Ignore:
Timestamp:
Nov 24, 2016, 1:14:11 PM (9 years ago)
Author:
Silvan Scherrer
Message:

Samba Server: update vendor to version 4.4.3

Location:
vendor/current/docs-xml/smbdotconf/security
Files:
15 added
3 deleted
74 edited

Legend:

Unmodified
Added
Removed

  • vendor/current/docs-xml/smbdotconf/security/accessbasedshareenum.xml

    r414 r988  
    11<samba:parameter name="access based share enum"
    2                 type="boolean"
     2                type="boolean"
    33                 context="S"
    4                  basic="1" advanced="1" developer="1"
    5                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     4                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65 <description>
    76     <para>If this parameter is <constant>yes</constant> for a
    87    service, then the share hosted by the service will only be visible
    98    to users who have read or write access to the share during share
    10     enumeration (for example net view \\sambaserver).  This has
     9    enumeration (for example net view \\sambaserver). The share ACLs
     10    which allow or deny the access to the share can be modified using
     11    for example the <command moreinfo="none">sharesec</command> command
     12    or using the appropriate Windows tools. This has
    1113    parallels to access based enumeration, the main difference being
    1214    that only share permissions are evaluated, and security

  • vendor/current/docs-xml/smbdotconf/security/aclgroupcontrol.xml

    r414 r988  
    11<samba:parameter name="acl group control"
    22                 context="S"
    3                 type="boolean"
     3                type="boolean"
    44                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    55<description>
    … …  
    1515        on a point in the filesystem to the group owner of a directory and anything below it also owned
    1616        by that group. This means there are multiple people with permissions to modify ACLs on a file
    17         or directory, easing managability.
     17        or directory, easing manageability.
    1818        </para>
    1919        <para>
    … …  
    2525        <para>
    2626        This parameter is best used with the <smbconfoption name="inherit owner"/> option and also
    27         on on a share containing directories with the UNIX <emphasis>setgid bit</emphasis> set
     27        on a share containing directories with the UNIX <emphasis>setgid bit</emphasis> set
    2828        on them, which causes new files and directories created within it to inherit the group
    2929        ownership from the containing directory.
    … …  
    3131
    3232        <para>
    33         This is parameter has been was deprecated in Samba 3.0.23, but re-activated in
     33        This parameter was deprecated in Samba 3.0.23, but re-activated in
    3434        Samba 3.0.31 and above, as it now only controls permission changes if the user
    3535        is in the owning primary group. It is now no longer equivalent to the

  • vendor/current/docs-xml/smbdotconf/security/adminusers.xml

    r414 r988  
    11<samba:parameter name="admin users"
    22                 context="S"
    3                                  type="list"
     3                 type="cmdlist"
    44                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    55<description>
    … …  
    1212    irrespective of file permissions.</para>
    1313
    14     <para>This parameter will not work with the <smbconfoption name="security">share</smbconfoption> in
    15     Samba 3.0.  This is by design.</para>
    16 
    1714</description>
    1815

  • vendor/current/docs-xml/smbdotconf/security/algorithmicridbase.xml

    r414 r988  
    11<samba:parameter name="algorithmic rid base"
    22                 context="G"
    3                  advanced="1" developer="1"
    4                                  type="integer"
    5                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     3                 type="integer"
     4                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>
    76    <para>This determines how Samba will use its
    … …  
    1211    <para>Setting this option to a larger value could be useful to sites
    1312    transitioning from WinNT and Win2k, as existing user and
    14     group rids would otherwise clash with sytem users etc.
     13    group rids would otherwise clash with system users etc.
    1514    </para>
    1615

  • vendor/current/docs-xml/smbdotconf/security/allowdcerpcauthlevelconnect.xml

    r919 r988  
    88        but no per message integrity nor privacy protection.</para>
    99
    10         <para>The behavior can be controlled per interface name (e.g. lsarpc, netlogon, samr, srvsvc,
    11         winreg, wkssvc ...) by using 'allow dcerpc auth level connect:interface = no' as option.</para>
     10        <para>Some interfaces like samr, lsarpc and netlogon have a hard-coded default of
     11        <constant>no</constant> and epmapper, mgmt and rpcecho have a hard-coded default of
     12        <constant>yes</constant>.
     13        </para>
    1214
    13         <para>This option yields precedence to the implentation specific restrictions.
     15        <para>The behavior can be overwritten per interface name (e.g. lsarpc, netlogon, samr, srvsvc,
     16        winreg, wkssvc ...) by using 'allow dcerpc auth level connect:interface = yes' as option.</para>
     17
     18        <para>This option yields precedence to the implementation specific restrictions.
    1419        E.g. the drsuapi and backupkey protocols require DCERPC_AUTH_LEVEL_PRIVACY.
    15         While others like samr and lsarpc have a hardcoded default of <constant>no</constant>.
     20        The dnsserver protocol requires DCERPC_AUTH_LEVEL_INTEGRITY.
    1621        </para>
    1722</description>

  • vendor/current/docs-xml/smbdotconf/security/allowtrusteddomains.xml

    r414 r988  
    11<samba:parameter name="allow trusted domains"
    22                 context="G"
    3                                  type="boolean"
    4                  advanced="1" developer="1"
    5                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     3                 type="boolean"
     4                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>
    76    <para>

  • vendor/current/docs-xml/smbdotconf/security/authmethods.xml

    r414 r988  
    11<samba:parameter name="auth methods"
    22                 context="G"
    3                                  type="list"
    4                  basic="1" advanced="1" wizard="1" developer="1"
    5                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     3                 type="cmdlist"
     4                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>
    76

  • vendor/current/docs-xml/smbdotconf/security/checkpasswordscript.xml

    r414 r988  
    11<samba:parameter name="check password script"
    22                 context="G"
    3                                  type="string"
    4                  advanced="1" developer="1"
     3                 type="string"
    54                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>
    … …  
    1817</description>
    1918
    20 <value type="default">Disabled</value>
     19<value type="default"><comment>Disabled</comment></value>
    2120<value type="example">/usr/local/sbin/crackcheck</value>
    2221</samba:parameter>

  • vendor/current/docs-xml/smbdotconf/security/clientipcsigning.xml

    r919 r988  
    22                 context="G"
    33                 type="enum"
     4                 function="_client_ipc_signing"
    45                 enumlist="enum_smb_signing_vals"
    56                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    67<description>
    78    <para>This controls whether the client is allowed or required to use SMB signing for IPC$
    8     connections as DCERPC transport inside of winbind. Possible values
     9    connections as DCERPC transport. Possible values
    910    are <emphasis>auto</emphasis>, <emphasis>mandatory</emphasis>
    1011    and <emphasis>disabled</emphasis>.
    1112    </para>
     13
     14    <para>When set to mandatory or default, SMB signing is required.</para>
    1215
    1316    <para>When set to auto, SMB signing is offered, but not enforced and if set
    … …  
    2023<related>client signing</related>
    2124
    22 <value type="default">mandatory</value>
     25<value type="default">default</value>
    2326</samba:parameter>

  • vendor/current/docs-xml/smbdotconf/security/clientlanmanauth.xml

    r414 r988  
    11<samba:parameter name="client lanman auth"
    22                 context="G"
    3                                  type="boolean"
    4                  advanced="1" developer="1"
     3                 type="boolean"
    54                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>

  • vendor/current/docs-xml/smbdotconf/security/clientntlmv2auth.xml

    r919 r988  
    1 <samba:parameter name="client ntlmv2 auth"
     1<samba:parameter name="client NTLMv2 auth"
    22                 context="G"
    3                                  type="boolean"
    4                  advanced="1" developer="1"
     3                 type="boolean"
    54                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>

  • vendor/current/docs-xml/smbdotconf/security/clientplaintextauth.xml

    r414 r988  
    11<samba:parameter name="client plaintext auth"
    22                 context="G"
    3                                  type="boolean"
    4                  basic="1" advanced="1" wizard="1" developer="1"
    5                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     3                 type="boolean"
     4                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>
    76        <para>Specifies whether a client should send a plaintext

  • vendor/current/docs-xml/smbdotconf/security/clientschannel.xml

    r414 r988  
    11<samba:parameter name="client schannel"
    22                 context="G"
    3                  basic="1"
    4                                  type="boolean-auto"
    5                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     3                 type="enum"
     4                 enumlist="enum_bool_auto"
     5                xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    66<description>
    77
    … …  
    1313    if the server is not able to speak netlogon schannel.
    1414    </para>
     15
     16    <para>Note that for active directory domains this is hardcoded to
     17    <smbconfoption name="client schannel">yes</smbconfoption>.</para>
     18
     19    <para>This option yields precedence to the <smbconfoption name="require strong key"/> option.</para>
    1520</description>
    1621<value type="default">auto</value>

  • vendor/current/docs-xml/smbdotconf/security/clientsigning.xml

    r919 r988  
    11<samba:parameter name="client signing"
    22                 context="G"
    3                                  type="boolean-auto"
    4                  basic="1"
    5                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     3                 type="enum"
     4                 enumlist="enum_smb_signing_vals"
     5                xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    66<description>
    77    <para>This controls whether the client is allowed or required to use SMB signing. Possible values
    … …  
    1010    </para>
    1111
    12     <para>When set to auto, SMB signing is offered, but not enforced.
    13     When set to mandatory, SMB signing is required and if set
    14         to disabled, SMB signing is not offered either.
     12    <para>When set to auto or default, SMB signing is offered, but not enforced.</para>
     13
     14    <para>When set to mandatory, SMB signing is required and if set
     15    to disabled, SMB signing is not offered either.</para>
    1516
    1617    <para>IPC$ connections for DCERPC e.g. in winbindd, are handled by the
    1718    <smbconfoption name="client ipc signing"/> option.</para>
    18 </para>
    1919</description>
    2020
    21 <value type="default">auto</value>
     21<related>client ipc signing</related>
     22
     23<value type="default">default</value>
    2224</samba:parameter>

  • vendor/current/docs-xml/smbdotconf/security/clientusepsnegoprincipal.xml

    r860 r988  
    11<samba:parameter name="client use spnego principal"
    22                 context="G"
    3                                 type="boolean"
    4                  advanced="1" developer="1"
     3                type="boolean"
     4                 deprecated="1"
    55                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    66<description>
    … …  
    1515    ordinarily cannot function in this situation. </para>
    1616
     17    <para>This is a VERY BAD IDEA for security reasons, and so this
     18    parameter SHOULD NOT BE USED. It will be removed in a future
     19    version of Samba.</para>
     20
    1721    <para>If disabled, Samba will use the name used to look up the
    1822    server when asking the KDC for a ticket.  This avoids situations
    … …  
    2428    this behaviour, and Windows Vista and later servers no longer
    2529    supply this 'rfc4178 hint' principal on the server side.</para>
     30
     31    <para>This parameter is deprecated in Samba 4.2.1 and will be removed
     32    (along with the functionality) in a later release of Samba.</para>
    2633</description>
    2734<value type="default">no</value>

  • vendor/current/docs-xml/smbdotconf/security/createmask.xml

    r414 r988  
    11<samba:parameter name="create mask"
    22                 context="S"
    3                                  type="string"
     3                 type="octal"
    44                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    55
    … …  
    2727        for details.
    2828        </para>
    29 
    30     <para>
    31         Note that this parameter does not apply to permissions set by Windows NT/2000 ACL editors. If the
    32         administrator wishes to enforce a mask on access control lists also, they need to set the <smbconfoption
    33         name="security mask"/>.
    34         </para>
    3529</description>
    3630

  • vendor/current/docs-xml/smbdotconf/security/dedicatedkeytabfile.xml

    r414 r988  
    1 <samba:parameter name="dedicated keytab file" context="G" type="string"
    2                  advanced="1" developer="1"
     1<samba:parameter name="dedicated keytab file"
     2                 context="G"
     3                 type="string"
     4                 constant="1"
    35                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    46<description>

  • vendor/current/docs-xml/smbdotconf/security/directorymask.xml

    r414 r988  
    11<samba:parameter name="directory mask"
    2         context="S"
    3         type="string"
     2                 context="S"
     3                 type="octal"
    44                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    55<synonym>directory mode</synonym>
    … …  
    2424    created from this parameter with the value of the <smbconfoption name="force directory mode"/> parameter.
    2525    This parameter is set to 000 by default (i.e. no extra mode bits are added).</para>
    26 
    27     <para>Note that this parameter does not apply to permissions
    28     set by Windows NT/2000 ACL editors. If the administrator wishes to enforce
    29     a mask on access control lists also, they need to set the <smbconfoption name="directory security mask"/>.</para>
    3026</description>
    3127
    3228<related>force directory mode</related>
    3329<related>create mask</related>
    34 <related>directory security mask</related>
    3530<related>inherit permissions</related>
    3631<value type="default">0755</value>

  • vendor/current/docs-xml/smbdotconf/security/directorysecuritymask.xml

    r414 r988  
    11<samba:parameter name="directory security mask"
    22                 context="S"
    3                                  type="string"
     3                 removed="1"
     4                 type="string"
    45                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    56<description>
    6     <para>This parameter controls what UNIX permission bits
    7     will be set when a Windows NT client is manipulating the UNIX
    8     permission on a directory using the native NT security dialog
    9     box.</para>
    10 
    117    <para>
    12         This parameter is applied as a mask (AND'ed with) to the incoming permission bits, thus resetting
    13         any bits not in this mask.  Make sure not to mix up this parameter with <smbconfoption name="force
    14         directory security mode"/>, which works similar like this one but uses logical OR instead of AND.
    15         Essentially, zero bits in this mask are a set of bits that will always be set to zero.
    16         </para>
    17 
    18     <para>
    19         Essentially, all bits set to zero in this mask will result in setting to zero the corresponding bits on the
    20         file permissions regardless of the previous status of this bits on the file.
     8        This parameter has been removed for Samba 4.0.0.
    219    </para>
    22 
    23     <para>If not set explicitly this parameter is set to 0777
    24     meaning a user is allowed to set all the user/group/world
    25     permissions on a directory.</para>
    26 
    27     <para><emphasis>Note</emphasis> that users who can access the
    28     Samba server through other means can easily bypass this restriction,
    29     so it is primarily useful for standalone &quot;appliance&quot; systems. 
    30     Administrators of most normal systems will probably want to leave
    31         it as the default of <constant>0777</constant>.</para>
    3210</description>
    3311
    34 <related>force directory security mode</related>
    35 <related>security mask</related>
    36 <related>force security mode</related>
    37 <value type="default">0777</value>
    38 <value type="example">0700</value>
    3912</samba:parameter>

  • vendor/current/docs-xml/smbdotconf/security/encryptpasswords.xml

    r414 r988  
    11<samba:parameter name="encrypt passwords"
    22                 context="G"
    3                                  type="boolean"
    4                  basic="1" advanced="1" wizard="1" developer="1"
    5                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     3                 type="boolean"
     4                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>
    76    <para>This boolean controls whether encrypted passwords
    … …  
    3332    <manvolnum>5</manvolnum></citerefentry> file (see the <citerefentry><refentrytitle>smbpasswd</refentrytitle>
    3433    <manvolnum>8</manvolnum></citerefentry> program for information on how to set up
    35     and maintain this file), or set the <smbconfoption name="security">[server|domain|ads]</smbconfoption> parameter which
     34    and maintain this file), or set the <smbconfoption name="security">[domain|ads]</smbconfoption> parameter which
    3635    causes <command moreinfo="none">smbd</command> to authenticate against another
    3736        server.</para>

  • vendor/current/docs-xml/smbdotconf/security/forcecreatemode.xml

    r414 r988  
    11<samba:parameter name="force create mode"
    22                 context="S"
     3                 type="octal"
    34                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    45<description>
    … …  
    2021<related>inherit permissions</related>
    2122
    22 <value type="default">000</value>
     23<value type="default">0000</value>
    2324<value type="example">0755</value>
    2425</samba:parameter>

  • vendor/current/docs-xml/smbdotconf/security/forcedirectorymode.xml

    r414 r988  
    11<samba:parameter name="force directory mode"
    22                 context="S"
    3                                  type="string"
     3                 type="octal"
    44                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    55<description>
    … …  
    1818</description>
    1919
    20 <value type="default">000</value>
     20<value type="default">0000</value>
    2121<value type="example">0755</value>
    2222

  • vendor/current/docs-xml/smbdotconf/security/forcedirectorysecuritymode.xml

    r414 r988  
    11<samba:parameter name="force directory security mode"
    22                 context="S"
    3                                  type="string"
     3                 type="string"
     4                 removed="1"
    45                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    56<description>
    67    <para>
    7         This parameter controls what UNIX permission bits can be modified when a Windows NT client is manipulating
    8         the UNIX permission on a directory using the native NT security dialog box.
    9         </para>
    10 
    11     <para>
    12         This parameter is applied as a mask (OR'ed with) to the changed permission bits, thus forcing any bits in this
    13         mask that the user may have modified to be on.  Make sure not to mix up this parameter with <smbconfoption
    14         name="directory security mask"/>, which works in a similar manner to this one, but uses a logical AND instead
    15         of an OR.
    16         </para>
    17 
    18         <para>
    19         Essentially, this mask may be treated as a set of bits that, when modifying security on a directory,
    20         to will enable (1) any flags that are off (0) but which the mask has set to on (1).
    21         </para>
    22 
    23     <para>
    24         If not set explicitly this parameter is 0000, which allows a user to modify all the user/group/world
    25         permissions on a directory without restrictions.
    26         </para>
    27 
    28     <note><para>
    29         Users who can access the Samba server through other means can easily bypass this restriction, so it is
    30         primarily useful for standalone &quot;appliance&quot; systems.  Administrators of most normal systems will
    31         probably want to leave it set as 0000.
    32         </para></note>
    33 
     8        This parameter has been removed for Samba 4.0.0.
     9    </para>
    3410</description>
    35 
    36 <value type="default">0</value>
    37 <value type="example">700</value>
    38 
    39 <related>directory security mask</related>
    40 <related>security mask</related>
    41 <related>force security mode</related>
    42 
    4311</samba:parameter>

  • vendor/current/docs-xml/smbdotconf/security/forcegroup.xml

    r414 r988  
    11<samba:parameter name="force group"
    22                 context="S"
    3                                 type="string"
     3                type="string"
    44                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    55<synonym>group</synonym>

  • vendor/current/docs-xml/smbdotconf/security/forcesecuritymode.xml

    r414 r988  
    11<samba:parameter name="force security mode"
    22                 context="S"
    3                                  type="string"
     3                 type="string"
     4                 removed="1"
    45                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    56<description>
    67    <para>
    7         This parameter controls what UNIX permission bits can be modified when a Windows NT client is manipulating
    8     the UNIX permission on a file using the native NT security dialog box.
    9         </para>
    10                
    11     <para>
    12         This parameter is applied as a mask (OR'ed with) to the changed permission bits, thus forcing any bits in this
    13         mask that the user may have modified to be on.  Make sure not to mix up this parameter with <smbconfoption
    14         name="security mask"/>, which works similar like this one but uses logical AND instead of OR.
    15         </para>
    16 
    17         <para>
    18         Essentially, one bits in this mask may be treated as a set of bits that, when modifying security on a file,
    19         the user has always set to be on.
    20         </para>
    21 
    22     <para>
    23         If not set explicitly this parameter is set to 0, and allows a user to modify all the user/group/world
    24         permissions on a file, with no restrictions.
    25         </para>
    26                
    27     <para><emphasis>
    28         Note</emphasis> that users who can access the Samba server through other means can easily bypass this
    29         restriction, so it is primarily useful for standalone &quot;appliance&quot; systems. Administrators of most
    30         normal systems will probably want to leave this set to 0000.
    31         </para>
    32 
     8        This parameter has been removed for Samba 4.0.0.
     9    </para>
    3310</description>
    34 
    35 <value type="default">0</value>
    36 <value type="example">700</value>
    37 
    38 <related>force directory security mode</related>
    39 <related>directory security mask</related>
    40 <related>security mask</related>
    4111</samba:parameter>

  • vendor/current/docs-xml/smbdotconf/security/forceunknownacluser.xml

    r414 r988  
    11<samba:parameter name="force unknown acl user"
    22                 context="S"
    3                                 type="boolean"
     3                type="boolean"
    44                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    55

  • vendor/current/docs-xml/smbdotconf/security/forceuser.xml

    r414 r988  
    11<samba:parameter name="force user"
    2                                 type="string"
     2                type="string"
    33                 context="S"
    44                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">

  • vendor/current/docs-xml/smbdotconf/security/guestaccount.xml

    r414 r988  
    11<samba:parameter name="guest account"
    22                 context="G"
    3                                 type="string"
    4                  basic="1" advanced="1" developer="1"
    5                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     3                type="string"
     4                 constant="1"
     5                xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    66<description>
    77    <para>This is a username which will be used for access

  • vendor/current/docs-xml/smbdotconf/security/guestok.xml

    r740 r988  
    11<samba:parameter name="guest ok"
    2                                 type="boolean"
     2                type="boolean"
    33                 context="S"
    4                  basic="1" advanced="1" print="1" developer="1"
    5                                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     4                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<synonym>public</synonym>
    76<description>

  • vendor/current/docs-xml/smbdotconf/security/guestonly.xml

    r414 r988  
    11<samba:parameter name="guest only"
    22                 context="S"
    3                                 type="boolean"
     3                type="boolean"
    44                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    55<synonym>only guest</synonym>

  • vendor/current/docs-xml/smbdotconf/security/hostsallow.xml

    r414 r988  
    11<samba:parameter name="hosts allow"
    22                 context="S"
    3                                  type="list"
    4                  basic="1" advanced="1" print="1" developer="1"
     3                 type="cmdlist"
    54                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<synonym>allow hosts</synonym>

  • vendor/current/docs-xml/smbdotconf/security/hostsdeny.xml

    r414 r988  
    11<samba:parameter name="hosts deny"
    22                 context="S"
    3                                  type="list"
    4                  basic="1" advanced="1" print="1" developer="1"
     3                 type="cmdlist"
    54                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<synonym>deny hosts</synonym>

  • vendor/current/docs-xml/smbdotconf/security/inheritacls.xml

    r414 r988  
    11<samba:parameter name="inherit acls"
    22                 context="S"
    3                                 type="boolean"
     3                type="boolean"
    44                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    55<description>

  • vendor/current/docs-xml/smbdotconf/security/inheritowner.xml

    r414 r988  
    11<samba:parameter name="inherit owner"
    22                 context="S"
    3                 type="boolean"
     3                type="boolean"
    44                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    55<description>
    … …  
    1111       
    1212        <para>Common scenarios where this behavior is useful is in
    13         implementing drop-boxes where users can create and edit files but not
    14         delete them and to ensure that newly create files in a user's
    15         roaming profile directory are actually owner by the user.</para>
     13        implementing drop-boxes, where users can create and edit files but
     14        not delete them and ensuring that newly created files in a user's
     15        roaming profile directory are actually owned by the user.</para>
    1616</description>
    1717

  • vendor/current/docs-xml/smbdotconf/security/inheritpermissions.xml

    r414 r988  
    11<samba:parameter name="inherit permissions"
    22                 context="S"
    3                                 type="boolean"
     3                type="boolean"
    44                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    55<description>

  • vendor/current/docs-xml/smbdotconf/security/invalidusers.xml

    r414 r988  
    11<samba:parameter name="invalid users"
    22                 context="S"
    3                                  type="list"
     3                 type="cmdlist"
    44                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    55<description>

  • vendor/current/docs-xml/smbdotconf/security/kerberosmethod.xml

    r414 r988  
    1 <samba:parameter name="kerberos method" context="G" type="enum"
    2                  advanced="1" developer="1"
     1<samba:parameter name="kerberos method"
     2                 context="G"
     3                 type="enum"
     4                 enumlist="enum_kerberos_method"
    35                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    46<description>
    … …  
    3638</description>
    3739<related>dedicated keytab file</related>
    38 <value type="default">secrets only</value>
     40<value type="default">default</value>
    3941</samba:parameter>

  • vendor/current/docs-xml/smbdotconf/security/lanmanauth.xml

    r414 r988  
    11<samba:parameter name="lanman auth"
    22                 context="G"
    3                                  type="boolean"
    4                  advanced="1" developer="1"
     3                 type="boolean"
    54                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>
    … …  
    2221    blanked after the next password change. As a result of that
    2322    lanman clients won't be able to authenticate, even if lanman
    24     auth is reenabled later on.
     23    auth is re-enabled later on.
    2524    </para>
    2625               

  • vendor/current/docs-xml/smbdotconf/security/maptoguest.xml

    r414 r988  
    11<samba:parameter name="map to guest"
    2                                 type="enum"
     2                type="enum"
    33                 context="G"
    4                  advanced="1" developer="1"
    5                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     4                 enumlist="enum_map_to_guest"
     5                xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    66<description>
    7     <para>This parameter is only useful in <smbconfoption name="SECURITY">
    8     security</smbconfoption> modes other than <parameter moreinfo="none">security = share</parameter>
    9     and <parameter moreinfo="none">security = server</parameter>
    10     - i.e. <constant>user</constant>, and <constant>domain</constant>.</para>
    11 
    127    <para>This parameter can take four different values, which tell
    138    <citerefentry><refentrytitle>smbd</refentrytitle>
    … …  
    5651
    5752    <para>Note that this parameter is needed to set up &quot;Guest&quot;
    58     share services when using <parameter moreinfo="none">security</parameter> modes other than
    59     share and server. This is because in these modes the name of the resource being
     53    share services. This is because in these modes the name of the resource being
    6054    requested is <emphasis>not</emphasis> sent to the server until after
    6155    the server has successfully authenticated the client so the server
    6256    cannot make authentication decisions at the correct time (connection
    63     to the share) for &quot;Guest&quot; shares. This parameter is not useful with
    64     <parameter moreinfo="none">security = server</parameter> as in this security mode
    65     no information is returned about whether a user logon failed due to
    66     a bad username or bad password, the same error is returned from a modern server
    67     in both cases.</para>
    68 
    69     <para>For people familiar with the older Samba releases, this
    70     parameter maps to the old compile-time setting of the <constant>
    71                 GUEST_SESSSETUP</constant> value in local.h.</para>
     57    to the share) for &quot;Guest&quot; shares. </para>
    7258</description>
    7359

  • vendor/current/docs-xml/smbdotconf/security/mapuntrustedtodomain.xml

    r414 r988  
    11<samba:parameter name="map untrusted to domain"
    22                 context="G"
    3                  type="boolean"
    4                  advanced="1"
    5                  developer="1"
    6                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     3                 type="boolean"
     4                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    75<description>
    86    <para>

  • vendor/current/docs-xml/smbdotconf/security/ntlmauth.xml

    r414 r988  
    11<samba:parameter name="ntlm auth"
    22                 context="G"
    3                                  type="boolean"
    4                  advanced="1" developer="1"
     3                 type="boolean"
    54                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>

  • vendor/current/docs-xml/smbdotconf/security/nullpasswords.xml

    r414 r988  
    11<samba:parameter name="null passwords"
    22                 context="G"
    3                  advanced="1" developer="1"
    4                                  type="boolean"
    5                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     3                 type="boolean"
     4                 deprecated="1"
     5                xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    66<description>
    77    <para>Allow or disallow client access to accounts that have null passwords. </para>

  • vendor/current/docs-xml/smbdotconf/security/obeypamrestrictions.xml

    r414 r988  
    11<samba:parameter name="obey pam restrictions"
    22                 context="G"
    3                                  type="boolean"
    4                  advanced="1" developer="1"
    5                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     3                 type="boolean"
     4                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>
    76    <para>When Samba 3.0 is configured to enable PAM support

  • vendor/current/docs-xml/smbdotconf/security/onlyuser.xml

    r414 r988  
    11<samba:parameter name="only user"
    2                                         type="boolean"
     2                 type="boolean"
    33                 context="S"
     4                 deprecated="1"
    45                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    56<description>
    6     <para>This is a boolean option that controls whether
    7     connections with usernames not in the <parameter moreinfo="none">user</parameter>
    8     list will be allowed. By default this option is disabled so that a
    9     client can supply a username to be used by the server.  Enabling
    10     this parameter will force the server to only use the login
    11     names from the <parameter moreinfo="none">user</parameter> list and is only really
    12     useful in <smbconfoption name="security">share</smbconfoption> level security.</para>
     7    <para>To restrict a service to a particular set of users you
     8    can use the <smbconfoption name="valid users"/> parameter.</para>
    139
    14     <para>Note that this also means Samba won't try to deduce
    15     usernames from the service name. This can be annoying for
    16     the [homes] section. To get around this you could use <command moreinfo="none">user =
    17     %S</command> which means your <parameter moreinfo="none">user</parameter> list
    18     will be just the service name, which for home directories is the
    19     name of the user.</para>
     10    <para>This parameter is deprecated</para>
     11
     12    <para>However, it currently operates only in conjunction with
     13    <smbconfoption name="username"/>.  The supported way to restrict
     14    a service to a particular set of users is the
     15    <smbconfoption name="valid users"/> parameter.</para>
     16
    2017</description>
    2118

  • vendor/current/docs-xml/smbdotconf/security/pampasswordchange.xml

    r414 r988  
    11<samba:parameter name="pam password change"
    22                 context="G"
    3                                  type="boolean"
    4                  advanced="1" developer="1"
    5                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     3                 type="boolean"
     4                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>
    76    <para>With the addition of better PAM support in Samba 2.2,

  • vendor/current/docs-xml/smbdotconf/security/passdbbackend.xml

    r414 r988  
    11<samba:parameter name="passdb backend"
    22                 context="G"
    3                  type="list"
    4                  advanced="1" developer="1"
    5                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     3                 type="string"
     4                 constant="1"
     5                xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    66<description>
    77

  • vendor/current/docs-xml/smbdotconf/security/passdbexpandexplicit.xml

    r414 r988  
    11<samba:parameter name="passdb expand explicit"
    22                 context="G"
    3                  advanced="1" developer="0"
    4                                  type="boolean"
    5                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     3                 type="boolean"
     4                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>
    76    <para>

  • vendor/current/docs-xml/smbdotconf/security/passwdchat.xml

    r414 r988  
    22                 context="G"
    33                 type="string"
    4                  advanced="1" developer="1"
    54                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>
    … …  
    5655<related>pam password change</related>
    5756
    58 <value type="default">*new*password* %n\n*new*password* %n\n *changed*</value>
     57<value type="default">*new*password* %n\n *new*password* %n\n *changed*</value>
    5958<value type="example">&quot;*Enter NEW password*&quot; %n\n &quot;*Reenter NEW password*&quot; %n\n &quot;*Password changed*&quot;</value>
    6059</samba:parameter>

  • vendor/current/docs-xml/smbdotconf/security/passwdchatdebug.xml

    r414 r988  
    11<samba:parameter name="passwd chat debug"
    22                 context="G"
    3                  advanced="1" developer="1"
    4                                  type="boolean"
     3                 type="boolean"
    54                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>

  • vendor/current/docs-xml/smbdotconf/security/passwdchattimeout.xml

    r414 r988  
    11<samba:parameter name="passwd chat timeout"
    22                 context="G"
    3                                  type="integer"
    4                  advanced="1" developer="1"
     3                 type="integer"
    54                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>

  • vendor/current/docs-xml/smbdotconf/security/passwdprogram.xml

    r414 r988  
    11<samba:parameter name="passwd program"
    22                 context="G"
    3                                  type="string"
    4                  advanced="1" developer="1"
    5                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     3                 type="string"
     4                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65 <description>
    76    <para>The name of a program that can be used to set

  • vendor/current/docs-xml/smbdotconf/security/passwordserver.xml

    r740 r988  
    11<samba:parameter name="password server"
    22                 context="G"
    3                                  type="list"
    4                  advanced="1" wizard="1" developer="1"
    5                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     3                 type="string"
     4                 constant="1"
     5                xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    66<description>
    7     <para>By specifying the name of another SMB server
    8     or Active Directory domain controller with this option,
    9     and using <command moreinfo="none">security = [ads|domain|server]</command>
     7    <para>By specifying the name of a domain controller with this option,
     8    and using <command moreinfo="none">security = [ads|domain]</command>
    109    it is possible to get Samba
    1110    to do all its username/password validation using a specific remote server.</para>
    1211
    13     <para>If the <parameter moreinfo="none">security</parameter> parameter is set to
    14     <constant>domain</constant> or <constant>ads</constant>, then this option
    15     <emphasis>should not</emphasis> be used, as the default '*' indicates to Samba
    16     to determine the best DC to contact dynamically, just as all other hosts in an
    17     AD domain do.  This allows the domain to be maintained without modification to
    18     the smb.conf file.  The cryptograpic protection on the authenticated RPC calls
     12    <para>Ideally, this option
     13    <emphasis>should not</emphasis> be used, as the default '*' indicates to Samba
     14    to determine the best DC to contact dynamically, just as all other hosts in an
     15    AD domain do.  This allows the domain to be maintained (addition
     16    and removal of domain controllers) without modification to
     17    the smb.conf file.  The cryptographic protection on the authenticated RPC calls
    1918    used to verify passwords ensures that this default is safe.</para>
    2019
    … …  
    3635    this list by locating the closest DC.</para>
    3736               
    38     <para>If parameter is a name, it is looked up using the
     37    <para>If parameter is a name, it is looked up using the 
    3938    parameter <smbconfoption name="name resolve order"/> and so may resolved
    4039    by any method and order described in that parameter.</para>
    4140
    42     <para>If the <parameter moreinfo="none">security</parameter> parameter is
    43     set to <constant>server</constant>, these additional restrictions apply:</para>
    44 
    45     <itemizedlist>
    46         <listitem>
    47             <para>You may list several password servers in
    48             the <parameter moreinfo="none">password server</parameter> parameter, however if an
    49             <command moreinfo="none">smbd</command> makes a connection to a password server,
    50             and then the password server fails, no more users will be able
    51             to be authenticated from this <command moreinfo="none">smbd</command>.  This is a
    52             restriction of the SMB/CIFS protocol when in <command moreinfo="none">security = server
    53             </command> mode and cannot be fixed in Samba.</para>
    54         </listitem>
    55            
    56         <listitem>
    57             <para>You will have to ensure that your users
    58             are able to login from the Samba server, as when in <command moreinfo="none">
    59             security = server</command>  mode the network logon will appear to
    60             come from the Samba server rather than from the users workstation.</para>
    61         </listitem>
    62 
    63         <listitem>
    64             <para>The client must not select NTLMv2 authentication.</para>
    65         </listitem>
    66 
    67         <listitem>
    68           <para>The password server must be a machine capable of using
    69           the &quot;LM1.2X002&quot; or the &quot;NT LM 0.12&quot; protocol, and it must be in
    70           user level security mode.</para>
    71         </listitem>
    72 
    73         <listitem>
    74           <para>Using a password server  means your UNIX box (running
    75           Samba) is only as secure as (a host masqurading as) your password server. <emphasis>DO NOT
    76           CHOOSE A PASSWORD SERVER THAT  YOU DON'T COMPLETELY TRUST</emphasis>.
    77           </para>
    78         </listitem>
    79 
    80         <listitem>
    81           <para>Never point a Samba server at itself for password serving.
    82           This will cause a loop and could lock up your Samba  server!</para>
    83         </listitem>
    84 
    85         <listitem>
    86           <para>The name of the password server takes the standard
    87           substitutions, but probably the only useful one is <parameter moreinfo="none">%m
    88           </parameter>, which means the Samba server will use the incoming
    89           client as the password server. If you use this then you better
    90           trust your clients, and you had better restrict them with hosts allow!</para>
    91         </listitem>
    92 
    93     </itemizedlist>
    9441</description>
    9542

  • vendor/current/docs-xml/smbdotconf/security/preloadmodules.xml

    r414 r988  
    11<samba:parameter name="preload modules"
    2                 type="list"
    3                  context="G"
    4                  basic="1"
    5                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     2                 type="cmdlist"
     3                 context="G"
     4                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>
    76        <para>This is a list of paths to modules that should

  • vendor/current/docs-xml/smbdotconf/security/privatedir.xml

    r414 r988  
    11<samba:parameter name="private dir"
    22                 context="G"
    3                                  type="string"
    4                  advanced="1" developer="1"
    5                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     3                 type="string"
     4                 constant="1"
     5                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     6<synonym>private directory</synonym>
    67<description>
    78    <para>This parameters defines the directory
    … …  
    1112</description>
    1213
    13 <value type="default">${prefix}/private</value>
     14<value type="default">&pathconfig.PRIVATE_DIR;</value>
    1415</samba:parameter>

  • vendor/current/docs-xml/smbdotconf/security/readlist.xml

    r414 r988  
    11<samba:parameter name="read list"
    22                 context="S"
    3                                  type="list"
     3                 type="cmdlist"
    44                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    55<description>
    … …  
    1010        parameter.
    1111        </para>
    12  
    13     <para>This parameter will not work with the <smbconfoption name="security">share</smbconfoption> in
    14     Samba 3.0.  This is by design.</para>
    1512</description>
    16 
    1713<related>write list</related>
    1814<related>invalid users</related>

  • vendor/current/docs-xml/smbdotconf/security/readonly.xml

    r414 r988  
    11<samba:parameter name="read only"
    22                 context="S"
    3                                  type="boolean"
    4                  basic="1" advanced="1"
     3                 type="boolean"
    54                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>

  • vendor/current/docs-xml/smbdotconf/security/renameuserscript.xml

    r414 r988  
    11<samba:parameter name="rename user script"
    22                 context="G"
    3                  advanced="1" developer="1"
    4                                  type="boolean"
    5                                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     3                 type="string"
     4                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>
    76    <para>
    … …  
    3029</description>
    3130
    32 <value type="default">no</value>
     31<value type="default"></value>
    3332</samba:parameter>

  • vendor/current/docs-xml/smbdotconf/security/restrictanonymous.xml

    r414 r988  
    11<samba:parameter name="restrict anonymous"
    2         type="integer"
     2                 type="integer"
    33                 context="G"
    4                  advanced="1" developer="1"
    54                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>
    … …  
    1413        registry key in Windows 2000 and Windows NT.  When set to 0, user
    1514        and group list information is returned to anyone who asks.  When set
    16     to 1, only an authenticated user can retrive user and
     15    to 1, only an authenticated user can retrieve user and
    1716    group list information.  For the value 2, supported by
    1817    Windows 2000/XP and Samba, no anonymous connections are allowed at

  • vendor/current/docs-xml/smbdotconf/security/rootdirectory.xml

    r414 r988  
    11<samba:parameter name="root directory"
    2         context="G"
    3         type="string"
    4                  advanced="1" developer="1"
    5                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     2                 context="G"
     3                 type="string"
     4                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<synonym>root</synonym>
    76<synonym>root dir</synonym>
    … …  
    3130</description>
    3231
    33 <value type="default">/</value>
     32<value type="default"></value>
    3433<value type="example">/homes/smb</value>
    3534</samba:parameter>

  • vendor/current/docs-xml/smbdotconf/security/security.xml

    r740 r988  
    11<samba:parameter name="security"
    22                 context="G"
    3                                  type="enum"
    4                  basic="1" advanced="1" wizard="1" developer="1"
    5                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    6                  <when_value value="security">
    7                          <requires option="encrypted passwords">/(yes|true)/</requires>
    8                  </when_value>
     3                 type="enum"
     4                 function="_security"
     5                 enumlist="enum_security"
     6                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     7<when_value value="security">
     8    <requires option="encrypted passwords">/(yes|true)/</requires>
     9</when_value>
    910<description>
    1011    <para>This option affects how clients respond to
    … …  
    1213    smb.conf</filename> file.</para>
    1314
    14     <para>The option sets the &quot;security mode bit&quot; in replies to
    15     protocol negotiations with <citerefentry><refentrytitle>smbd</refentrytitle>
    16     <manvolnum>8</manvolnum></citerefentry> to turn share level security on or off. Clients decide
    17     based on this bit whether (and how) to transfer user and password
    18     information to the server.</para>
    19 
    20 
    2115    <para>The default is <command moreinfo="none">security = user</command>, as this is
    22     the most common setting needed when talking to Windows 98 and
    23     Windows NT.</para>
     16    the most common setting, used for a standalone file server or a DC.</para>
    2417
    2518    <para>The alternatives are
    2619    <command moreinfo="none">security = ads</command> or <command moreinfo="none">security = domain
    27     </command>, which support joining Samba to a Windows domain, along with <command moreinfo="none">security = share</command> and <command moreinfo="none">security = server</command>, both of which are deprecated.</para>
     20    </command>, which support joining Samba to a Windows domain</para>
    2821
    29     <para>In versions of Samba prior to 2.0.0, the default was
    30     <command moreinfo="none">security = share</command> mainly because that was
    31     the only option at one stage.</para>
    32 
    33     <para>You should use <command moreinfo="none">security = user</command> and
    34     <smbconfoption name="map to guest"/> if you
     22    <para>You should use <command moreinfo="none">security = user</command> and
     23    <smbconfoption name="map to guest"/> if you
    3524    want to mainly setup shares without a password (guest shares). This
    3625    is commonly used for a shared printer server. </para>
    3726               
    38     <para>It is possible to use <command moreinfo="none">smbd</command> in a <emphasis>
    39     hybrid mode</emphasis> where it is offers both user and share
    40     level security under different <smbconfoption name="NetBIOS aliases"/>. </para>
    41 
    4227    <para>The different settings will now be explained.</para>
    4328
    4429
     30    <para><anchor id="SECURITYEQUALSAUTO"/><emphasis>SECURITY = AUTO</emphasis></para>
     31
     32    <para>This is the default security setting in Samba, and causes Samba to consult
     33    the <smbconfoption name="server role"/> parameter (if set) to determine the security mode.</para>
     34
    4535    <para><anchor id="SECURITYEQUALSUSER"/><emphasis>SECURITY = USER</emphasis></para>
    4636
    47     <para>This is the default security setting in Samba.
    48     With user-level security a client must first &quot;log-on&quot; with a
    49     valid username and password (which can be mapped using the <smbconfoption name="username map"/>
     37    <para>If <smbconfoption name="server role"/> is not specified, this is the default security setting in Samba.
     38    With user-level security a client must first &quot;log-on&quot; with a 
     39    valid username and password (which can be mapped using the <smbconfoption name="username map"/> 
    5040    parameter). Encrypted passwords (see the <smbconfoption name="encrypted passwords"/> parameter) can also
    5141    be used in this security mode. Parameters such as <smbconfoption name="user"/> and <smbconfoption
    52         name="guest only"/> if set      are then applied and
    53     may change the UNIX user to use on this connection, but only after
     42        name="guest only"/> if set      are then applied and 
     43    may change the UNIX user to use on this connection, but only after 
    5444    the user has been successfully authenticated.</para>
    55 
    56     <para><emphasis>Note</emphasis> that the name of the resource being
    57     requested is <emphasis>not</emphasis> sent to the server until after
    58     the server has successfully authenticated the client. This is why
    59     guest shares don't work in user level security without allowing
    60     the server to automatically map unknown users into the <smbconfoption name="guest account"/>.
    61     See the <smbconfoption name="map to guest"/> parameter for details on doing this.</para>
    62 
    63     <para>See also the section <link linkend="VALIDATIONSECT">NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para>
    64 
    65     <para><anchor id="SECURITYEQUALSDOMAIN"/><emphasis>SECURITY = DOMAIN</emphasis></para>
    66 
    67     <para>This mode will only work correctly if <citerefentry><refentrytitle>net</refentrytitle>
    68     <manvolnum>8</manvolnum></citerefentry> has been used to add this
    69     machine into a Windows NT Domain. It expects the <smbconfoption name="encrypted passwords"/>
    70         parameter to be set to <constant>yes</constant>. In this
    71     mode Samba will try to validate the username/password by passing
    72     it to a Windows NT Primary or Backup Domain Controller, in exactly
    73     the same way that a Windows NT Server would do.</para>
    74 
    75     <para><emphasis>Note</emphasis> that a valid UNIX user must still
    76     exist as well as the account on the Domain Controller to allow
    77     Samba to have a valid UNIX account to map file access to.</para>
    78 
    79     <para><emphasis>Note</emphasis> that from the client's point
    80     of view <command moreinfo="none">security = domain</command> is the same
    81     as <command moreinfo="none">security = user</command>. It only
    82     affects how the server deals with the authentication,
    83     it does not in any way affect what the client sees.</para>
    84 
    85     <para><emphasis>Note</emphasis> that the name of the resource being
    86     requested is <emphasis>not</emphasis> sent to the server until after
    87     the server has successfully authenticated the client. This is why
    88     guest shares don't work in user level security without allowing
    89     the server to automatically map unknown users into the <smbconfoption name="guest account"/>.
    90     See the <smbconfoption name="map to guest"/> parameter for details on doing this.</para>
    91 
    92     <para>See also the section <link linkend="VALIDATIONSECT">
    93     NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para>
    94 
    95     <para>See also the <smbconfoption name="password server"/> parameter and
    96          the <smbconfoption name="encrypted passwords"/> parameter.</para>
    97 
    98     <para><anchor id="SECURITYEQUALSSHARE"/><emphasis>SECURITY = SHARE</emphasis></para>
    99 
    100     <note><para>This option is deprecated as it is incompatible with SMB2</para></note>
    101                
    102     <para>When clients connect to a share level security server, they
    103     need not log onto the server with a valid username and password before
    104     attempting to connect to a shared resource (although modern clients
    105     such as Windows 95/98 and Windows NT will send a logon request with
    106     a username but no password when talking to a <command moreinfo="none">security = share
    107     </command> server). Instead, the clients send authentication information
    108     (passwords) on a per-share basis, at the time they attempt to connect
    109     to that share.</para>
    110 
    111     <para>Note that <command moreinfo="none">smbd</command> <emphasis>ALWAYS</emphasis>
    112     uses a valid UNIX user to act on behalf of the client, even in
    113     <command moreinfo="none">security = share</command> level security.</para>
    114 
    115     <para>As clients are not required to send a username to the server
    116     in share level security, <command moreinfo="none">smbd</command> uses several
    117     techniques to determine the correct UNIX user to use on behalf
    118     of the client.</para>
    119 
    120     <para>A list of possible UNIX usernames to match with the given
    121     client password is constructed using the following methods :</para>
    122 
    123     <itemizedlist>
    124         <listitem>
    125             <para>If the <smbconfoption name="guest only"/> parameter is set, then all the other
    126             stages are missed and only the <smbconfoption name="guest account"/> username is checked.
    127             </para>
    128         </listitem>
    129 
    130         <listitem>
    131             <para>Is a username is sent with the share connection
    132             request, then this username (after mapping - see <smbconfoption name="username map"/>),
    133             is added as a potential username.
    134             </para>
    135         </listitem>
    136 
    137         <listitem>
    138             <para>If the client did a previous <emphasis>logon
    139             </emphasis> request (the SessionSetup SMB call) then the
    140             username sent in this SMB will be added as a potential username.
    141             </para>
    142         </listitem>
    143 
    144         <listitem>
    145             <para>The name of the service the client requested is
    146             added as a potential username.
    147             </para>
    148         </listitem>
    149 
    150         <listitem>
    151             <para>The NetBIOS name of the client is added to
    152             the list as a potential username.
    153             </para>
    154         </listitem>
    155 
    156         <listitem>
    157             <para>Any users on the <smbconfoption name="user"/> list are added as potential usernames.
    158             </para>
    159         </listitem>
    160     </itemizedlist>
    161 
    162     <para>If the <parameter moreinfo="none">guest only</parameter> parameter is
    163     not set, then this list is then tried with the supplied password.
    164     The first user for whom the password matches will be used as the
    165     UNIX user.</para>
    166 
    167     <para>If the <parameter moreinfo="none">guest only</parameter> parameter is
    168     set, or no username can be determined then if the share is marked
    169     as available to the <parameter moreinfo="none">guest account</parameter>, then this
    170     guest user will be used, otherwise access is denied.</para>
    171 
    172     <para>Note that it can be <emphasis>very</emphasis> confusing
    173     in share-level security as to which UNIX username will eventually
    174     be used in granting access.</para>
    175 
    176     <para>See also the section <link linkend="VALIDATIONSECT">
    177     NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para>
    178 
    179     <para><anchor id="SECURITYEQUALSSERVER"/><emphasis>SECURITY = SERVER</emphasis></para>
    180 
    181     <para>
    182         In this depicted mode Samba will try to validate the username/password by passing it to another SMB server, such as an
    183         NT box. If this fails it will revert to <command moreinfo="none">security = user</command>. It expects the
    184         <smbconfoption name="encrypted passwords"/> parameter to be set to <constant>yes</constant>, unless the remote
    185         server does not support them.  However note that if encrypted passwords have been negotiated then Samba cannot
    186         revert back to checking the UNIX password file, it must have a valid <filename
    187         moreinfo="none">smbpasswd</filename> file to check users against. See the chapter about the User Database in
    188         the Samba HOWTO Collection for details on how to set this up.
    189 </para>
    190 
    191         <note><para>This mode of operation has
    192     significant pitfalls since it is more vulnerable to
    193     man-in-the-middle attacks and server impersonation.  In particular,
    194     this mode of operation can cause significant resource consumption on
    195     the PDC, as it must maintain an active connection for the duration
    196     of the user's session.  Furthermore, if this connection is lost,
    197     there is no way to reestablish it, and further authentications to the
    198     Samba server may fail (from a single client, till it disconnects).
    199         </para></note>
    200 
    201         <note><para>If the client selects NTLMv2 authentication, then this mode of operation <emphasis>will fail</emphasis>
    202         </para></note>
    203 
    204         <note><para>From the client's point of
    205     view, <command moreinfo="none">security = server</command> is the
    206     same as <command moreinfo="none">security = user</command>.  It
    207     only affects how the server deals  with the authentication, it does
    208         not in any way affect what the  client sees.</para></note>
    209 
    210     <note><para>This option is deprecated, and may be removed in future</para></note>
    21145
    21246    <para><emphasis>Note</emphasis> that the name of the resource being
    … …  
    21751    See the <smbconfoption name="map to guest"/> parameter for details on doing this.</para>
    21852
    219     <para>See also the section <link linkend="VALIDATIONSECT">
    220     NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para>
     53    <para><anchor id="SECURITYEQUALSDOMAIN"/><emphasis>SECURITY = DOMAIN</emphasis></para>
     54
     55    <para>This mode will only work correctly if <citerefentry><refentrytitle>net</refentrytitle>
     56    <manvolnum>8</manvolnum></citerefentry> has been used to add this
     57    machine into a Windows NT Domain. It expects the <smbconfoption name="encrypted passwords"/>
     58        parameter to be set to <constant>yes</constant>. In this
     59    mode Samba will try to validate the username/password by passing
     60    it to a Windows NT Primary or Backup Domain Controller, in exactly
     61    the same way that a Windows NT Server would do.</para>
     62
     63    <para><emphasis>Note</emphasis> that a valid UNIX user must still
     64    exist as well as the account on the Domain Controller to allow
     65    Samba to have a valid UNIX account to map file access to.</para>
     66
     67    <para><emphasis>Note</emphasis> that from the client's point
     68    of view <command moreinfo="none">security = domain</command> is the same
     69    as <command moreinfo="none">security = user</command>. It only
     70    affects how the server deals with the authentication,
     71    it does not in any way affect what the client sees.</para>
     72
     73    <para><emphasis>Note</emphasis> that the name of the resource being
     74    requested is <emphasis>not</emphasis> sent to the server until after
     75    the server has successfully authenticated the client. This is why
     76    guest shares don't work in user level security without allowing
     77    the server to automatically map unknown users into the <smbconfoption name="guest account"/>.
     78    See the <smbconfoption name="map to guest"/> parameter for details on doing this.</para>
     79
     80    <para>See also the <smbconfoption name="password server"/> parameter and
     81         the <smbconfoption name="encrypted passwords"/> parameter.</para>
     82
     83
     84    <para><emphasis>Note</emphasis> that the name of the resource being
     85    requested is <emphasis>not</emphasis> sent to the server until after
     86    the server has successfully authenticated the client. This is why
     87    guest shares don't work in user level security without allowing
     88    the server to automatically map unknown users into the <smbconfoption name="guest account"/>.
     89    See the <smbconfoption name="map to guest"/> parameter for details on doing this.</para>
    22190
    22291    <para>See also the <smbconfoption name="password server"/> parameter and the
    … …  
    232101        <para>Note that this mode does NOT make Samba operate as a Active Directory Domain
    233102                Controller. </para>
    234        
     103
     104        <para>Note that this forces <smbconfoption name="require strong key">yes</smbconfoption>
     105        and <smbconfoption name="client schannel">yes</smbconfoption> for the primary domain.</para>
     106
    235107        <para>Read the chapter about Domain Membership in the HOWTO for details.</para>
    236108</description>
    … …  
    239111<related>encrypt passwords</related>
    240112
    241 <value type="default">USER</value>
     113<value type="default">AUTO</value>
    242114<value type="example">DOMAIN</value>
    243115</samba:parameter>

  • vendor/current/docs-xml/smbdotconf/security/securitymask.xml

    r414 r988  
    11<samba:parameter name="security mask"
    22                 context="S"
    3                                  type="string"
     3                 type="string"
     4                 removed="1"
    45                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    56<description>
    67    <para>
    7         This parameter controls what UNIX permission bits will be set when a Windows NT client is manipulating the
    8         UNIX permission on a file using the native NT security dialog box.
    9         </para>
    10 
    11     <para>
    12         This parameter is applied as a mask (AND'ed with) to the incoming permission bits, thus resetting
    13         any bits not in this mask. Make sure not to mix up this parameter with <smbconfoption name="force
    14         security mode"/>, which works in a manner similar to this one but uses a logical OR instead of an AND.
    15         </para>
    16 
    17     <para>
    18         Essentially, all bits set to zero in this mask will result in setting to zero the corresponding bits on the
    19         file permissions regardless of the previous status of this bits on the file.
     8        This parameter has been removed for Samba 4.0.0.
    209    </para>
    21 
    22     <para>
    23         If not set explicitly this parameter is 0777, allowing a user to set all the user/group/world permissions on a file.
    24     </para>
    25 
    26     <para><emphasis>
    27         Note</emphasis> that users who can access the Samba server through other means can easily bypass this
    28     restriction, so it is primarily useful for standalone &quot;appliance&quot; systems.  Administrators of
    29         most normal systems will probably want to leave it set to <constant>0777</constant>.
    30         </para>
    3110</description>
    32 
    33 <related>force directory security mode</related>
    34 <related>directory security mask</related>
    35 <related>force security mode</related>
    36 
    37 <value type="default">0777</value>
    38 <value type="example">0770</value>
    3911</samba:parameter>

  • vendor/current/docs-xml/smbdotconf/security/serverschannel.xml

    r414 r988  
    11<samba:parameter name="server schannel"
    22                 context="G"
    3                                  type="boolean-auto"
    4                  basic="1"
    5                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     3                 type="enum"
     4                 enumlist="enum_bool_auto"
     5                xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    66<description>
    77    <para>

  • vendor/current/docs-xml/smbdotconf/security/serversigning.xml

    r746 r988  
    11<samba:parameter name="server signing"
    22                 context="G"
    3                                 type="enum"
    4                  basic="1"
    5                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     3                type="enum"
     4                 enumlist="enum_smb_signing_vals"
     5                xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    66<description>
    77
    88    <para>This controls whether the client is allowed or required to use SMB1 and SMB2 signing. Possible values
    9     are <emphasis>auto</emphasis>, <emphasis>mandatory</emphasis>
     9    are <emphasis>default</emphasis>, <emphasis>auto</emphasis>, <emphasis>mandatory</emphasis>
    1010    and <emphasis>disabled</emphasis>.
    1111    </para>
     12
     13    <para>By default, and when smb signing is set to
     14    <emphasis>default</emphasis>, smb signing is required when
     15    <smbconfoption name="server role"/> is <emphasis>active directory
     16    domain controller</emphasis> and disabled otherwise.</para>
    1217
    1318    <para>When set to auto, SMB1 signing is offered, but not enforced.
    … …  
    2126</description>
    2227
    23 <value type="default">Disabled</value>
     28<value type="default">default</value>
    2429</samba:parameter>

  • vendor/current/docs-xml/smbdotconf/security/smbencrypt.xml

    r414 r988  
    11<samba:parameter name="smb encrypt"
    22                 context="S"
    3                                 type="enum"
    4                  basic="1"
    5                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     3                type="enum"
     4                 enumlist="enum_smb_signing_vals"
     5                xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    66<description>
    7 
    8     <para>This is a new feature introduced with Samba 3.2 and above. It is an
    9     extension to the SMB/CIFS protocol negotiated as part of the UNIX extensions.
    10     SMB encryption uses the GSSAPI (SSPI on Windows) ability to encrypt
    11     and sign every request/response in a SMB protocol stream. When
    12     enabled it provides a secure method of SMB/CIFS communication,
    13     similar to an ssh protected session, but using SMB/CIFS authentication
    14     to negotiate encryption and signing keys. Currently this is only
    15     supported by Samba 3.2 smbclient, and hopefully soon Linux CIFSFS
    16     and MacOS/X clients. Windows clients do not support this feature.
    17     </para>
    18 
    19     <para>This controls whether the remote client is allowed or required to use SMB encryption. Possible values
    20     are <emphasis>auto</emphasis>, <emphasis>mandatory</emphasis>
    21     and <emphasis>disabled</emphasis>. This may be set on a per-share
    22     basis, but clients may chose to encrypt the entire session, not
    23     just traffic to a specific share. If this is set to mandatory
    24     then all traffic to a share <emphasis>must</emphasis> must
    25     be encrypted once the connection has been made to the share.
    26     The server would return "access denied" to all non-encrypted
    27     requests on such a share. Selecting encrypted traffic reduces
    28     throughput as smaller packet sizes must be used (no huge UNIX
    29     style read/writes allowed) as well as the overhead of encrypting
    30     and signing all the data.
    31     </para>
    32 
    33     <para>If SMB encryption is selected, Windows style SMB signing (see
    34     the <smbconfoption name="server signing"/> option) is no longer necessary,
    35     as the GSSAPI flags use select both signing and sealing of the data.
    36     </para>
    37 
    38     <para>When set to auto, SMB encryption is offered, but not enforced.
    39     When set to mandatory, SMB encryption is required and if set
    40     to disabled, SMB encryption can not be negotiated.</para>
     7        <para>
     8        This parameter controls whether a remote client is allowed or required
     9        to use SMB encryption. It has different effects depending on whether
     10        the connection uses SMB1 or SMB2 and newer:
     11        </para>
     12
     13        <itemizedlist>
     14        <listitem>
     15                <para>
     16                If the connection uses SMB1, then this option controls the use
     17                of a Samba-specific extension to the SMB protocol introduced in
     18                Samba 3.2 that makes use of the Unix extensions.
     19                </para>
     20        </listitem>
     21
     22        <listitem>
     23                <para>
     24                If the connection uses SMB2 or newer, then this option controls
     25                the use of the SMB-level encryption that is supported in SMB
     26                version 3.0 and above and available in Windows 8 and newer.
     27                </para>
     28        </listitem>
     29        </itemizedlist>
     30
     31        <para>
     32                This parameter can be set globally and on a per-share bases.
     33                Possible values are
     34                <emphasis>off</emphasis> (or <emphasis>disabled</emphasis>),
     35                <emphasis>enabled</emphasis> (or <emphasis>auto</emphasis>, or
     36                <emphasis>if_required</emphasis>),
     37                <emphasis>desired</emphasis>,
     38                and
     39                <emphasis>required</emphasis>
     40                (or <emphasis>mandatory</emphasis>).
     41                A special value is <emphasis>default</emphasis> which is
     42                the implicit default setting of <emphasis>enabled</emphasis>.
     43        </para>
     44
     45        <variablelist>
     46                <varlistentry>
     47                <term><emphasis>Effects for SMB1</emphasis></term>
     48                <listitem>
     49                <para>
     50                The Samba-specific encryption of SMB1 connections is an
     51                extension to the SMB protocol negotiated as part of the UNIX
     52                extensions.  SMB encryption uses the GSSAPI (SSPI on Windows)
     53                ability to encrypt and sign every request/response in a SMB
     54                protocol stream. When enabled it provides a secure method of
     55                SMB/CIFS communication, similar to an ssh protected session, but
     56                using SMB/CIFS authentication to negotiate encryption and
     57                signing keys. Currently this is only supported smbclient of by
     58                Samba 3.2 and newer, and hopefully soon Linux CIFSFS and MacOS/X
     59                clients. Windows clients do not support this feature.
     60                </para>
     61
     62                <para>This may be set on a per-share
     63                basis, but clients may chose to encrypt the entire session, not
     64                just traffic to a specific share. If this is set to mandatory
     65                then all traffic to a share <emphasis>must</emphasis>
     66                be encrypted once the connection has been made to the share.
     67                The server would return "access denied" to all non-encrypted
     68                requests on such a share. Selecting encrypted traffic reduces
     69                throughput as smaller packet sizes must be used (no huge UNIX
     70                style read/writes allowed) as well as the overhead of encrypting
     71                and signing all the data.
     72                </para>
     73
     74                <para>
     75                If SMB encryption is selected, Windows style SMB signing (see
     76                the <smbconfoption name="server signing"/> option) is no longer
     77                necessary, as the GSSAPI flags use select both signing and
     78                sealing of the data.
     79                </para>
     80
     81                <para>
     82                When set to auto or default, SMB encryption is offered, but not
     83                enforced.  When set to mandatory, SMB encryption is required and
     84                if set to disabled, SMB encryption can not be negotiated.
     85                </para>
     86                </listitem>
     87                </varlistentry>
     88
     89                <varlistentry>
     90                <term><emphasis>Effects for SMB2</emphasis></term>
     91                <listitem>
     92                <para>
     93                Native SMB transport encryption is available in SMB version 3.0
     94                or newer. It is only offered by Samba if
     95                <emphasis>server max protocol</emphasis> is set to
     96                <emphasis>SMB3</emphasis> or newer.
     97                Clients supporting this type of encryption include
     98                Windows 8 and newer,
     99                Windows server 2012 and newer,
     100                and smbclient of Samba 4.1 and newer.
     101                </para>
     102
     103                <para>
     104                The protocol implementation offers various options:
     105                </para>
     106
     107                <itemizedlist>
     108                        <listitem>
     109                        <para>
     110                        The capability to perform SMB encryption can be
     111                        negotiated during protocol negotiation.
     112                        </para>
     113                        </listitem>
     114
     115                        <listitem>
     116                        <para>
     117                        Data encryption can be enabled globally. In that case,
     118                        an encryption-capable connection will have all traffic
     119                        in all its sessions encrypted. In particular all share
     120                        connections will be encrypted.
     121                        </para>
     122                        </listitem>
     123
     124                        <listitem>
     125                        <para>
     126                        Data encryption can also be enabled per share if not
     127                        enabled globally. For an encryption-capable connection,
     128                        all connections to an encryption-enabled share will be
     129                        encrypted.
     130                        </para>
     131                        </listitem>
     132
     133                        <listitem>
     134                        <para>
     135                        Encryption can be enforced. This means that session
     136                        setups will be denied on non-encryption-capable
     137                        connections if data encryption has been enabled
     138                        globally. And tree connections will be denied for
     139                        non-encryption capable connections to shares with data
     140                        encryption enabled.
     141                        </para>
     142                        </listitem>
     143                </itemizedlist>
     144
     145                <para>
     146                These features can be controlled with settings of
     147                <emphasis>smb encrypt</emphasis> as follows:
     148                </para>
     149
     150                <itemizedlist>
     151                        <listitem>
     152                        <para>
     153                        Leaving it as default, explicitly setting
     154                        <emphasis>default</emphasis>, or setting it to
     155                        <emphasis>enabled</emphasis> globally will enable
     156                        negotiation of encryption but will not turn on
     157                        data encryption globally or per share.
     158                        </para>
     159                        </listitem>
     160
     161                        <listitem>
     162                        <para>
     163                        Setting it to <emphasis>desired</emphasis> globally
     164                        will enable negotiation and will turn on data encryption
     165                        on sessions and share connections for those clients
     166                        that support it.
     167                        </para>
     168                        </listitem>
     169
     170                        <listitem>
     171                        <para>
     172                        Setting it to <emphasis>required</emphasis> globally
     173                        will enable negotiation and turn on data encryption
     174                        on sessions and share connections. Clients that do
     175                        not support encryption will be denied access to the
     176                        server.
     177                        </para>
     178                        </listitem>
     179
     180                        <listitem>
     181                        <para>
     182                        Setting it to <emphasis>off</emphasis> globally will
     183                        completely disable the encryption feature.
     184                        </para>
     185                        </listitem>
     186
     187                        <listitem>
     188                        <para>
     189                        Setting it to <emphasis>desired</emphasis> on a share
     190                        will turn on data encryption for this share for clients
     191                        that support encryption if negotiation has been
     192                        enabled globally.
     193                        </para>
     194                        </listitem>
     195
     196                        <listitem>
     197                        <para>
     198                        Setting it to <emphasis>required</emphasis> on a share
     199                        will enforce data encryption for this share if
     200                        negotiation has been enabled globally. I.e. clients that
     201                        do not support encryption will be denied access to the
     202                        share.
     203                        </para>
     204                        <para>
     205                        Note that this allows per-share enforcing to be
     206                        controlled in Samba differently from Windows:
     207                        In Windows, <emphasis>RejectUnencryptedAccess</emphasis>
     208                        is a global setting, and if it is set, all shares with
     209                        data encryption turned on
     210                        are automatically enforcing encryption. In order to
     211                        achieve the same effect in Samba, one
     212                        has to globally set <emphasis>smb encrypt</emphasis> to
     213                        <emphasis>enabled</emphasis>, and then set all shares
     214                        that should be encrypted to
     215                        <emphasis>required</emphasis>.
     216                        Additionally, it is possible in Samba to have some
     217                        shares with encryption <emphasis>required</emphasis>
     218                        and some other shares with encryption only
     219                        <emphasis>desired</emphasis>, which is not possible in
     220                        Windows.
     221                        </para>
     222                        </listitem>
     223
     224                        <listitem>
     225                        <para>
     226                        Setting it to <emphasis>off</emphasis> or
     227                        <emphasis>enabled</emphasis> for a share has
     228                        no effect.
     229                        </para>
     230                        </listitem>
     231                </itemizedlist>
     232                </listitem>
     233                </varlistentry>
     234        </variablelist>
    41235</description>
    42236
    43 <value type="default">auto</value>
     237<value type="default">default</value>
    44238</samba:parameter>

  • vendor/current/docs-xml/smbdotconf/security/smbpasswdfile.xml

    r414 r988  
    11<samba:parameter name="smb passwd file"
    2         type="string"
     2                 type="string"
    33                 context="G"
    4                  advanced="1" developer="1"
    5                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
     4                 constant="1"
     5                xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    66<description>
    77    <para>This option sets the path to the encrypted smbpasswd file. By
    … …  
    1616</description>
    1717
    18 <value type="default">${prefix}/private/smbpasswd</value>
     18<value type="default">&pathconfig.SMB_PASSWD_FILE;</value>
    1919</samba:parameter>

  • vendor/current/docs-xml/smbdotconf/security/unixpasswordsync.xml

    r414 r988  
    11<samba:parameter name="unix password sync"
    22                 context="G"
    3                                  type="boolean"
    4                  advanced="1" developer="1"
     3                 type="boolean"
    54                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>

  • vendor/current/docs-xml/smbdotconf/security/username.xml

    r740 r988  
    11<samba:parameter name="username"
    2         context="S"
    3         type="string"
     2                 context="S"
     3                 type="string"
     4                 deprecated="1"
    45                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    56<synonym>user</synonym>
    67<synonym>users</synonym>
    78<description>
    8     <para>Multiple users may be specified in a comma-delimited
    9     list, in which case the supplied password will be tested against
    10     each username in turn (left to right).</para>
    11 
    12     <para>The deprecated <parameter moreinfo="none">username</parameter> line is needed only when
    13     the PC is unable to supply its own username. This is the case
    14     for the COREPLUS protocol or where your users have different WfWg
    15     usernames to UNIX usernames. In both these cases you may also be
    16     better using the \\server\share%user syntax instead.</para>
    17 
    18     <para>The <parameter moreinfo="none">username</parameter> line is not a great
    19     solution in many cases as it means Samba will try to validate
    20     the supplied password against each of the usernames in the
    21     <parameter moreinfo="none">username</parameter> line in turn. This is slow and
    22     a bad idea for lots of users in case of duplicate passwords.
    23     You may get timeouts or security breaches using this parameter
    24     unwisely.</para>
    25 
    26     <para>Samba relies on the underlying UNIX security. This
    27     parameter does not restrict who can login, it just offers hints
    28     to the Samba server as to what usernames might correspond to the
    29     supplied password. Users can login as whoever they please and
    30     they will be able to do no more damage than if they started a
    31     telnet session. The daemon runs as the user that they log in as,
    32     so they cannot do anything that user cannot do.</para>
    33 
    349    <para>To restrict a service to a particular set of users you
    3510    can use the <smbconfoption name="valid users"/> parameter.</para>
    3611
    37     <para>If any of the usernames begin with a '@' then the name
    38     will be looked up first in the NIS netgroups list (if Samba
    39     is compiled with netgroup support), followed by a lookup in
    40     the UNIX groups database and will expand to a list of all users
    41     in the group of that name.</para>
    42                
    43     <para>If any of the usernames begin with a '+' then the name
    44     will be looked up only in the UNIX groups database and will
    45     expand to a list of all users in the group of that name.</para>
     12    <para>This parameter is deprecated</para>
    4613
    47     <para>If any of the usernames begin with a '&amp;' then the name
    48     will be looked up only in the NIS netgroups database (if Samba
    49     is compiled with netgroup support) and will expand to a list
    50     of all users in the netgroup group of that name.</para>
     14    <para>However, it currently operates only in conjunction with
     15    <smbconfoption name="only user"/>.  The supported way to restrict
     16    a service to a particular set of users is the
     17    <smbconfoption name="valid users"/> parameter.</para>
    5118
    52     <para>Note that searching though a groups database can take
    53     quite some time, and some clients may time out during the
    54     search.</para>
    55 
    56     <para>See the section <link linkend="VALIDATIONSECT">NOTE ABOUT
    57         USERNAME/PASSWORD VALIDATION</link> for more information on how
    58         this parameter determines access to the services.</para>
    5919</description>
    6020

  • vendor/current/docs-xml/smbdotconf/security/usernamelevel.xml

    r414 r988  
    11<samba:parameter name="username level"
    22                 context="G"
    3                  advanced="1" developer="1"
    4                                  type="integer"
     3                 type="integer"
    54                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>

  • vendor/current/docs-xml/smbdotconf/security/usernamemap.xml

    r414 r988  
    11<samba:parameter name="username map"
    22                 context="G"
    3                  advanced="1" developer="1"
    4                                  type="string"
     3                 type="string"
    54                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>
    … …  
    1312
    1413    <para>
    15         Please note that for user or share mode security, the username map is applied prior to validating the user
     14        Please note that for user mode security, the username map is applied prior to validating the user
    1615        credentials.  Domain member servers (domain or ads) apply the username map after the user has been
    17         successfully authenticated by the domain controller and require fully qualified enties in the map table (e.g.
     16        successfully authenticated by the domain controller and require fully qualified entries in the map table (e.g.
    1817        biddle = <literal>DOMAIN\foo</literal>).
    1918        </para>
    … …  
    8584        <constant>fred</constant> is remapped to <constant>mary</constant> then you will actually be connecting to
    8685        \\server\mary and will need to supply a password suitable for <constant>mary</constant> not
    87         <constant>fred</constant>. The only exception to this is the username passed to the <smbconfoption
    88         name="password server"/> (if you have one). The password server will receive whatever username the client
     86        <constant>fred</constant>. The only exception to this is the
     87        username passed to a Domain Controller (if you have one). The DC will receive whatever username the client
    8988        supplies without  modification.
    9089    </para>

  • vendor/current/docs-xml/smbdotconf/security/usernamemapcachetime.xml

    r740 r988  
    11<samba:parameter name="username map cache time"
    22                 context="G"
    3                  advanced="1" developer="0"
    4                                  type="integer"
     3                 type="integer"
    54                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>

  • vendor/current/docs-xml/smbdotconf/security/usernamemapscript.xml

    r414 r988  
    11<samba:parameter name="username map script"
    22                 context="G"
    3                  type="string"
    4                  advanced="1" developer="1"
     3                 type="string"
    54                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    65<description>
    … …  
    98        specifies and external program or script that must accept a single
    109        command line option (the username transmitted in the authentication
    11         request) and return a line line on standard output (the name to which
     10        request) and return a line on standard output (the name to which
    1211        the account should mapped).  In this way, it is possible to store
    1312        username map tables in an LDAP or NIS directory services.

  • vendor/current/docs-xml/smbdotconf/security/validusers.xml

    r414 r988  
    11<samba:parameter name="valid users"
    22                 context="S"
    3                                  type="list"
     3                 type="cmdlist"
    44                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    55<description>
    … …  
    2020    This is useful in the [homes] section.
    2121    </para>
     22
     23    <para><emphasis>Note: </emphasis>When used in the [global] section this
     24    parameter may have unwanted side effects. For example: If samba is configured as a MASTER BROWSER (see
     25    <parameter moreinfo="none">local master</parameter>,
     26    <parameter moreinfo="none">os level</parameter>,
     27    <parameter moreinfo="none">domain master</parameter>,
     28    <parameter moreinfo="none">preferred master</parameter>) this option
     29    will prevent workstations from being able to browse the network.
     30    </para>
     31
    2232</description>
    2333

  • vendor/current/docs-xml/smbdotconf/security/writeable.xml

    r414 r988  
    11<samba:parameter name="writeable"
    22                 context="S"
    3                                  type="boolean"
     3                 type="boolean-rev"
     4                 function="read_only"
     5                 synonym="1"
    46                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    57<synonym>writable</synonym>
     8<synonym>write ok</synonym>
    69<description>
    710    <para>Inverted synonym for <smbconfoption name="read only"/>.</para>

  • vendor/current/docs-xml/smbdotconf/security/writelist.xml

    r414 r988  
    11<samba:parameter name="write list"
    22                 context="S"
    3                                  type="list"
     3                 type="cmdlist"
    44                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
    55<description>
    … …  
    1616    </para>
    1717
    18     <para>
    19     By design, this parameter will not work with the
    20     <smbconfoption name="security">share</smbconfoption> in Samba 3.0.
    21     </para>
    22 
    2318</description>
    2419
Note: See TracChangeset for help on using the changeset viewer.