \FCsmbd\F[] 2393 2669 requires that the administrator connects using a root account (i\&.e\&. uid == 0) or has the 2394 SeDiskOperatorPrivilege\&. Scripts defined in the2670 \FCSeDiskOperatorPrivilege\F[]\&. Scripts defined in the 2395 2671 \fIdelete share command\fR 2396 2672 parameter are executed as root\&. 2397 2673 .sp 2398 2674 When executed, 2399 smbd 2675 \FCsmbd\F[] 2400 2676 will automatically invoke the 2401 2677 \fIdelete share command\fR … … 2412 2688 \fIconfigFile\fR 2413 2689 \- the location of the global 2414 smb\&.conf 2690 \FCsmb\&.conf\F[] 2415 2691 file\&. 2416 2692 .RE … … 2432 2708 .sp 2433 2709 Default: 2434 \fI\fIdelete share command\fR\fR\fI = \fR\fI\ fR\fI \fR2435 .sp 2436 Example: 2437 \fI\fIdelete share command\fR\fR\fI = \fR\fI /usr/local/bin/delshare\fR\fI \fR2710 \fI\fIdelete share command\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 2711 .sp 2712 Example: 2713 \fI\fIdelete share command\fR\fR\fI = \fR\fI\FC/usr/local/bin/delshare\F[]\fR\fI \fR 2438 2714 .RE 2439 2715 … … 2451 2727 .sp 2452 2728 Default: 2453 \fI\fIdelete user from group script\fR\fR\fI = \fR\fI\ fR\fI \fR2454 .sp 2455 Example: 2456 \fI\fIdelete user from group script\fR\fR\fI = \fR\fI /usr/sbin/deluser %u %g\fR\fI \fR2729 \fI\fIdelete user from group script\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 2730 .sp 2731 Example: 2732 \fI\fIdelete user from group script\fR\fR\fI = \fR\fI\FC/usr/sbin/deluser %u %g\F[]\fR\fI \fR 2457 2733 .RE 2458 2734 … … 2466 2742 .sp 2467 2743 This script is called when a remote client removes a user from the server, normally using \'User Manager for Domains\' or 2468 rpcclient\&.2744 \FCrpcclient\F[]\&. 2469 2745 .sp 2470 2746 This script should delete the given UNIX username\&. 2471 2747 .sp 2472 2748 Default: 2473 \fI\fIdelete user script\fR\fR\fI = \fR\fI\ fR\fI \fR2474 .sp 2475 Example: 2476 \fI\fIdelete user script\fR\fR\fI = \fR\fI /usr/local/samba/bin/del_user %u\fR\fI \fR2749 \fI\fIdelete user script\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 2750 .sp 2751 Example: 2752 \fI\fIdelete user script\fR\fR\fI = \fR\fI\FC/usr/local/samba/bin/del_user %u\F[]\fR\fI \fR 2477 2753 .RE 2478 2754 … … 2489 2765 If this option is set to 2490 2766 \fByes\fR, then Samba will attempt to recursively delete any files and directories within the vetoed directory\&. This can be useful for integration with file serving systems such as NetAtalk which create meta\-files within directories you might normally veto DOS/Windows users from seeing (e\&.g\&. 2491 \ &.AppleDouble)2767 \FC\&.AppleDouble\F[]) 2492 2768 .sp 2493 2769 Setting … … 2496 2772 .sp 2497 2773 Default: 2498 \fI\fIdelete veto files\fR\fR\fI = \fR\fI no\fR\fI \fR2774 \fI\fIdelete veto files\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 2499 2775 .RE 2500 2776 … … 2516 2792 .sp 2517 2793 Example: 2518 \fI\fIdfree cache time\fR\fR\fI = \fR\fI dfree cache time = 60\fR\fI \fR2794 \fI\fIdfree cache time\fR\fR\fI = \fR\fI\FCdfree cache time = 60\F[]\fR\fI \fR 2519 2795 .RE 2520 2796 … … 2534 2810 .sp 2535 2811 The external program will be passed a single parameter indicating a directory in the filesystem being queried\&. This will typically consist of the string 2536 \ &./\&. The script should return two integers in ASCII\&. The first should be the total disk space in blocks, and the second should be the number of available blocks\&. An optional third return value can give the block size in bytes\&. The default blocksize is 1024 bytes\&.2812 \FC\&./\F[]\&. The script should return two integers in ASCII\&. The first should be the total disk space in blocks, and the second should be the number of available blocks\&. An optional third return value can give the block size in bytes\&. The default blocksize is 1024 bytes\&. 2537 2813 .sp 2538 2814 Note: Your script should … … 2545 2821 .RS 4 2546 2822 .\} 2823 .fam C 2824 .ps -1 2547 2825 .nf 2826 .BB lightgray 2548 2827 2549 2828 #!/bin/sh 2550 2829 df $1 | tail \-1 | awk \'{print $(NF\-4),$(NF\-2)}\' 2830 .EB lightgray 2551 2831 .fi 2832 .fam 2833 .ps +1 2552 2834 .if n \{\ 2553 2835 .RE … … 2559 2841 .RS 4 2560 2842 .\} 2843 .fam C 2844 .ps -1 2561 2845 .nf 2846 .BB lightgray 2562 2847 2563 2848 #!/bin/sh 2564 2849 /usr/bin/df \-k $1 | tail \-1 | awk \'{print $3" "$5}\' 2850 .EB lightgray 2565 2851 .fi 2852 .fam 2853 .ps +1 2566 2854 .if n \{\ 2567 2855 .RE … … 2575 2863 .sp 2576 2864 Example: 2577 \fI\fIdfree command\fR\fR\fI = \fR\fI /usr/local/samba/bin/dfree\fR\fI \fR2865 \fI\fIdfree command\fR\fR\fI = \fR\fI\FC/usr/local/samba/bin/dfree\F[]\fR\fI \fR 2578 2866 .RE 2579 2867 … … 2606 2894 .sp 2607 2895 Default: 2608 \fI\fIdirectory mask\fR\fR\fI = \fR\fI 0755\fR\fI \fR2609 .sp 2610 Example: 2611 \fI\fIdirectory mask\fR\fR\fI = \fR\fI 0775\fR\fI \fR2896 \fI\fIdirectory mask\fR\fR\fI = \fR\fI\FC0755\F[]\fR\fI \fR 2897 .sp 2898 Example: 2899 \fI\fIdirectory mask\fR\fR\fI = \fR\fI\FC0775\F[]\fR\fI \fR 2612 2900 .RE 2613 2901 … … 2630 2918 .sp 2631 2919 Default: 2632 \fI\fIdirectory security mask\fR\fR\fI = \fR\fI 0777\fR\fI \fR2633 .sp 2634 Example: 2635 \fI\fIdirectory security mask\fR\fR\fI = \fR\fI 0700\fR\fI \fR2920 \fI\fIdirectory security mask\fR\fR\fI = \fR\fI\FC0777\F[]\fR\fI \fR 2921 .sp 2922 Example: 2923 \fI\fIdirectory security mask\fR\fR\fI = \fR\fI\FC0700\F[]\fR\fI \fR 2636 2924 .RE 2637 2925 … … 2645 2933 .\} 2646 2934 .RS 4 2935 .BM yellow 2647 2936 .it 1 an-trap 2648 2937 .nr an-no-space-flag 1 … … 2655 2944 Clients that only support netbios won\'t be able to see your samba server when netbios support is disabled\&. 2656 2945 .sp .5v 2657 .RE 2658 Default: 2659 \fI\fIdisable netbios\fR\fR\fI = \fR\fIno\fR\fI \fR 2946 .EM yellow 2947 .RE 2948 Default: 2949 \fI\fIdisable netbios\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 2660 2950 .RE 2661 2951 … … 2668 2958 .sp 2669 2959 Default: 2670 \fI\fIdisable spoolss\fR\fR\fI = \fR\fI no\fR\fI \fR2960 \fI\fIdisable spoolss\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 2671 2961 .RE 2672 2962 … … 2679 2969 .sp 2680 2970 Default: 2681 \fI\fIdisplay charset\fR\fR\fI = \fR\fI "LOCALE" or "ASCII" (depending on the system)\fR\fI \fR2682 .sp 2683 Example: 2684 \fI\fIdisplay charset\fR\fR\fI = \fR\fI UTF8\fR\fI \fR2971 \fI\fIdisplay charset\fR\fR\fI = \fR\fI\FC"LOCALE" or "ASCII" (depending on the system)\F[]\fR\fI \fR 2972 .sp 2973 Example: 2974 \fI\fIdisplay charset\fR\fR\fI = \fR\fI\FCUTF8\F[]\fR\fI \fR 2685 2975 .RE 2686 2976 … … 2696 2986 .sp 2697 2987 Default: 2698 \fI\fIdmapi support\fR\fR\fI = \fR\fI no\fR\fI \fR2988 \fI\fIdmapi support\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 2699 2989 .RE 2700 2990 … … 2709 2999 Note that the maximum length for a NetBIOS name is 15 characters, so the DNS name (or DNS alias) can likewise only be 15 characters, maximum\&. 2710 3000 .sp 2711 nmbd 3001 \FCnmbd\F[] 2712 3002 spawns a second copy of itself to do the DNS name lookup requests, as doing a name lookup is a blocking action\&. 2713 3003 .sp 2714 3004 Default: 2715 \fI\fIdns proxy\fR\fR\fI = \fR\fI yes\fR\fI \fR3005 \fI\fIdns proxy\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 2716 3006 .RE 2717 3007 … … 2726 3016 .sp 2727 3017 Default: 2728 \fI\fIdomain logons\fR\fR\fI = \fR\fI no\fR\fI \fR3018 \fI\fIdomain logons\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 2729 3019 .RE 2730 3020 … … 2736 3026 \fBsmbd\fR(8) 2737 3027 to enable WAN\-wide browse list collation\&. Setting this option causes 2738 nmbd 3028 \FCnmbd\F[] 2739 3029 to claim a special domain specific NetBIOS name that identifies it as a domain master browser for its given 2740 3030 \m[blue]\fBworkgroup\fR\m[]\&. Local master browsers in the same 2741 3031 \m[blue]\fBworkgroup\fR\m[] 2742 3032 on broadcast\-isolated subnets will give this 2743 nmbd 3033 \FCnmbd\F[] 2744 3034 their local browse lists, and then ask 2745 3035 \fBsmbd\fR(8) … … 2751 3041 \m[blue]\fBworkgroup\fR\m[] 2752 3042 by default (i\&.e\&. there is no way to prevent a Windows NT PDC from attempting to do this)\&. This means that if this parameter is set and 2753 nmbd 3043 \FCnmbd\F[] 2754 3044 claims the special name for a 2755 3045 \m[blue]\fBworkgroup\fR\m[] … … 2771 3061 .sp 2772 3062 Default: 2773 \fI\fIdomain master\fR\fR\fI = \fR\fI auto\fR\fI \fR3063 \fI\fIdomain master\fR\fR\fI = \fR\fI\FCauto\F[]\fR\fI \fR 2774 3064 .RE 2775 3065 … … 2779 3069 .RS 4 2780 3070 There are certain directories on some systems (e\&.g\&., the 2781 /proc 3071 \FC/proc\F[] 2782 3072 tree under Linux) that are either not of interest to clients or are infinitely deep (recursive)\&. This parameter allows you to specify a comma\-delimited list of directories that the server should always show as empty\&. 2783 3073 .sp 2784 3074 Note that Samba can be very fussy about the exact format of the "dont descend" entries\&. For example you may need 2785 \ &./proc3075 \FC \&./proc\F[] 2786 3076 instead of just 2787 /proc\&. Experimentation is the best policy :\-)2788 .sp 2789 Default: 2790 \fI\fIdont descend\fR\fR\fI = \fR\fI\ fR\fI \fR2791 .sp 2792 Example: 2793 \fI\fIdont descend\fR\fR\fI = \fR\fI /proc,/dev\fR\fI \fR3077 \FC/proc\F[]\&. Experimentation is the best policy :\-) 3078 .sp 3079 Default: 3080 \fI\fIdont descend\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 3081 .sp 3082 Example: 3083 \fI\fIdont descend\fR\fR\fI = \fR\fI\FC/proc,/dev\F[]\fR\fI \fR 2794 3084 .RE 2795 3085 … … 2814 3104 .sp 2815 3105 Default: 2816 \fI\fIdos filemode\fR\fR\fI = \fR\fI no\fR\fI \fR3106 \fI\fIdos filemode\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 2817 3107 .RE 2818 3108 … … 2827 3117 .sp 2828 3118 Default: 2829 \fI\fIdos filetime resolution\fR\fR\fI = \fR\fI no\fR\fI \fR3119 \fI\fIdos filetime resolution\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 2830 3120 .RE 2831 3121 … … 2835 3125 .RS 4 2836 3126 Under DOS and Windows, if a user can write to a file they can change the timestamp on it\&. Under POSIX semantics, only the owner of the file or root may change the timestamp\&. By default, Samba runs with POSIX semantics and refuses to change the timestamp on a file if the user 2837 smbd 3127 \FCsmbd\F[] 2838 3128 is acting on behalf of is not the file owner\&. Setting this option to 2839 3129 \fB yes\fR … … 2843 3133 .sp 2844 3134 Default: 2845 \fI\fIdos filetimes\fR\fR\fI = \fR\fI yes\fR\fI \fR3135 \fI\fIdos filetimes\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 2846 3136 .RE 2847 3137 … … 2855 3145 .sp 2856 3146 Default: 2857 \fI\fIea support\fR\fR\fI = \fR\fI no\fR\fI \fR3147 \fI\fIea support\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 2858 3148 .RE 2859 3149 … … 2865 3155 .sp 2866 3156 Default: 2867 \fI\fIenable asu support\fR\fR\fI = \fR\fI no\fR\fI \fR3157 \fI\fIenable asu support\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 2868 3158 .RE 2869 3159 … … 2876 3166 .sp 2877 3167 Default: 2878 \fI\fIenable core files\fR\fR\fI = \fR\fI yes\fR\fI \fR2879 .sp 2880 Example: 2881 \fI\fIenable core files\fR\fR\fI = \fR\fI no\fR\fI \fR3168 \fI\fIenable core files\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 3169 .sp 3170 Example: 3171 \fI\fIenable core files\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 2882 3172 .RE 2883 3173 … … 2887 3177 .RS 4 2888 3178 This parameter controls whether or not smbd will honor privileges assigned to specific SIDs via either 2889 net rpc rights 3179 \FCnet rpc rights\F[] 2890 3180 or one of the Windows user and group manager tools\&. This parameter is enabled by default\&. It can be disabled to prevent members of the Domain Admins group from being able to assign privileges to users or groups which can then result in certain smbd operations running as root that would normally run under the context of the connected user\&. 2891 3181 .sp … … 2895 3185 .sp 2896 3186 Default: 2897 \fI\fIenable privileges\fR\fR\fI = \fR\fI yes\fR\fI \fR3187 \fI\fIenable privileges\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 2898 3188 .RE 2899 3189 … … 2917 3207 \m[blue]\fBsecurity = [server|domain|ads]\fR\m[] 2918 3208 parameter which causes 2919 smbd 3209 \FCsmbd\F[] 2920 3210 to authenticate against another server\&. 2921 3211 .sp 2922 3212 Default: 2923 \fI\fIencrypt passwords\fR\fR\fI = \fR\fI yes\fR\fI \fR3213 \fI\fIencrypt passwords\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 2924 3214 .RE 2925 3215 … … 2937 3227 .sp 2938 3228 Default: 2939 \fI\fIenhanced browsing\fR\fR\fI = \fR\fI yes\fR\fI \fR3229 \fI\fIenhanced browsing\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 2940 3230 .RE 2941 3231 … … 2944 3234 .PP 2945 3235 .RS 4 2946 The concept of a "port" is fairly foreign to UNIX hosts\&. Under Windows NT/2000 print servers, a port is associated with a port monitor and generally takes the form of a local port (i\&.e\&. LPT1:, COM1:, FILE:) or a remote port (i\&.e\&. LPD Port Monitor, etc\&.\&.\&.)\&. By default, Samba has only one port defined\-\-\fB"Samba Printer Port"\fR\&. Under Windows NT/2000, all printers must have a valid port name\&. If you wish to have a list of ports displayed ( smbd3236 The concept of a "port" is fairly foreign to UNIX hosts\&. Under Windows NT/2000 print servers, a port is associated with a port monitor and generally takes the form of a local port (i\&.e\&. LPT1:, COM1:, FILE:) or a remote port (i\&.e\&. LPD Port Monitor, etc\&.\&.\&.)\&. By default, Samba has only one port defined\-\-\fB"Samba Printer Port"\fR\&. Under Windows NT/2000, all printers must have a valid port name\&. If you wish to have a list of ports displayed (\FCsmbd \F[] 2947 3237 does not use a port name for anything) other than the default 2948 3238 \fB"Samba Printer Port"\fR, you can define … … 2951 3241 .sp 2952 3242 Default: 2953 \fI\fIenumports command\fR\fR\fI = \fR\fI\ fR\fI \fR2954 .sp 2955 Example: 2956 \fI\fIenumports command\fR\fR\fI = \fR\fI /usr/bin/listports\fR\fI \fR3243 \fI\fIenumports command\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 3244 .sp 3245 Example: 3246 \fI\fIenumports command\fR\fR\fI = \fR\fI\FC/usr/bin/listports\F[]\fR\fI \fR 2957 3247 .RE 2958 3248 … … 2962 3252 .RS 4 2963 3253 This option defines a list of log names that Samba will report to the Microsoft EventViewer utility\&. The listed eventlogs will be associated with tdb file on disk in the 2964 $(lockdir)/eventlog\&.3254 \FC$(lockdir)/eventlog\F[]\&. 2965 3255 .sp 2966 3256 The administrator must use an external process to parse the normal Unix logs such as 2967 /var/log/messages 3257 \FC/var/log/messages\F[] 2968 3258 and write then entries to the eventlog tdb files\&. Refer to the eventlogadm(8) utility for how to write eventlog entries\&. 2969 3259 .sp 2970 3260 Default: 2971 \fI\fIeventlog list\fR\fR\fI = \fR\fI\ fR\fI \fR2972 .sp 2973 Example: 2974 \fI\fIeventlog list\fR\fR\fI = \fR\fI Security Application Syslog Apache\fR\fI \fR3261 \fI\fIeventlog list\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 3262 .sp 3263 Example: 3264 \fI\fIeventlog list\fR\fR\fI = \fR\fI\FCSecurity Application Syslog Apache\F[]\fR\fI \fR 2975 3265 .RE 2976 3266 … … 2986 3276 .sp 2987 3277 Default: 2988 \fI\fIfake directory create times\fR\fR\fI = \fR\fI no\fR\fI \fR3278 \fI\fIfake directory create times\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 2989 3279 .RE 2990 3280 … … 2996 3286 .sp 2997 3287 When you set 2998 fake oplocks = yes,3288 \FCfake oplocks = yes\F[], 2999 3289 \fBsmbd\fR(8) 3000 3290 will always grant oplock requests no matter how many clients are using the file\&. … … 3007 3297 .sp 3008 3298 Default: 3009 \fI\fIfake oplocks\fR\fR\fI = \fR\fI no\fR\fI \fR3299 \fI\fIfake oplocks\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 3010 3300 .RE 3011 3301 … … 3019 3309 \fBno\fR 3020 3310 prevents any file or directory that is a symbolic link from being followed (the user will get an error)\&. This option is very useful to stop users from adding a symbolic link to 3021 /etc/passwd 3311 \FC/etc/passwd\F[] 3022 3312 in their home directory for instance\&. However it will slow filename lookups down slightly\&. 3023 3313 .sp 3024 3314 This option is enabled (i\&.e\&. 3025 smbd 3315 \FCsmbd\F[] 3026 3316 will follow symbolic links) by default\&. 3027 3317 .sp 3028 3318 Default: 3029 \fI\fIfollow symlinks\fR\fR\fI = \fR\fI yes\fR\fI \fR3319 \fI\fIfollow symlinks\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 3030 3320 .RE 3031 3321 … … 3043 3333 .sp 3044 3334 Default: 3045 \fI\fIforce create mode\fR\fR\fI = \fR\fI 000\fR\fI \fR3046 .sp 3047 Example: 3048 \fI\fIforce create mode\fR\fR\fI = \fR\fI 0755\fR\fI \fR3335 \fI\fIforce create mode\fR\fR\fI = \fR\fI\FC000\F[]\fR\fI \fR 3336 .sp 3337 Example: 3338 \fI\fIforce create mode\fR\fR\fI = \fR\fI\FC0755\F[]\fR\fI \fR 3049 3339 .RE 3050 3340 … … 3062 3352 .sp 3063 3353 Default: 3064 \fI\fIforce directory mode\fR\fR\fI = \fR\fI 000\fR\fI \fR3065 .sp 3066 Example: 3067 \fI\fIforce directory mode\fR\fR\fI = \fR\fI 0755\fR\fI \fR3354 \fI\fIforce directory mode\fR\fR\fI = \fR\fI\FC000\F[]\fR\fI \fR 3355 .sp 3356 Example: 3357 \fI\fIforce directory mode\fR\fR\fI = \fR\fI\FC0755\F[]\fR\fI \fR 3068 3358 .RE 3069 3359 … … 3084 3374 .\} 3085 3375 .RS 4 3376 .BM yellow 3086 3377 .it 1 an-trap 3087 3378 .nr an-no-space-flag 1 … … 3094 3385 Users who can access the Samba server through other means can easily bypass this restriction, so it is primarily useful for standalone "appliance" systems\&. Administrators of most normal systems will probably want to leave it set as 0000\&. 3095 3386 .sp .5v 3096 .RE 3097 Default: 3098 \fI\fIforce directory security mode\fR\fR\fI = \fR\fI0\fR\fI \fR 3099 .sp 3100 Example: 3101 \fI\fIforce directory security mode\fR\fR\fI = \fR\fI700\fR\fI \fR 3387 .EM yellow 3388 .RE 3389 Default: 3390 \fI\fIforce directory security mode\fR\fR\fI = \fR\fI\FC0\F[]\fR\fI \fR 3391 .sp 3392 Example: 3393 \fI\fIforce directory security mode\fR\fR\fI = \fR\fI\FC700\F[]\fR\fI \fR 3102 3394 .RE 3103 3395 … … 3117 3409 .sp 3118 3410 In Samba 2\&.0\&.5 and above this parameter has extended functionality in the following way\&. If the group name listed here has a \'+\' character prepended to it then the current user accessing the share only has the primary group default assigned to this group if they are already assigned as a member of that group\&. This allows an administrator to decide that only users who are already in a particular group will create files with group ownership set to that group\&. This gives a finer granularity of ownership assignment\&. For example, the setting 3119 force group = +sys 3411 \FCforce group = +sys\F[] 3120 3412 means that only users who are already in group sys will have their default primary group assigned to sys when accessing this Samba share\&. All other users will retain their ordinary primary group\&. 3121 3413 .sp … … 3128 3420 .sp 3129 3421 Default: 3130 \fI\fIforce group\fR\fR\fI = \fR\fI\ fR\fI \fR3131 .sp 3132 Example: 3133 \fI\fIforce group\fR\fR\fI = \fR\fI agroup\fR\fI \fR3422 \fI\fIforce group\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 3423 .sp 3424 Example: 3425 \fI\fIforce group\fR\fR\fI = \fR\fI\FCagroup\F[]\fR\fI \fR 3134 3426 .RE 3135 3427 … … 3139 3431 .RS 4 3140 3432 When printing from Windows NT (or later), each printer in 3141 smb\&.conf 3433 \FCsmb\&.conf\F[] 3142 3434 has two associated names which can be used by the client\&. The first is the sharename (or shortname) defined in smb\&.conf\&. This is the only printername available for use by Windows 9x clients\&. The second name associated with a printer can be seen when browsing to the "Printers" (or "Printers and Faxes") folder on the Samba server\&. This is referred to simply as the printername (not to be confused with the 3143 3435 \fIprinter name\fR … … 3152 3444 .sp 3153 3445 Default: 3154 \fI\fIforce printername\fR\fR\fI = \fR\fI no\fR\fI \fR3446 \fI\fIforce printername\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 3155 3447 .RE 3156 3448 … … 3172 3464 .sp 3173 3465 Default: 3174 \fI\fIforce security mode\fR\fR\fI = \fR\fI 0\fR\fI \fR3175 .sp 3176 Example: 3177 \fI\fIforce security mode\fR\fR\fI = \fR\fI 700\fR\fI \fR3466 \fI\fIforce security mode\fR\fR\fI = \fR\fI\FC0\F[]\fR\fI \fR 3467 .sp 3468 Example: 3469 \fI\fIforce security mode\fR\fR\fI = \fR\fI\FC700\F[]\fR\fI \fR 3178 3470 .RE 3179 3471 … … 3189 3481 .sp 3190 3482 Default: 3191 \fI\fIforce unknown acl user\fR\fR\fI = \fR\fI no\fR\fI \fR3483 \fI\fIforce unknown acl user\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 3192 3484 .RE 3193 3485 … … 3203 3495 .sp 3204 3496 Default: 3205 \fI\fIforce user\fR\fR\fI = \fR\fI\ fR\fI \fR3206 .sp 3207 Example: 3208 \fI\fIforce user\fR\fR\fI = \fR\fI auser\fR\fI \fR3497 \fI\fIforce user\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 3498 .sp 3499 Example: 3500 \fI\fIforce user\fR\fR\fI = \fR\fI\FCauser\F[]\fR\fI \fR 3209 3501 .RE 3210 3502 … … 3224 3516 .sp 3225 3517 Default: 3226 \fI\fIfstype\fR\fR\fI = \fR\fI NTFS\fR\fI \fR3227 .sp 3228 Example: 3229 \fI\fIfstype\fR\fR\fI = \fR\fI Samba\fR\fI \fR3518 \fI\fIfstype\fR\fR\fI = \fR\fI\FCNTFS\F[]\fR\fI \fR 3519 .sp 3520 Example: 3521 \fI\fIfstype\fR\fR\fI = \fR\fI\FCSamba\F[]\fR\fI \fR 3230 3522 .RE 3231 3523 … … 3235 3527 .RS 4 3236 3528 The 3237 get quota command 3529 \FCget quota command\F[] 3238 3530 should only be used whenever there is no operating system API available from the OS that samba can use\&. 3239 3531 .sp 3240 3532 This option is only available you have compiled Samba with the 3241 \ -\-with\-sys\-quotas3533 \FC\-\-with\-sys\-quotas\F[] 3242 3534 option or on Linux with 3243 \ -\-with\-quotas3535 \FC\-\-with\-quotas\F[] 3244 3536 and a working quota api was found in the system\&. 3245 3537 .sp … … 3418 3710 .RE 3419 3711 Default: 3420 \fI\fIget quota command\fR\fR\fI = \fR\fI\ fR\fI \fR3421 .sp 3422 Example: 3423 \fI\fIget quota command\fR\fR\fI = \fR\fI /usr/local/sbin/query_quota\fR\fI \fR3712 \fI\fIget quota command\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 3713 .sp 3714 Example: 3715 \fI\fIget quota command\fR\fR\fI = \fR\fI\FC/usr/local/sbin/query_quota\F[]\fR\fI \fR 3424 3716 .RE 3425 3717 … … 3434 3726 .sp 3435 3727 Default: 3436 \fI\fIgetwd cache\fR\fR\fI = \fR\fI yes\fR\fI \fR3728 \fI\fIgetwd cache\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 3437 3729 .RE 3438 3730 … … 3446 3738 .sp 3447 3739 On some systems the default guest account "nobody" may not be able to print\&. Use another account in this case\&. You should test this by trying to log in as your guest user (perhaps by using the 3448 su \- 3740 \FCsu \-\F[] 3449 3741 command) and trying to print using the system print command such as 3450 lpr(1) 3742 \FClpr(1)\F[] 3451 3743 or 3452 lp(1)\&.3744 \FC lp(1)\F[]\&. 3453 3745 .sp 3454 3746 This parameter does not accept % macros, because many parts of the system require this value to be constant for correct operation\&. 3455 3747 .sp 3456 3748 Default: 3457 \fI\fIguest account\fR\fR\fI = \fR\fI nobody # default can be changed at compile\-time\fR\fI \fR3458 .sp 3459 Example: 3460 \fI\fIguest account\fR\fR\fI = \fR\fI ftp\fR\fI \fR3749 \fI\fIguest account\fR\fR\fI = \fR\fI\FCnobody # default can be changed at compile\-time\F[]\fR\fI \fR 3750 .sp 3751 Example: 3752 \fI\fIguest account\fR\fR\fI = \fR\fI\FCftp\F[]\fR\fI \fR 3461 3753 .RE 3462 3754 … … 3486 3778 .sp 3487 3779 Default: 3488 \fI\fIguest ok\fR\fR\fI = \fR\fI no\fR\fI \fR3780 \fI\fIguest ok\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 3489 3781 .RE 3490 3782 … … 3512 3804 .sp 3513 3805 Default: 3514 \fI\fIguest only\fR\fR\fI = \fR\fI no\fR\fI \fR3806 \fI\fIguest only\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 3515 3807 .RE 3516 3808 … … 3522 3814 .sp 3523 3815 Default: 3524 \fI\fIhide dot files\fR\fR\fI = \fR\fI yes\fR\fI \fR3816 \fI\fIhide dot files\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 3525 3817 .RE 3526 3818 … … 3548 3840 .RS 4 3549 3841 .\} 3842 .fam C 3843 .ps -1 3550 3844 .nf 3845 .if t \{\ 3846 .sp -1 3847 .\} 3848 .BB lightgray adjust-for-leading-newline 3849 .sp -1 3850 3551 3851 hide files = /\&.*/DesktopFolderDB/TrashFor%m/resource\&.frk/ 3852 .EB lightgray adjust-for-leading-newline 3853 .if t \{\ 3854 .sp 1 3855 .\} 3552 3856 .fi 3857 .fam 3858 .ps +1 3553 3859 .if n \{\ 3554 3860 .RE … … 3556 3862 .sp 3557 3863 Default: 3558 \fI\fIhide files\fR\fR\fI = \fR\fI # no file are hidden\fR\fI \fR3864 \fI\fIhide files\fR\fR\fI = \fR\fI\FC # no file are hidden\F[]\fR\fI \fR 3559 3865 .RE 3560 3866 … … 3566 3872 .sp 3567 3873 Default: 3568 \fI\fIhide special files\fR\fR\fI = \fR\fI no\fR\fI \fR3874 \fI\fIhide special files\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 3569 3875 .RE 3570 3876 … … 3576 3882 .sp 3577 3883 Default: 3578 \fI\fIhide unreadable\fR\fR\fI = \fR\fI no\fR\fI \fR3884 \fI\fIhide unreadable\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 3579 3885 .RE 3580 3886 … … 3586 3892 .sp 3587 3893 Default: 3588 \fI\fIhide unwriteable files\fR\fR\fI = \fR\fI no\fR\fI \fR3894 \fI\fIhide unwriteable files\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 3589 3895 .RE 3590 3896 … … 3605 3911 .RS 4 3606 3912 .\} 3913 .fam C 3914 .ps -1 3607 3915 .nf 3608 username server:/some/file/system 3916 .if t \{\ 3917 .sp -1 3918 .\} 3919 .BB lightgray adjust-for-leading-newline 3920 .sp -1 3921 3922 \FCusername server:/some/file/system\F[] 3923 .EB lightgray adjust-for-leading-newline 3924 .if t \{\ 3925 .sp 1 3926 .\} 3609 3927 .fi 3928 .fam 3929 .ps +1 3610 3930 .if n \{\ 3611 3931 .RE … … 3617 3937 .\} 3618 3938 .RS 4 3939 .BM yellow 3619 3940 .it 1 an-trap 3620 3941 .nr an-no-space-flag 1 … … 3627 3948 A working NIS client is required on the system for this option to work\&. 3628 3949 .sp .5v 3629 .RE 3630 Default: 3631 \fI\fIhomedir map\fR\fR\fI = \fR\fI\fR\fI \fR 3632 .sp 3633 Example: 3634 \fI\fIhomedir map\fR\fR\fI = \fR\fIamd\&.homedir\fR\fI \fR 3950 .EM yellow 3951 .RE 3952 Default: 3953 \fI\fIhomedir map\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 3954 .sp 3955 Example: 3956 \fI\fIhomedir map\fR\fR\fI = \fR\fI\FCamd\&.homedir\F[]\fR\fI \fR 3635 3957 .RE 3636 3958 … … 3647 3969 .sp 3648 3970 Default: 3649 \fI\fIhost msdfs\fR\fR\fI = \fR\fI yes\fR\fI \fR3971 \fI\fIhost msdfs\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 3650 3972 .RE 3651 3973 … … 3655 3977 .RS 4 3656 3978 Specifies whether samba should use (expensive) hostname lookups or use the ip addresses instead\&. An example place where hostname lookups are currently used is when checking the 3657 hosts deny 3979 \FChosts deny\F[] 3658 3980 and 3659 hosts allow\&.3660 .sp 3661 Default: 3662 \fI\fIhostname lookups\fR\fR\fI = \fR\fI no\fR\fI \fR3663 .sp 3664 Example: 3665 \fI\fIhostname lookups\fR\fR\fI = \fR\fI yes\fR\fI \fR3981 \FChosts allow\F[]\&. 3982 .sp 3983 Default: 3984 \fI\fIhostname lookups\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 3985 .sp 3986 Example: 3987 \fI\fIhostname lookups\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 3666 3988 .RE 3667 3989 … … 3686 4008 .sp 3687 4009 You can specify the hosts by name or IP number\&. For example, you could restrict access to only the hosts on a Class C subnet with something like 3688 allow hosts = 150\&.203\&.5\&.\&. The full syntax of the list is described in the man page3689 hosts_access(5)\&. Note that this man page may not be present on your system, so a brief description will be given here also\&.4010 \FCallow hosts = 150\&.203\&.5\&.\F[]\&. The full syntax of the list is described in the man page 4011 \FChosts_access(5)\F[]\&. Note that this man page may not be present on your system, so a brief description will be given here also\&. 3690 4012 .sp 3691 4013 Note that the localhost address 127\&.0\&.0\&.1 will always be allowed access unless specifically denied by a … … 3699 4021 Example 1: allow all IPs in 150\&.203\&.*\&.*; except one 3700 4022 .sp 3701 hosts allow = 150\&.203\&. EXCEPT 150\&.203\&.6\&.66 4023 \FChosts allow = 150\&.203\&. EXCEPT 150\&.203\&.6\&.66\F[] 3702 4024 .sp 3703 4025 Example 2: allow hosts that match the given network/netmask 3704 4026 .sp 3705 hosts allow = 150\&.203\&.15\&.0/255\&.255\&.255\&.0 4027 \FChosts allow = 150\&.203\&.15\&.0/255\&.255\&.255\&.0\F[] 3706 4028 .sp 3707 4029 Example 3: allow a couple of hosts 3708 4030 .sp 3709 hosts allow = lapland, arvidsjaur 4031 \FChosts allow = lapland, arvidsjaur\F[] 3710 4032 .sp 3711 4033 Example 4: allow only hosts in NIS netgroup "foonet", but deny access from one particular host 3712 4034 .sp 3713 hosts allow = @foonet 3714 .sp 3715 hosts deny = pirate 4035 \FChosts allow = @foonet\F[] 4036 .sp 4037 \FChosts deny = pirate\F[] 3716 4038 .if n \{\ 3717 4039 .sp 3718 4040 .\} 3719 4041 .RS 4 4042 .BM yellow 3720 4043 .it 1 an-trap 3721 4044 .nr an-no-space-flag 1 … … 3728 4051 Note that access still requires suitable user\-level passwords\&. 3729 4052 .sp .5v 4053 .EM yellow 3730 4054 .RE 3731 4055 See … … 3734 4058 .sp 3735 4059 Default: 3736 \fI\fIhosts allow\fR\fR\fI = \fR\fI # none (i\&.e\&., all hosts permitted access)\fR\fI \fR3737 .sp 3738 Example: 3739 \fI\fIhosts allow\fR\fR\fI = \fR\fI 150\&.203\&.5\&. myhost\&.mynet\&.edu\&.au\fR\fI \fR4060 \fI\fIhosts allow\fR\fR\fI = \fR\fI\FC # none (i\&.e\&., all hosts permitted access)\F[]\fR\fI \fR 4061 .sp 4062 Example: 4063 \fI\fIhosts allow\fR\fR\fI = \fR\fI\FC150\&.203\&.5\&. myhost\&.mynet\&.edu\&.au\F[]\fR\fI \fR 3740 4064 .RE 3741 4065 … … 3761 4085 .sp 3762 4086 In the event that it is necessary to deny all by default, use the keyword ALL (or the netmask 3763 0\&.0\&.0\&.0/0) and then explicitly specify to the4087 \FC0\&.0\&.0\&.0/0\F[]) and then explicitly specify to the 3764 4088 \m[blue]\fBhosts allow = hosts allow\fR\m[] 3765 4089 parameter those hosts that should be permitted access\&. 3766 4090 .sp 3767 4091 Default: 3768 \fI\fIhosts deny\fR\fR\fI = \fR\fI # none (i\&.e\&., no hosts specifically excluded)\fR\fI \fR3769 .sp 3770 Example: 3771 \fI\fIhosts deny\fR\fR\fI = \fR\fI 150\&.203\&.4\&. badhost\&.mynet\&.edu\&.au\fR\fI \fR4092 \fI\fIhosts deny\fR\fR\fI = \fR\fI\FC # none (i\&.e\&., no hosts specifically excluded)\F[]\fR\fI \fR 4093 .sp 4094 Example: 4095 \fI\fIhosts deny\fR\fR\fI = \fR\fI\FC150\&.203\&.4\&. badhost\&.mynet\&.edu\&.au\F[]\fR\fI \fR 3772 4096 .RE 3773 4097 … … 3789 4113 .sp 3790 4114 Example: 3791 \fI\fIidmap alloc backend\fR\fR\fI = \fR\fI tdb\fR\fI \fR4115 \fI\fIidmap alloc backend\fR\fR\fI = \fR\fI\FCtdb\F[]\fR\fI \fR 3792 4116 .RE 3793 4117 … … 3831 4155 .sp 3832 4156 Default: 3833 \fI\fIidmap backend\fR\fR\fI = \fR\fI tdb\fR\fI \fR4157 \fI\fIidmap backend\fR\fR\fI = \fR\fI\FCtdb\F[]\fR\fI \fR 3834 4158 .RE 3835 4159 … … 3841 4165 .sp 3842 4166 Default: 3843 \fI\fIidmap cache time\fR\fR\fI = \fR\fI 604800 (one week)\fR\fI \fR4167 \fI\fIidmap cache time\fR\fR\fI = \fR\fI\FC604800 (one week)\F[]\fR\fI \fR 3844 4168 .RE 3845 4169 … … 3874 4198 .RS 4 3875 4199 .\} 4200 .fam C 4201 .ps -1 3876 4202 .nf 4203 .if t \{\ 4204 .sp -1 4205 .\} 4206 .BB lightgray adjust-for-leading-newline 4207 .sp -1 4208 3877 4209 idmap backend = tdb 3878 4210 idmap uid = 1000000\-1999999 … … 3882 4214 idmap config CORP : range = 1000\-999999 3883 4215 4216 .EB lightgray adjust-for-leading-newline 4217 .if t \{\ 4218 .sp 1 4219 .\} 3884 4220 .fi 4221 .fam 4222 .ps +1 3885 4223 .if n \{\ 3886 4224 .RE … … 3910 4248 .sp 3911 4249 Default: 3912 \fI\fIidmap gid\fR\fR\fI = \fR\fI\ fR\fI \fR3913 .sp 3914 Example: 3915 \fI\fIidmap gid\fR\fR\fI = \fR\fI 10000\-20000\fR\fI \fR4250 \fI\fIidmap gid\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 4251 .sp 4252 Example: 4253 \fI\fIidmap gid\fR\fR\fI = \fR\fI\FC10000\-20000\F[]\fR\fI \fR 3916 4254 .RE 3917 4255 … … 3923 4261 .sp 3924 4262 Default: 3925 \fI\fIidmap negative cache time\fR\fR\fI = \fR\fI 120\fR\fI \fR4263 \fI\fIidmap negative cache time\fR\fR\fI = \fR\fI\FC120\F[]\fR\fI \fR 3926 4264 .RE 3927 4265 … … 3947 4285 .sp 3948 4286 Default: 3949 \fI\fIidmap uid\fR\fR\fI = \fR\fI\ fR\fI \fR3950 .sp 3951 Example: 3952 \fI\fIidmap uid\fR\fR\fI = \fR\fI 10000\-20000\fR\fI \fR4287 \fI\fIidmap uid\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 4288 .sp 4289 Example: 4290 \fI\fIidmap uid\fR\fR\fI = \fR\fI\FC10000\-20000\F[]\fR\fI \fR 3953 4291 .RE 3954 4292 … … 3974 4312 .sp 3975 4313 Default: 3976 \fI\fIinclude\fR\fR\fI = \fR\fI\ fR\fI \fR3977 .sp 3978 Example: 3979 \fI\fIinclude\fR\fR\fI = \fR\fI /usr/local/samba/lib/admin_smb\&.conf\fR\fI \fR4314 \fI\fIinclude\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 4315 .sp 4316 Example: 4317 \fI\fIinclude\fR\fR\fI = \fR\fI\FC/usr/local/samba/lib/admin_smb\&.conf\F[]\fR\fI \fR 3980 4318 .RE 3981 4319 … … 3987 4325 .sp 3988 4326 Default: 3989 \fI\fIinherit acls\fR\fR\fI = \fR\fI no\fR\fI \fR4327 \fI\fIinherit acls\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 3990 4328 .RE 3991 4329 … … 3999 4337 .sp 4000 4338 Default: 4001 \fI\fIinherit owner\fR\fR\fI = \fR\fI no\fR\fI \fR4339 \fI\fIinherit owner\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 4002 4340 .RE 4003 4341 … … 4030 4368 .sp 4031 4369 Default: 4032 \fI\fIinherit permissions\fR\fR\fI = \fR\fI no\fR\fI \fR4370 \fI\fIinherit permissions\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 4033 4371 .RE 4034 4372 … … 4044 4382 .sp 4045 4383 Default: 4046 \fI\fIinit logon delayed hosts\fR\fR\fI = \fR\fI\ fR\fI \fR4047 .sp 4048 Example: 4049 \fI\fIinit logon delayed hosts\fR\fR\fI = \fR\fI 150\&.203\&.5\&. myhost\&.mynet\&.de\fR\fI \fR4384 \fI\fIinit logon delayed hosts\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 4385 .sp 4386 Example: 4387 \fI\fIinit logon delayed hosts\fR\fR\fI = \fR\fI\FC150\&.203\&.5\&. myhost\&.mynet\&.de\F[]\fR\fI \fR 4050 4388 .RE 4051 4389 … … 4058 4396 .sp 4059 4397 Default: 4060 \fI\fIinit logon delay\fR\fR\fI = \fR\fI 100\fR\fI \fR4398 \fI\fIinit logon delay\fR\fR\fI = \fR\fI\FC100\F[]\fR\fI \fR 4061 4399 .RE 4062 4400 … … 4122 4460 .sp 4123 4461 Default: 4124 \fI\fIinterfaces\fR\fR\fI = \fR\fI\ fR\fI \fR4125 .sp 4126 Example: 4127 \fI\fIinterfaces\fR\fR\fI = \fR\fI eth0 192\&.168\&.2\&.10/24 192\&.168\&.3\&.10/255\&.255\&.255\&.0\fR\fI \fR4462 \fI\fIinterfaces\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 4463 .sp 4464 Example: 4465 \fI\fIinterfaces\fR\fR\fI = \fR\fI\FCeth0 192\&.168\&.2\&.10/24 192\&.168\&.3\&.10/255\&.255\&.255\&.0\F[]\fR\fI \fR 4128 4466 .RE 4129 4467 … … 4148 4486 .sp 4149 4487 Default: 4150 \fI\fIinvalid users\fR\fR\fI = \fR\fI # no invalid users\fR\fI \fR4151 .sp 4152 Example: 4153 \fI\fIinvalid users\fR\fR\fI = \fR\fI root fred admin @wheel\fR\fI \fR4488 \fI\fIinvalid users\fR\fR\fI = \fR\fI\FC # no invalid users\F[]\fR\fI \fR 4489 .sp 4490 Example: 4491 \fI\fIinvalid users\fR\fR\fI = \fR\fI\FCroot fred admin @wheel\F[]\fR\fI \fR 4154 4492 .RE 4155 4493 … … 4164 4502 .sp 4165 4503 If set, this option overrides the ServerName option in the CUPS 4166 client\&.conf\&. This is necessary if you have virtual samba servers that connect to different CUPS daemons\&.4167 .sp 4168 Default: 4169 \fI\fIiprint server\fR\fR\fI = \fR\fI ""\fR\fI \fR4170 .sp 4171 Example: 4172 \fI\fIiprint server\fR\fR\fI = \fR\fI MYCUPSSERVER\fR\fI \fR4504 \FCclient\&.conf\F[]\&. This is necessary if you have virtual samba servers that connect to different CUPS daemons\&. 4505 .sp 4506 Default: 4507 \fI\fIiprint server\fR\fR\fI = \fR\fI\FC""\F[]\fR\fI \fR 4508 .sp 4509 Example: 4510 \fI\fIiprint server\fR\fR\fI = \fR\fI\FCMYCUPSSERVER\F[]\fR\fI \fR 4173 4511 .RE 4174 4512 … … 4185 4523 .sp 4186 4524 Default: 4187 \fI\fIkeepalive\fR\fR\fI = \fR\fI 300\fR\fI \fR4188 .sp 4189 Example: 4190 \fI\fIkeepalive\fR\fR\fI = \fR\fI 600\fR\fI \fR4525 \fI\fIkeepalive\fR\fR\fI = \fR\fI\FC300\F[]\fR\fI \fR 4526 .sp 4527 Example: 4528 \fI\fIkeepalive\fR\fR\fI = \fR\fI\FC600\F[]\fR\fI \fR 4191 4529 .RE 4192 4530 … … 4200 4538 .sp 4201 4539 Default: 4202 \fI\fIkernel change notify\fR\fR\fI = \fR\fI yes\fR\fI \fR4540 \fI\fIkernel change notify\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 4203 4541 .RE 4204 4542 … … 4223 4561 .sp 4224 4562 Default: 4225 \fI\fIkernel oplocks\fR\fR\fI = \fR\fI yes\fR\fI \fR4563 \fI\fIkernel oplocks\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 4226 4564 .RE 4227 4565 … … 4237 4575 .sp 4238 4576 Unlike the 4239 encrypt passwords 4577 \FCencrypt passwords\F[] 4240 4578 option, this parameter cannot alter client behaviour, and the LANMAN response will still be sent over the network\&. See the 4241 client lanman auth 4579 \FCclient lanman auth\F[] 4242 4580 to disable this for Samba\'s clients (such as smbclient) 4243 4581 .sp 4244 4582 If this option, and 4245 ntlm auth 4583 \FCntlm auth\F[] 4246 4584 are both disabled, then only NTLMv2 logins will be permited\&. Not all clients support NTLMv2, and most will require special configuration to use it\&. 4247 4585 .sp 4248 4586 Default: 4249 \fI\fIlanman auth\fR\fR\fI = \fR\fI no\fR\fI \fR4587 \fI\fIlanman auth\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 4250 4588 .RE 4251 4589 … … 4256 4594 This parameter determines whether or not 4257 4595 \fBsmbd\fR(8) 4258 supports the new 64k streaming read and write vari ent SMB requests introduced with Windows 2000\&. Note that due to Windows 2000 client redirector bugs this requires Samba to be running on a 64\-bit capable operating system such as IRIX, Solaris or a Linux 2\&.4 kernel\&. Can improve performance by 10% with Windows 2000 clients\&. Defaults to on\&. Not as tested as some other Samba code paths\&.4259 .sp 4260 Default: 4261 \fI\fIlarge readwrite\fR\fR\fI = \fR\fI yes\fR\fI \fR4596 supports the new 64k streaming read and write variant SMB requests introduced with Windows 2000\&. Note that due to Windows 2000 client redirector bugs this requires Samba to be running on a 64\-bit capable operating system such as IRIX, Solaris or a Linux 2\&.4 kernel\&. Can improve performance by 10% with Windows 2000 clients\&. Defaults to on\&. Not as tested as some other Samba code paths\&. 4597 .sp 4598 Default: 4599 \fI\fIlarge readwrite\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 4262 4600 .RE 4263 4601 … … 4271 4609 \m[blue]\fBldap admin dn\fR\m[] 4272 4610 is used in conjunction with the admin dn password stored in the 4273 private/secrets\&.tdb 4611 \FCprivate/secrets\&.tdb\F[] 4274 4612 file\&. See the 4275 4613 \fBsmbpasswd\fR(8) … … 4297 4635 .sp 4298 4636 Default: 4299 \fI\fIldap connection timeout\fR\fR\fI = \fR\fI 2\fR\fI \fR4637 \fI\fIldap connection timeout\fR\fR\fI = \fR\fI\FC2\F[]\fR\fI \fR 4300 4638 .RE 4301 4639 … … 4314 4652 .sp 4315 4653 Default: 4316 \fI\fIldap debug level\fR\fR\fI = \fR\fI 0\fR\fI \fR4317 .sp 4318 Example: 4319 \fI\fIldap debug level\fR\fR\fI = \fR\fI 1\fR\fI \fR4654 \fI\fIldap debug level\fR\fR\fI = \fR\fI\FC0\F[]\fR\fI \fR 4655 .sp 4656 Example: 4657 \fI\fIldap debug level\fR\fR\fI = \fR\fI\FC1\F[]\fR\fI \fR 4320 4658 .RE 4321 4659 … … 4329 4667 .sp 4330 4668 Default: 4331 \fI\fIldap debug threshold\fR\fR\fI = \fR\fI 10\fR\fI \fR4332 .sp 4333 Example: 4334 \fI\fIldap debug threshold\fR\fR\fI = \fR\fI 5\fR\fI \fR4669 \fI\fIldap debug threshold\fR\fR\fI = \fR\fI\FC10\F[]\fR\fI \fR 4670 .sp 4671 Example: 4672 \fI\fIldap debug threshold\fR\fR\fI = \fR\fI\FC5\F[]\fR\fI \fR 4335 4673 .RE 4336 4674 … … 4342 4680 .sp 4343 4681 Default: 4344 \fI\fIldap delete dn\fR\fR\fI = \fR\fI no\fR\fI \fR4682 \fI\fIldap delete dn\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 4345 4683 .RE 4346 4684 … … 4356 4694 .sp 4357 4695 Default: 4358 \fI\fIldap group suffix\fR\fR\fI = \fR\fI\ fR\fI \fR4359 .sp 4360 Example: 4361 \fI\fIldap group suffix\fR\fR\fI = \fR\fI ou=Groups\fR\fI \fR4696 \fI\fIldap group suffix\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 4697 .sp 4698 Example: 4699 \fI\fIldap group suffix\fR\fR\fI = \fR\fI\FCou=Groups\F[]\fR\fI \fR 4362 4700 .RE 4363 4701 … … 4373 4711 .sp 4374 4712 Default: 4375 \fI\fIldap idmap suffix\fR\fR\fI = \fR\fI\ fR\fI \fR4376 .sp 4377 Example: 4378 \fI\fIldap idmap suffix\fR\fR\fI = \fR\fI ou=Idmap\fR\fI \fR4713 \fI\fIldap idmap suffix\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 4714 .sp 4715 Example: 4716 \fI\fIldap idmap suffix\fR\fR\fI = \fR\fI\FCou=Idmap\F[]\fR\fI \fR 4379 4717 .RE 4380 4718 … … 4390 4728 .sp 4391 4729 Default: 4392 \fI\fIldap machine suffix\fR\fR\fI = \fR\fI\ fR\fI \fR4393 .sp 4394 Example: 4395 \fI\fIldap machine suffix\fR\fR\fI = \fR\fI ou=Computers\fR\fI \fR4730 \fI\fIldap machine suffix\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 4731 .sp 4732 Example: 4733 \fI\fIldap machine suffix\fR\fR\fI = \fR\fI\FCou=Computers\F[]\fR\fI \fR 4396 4734 .RE 4397 4735 … … 4405 4743 .sp 4406 4744 Default: 4407 \fI\fIldap page size\fR\fR\fI = \fR\fI 1024\fR\fI \fR4408 .sp 4409 Example: 4410 \fI\fIldap page size\fR\fR\fI = \fR\fI 512\fR\fI \fR4745 \fI\fIldap page size\fR\fR\fI = \fR\fI\FC1024\F[]\fR\fI \fR 4746 .sp 4747 Example: 4748 \fI\fIldap page size\fR\fR\fI = \fR\fI\FC512\F[]\fR\fI \fR 4411 4749 .RE 4412 4750 … … 4458 4796 .RE 4459 4797 Default: 4460 \fI\fIldap passwd sync\fR\fR\fI = \fR\fI no\fR\fI \fR4798 \fI\fIldap passwd sync\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 4461 4799 .RE 4462 4800 … … 4472 4810 .sp 4473 4811 Default: 4474 \fI\fIldap replication sleep\fR\fR\fI = \fR\fI 1000\fR\fI \fR4812 \fI\fIldap replication sleep\fR\fR\fI = \fR\fI\FC1000\F[]\fR\fI \fR 4475 4813 .RE 4476 4814 … … 4482 4820 .sp 4483 4821 To use this option, a basic ldap tree must be provided and the ldap suffix parameters must be properly configured\&. On virgin servers the default users and groups (Administrator, Guest, Domain Users, Domain Admins, Domain Guests) can be precreated with the command 4484 net sam provision\&. To run this command the ldap server must be running, Winindd must be running and the smb\&.conf ldap options must be properly configured\&. The typical ldap setup used with the4822 \FCnet sam provision\F[]\&. To run this command the ldap server must be running, Winindd must be running and the smb\&.conf ldap options must be properly configured\&. The typical ldap setup used with the 4485 4823 \m[blue]\fBldapsam:trusted = yes\fR\m[] 4486 4824 option is usually sufficient to use … … 4493 4831 .RS 4 4494 4832 .\} 4833 .fam C 4834 .ps -1 4495 4835 .nf 4836 .if t \{\ 4837 .sp -1 4838 .\} 4839 .BB lightgray adjust-for-leading-newline 4840 .sp -1 4841 4496 4842 encrypt passwords = true 4497 4843 passdb backend = ldapsam … … 4513 4859 idmap gid = 5000\-50000 4514 4860 4861 .EB lightgray adjust-for-leading-newline 4862 .if t \{\ 4863 .sp 1 4864 .\} 4515 4865 .fi 4866 .fam 4867 .ps +1 4516 4868 .if n \{\ 4517 4869 .RE … … 4523 4875 .RS 4 4524 4876 .\} 4877 .fam C 4878 .ps -1 4525 4879 .nf 4880 .if t \{\ 4881 .sp -1 4882 .\} 4883 .BB lightgray adjust-for-leading-newline 4884 .sp -1 4885 4526 4886 dn: dc=samba,dc=org 4527 4887 objectClass: top … … 4558 4918 ou: computers 4559 4919 4920 .EB lightgray adjust-for-leading-newline 4921 .if t \{\ 4922 .sp 1 4923 .\} 4560 4924 .fi 4925 .fam 4926 .ps +1 4561 4927 .if n \{\ 4562 4928 .RE … … 4564 4930 .sp 4565 4931 Default: 4566 \fI\fIldapsam:editposix\fR\fR\fI = \fR\fI no\fR\fI \fR4932 \fI\fIldapsam:editposix\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 4567 4933 .RE 4568 4934 … … 4580 4946 .sp 4581 4947 Default: 4582 \fI\fIldapsam:trusted\fR\fR\fI = \fR\fI no\fR\fI \fR4948 \fI\fIldapsam:trusted\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 4583 4949 .RE 4584 4950 … … 4600 4966 .sp 4601 4967 Default: 4602 \fI\fIldap ssl ads\fR\fR\fI = \fR\fI no\fR\fI \fR4968 \fI\fIldap ssl ads\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 4603 4969 .RE 4604 4970 … … 4610 4976 \fINOT\fR 4611 4977 related to Samba\'s previous SSL support which was enabled by specifying the 4612 \ -\-with\-ssl4978 \FC\-\-with\-ssl\F[] 4613 4979 option to the 4614 configure 4980 \FCconfigure\F[] 4615 4981 script\&. 4616 4982 .sp … … 4665 5031 .sp 4666 5032 Default: 4667 \fI\fIldap ssl\fR\fR\fI = \fR\fI start tls\fR\fI \fR5033 \fI\fIldap ssl\fR\fR\fI = \fR\fI\FCstart tls\F[]\fR\fI \fR 4668 5034 .RE 4669 5035 … … 4682 5048 .sp 4683 5049 Default: 4684 \fI\fIldap suffix\fR\fR\fI = \fR\fI\ fR\fI \fR4685 .sp 4686 Example: 4687 \fI\fIldap suffix\fR\fR\fI = \fR\fI dc=samba,dc=org\fR\fI \fR5050 \fI\fIldap suffix\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 5051 .sp 5052 Example: 5053 \fI\fIldap suffix\fR\fR\fI = \fR\fI\FCdc=samba,dc=org\F[]\fR\fI \fR 4688 5054 .RE 4689 5055 … … 4695 5061 .sp 4696 5062 Default: 4697 \fI\fIldap timeout\fR\fR\fI = \fR\fI 15\fR\fI \fR5063 \fI\fIldap timeout\fR\fR\fI = \fR\fI\FC15\F[]\fR\fI \fR 4698 5064 .RE 4699 5065 … … 4709 5075 .sp 4710 5076 Default: 4711 \fI\fIldap user suffix\fR\fR\fI = \fR\fI\ fR\fI \fR4712 .sp 4713 Example: 4714 \fI\fIldap user suffix\fR\fR\fI = \fR\fI ou=people\fR\fI \fR5077 \fI\fIldap user suffix\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 5078 .sp 5079 Example: 5080 \fI\fIldap user suffix\fR\fR\fI = \fR\fI\FCou=people\F[]\fR\fI \fR 4715 5081 .RE 4716 5082 … … 4739 5105 .sp 4740 5106 Default: 4741 \fI\fIlevel2 oplocks\fR\fR\fI = \fR\fI yes\fR\fI \fR5107 \fI\fIlevel2 oplocks\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 4742 5108 .RE 4743 5109 … … 4763 5129 .sp 4764 5130 Default: 4765 \fI\fIlm announce\fR\fR\fI = \fR\fI auto\fR\fI \fR4766 .sp 4767 Example: 4768 \fI\fIlm announce\fR\fR\fI = \fR\fI yes\fR\fI \fR5131 \fI\fIlm announce\fR\fR\fI = \fR\fI\FCauto\F[]\fR\fI \fR 5132 .sp 5133 Example: 5134 \fI\fIlm announce\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 4769 5135 .RE 4770 5136 … … 4780 5146 .sp 4781 5147 Default: 4782 \fI\fIlm interval\fR\fR\fI = \fR\fI 60\fR\fI \fR4783 .sp 4784 Example: 4785 \fI\fIlm interval\fR\fR\fI = \fR\fI 120\fR\fI \fR5148 \fI\fIlm interval\fR\fR\fI = \fR\fI\FC60\F[]\fR\fI \fR 5149 .sp 5150 Example: 5151 \fI\fIlm interval\fR\fR\fI = \fR\fI\FC120\F[]\fR\fI \fR 4786 5152 .RE 4787 5153 … … 4795 5161 .sp 4796 5162 Default: 4797 \fI\fIload printers\fR\fR\fI = \fR\fI yes\fR\fI \fR5163 \fI\fIload printers\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 4798 5164 .RE 4799 5165 … … 4807 5173 \fBno\fR 4808 5174 then 4809 nmbd 5175 \FC nmbd\F[] 4810 5176 will not attempt to become a local master browser on a subnet and will also lose in all browsing elections\&. By default this value is set to 4811 5177 \fByes\fR\&. Setting this value to … … 4814 5180 \fIbecome\fR 4815 5181 the local master browser on a subnet, just that 4816 nmbd 5182 \FCnmbd\F[] 4817 5183 will 4818 5184 \fIparticipate\fR … … 4822 5188 \fBno\fR 4823 5189 will cause 4824 nmbd 5190 \FCnmbd\F[] 4825 5191 \fInever\fR 4826 5192 to become a local master browser\&. 4827 5193 .sp 4828 5194 Default: 4829 \fI\fIlocal master\fR\fR\fI = \fR\fI yes\fR\fI \fR5195 \fI\fIlocal master\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 4830 5196 .RE 4831 5197 … … 4849 5215 .sp 4850 5216 Default: 4851 \fI\fIlock directory\fR\fR\fI = \fR\fI ${prefix}/var/locks\fR\fI \fR4852 .sp 4853 Example: 4854 \fI\fIlock directory\fR\fR\fI = \fR\fI /var/run/samba/locks\fR\fI \fR5217 \fI\fIlock directory\fR\fR\fI = \fR\fI\FC${prefix}/var/locks\F[]\fR\fI \fR 5218 .sp 5219 Example: 5220 \fI\fIlock directory\fR\fR\fI = \fR\fI\FC/var/run/samba/locks\F[]\fR\fI \fR 4855 5221 .RE 4856 5222 … … 4862 5228 .sp 4863 5229 If 4864 locking = no, all lock and unlock requests will appear to succeed and all lock queries will report that the file in question is available for locking\&.5230 \FClocking = no\F[], all lock and unlock requests will appear to succeed and all lock queries will report that the file in question is available for locking\&. 4865 5231 .sp 4866 5232 If 4867 locking = yes, real locking will be performed by the server\&.5233 \FClocking = yes\F[], real locking will be performed by the server\&. 4868 5234 .sp 4869 5235 This option … … 4888 5254 .sp 4889 5255 Default: 4890 \fI\fIlock spin count\fR\fR\fI = \fR\fI 0\fR\fI \fR5256 \fI\fIlock spin count\fR\fR\fI = \fR\fI\FC0\F[]\fR\fI \fR 4891 5257 .RE 4892 5258 … … 4900 5266 .sp 4901 5267 Default: 4902 \fI\fIlock spin time\fR\fR\fI = \fR\fI 200\fR\fI \fR5268 \fI\fIlock spin time\fR\fR\fI = \fR\fI\FC200\F[]\fR\fI \fR 4903 5269 .RE 4904 5270 … … 4914 5280 .sp 4915 5281 Example: 4916 \fI\fIlog file\fR\fR\fI = \fR\fI /usr/local/samba/var/log\&.%m\fR\fI \fR5282 \fI\fIlog file\fR\fR\fI = \fR\fI\FC/usr/local/samba/var/log\&.%m\F[]\fR\fI \fR 4917 5283 .RE 4918 5284 … … 4930 5296 .RS 4 4931 5297 The value of the parameter (a astring) allows the debug level (logging level) to be specified in the 4932 smb\&.conf 5298 \FCsmb\&.conf\F[] 4933 5299 file\&. 4934 5300 .sp … … 5156 5522 .RE 5157 5523 Default: 5158 \fI\fIlog level\fR\fR\fI = \fR\fI 0\fR\fI \fR5159 .sp 5160 Example: 5161 \fI\fIlog level\fR\fR\fI = \fR\fI 3 passdb:5 auth:10 winbind:2\fR\fI \fR5524 \fI\fIlog level\fR\fR\fI = \fR\fI\FC0\F[]\fR\fI \fR 5525 .sp 5526 Example: 5527 \fI\fIlog level\fR\fR\fI = \fR\fI\FC3 passdb:5 auth:10 winbind:2\F[]\fR\fI \fR 5162 5528 .RE 5163 5529 … … 5172 5538 .sp 5173 5539 Default: 5174 \fI\fIlogon drive\fR\fR\fI = \fR\fI\ fR\fI \fR5175 .sp 5176 Example: 5177 \fI\fIlogon drive\fR\fR\fI = \fR\fI h:\fR\fI \fR5540 \fI\fIlogon drive\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 5541 .sp 5542 Example: 5543 \fI\fIlogon drive\fR\fR\fI = \fR\fI\FCh:\F[]\fR\fI \fR 5178 5544 .RE 5179 5545 … … 5185 5551 .sp 5186 5552 5187 C:\e>\fBNET USE H: /HOME\fR5553 \FCC:\e>\F[]\fBNET USE H: /HOME\fR 5188 5554 .sp 5189 5555 from a command prompt, for example\&. … … 5194 5560 .sp 5195 5561 5196 logon home = \e\e%N\e%U\eprofile 5562 \FClogon home = \e\e%N\e%U\eprofile\F[] 5197 5563 .sp 5198 5564 This tells Samba to return the above string, with substitutions made when a client requests the info, generally in a NetUserGetInfo request\&. Win9X clients truncate the info to \e\eserver\eshare when a user does 5199 net use /home 5565 \FCnet use /home\F[] 5200 5566 but use the whole string when dealing with profiles\&. 5201 5567 .sp … … 5204 5570 was returned rather than 5205 5571 \fIlogon home\fR\&. This broke 5206 net use /home 5572 \FCnet use /home\F[] 5207 5573 but allowed profiles outside the home directory\&. The current implementation is correct, and can be used for profiles if you use the above trick\&. 5208 5574 .sp … … 5214 5580 .sp 5215 5581 Default: 5216 \fI\fIlogon home\fR\fR\fI = \fR\fI\ e\e%N\e%U\fR\fI \fR5217 .sp 5218 Example: 5219 \fI\fIlogon home\fR\fR\fI = \fR\fI\ e\eremote_smb_server\e%U\fR\fI \fR5582 \fI\fIlogon home\fR\fR\fI = \fR\fI\FC\e\e%N\e%U\F[]\fR\fI \fR 5583 .sp 5584 Example: 5585 \fI\fIlogon home\fR\fR\fI = \fR\fI\FC\e\eremote_smb_server\e%U\F[]\fR\fI \fR 5220 5586 .RE 5221 5587 … … 5229 5595 .sp 5230 5596 This option takes the standard substitutions, allowing you to have separate logon scripts for each user or machine\&. It also specifies the directory from which the "Application Data", 5231 desktop,5232 start menu,5233 network neighborhood,5234 programs 5597 \FCdesktop\F[], 5598 \FCstart menu\F[], 5599 \FCnetwork neighborhood\F[], 5600 \FCprograms\F[] 5235 5601 and other folders, and their contents, are loaded and displayed on your Windows NT client\&. 5236 5602 .sp … … 5245 5611 .\} 5246 5612 .RS 4 5613 .BM yellow 5247 5614 .it 1 an-trap 5248 5615 .nr an-no-space-flag 1 … … 5257 5624 will break profile handling\&. Where the tdbsam or ldapsam passdb backend is used, at the time the user account is created the value configured for this parameter is written to the passdb backend and that value will over\-ride the parameter value present in the smb\&.conf file\&. Any error present in the passdb backend account record must be editted using the appropriate tool (pdbedit on the command\-line, or any other locally provided system tool)\&. 5258 5625 .sp .5v 5626 .EM yellow 5259 5627 .RE 5260 5628 Note that this option is only useful if Samba is set up as a domain controller\&. … … 5268 5636 .RS 4 5269 5637 .\} 5638 .fam C 5639 .ps -1 5270 5640 .nf 5641 .if t \{\ 5642 .sp -1 5643 .\} 5644 .BB lightgray adjust-for-leading-newline 5645 .sp -1 5646 5271 5647 logon path = \e\ePROFILESERVER\ePROFILE\e%U 5648 .EB lightgray adjust-for-leading-newline 5649 .if t \{\ 5650 .sp 1 5651 .\} 5272 5652 .fi 5653 .fam 5654 .ps +1 5273 5655 .if n \{\ 5274 5656 .RE … … 5276 5658 .sp 5277 5659 Default: 5278 \fI\fIlogon path\fR\fR\fI = \fR\fI\ e\e%N\e%U\eprofile\fR\fI \fR5660 \fI\fIlogon path\fR\fR\fI = \fR\fI\FC\e\e%N\e%U\eprofile\F[]\fR\fI \fR 5279 5661 .RE 5280 5662 … … 5283 5665 .PP 5284 5666 .RS 4 5285 This parameter specifies the batch file (\ &.bat) or NT command file (\&.cmd) to be downloaded and run on a machine when a user successfully logs in\&. The file must contain the DOS style CR/LF line endings\&. Using a DOS\-style editor to create the file is recommended\&.5667 This parameter specifies the batch file (\FC\&.bat\F[]) or NT command file (\FC\&.cmd\F[]) to be downloaded and run on a machine when a user successfully logs in\&. The file must contain the DOS style CR/LF line endings\&. Using a DOS\-style editor to create the file is recommended\&. 5286 5668 .sp 5287 5669 The script must be a relative path to the … … 5290 5672 \m[blue]\fBpath\fR\m[] 5291 5673 of 5292 /usr/local/samba/netlogon, and5674 \FC/usr/local/samba/netlogon\F[], and 5293 5675 \m[blue]\fBlogon script = STARTUP\&.BAT\fR\m[], then the file that will be downloaded is: 5294 5676 .sp … … 5296 5678 .RS 4 5297 5679 .\} 5680 .fam C 5681 .ps -1 5298 5682 .nf 5683 .if t \{\ 5684 .sp -1 5685 .\} 5686 .BB lightgray adjust-for-leading-newline 5687 .sp -1 5688 5299 5689 /usr/local/samba/netlogon/STARTUP\&.BAT 5690 .EB lightgray adjust-for-leading-newline 5691 .if t \{\ 5692 .sp 1 5693 .\} 5300 5694 .fi 5695 .fam 5696 .ps +1 5301 5697 .if n \{\ 5302 5698 .RE … … 5304 5700 .sp 5305 5701 The contents of the batch file are entirely your choice\&. A suggested command would be to add 5306 NET TIME \e\eSERVER /SET /YES, to force every machine to synchronize clocks with the same time server\&. Another use would be to add5307 NET USE U: \e\eSERVER\eUTILS 5702 \FCNET TIME \e\eSERVER /SET /YES\F[], to force every machine to synchronize clocks with the same time server\&. Another use would be to add 5703 \FCNET USE U: \e\eSERVER\eUTILS\F[] 5308 5704 for commonly used utilities, or 5309 5705 .sp … … 5311 5707 .RS 4 5312 5708 .\} 5709 .fam C 5710 .ps -1 5313 5711 .nf 5712 .if t \{\ 5713 .sp -1 5714 .\} 5715 .BB lightgray adjust-for-leading-newline 5716 .sp -1 5717 5314 5718 \fBNET USE Q: \e\eSERVER\eISO9001_QA\fR 5719 .EB lightgray adjust-for-leading-newline 5720 .if t \{\ 5721 .sp 1 5722 .\} 5315 5723 .fi 5724 .fam 5725 .ps +1 5316 5726 .if n \{\ 5317 5727 .RE … … 5327 5737 .sp 5328 5738 Default: 5329 \fI\fIlogon script\fR\fR\fI = \fR\fI\ fR\fI \fR5330 .sp 5331 Example: 5332 \fI\fIlogon script\fR\fR\fI = \fR\fI scripts\e%U\&.bat\fR\fI \fR5739 \fI\fIlogon script\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 5740 .sp 5741 Example: 5742 \fI\fIlogon script\fR\fR\fI = \fR\fI\FCscripts\e%U\&.bat\F[]\fR\fI \fR 5333 5743 .RE 5334 5744 … … 5353 5763 .sp 5354 5764 Default: 5355 \fI\fIlppause command\fR\fR\fI = \fR\fI # Currently no default value is given to this string, unless the value of the \m[blue]\fBprinting\fR\m[] parameter is \fBSYSV\fR, in which case the default is : lp \-i %p\-%j \-H hold or if the value of the \fIprinting\fR parameter is \fBSOFTQ\fR, then the default is: qstat \-s \-j%j \-h\&.\fR\fI \fR5356 .sp 5357 Example: 5358 \fI\fIlppause command\fR\fR\fI = \fR\fI /usr/bin/lpalt %p\-%j \-p0\fR\fI \fR5765 \fI\fIlppause command\fR\fR\fI = \fR\fI\FC # Currently no default value is given to this string, unless the value of the \m[blue]\fBprinting\fR\m[] parameter is \fBSYSV\fR, in which case the default is : \FClp \-i %p\-%j \-H hold\F[] or if the value of the \fIprinting\fR parameter is \fBSOFTQ\fR, then the default is: \FCqstat \-s \-j%j \-h\F[]\&. \F[]\fR\fI \fR 5766 .sp 5767 Example: 5768 \fI\fIlppause command\fR\fR\fI = \fR\fI\FC/usr/bin/lpalt %p\-%j \-p0\F[]\fR\fI \fR 5359 5769 .RE 5360 5770 … … 5364 5774 .RS 4 5365 5775 This controls how long lpq info will be cached for to prevent the 5366 lpq 5776 \FClpq\F[] 5367 5777 command being called too often\&. A separate cache is kept for each variation of the 5368 lpq 5778 \FC lpq\F[] 5369 5779 command used by the system, so if you use different 5370 lpq 5780 \FClpq\F[] 5371 5781 commands for different users then they won\'t share cache information\&. 5372 5782 .sp 5373 5783 The cache files are stored in 5374 /tmp/lpq\&.xxxx 5784 \FC/tmp/lpq\&.xxxx\F[] 5375 5785 where xxxx is a hash of the 5376 lpq 5786 \FClpq\F[] 5377 5787 command in use\&. 5378 5788 .sp 5379 5789 The default is 30 seconds, meaning that the cached results of a previous identical 5380 lpq 5790 \FClpq\F[] 5381 5791 command will be used if the cached data is less than 30 seconds old\&. A large value may be advisable if your 5382 lpq 5792 \FClpq\F[] 5383 5793 command is very slow\&. 5384 5794 .sp … … 5386 5796 .sp 5387 5797 Default: 5388 \fI\fIlpq cache time\fR\fR\fI = \fR\fI 30\fR\fI \fR5389 .sp 5390 Example: 5391 \fI\fIlpq cache time\fR\fR\fI = \fR\fI 10\fR\fI \fR5798 \fI\fIlpq cache time\fR\fR\fI = \fR\fI\FC30\F[]\fR\fI \fR 5799 .sp 5800 Example: 5801 \fI\fIlpq cache time\fR\fR\fI = \fR\fI\FC10\F[]\fR\fI \fR 5392 5802 .RE 5393 5803 … … 5397 5807 .RS 4 5398 5808 This parameter specifies the command to be executed on the server host in order to obtain 5399 lpq\-style printer status information\&.5809 \FClpq \F[]\-style printer status information\&. 5400 5810 .sp 5401 5811 This command should be a program or script which takes a printer name as its only parameter and outputs printer status information\&. … … 5420 5830 .sp 5421 5831 Default: 5422 \fI\fIlpq command\fR\fR\fI = \fR\fI\ fR\fI \fR5423 .sp 5424 Example: 5425 \fI\fIlpq command\fR\fR\fI = \fR\fI /usr/bin/lpq \-P%p\fR\fI \fR5832 \fI\fIlpq command\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 5833 .sp 5834 Example: 5835 \fI\fIlpq command\fR\fR\fI = \fR\fI\FC/usr/bin/lpq \-P%p\F[]\fR\fI \fR 5426 5836 .RE 5427 5837 … … 5455 5865 \fBSYSV\fR, in which case the default is: 5456 5866 .sp 5457 lp \-i %p\-%j \-H resume 5867 \FClp \-i %p\-%j \-H resume\F[] 5458 5868 .sp 5459 5869 or if the value of the … … 5462 5872 \fBSOFTQ\fR, then the default is: 5463 5873 .sp 5464 qstat \-s \-j%j \-r 5874 \FCqstat \-s \-j%j \-r\F[] 5465 5875 .sp 5466 5876 \fINo default\fR 5467 5877 .sp 5468 5878 Example: 5469 \fI\fIlpresume command\fR\fR\fI = \fR\fI /usr/bin/lpalt %p\-%j \-p2\fR\fI \fR5879 \fI\fIlpresume command\fR\fR\fI = \fR\fI\FC/usr/bin/lpalt %p\-%j \-p2\F[]\fR\fI \fR 5470 5880 .RE 5471 5881 … … 5493 5903 .RS 4 5494 5904 .\} 5905 .fam C 5906 .ps -1 5495 5907 .nf 5908 .if t \{\ 5909 .sp -1 5910 .\} 5911 .BB lightgray adjust-for-leading-newline 5912 .sp -1 5913 5496 5914 lprm command = /usr/bin/lprm \-P%p %j 5497 5915 … … 5499 5917 5500 5918 lprm command = /usr/bin/cancel %p\-%j 5919 .EB lightgray adjust-for-leading-newline 5920 .if t \{\ 5921 .sp 1 5922 .\} 5501 5923 .fi 5924 .fam 5925 .ps +1 5502 5926 .if n \{\ 5503 5927 .RE … … 5505 5929 .sp 5506 5930 Default: 5507 \fI\fIlprm command\fR\fR\fI = \fR\fI determined by printing parameter\fR\fI \fR5931 \fI\fIlprm command\fR\fR\fI = \fR\fI\FC determined by printing parameter\F[]\fR\fI \fR 5508 5932 .RE 5509 5933 … … 5515 5939 \m[blue]\fBsecurity = domain\fR\m[] 5516 5940 parameter) then periodically a running smbd process will try and change the MACHINE ACCOUNT PASSWORD stored in the TDB called 5517 private/secrets\&.tdb\&. This parameter specifies how often this password will be changed, in seconds\&. The default is one week (expressed in seconds), the same as a Windows NT Domain member server\&.5941 \FCprivate/secrets\&.tdb \F[]\&. This parameter specifies how often this password will be changed, in seconds\&. The default is one week (expressed in seconds), the same as a Windows NT Domain member server\&. 5518 5942 .sp 5519 5943 See also … … 5523 5947 .sp 5524 5948 Default: 5525 \fI\fImachine password timeout\fR\fR\fI = \fR\fI 604800\fR\fI \fR5949 \fI\fImachine password timeout\fR\fR\fI = \fR\fI\FC604800\F[]\fR\fI \fR 5526 5950 .RE 5527 5951 … … 5537 5961 .\} 5538 5962 .RS 4 5963 .BM yellow 5539 5964 .it 1 an-trap 5540 5965 .nr an-no-space-flag 1 … … 5549 5974 in the same directory the output file content is undefined\&. 5550 5975 .sp .5v 5551 .RE 5552 Default: 5553 \fI\fImagic output\fR\fR\fI = \fR\fI<magic script name>\&.out\fR\fI \fR 5554 .sp 5555 Example: 5556 \fI\fImagic output\fR\fR\fI = \fR\fImyfile\&.txt\fR\fI \fR 5976 .EM yellow 5977 .RE 5978 Default: 5979 \fI\fImagic output\fR\fR\fI = \fR\fI\FC<magic script name>\&.out\F[]\fR\fI \fR 5980 .sp 5981 Example: 5982 \fI\fImagic output\fR\fR\fI = \fR\fI\FCmyfile\&.txt\F[]\fR\fI \fR 5557 5983 .RE 5558 5984 … … 5580 6006 .sp 5581 6007 Default: 5582 \fI\fImagic script\fR\fR\fI = \fR\fI\ fR\fI \fR5583 .sp 5584 Example: 5585 \fI\fImagic script\fR\fR\fI = \fR\fI user\&.csh\fR\fI \fR6008 \fI\fImagic script\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 6009 .sp 6010 Example: 6011 \fI\fImagic script\fR\fR\fI = \fR\fI\FCuser\&.csh\F[]\fR\fI \fR 5586 6012 .RE 5587 6013 … … 5642 6068 .sp 5643 6069 Default: 5644 \fI\fImangled names\fR\fR\fI = \fR\fI yes\fR\fI \fR6070 \fI\fImangled names\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 5645 6071 .RE 5646 6072 … … 5654 6080 .sp 5655 6081 Default: 5656 \fI\fImangle prefix\fR\fR\fI = \fR\fI 1\fR\fI \fR5657 .sp 5658 Example: 5659 \fI\fImangle prefix\fR\fR\fI = \fR\fI 4\fR\fI \fR6082 \fI\fImangle prefix\fR\fR\fI = \fR\fI\FC1\F[]\fR\fI \fR 6083 .sp 6084 Example: 6085 \fI\fImangle prefix\fR\fR\fI = \fR\fI\FC4\F[]\fR\fI \fR 5660 6086 .RE 5661 6087 … … 5670 6096 .sp 5671 6097 Default: 5672 \fI\fImangling char\fR\fR\fI = \fR\fI ~\fR\fI \fR5673 .sp 5674 Example: 5675 \fI\fImangling char\fR\fR\fI = \fR\fI ^\fR\fI \fR6098 \fI\fImangling char\fR\fR\fI = \fR\fI\FC~\F[]\fR\fI \fR 6099 .sp 6100 Example: 6101 \fI\fImangling char\fR\fR\fI = \fR\fI\FC^\F[]\fR\fI \fR 5676 6102 .RE 5677 6103 … … 5683 6109 .sp 5684 6110 Default: 5685 \fI\fImangling method\fR\fR\fI = \fR\fI hash2\fR\fI \fR5686 .sp 5687 Example: 5688 \fI\fImangling method\fR\fR\fI = \fR\fI hash\fR\fI \fR6111 \fI\fImangling method\fR\fR\fI = \fR\fI\FChash2\F[]\fR\fI \fR 6112 .sp 6113 Example: 6114 \fI\fImangling method\fR\fR\fI = \fR\fI\FChash\F[]\fR\fI \fR 5689 6115 .RE 5690 6116 … … 5698 6124 .sp 5699 6125 Default: 5700 \fI\fImap acl inherit\fR\fR\fI = \fR\fI no\fR\fI \fR6126 \fI\fImap acl inherit\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 5701 6127 .RE 5702 6128 … … 5714 6140 .sp 5715 6141 Default: 5716 \fI\fImap archive\fR\fR\fI = \fR\fI yes\fR\fI \fR6142 \fI\fImap archive\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 5717 6143 .RE 5718 6144 … … 5796 6222 .RE 5797 6223 Default: 5798 \fI\fImap read only\fR\fR\fI = \fR\fI yes\fR\fI \fR6224 \fI\fImap read only\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 5799 6225 .RE 5800 6226 … … 5812 6238 .sp 5813 6239 Default: 5814 \fI\fImap system\fR\fR\fI = \fR\fI no\fR\fI \fR6240 \fI\fImap system\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 5815 6241 .RE 5816 6242 … … 5902 6328 .sp 5903 6329 Default: 5904 \fI\fImap to guest\fR\fR\fI = \fR\fI Never\fR\fI \fR5905 .sp 5906 Example: 5907 \fI\fImap to guest\fR\fR\fI = \fR\fI Bad User\fR\fI \fR6330 \fI\fImap to guest\fR\fR\fI = \fR\fI\FCNever\F[]\fR\fI \fR 6331 .sp 6332 Example: 6333 \fI\fImap to guest\fR\fR\fI = \fR\fI\FCBad User\F[]\fR\fI \fR 5908 6334 .RE 5909 6335 … … 5921 6347 .sp 5922 6348 Default: 5923 \fI\fImax connections\fR\fR\fI = \fR\fI 0\fR\fI \fR5924 .sp 5925 Example: 5926 \fI\fImax connections\fR\fR\fI = \fR\fI 10\fR\fI \fR6349 \fI\fImax connections\fR\fR\fI = \fR\fI\FC0\F[]\fR\fI \fR 6350 .sp 6351 Example: 6352 \fI\fImax connections\fR\fR\fI = \fR\fI\FC10\F[]\fR\fI \fR 5927 6353 .RE 5928 6354 … … 5943 6369 .sp 5944 6370 Default: 5945 \fI\fImax disk size\fR\fR\fI = \fR\fI 0\fR\fI \fR5946 .sp 5947 Example: 5948 \fI\fImax disk size\fR\fR\fI = \fR\fI 1000\fR\fI \fR6371 \fI\fImax disk size\fR\fR\fI = \fR\fI\FC0\F[]\fR\fI \fR 6372 .sp 6373 Example: 6374 \fI\fImax disk size\fR\fR\fI = \fR\fI\FC1000\F[]\fR\fI \fR 5949 6375 .RE 5950 6376 … … 5954 6380 .RS 4 5955 6381 This option (an integer in kilobytes) specifies the max size the log file should grow to\&. Samba periodically checks the size and if it is exceeded it will rename the file, adding a 5956 \ &.old6382 \FC\&.old\F[] 5957 6383 extension\&. 5958 6384 .sp … … 5960 6386 .sp 5961 6387 Default: 5962 \fI\fImax log size\fR\fR\fI = \fR\fI 5000\fR\fI \fR5963 .sp 5964 Example: 5965 \fI\fImax log size\fR\fR\fI = \fR\fI 1000\fR\fI \fR6388 \fI\fImax log size\fR\fR\fI = \fR\fI\FC5000\F[]\fR\fI \fR 6389 .sp 6390 Example: 6391 \fI\fImax log size\fR\fR\fI = \fR\fI\FC1000\F[]\fR\fI \fR 5966 6392 .RE 5967 6393 … … 5973 6399 .sp 5974 6400 Default: 5975 \fI\fImax mux\fR\fR\fI = \fR\fI 50\fR\fI \fR6401 \fI\fImax mux\fR\fR\fI = \fR\fI\FC50\F[]\fR\fI \fR 5976 6402 .RE 5977 6403 … … 5987 6413 .sp 5988 6414 Default: 5989 \fI\fImax open files\fR\fR\fI = \fR\fI 10000\fR\fI \fR6415 \fI\fImax open files\fR\fR\fI = \fR\fI\FC10000\F[]\fR\fI \fR 5990 6416 .RE 5991 6417 … … 5999 6425 .sp 6000 6426 Default: 6001 \fI\fImax print jobs\fR\fR\fI = \fR\fI 1000\fR\fI \fR6002 .sp 6003 Example: 6004 \fI\fImax print jobs\fR\fR\fI = \fR\fI 5000\fR\fI \fR6427 \fI\fImax print jobs\fR\fR\fI = \fR\fI\FC1000\F[]\fR\fI \fR 6428 .sp 6429 Example: 6430 \fI\fImax print jobs\fR\fR\fI = \fR\fI\FC5000\F[]\fR\fI \fR 6005 6431 .RE 6006 6432 … … 6081 6507 .sp 6082 6508 Default: 6083 \fI\fImax protocol\fR\fR\fI = \fR\fI NT1\fR\fI \fR6084 .sp 6085 Example: 6086 \fI\fImax protocol\fR\fR\fI = \fR\fI LANMAN1\fR\fI \fR6509 \fI\fImax protocol\fR\fR\fI = \fR\fI\FCNT1\F[]\fR\fI \fR 6510 .sp 6511 Example: 6512 \fI\fImax protocol\fR\fR\fI = \fR\fI\FCLANMAN1\F[]\fR\fI \fR 6087 6513 .RE 6088 6514 … … 6094 6520 .sp 6095 6521 Default: 6096 \fI\fImax reported print jobs\fR\fR\fI = \fR\fI 0\fR\fI \fR6097 .sp 6098 Example: 6099 \fI\fImax reported print jobs\fR\fR\fI = \fR\fI 1000\fR\fI \fR6522 \fI\fImax reported print jobs\fR\fR\fI = \fR\fI\FC0\F[]\fR\fI \fR 6523 .sp 6524 Example: 6525 \fI\fImax reported print jobs\fR\fR\fI = \fR\fI\FC1000\F[]\fR\fI \fR 6100 6526 .RE 6101 6527 … … 6111 6537 .sp 6112 6538 Default: 6113 \fI\fImax smbd processes\fR\fR\fI = \fR\fI 0\fR\fI \fR6114 .sp 6115 Example: 6116 \fI\fImax smbd processes\fR\fR\fI = \fR\fI 1000\fR\fI \fR6539 \fI\fImax smbd processes\fR\fR\fI = \fR\fI\FC0\F[]\fR\fI \fR 6540 .sp 6541 Example: 6542 \fI\fImax smbd processes\fR\fR\fI = \fR\fI\FC1000\F[]\fR\fI \fR 6117 6543 .RE 6118 6544 … … 6126 6552 .sp 6127 6553 Default: 6128 \fI\fImax stat cache size\fR\fR\fI = \fR\fI 256\fR\fI \fR6129 .sp 6130 Example: 6131 \fI\fImax stat cache size\fR\fR\fI = \fR\fI 100\fR\fI \fR6554 \fI\fImax stat cache size\fR\fR\fI = \fR\fI\FC256\F[]\fR\fI \fR 6555 .sp 6556 Example: 6557 \fI\fImax stat cache size\fR\fR\fI = \fR\fI\FC100\F[]\fR\fI \fR 6132 6558 .RE 6133 6559 … … 6139 6565 \fBnmbd\fR(8) 6140 6566 what the default \'time to live\' of NetBIOS names should be (in seconds) when 6141 nmbd 6567 \FCnmbd\F[] 6142 6568 is requesting a name using either a broadcast packet or from a WINS server\&. You should never need to change this parameter\&. The default is 3 days\&. 6143 6569 .sp 6144 6570 Default: 6145 \fI\fImax ttl\fR\fR\fI = \fR\fI 259200\fR\fI \fR6571 \fI\fImax ttl\fR\fR\fI = \fR\fI\FC259200\F[]\fR\fI \fR 6146 6572 .RE 6147 6573 … … 6153 6579 \fBsmbd\fR(8) 6154 6580 when acting as a WINS server (\m[blue]\fBwins support = yes\fR\m[]) what the maximum \'time to live\' of NetBIOS names that 6155 nmbd 6581 \FCnmbd\F[] 6156 6582 will grant will be (in seconds)\&. You should never need to change this parameter\&. The default is 6 days (518400 seconds)\&. 6157 6583 .sp 6158 6584 Default: 6159 \fI\fImax wins ttl\fR\fR\fI = \fR\fI 518400\fR\fI \fR6585 \fI\fImax wins ttl\fR\fR\fI = \fR\fI\FC518400\F[]\fR\fI \fR 6160 6586 .RE 6161 6587 … … 6167 6593 .sp 6168 6594 Default: 6169 \fI\fImax xmit\fR\fR\fI = \fR\fI 16644\fR\fI \fR6170 .sp 6171 Example: 6172 \fI\fImax xmit\fR\fR\fI = \fR\fI 8192\fR\fI \fR6595 \fI\fImax xmit\fR\fR\fI = \fR\fI\FC16644\F[]\fR\fI \fR 6596 .sp 6597 Example: 6598 \fI\fImax xmit\fR\fR\fI = \fR\fI\FC8192\F[]\fR\fI \fR 6173 6599 .RE 6174 6600 … … 6186 6612 .RS 4 6187 6613 .\} 6614 .fam C 6615 .ps -1 6188 6616 .nf 6189 message command = csh \-c \'xedit %s;rm %s\' & 6617 .if t \{\ 6618 .sp -1 6619 .\} 6620 .BB lightgray adjust-for-leading-newline 6621 .sp -1 6622 6623 \FCmessage command = csh \-c \'xedit %s;rm %s\' &\F[] 6624 .EB lightgray adjust-for-leading-newline 6625 .if t \{\ 6626 .sp 1 6627 .\} 6190 6628 .fi 6629 .fam 6630 .ps +1 6191 6631 .if n \{\ 6192 6632 .RE … … 6194 6634 .sp 6195 6635 This delivers the message using 6196 xedit, then removes it afterwards\&.6636 \FCxedit\F[], then removes it afterwards\&. 6197 6637 \fINOTE THAT IT IS VERY IMPORTANT THAT THIS COMMAND RETURN IMMEDIATELY\fR\&. That\'s why I have the \'&\' on the end\&. If it doesn\'t return immediately then your PCs may freeze when sending messages (they should recover after 30 seconds, hopefully)\&. 6198 6638 .sp … … 6247 6687 .RS 4 6248 6688 .\} 6689 .fam C 6690 .ps -1 6249 6691 .nf 6250 message command = /bin/mail \-s \'message from %f on %m\' root < %s; rm %s 6692 .if t \{\ 6693 .sp -1 6694 .\} 6695 .BB lightgray adjust-for-leading-newline 6696 .sp -1 6697 6698 \FCmessage command = /bin/mail \-s \'message from %f on %m\' root < %s; rm %s\F[] 6699 .EB lightgray adjust-for-leading-newline 6700 .if t \{\ 6701 .sp 1 6702 .\} 6251 6703 .fi 6704 .fam 6705 .ps +1 6252 6706 .if n \{\ 6253 6707 .RE … … 6261 6715 .RS 4 6262 6716 .\} 6717 .fam C 6718 .ps -1 6263 6719 .nf 6264 message command = rm %s 6720 .if t \{\ 6721 .sp -1 6722 .\} 6723 .BB lightgray adjust-for-leading-newline 6724 .sp -1 6725 6726 \FCmessage command = rm %s\F[] 6727 .EB lightgray adjust-for-leading-newline 6728 .if t \{\ 6729 .sp 1 6730 .\} 6265 6731 .fi 6732 .fam 6733 .ps +1 6266 6734 .if n \{\ 6267 6735 .RE … … 6269 6737 .sp 6270 6738 Default: 6271 \fI\fImessage command\fR\fR\fI = \fR\fI\ fR\fI \fR6272 .sp 6273 Example: 6274 \fI\fImessage command\fR\fR\fI = \fR\fI csh \-c \'xedit %s; rm %s\' &\fR\fI \fR6739 \fI\fImessage command\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 6740 .sp 6741 Example: 6742 \fI\fImessage command\fR\fR\fI = \fR\fI\FCcsh \-c \'xedit %s; rm %s\' &\F[]\fR\fI \fR 6275 6743 .RE 6276 6744 … … 6282 6750 .sp 6283 6751 Default: 6284 \fI\fImin print space\fR\fR\fI = \fR\fI 0\fR\fI \fR6285 .sp 6286 Example: 6287 \fI\fImin print space\fR\fR\fI = \fR\fI 2000\fR\fI \fR6752 \fI\fImin print space\fR\fR\fI = \fR\fI\FC0\F[]\fR\fI \fR 6753 .sp 6754 Example: 6755 \fI\fImin print space\fR\fR\fI = \fR\fI\FC2000\F[]\fR\fI \fR 6288 6756 .RE 6289 6757 … … 6295 6763 \m[blue]\fBmax protocol\fR\m[] 6296 6764 parameter for a list of valid protocol names and a brief description of each\&. You may also wish to refer to the C source code in 6297 source/smbd/negprot\&.c 6765 \FCsource/smbd/negprot\&.c\F[] 6298 6766 for a listing of known protocol dialects supported by clients\&. 6299 6767 .sp … … 6303 6771 .sp 6304 6772 Default: 6305 \fI\fImin protocol\fR\fR\fI = \fR\fI CORE\fR\fI \fR6306 .sp 6307 Example: 6308 \fI\fImin protocol\fR\fR\fI = \fR\fI NT1\fR\fI \fR6773 \fI\fImin protocol\fR\fR\fI = \fR\fI\FCCORE\F[]\fR\fI \fR 6774 .sp 6775 Example: 6776 \fI\fImin protocol\fR\fR\fI = \fR\fI\FCNT1\F[]\fR\fI \fR 6309 6777 .RE 6310 6778 … … 6322 6790 .sp 6323 6791 Default: 6324 \fI\fImin receivefile size\fR\fR\fI = \fR\fI 0\fR\fI \fR6792 \fI\fImin receivefile size\fR\fR\fI = \fR\fI\FC0\F[]\fR\fI \fR 6325 6793 .RE 6326 6794 … … 6332 6800 \fBnmbd\fR(8) 6333 6801 when acting as a WINS server (\m[blue]\fBwins support = yes\fR\m[]) what the minimum \'time to live\' of NetBIOS names that 6334 nmbd 6802 \FCnmbd\F[] 6335 6803 will grant will be (in seconds)\&. You should never need to change this parameter\&. The default is 6 hours (21600 seconds)\&. 6336 6804 .sp 6337 6805 Default: 6338 \fI\fImin wins ttl\fR\fR\fI = \fR\fI 21600\fR\fI \fR6806 \fI\fImin wins ttl\fR\fR\fI = \fR\fI\FC21600\F[]\fR\fI \fR 6339 6807 .RE 6340 6808 … … 6354 6822 .sp 6355 6823 Example: 6356 \fI\fImsdfs proxy\fR\fR\fI = \fR\fI\ eotherserver\esomeshare\fR\fI \fR6824 \fI\fImsdfs proxy\fR\fR\fI = \fR\fI\FC\eotherserver\esomeshare\F[]\fR\fI \fR 6357 6825 .RE 6358 6826 … … 6363 6831 If set to 6364 6832 \fByes\fR, Samba treats the share as a Dfs root and allows clients to browse the distributed file system tree rooted at the share directory\&. Dfs links are specified in the share directory by symbolic links of the form 6365 msdfs:serverA\e\eshareA,serverB\e\eshareB 6833 \FCmsdfs:serverA\e\eshareA,serverB\e\eshareB\F[] 6366 6834 and so on\&. For more information on setting up a Dfs tree on Samba, refer to the MSDFS chapter in the Samba3\-HOWTO book\&. 6367 6835 .sp 6368 6836 Default: 6369 \fI\fImsdfs root\fR\fR\fI = \fR\fI no\fR\fI \fR6837 \fI\fImsdfs root\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 6370 6838 .RE 6371 6839 … … 6377 6845 .sp 6378 6846 Default: 6379 \fI\fIname cache timeout\fR\fR\fI = \fR\fI 660\fR\fI \fR6380 .sp 6381 Example: 6382 \fI\fIname cache timeout\fR\fR\fI = \fR\fI 0\fR\fI \fR6847 \fI\fIname cache timeout\fR\fR\fI = \fR\fI\FC660\F[]\fR\fI \fR 6848 .sp 6849 Example: 6850 \fI\fIname cache timeout\fR\fR\fI = \fR\fI\FC0\F[]\fR\fI \fR 6383 6851 .RE 6384 6852 … … 6415 6883 \fBhost\fR 6416 6884 : Do a standard host name to IP address resolution, using the system 6417 /etc/hosts, NIS, or DNS lookups\&. This method of name resolution is operating system depended for instance on IRIX or Solaris this may be controlled by the6418 /etc/nsswitch\&.conf 6885 \FC/etc/hosts \F[], NIS, or DNS lookups\&. This method of name resolution is operating system depended for instance on IRIX or Solaris this may be controlled by the 6886 \FC/etc/nsswitch\&.conf\F[] 6419 6887 file\&. Note that this method is used only if the NetBIOS name type being queried is the 0x20 (server) name type or 0x1c (domain controllers)\&. The latter case is only useful for active directory domains and results in a DNS query for the SRV RR entry matching _ldap\&._tcp\&.domain\&. 6420 6888 .RE … … 6450 6918 The example below will cause the local lmhosts file to be examined first, followed by a broadcast attempt, followed by a normal system hostname lookup\&. 6451 6919 .sp 6452 When Samba is functioning in ADS security mode ( security = ads) it is advised to use following settings for6920 When Samba is functioning in ADS security mode (\FCsecurity = ads\F[]) it is advised to use following settings for 6453 6921 \fIname resolve order\fR: 6454 6922 .sp 6455 name resolve order = wins bcast 6923 \FCname resolve order = wins bcast\F[] 6456 6924 .sp 6457 6925 DC lookups will still be done via DNS, but fallbacks to netbios names will not inundate your DNS servers with needless querys for DOMAIN<0x1c> lookups\&. 6458 6926 .sp 6459 6927 Default: 6460 \fI\fIname resolve order\fR\fR\fI = \fR\fI lmhosts host wins bcast\fR\fI \fR6461 .sp 6462 Example: 6463 \fI\fIname resolve order\fR\fR\fI = \fR\fI lmhosts bcast host\fR\fI \fR6928 \fI\fIname resolve order\fR\fR\fI = \fR\fI\FClmhosts host wins bcast\F[]\fR\fI \fR 6929 .sp 6930 Example: 6931 \fI\fIname resolve order\fR\fR\fI = \fR\fI\FClmhosts bcast host\F[]\fR\fI \fR 6464 6932 .RE 6465 6933 … … 6471 6939 .sp 6472 6940 Default: 6473 \fI\fInetbios aliases\fR\fR\fI = \fR\fI # empty string (no additional names)\fR\fI \fR6474 .sp 6475 Example: 6476 \fI\fInetbios aliases\fR\fR\fI = \fR\fI TEST TEST1 TEST2\fR\fI \fR6941 \fI\fInetbios aliases\fR\fR\fI = \fR\fI\FC # empty string (no additional names)\F[]\fR\fI \fR 6942 .sp 6943 Example: 6944 \fI\fInetbios aliases\fR\fR\fI = \fR\fI\FCTEST TEST1 TEST2\F[]\fR\fI \fR 6477 6945 .RE 6478 6946 … … 6484 6952 .sp 6485 6953 There is a bug in Samba\-3 that breaks operation of browsing and access to shares if the netbios name is set to the literal name 6486 PIPE\&. To avoid this problem, do not name your Samba\-3 server6487 PIPE\&.6488 .sp 6489 Default: 6490 \fI\fInetbios name\fR\fR\fI = \fR\fI # machine DNS name\fR\fI \fR6491 .sp 6492 Example: 6493 \fI\fInetbios name\fR\fR\fI = \fR\fI MYNAME\fR\fI \fR6954 \FCPIPE\F[]\&. To avoid this problem, do not name your Samba\-3 server 6955 \FCPIPE\F[]\&. 6956 .sp 6957 Default: 6958 \fI\fInetbios name\fR\fR\fI = \fR\fI\FC # machine DNS name\F[]\fR\fI \fR 6959 .sp 6960 Example: 6961 \fI\fInetbios name\fR\fR\fI = \fR\fI\FCMYNAME\F[]\fR\fI \fR 6494 6962 .RE 6495 6963 … … 6501 6969 .sp 6502 6970 Default: 6503 \fI\fInetbios scope\fR\fR\fI = \fR\fI\ fR\fI \fR6971 \fI\fInetbios scope\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 6504 6972 .RE 6505 6973 … … 6519 6987 .sp 6520 6988 Default: 6521 \fI\fInis homedir\fR\fR\fI = \fR\fI no\fR\fI \fR6989 \fI\fInis homedir\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 6522 6990 .RE 6523 6991 … … 6531 6999 .sp 6532 7000 Default: 6533 \fI\fInt acl support\fR\fR\fI = \fR\fI yes\fR\fI \fR7001 \fI\fInt acl support\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 6534 7002 .RE 6535 7003 … … 6543 7011 .sp 6544 7012 If this option, and 6545 lanman auth 7013 \FClanman auth\F[] 6546 7014 are both disabled, then only NTLMv2 logins will be permited\&. Not all clients support NTLMv2, and most will require special configuration to use it\&. 6547 7015 .sp 6548 7016 Default: 6549 \fI\fIntlm auth\fR\fR\fI = \fR\fI yes\fR\fI \fR7017 \fI\fIntlm auth\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 6550 7018 .RE 6551 7019 … … 6561 7029 .sp 6562 7030 Default: 6563 \fI\fInt pipe support\fR\fR\fI = \fR\fI yes\fR\fI \fR7031 \fI\fInt pipe support\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 6564 7032 .RE 6565 7033 … … 6577 7045 .sp 6578 7046 Default: 6579 \fI\fInt status support\fR\fR\fI = \fR\fI yes\fR\fI \fR7047 \fI\fInt status support\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 6580 7048 .RE 6581 7049 … … 6590 7058 .sp 6591 7059 Default: 6592 \fI\fInull passwords\fR\fR\fI = \fR\fI no\fR\fI \fR7060 \fI\fInull passwords\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 6593 7061 .RE 6594 7062 … … 6601 7069 .sp 6602 7070 Default: 6603 \fI\fIobey pam restrictions\fR\fR\fI = \fR\fI no\fR\fI \fR7071 \fI\fIobey pam restrictions\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 6604 7072 .RE 6605 7073 … … 6617 7085 .sp 6618 7086 Note that this also means Samba won\'t try to deduce usernames from the service name\&. This can be annoying for the [homes] section\&. To get around this you could use 6619 user = %S 7087 \FCuser = %S\F[] 6620 7088 which means your 6621 7089 \fIuser\fR … … 6623 7091 .sp 6624 7092 Default: 6625 \fI\fIonly user\fR\fR\fI = \fR\fI no\fR\fI \fR7093 \fI\fIonly user\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 6626 7094 .RE 6627 7095 … … 6635 7103 .\} 6636 7104 .RS 4 7105 .BM yellow 6637 7106 .it 1 an-trap 6638 7107 .nr an-no-space-flag 1 … … 6645 7114 DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE\&. 6646 7115 .sp .5v 6647 .RE 6648 Default: 6649 \fI\fIoplock break wait time\fR\fR\fI = \fR\fI0\fR\fI \fR 7116 .EM yellow 7117 .RE 7118 Default: 7119 \fI\fIoplock break wait time\fR\fR\fI = \fR\fI\FC0\F[]\fR\fI \fR 6650 7120 .RE 6651 7121 … … 6662 7132 In brief it specifies a number, which causes 6663 7133 \fBsmbd\fR(8)not to grant an oplock even when requested if the approximate number of clients contending for an oplock on the same file goes over this limit\&. This causes 6664 smbd 7134 \FCsmbd\F[] 6665 7135 to behave in a similar way to Windows NT\&. 6666 7136 .if n \{\ … … 6668 7138 .\} 6669 7139 .RS 4 7140 .BM yellow 6670 7141 .it 1 an-trap 6671 7142 .nr an-no-space-flag 1 … … 6678 7149 DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE\&. 6679 7150 .sp .5v 6680 .RE 6681 Default: 6682 \fI\fIoplock contention limit\fR\fR\fI = \fR\fI2\fR\fI \fR 7151 .EM yellow 7152 .RE 7153 Default: 7154 \fI\fIoplock contention limit\fR\fR\fI = \fR\fI\FC2\F[]\fR\fI \fR 6683 7155 .RE 6684 7156 … … 6688 7160 .RS 4 6689 7161 This boolean option tells 6690 smbd 7162 \FCsmbd\F[] 6691 7163 whether to issue oplocks (opportunistic locks) to file open requests on this share\&. The oplock code can dramatically (approx\&. 30% or more) improve the speed of access to files on Samba servers\&. It allows the clients to aggressively cache files locally and you may want to disable this option for unreliable network environments (it is turned on by default in Windows NT Servers)\&. For more information see the file 6692 Speed\&.txt 7164 \FCSpeed\&.txt\F[] 6693 7165 in the Samba 6694 docs/ 7166 \FCdocs/\F[] 6695 7167 directory\&. 6696 7168 .sp … … 6702 7174 .sp 6703 7175 Default: 6704 \fI\fIoplocks\fR\fR\fI = \fR\fI yes\fR\fI \fR7176 \fI\fIoplocks\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 6705 7177 .RE 6706 7178 … … 6714 7186 .sp 6715 7187 For example, a valid entry using the HP LaserJet 5 printer driver would appear as 6716 HP LaserJet 5L = LASERJET\&.HP LaserJet 5L\&.7188 \FCHP LaserJet 5L = LASERJET\&.HP LaserJet 5L\F[]\&. 6717 7189 .sp 6718 7190 The need for the file is due to the printer driver namespace problem described in the chapter on Classical Printing in the Samba3\-HOWTO book\&. For more details on OS/2 clients, please refer to chapter on other clients in the Samba3\-HOWTO book\&. 6719 7191 .sp 6720 7192 Default: 6721 \fI\fIos2 driver map\fR\fR\fI = \fR\fI\ fR\fI \fR7193 \fI\fIos2 driver map\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 6722 7194 .RE 6723 7195 … … 6738 7210 .sp 6739 7211 Default: 6740 \fI\fIos level\fR\fR\fI = \fR\fI 20\fR\fI \fR6741 .sp 6742 Example: 6743 \fI\fIos level\fR\fR\fI = \fR\fI 65\fR\fI \fR7212 \fI\fIos level\fR\fR\fI = \fR\fI\FC20\F[]\fR\fI \fR 7213 .sp 7214 Example: 7215 \fI\fIos level\fR\fR\fI = \fR\fI\FC65\F[]\fR\fI \fR 6744 7216 .RE 6745 7217 … … 6754 7226 .sp 6755 7227 Default: 6756 \fI\fIpam password change\fR\fR\fI = \fR\fI no\fR\fI \fR7228 \fI\fIpam password change\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 6757 7229 .RE 6758 7230 … … 6768 7240 .sp 6769 7241 Default: 6770 \fI\fIpanic action\fR\fR\fI = \fR\fI\ fR\fI \fR6771 .sp 6772 Example: 6773 \fI\fIpanic action\fR\fR\fI = \fR\fI "/bin/sleep 90000"\fR\fI \fR7242 \fI\fIpanic action\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 7243 .sp 7244 Example: 7245 \fI\fIpanic action\fR\fR\fI = \fR\fI\FC"/bin/sleep 90000"\F[]\fR\fI \fR 6774 7246 .RE 6775 7247 … … 6783 7255 .sp 6784 7256 Default: 6785 \fI\fIparanoid server security\fR\fR\fI = \fR\fI yes\fR\fI \fR7257 \fI\fIparanoid server security\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 6786 7258 .RE 6787 7259 … … 6804 7276 .IP \(bu 2.3 6805 7277 .\} 6806 smbpasswd 7278 \FCsmbpasswd\F[] 6807 7279 \- The default smbpasswd backend\&. Takes a path to the smbpasswd file as an optional argument\&. 6808 7280 .RE … … 6816 7288 .IP \(bu 2.3 6817 7289 .\} 6818 tdbsam 7290 \FCtdbsam\F[] 6819 7291 \- The TDB based password storage backend\&. Takes a path to the TDB as an optional argument (defaults to passdb\&.tdb in the 6820 7292 \m[blue]\fBprivate dir\fR\m[] … … 6830 7302 .IP \(bu 2.3 6831 7303 .\} 6832 ldapsam 7304 \FCldapsam\F[] 6833 7305 \- The LDAP based passdb backend\&. Takes an LDAP URL as an optional argument (defaults to 6834 ldap://localhost)7306 \FCldap://localhost\F[]) 6835 7307 .sp 6836 7308 LDAP connections should be secured where possible\&. This may be done using either Start\-TLS (see … … 6848 7320 .RS 4 6849 7321 .\} 7322 .fam C 7323 .ps -1 6850 7324 .nf 7325 .if t \{\ 7326 .sp -1 7327 .\} 7328 .BB lightgray adjust-for-leading-newline 7329 .sp -1 7330 6851 7331 passdb backend = tdbsam:/etc/samba/private/passdb\&.tdb 6852 7332 … … 6858 7338 6859 7339 passdb backend = ldapsam:"ldap://ldap\-1\&.example\&.com ldap\-2\&.example\&.com" 7340 .EB lightgray adjust-for-leading-newline 7341 .if t \{\ 7342 .sp 1 7343 .\} 6860 7344 .fi 7345 .fam 7346 .ps +1 6861 7347 .if n \{\ 6862 7348 .RE … … 6864 7350 .sp 6865 7351 Default: 6866 \fI\fIpassdb backend\fR\fR\fI = \fR\fI smbpasswd\fR\fI \fR7352 \fI\fIpassdb backend\fR\fR\fI = \fR\fI\FCsmbpasswd\F[]\fR\fI \fR 6867 7353 .RE 6868 7354 … … 6874 7360 .sp 6875 7361 Default: 6876 \fI\fIpassdb expand explicit\fR\fR\fI = \fR\fI no\fR\fI \fR7362 \fI\fIpassdb expand explicit\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 6877 7363 .RE 6878 7364 … … 6888 7374 \m[blue]\fBdebug level\fR\m[] 6889 7375 of 100\&. This is a dangerous option as it will allow plaintext passwords to be seen in the 6890 smbd 7376 \FCsmbd\F[] 6891 7377 log\&. It is available to help Samba admins debug their 6892 7378 \fIpasswd chat\fR … … 6898 7384 .sp 6899 7385 Default: 6900 \fI\fIpasswd chat debug\fR\fR\fI = \fR\fI no\fR\fI \fR7386 \fI\fIpasswd chat debug\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 6901 7387 .RE 6902 7388 … … 6908 7394 .sp 6909 7395 Default: 6910 \fI\fIpasswd chat timeout\fR\fR\fI = \fR\fI 2\fR\fI \fR7396 \fI\fIpasswd chat timeout\fR\fR\fI = \fR\fI\FC2\F[]\fR\fI \fR 6911 7397 .RE 6912 7398 … … 6950 7436 .sp 6951 7437 Default: 6952 \fI\fIpasswd chat\fR\fR\fI = \fR\fI *new*password* %n\en*new*password* %n\en *changed*\fR\fI \fR6953 .sp 6954 Example: 6955 \fI\fIpasswd chat\fR\fR\fI = \fR\fI "*Enter NEW password*" %n\en "*Reenter NEW password*" %n\en "*Password changed*"\fR\fI \fR7438 \fI\fIpasswd chat\fR\fR\fI = \fR\fI\FC*new*password* %n\en*new*password* %n\en *changed*\F[]\fR\fI \fR 7439 .sp 7440 Example: 7441 \fI\fIpasswd chat\fR\fR\fI = \fR\fI\FC"*Enter NEW password*" %n\en "*Reenter NEW password*" %n\en "*Password changed*"\F[]\fR\fI \fR 6956 7442 .RE 6957 7443 … … 6976 7462 \fIAS ROOT\fR 6977 7463 before the SMB password in the smbpasswd file is changed\&. If this UNIX password change fails, then 6978 smbd 7464 \FCsmbd\F[] 6979 7465 will fail to change the SMB password also (this is by design)\&. 6980 7466 .sp … … 6991 7477 .sp 6992 7478 Default: 6993 \fI\fIpasswd program\fR\fR\fI = \fR\fI\ fR\fI \fR6994 .sp 6995 Example: 6996 \fI\fIpasswd program\fR\fR\fI = \fR\fI /bin/passwd %u\fR\fI \fR7479 \fI\fIpasswd program\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 7480 .sp 7481 Example: 7482 \fI\fIpasswd program\fR\fR\fI = \fR\fI\FC/bin/passwd %u\F[]\fR\fI \fR 6997 7483 .RE 6998 7484 … … 7027 7513 .sp 7028 7514 Default: 7029 \fI\fIpassword level\fR\fR\fI = \fR\fI 0\fR\fI \fR7030 .sp 7031 Example: 7032 \fI\fIpassword level\fR\fR\fI = \fR\fI 4\fR\fI \fR7515 \fI\fIpassword level\fR\fR\fI = \fR\fI\FC0\F[]\fR\fI \fR 7516 .sp 7517 Example: 7518 \fI\fIpassword level\fR\fR\fI = \fR\fI\FC4\F[]\fR\fI \fR 7033 7519 .RE 7034 7520 … … 7038 7524 .RS 4 7039 7525 By specifying the name of another SMB server or Active Directory domain controller with this option, and using 7040 security = [ads|domain|server]7526 \FCsecurity = [ads|domain|server]\F[] 7041 7527 it is possible to get Samba to do all its username/password validation using a specific remote server\&. 7042 7528 .sp … … 7052 7538 .\} 7053 7539 .RS 4 7540 .BM yellow 7054 7541 .it 1 an-trap 7055 7542 .nr an-no-space-flag 1 … … 7063 7550 \fIDO NOT CHOOSE A PASSWORD SERVER THAT YOU DON\'T COMPLETELY TRUST\fR\&. 7064 7551 .sp .5v 7552 .EM yellow 7065 7553 .RE 7066 7554 Never point a Samba server at itself for password serving\&. This will cause a loop and could lock up your Samba server! … … 7075 7563 or 7076 7564 \fBads\fR, then the list of machines in this option must be a list of Primary or Backup Domain controllers for the Domain or the character \'*\', as the Samba server is effectively in that domain, and will use cryptographically authenticated RPC calls to authenticate the user logging on\&. The advantage of using 7077 security = domain 7565 \FC security = domain\F[] 7078 7566 is that if you list several hosts in the 7079 7567 \fIpassword server\fR 7080 7568 option then 7081 smbd 7569 \FCsmbd \F[] 7082 7570 will try each in turn till it finds one that responds\&. This is useful in case your primary server goes down\&. 7083 7571 .sp … … 7094 7582 parameter is set to 7095 7583 \fBserver\fR, then there are different restrictions that 7096 security = domain 7584 \FCsecurity = domain\F[] 7097 7585 doesn\'t suffer from: 7098 7586 .sp … … 7108 7596 \fIpassword server\fR 7109 7597 parameter, however if an 7110 smbd 7598 \FCsmbd\F[] 7111 7599 makes a connection to a password server, and then the password server fails, no more users will be able to be authenticated from this 7112 smbd\&. This is a restriction of the SMB/CIFS protocol when in7113 security = server 7600 \FCsmbd\F[]\&. This is a restriction of the SMB/CIFS protocol when in 7601 \FCsecurity = server \F[] 7114 7602 mode and cannot be fixed in Samba\&. 7115 7603 .RE … … 7124 7612 .\} 7125 7613 If you are using a Windows NT server as your password server then you will have to ensure that your users are able to login from the Samba server, as when in 7126 security = server 7614 \FC security = server\F[] 7127 7615 mode the network logon will appear to come from there rather than from the users workstation\&. 7128 7616 .sp 7129 7617 .RE 7130 7618 Default: 7131 \fI\fIpassword server\fR\fR\fI = \fR\fI *\fR\fI \fR7132 .sp 7133 Example: 7134 \fI\fIpassword server\fR\fR\fI = \fR\fI NT\-PDC, NT\-BDC1, NT\-BDC2, *\fR\fI \fR7135 .sp 7136 Example: 7137 \fI\fIpassword server\fR\fR\fI = \fR\fI windc\&.mydomain\&.com:389 192\&.168\&.1\&.101 *\fR\fI \fR7619 \fI\fIpassword server\fR\fR\fI = \fR\fI\FC*\F[]\fR\fI \fR 7620 .sp 7621 Example: 7622 \fI\fIpassword server\fR\fR\fI = \fR\fI\FCNT\-PDC, NT\-BDC1, NT\-BDC2, *\F[]\fR\fI \fR 7623 .sp 7624 Example: 7625 \fI\fIpassword server\fR\fR\fI = \fR\fI\FCwindc\&.mydomain\&.com:389 192\&.168\&.1\&.101 *\F[]\fR\fI \fR 7138 7626 .RE 7139 7627 … … 7165 7653 .sp 7166 7654 Default: 7167 \fI\fIpath\fR\fR\fI = \fR\fI\ fR\fI \fR7168 .sp 7169 Example: 7170 \fI\fIpath\fR\fR\fI = \fR\fI /home/fred\fR\fI \fR7655 \fI\fIpath\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 7656 .sp 7657 Example: 7658 \fI\fIpath\fR\fR\fI = \fR\fI\FC/home/fred\F[]\fR\fI \fR 7171 7659 .RE 7172 7660 … … 7178 7666 .sp 7179 7667 Default: 7180 \fI\fIpid directory\fR\fR\fI = \fR\fI ${prefix}/var/locks\fR\fI \fR7181 .sp 7182 Example: 7183 \fI\fIpid directory\fR\fR\fI = \fR\fI pid directory = /var/run/\fR\fI \fR7668 \fI\fIpid directory\fR\fR\fI = \fR\fI\FC${prefix}/var/locks\F[]\fR\fI \fR 7669 .sp 7670 Example: 7671 \fI\fIpid directory\fR\fR\fI = \fR\fI\FCpid directory = /var/run/\F[]\fR\fI \fR 7184 7672 .RE 7185 7673 … … 7193 7681 .sp 7194 7682 Default: 7195 \fI\fIposix locking\fR\fR\fI = \fR\fI yes\fR\fI \fR7683 \fI\fIposix locking\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 7196 7684 .RE 7197 7685 … … 7204 7692 An interesting example may be to unmount server resources: 7205 7693 .sp 7206 postexec = /etc/umount /cdrom 7207 .sp 7208 Default: 7209 \fI\fIpostexec\fR\fR\fI = \fR\fI\ fR\fI \fR7210 .sp 7211 Example: 7212 \fI\fIpostexec\fR\fR\fI = \fR\fI echo \e"%u disconnected from %S from %m (%I)\e" >> /tmp/log\fR\fI \fR7694 \FCpostexec = /etc/umount /cdrom\F[] 7695 .sp 7696 Default: 7697 \fI\fIpostexec\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 7698 .sp 7699 Example: 7700 \fI\fIpostexec\fR\fR\fI = \fR\fI\FCecho \e"%u disconnected from %S from %m (%I)\e" >> /tmp/log\F[]\fR\fI \fR 7213 7701 .RE 7214 7702 … … 7222 7710 .sp 7223 7711 Default: 7224 \fI\fIpreexec close\fR\fR\fI = \fR\fI no\fR\fI \fR7712 \fI\fIpreexec close\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 7225 7713 .RE 7226 7714 … … 7242 7730 .sp 7243 7731 7244 preexec = csh \-c \'echo \e"Welcome to %S!\e" | /usr/local/samba/bin/smbclient \-M %m \-I %I\' & 7732 \FCpreexec = csh \-c \'echo \e"Welcome to %S!\e" | /usr/local/samba/bin/smbclient \-M %m \-I %I\' & \F[] 7245 7733 .sp 7246 7734 Of course, this could get annoying after a while :\-) … … 7252 7740 .sp 7253 7741 Default: 7254 \fI\fIpreexec\fR\fR\fI = \fR\fI\ fR\fI \fR7255 .sp 7256 Example: 7257 \fI\fIpreexec\fR\fR\fI = \fR\fI echo \e"%u connected to %S from %m (%I)\e" >> /tmp/log\fR\fI \fR7742 \fI\fIpreexec\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 7743 .sp 7744 Example: 7745 \fI\fIpreexec\fR\fR\fI = \fR\fI\FCecho \e"%u connected to %S from %m (%I)\e" >> /tmp/log\F[]\fR\fI \fR 7258 7746 .RE 7259 7747 … … 7276 7764 If this is set to 7277 7765 \fByes\fR, on startup, 7278 nmbd 7766 \FCnmbd\F[] 7279 7767 will force an election, and it will have a slight advantage in winning the election\&. It is recommended that this parameter is used in conjunction with 7280 7768 \m[blue]\fBdomain master = yes\fR\m[], so that 7281 nmbd 7769 \FCnmbd\F[] 7282 7770 can guarantee becoming a domain master\&. 7283 7771 .sp … … 7285 7773 .sp 7286 7774 Default: 7287 \fI\fIpreferred master\fR\fR\fI = \fR\fI auto\fR\fI \fR7775 \fI\fIpreferred master\fR\fR\fI = \fR\fI\FCauto\F[]\fR\fI \fR 7288 7776 .RE 7289 7777 … … 7295 7783 .sp 7296 7784 Default: 7297 \fI\fIpreload modules\fR\fR\fI = \fR\fI\ fR\fI \fR7298 .sp 7299 Example: 7300 \fI\fIpreload modules\fR\fR\fI = \fR\fI /usr/lib/samba/passdb/mysql\&.so\fR\fI \fR7785 \fI\fIpreload modules\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 7786 .sp 7787 Example: 7788 \fI\fIpreload modules\fR\fR\fI = \fR\fI\FC/usr/lib/samba/passdb/mysql\&.so\F[]\fR\fI \fR 7301 7789 .RE 7302 7790 … … 7320 7808 .sp 7321 7809 Default: 7322 \fI\fIpreload\fR\fR\fI = \fR\fI\ fR\fI \fR7323 .sp 7324 Example: 7325 \fI\fIpreload\fR\fR\fI = \fR\fI fred lp colorlp\fR\fI \fR7810 \fI\fIpreload\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 7811 .sp 7812 Example: 7813 \fI\fIpreload\fR\fR\fI = \fR\fI\FCfred lp colorlp\F[]\fR\fI \fR 7326 7814 .RE 7327 7815 … … 7338 7826 .sp 7339 7827 Default: 7340 \fI\fIpreserve case\fR\fR\fI = \fR\fI yes\fR\fI \fR7828 \fI\fIpreserve case\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 7341 7829 .RE 7342 7830 … … 7361 7849 .sp 7362 7850 Default: 7363 \fI\fIprintable\fR\fR\fI = \fR\fI no\fR\fI \fR7851 \fI\fIprintable\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 7364 7852 .RE 7365 7853 … … 7373 7861 .sp 7374 7862 Default: 7375 \fI\fIprintcap cache time\fR\fR\fI = \fR\fI 750\fR\fI \fR7376 .sp 7377 Example: 7378 \fI\fIprintcap cache time\fR\fR\fI = \fR\fI 600\fR\fI \fR7863 \fI\fIprintcap cache time\fR\fR\fI = \fR\fI\FC750\F[]\fR\fI \fR 7864 .sp 7865 Example: 7866 \fI\fIprintcap cache time\fR\fR\fI = \fR\fI\FC600\F[]\fR\fI \fR 7379 7867 .RE 7380 7868 … … 7392 7880 .RS 4 7393 7881 This parameter may be used to override the compiled\-in default printcap name used by the server (usually 7394 /etc/printcap)\&. See the discussion of the7882 \FC /etc/printcap\F[])\&. See the discussion of the 7395 7883 [printers] 7396 7884 section above for reasons why you might want to do this\&. 7397 7885 .sp 7398 7886 To use the CUPS printing interface set 7399 printcap name = cups\&. This should be supplemented by an addtional setting7887 \FCprintcap name = cups \F[]\&. This should be supplemented by an addtional setting 7400 7888 \m[blue]\fBprinting = cups\fR\m[] 7401 7889 in the [global] section\&. 7402 printcap name = cups 7890 \FCprintcap name = cups\F[] 7403 7891 will use the "dummy" printcap created by CUPS, as specified in your CUPS configuration file\&. 7404 7892 .sp 7405 7893 On System V systems that use 7406 lpstat 7894 \FClpstat\F[] 7407 7895 to list available printers you can use 7408 printcap name = lpstat 7896 \FCprintcap name = lpstat \F[] 7409 7897 to automatically obtain lists of available printers\&. This is the default for systems that define SYSV at configure time in Samba (this includes most System V based systems)\&. If 7410 7898 \fI printcap name\fR 7411 7899 is set to 7412 lpstat 7900 \FClpstat\F[] 7413 7901 on these systems then Samba will launch 7414 lpstat \-v 7902 \FClpstat \-v\F[] 7415 7903 and attempt to parse the output to obtain a printer list\&. 7416 7904 .sp … … 7420 7908 .RS 4 7421 7909 .\} 7910 .fam C 7911 .ps -1 7422 7912 .nf 7913 .if t \{\ 7914 .sp -1 7915 .\} 7916 .BB lightgray adjust-for-leading-newline 7917 .sp -1 7918 7423 7919 print1|My Printer 1 7424 7920 print2|My Printer 2 … … 7426 7922 print4|My Printer 4 7427 7923 print5|My Printer 5 7924 .EB lightgray adjust-for-leading-newline 7925 .if t \{\ 7926 .sp 1 7927 .\} 7428 7928 .fi 7929 .fam 7930 .ps +1 7429 7931 .if n \{\ 7430 7932 .RE … … 7436 7938 .\} 7437 7939 .RS 4 7940 .BM yellow 7438 7941 .it 1 an-trap 7439 7942 .nr an-no-space-flag 1 … … 7445 7948 .br 7446 7949 Under AIX the default printcap name is 7447 /etc/qconfig\&. Samba will assume the file is in AIX7448 qconfig 7950 \FC/etc/qconfig\F[]\&. Samba will assume the file is in AIX 7951 \FCqconfig\F[] 7449 7952 format if the string 7450 qconfig 7953 \FCqconfig\F[] 7451 7954 appears in the printcap filename\&. 7452 7955 .sp .5v 7453 .RE 7454 Default: 7455 \fI\fIprintcap name\fR\fR\fI = \fR\fI/etc/printcap\fR\fI \fR 7456 .sp 7457 Example: 7458 \fI\fIprintcap name\fR\fR\fI = \fR\fI/etc/myprintcap\fR\fI \fR 7956 .EM yellow 7957 .RE 7958 Default: 7959 \fI\fIprintcap name\fR\fR\fI = \fR\fI\FC/etc/printcap\F[]\fR\fI \fR 7960 .sp 7961 Example: 7962 \fI\fIprintcap name\fR\fR\fI = \fR\fI\FC/etc/myprintcap\F[]\fR\fI \fR 7459 7963 .RE 7460 7964 … … 7464 7968 .RS 4 7465 7969 After a print job has finished spooling to a service, this command will be used via a 7466 system() 7970 \FCsystem()\F[] 7467 7971 call to process the spool file\&. Typically the command specified will submit the spool file to the host\'s printing subsystem, but there is no requirement that this be the case\&. The server will not remove the spool file, so whatever command you specify should remove the spool file when it has been processed, otherwise you will need to manually remove old spool files\&. 7468 7972 .sp … … 7503 8007 You can form quite complex print commands by realizing that they are just passed to a shell\&. For example the following will log a print job, print the file, then remove it\&. Note that \';\' is the usual separator for command in shell scripts\&. 7504 8008 .sp 7505 print command = echo Printing %s >> /tmp/print\&.log; lpr \-P %p %s; rm %s 8009 \FCprint command = echo Printing %s >> /tmp/print\&.log; lpr \-P %p %s; rm %s\F[] 7506 8010 .sp 7507 8011 You may have to vary this command considerably depending on how you normally print files on your system\&. The default for the parameter varies depending on the setting of the … … 7510 8014 .sp 7511 8015 Default: For 7512 printing = BSD, AIX, QNX, LPRNG or PLP : 7513 .sp 7514 print command = lpr \-r \-P%p %s 8016 \FCprinting = BSD, AIX, QNX, LPRNG or PLP :\F[] 8017 .sp 8018 \FCprint command = lpr \-r \-P%p %s\F[] 7515 8019 .sp 7516 8020 For 7517 printing = SYSV or HPUX : 7518 .sp 7519 print command = lp \-c \-d%p %s; rm %s 8021 \FCprinting = SYSV or HPUX :\F[] 8022 .sp 8023 \FCprint command = lp \-c \-d%p %s; rm %s\F[] 7520 8024 .sp 7521 8025 For 7522 printing = SOFTQ : 7523 .sp 7524 print command = lp \-d%p \-s %s; rm %s 8026 \FCprinting = SOFTQ :\F[] 8027 .sp 8028 \FCprint command = lp \-d%p \-s %s; rm %s\F[] 7525 8029 .sp 7526 8030 For printing = CUPS : If SAMBA is compiled against libcups, then 7527 8031 \m[blue]\fBprintcap = cups\fR\m[] 7528 8032 uses the CUPS API to submit jobs, etc\&. Otherwise it maps to the System V commands with the \-oraw option for printing, i\&.e\&. it uses 7529 lp \-c \-d%p \-oraw; rm %s\&. With7530 printing = cups, and if SAMBA is compiled against libcups, any manually set print command will be ignored\&.8033 \FClp \-c \-d%p \-oraw; rm %s\F[]\&. With 8034 \FCprinting = cups\F[], and if SAMBA is compiled against libcups, any manually set print command will be ignored\&. 7531 8035 .sp 7532 8036 \fINo default\fR 7533 8037 .sp 7534 8038 Example: 7535 \fI\fIprint command\fR\fR\fI = \fR\fI /usr/local/samba/bin/myprintscript %p %s\fR\fI \fR8039 \fI\fIprint command\fR\fR\fI = \fR\fI\FC/usr/local/samba/bin/myprintscript %p %s\F[]\fR\fI \fR 7536 8040 .RE 7537 8041 … … 7545 8049 .sp 7546 8050 Default: 7547 \fI\fIprinter admin\fR\fR\fI = \fR\fI\ fR\fI \fR7548 .sp 7549 Example: 7550 \fI\fIprinter admin\fR\fR\fI = \fR\fI admin, @staff\fR\fI \fR8051 \fI\fIprinter admin\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 8052 .sp 8053 Example: 8054 \fI\fIprinter admin\fR\fR\fI = \fR\fI\FCadmin, @staff\F[]\fR\fI \fR 7551 8055 .RE 7552 8056 … … 7570 8074 \m[blue]\fBprinter name\fR\m[] 7571 8075 may be 7572 lp 8076 \FClp\F[] 7573 8077 on many systems\&. 7574 8078 .sp 7575 8079 Default: 7576 \fI\fIprinter name\fR\fR\fI = \fR\fI none\fR\fI \fR7577 .sp 7578 Example: 7579 \fI\fIprinter name\fR\fR\fI = \fR\fI laserwriter\fR\fI \fR8080 \fI\fIprinter name\fR\fR\fI = \fR\fI\FCnone\F[]\fR\fI \fR 8081 .sp 8082 Example: 8083 \fI\fIprinter name\fR\fR\fI = \fR\fI\FClaserwriter\F[]\fR\fI \fR 7580 8084 .RE 7581 8085 … … 7616 8120 .sp 7617 8121 Default: 7618 \fI\fIprinting\fR\fR\fI = \fR\fI Depends on the operating system, see testparm \-v\&.\fR\fI \fR8122 \fI\fIprinting\fR\fR\fI = \fR\fI\FCDepends on the operating system, see \FCtestparm \-v\&.\F[]\F[]\fR\fI \fR 7619 8123 .RE 7620 8124 … … 7626 8130 .sp 7627 8131 Default: 7628 \fI\fIprintjob username\fR\fR\fI = \fR\fI %U\fR\fI \fR7629 .sp 7630 Example: 7631 \fI\fIprintjob username\fR\fR\fI = \fR\fI %D\e%U\fR\fI \fR8132 \fI\fIprintjob username\fR\fR\fI = \fR\fI\FC%U\F[]\fR\fI \fR 8133 .sp 8134 Example: 8135 \fI\fIprintjob username\fR\fR\fI = \fR\fI\FC%D\e%U\F[]\fR\fI \fR 7632 8136 .RE 7633 8137 … … 7637 8141 .RS 4 7638 8142 This parameters defines the directory smbd will use for storing such files as 7639 smbpasswd 8143 \FCsmbpasswd\F[] 7640 8144 and 7641 secrets\&.tdb\&.7642 .sp 7643 Default: 7644 \fI\fIprivate dir\fR\fR\fI = \fR\fI ${prefix}/private\fR\fI \fR8145 \FCsecrets\&.tdb\F[]\&. 8146 .sp 8147 Default: 8148 \fI\fIprivate dir\fR\fR\fI = \fR\fI\FC${prefix}/private\F[]\fR\fI \fR 7645 8149 .RE 7646 8150 … … 7656 8160 .sp 7657 8161 Default: 7658 \fI\fIprofile acls\fR\fR\fI = \fR\fI no\fR\fI \fR8162 \fI\fIprofile acls\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 7659 8163 .RE 7660 8164 … … 7678 8182 .sp 7679 8183 Example: 7680 \fI\fIqueuepause command\fR\fR\fI = \fR\fI disable %p\fR\fI \fR8184 \fI\fIqueuepause command\fR\fR\fI = \fR\fI\FCdisable %p\F[]\fR\fI \fR 7681 8185 .RE 7682 8186 … … 7698 8202 .sp 7699 8203 Default: 7700 \fI\fIqueueresume command\fR\fR\fI = \fR\fI\ fR\fI \fR7701 .sp 7702 Example: 7703 \fI\fIqueueresume command\fR\fR\fI = \fR\fI enable %p\fR\fI \fR8204 \fI\fIqueueresume command\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 8205 .sp 8206 Example: 8207 \fI\fIqueueresume command\fR\fR\fI = \fR\fI\FCenable %p\F[]\fR\fI \fR 7704 8208 .RE 7705 8209 … … 7719 8223 .sp 7720 8224 Default: 7721 \fI\fIread list\fR\fR\fI = \fR\fI\ fR\fI \fR7722 .sp 7723 Example: 7724 \fI\fIread list\fR\fR\fI = \fR\fI mary, @students\fR\fI \fR8225 \fI\fIread list\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 8226 .sp 8227 Example: 8228 \fI\fIread list\fR\fR\fI = \fR\fI\FCmary, @students\F[]\fR\fI \fR 7725 8229 .RE 7726 8230 … … 7735 8239 \fByes\fR, then users of a service may not create or modify files in the service\'s directory\&. 7736 8240 .sp 7737 Note that a printable service ( printable = yes) will8241 Note that a printable service (\FCprintable = yes\F[]) will 7738 8242 \fIALWAYS\fR 7739 8243 allow writing to the directory (user privileges permitting), but only via spooling operations\&. 7740 8244 .sp 7741 8245 Default: 7742 \fI\fIread only\fR\fR\fI = \fR\fI yes\fR\fI \fR8246 \fI\fIread only\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 7743 8247 .RE 7744 8248 … … 7756 8260 .sp 7757 8261 Default: 7758 \fI\fIread raw\fR\fR\fI = \fR\fI yes\fR\fI \fR8262 \fI\fIread raw\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 7759 8263 .RE 7760 8264 … … 7764 8268 .RS 4 7765 8269 This option specifies the kerberos realm to use\&. The realm is used as the ADS equivalent of the NT4 7766 domain\&. It is usually set to the DNS name of the kerberos server\&.7767 .sp 7768 Default: 7769 \fI\fIrealm\fR\fR\fI = \fR\fI\ fR\fI \fR7770 .sp 7771 Example: 7772 \fI\fIrealm\fR\fR\fI = \fR\fI mysambabox\&.mycompany\&.com\fR\fI \fR8270 \FCdomain\F[]\&. It is usually set to the DNS name of the kerberos server\&. 8271 .sp 8272 Default: 8273 \fI\fIrealm\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 8274 .sp 8275 Example: 8276 \fI\fIrealm\fR\fR\fI = \fR\fI\FCmysambabox\&.mycompany\&.com\F[]\fR\fI \fR 7773 8277 .RE 7774 8278 … … 7790 8294 .sp 7791 8295 Default: 7792 \fI\fIregistry shares\fR\fR\fI = \fR\fI no\fR\fI \fR7793 .sp 7794 Example: 7795 \fI\fIregistry shares\fR\fR\fI = \fR\fI yes\fR\fI \fR8296 \fI\fIregistry shares\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 8297 .sp 8298 Example: 8299 \fI\fIregistry shares\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 7796 8300 .RE 7797 8301 … … 7811 8315 .RS 4 7812 8316 .\} 8317 .fam C 8318 .ps -1 7813 8319 .nf 7814 remote announce = 192\&.168\&.2\&.255/SERVERS 192\&.168\&.4\&.255/STAFF 8320 .if t \{\ 8321 .sp -1 8322 .\} 8323 .BB lightgray adjust-for-leading-newline 8324 .sp -1 8325 8326 \FCremote announce = 192\&.168\&.2\&.255/SERVERS 192\&.168\&.4\&.255/STAFF\F[] 8327 .EB lightgray adjust-for-leading-newline 8328 .if t \{\ 8329 .sp 1 8330 .\} 7815 8331 .fi 8332 .fam 8333 .ps +1 7816 8334 .if n \{\ 7817 8335 .RE … … 7819 8337 .sp 7820 8338 the above line would cause 7821 nmbd 8339 \FCnmbd\F[] 7822 8340 to announce itself to the two given IP addresses using the given workgroup names\&. If you leave out the workgroup name, then the one given in the 7823 8341 \m[blue]\fBworkgroup\fR\m[] … … 7829 8347 .sp 7830 8348 Default: 7831 \fI\fIremote announce\fR\fR\fI = \fR\fI\ fR\fI \fR8349 \fI\fIremote announce\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 7832 8350 .RE 7833 8351 … … 7847 8365 .RS 4 7848 8366 .\} 8367 .fam C 8368 .ps -1 7849 8369 .nf 8370 .if t \{\ 8371 .sp -1 8372 .\} 8373 .BB lightgray adjust-for-leading-newline 8374 .sp -1 8375 7850 8376 \fIremote browse sync = 192\&.168\&.2\&.255 192\&.168\&.4\&.255\fR 8377 .EB lightgray adjust-for-leading-newline 8378 .if t \{\ 8379 .sp 1 8380 .\} 7851 8381 .fi 8382 .fam 8383 .ps +1 7852 8384 .if n \{\ 7853 8385 .RE … … 7855 8387 .sp 7856 8388 the above line would cause 7857 nmbd 8389 \FCnmbd\F[] 7858 8390 to request the master browser on the specified subnets or addresses to synchronize their browse lists with the local server\&. 7859 8391 .sp … … 7865 8397 .sp 7866 8398 Default: 7867 \fI\fIremote browse sync\fR\fR\fI = \fR\fI\ fR\fI \fR8399 \fI\fIremote browse sync\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 7868 8400 .RE 7869 8401 … … 7877 8409 .sp 7878 8410 When a user with admin authority or SeAddUserPrivilege rights renames a user (e\&.g\&.: from the NT4 User Manager for Domains), this script will be run to rename the POSIX user\&. Two variables, 7879 %uold 8411 \FC%uold\F[] 7880 8412 and 7881 %unew, will be substituted with the old and new usernames, respectively\&. The script should return 0 upon successful completion, and nonzero otherwise\&.8413 \FC%unew\F[], will be substituted with the old and new usernames, respectively\&. The script should return 0 upon successful completion, and nonzero otherwise\&. 7882 8414 .if n \{\ 7883 8415 .sp 7884 8416 .\} 7885 8417 .RS 4 8418 .BM yellow 7886 8419 .it 1 an-trap 7887 8420 .nr an-no-space-flag 1 … … 7894 8427 The script has all responsibility to rename all the necessary data that is accessible in this posix method\&. This can mean different requirements for different backends\&. The tdbsam and smbpasswd backends will take care of the contents of their respective files, so the script is responsible only for changing the POSIX username, and other data that may required for your circumstances, such as home directory\&. Please also consider whether or not you need to rename the actual home directories themselves\&. The ldapsam backend will not make any changes, because of the potential issues with renaming the LDAP naming attribute\&. In this case the script is responsible for changing the attribute that samba uses (uid) for locating users, as well as any data that needs to change for other applications using the same directory\&. 7895 8428 .sp .5v 7896 .RE 7897 Default: 7898 \fI\fIrename user script\fR\fR\fI = \fR\fIno\fR\fI \fR 8429 .EM yellow 8430 .RE 8431 Default: 8432 \fI\fIrename user script\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 7899 8433 .RE 7900 8434 … … 7906 8440 .sp 7907 8441 Default: 7908 \fI\fIreset on zero vc\fR\fR\fI = \fR\fI no\fR\fI \fR8442 \fI\fIreset on zero vc\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 7909 8443 .RE 7910 8444 … … 7918 8452 .RS 4 7919 8453 .\} 8454 .fam C 8455 .ps -1 7920 8456 .nf 8457 .if t \{\ 8458 .sp -1 8459 .\} 8460 .BB lightgray adjust-for-leading-newline 8461 .sp -1 8462 7921 8463 HKEY_LOCAL_MACHINE\eSYSTEM\eCurrentControlSet\e 7922 8464 Control\eLSA\eRestrictAnonymous 8465 .EB lightgray adjust-for-leading-newline 8466 .if t \{\ 8467 .sp 1 8468 .\} 7923 8469 .fi 8470 .fam 8471 .ps +1 7924 8472 .if n \{\ 7925 8473 .RE … … 7933 8481 .\} 7934 8482 .RS 4 8483 .BM yellow 7935 8484 .it 1 an-trap 7936 8485 .nr an-no-space-flag 1 … … 7945 8494 on any share\&. 7946 8495 .sp .5v 7947 .RE 7948 Default: 7949 \fI\fIrestrict anonymous\fR\fR\fI = \fR\fI0\fR\fI \fR 8496 .EM yellow 8497 .RE 8498 Default: 8499 \fI\fIrestrict anonymous\fR\fR\fI = \fR\fI\FC0\F[]\fR\fI \fR 7950 8500 .RE 7951 8501 … … 7971 8521 .RS 4 7972 8522 The server will 7973 chroot() 8523 \FCchroot()\F[] 7974 8524 (i\&.e\&. Change its root directory) to this directory on startup\&. This is not strictly necessary for secure operation\&. Even without it the server will deny access to files not in one of the service entries\&. It may also check for, and deny access to, soft links to other parts of the filesystem, or attempts to use "\&.\&." in file names to access other directories (depending on the setting of the 7975 8525 \m[blue]\fBwide smbconfoptions\fR\m[] … … 7985 8535 \fIroot directory\fR 7986 8536 tree\&. In particular you will need to mirror 7987 /etc/passwd 8537 \FC/etc/passwd\F[] 7988 8538 (or a subset of it), and any binaries or configuration files needed for printing (if required)\&. The set of files that must be mirrored is operating system dependent\&. 7989 8539 .sp 7990 8540 Default: 7991 \fI\fIroot directory\fR\fR\fI = \fR\fI /\fR\fI \fR7992 .sp 7993 Example: 7994 \fI\fIroot directory\fR\fR\fI = \fR\fI /homes/smb\fR\fI \fR8541 \fI\fIroot directory\fR\fR\fI = \fR\fI\FC/\F[]\fR\fI \fR 8542 .sp 8543 Example: 8544 \fI\fIroot directory\fR\fR\fI = \fR\fI\FC/homes/smb\F[]\fR\fI \fR 7995 8545 .RE 7996 8546 … … 8004 8554 .sp 8005 8555 Default: 8006 \fI\fIroot postexec\fR\fR\fI = \fR\fI\ fR\fI \fR8556 \fI\fIroot postexec\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 8007 8557 .RE 8008 8558 … … 8016 8566 .sp 8017 8567 Default: 8018 \fI\fIroot preexec close\fR\fR\fI = \fR\fI no\fR\fI \fR8568 \fI\fIroot preexec close\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 8019 8569 .RE 8020 8570 … … 8028 8578 .sp 8029 8579 Default: 8030 \fI\fIroot preexec\fR\fR\fI = \fR\fI\ fR\fI \fR8580 \fI\fIroot preexec\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 8031 8581 .RE 8032 8582 … … 8049 8599 .sp 8050 8600 Default: 8051 \fI\fIsecurity mask\fR\fR\fI = \fR\fI 0777\fR\fI \fR8052 .sp 8053 Example: 8054 \fI\fIsecurity mask\fR\fR\fI = \fR\fI 0770\fR\fI \fR8601 \fI\fIsecurity mask\fR\fR\fI = \fR\fI\FC0777\F[]\fR\fI \fR 8602 .sp 8603 Example: 8604 \fI\fIsecurity mask\fR\fR\fI = \fR\fI\FC0770\F[]\fR\fI \fR 8055 8605 .RE 8056 8606 … … 8060 8610 .RS 4 8061 8611 This option affects how clients respond to Samba and is one of the most important settings in the 8062 smb\&.conf 8612 \FC smb\&.conf\F[] 8063 8613 file\&. 8064 8614 .sp … … 8068 8618 .sp 8069 8619 The default is 8070 security = user, as this is the most common setting needed when talking to Windows 98 and Windows NT\&.8620 \FCsecurity = user\F[], as this is the most common setting needed when talking to Windows 98 and Windows NT\&. 8071 8621 .sp 8072 8622 The alternatives are 8073 security = share,8074 security = server 8623 \FCsecurity = share\F[], 8624 \FCsecurity = server\F[] 8075 8625 or 8076 security = domain\&.8626 \FCsecurity = domain \F[]\&. 8077 8627 .sp 8078 8628 In versions of Samba prior to 2\&.0\&.0, the default was 8079 security = share 8629 \FCsecurity = share\F[] 8080 8630 mainly because that was the only option at one stage\&. 8081 8631 .sp … … 8083 8633 .sp 8084 8634 If your PCs use usernames that are the same as their usernames on the UNIX machine then you will want to use 8085 security = user\&. If you mostly use usernames that don\'t exist on the UNIX box then use8086 security = share\&.8635 \FCsecurity = user\F[]\&. If you mostly use usernames that don\'t exist on the UNIX box then use 8636 \FCsecurity = share\F[]\&. 8087 8637 .sp 8088 8638 You should also use 8089 security = share 8639 \FCsecurity = share\F[] 8090 8640 if you want to mainly setup shares without a password (guest shares)\&. This is commonly used for a shared printer server\&. It is more difficult to setup guest shares with 8091 security = user, see the8641 \FCsecurity = user\F[], see the 8092 8642 \m[blue]\fBmap to guest\fR\m[] 8093 8643 parameter for details\&. 8094 8644 .sp 8095 8645 It is possible to use 8096 smbd 8646 \FCsmbd\F[] 8097 8647 in a 8098 8648 \fI hybrid mode\fR … … 8105 8655 .sp 8106 8656 When clients connect to a share level security server, they need not log onto the server with a valid username and password before attempting to connect to a shared resource (although modern clients such as Windows 95/98 and Windows NT will send a logon request with a username but no password when talking to a 8107 security = share 8657 \FCsecurity = share \F[] 8108 8658 server)\&. Instead, the clients send authentication information (passwords) on a per\-share basis, at the time they attempt to connect to that share\&. 8109 8659 .sp 8110 8660 Note that 8111 smbd 8661 \FCsmbd\F[] 8112 8662 \fIALWAYS\fR 8113 8663 uses a valid UNIX user to act on behalf of the client, even in 8114 security = share 8664 \FCsecurity = share\F[] 8115 8665 level security\&. 8116 8666 .sp 8117 8667 As clients are not required to send a username to the server in share level security, 8118 smbd 8668 \FCsmbd\F[] 8119 8669 uses several techniques to determine the correct UNIX user to use on behalf of the client\&. 8120 8670 .sp … … 8249 8799 \fINote\fR 8250 8800 that from the client\'s point of view 8251 security = domain 8801 \FCsecurity = domain\F[] 8252 8802 is the same as 8253 security = user\&. It only affects how the server deals with the authentication, it does not in any way affect what the client sees\&.8803 \FCsecurity = user\F[]\&. It only affects how the server deals with the authentication, it does not in any way affect what the client sees\&. 8254 8804 .sp 8255 8805 \fINote\fR … … 8273 8823 .sp 8274 8824 In this mode Samba will try to validate the username/password by passing it to another SMB server, such as an NT box\&. If this fails it will revert to 8275 security = user\&. It expects the8825 \FCsecurity = user\F[]\&. It expects the 8276 8826 \m[blue]\fBencrypted passwords\fR\m[] 8277 8827 parameter to be set to 8278 8828 \fByes\fR, unless the remote server does not support them\&. However note that if encrypted passwords have been negotiated then Samba cannot revert back to checking the UNIX password file, it must have a valid 8279 smbpasswd 8829 \FCsmbpasswd\F[] 8280 8830 file to check users against\&. See the chapter about the User Database in the Samba HOWTO Collection for details on how to set this up\&. 8281 8831 .if n \{\ … … 8283 8833 .\} 8284 8834 .RS 4 8835 .BM yellow 8285 8836 .it 1 an-trap 8286 8837 .nr an-no-space-flag 1 … … 8293 8844 This mode of operation has significant pitfalls since it is more vulnerable to man\-in\-the\-middle attacks and server impersonation\&. In particular, this mode of operation can cause significant resource consuption on the PDC, as it must maintain an active connection for the duration of the user\'s session\&. Furthermore, if this connection is lost, there is no way to reestablish it, and futher authentications to the Samba server may fail (from a single client, till it disconnects)\&. 8294 8845 .sp .5v 8846 .EM yellow 8295 8847 .RE 8296 8848 .if n \{\ … … 8298 8850 .\} 8299 8851 .RS 4 8852 .BM yellow 8300 8853 .it 1 an-trap 8301 8854 .nr an-no-space-flag 1 … … 8307 8860 .br 8308 8861 From the client\'s point of view, 8309 security = server 8862 \FCsecurity = server\F[] 8310 8863 is the same as 8311 security = user\&. It only affects how the server deals with the authentication, it does not in any way affect what the client sees\&.8864 \FCsecurity = user\F[]\&. It only affects how the server deals with the authentication, it does not in any way affect what the client sees\&. 8312 8865 .sp .5v 8866 .EM yellow 8313 8867 .RE 8314 8868 \fINote\fR … … 8338 8892 .sp 8339 8893 Default: 8340 \fI\fIsecurity\fR\fR\fI = \fR\fI USER\fR\fI \fR8341 .sp 8342 Example: 8343 \fI\fIsecurity\fR\fR\fI = \fR\fI DOMAIN\fR\fI \fR8894 \fI\fIsecurity\fR\fR\fI = \fR\fI\FCUSER\F[]\fR\fI \fR 8895 .sp 8896 Example: 8897 \fI\fIsecurity\fR\fR\fI = \fR\fI\FCDOMAIN\F[]\fR\fI \fR 8344 8898 .RE 8345 8899 … … 8357 8911 .sp 8358 8912 Please note that with this set to 8359 no, you will have to apply the WindowsXP8360 WinXP_SignOrSeal\&.reg 8913 \FCno\F[], you will have to apply the WindowsXP 8914 \FCWinXP_SignOrSeal\&.reg\F[] 8361 8915 registry patch found in the docs/registry subdirectory of the Samba distribution tarball\&. 8362 8916 .sp 8363 8917 Default: 8364 \fI\fIserver schannel\fR\fR\fI = \fR\fI auto\fR\fI \fR8365 .sp 8366 Example: 8367 \fI\fIserver schannel\fR\fR\fI = \fR\fI yes\fR\fI \fR8918 \fI\fIserver schannel\fR\fR\fI = \fR\fI\FCauto\F[]\fR\fI \fR 8919 .sp 8920 Example: 8921 \fI\fIserver schannel\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 8368 8922 .RE 8369 8923 … … 8381 8935 .sp 8382 8936 Default: 8383 \fI\fIserver signing\fR\fR\fI = \fR\fI Disabled\fR\fI \fR8937 \fI\fIserver signing\fR\fR\fI = \fR\fI\FCDisabled\F[]\fR\fI \fR 8384 8938 .RE 8385 8939 … … 8389 8943 .RS 4 8390 8944 This controls what string will show up in the printer comment box in print manager and next to the IPC connection in 8391 net view\&. It can be any string that you wish to show to your users\&.8945 \FCnet view\F[]\&. It can be any string that you wish to show to your users\&. 8392 8946 .sp 8393 8947 It also sets what will appear in browse lists next to the machine name\&. … … 8402 8956 .sp 8403 8957 Default: 8404 \fI\fIserver string\fR\fR\fI = \fR\fI Samba %v\fR\fI \fR8405 .sp 8406 Example: 8407 \fI\fIserver string\fR\fR\fI = \fR\fI University of GNUs Samba Server\fR\fI \fR8958 \fI\fIserver string\fR\fR\fI = \fR\fI\FCSamba %v\F[]\fR\fI \fR 8959 .sp 8960 Example: 8961 \fI\fIserver string\fR\fR\fI = \fR\fI\FCUniversity of GNUs Samba Server\F[]\fR\fI \fR 8408 8962 .RE 8409 8963 … … 8413 8967 .RS 4 8414 8968 If 8415 set directory = no, then users of the service may not use the setdir command to change directory\&.8969 \FCset directory = no\F[], then users of the service may not use the setdir command to change directory\&. 8416 8970 .sp 8417 8971 The 8418 setdir 8972 \FCsetdir\F[] 8419 8973 command is only implemented in the Digital Pathworks client\&. See the Pathworks documentation for details\&. 8420 8974 .sp 8421 8975 Default: 8422 \fI\fIset directory\fR\fR\fI = \fR\fI no\fR\fI \fR8976 \fI\fIset directory\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 8423 8977 .RE 8424 8978 … … 8428 8982 .RS 4 8429 8983 Thanks to the Posix subsystem in NT a Windows User has a primary group in addition to the auxiliary groups\&. This script sets the primary group in the unix userdatase when an administrator sets the primary group from the windows user manager or when fetching a SAM with 8430 net rpc vampire\&.8984 \FCnet rpc vampire\F[]\&. 8431 8985 \fI%u\fR 8432 8986 will be replaced with the user whose primary group is to be set\&. … … 8435 8989 .sp 8436 8990 Default: 8437 \fI\fIset primary group script\fR\fR\fI = \fR\fI\ fR\fI \fR8438 .sp 8439 Example: 8440 \fI\fIset primary group script\fR\fR\fI = \fR\fI /usr/sbin/usermod \-g \'%g\' \'%u\'\fR\fI \fR8991 \fI\fIset primary group script\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 8992 .sp 8993 Example: 8994 \fI\fIset primary group script\fR\fR\fI = \fR\fI\FC/usr/sbin/usermod \-g \'%g\' \'%u\'\F[]\fR\fI \fR 8441 8995 .RE 8442 8996 … … 8446 9000 .RS 4 8447 9001 The 8448 set quota command 9002 \FCset quota command\F[] 8449 9003 should only be used whenever there is no operating system API available from the OS that samba can use\&. 8450 9004 .sp 8451 9005 This option is only available if Samba was configured with the argument 8452 \ -\-with\-sys\-quotas9006 \FC\-\-with\-sys\-quotas\F[] 8453 9007 or on linux when 8454 \ &./configure \-\-with\-quotas9008 \FC\&./configure \-\-with\-quotas\F[] 8455 9009 was used and a working quota api was found in the system\&. Most packages are configured with these options already\&. 8456 9010 .sp … … 8595 9149 .sp 8596 9150 Default: 8597 \fI\fIset quota command\fR\fR\fI = \fR\fI\ fR\fI \fR8598 .sp 8599 Example: 8600 \fI\fIset quota command\fR\fR\fI = \fR\fI /usr/local/sbin/set_quota\fR\fI \fR9151 \fI\fIset quota command\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 9152 .sp 9153 Example: 9154 \fI\fIset quota command\fR\fR\fI = \fR\fI\FC/usr/local/sbin/set_quota\F[]\fR\fI \fR 8601 9155 .RE 8602 9156 … … 8622 9176 .sp 8623 9177 Default: 8624 \fI\fIshare modes\fR\fR\fI = \fR\fI yes\fR\fI \fR9178 \fI\fIshare modes\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 8625 9179 .RE 8626 9180 … … 8638 9192 .sp 8639 9193 Default: 8640 \fI\fIshort preserve case\fR\fR\fI = \fR\fI yes\fR\fI \fR9194 \fI\fIshort preserve case\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 8641 9195 .RE 8642 9196 … … 8658 9212 .\} 8659 9213 .RS 4 9214 .BM yellow 8660 9215 .it 1 an-trap 8661 9216 .nr an-no-space-flag 1 … … 8668 9223 This does not prevent the same user from having administrative privilege on an individual printer\&. 8669 9224 .sp .5v 8670 .RE 8671 Default: 8672 \fI\fIshow add printer wizard\fR\fR\fI = \fR\fIyes\fR\fI \fR 9225 .EM yellow 9226 .RE 9227 Default: 9228 \fI\fIshow add printer wizard\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 8673 9229 .RE 8674 9230 … … 8741 9297 .RS 4 8742 9298 .\} 9299 .fam C 9300 .ps -1 8743 9301 .nf 9302 .if t \{\ 9303 .sp -1 9304 .\} 9305 .BB lightgray adjust-for-leading-newline 9306 .sp -1 9307 8744 9308 #!/bin/bash 8745 9309 … … 8750 9314 /sbin/shutdown $3 $4 +$time $1 & 8751 9315 9316 .EB lightgray adjust-for-leading-newline 9317 .if t \{\ 9318 .sp 1 9319 .\} 8752 9320 .fi 9321 .fam 9322 .ps +1 8753 9323 .if n \{\ 8754 9324 .RE … … 8758 9328 .sp 8759 9329 Default: 8760 \fI\fIshutdown script\fR\fR\fI = \fR\fI\ fR\fI \fR8761 .sp 8762 Example: 8763 \fI\fIshutdown script\fR\fR\fI = \fR\fI /usr/local/samba/sbin/shutdown %m %t %r %f\fR\fI \fR9330 \fI\fIshutdown script\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 9331 .sp 9332 Example: 9333 \fI\fIshutdown script\fR\fR\fI = \fR\fI\FC/usr/local/samba/sbin/shutdown %m %t %r %f\F[]\fR\fI \fR 8764 9334 .RE 8765 9335 … … 8785 9355 .sp 8786 9356 Default: 8787 \fI\fIsmb encrypt\fR\fR\fI = \fR\fI auto\fR\fI \fR9357 \fI\fIsmb encrypt\fR\fR\fI = \fR\fI\FCauto\F[]\fR\fI \fR 8788 9358 .RE 8789 9359 … … 8799 9369 .RS 4 8800 9370 .\} 9371 .fam C 9372 .ps -1 8801 9373 .nf 9374 .if t \{\ 9375 .sp -1 9376 .\} 9377 .BB lightgray adjust-for-leading-newline 9378 .sp -1 9379 8802 9380 smb passwd file = /etc/samba/smbpasswd 9381 .EB lightgray adjust-for-leading-newline 9382 .if t \{\ 9383 .sp 1 9384 .\} 8803 9385 .fi 9386 .fam 9387 .ps +1 8804 9388 .if n \{\ 8805 9389 .RE … … 8807 9391 .sp 8808 9392 Default: 8809 \fI\fIsmb passwd file\fR\fR\fI = \fR\fI ${prefix}/private/smbpasswd\fR\fI \fR9393 \fI\fIsmb passwd file\fR\fR\fI = \fR\fI\FC${prefix}/private/smbpasswd\F[]\fR\fI \fR 8810 9394 .RE 8811 9395 … … 8817 9401 .sp 8818 9402 Default: 8819 \fI\fIsmb ports\fR\fR\fI = \fR\fI 445 139\fR\fI \fR9403 \fI\fIsmb ports\fR\fR\fI = \fR\fI\FC445 139\F[]\fR\fI \fR 8820 9404 .RE 8821 9405 … … 8831 9415 .sp 8832 9416 Default: 8833 \fI\fIsocket address\fR\fR\fI = \fR\fI\ fR\fI \fR8834 .sp 8835 Example: 8836 \fI\fIsocket address\fR\fR\fI = \fR\fI 192\&.168\&.2\&.20\fR\fI \fR9417 \fI\fIsocket address\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 9418 .sp 9419 Example: 9420 \fI\fIsocket address\fR\fR\fI = \fR\fI\FC192\&.168\&.2\&.20\F[]\fR\fI \fR 8837 9421 .RE 8838 9422 … … 8846 9430 .sp 8847 9431 This option will typically be used to tune your Samba server for optimal performance for your local network\&. There is no way that Samba can know what the optimal parameters are for your net, so you must experiment and choose them yourself\&. We strongly suggest you read the appropriate documentation for your operating system first (perhaps 8848 man setsockopt 9432 \FCman setsockopt\F[] 8849 9433 will help)\&. 8850 9434 .sp … … 8971 9555 .sp 8972 9556 To specify an argument use the syntax SOME_OPTION = VALUE for example 8973 SO_SNDBUF = 8192\&. Note that you must not have any spaces before or after the = sign\&.9557 \FCSO_SNDBUF = 8192\F[]\&. Note that you must not have any spaces before or after the = sign\&. 8974 9558 .sp 8975 9559 If you are on a local network then a sensible option might be: 8976 9560 .sp 8977 socket options = IPTOS_LOWDELAY 9561 \FCsocket options = IPTOS_LOWDELAY\F[] 8978 9562 .sp 8979 9563 If you have a local network then you could try: 8980 9564 .sp 8981 socket options = IPTOS_LOWDELAY TCP_NODELAY 9565 \FCsocket options = IPTOS_LOWDELAY TCP_NODELAY\F[] 8982 9566 .sp 8983 9567 If you are on a wide area network then perhaps try setting IPTOS_THROUGHPUT\&. … … 8986 9570 .sp 8987 9571 Default: 8988 \fI\fIsocket options\fR\fR\fI = \fR\fI TCP_NODELAY\fR\fI \fR8989 .sp 8990 Example: 8991 \fI\fIsocket options\fR\fR\fI = \fR\fI IPTOS_LOWDELAY\fR\fI \fR9572 \fI\fIsocket options\fR\fR\fI = \fR\fI\FCTCP_NODELAY\F[]\fR\fI \fR 9573 .sp 9574 Example: 9575 \fI\fIsocket options\fR\fR\fI = \fR\fI\FCIPTOS_LOWDELAY\F[]\fR\fI \fR 8992 9576 .RE 8993 9577 … … 9001 9585 .sp 9002 9586 Default: 9003 \fI\fIstat cache\fR\fR\fI = \fR\fI yes\fR\fI \fR9587 \fI\fIstat cache\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 9004 9588 .RE 9005 9589 … … 9020 9604 .sp 9021 9605 Default: 9022 \fI\fIstore dos attributes\fR\fR\fI = \fR\fI no\fR\fI \fR9606 \fI\fIstore dos attributes\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 9023 9607 .RE 9024 9608 … … 9040 9624 .sp 9041 9625 Default: 9042 \fI\fIstrict allocate\fR\fR\fI = \fR\fI no\fR\fI \fR9626 \fI\fIstrict allocate\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 9043 9627 .RE 9044 9628 … … 9055 9639 .sp 9056 9640 Well\-behaved clients always ask for lock checks when it is important\&. So in the vast majority of cases, 9057 strict locking = Auto 9641 \FCstrict locking = Auto\F[] 9058 9642 or 9059 strict locking = no 9643 \FCstrict locking = no\F[] 9060 9644 is acceptable\&. 9061 9645 .sp 9062 9646 Default: 9063 \fI\fIstrict locking\fR\fR\fI = \fR\fI Auto\fR\fI \fR9647 \fI\fIstrict locking\fR\fR\fI = \fR\fI\FCAuto\F[]\fR\fI \fR 9064 9648 .RE 9065 9649 … … 9075 9659 .sp 9076 9660 Default: 9077 \fI\fIstrict sync\fR\fR\fI = \fR\fI no\fR\fI \fR9661 \fI\fIstrict sync\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 9078 9662 .RE 9079 9663 … … 9085 9669 .sp 9086 9670 The administrator must create a directory name 9087 svcctl 9671 \FCsvcctl\F[] 9088 9672 in Samba\'s $(libdir) and create symbolic links to the init scripts in 9089 /etc/init\&.d/\&. The name of the links must match the names given as part of the9673 \FC/etc/init\&.d/\F[]\&. The name of the links must match the names given as part of the 9090 9674 \fIsvcctl list\fR\&. 9091 9675 .sp 9092 9676 Default: 9093 \fI\fIsvcctl list\fR\fR\fI = \fR\fI\ fR\fI \fR9094 .sp 9095 Example: 9096 \fI\fIsvcctl list\fR\fR\fI = \fR\fI cups postfix portmap httpd\fR\fI \fR9677 \fI\fIsvcctl list\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 9678 .sp 9679 Example: 9680 \fI\fIsvcctl list\fR\fR\fI = \fR\fI\FCcups postfix portmap httpd\F[]\fR\fI \fR 9097 9681 .RE 9098 9682 … … 9106 9690 \fByes\fR 9107 9691 then every write will be followed by a 9108 fsync() 9692 \FCfsync() \F[] 9109 9693 call to ensure the data is written to disk\&. Note that the 9110 9694 \fIstrict sync\fR … … 9114 9698 .sp 9115 9699 Default: 9116 \fI\fIsync always\fR\fR\fI = \fR\fI no\fR\fI \fR9700 \fI\fIsync always\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 9117 9701 .RE 9118 9702 … … 9126 9710 .sp 9127 9711 Default: 9128 \fI\fIsyslog only\fR\fR\fI = \fR\fI no\fR\fI \fR9712 \fI\fIsyslog only\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 9129 9713 .RE 9130 9714 … … 9144 9728 .sp 9145 9729 Default: 9146 \fI\fIsyslog\fR\fR\fI = \fR\fI 1\fR\fI \fR9730 \fI\fIsyslog\fR\fR\fI = \fR\fI\FC1\F[]\fR\fI \fR 9147 9731 .RE 9148 9732 … … 9160 9744 .sp 9161 9745 Default: 9162 \fI\fItemplate homedir\fR\fR\fI = \fR\fI /home/%D/%U\fR\fI \fR9746 \fI\fItemplate homedir\fR\fR\fI = \fR\fI\FC/home/%D/%U\F[]\fR\fI \fR 9163 9747 .RE 9164 9748 … … 9181 9765 .sp 9182 9766 Default: 9183 \fI\fItime offset\fR\fR\fI = \fR\fI 0\fR\fI \fR9184 .sp 9185 Example: 9186 \fI\fItime offset\fR\fR\fI = \fR\fI 60\fR\fI \fR9767 \fI\fItime offset\fR\fR\fI = \fR\fI\FC0\F[]\fR\fI \fR 9768 .sp 9769 Example: 9770 \fI\fItime offset\fR\fR\fI = \fR\fI\FC60\F[]\fR\fI \fR 9187 9771 .RE 9188 9772 … … 9196 9780 .sp 9197 9781 Default: 9198 \fI\fItime server\fR\fR\fI = \fR\fI no\fR\fI \fR9782 \fI\fItime server\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 9199 9783 .RE 9200 9784 … … 9208 9792 .sp 9209 9793 Default: 9210 \fI\fIunix charset\fR\fR\fI = \fR\fI UTF8\fR\fI \fR9211 .sp 9212 Example: 9213 \fI\fIunix charset\fR\fR\fI = \fR\fI ASCII\fR\fI \fR9794 \fI\fIunix charset\fR\fR\fI = \fR\fI\FCUTF8\F[]\fR\fI \fR 9795 .sp 9796 Example: 9797 \fI\fIunix charset\fR\fR\fI = \fR\fI\FCASCII\F[]\fR\fI \fR 9214 9798 .RE 9215 9799 … … 9220 9804 This boolean parameter controls whether Samba implements the CIFS UNIX extensions, as defined by HP\&. These extensions enable Samba to better serve UNIX CIFS clients by supporting features such as symbolic links, hard links, etc\&.\&.\&. These extensions require a similarly enabled client, and are of no current use to Windows clients\&. 9221 9805 .sp 9222 Default: 9223 \fI\fIunix extensions\fR\fR\fI = \fR\fIyes\fR\fI \fR 9806 Note if this parameter is turned on, the 9807 \m[blue]\fBwide links\fR\m[] 9808 parameter will automatically be disabled\&. 9809 .sp 9810 Default: 9811 \fI\fIunix extensions\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 9224 9812 .RE 9225 9813 … … 9237 9825 .sp 9238 9826 Default: 9239 \fI\fIunix password sync\fR\fR\fI = \fR\fI no\fR\fI \fR9827 \fI\fIunix password sync\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 9240 9828 .RE 9241 9829 … … 9258 9846 .sp 9259 9847 Note that even when this parameter is set, a user authenticating to 9260 smbd 9848 \FCsmbd\F[] 9261 9849 must still enter a valid password in order to connect correctly, and to update their hashed (smbpasswd) passwords\&. 9262 9850 .sp 9263 9851 Default: 9264 \fI\fIupdate encrypted\fR\fR\fI = \fR\fI no\fR\fI \fR9852 \fI\fIupdate encrypted\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 9265 9853 .RE 9266 9854 … … 9270 9858 .RS 4 9271 9859 This parameter applies only to Windows NT/2000 clients\&. It has no effect on Windows 95/98/ME clients\&. When serving a printer to Windows NT/2000 clients without first installing a valid printer driver on the Samba host, the client will be required to install a local printer driver\&. From this point on, the client will treat the print as a local printer and not a network printer connection\&. This is much the same behavior that will occur when 9272 disable spoolss = yes\&.9860 \FCdisable spoolss = yes\F[]\&. 9273 9861 .sp 9274 9862 The differentiating factor is that under normal circumstances, the NT/2000 client will attempt to open the network printer using MS\-RPC\&. The problem is that because the client considers the printer to be local, it will attempt to issue the OpenPrinterEx() call requesting access rights associated with the logged on user\&. If the user possesses local administator rights but not root privilege on the Samba host (often the case), the OpenPrinterEx() call will fail\&. The result is that the client will now display an "Access Denied; Unable to connect" message in the printer queue window (even though jobs may successfully be printed)\&. … … 9278 9866 .sp 9279 9867 Default: 9280 \fI\fIuse client driver\fR\fR\fI = \fR\fI no\fR\fI \fR9868 \fI\fIuse client driver\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 9281 9869 .RE 9282 9870 … … 9291 9879 .sp 9292 9880 When you are using the heimdal Kerberos libraries, you must also specify the following in 9293 /etc/krb5\&.conf:9881 \FC/etc/krb5\&.conf\F[]: 9294 9882 .sp 9295 9883 .if n \{\ 9296 9884 .RS 4 9297 9885 .\} 9886 .fam C 9887 .ps -1 9298 9888 .nf 9889 .if t \{\ 9890 .sp -1 9891 .\} 9892 .BB lightgray adjust-for-leading-newline 9893 .sp -1 9894 9299 9895 [libdefaults] 9300 9896 default_keytab_name = FILE:/etc/krb5\&.keytab 9897 .EB lightgray adjust-for-leading-newline 9898 .if t \{\ 9899 .sp 1 9900 .\} 9301 9901 .fi 9902 .fam 9903 .ps +1 9302 9904 .if n \{\ 9303 9905 .RE … … 9305 9907 .sp 9306 9908 Default: 9307 \fI\fIuse kerberos keytab\fR\fR\fI = \fR\fI False\fR\fI \fR9909 \fI\fIuse kerberos keytab\fR\fR\fI = \fR\fI\FCFalse\F[]\fR\fI \fR 9308 9910 .RE 9309 9911 … … 9317 9919 .sp 9318 9920 Default: 9319 \fI\fIuse mmap\fR\fR\fI = \fR\fI yes\fR\fI \fR9921 \fI\fIuse mmap\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 9320 9922 .RE 9321 9923 … … 9332 9934 .sp 9333 9935 Default: 9334 \fI\fIusername level\fR\fR\fI = \fR\fI 0\fR\fI \fR9335 .sp 9336 Example: 9337 \fI\fIusername level\fR\fR\fI = \fR\fI 5\fR\fI \fR9936 \fI\fIusername level\fR\fR\fI = \fR\fI\FC0\F[]\fR\fI \fR 9937 .sp 9938 Example: 9939 \fI\fIusername level\fR\fR\fI = \fR\fI\FC5\F[]\fR\fI \fR 9338 9940 .RE 9339 9941 … … 9347 9949 .sp 9348 9950 Default: 9349 \fI\fIusername map script\fR\fR\fI = \fR\fI\ fR\fI \fR9350 .sp 9351 Example: 9352 \fI\fIusername map script\fR\fR\fI = \fR\fI /etc/samba/scripts/mapusers\&.sh\fR\fI \fR9951 \fI\fIusername map script\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 9952 .sp 9953 Example: 9954 \fI\fIusername map script\fR\fR\fI = \fR\fI\FC/etc/samba/scripts/mapusers\&.sh\F[]\fR\fI \fR 9353 9955 .RE 9354 9956 … … 9360 9962 .sp 9361 9963 Please note that for user or share mode security, the username map is applied prior to validating the user credentials\&. Domain member servers (domain or ads) apply the username map after the user has been successfully authenticated by the domain controller and require fully qualified enties in the map table (e\&.g\&. biddle = 9362 DOMAIN\efoo)\&.9964 \FCDOMAIN\efoo\F[])\&. 9363 9965 .sp 9364 9966 The map file is parsed line by line\&. Each line should contain a single UNIX username on the left then a \'=\' followed by a list of usernames on the right\&. The list of usernames on the right may contain names of the form @group in which case they will match any UNIX username in that group\&. The special client name \'*\' is a wildcard and matches any name\&. Each line of the map file may be up to 1023 characters long\&. … … 9381 9983 .RS 4 9382 9984 .\} 9985 .fam C 9986 .ps -1 9383 9987 .nf 9384 root = admin administrator 9988 .if t \{\ 9989 .sp -1 9990 .\} 9991 .BB lightgray adjust-for-leading-newline 9992 .sp -1 9993 9994 \FCroot = admin administrator\F[] 9995 .EB lightgray adjust-for-leading-newline 9996 .if t \{\ 9997 .sp 1 9998 .\} 9385 9999 .fi 10000 .fam 10001 .ps +1 9386 10002 .if n \{\ 9387 10003 .RE … … 9397 10013 .RS 4 9398 10014 .\} 10015 .fam C 10016 .ps -1 9399 10017 .nf 9400 sys = @system 10018 .if t \{\ 10019 .sp -1 10020 .\} 10021 .BB lightgray adjust-for-leading-newline 10022 .sp -1 10023 10024 \FCsys = @system\F[] 10025 .EB lightgray adjust-for-leading-newline 10026 .if t \{\ 10027 .sp 1 10028 .\} 9401 10029 .fi 10030 .fam 10031 .ps +1 9402 10032 .if n \{\ 9403 10033 .RE … … 9407 10037 .sp 9408 10038 If your system supports the NIS NETGROUP option then the netgroup database is checked before the 9409 /etc/group 10039 \FC/etc/group \F[] 9410 10040 database for matching groups\&. 9411 10041 .sp … … 9415 10045 .RS 4 9416 10046 .\} 10047 .fam C 10048 .ps -1 9417 10049 .nf 9418 tridge = "Andrew Tridgell" 10050 .if t \{\ 10051 .sp -1 10052 .\} 10053 .BB lightgray adjust-for-leading-newline 10054 .sp -1 10055 10056 \FCtridge = "Andrew Tridgell"\F[] 10057 .EB lightgray adjust-for-leading-newline 10058 .if t \{\ 10059 .sp 1 10060 .\} 9419 10061 .fi 10062 .fam 10063 .ps +1 9420 10064 .if n \{\ 9421 10065 .RE … … 9429 10073 .RS 4 9430 10074 .\} 10075 .fam C 10076 .ps -1 9431 10077 .nf 10078 .if t \{\ 10079 .sp -1 10080 .\} 10081 .BB lightgray adjust-for-leading-newline 10082 .sp -1 10083 9432 10084 !sys = mary fred 9433 10085 guest = * 10086 .EB lightgray adjust-for-leading-newline 10087 .if t \{\ 10088 .sp 1 10089 .\} 9434 10090 .fi 10091 .fam 10092 .ps +1 9435 10093 .if n \{\ 9436 10094 .RE … … 9451 10109 .sp 9452 10110 Samba versions prior to 3\&.0\&.8 would only support reading the fully qualified username (e\&.g\&.: 9453 DOMAIN\euser) from the username map when performing a kerberos login from a client\&. However, when looking up a map entry for a user authenticated by NTLM[SSP], only the login name would be used for matches\&. This resulted in inconsistent behavior sometimes even on the same server\&.10111 \FCDOMAIN\euser\F[]) from the username map when performing a kerberos login from a client\&. However, when looking up a map entry for a user authenticated by NTLM[SSP], only the login name would be used for matches\&. This resulted in inconsistent behavior sometimes even on the same server\&. 9454 10112 .sp 9455 10113 The following functionality is obeyed in version 3\&.0\&.8 and later: … … 9458 10116 .sp 9459 10117 When relying upon a external domain controller for validating authentication requests, smbd will apply the username map to the fully qualified username (i\&.e\&. 9460 DOMAIN\euser) only after the user has been successfully authenticated\&.10118 \FCDOMAIN\euser\F[]) only after the user has been successfully authenticated\&. 9461 10119 .sp 9462 10120 An example of use is: … … 9465 10123 .RS 4 9466 10124 .\} 10125 .fam C 10126 .ps -1 9467 10127 .nf 10128 .if t \{\ 10129 .sp -1 10130 .\} 10131 .BB lightgray adjust-for-leading-newline 10132 .sp -1 10133 9468 10134 username map = /usr/local/samba/lib/users\&.map 10135 .EB lightgray adjust-for-leading-newline 10136 .if t \{\ 10137 .sp 1 10138 .\} 9469 10139 .fi 10140 .fam 10141 .ps +1 9470 10142 .if n \{\ 9471 10143 .RE … … 9473 10145 .sp 9474 10146 Default: 9475 \fI\fIusername map\fR\fR\fI = \fR\fI # no username map\fR\fI \fR10147 \fI\fIusername map\fR\fR\fI = \fR\fI\FC # no username map\F[]\fR\fI \fR 9476 10148 .RE 9477 10149 … … 9527 10199 .sp 9528 10200 Default: 9529 \fI\fIusername\fR\fR\fI = \fR\fI # The guest account if a guest service, else <empty string>\&.\fR\fI \fR9530 .sp 9531 Example: 9532 \fI\fIusername\fR\fR\fI = \fR\fI fred, mary, jack, jane, @users, @pcgroup\fR\fI \fR10201 \fI\fIusername\fR\fR\fI = \fR\fI\FC # The guest account if a guest service, else <empty string>\&.\F[]\fR\fI \fR 10202 .sp 10203 Example: 10204 \fI\fIusername\fR\fR\fI = \fR\fI\FCfred, mary, jack, jane, @users, @pcgroup\F[]\fR\fI \fR 9533 10205 .RE 9534 10206 … … 9542 10214 .sp 9543 10215 Default: 9544 \fI\fIusershare allow guests\fR\fR\fI = \fR\fI no\fR\fI \fR10216 \fI\fIusershare allow guests\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 9545 10217 .RE 9546 10218 … … 9552 10224 .sp 9553 10225 Default: 9554 \fI\fIusershare max shares\fR\fR\fI = \fR\fI 0\fR\fI \fR10226 \fI\fIusershare max shares\fR\fR\fI = \fR\fI\FC0\F[]\fR\fI \fR 9555 10227 .RE 9556 10228 … … 9562 10234 .sp 9563 10235 Default: 9564 \fI\fIusershare owner only\fR\fR\fI = \fR\fI True\fR\fI \fR10236 \fI\fIusershare owner only\fR\fR\fI = \fR\fI\FCTrue\F[]\fR\fI \fR 9565 10237 .RE 9566 10238 … … 9578 10250 .RS 4 9579 10251 .\} 10252 .fam C 10253 .ps -1 9580 10254 .nf 10255 .if t \{\ 10256 .sp -1 10257 .\} 10258 .BB lightgray adjust-for-leading-newline 10259 .sp -1 10260 9581 10261 ls \-ld /usr/local/samba/lib/usershares/ 9582 10262 drwxrwx\-\-T 2 root power_users 4096 2006\-05\-05 12:27 /usr/local/samba/lib/usershares/ 9583 10263 10264 .EB lightgray adjust-for-leading-newline 10265 .if t \{\ 10266 .sp 1 10267 .\} 9584 10268 .fi 10269 .fam 10270 .ps +1 9585 10271 .if n \{\ 9586 10272 .RE … … 9590 10276 .sp 9591 10277 Default: 9592 \fI\fIusershare path\fR\fR\fI = \fR\fI NULL\fR\fI \fR10278 \fI\fIusershare path\fR\fR\fI = \fR\fI\FCNULL\F[]\fR\fI \fR 9593 10279 .RE 9594 10280 … … 9602 10288 .sp 9603 10289 Default: 9604 \fI\fIusershare prefix allow list\fR\fR\fI = \fR\fI NULL\fR\fI \fR9605 .sp 9606 Example: 9607 \fI\fIusershare prefix allow list\fR\fR\fI = \fR\fI /home /data /space\fR\fI \fR10290 \fI\fIusershare prefix allow list\fR\fR\fI = \fR\fI\FCNULL\F[]\fR\fI \fR 10291 .sp 10292 Example: 10293 \fI\fIusershare prefix allow list\fR\fR\fI = \fR\fI\FC/home /data /space\F[]\fR\fI \fR 9608 10294 .RE 9609 10295 … … 9617 10303 .sp 9618 10304 Default: 9619 \fI\fIusershare prefix deny list\fR\fR\fI = \fR\fI NULL\fR\fI \fR9620 .sp 9621 Example: 9622 \fI\fIusershare prefix deny list\fR\fR\fI = \fR\fI /etc /dev /private\fR\fI \fR10305 \fI\fIusershare prefix deny list\fR\fR\fI = \fR\fI\FCNULL\F[]\fR\fI \fR 10306 .sp 10307 Example: 10308 \fI\fIusershare prefix deny list\fR\fR\fI = \fR\fI\FC/etc /dev /private\F[]\fR\fI \fR 9623 10309 .RE 9624 10310 … … 9632 10318 .sp 9633 10319 Default: 9634 \fI\fIusershare template share\fR\fR\fI = \fR\fI NULL\fR\fI \fR9635 .sp 9636 Example: 9637 \fI\fIusershare template share\fR\fR\fI = \fR\fI template_share\fR\fI \fR10320 \fI\fIusershare template share\fR\fR\fI = \fR\fI\FCNULL\F[]\fR\fI \fR 10321 .sp 10322 Example: 10323 \fI\fIusershare template share\fR\fR\fI = \fR\fI\FCtemplate_share\F[]\fR\fI \fR 9638 10324 .RE 9639 10325 … … 9648 10334 .sp 9649 10335 Default: 9650 \fI\fIuse sendfile\fR\fR\fI = \fR\fI false\fR\fI \fR10336 \fI\fIuse sendfile\fR\fR\fI = \fR\fI\FCfalse\F[]\fR\fI \fR 9651 10337 .RE 9652 10338 … … 9660 10346 .sp 9661 10347 Default: 9662 \fI\fIuse spnego\fR\fR\fI = \fR\fI yes\fR\fI \fR10348 \fI\fIuse spnego\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 9663 10349 .RE 9664 10350 … … 9668 10354 .RS 4 9669 10355 This parameter is only available if Samba has been configured and compiled with the option 9670 \ -\-with\-utmp\&. It specifies a directory pathname that is used to store the utmp or utmpx files (depending on the UNIX system) that record user connections to a Samba server\&. By default this is not set, meaning the system will use whatever utmp file the native system is set to use (usually9671 /var/run/utmp 10356 \FC \-\-with\-utmp\F[]\&. It specifies a directory pathname that is used to store the utmp or utmpx files (depending on the UNIX system) that record user connections to a Samba server\&. By default this is not set, meaning the system will use whatever utmp file the native system is set to use (usually 10357 \FC/var/run/utmp\F[] 9672 10358 on Linux)\&. 9673 10359 .sp 9674 10360 Default: 9675 \fI\fIutmp directory\fR\fR\fI = \fR\fI # Determined automatically\fR\fI \fR9676 .sp 9677 Example: 9678 \fI\fIutmp directory\fR\fR\fI = \fR\fI /var/run/utmp\fR\fI \fR10361 \fI\fIutmp directory\fR\fR\fI = \fR\fI\FC # Determined automatically\F[]\fR\fI \fR 10362 .sp 10363 Example: 10364 \fI\fIutmp directory\fR\fR\fI = \fR\fI\FC/var/run/utmp\F[]\fR\fI \fR 9679 10365 .RE 9680 10366 … … 9684 10370 .RS 4 9685 10371 This boolean parameter is only available if Samba has been configured and compiled with the option 9686 \ -\-with\-utmp\&. If set to10372 \FC\-\-with\-utmp\F[]\&. If set to 9687 10373 \fByes\fR 9688 10374 then Samba will attempt to add utmp or utmpx records (depending on the UNIX system) whenever a connection is made to a Samba server\&. Sites may use this to record the user connecting to a Samba share\&. … … 9691 10377 .sp 9692 10378 Default: 9693 \fI\fIutmp\fR\fR\fI = \fR\fI no\fR\fI \fR10379 \fI\fIutmp\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 9694 10380 .RE 9695 10381 … … 9710 10396 .sp 9711 10397 Default: 9712 \fI\fIvalid users\fR\fR\fI = \fR\fI # No valid users list (anyone can login)\fR\fI \fR9713 .sp 9714 Example: 9715 \fI\fIvalid users\fR\fR\fI = \fR\fI greg, @pcusers\fR\fI \fR10398 \fI\fIvalid users\fR\fR\fI = \fR\fI\FC # No valid users list (anyone can login) \F[]\fR\fI \fR 10399 .sp 10400 Example: 10401 \fI\fIvalid users\fR\fR\fI = \fR\fI\FCgreg, @pcusers\F[]\fR\fI \fR 9716 10402 .RE 9717 10403 … … 9725 10411 .sp 9726 10412 Default: 9727 \fI\fI\-valid\fR\fR\fI = \fR\fI yes\fR\fI \fR10413 \fI\fI\-valid\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 9728 10414 .RE 9729 10415 … … 9756 10442 .RS 4 9757 10443 .\} 10444 .fam C 10445 .ps -1 9758 10446 .nf 10447 .if t \{\ 10448 .sp -1 10449 .\} 10450 .BB lightgray adjust-for-leading-newline 10451 .sp -1 10452 9759 10453 ; Veto any files containing the word Security, 9760 10454 ; any ending in \&.tmp, and any directory containing the … … 9765 10459 ; creates\&. 9766 10460 veto files = /\&.AppleDouble/\&.bin/\&.AppleDesktop/Network Trash Folder/ 10461 .EB lightgray adjust-for-leading-newline 10462 .if t \{\ 10463 .sp 1 10464 .\} 9767 10465 .fi 10466 .fam 10467 .ps +1 9768 10468 .if n \{\ 9769 10469 .RE … … 9771 10471 .sp 9772 10472 Default: 9773 \fI\fIveto files\fR\fR\fI = \fR\fI No files or directories are vetoed\&.\fR\fI \fR10473 \fI\fIveto files\fR\fR\fI = \fR\fI\FCNo files or directories are vetoed\&.\F[]\fR\fI \fR 9774 10474 .RE 9775 10475 … … 9785 10485 .sp 9786 10486 You might want to do this on files that you know will be heavily contended for by clients\&. A good example of this is in the NetBench SMB benchmark program, which causes heavy client contention for files ending in 9787 \ &.SEM\&. To cause Samba not to grant oplocks on these files you would use the line (either in the [global] section or in the section for the particular NetBench share\&.10487 \FC\&.SEM\F[]\&. To cause Samba not to grant oplocks on these files you would use the line (either in the [global] section or in the section for the particular NetBench share\&. 9788 10488 .sp 9789 10489 An example of use is: … … 9792 10492 .RS 4 9793 10493 .\} 10494 .fam C 10495 .ps -1 9794 10496 .nf 10497 .if t \{\ 10498 .sp -1 10499 .\} 10500 .BB lightgray adjust-for-leading-newline 10501 .sp -1 10502 9795 10503 veto oplock files = /\&.*SEM/ 10504 .EB lightgray adjust-for-leading-newline 10505 .if t \{\ 10506 .sp 1 10507 .\} 9796 10508 .fi 10509 .fam 10510 .ps +1 9797 10511 .if n \{\ 9798 10512 .RE … … 9800 10514 .sp 9801 10515 Default: 9802 \fI\fIveto oplock files\fR\fR\fI = \fR\fI # No files are vetoed for oplock grants\fR\fI \fR10516 \fI\fIveto oplock files\fR\fR\fI = \fR\fI\FC # No files are vetoed for oplock grants\F[]\fR\fI \fR 9803 10517 .RE 9804 10518 … … 9818 10532 .sp 9819 10533 Default: 9820 \fI\fIvfs objects\fR\fR\fI = \fR\fI\ fR\fI \fR9821 .sp 9822 Example: 9823 \fI\fIvfs objects\fR\fR\fI = \fR\fI extd_audit recycle\fR\fI \fR10534 \fI\fIvfs objects\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 10535 .sp 10536 Example: 10537 \fI\fIvfs objects\fR\fR\fI = \fR\fI\FCextd_audit recycle\F[]\fR\fI \fR 9824 10538 .RE 9825 10539 … … 9831 10545 .sp 9832 10546 Default: 9833 \fI\fIvolume\fR\fR\fI = \fR\fI # the name of the share\fR\fI \fR10547 \fI\fIvolume\fR\fR\fI = \fR\fI\FC # the name of the share\F[]\fR\fI \fR 9834 10548 .RE 9835 10549 … … 9840 10554 This parameter controls whether or not links in the UNIX file system may be followed by the server\&. Links that point to areas within the directory tree exported by the server are always allowed; this parameter controls access only to areas that are outside the directory tree being exported\&. 9841 10555 .sp 9842 Note that setting this parameter can have a negative effect on your server performance due to the extra system calls that Samba has to do in order to perform the link checks\&. 9843 .sp 9844 Default: 9845 \fI\fIwide links\fR\fR\fI = \fR\fIyes\fR\fI \fR 10556 Note: Turning this parameter on when UNIX extensions are enabled will allow UNIX clients to create symbolic links on the share that can point to files or directories outside restricted path exported by the share definition\&. This can cause access to areas outside of the share\&. Due to this problem, this parameter will be automatically disabled (with a message in the log file) if the 10557 \m[blue]\fBunix extensions\fR\m[] 10558 option is on\&. 10559 .sp 10560 Default: 10561 \fI\fIwide links\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 9846 10562 .RE 9847 10563 … … 9859 10575 .sp 9860 10576 Default: 9861 \fI\fIwinbind cache time\fR\fR\fI = \fR\fI 300\fR\fI \fR10577 \fI\fIwinbind cache time\fR\fR\fI = \fR\fI\FC300\F[]\fR\fI \fR 9862 10578 .RE 9863 10579 … … 9869 10585 \fBwinbindd\fR(8) 9870 10586 it may be necessary to suppress the enumeration of groups through the 9871 setgrent(),9872 getgrent() 10587 \FCsetgrent()\F[], 10588 \FCgetgrent()\F[] 9873 10589 and 9874 endgrent() 10590 \FCendgrent()\F[] 9875 10591 group of system calls\&. If the 9876 10592 \fIwinbind enum groups\fR 9877 10593 parameter is 9878 10594 \fBno\fR, calls to the 9879 getgrent() 10595 \FCgetgrent()\F[] 9880 10596 system call will not return any data\&. 9881 10597 .if n \{\ … … 9883 10599 .\} 9884 10600 .RS 4 10601 .BM yellow 9885 10602 .it 1 an-trap 9886 10603 .nr an-no-space-flag 1 … … 9893 10610 Turning off group enumeration may cause some programs to behave oddly\&. 9894 10611 .sp .5v 9895 .RE 9896 Default: 9897 \fI\fIwinbind enum groups\fR\fR\fI = \fR\fIno\fR\fI \fR 10612 .EM yellow 10613 .RE 10614 Default: 10615 \fI\fIwinbind enum groups\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 9898 10616 .RE 9899 10617 … … 9905 10623 \fBwinbindd\fR(8) 9906 10624 it may be necessary to suppress the enumeration of users through the 9907 setpwent(),9908 getpwent() 10625 \FCsetpwent()\F[], 10626 \FCgetpwent()\F[] 9909 10627 and 9910 endpwent() 10628 \FCendpwent()\F[] 9911 10629 group of system calls\&. If the 9912 10630 \fIwinbind enum users\fR 9913 10631 parameter is 9914 10632 \fBno\fR, calls to the 9915 getpwent 10633 \FCgetpwent\F[] 9916 10634 system call will not return any data\&. 9917 10635 .if n \{\ … … 9919 10637 .\} 9920 10638 .RS 4 10639 .BM yellow 9921 10640 .it 1 an-trap 9922 10641 .nr an-no-space-flag 1 … … 9929 10648 Turning off user enumeration may cause some programs to behave oddly\&. For example, the finger program relies on having access to the full user list when searching for matching usernames\&. 9930 10649 .sp .5v 9931 .RE 9932 Default: 9933 \fI\fIwinbind enum users\fR\fR\fI = \fR\fIno\fR\fI \fR 10650 .EM yellow 10651 .RE 10652 Default: 10653 \fI\fIwinbind enum users\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 9934 10654 .RE 9935 10655 … … 9945 10665 .sp 9946 10666 Default: 9947 \fI\fIwinbind expand groups\fR\fR\fI = \fR\fI 1\fR\fI \fR10667 \fI\fIwinbind expand groups\fR\fR\fI = \fR\fI\FC1\F[]\fR\fI \fR 9948 10668 .RE 9949 10669 … … 9955 10675 .sp 9956 10676 Default: 9957 \fI\fIwinbind nested groups\fR\fR\fI = \fR\fI yes\fR\fI \fR10677 \fI\fIwinbind nested groups\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 9958 10678 .RE 9959 10679 … … 9964 10684 This parameter controls whether winbindd will replace whitespace in user and group names with an underscore (_) character\&. For example, whether the name "Space Kadet" should be replaced with the string "space_kadet"\&. Frequently Unix shell scripts will have difficulty with usernames contains whitespace due to the default field separator in the shell\&. If your domain possesses names containing the underscore character, this option may cause problems unless the name aliasing feature is supported by your nss_info plugin\&. 9965 10685 .sp 9966 This feature also enables the name aliasing API which can be used to make domain user and group names to a non\-qualified version\&. Please refer to the manpage for the configured idmap and nss_info plugin for the specifics on how to configure name aliasing for a specific configuration\&. Name aliasing takes prece ndence (and is mutually exclusive) over the whitespace replacement mechanism discussed previsouly\&.9967 .sp 9968 Default: 9969 \fI\fIwinbind normalize names\fR\fR\fI = \fR\fI no\fR\fI \fR9970 .sp 9971 Example: 9972 \fI\fIwinbind normalize names\fR\fR\fI = \fR\fI yes\fR\fI \fR10686 This feature also enables the name aliasing API which can be used to make domain user and group names to a non\-qualified version\&. Please refer to the manpage for the configured idmap and nss_info plugin for the specifics on how to configure name aliasing for a specific configuration\&. Name aliasing takes precedence (and is mutually exclusive) over the whitespace replacement mechanism discussed previsouly\&. 10687 .sp 10688 Default: 10689 \fI\fIwinbind normalize names\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 10690 .sp 10691 Example: 10692 \fI\fIwinbind normalize names\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 9973 10693 .RE 9974 10694 … … 10012 10732 .sp 10013 10733 Default: 10014 \fI\fIwinbind nss info\fR\fR\fI = \fR\fI template\fR\fI \fR10015 .sp 10016 Example: 10017 \fI\fIwinbind nss info\fR\fR\fI = \fR\fI template sfu\fR\fI \fR10734 \fI\fIwinbind nss info\fR\fR\fI = \fR\fI\FCtemplate\F[]\fR\fI \fR 10735 .sp 10736 Example: 10737 \fI\fIwinbind nss info\fR\fR\fI = \fR\fI\FCtemplate sfu\F[]\fR\fI \fR 10018 10738 .RE 10019 10739 … … 10027 10747 .sp 10028 10748 Default: 10029 \fI\fIwinbind offline logon\fR\fR\fI = \fR\fI false\fR\fI \fR10030 .sp 10031 Example: 10032 \fI\fIwinbind offline logon\fR\fR\fI = \fR\fI true\fR\fI \fR10749 \fI\fIwinbind offline logon\fR\fR\fI = \fR\fI\FCfalse\F[]\fR\fI \fR 10750 .sp 10751 Example: 10752 \fI\fIwinbind offline logon\fR\fR\fI = \fR\fI\FCtrue\F[]\fR\fI \fR 10033 10753 .RE 10034 10754 … … 10042 10762 .sp 10043 10763 Default: 10044 \fI\fIwinbind reconnect delay\fR\fR\fI = \fR\fI 30\fR\fI \fR10764 \fI\fIwinbind reconnect delay\fR\fR\fI = \fR\fI\FC30\F[]\fR\fI \fR 10045 10765 .RE 10046 10766 … … 10054 10774 .sp 10055 10775 Default: 10056 \fI\fIwinbind refresh tickets\fR\fR\fI = \fR\fI false\fR\fI \fR10057 .sp 10058 Example: 10059 \fI\fIwinbind refresh tickets\fR\fR\fI = \fR\fI true\fR\fI \fR10776 \fI\fIwinbind refresh tickets\fR\fR\fI = \fR\fI\FCfalse\F[]\fR\fI \fR 10777 .sp 10778 Example: 10779 \fI\fIwinbind refresh tickets\fR\fR\fI = \fR\fI\FCtrue\F[]\fR\fI \fR 10060 10780 .RE 10061 10781 … … 10065 10785 .RS 4 10066 10786 Setting this parameter to 10067 yes 10787 \FCyes\F[] 10068 10788 forces winbindd to use RPC instead of LDAP to retrieve information from Domain Controllers\&. 10069 10789 .sp 10070 10790 Default: 10071 \fI\fIwinbind rpc only\fR\fR\fI = \fR\fI no\fR\fI \fR10791 \fI\fIwinbind rpc only\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 10072 10792 .RE 10073 10793 … … 10078 10798 This parameter allows an admin to define the character used when listing a username of the form of 10079 10799 \fIDOMAIN \fR\e\fIuser\fR\&. This parameter is only applicable when using the 10080 pam_winbind\&.so 10800 \FCpam_winbind\&.so\F[] 10081 10801 and 10082 nss_winbind\&.so 10802 \FCnss_winbind\&.so\F[] 10083 10803 modules for UNIX services\&. 10084 10804 .sp … … 10086 10806 .sp 10087 10807 Default: 10088 \fI\fIwinbind separator\fR\fR\fI = \fR\fI\ '\e\'\fR\fI \fR10089 .sp 10090 Example: 10091 \fI\fIwinbind separator\fR\fR\fI = \fR\fI +\fR\fI \fR10808 \fI\fIwinbind separator\fR\fR\fI = \fR\fI\FC\'\e\'\F[]\fR\fI \fR 10809 .sp 10810 Example: 10811 \fI\fIwinbind separator\fR\fR\fI = \fR\fI\FC+\F[]\fR\fI \fR 10092 10812 .RE 10093 10813 … … 10097 10817 .RS 4 10098 10818 This parameter is designed to allow Samba servers that are members of a Samba controlled domain to use UNIX accounts distributed via NIS, rsync, or LDAP as the uid\'s for winbindd users in the hosts primary domain\&. Therefore, the user 10099 DOMAIN\euser1 10819 \FCDOMAIN\euser1\F[] 10100 10820 would be mapped to the account user1 in /etc/passwd instead of allocating a new uid for him or her\&. 10101 10821 .sp … … 10105 10825 .sp 10106 10826 Default: 10107 \fI\fIwinbind trusted domains only\fR\fR\fI = \fR\fI no\fR\fI \fR10827 \fI\fIwinbind trusted domains only\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 10108 10828 .RE 10109 10829 … … 10117 10837 .sp 10118 10838 Default: 10119 \fI\fIwinbind use default domain\fR\fR\fI = \fR\fI no\fR\fI \fR10120 .sp 10121 Example: 10122 \fI\fIwinbind use default domain\fR\fR\fI = \fR\fI yes\fR\fI \fR10839 \fI\fIwinbind use default domain\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 10840 .sp 10841 Example: 10842 \fI\fIwinbind use default domain\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 10123 10843 .RE 10124 10844 … … 10131 10851 The wins hook parameter specifies the name of a script or executable that will be called as follows: 10132 10852 .sp 10133 wins_hook operation name nametype ttl IP_list 10853 \FCwins_hook operation name nametype ttl IP_list\F[] 10134 10854 .sp 10135 10855 .RS 4 … … 10189 10909 .RE 10190 10910 An example script that calls the BIND dynamic DNS update program 10191 nsupdate 10911 \FCnsupdate\F[] 10192 10912 is provided in the examples directory of the Samba source code\&. 10193 10913 .sp … … 10206 10926 .sp 10207 10927 Default: 10208 \fI\fIwins proxy\fR\fR\fI = \fR\fI no\fR\fI \fR10928 \fI\fIwins proxy\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 10209 10929 .RE 10210 10930 … … 10224 10944 .\} 10225 10945 .RS 4 10946 .BM yellow 10226 10947 .it 1 an-trap 10227 10948 .nr an-no-space-flag 1 … … 10234 10955 You need to set up Samba to point to a WINS server if you have multiple subnets and wish cross\-subnet browsing to work correctly\&. 10235 10956 .sp .5v 10957 .EM yellow 10236 10958 .RE 10237 10959 See the chapter in the Samba3\-HOWTO on Network Browsing\&. 10238 10960 .sp 10239 10961 Default: 10240 \fI\fIwins server\fR\fR\fI = \fR\fI\ fR\fI \fR10241 .sp 10242 Example: 10243 \fI\fIwins server\fR\fR\fI = \fR\fI mary:192\&.9\&.200\&.1 fred:192\&.168\&.3\&.199 mary:192\&.168\&.2\&.61 # For this example when querying a certain name, 192\&.19\&.200\&.1 will be asked first and if that doesn\'t respond 192\&.168\&.2\&.61\&. If either of those doesn\'t know the name 192\&.168\&.3\&.199 will be queried\&.\fR\fI \fR10244 .sp 10245 Example: 10246 \fI\fIwins server\fR\fR\fI = \fR\fI 192\&.9\&.200\&.1 192\&.168\&.2\&.61\fR\fI \fR10962 \fI\fIwins server\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 10963 .sp 10964 Example: 10965 \fI\fIwins server\fR\fR\fI = \fR\fI\FCmary:192\&.9\&.200\&.1 fred:192\&.168\&.3\&.199 mary:192\&.168\&.2\&.61 # For this example when querying a certain name, 192\&.19\&.200\&.1 will be asked first and if that doesn\'t respond 192\&.168\&.2\&.61\&. If either of those doesn\'t know the name 192\&.168\&.3\&.199 will be queried\&.\F[]\fR\fI \fR 10966 .sp 10967 Example: 10968 \fI\fIwins server\fR\fR\fI = \fR\fI\FC192\&.9\&.200\&.1 192\&.168\&.2\&.61\F[]\fR\fI \fR 10247 10969 .RE 10248 10970 … … 10256 10978 \fByes\fR 10257 10979 unless you have a multi\-subnetted network and you wish a particular 10258 nmbd 10980 \FCnmbd\F[] 10259 10981 to be your WINS server\&. Note that you should 10260 10982 \fINEVER\fR … … 10264 10986 .sp 10265 10987 Default: 10266 \fI\fIwins support\fR\fR\fI = \fR\fI no\fR\fI \fR10988 \fI\fIwins support\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 10267 10989 .RE 10268 10990 … … 10276 10998 .sp 10277 10999 Default: 10278 \fI\fIworkgroup\fR\fR\fI = \fR\fI WORKGROUP\fR\fI \fR10279 .sp 10280 Example: 10281 \fI\fIworkgroup\fR\fR\fI = \fR\fI MYGROUP\fR\fI \fR11000 \fI\fIworkgroup\fR\fR\fI = \fR\fI\FCWORKGROUP\F[]\fR\fI \fR 11001 .sp 11002 Example: 11003 \fI\fIworkgroup\fR\fR\fI = \fR\fI\FCMYGROUP\F[]\fR\fI \fR 10282 11004 .RE 10283 11005 … … 10298 11020 .sp 10299 11021 Default: 10300 \fI\fIwriteable\fR\fR\fI = \fR\fI no\fR\fI \fR11022 \fI\fIwriteable\fR\fR\fI = \fR\fI\FCno\F[]\fR\fI \fR 10301 11023 .RE 10302 11024 … … 10314 11036 .sp 10315 11037 Default: 10316 \fI\fIwrite cache size\fR\fR\fI = \fR\fI 0\fR\fI \fR10317 .sp 10318 Example: 10319 \fI\fIwrite cache size\fR\fR\fI = \fR\fI 262144 # for a 256k cache size per file\fR\fI \fR11038 \fI\fIwrite cache size\fR\fR\fI = \fR\fI\FC0\F[]\fR\fI \fR 11039 .sp 11040 Example: 11041 \fI\fIwrite cache size\fR\fR\fI = \fR\fI\FC262144 # for a 256k cache size per file\F[]\fR\fI \fR 10320 11042 .RE 10321 11043 … … 10335 11057 .sp 10336 11058 Default: 10337 \fI\fIwrite list\fR\fR\fI = \fR\fI\ fR\fI \fR10338 .sp 10339 Example: 10340 \fI\fIwrite list\fR\fR\fI = \fR\fI admin, root, @staff\fR\fI \fR11059 \fI\fIwrite list\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 11060 .sp 11061 Example: 11062 \fI\fIwrite list\fR\fR\fI = \fR\fI\FCadmin, root, @staff\F[]\fR\fI \fR 10341 11063 .RE 10342 11064 … … 10348 11070 .sp 10349 11071 Default: 10350 \fI\fIwrite raw\fR\fR\fI = \fR\fI yes\fR\fI \fR11072 \fI\fIwrite raw\fR\fR\fI = \fR\fI\FCyes\F[]\fR\fI \fR 10351 11073 .RE 10352 11074 … … 10356 11078 .RS 4 10357 11079 This parameter is only available if Samba has been configured and compiled with the option 10358 \ -\-with\-utmp\&. It specifies a directory pathname that is used to store the wtmp or wtmpx files (depending on the UNIX system) that record user connections to a Samba server\&. The difference with the utmp directory is the fact that user info is kept after a user has logged out\&.11080 \FC \-\-with\-utmp\F[]\&. It specifies a directory pathname that is used to store the wtmp or wtmpx files (depending on the UNIX system) that record user connections to a Samba server\&. The difference with the utmp directory is the fact that user info is kept after a user has logged out\&. 10359 11081 .sp 10360 11082 By default this is not set, meaning the system will use whatever utmp file the native system is set to use (usually 10361 /var/run/wtmp 11083 \FC/var/run/wtmp\F[] 10362 11084 on Linux)\&. 10363 11085 .sp 10364 11086 Default: 10365 \fI\fIwtmp directory\fR\fR\fI = \fR\fI\ fR\fI \fR10366 .sp 10367 Example: 10368 \fI\fIwtmp directory\fR\fR\fI = \fR\fI /var/log/wtmp\fR\fI \fR11087 \fI\fIwtmp directory\fR\fR\fI = \fR\fI\FC\F[]\fR\fI \fR 11088 .sp 11089 Example: 11090 \fI\fIwtmp directory\fR\fR\fI = \fR\fI\FC/var/log/wtmp\F[]\fR\fI \fR 10369 11091 .RE 10370 11092 .SH "WARNINGS" … … 10377 11099 .PP 10378 11100 Use of the 10379 [homes]11101 \FC[homes]\F[] 10380 11102 and 10381 [printers]11103 \FC[printers]\F[] 10382 11104 special sections make life for an administrator easy, but the various combinations of default attributes can be tricky\&. Take extreme care when designing these sections\&. In particular, ensure that the permissions on spool directories are correct\&. 10383 11105 .SH "VERSION"
Note:
See TracChangeset
for help on using the changeset viewer.
