Context Navigation

← Previous Change
Next Change →

smb.conf.5

Timestamp:

Nov 14, 2012, 12:59:34 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to 3.6.0

File:

: 1 edited

vendor/current/docs/manpages/smb.conf.5 (modified) (73 diffs)

Legend:

: Unmodified
: Added
: Removed

vendor/current/docs/manpages/smb.conf.5

-              r618
+              r740
 .\"    Author: [see the "AUTHOR" section]
 .\" Generator: DocBook XSL Stylesheets v1.75.2 <http://docbook.sf.net/>
 .\"      Date: 08/02/2011
+.\"      Date: 08/08/2011
 .\"    Manual: File Formats and Conventions
 .\"    Source: Samba 3.5
+.\"    Source: Samba 3.6
 .\"  Language: English
 .\"
 .TH "SMB\&.CONF" "5" "08/02/2011" "Samba 3\&.5" "File Formats and Conventions"
+.TH "SMB\&.CONF" "5" "08/08/2011" "Samba 3\&.6" "File Formats and Conventions"
 .\" -----------------------------------------------------------------
 .\" * set default formatting
 …
 .\}
 If no path was given, the path is set to the user\'s home directory\&.
+.RE
 .sp
 .RE
 …
 .\}
 If the share does not permit guest access and no username was given, the username is set to the located printer name\&.
+.RE
 .sp
 .RE
 …
 %a
 .RS 4
 The architecture of the remote machine\&. It currently recognizes Samba (\fBSamba\fR), the Linux CIFS file system (\fBCIFSFS\fR), OS/2, (\fBOS2\fR), Windows for Workgroups (\fBWfWg\fR), Windows 9x/ME (\fBWin95\fR), Windows NT (\fBWinNT\fR), Windows 2000 (\fBWin2K\fR), Windows XP (\fBWinXP\fR), Windows XP 64\-bit(\fBWinXP64\fR), Windows 2003 including 2003R2 (\fBWin2K3\fR), and Windows Vista (\fBVista\fR)\&. Anything else will be known as
+The architecture of the remote machine\&. It currently recognizes Samba (\fBSamba\fR), the Linux CIFS file system (\fBCIFSFS\fR), OS/2, (\fBOS2\fR), Mac OS X (\fBOSX\fR), Windows for Workgroups (\fBWfWg\fR), Windows 9x/ME (\fBWin95\fR), Windows NT (\fBWinNT\fR), Windows 2000 (\fBWin2K\fR), Windows XP (\fBWinXP\fR), Windows XP 64\-bit(\fBWinXP64\fR), Windows 2003 including 2003R2 (\fBWin2K3\fR), and Windows Vista (\fBVista\fR)\&. Anything else will be known as
 \fBUNKNOWN\fR\&.
 .RE
 …
 .RS 4
 the IP address of the client machine\&.
+.sp
+Before 3\&.6\&.0 it could contain IPv4 mapped IPv6 addresses, now it only contains IPv4 or IPv6 addresses\&.
 .RE
 .PP
 …
 .RS 4
 the local IP address to which a client connected\&.
+.sp
+Before 3\&.6\&.0 it could contain IPv4 mapped IPv6 addresses, now it only contains IPv4 or IPv6 addresses\&.
 .RE
 .PP
 …
 .RS 4
 controls what the default case is for new filenames (ie\&. files that don\'t currently exist in the filesystem)\&. Default
+\fIlower\fR\&. IMPORTANT NOTE: This option will be used to modify the case of
+\fIlower\fR\&. IMPORTANT NOTE: As part of the optimizations for directories containing large numbers of files, the following special case applies\&. If the options
+\m[blue]\fBcase sensitive = yes\fR\m[],
+\m[blue]\fBpreserve case = No\fR\m[], and
+\m[blue]\fBshort preserve case = No\fR\m[]
+are set, then the case of
 \fIall\fR
+incoming client filenames, not just new filenames if the options
+\m[blue]\fBcase sensitive = yes\fR\m[],
+\m[blue]\fBpreserve case = No\fR\m[],
+\m[blue]\fBshort preserve case = No\fR\m[]
+are set\&. This change is needed as part of the optimisations for directories containing large numbers of files\&.
+incoming client filenames, not just new filenames, will be modified\&. See additional notes below\&.
 .RE
 .PP
 …
 .\}
 \fIdevice URI\fR
+.sp
+.RE
+The deviceURI is in the for of socket://<hostname>[:<portnumber>] or lpd://<hostname>/<queuename>\&.
+.RE
+.sp
+.RE
+The deviceURI is in the format of socket://<hostname>[:<portnumber>] or lpd://<hostname>/<queuename>\&.
 .sp
 Default:
 …
 .\}
 \fIWindows 9x driver location\fR
+.RE
 .sp
 .RE
 …
 \fImax connections\fR
 Number of maximum simultaneous connections to this share\&.
+.RE
 .sp
 .RE
 …
 Example:
 \fI\fIannounce version\fR\fR\fI = \fR\fI2\&.0\fR\fI \fR
+.RE
+async smb echo handler (G)
+.\" async smb echo handler
+.PP
+.RS 4
+This parameter specifies whether Samba should fork the async smb echo handler\&. It can be beneficial if your file system can block syscalls for a very long time\&. In some circumstances, it prolongs the timeout that Windows uses to determine whether a connection is dead\&.
+.sp
+Default:
+\fI\fIasync smb echo handler\fR\fR\fI = \fR\fIno\fR\fI \fR
 .RE
 …
 \fImax connections\fR
 Number of maximum simultaneous connections to this share\&.
+.RE
 .sp
 .RE
 …
 will attempt to authenticate itself to servers using the NTLMv2 encrypted password response\&.
 .sp
 If enabled, only an NTLMv2 and LMv2 response (both much more secure than earlier versions) will be sent\&. Many servers (including NT4 < SP4, Win9x and Samba 2\&.2) are not compatible with NTLMv2\&.
+If enabled, only an NTLMv2 and LMv2 response (both much more secure than earlier versions) will be sent\&. Older servers (including NT4 < SP4, Win9x and Samba 2\&.2) are not compatible with NTLMv2 when not in an NTLMv2 supporting domain
 .sp
 Similarly, if enabled, NTLMv1,
 …
 client lanman auth\&.
 .sp
 Note that some sites (particularly those following \'best practice\' security polices) only allow NTLMv2 responses, and not the weaker LM or NTLM\&.
 .sp
 Default:
 \fI\fIclient ntlmv2 auth\fR\fR\fI = \fR\fIno\fR\fI \fR
+Note that Windows Vista and later versions already use NTLMv2 by default, and some sites (particularly those following \'best practice\' security polices) only allow NTLMv2 responses, and not the weaker LM or NTLM\&.
+.sp
+Default:
+\fI\fIclient ntlmv2 auth\fR\fR\fI = \fR\fIyes\fR\fI \fR
 .RE
 …
 .RE
+ctdb locktime warn threshold (G)
+.\" ctdb locktime warn threshold
+.PP
+.RS 4
+In a cluster environment using Samba and ctdb it is critical that locks on central ctdb\-hosted databases like locking\&.tdb are not held for long\&. With the current Samba architecture it happens that Samba takes a lock and while holding that lock makes file system calls into the shared cluster file system\&. This option makes Samba warn if it detects that it has held locks for the specified number of milliseconds\&. If this happens,
+\fIsmbd\fR
+will emit a debug level 0 message into its logs and potentially into syslog\&. The most likely reason for such a log message is that an operation of the cluster file system Samba exports is taking longer than expected\&. The messages are meant as a debugging aid for potential cluster problems\&.
+.sp
+The default value of 0 disables this logging\&.
+.sp
+Default:
+\fI\fIctdb locktime warn threshold\fR\fR\fI = \fR\fI0\fR\fI \fR
+.RE
 ctdb timeout (G)
 .\" ctdb timeout
 …
 \fIshareName\fR
 \- the name of the existing service\&.
+.RE
 .sp
 .RE
 …
 .PP
 .RS 4
 This parameter controls whether or not smbd will honor privileges assigned to specific SIDs via either
+This deprecated parameter controls whether or not smbd will honor privileges assigned to specific SIDs via either
 net rpc rights
 or one of the Windows user and group manager tools\&. This parameter is enabled by default\&. It can be disabled to prevent members of the Domain Admins group from being able to assign privileges to users or groups which can then result in certain smbd operations running as root that would normally run under the context of the connected user\&.
 …
 .\}
 uid of user or gid of group
+.RE
 .sp
 .RE
 …
 .\}
 \- group default quotas (gid = \-1)
+.RE
 .sp
 .RE
 …
 .\}
 Arg 8(optional) \- the number of bytes in a block(default is 1024)
+.RE
 .sp
 .RE
 …
 \m[blue]\fBguest account\fR\m[]\&.
 .sp
 This paramater nullifies the benifits of setting
+This parameter nullifies the benefits of setting
 \m[blue]\fBrestrict anonymous = 2\fR\m[]
 .sp
 …
 .RE
-idmap alloc backend (G)
-.\" idmap alloc backend
-.PP
-.RS 4
-The idmap alloc backend provides a plugin interface for Winbind to use when allocating Unix uids/gids for Windows SIDs\&. This option refers to the name of the idmap module which will provide the id allocation functionality\&. Please refer to the man page for each idmap plugin to determine whether or not the module implements the allocation feature\&. The most common plugins are the tdb (\fBidmap_tdb\fR(8)) and ldap (\fBidmap_ldap\fR(8)) libraries\&.
-.sp
-This parameter defaults to the value
-\m[blue]\fBidmap backend\fR\m[]
-was set to, so by default winbind will allocate Unix IDs from the default backend\&. You will only need to set this parameter explicitly if you have an external source for Unix IDs, like a central database service somewhere in your company\&.
-.sp
-Also refer to the
-\m[blue]\fBidmap alloc config\fR\m[]
-option\&.
-.sp
-\fINo default\fR
-.sp
-Example:
-\fI\fIidmap alloc backend\fR\fR\fI = \fR\fItdb\fR\fI \fR
-.RE
-idmap alloc config (G)
-.\" idmap alloc config
-.PP
-.RS 4
-The idmap alloc config prefix provides a means of managing settings for the backend defined by the
-\m[blue]\fBidmap alloc backend\fR\m[]
-parameter\&. Refer to the man page for each idmap plugin regarding specific configuration details\&.
-.sp
-\fINo default\fR
-.RE
 idmap backend (G)
 .\" idmap backend
 …
 The idmap backend provides a plugin interface for Winbind to use varying backends to store SID/uid/gid mapping tables\&.
 .sp
+This option specifies the default backend that is used when no special configuration set by
+\m[blue]\fBidmap config\fR\m[]
+matches the specific request\&.
+.sp
+This default backend also specifies the place where winbind\-generated idmap entries will be stored\&. So it is highly recommended that you specify a writable backend like
+\fBidmap_tdb\fR(8)
+or
+\fBidmap_ldap\fR(8)
+as the idmap backend\&. The
+\fBidmap_rid\fR(8)
+and
+\fBidmap_ad\fR(8)
+backends are not writable and thus will generate unexpected results if set as idmap backend\&.
+.sp
+To use the rid and ad backends, please specify them via the
+\m[blue]\fBidmap config\fR\m[]
+parameter, possibly also for the domain your machine is member of, specified by
+\m[blue]\fBworkgroup\fR\m[]\&.
+.sp
+Examples of SID/uid/gid backends include tdb (\fBidmap_tdb\fR(8)), ldap (\fBidmap_ldap\fR(8)), rid (\fBidmap_rid\fR(8)), and ad (\fBidmap_ad\fR(8))\&.
+This option specifies the default backend that is used when no special configuration set, but it is now deprecated in favour of the new spelling
+\m[blue]\fBidmap config * : backend\fR\m[]\&.
 .sp
 Default:
 …
 .PP
 .RS 4
+The idmap config prefix provides a means of managing each trusted domain separately\&. The idmap config prefix should be followed by the name of the domain, a colon, and a setting specific to the chosen backend\&. There are three options available for all domains:
+ID mapping in Samba is the mapping between Windows SIDs and Unix user and group IDs\&. This is performed by Winbindd with a configurable plugin interface\&. Samba\'s ID mapping is configured by options starting with the
+\m[blue]\fBidmap config\fR\m[]
+prefix\&. An idmap option consists of the
+\m[blue]\fBidmap config\fR\m[]
+prefix, followed by a domain name or the asterisk character (*), a colon, and the name of an idmap setting for the chosen domain\&.
+.sp
+The idmap configuration is hence divided into groups, one group for each domain to be configured, and one group with the the asterisk instead of a proper domain name, which speifies the default configuration that is used to catch all domains that do not have an explicit idmap configuration of their own\&.
+.sp
+There are three general options available:
 .PP
 backend = backend_name
 .RS 4
+Specifies the name of the idmap plugin to use as the SID/uid/gid backend for this domain\&.
+This specifies the name of the idmap plugin to use as the SID/uid/gid backend for this domain\&. The standard backends are tdb (\fBidmap_tdb\fR(8)), tdb2 (\fBidmap_tdb2\fR(8)), ldap (\fBidmap_ldap\fR(8)), , rid (\fBidmap_rid\fR(8)), , hash (\fBidmap_hash\fR(8)), , autorid (\fBidmap_autorid\fR(8)), , ad (\fBidmap_ad\fR(8)), , adex (\fBidmap_adex\fR(8)), , and nss\&. (\fBidmap_nss\fR(8)), The corresponding manual pages contain the details, but here is a summary\&.
+.sp
+The first three of these create mappings of their own using internal unixid counters and store the mappings in a database\&. These are suitable for use in the default idmap configuration\&. The rid and hash backends use a pure algorithmic calculation to determine the unixid for a SID\&. The autorid module is a mixture of the tdb and rid backend\&. It creates ranges for each domain encountered and then uses the rid algorithm for each of these automatically configured domains individually\&. The ad and adex backends both use unix IDs stored in Active Directory via the standard schema extensions\&. The nss backend reverses the standard winbindd setup and gets the unixids via names from nsswitch which can be useful in an ldap setup\&.
 .RE
 .PP
 range = low \- high
 .RS 4
+Defines the available matching uid and gid range for which the backend is authoritative\&. Note that the range commonly matches the allocation range due to the fact that the same backend will store and retrieve SID/uid/gid mapping entries\&.
+.sp
+winbind uses this parameter to find the backend that is authoritative for a unix ID to SID mapping, so it must be set for each individually configured domain, and it must be disjoint from the ranges set via
+\m[blue]\fBidmap uid\fR\m[]
+and
+\m[blue]\fBidmap gid\fR\m[]\&.
+Defines the available matching uid and gid range for which the backend is authoritative\&. For allocating backends, this also defines the start and the end of the range for allocating new unid IDs\&.
+.sp
+winbind uses this parameter to find the backend that is authoritative for a unix ID to SID mapping, so it must be set for each individually configured domain and for the default configuration\&. The configured ranges must be mutually disjoint\&.
+.RE
+.PP
+read only = yes|no
+.RS 4
+This option can be used to turn the writing backends tdb, tdb2, and ldap into read only mode\&. This can be useful e\&.g\&. in cases where a pre\-filled database exists that should not be extended automatically\&.
 .RE
 .sp
 The following example illustrates how to configure the
 \fBidmap_ad\fR(8)
 for the CORP domain and the
+backend for the CORP domain and the
 \fBidmap_tdb\fR(8)
 backend for all other domains\&. This configuration assumes that the admin of CORP assigns unix ids below 1000000 via the SFU extensions, and winbind is supposed to use the next million entries for its own mappings from trusted domains and for local groups for example\&.
 …
 .\}
 .nf
+        idmap backend = tdb
+        idmap uid = 1000000\-1999999
+        idmap gid = 1000000\-1999999
+        idmap config * : backend = tdb
+        idmap config * : range = 1000000\-1999999
         idmap config CORP : backend  = ad
 …
 .PP
 .RS 4
 The idmap gid parameter specifies the range of group ids that are allocated for the purpose of mapping UNX groups to NT group SIDs\&. This range of group ids should have no existing local or NIS groups within it as strange conflicts can occur otherwise\&.
+.sp
+See also the
+\m[blue]\fBidmap backend\fR\m[], and
+The idmap gid parameter specifies the range of group ids for the default idmap configuration\&. It is now deprecated in favour of
+\m[blue]\fBidmap config * : range\fR\m[]\&.
+.sp
+See the
 \m[blue]\fBidmap config\fR\m[]
 options\&.
+option\&.
 .sp
 Default:
 …
 .PP
 .RS 4
+The idmap uid parameter specifies the range of user ids that are allocated for use in mapping UNIX users to NT user SIDs\&. This range of ids should have no existing local or NIS users within it as strange conflicts can occur otherwise\&.
+.sp
+See also the
+\m[blue]\fBidmap backend\fR\m[]
+and
+The idmap uid parameter specifies the range of user ids for the default idmap configuration\&. It is now deprecated in favour of
+\m[blue]\fBidmap config * : range\fR\m[]\&.
+.sp
+See the
 \m[blue]\fBidmap config\fR\m[]
 options\&.
+option\&.
 .sp
 Default:
 …
 .\}
 a broadcast/mask pair\&.
+.RE
 .sp
 .RE
 …
 .\}
 secrets and keytab \- use the secrets\&.tdb first, then the system keytab
+.RE
 .sp
 .RE
 …
 \fIOnly\fR
 = Only update the LDAP password and let the LDAP server do the rest\&.
+.RE
 .sp
 .RE
 …
 \fIstart tls\fR
 = Use the LDAPv3 StartTLS extended operation (RFC2830) for communicating with the directory server\&.
+.RE
 .sp
 .RE
 …
 .\}
 \fIregistry\fR
+.RE
 .sp
 .RE
 …
 .RE
+log writeable files on exit (G)
+.\" log writeable files on exit
+.PP
+.RS 4
+When the network connection between a CIFS client and Samba dies, Samba has no option but to simply shut down the server side of the network connection\&. If this happens, there is a risk of data corruption because the Windows client did not complete all write operations that the Windows application requested\&. Setting this option to "yes" makes smbd log with a level 0 message a list of all files that have been opened for writing when the network connection died\&. Those are the files that are potentially corrupted\&. It is meant as an aid for the administrator to give him a list of files to do consistency checks on\&.
+.sp
+Default:
+\fI\fIlog writeable files on exit\fR\fR\fI = \fR\fIno\fR\fI \fR
+.RE
 lppause command (S)
 .\" lppause command
 …
 .\}
 Files whose UNIX name begins with a dot will be presented as DOS hidden files\&. The mangled name will be created as for other filenames, but with the leading dot removed and "___" as its extension regardless of actual original extension (that\'s three underscores)\&.
+.RE
 .sp
 .RE
 …
 \m[blue]\fBstore dos attributes\fR\m[]
 method\&. This may be useful for exporting mounted CDs\&.
+.RE
 .sp
 .RE
 …
 \fBBad Uid\fR
 \- Is only applicable when Samba is configured in some type of domain mode security (security = {domain|ads}) and means that user logins which are successfully authenticated but which have no valid Unix user account (and smbd is unable to create one) should be mapped to the defined guest account\&. This was the default behavior of Samba 2\&.x releases\&. Note that if a member server is running winbindd, this option should never be required because the nss_winbind library will export the Windows domain users and groups to the underlying OS via the Name Service Switch interface\&.
+.RE
 .sp
 .RE
 …
 .\}
 \fBSMB2\fR: Re\-implementation of the SMB protocol\&. Used by Windows Vista and newer\&. The Samba implementation of SMB2 is currently marked experimental!
+.RE
 .sp
 .RE
 …
 \fI%f\fR
 = who the message is from\&.
+.RE
 .sp
 .RE
 …
 .RE
+multicast dns register (G)
+.\" multicast dns register
+.PP
+.RS 4
+If compiled with proper support for it, Samba will announce itself with multicast DNS services like for example provided by the Avahi daemon\&.
+.sp
+This parameter allows disabling Samba to register itself\&.
+.sp
+Default:
+\fI\fImulticast dns register\fR\fR\fI = \fR\fIyes\fR\fI \fR
+.RE
 name cache timeout (G)
 .\" name cache timeout
 …
 \m[blue]\fBinterfaces\fR\m[]
 parameter\&. This is the least reliable of the name resolution methods as it depends on the target host being on a locally connected subnet\&.
+.RE
 .sp
 .RE
 …
 Example:
 \fI\fIname resolve order\fR\fR\fI = \fR\fIlmhosts bcast host\fR\fI \fR
+.RE
+ncalrpc dir (G)
+.\" ncalrpc dir
+.PP
+.RS 4
+This directory will hold a series of named pipes to allow RPC over inter\-process communication\&.
+.sp
+\&.
+        This will allow Samba and other unix processes to interact over DCE/RPC without using TCP/IP\&. Additionally a sub\-directory \'np\' has restricted permissions, and allows a trusted communication channel between Samba processes
+.sp
+Default:
+\fI\fIncalrpc dir\fR\fR\fI = \fR\fI${prefix}/var/ncalrpc\fR\fI \fR
+.sp
+Example:
+\fI\fIncalrpc dir\fR\fR\fI = \fR\fI/var/run/samba/ncalrpc\fR\fI \fR
 .RE
 …
 .sp
 Multiple servers may also be specified in double\-quotes\&. Whether multiple servers are supported or not and the exact syntax depends on the LDAP library you use\&.
+.RE
 .sp
 .RE
 …
 Some client/server combinations have difficulty with mixed\-case passwords\&. One offending client is Windows for Workgroups, which for some reason forces passwords to upper case when using the LANMAN1 protocol, but leaves them alone when using COREPLUS! Another problem child is the Windows 95/98 family of operating systems\&. These clients upper case clear text passwords even when NT LM 0\&.12 selected by the protocol negotiation request/response\&.
 .sp
 This parameter defines the maximum number of characters that may be upper case in passwords\&.
+This deprecated parameter defines the maximum number of characters that may be upper case in passwords\&.
 .sp
 For example, say the password given was "FRED"\&. If
 …
 security = [ads|domain|server]
 it is possible to get Samba to do all its username/password validation using a specific remote server\&.
-.sp
-This option sets the name or IP address of the password server to use\&. New syntax has been added to support defining the port to use when connecting to the server the case of an ADS realm\&. To define a port other than the default LDAP port of 389, add the port number using a colon after the name or IP address (e\&.g\&. 192\&.168\&.1\&.100:389)\&. If you do not specify a port, Samba will use the standard LDAP port of tcp/389\&. Note that port numbers have no effect on password servers for Windows NT 4\&.0 domains or netbios connections\&.
-.sp
-If parameter is a name, it is looked up using the parameter
-\m[blue]\fBname resolve order\fR\m[]
-and so may resolved by any method and order described in that parameter\&.
-.sp
-The password server must be a machine capable of using the "LM1\&.2X002" or the "NT LM 0\&.12" protocol, and it must be in user level security mode\&.
-.if n \{\
-.sp
-.\}
-.RS 4
-.it 1 an-trap
-.nr an-no-space-flag 1
-.nr an-break-flag 1
-.br
-.ps +1
-\fBNote\fR
-.ps -1
-.br
-Using a password server means your UNIX box (running Samba) is only as secure as your password server\&.
-\fIDO NOT CHOOSE A PASSWORD SERVER THAT YOU DON\'T COMPLETELY TRUST\fR\&.
-.sp .5v
-.RE
-Never point a Samba server at itself for password serving\&. This will cause a loop and could lock up your Samba server!
-.sp
-The name of the password server takes the standard substitutions, but probably the only useful one is
-\fI%m \fR, which means the Samba server will use the incoming client as the password server\&. If you use this then you better trust your clients, and you had better restrict them with hosts allow!
 .sp
 If the
 …
 \fBdomain\fR
 or
+\fBads\fR, then the list of machines in this option must be a list of Primary or Backup Domain controllers for the Domain or the character \'*\', as the Samba server is effectively in that domain, and will use cryptographically authenticated RPC calls to authenticate the user logging on\&. The advantage of using
+security = domain
+is that if you list several hosts in the
+\fBads\fR, then this option
+\fIshould not\fR
+be used, as the default \'*\' indicates to Samba to determine the best DC to contact dynamically, just as all other hosts in an AD domain do\&. This allows the domain to be maintained without modification to the smb\&.conf file\&. The cryptograpic protection on the authenticated RPC calls used to verify passwords ensures that this default is safe\&.
+.sp
+\fIIt is strongly recommended that you use the default of \'*\'\fR, however if in your particular environment you have reason to specify a particular DC list, then the list of machines in this option must be a list of names or IP addresses of Domain controllers for the Domain\&. If you use the default of \'*\', or list several hosts in the
 \fIpassword server\fR
 option then
 …
 will try each in turn till it finds one that responds\&. This is useful in case your primary server goes down\&.
 .sp
-If the
-\fIpassword server\fR
-option is set to the character \'*\', then Samba will attempt to auto\-locate the Primary or Backup Domain controllers to authenticate against by doing a query for the name
-\fBWORKGROUP<1C>\fR
-and then contacting each server returned in the list of IP addresses from the name resolution source\&.
-.sp
 If the list of servers contains both names/IP\'s and the \'*\' character, the list is treated as a list of preferred domain controllers, but an auto lookup of all remaining DC\'s will be added to the list as well\&. Samba will not attempt to optimize this list by locating the closest DC\&.
+.sp
+If parameter is a name, it is looked up using the parameter
+\m[blue]\fBname resolve order\fR\m[]
+and so may resolved by any method and order described in that parameter\&.
 .sp
 If the
 \fIsecurity\fR
 parameter is set to
+\fBserver\fR, then there are different restrictions that
+security = domain
+doesn\'t suffer from:
+\fBserver\fR, these additional restrictions apply:
 .sp
 .RS 4
 …
 .IP \(bu 2.3
 .\}
 If you are using a Windows NT server as your password server then you will have to ensure that your users are able to login from the Samba server, as when in
+You will have to ensure that your users are able to login from the Samba server, as when in
 security = server
+mode the network logon will appear to come from there rather than from the users workstation\&.
+mode the network logon will appear to come from the Samba server rather than from the users workstation\&.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+The client must not select NTLMv2 authentication\&.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+The password server must be a machine capable of using the "LM1\&.2X002" or the "NT LM 0\&.12" protocol, and it must be in user level security mode\&.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+Using a password server means your UNIX box (running Samba) is only as secure as (a host masqurading as) your password server\&.
+\fIDO NOT CHOOSE A PASSWORD SERVER THAT YOU DON\'T COMPLETELY TRUST\fR\&.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+Never point a Samba server at itself for password serving\&. This will cause a loop and could lock up your Samba server!
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+The name of the password server takes the standard substitutions, but probably the only useful one is
+\fI%m \fR, which means the Samba server will use the incoming client as the password server\&. If you use this then you better trust your clients, and you had better restrict them with hosts allow!
+.RE
 .sp
 .RE
 …
 The
 \fBsmbd\fR(8)
 daemon maintains an database of file locks obtained by SMB clients\&. The default behavior is to map this internal database to POSIX locks\&. This means that file locks obtained by SMB clients are consistent with those seen by POSIX compliant applications accessing the files via a non\-SMB method (e\&.g\&. NFS or local file access)\&. You should never need to disable this parameter\&.
+daemon maintains an database of file locks obtained by SMB clients\&. The default behavior is to map this internal database to POSIX locks\&. This means that file locks obtained by SMB clients are consistent with those seen by POSIX compliant applications accessing the files via a non\-SMB method (e\&.g\&. NFS or local file access)\&. It is very unlikely that you need to set this parameter to "no", unless you are sharing from an NFS mount, which is not a good idea in the first place\&.
 .sp
 Default:
 …
 .PP
 .RS 4
 This option specifies the number of seconds before the printing subsystem is again asked for the known printers\&. If the value is greater than 60 the initial waiting time is set to 60 seconds to allow an earlier first rescan of the printing subsystem\&.
+This option specifies the number of seconds before the printing subsystem is again asked for the known printers\&.
 .sp
 Setting this parameter to 0 disables any rescanning for new or removed printers after the initial startup\&.
 …
 .RE
+print notify backchannel (S)
+.\" print notify backchannel
+.PP
+.RS 4
+Windows print clients can update print queue status by expecting the server to open a backchannel SMB connection to them\&. Due to client firewall settings this can cause considerable timeouts and will often fail, as there is no guarantee the client is even running an SMB server\&. By setting this parameter to
+\fBno\fR
+the Samba print server will not try to connect back to clients and treat corresponding requests as if the connection back to the client failed\&. The default setting of
+\fByes\fR
+causes smbd to attempt this connection\&.
+.sp
+Default:
+\fI\fIprint notify backchannel\fR\fR\fI = \fR\fIyes\fR\fI \fR
+.RE
 private dir (G)
 .\" private dir
 …
 .RE
+rpc_server (G)
+.\" rpc_server
+.PP
+.RS 4
+Defines what kind of rpc server to use for a named pipe\&. The rpc_server prefix must be followed by the pipe name, and a value\&.
+.sp
+Three possible values are currently supported:
+embedded
+daemon
+external
+.sp
+The classic method is to run every pipe as an internal function
+\fIembedded\fR
+in smbd\&.
+.sp
+An alternative method is to fork a
+\fIdaemon\fR
+early on at smbd startup time\&. This is supported only for selected pipes\&.
+.sp
+Choosing the
+\fIexternal\fR
+option allows to run a completely independent (3rd party) server capable of interfacing with samba via the MS\-RPC interface over named pipes\&.
+.sp
+Currently only the spoolss pipe can be configured in
+\fIdaemon\fR
+mode like this:
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+        rpc_server:spoolss = daemon
+.fi
+.if n \{\
+.RE
+.\}
+.sp
+Default:
+\fI\fIrpc_server\fR\fR\fI = \fR\fInone\fR\fI \fR
+.RE
 security mask (S)
 .\" security mask
 …
 .sp
 The alternatives are
+security = share,
+security = server
+security = ads
 or
+security = domain\&.
+security = domain, which support joining Samba to a Windows domain, along with
+security = share
+and
+security = server, both of which are deprecated\&.
 .sp
 In versions of Samba prior to 2\&.0\&.0, the default was
 …
 mainly because that was the only option at one stage\&.
 .sp
+There is a bug in WfWg that has relevance to this setting\&. When in user or server level security a WfWg client will totally ignore the username and password you type in the "connect drive" dialog box\&. This makes it very difficult (if not impossible) to connect to a Samba service as anyone except the user that you are logged into WfWg as\&.
+.sp
+If your PCs use usernames that are the same as their usernames on the UNIX machine then you will want to use
+security = user\&. If you mostly use usernames that don\'t exist on the UNIX box then use
+security = share\&.
+.sp
+You should also use
+security = share
+if you want to mainly setup shares without a password (guest shares)\&. This is commonly used for a shared printer server\&. It is more difficult to setup guest shares with
+security = user, see the
+You should use
+security = user
+and
 \m[blue]\fBmap to guest\fR\m[]
 parameter for details\&.
+if you want to mainly setup shares without a password (guest shares)\&. This is commonly used for a shared printer server\&.
 .sp
 It is possible to use
 …
 The different settings will now be explained\&.
 .sp
-\fISECURITY = SHARE\fR
-.sp
-When clients connect to a share level security server, they need not log onto the server with a valid username and password before attempting to connect to a shared resource (although modern clients such as Windows 95/98 and Windows NT will send a logon request with a username but no password when talking to a
-security = share
-server)\&. Instead, the clients send authentication information (passwords) on a per\-share basis, at the time they attempt to connect to that share\&.
-.sp
-Note that
-smbd
-\fIALWAYS\fR
-uses a valid UNIX user to act on behalf of the client, even in
-security = share
-level security\&.
-.sp
-As clients are not required to send a username to the server in share level security,
-smbd
-uses several techniques to determine the correct UNIX user to use on behalf of the client\&.
-.sp
-A list of possible UNIX usernames to match with the given client password is constructed using the following methods :
-.sp
-.RS 4
-.ie n \{\
-\h'-04'\(bu\h'+03'\c
-.\}
-.el \{\
-.sp -1
-.IP \(bu 2.3
-.\}
-If the
-\m[blue]\fBguest only\fR\m[]
-parameter is set, then all the other stages are missed and only the
-\m[blue]\fBguest account\fR\m[]
-username is checked\&.
-.RE
-.sp
-.RS 4
-.ie n \{\
-\h'-04'\(bu\h'+03'\c
-.\}
-.el \{\
-.sp -1
-.IP \(bu 2.3
-.\}
-Is a username is sent with the share connection request, then this username (after mapping \- see
-\m[blue]\fBusername map\fR\m[]), is added as a potential username\&.
-.RE
-.sp
-.RS 4
-.ie n \{\
-\h'-04'\(bu\h'+03'\c
-.\}
-.el \{\
-.sp -1
-.IP \(bu 2.3
-.\}
-If the client did a previous
-\fIlogon \fR
-request (the SessionSetup SMB call) then the username sent in this SMB will be added as a potential username\&.
-.RE
-.sp
-.RS 4
-.ie n \{\
-\h'-04'\(bu\h'+03'\c
-.\}
-.el \{\
-.sp -1
-.IP \(bu 2.3
-.\}
-The name of the service the client requested is added as a potential username\&.
-.RE
-.sp
-.RS 4
-.ie n \{\
-\h'-04'\(bu\h'+03'\c
-.\}
-.el \{\
-.sp -1
-.IP \(bu 2.3
-.\}
-The NetBIOS name of the client is added to the list as a potential username\&.
-.RE
-.sp
-.RS 4
-.ie n \{\
-\h'-04'\(bu\h'+03'\c
-.\}
-.el \{\
-.sp -1
-.IP \(bu 2.3
-.\}
-Any users on the
-\m[blue]\fBuser\fR\m[]
-list are added as potential usernames\&.
-.sp
-.RE
-If the
-\fIguest only\fR
-parameter is not set, then this list is then tried with the supplied password\&. The first user for whom the password matches will be used as the UNIX user\&.
-.sp
-If the
-\fIguest only\fR
-parameter is set, or no username can be determined then if the share is marked as available to the
-\fIguest account\fR, then this guest user will be used, otherwise access is denied\&.
-.sp
-Note that it can be
-\fIvery\fR
-confusing in share\-level security as to which UNIX username will eventually be used in granting access\&.
-.sp
-See also the section
-NOTE ABOUT USERNAME/PASSWORD VALIDATION\&.
-.sp
 \fISECURITY = USER\fR
 .sp
 This is the default security setting in Samba 3\&.0\&. With user\-level security a client must first "log\-on" with a valid username and password (which can be mapped using the
+This is the default security setting in Samba\&. With user\-level security a client must first "log\-on" with a valid username and password (which can be mapped using the
 \m[blue]\fBusername map\fR\m[]
 parameter)\&. Encrypted passwords (see the
 …
 parameter\&.
 .sp
+\fISECURITY = SERVER\fR
+.sp
+In this mode Samba will try to validate the username/password by passing it to another SMB server, such as an NT box\&. If this fails it will revert to
+security = user\&. It expects the
+\m[blue]\fBencrypted passwords\fR\m[]
+parameter to be set to
+\fByes\fR, unless the remote server does not support them\&. However note that if encrypted passwords have been negotiated then Samba cannot revert back to checking the UNIX password file, it must have a valid
+smbpasswd
+file to check users against\&. See the chapter about the User Database in the Samba HOWTO Collection for details on how to set this up\&.
+\fISECURITY = SHARE\fR
 .if n \{\
 .sp
 …
 .ps -1
 .br
+This mode of operation has significant pitfalls since it is more vulnerable to man\-in\-the\-middle attacks and server impersonation\&. In particular, this mode of operation can cause significant resource consuption on the PDC, as it must maintain an active connection for the duration of the user\'s session\&. Furthermore, if this connection is lost, there is no way to reestablish it, and futher authentications to the Samba server may fail (from a single client, till it disconnects)\&.
+This option is deprecated as it is incompatible with SMB2
+.sp .5v
+.RE
+When clients connect to a share level security server, they need not log onto the server with a valid username and password before attempting to connect to a shared resource (although modern clients such as Windows 95/98 and Windows NT will send a logon request with a username but no password when talking to a
+security = share
+server)\&. Instead, the clients send authentication information (passwords) on a per\-share basis, at the time they attempt to connect to that share\&.
+.sp
+Note that
+smbd
+\fIALWAYS\fR
+uses a valid UNIX user to act on behalf of the client, even in
+security = share
+level security\&.
+.sp
+As clients are not required to send a username to the server in share level security,
+smbd
+uses several techniques to determine the correct UNIX user to use on behalf of the client\&.
+.sp
+A list of possible UNIX usernames to match with the given client password is constructed using the following methods :
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+If the
+\m[blue]\fBguest only\fR\m[]
+parameter is set, then all the other stages are missed and only the
+\m[blue]\fBguest account\fR\m[]
+username is checked\&.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+Is a username is sent with the share connection request, then this username (after mapping \- see
+\m[blue]\fBusername map\fR\m[]), is added as a potential username\&.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+If the client did a previous
+\fIlogon \fR
+request (the SessionSetup SMB call) then the username sent in this SMB will be added as a potential username\&.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+The name of the service the client requested is added as a potential username\&.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+The NetBIOS name of the client is added to the list as a potential username\&.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.sp -1
+.IP \(bu 2.3
+.\}
+Any users on the
+\m[blue]\fBuser\fR\m[]
+list are added as potential usernames\&.
+.RE
+.sp
+.RE
+If the
+\fIguest only\fR
+parameter is not set, then this list is then tried with the supplied password\&. The first user for whom the password matches will be used as the UNIX user\&.
+.sp
+If the
+\fIguest only\fR
+parameter is set, or no username can be determined then if the share is marked as available to the
+\fIguest account\fR, then this guest user will be used, otherwise access is denied\&.
+.sp
+Note that it can be
+\fIvery\fR
+confusing in share\-level security as to which UNIX username will eventually be used in granting access\&.
+.sp
+See also the section
+NOTE ABOUT USERNAME/PASSWORD VALIDATION\&.
+.sp
+\fISECURITY = SERVER\fR
+.sp
+In this depicted mode Samba will try to validate the username/password by passing it to another SMB server, such as an NT box\&. If this fails it will revert to
+security = user\&. It expects the
+\m[blue]\fBencrypted passwords\fR\m[]
+parameter to be set to
+\fByes\fR, unless the remote server does not support them\&. However note that if encrypted passwords have been negotiated then Samba cannot revert back to checking the UNIX password file, it must have a valid
+smbpasswd
+file to check users against\&. See the chapter about the User Database in the Samba HOWTO Collection for details on how to set this up\&.
+.if n \{\
+.sp
+.\}
+.RS 4
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.ps +1
+\fBNote\fR
+.ps -1
+.br
+This mode of operation has significant pitfalls since it is more vulnerable to man\-in\-the\-middle attacks and server impersonation\&. In particular, this mode of operation can cause significant resource consumption on the PDC, as it must maintain an active connection for the duration of the user\'s session\&. Furthermore, if this connection is lost, there is no way to reestablish it, and further authentications to the Samba server may fail (from a single client, till it disconnects)\&.
+.sp .5v
+.RE
+.if n \{\
+.sp
+.\}
+.RS 4
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.ps +1
+\fBNote\fR
+.ps -1
+.br
+If the client selects NTLMv2 authentication, then this mode of operation
+\fIwill fail\fR
 .sp .5v
 .RE
 …
 .sp .5v
 .RE
+.if n \{\
+.sp
+.\}
+.RS 4
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.ps +1
+\fBNote\fR
+.ps -1
+.br
+This option is deprecated, and may be removed in future
+.sp .5v
+.RE
 \fINote\fR
 that the name of the resource being requested is
 …
 .RE
+send spnego principal (G)
+.\" send spnego principal
+.PP
+.RS 4
+This parameter determines whether or not
+\fBsmbd\fR(8)
+will send the server\-supplied principal sometimes given in the SPNEGO exchange\&.
+.sp
+If enabled, Samba can attempt to help clients to use Kerberos to contact it, even when known only by IP address or a name not registered with our KDC as a service principal name\&. Kerberos relies on names, so ordinarily cannot function in this situation\&.
+.sp
+If disabled, Samba will send the string not_defined_in_RFC4178@please_ignore as the \'rfc4178 hint\', following the updated RFC and Windows 2008 behaviour in this area\&.
+.sp
+Note that Windows XP SP2 and later versions already ignored this value in all circumstances\&.
+.sp
+Default:
+\fI\fIsend spnego principal\fR\fR\fI = \fR\fIno\fR\fI \fR
+.RE
 server schannel (G)
 .\" server schannel
 …
 .\}
 \- group default quotas (gid = \-1)
+.RE
 .sp
 .RE
 …
 .\}
 (optional) \- block size, defaults to 1024
+.RE
 .sp
 .RE
 …
 will be substituted with the switch
 \fI\-f\fR\&. It means force the shutdown even if applications do not respond for NT\&.
+.RE
 .sp
 .RE
 …
 Example:
 \fI\fIshutdown script\fR\fR\fI = \fR\fI/usr/local/samba/sbin/shutdown %m %t %r %f\fR\fI \fR
+.RE
+smb2 max credits (G)
+.\" smb2 max credits
+.PP
+.RS 4
+This option controls the maximum number of outstanding simultaneous SMB2 operations that Samba tells the client it will allow\&. This is similar to the
+\m[blue]\fBmax mux\fR\m[]
+parameter for SMB1\&. You should never need to set this parameter\&.
+.sp
+The default is 8192 credits, which is the same as a Windows 2008R2 SMB2 server\&.
+.sp
+Default:
+\fI\fIsmb2 max credits\fR\fR\fI = \fR\fI128\fR\fI \fR
+.RE
+smb2 max read (G)
+.\" smb2 max read
+.PP
+.RS 4
+This option specifies the protocol value that
+\fBsmbd\fR(8)
+will return to a client, informing the client of the largest size that may be returned by a single SMB2 read call\&.
+.sp
+The default is 1048576 bytes (1MB), which is the same as a Windows7 SMB2 server\&.
+.sp
+Default:
+\fI\fIsmb2 max read\fR\fR\fI = \fR\fI1048576\fR\fI \fR
+.RE
+smb2 max trans (G)
+.\" smb2 max trans
+.PP
+.RS 4
+This option specifies the protocol value that
+\fBsmbd\fR(8)
+will return to a client, informing the client of the largest size of buffer that may be used in querying file meta\-data via QUERY_INFO and related SMB2 calls\&.
+.sp
+The default is 1048576 bytes (1MB), which is the same as a Windows7 SMB2 server\&.
+.sp
+Default:
+\fI\fIsmb2 max trans\fR\fR\fI = \fR\fI1048576\fR\fI \fR
+.RE
+smb2 max write (G)
+.\" smb2 max write
+.PP
+.RS 4
+This option specifies the protocol value that
+\fBsmbd\fR(8)
+will return to a client, informing the client of the largest size that may be sent to the server by a single SMB2 write call\&.
+.sp
+The default is 1048576 bytes (1MB), which is the same as a Windows7 SMB2 server\&.
+.sp
+Default:
+\fI\fIsmb2 max write\fR\fR\fI = \fR\fI1048576\fR\fI \fR
 .RE
 …
 .\}
 SO_RCVLOWAT *
+.RE
 .sp
 .RE
 …
 This is a boolean that controls the handling of disk space allocation in the server\&. When this is set to
 \fByes\fR
+the server will change from UNIX behaviour of not committing real disk storage blocks when a file is extended to the Windows behaviour of actually forcing the disk system to allocate real storage blocks when a file is created or extended to be a given size\&. In UNIX terminology this means that Samba will stop creating sparse files\&. This can be slow on some systems\&. When you work with large files like >100MB or so you may even run into problems with clients running into timeouts\&.
+the server will change from UNIX behaviour of not committing real disk storage blocks when a file is extended to the Windows behaviour of actually forcing the disk system to allocate real storage blocks when a file is created or extended to be a given size\&. In UNIX terminology this means that Samba will stop creating sparse files\&.
+.sp
+This option is really desgined for file systems that support fast allocation of large numbers of blocks such as extent\-based file systems\&. On file systems that don\'t support extents (most notably ext3) this can make Samba slower\&. When you work with large files over >100MB on file systems without extents you may even run into problems with clients running into timeouts\&.
 .sp
 When you have an extent based filesystem it\'s likely that we can make use of unwritten extents which allows Samba to allocate even large amounts of space very fast and you will not see any timeout problems caused by strict allocate\&. With strict allocate in use you will also get much better out of quota messages in case you use quotas\&. Another advantage of activating this setting is that it will help to reduce file fragmentation\&.
 …
 .PP
 .RS 4
+This parameter is a setting in minutes to add to the normal GMT to local time conversion\&. This is useful if you are serving a lot of PCs that have incorrect daylight saving time handling\&.
+.sp
+This deprecated parameter is a setting in minutes to add to the normal GMT to local time conversion\&. This is useful if you are serving a lot of PCs that have incorrect daylight saving time handling\&.
+.if n \{\
+.sp
+.\}
+.RS 4
+.it 1 an-trap
+.nr an-no-space-flag 1
+.nr an-break-flag 1
+.br
+.ps +1
+\fBNote\fR
+.ps -1
+.br
+This option is deprecated, and will be removed in the next major release
+.sp .5v
+.RE
 Default:
 \fI\fItime offset\fR\fR\fI = \fR\fI0\fR\fI \fR
 …
 .RE
-update encrypted (G)
-.\" update encrypted
-.PP
-.RS 4
-This boolean parameter allows a user logging on with a plaintext password to have their encrypted (hashed) password in the smbpasswd file to be updated automatically as they log on\&. This option allows a site to migrate from plaintext password authentication (users authenticate with plaintext password over the wire, and are checked against a UNIX account database) to encrypted password authentication (the SMB challenge/response authentication mechanism) without forcing all users to re\-enter their passwords via smbpasswd at the time the change is made\&. This is a convenience option to allow the change over to encrypted passwords to be made over a longer period\&. Once all users have encrypted representations of their passwords in the smbpasswd file this parameter should be set to
-\fBno\fR\&.
-.sp
-In order for this parameter to be operative the
-\m[blue]\fBencrypt passwords\fR\m[]
-parameter must be set to
-\fBno\fR\&. The default value of
-\m[blue]\fBencrypt passwords = Yes\fR\m[]\&. Note: This must be set to
-\fBno\fR
-for this
-\m[blue]\fBupdate encrypted\fR\m[]
-to work\&.
-.sp
-Note that even when this parameter is set, a user authenticating to
-smbd
-must still enter a valid password in order to connect correctly, and to update their hashed (smbpasswd) passwords\&.
-.sp
-Default:
-\fI\fIupdate encrypted\fR\fR\fI = \fR\fIno\fR\fI \fR
-.RE
 use client driver (S)
 .\" use client driver
 …
 Example:
 \fI\fIusername level\fR\fR\fI = \fR\fI5\fR\fI \fR
+.RE
+username map cache time (G)
+.\" username map cache time
+.PP
+.RS 4
+Mapping usernames with the
+\m[blue]\fBusername map\fR\m[]
+or
+\m[blue]\fBusername map script\fR\m[]
+features of Samba can be relatively expensive\&. During login of a user, the mapping is done several times\&. In particular, calling the
+\m[blue]\fBusername map script\fR\m[]
+can slow down logins if external databases have to be queried from the script being called\&.
+.sp
+The parameter
+\m[blue]\fBusername map cache time\fR\m[]
+controls a mapping cache\&. It specifies the number of seconds a mapping from the username map file or script is to be efficiently cached\&. The default of 0 means no caching is done\&.
+.sp
+Default:
+\fI\fIusername map cache time\fR\fR\fI = \fR\fI0\fR\fI \fR
+.sp
+Example:
+\fI\fIusername map cache time\fR\fR\fI = \fR\fI60\fR\fI \fR
 .RE
 …
 Multiple users may be specified in a comma\-delimited list, in which case the supplied password will be tested against each username in turn (left to right)\&.
 .sp
 The
+The deprecated
 \fIusername\fR
 line is needed only when the PC is unable to supply its own username\&. This is the case for the COREPLUS protocol or where your users have different WfWg usernames to UNIX usernames\&. In both these cases you may also be better using the \e\eserver\eshare%user syntax instead\&.
 …
 .PP
 .RS 4
 This variable controls controls whether samba will try to use Simple and Protected NEGOciation (as specified by rfc2478) with WindowsXP and Windows2000 clients to agree upon an authentication mechanism\&.
+This deprecated variable controls controls whether samba will try to use Simple and Protected NEGOciation (as specified by rfc2478) with WindowsXP and Windows2000 clients to agree upon an authentication mechanism\&.
 .sp
 Unless further issues are discovered with our SPNEGO implementation, there is no reason this should ever be disabled\&.
 …
 .RE
+winbind max clients (G)
+.\" winbind max clients
+.PP
+.RS 4
+This parameter specifies the maximum number of clients the
+\fBwinbindd\fR(8)
+daemon can connect with\&.
+.sp
+Default:
+\fI\fIwinbind max clients\fR\fR\fI = \fR\fI200\fR\fI \fR
+.RE
+winbind max domain connections (G)
+.\" winbind max domain connections
+.PP
+.RS 4
+This parameter specifies the maximum number of simultaneous connections that the
+\fBwinbindd\fR(8)
+daemon should open to the domain controller of one domain\&. Setting this parameter to a value greater than 1 can improve scalability with many simultaneous winbind requests, some of which might be slow\&.
+.sp
+Note that if
+\m[blue]\fBwinbind offline logon\fR\m[]
+is set to
+\fBYes\fR, then only one DC connection is allowed per domain, regardless of this setting\&.
+.sp
+Default:
+\fI\fIwinbind max domain connections\fR\fR\fI = \fR\fI1\fR\fI \fR
+.sp
+Example:
+\fI\fIwinbind max domain connections\fR\fR\fI = \fR\fI10\fR\fI \fR
+.RE
 winbind nested groups (G)
 .\" winbind nested groups
 …
 \fIidmap config DOMAIN:backend\fR
 = ad as well\&.
+.RE
 .sp
 .RE
 …
 This parameter specifies whether the
 \fBwinbindd\fR(8)
+daemon should operate on users without domain component in their username\&. Users without a domain component are treated as is part of the winbindd server\'s own domain\&. While this does not benifit Windows users, it makes SSH, FTP and e\-mail function in a way much closer to the way they would in a native unix system\&.
+daemon should operate on users without domain component in their username\&. Users without a domain component are treated as is part of the winbindd server\'s own domain\&. While this does not benefit Windows users, it makes SSH, FTP and e\-mail function in a way much closer to the way they would in a native unix system\&.
+.sp
+This option should be avoided if possible\&. It can cause confusion about responsibilities for a user or group\&. In many situations it is not clear whether winbind or /etc/passwd should be seen as authoritative for a user, likewise for groups\&.
 .sp
 Default:
 …
 .\}
 The fifth and subsequent arguments are the IP addresses currently registered for that name\&. If this list is empty then the name should be deleted\&.
+.RE
 .sp
 .RE

Note: See TracChangeset for help on using the changeset viewer.

Context Navigation

Changeset 740 for vendor/current/docs/manpages/smb.conf.5

Legend:

vendor/current/docs/manpages/smb.conf.5

Download in other formats: