Changeset 746 for vendor/current/docs/manpages/smb.conf.5

Timestamp:

Nov 27, 2012, 4:56:06 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated vendor to 3.6.9

File:

• vendor/current/docs/manpages/smb.conf.5 (modified) (14 diffs)

vendor/current/docs/manpages/smb.conf.5

@@ -3 +3 @@
 .\"    Author: [see the "AUTHOR" section]
 .\" Generator: DocBook XSL Stylesheets v1.75.2 <http://docbook.sf.net/>
-.\"      Date: 08/08/2011
+.\"      Date: 10/29/2012
 .\"    Manual: File Formats and Conventions
 .\"    Source: Samba 3.6
 .\"  Language: English
 .\"
-.TH "SMB\&.CONF" "5" "08/08/2011" "Samba 3\&.6" "File Formats and Conventions"
+.TH "SMB\&.CONF" "5" "10/29/2012" "Samba 3\&.6" "File Formats and Conventions"
 .\" -----------------------------------------------------------------
 .\" * set default formatting
@@ -1360 +1360 @@
 Example:
 \fI\fIallocation roundup size\fR\fR\fI = \fR\fI0 # (to disable roundups)\fR\fI \fR
+.RE
+
+allow insecure wide links (G)
+.\" allow insecure wide links
+.PP
+.RS 4
+In normal operation the option
+\m[blue]\fBwide links\fR\m[]
+which allows the server to follow symlinks outside of a share path is automatically disabled when
+\m[blue]\fBunix extensions\fR\m[]
+are enabled on a Samba server\&. This is done for security purposes to prevent UNIX clients creating symlinks to areas of the server file system that the administrator does not wish to export\&.
+.sp
+Setting
+\m[blue]\fBallow insecure wide links\fR\m[]
+to true disables the link between these two parameters, removing this protection and allowing a site to configure the server to follow symlinks (by setting
+\m[blue]\fBwide links\fR\m[]
+to "true") even when
+\m[blue]\fBunix extensions\fR\m[]
+is turned on\&.
+.sp
+If is not recommended to enable this option unless you fully understand the implications of allowing the server to follow symbolic links created by UNIX clients\&. For most normal Samba configurations this would be considered a security hole and setting this parameter is not recommended\&.
+.sp
+This option was added at the request of sites who had deliberately set Samba up in this way and needed to continue supporting this functionality without having to patch the Samba code\&.
+.sp
+Default:
+\fI\fIallow insecure wide links\fR\fR\fI = \fR\fIno\fR\fI \fR
 .RE
 
@@ -1663 +1689 @@
 .sp
 Default:
-\fI\fIcase sensitive\fR\fR\fI = \fR\fIno\fR\fI \fR
+\fI\fIcase sensitive\fR\fR\fI = \fR\fIauto\fR\fI \fR
 .RE
 
@@ -6407 +6433 @@
 This parameter limits the size in memory of any
 \fIstat cache\fR
-being used to speed up case insensitive name mappings\&. It represents the number of kilobyte (1024) units the stat cache can use\&. A value of zero, meaning unlimited, is not advisable due to increased memory useage\&. You should not need to change this parameter\&.
+being used to speed up case insensitive name mappings\&. It represents the number of kilobyte (1024) units the stat cache can use\&. A value of zero, meaning unlimited, is not advisable due to increased memory usage\&. You should not need to change this parameter\&.
 .sp
 Default:
@@ -6756 +6782 @@
 .sp
 Default:
-\fI\fIname resolve order\fR\fR\fI = \fR\fIlmhosts host wins bcast\fR\fI \fR
+\fI\fIname resolve order\fR\fR\fI = \fR\fIlmhosts wins host bcast\fR\fI \fR
 .sp
 Example:
@@ -8031 +8057 @@
 Note that if you have multiple users logging on to a workstation then in order to prevent them from being able to access each others profiles you must remove the "Bypass traverse checking" advanced user right\&. This will prevent access to other users profile directories as the top level profile directory (named after the user) is created by the workstation profile code and has an ACL restricting entry to the directory tree to the owning user\&.
 .sp
+Note that this parameter should be set to yes on dedicated profile shares only\&. On other shares, it might cause incorrect file ownerships\&.
+.sp
 Default:
 \fI\fIprofile acls\fR\fR\fI = \fR\fIno\fR\fI \fR
@@ -8849 +8877 @@
 .PP
 .RS 4
-This controls whether the client is allowed or required to use SMB signing\&. Possible values are
+This controls whether the client is allowed or required to use SMB1 and SMB2 signing\&. Possible values are
 \fIauto\fR,
 \fImandatory\fR
@@ -8855 +8883 @@
 \fIdisabled\fR\&.
 .sp
-When set to auto, SMB signing is offered, but not enforced\&. When set to mandatory, SMB signing is required and if set to disabled, SMB signing is not offered either\&.
+When set to auto, SMB1 signing is offered, but not enforced\&. When set to mandatory, SMB1 signing is required and if set to disabled, SMB signing is not offered either\&.
+.sp
+For the SMB2 protocol, by design, signing cannot be disabled\&. In the case where SMB2 is negotiated, if this parameter is set to
+\fIdisabled\fR, it will be treated as
+\fIauto\fR\&. Setting it to
+\fImandatory\fR
+will still require SMB2 clients to use signing\&.
 .sp
 Default:
@@ -9267 +9301 @@
 .sp
 Default:
-\fI\fIsmb2 max credits\fR\fR\fI = \fR\fI128\fR\fI \fR
+\fI\fIsmb2 max credits\fR\fR\fI = \fR\fI8192\fR\fI \fR
 .RE
 
@@ -9278 +9312 @@
 will return to a client, informing the client of the largest size that may be returned by a single SMB2 read call\&.
 .sp
-The default is 1048576 bytes (1MB), which is the same as a Windows7 SMB2 server\&.
-.sp
-Default:
-\fI\fIsmb2 max read\fR\fR\fI = \fR\fI1048576\fR\fI \fR
+The maximum is 65536 bytes (64KB), which is the same as a Windows Vista SMB2 server\&.
+.sp
+Default:
+\fI\fIsmb2 max read\fR\fR\fI = \fR\fI65536\fR\fI \fR
 .RE
 
@@ -9292 +9326 @@
 will return to a client, informing the client of the largest size of buffer that may be used in querying file meta\-data via QUERY_INFO and related SMB2 calls\&.
 .sp
-The default is 1048576 bytes (1MB), which is the same as a Windows7 SMB2 server\&.
-.sp
-Default:
-\fI\fIsmb2 max trans\fR\fR\fI = \fR\fI1048576\fR\fI \fR
+The maximum is 65536 bytes (64KB), which is the same as a Windows Vista SMB2 server\&.
+.sp
+Default:
+\fI\fIsmb2 max trans\fR\fR\fI = \fR\fI65536\fR\fI \fR
 .RE
 
@@ -9306 +9340 @@
 will return to a client, informing the client of the largest size that may be sent to the server by a single SMB2 write call\&.
 .sp
-The default is 1048576 bytes (1MB), which is the same as a Windows7 SMB2 server\&.
-.sp
-Default:
-\fI\fIsmb2 max write\fR\fR\fI = \fR\fI1048576\fR\fI \fR
+The maximum is 65536 bytes (64KB), which is the same as a Windows Vista SMB2 server\&.
+.sp
+Default:
+\fI\fIsmb2 max write\fR\fR\fI = \fR\fI65536\fR\fI \fR
 .RE
 
@@ -9805 +9839 @@
 parameter will automatically be disabled\&.
 .sp
+See the parameter
+\m[blue]\fBallow insecure wide links\fR\m[]
+if you wish to change this coupling between the two parameters\&.
+.sp
 Default:
 \fI\fIunix extensions\fR\fR\fI = \fR\fIyes\fR\fI \fR
@@ -10399 +10437 @@
 \m[blue]\fBunix extensions\fR\m[]
 option is on\&.
+.sp
+See the parameter
+\m[blue]\fBallow insecure wide links\fR\m[]
+if you wish to change this coupling between the two parameters\&.
 .sp
 Default: