docs/htmldocs/smb.conf.5.html

   1 <HTML
   2 ><HEAD
   3 ><TITLE
   4 >smb.conf</TITLE
   5 ><META
   6 NAME="GENERATOR"
   7 CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD
   8 ><BODY
   9 CLASS="REFENTRY"
  10 BGCOLOR="#FFFFFF"
  11 TEXT="#000000"
  12 LINK="#0000FF"
  13 VLINK="#840084"
  14 ALINK="#0000FF"
  15 ><H1
  16 ><A
  17 NAME="SMB.CONF"
  18 >smb.conf</A
  19 ></H1
  20 ><DIV
  21 CLASS="REFNAMEDIV"
  22 ><A
  23 NAME="AEN5"
  24 ></A
  25 ><H2
  26 >Name</H2
  27 >smb.conf&nbsp;--&nbsp;The configuration file for the Samba suite</DIV
  28 ><DIV
  29 CLASS="REFSECT1"
  30 ><A
  31 NAME="AEN8"
  32 ></A
  33 ><H2
  34 >SYNOPSIS</H2
  35 ><P
  36 >The <TT
  37 CLASS="FILENAME"
  38 >smb.conf</TT
  39 > file is a configuration
  40         file for the Samba suite. <TT
  41 CLASS="FILENAME"
  42 >smb.conf</TT
  43 > contains
  44         runtime configuration information for the Samba programs. The
  45         <TT
  46 CLASS="FILENAME"
  47 >smb.conf</TT
  48 > file is designed to be configured and
  49         administered by the <A
  50 HREF="swat.8.html"
  51 TARGET="_top"
  52 ><B
  53 CLASS="COMMAND"
  54 >swat(8)</B
  55 >
  56         </A
  57 > program. The complete description of the file format and
  58         possible parameters held within are here for reference purposes.</P
  59 ></DIV
  60 ><DIV
  61 CLASS="REFSECT1"
  62 ><A
  63 NAME="AEN16"
  64 ></A
  65 ><H2
  66 >FILE FORMAT</H2
  67 ><P
  68 >The file consists of sections and parameters. A section
  69         begins with the name of the section in square brackets and continues
  70         until the next section begins. Sections contain parameters of the
  71         form</P
  72 ><P
  73 ><TT
  74 CLASS="REPLACEABLE"
  75 ><I
  76 >name</I
  77 ></TT
  78 > = <TT
  79 CLASS="REPLACEABLE"
  80 ><I
  81 >value
  82         </I
  83 ></TT
  84 ></P
  85 ><P
  86 >The file is line-based - that is, each newline-terminated
  87         line represents either a comment, a section name or a parameter.</P
  88 ><P
  89 >Section and parameter names are not case sensitive.</P
  90 ><P
  91 >Only the first equals sign in a parameter is significant.
  92         Whitespace before or after the first equals sign is discarded.
  93         Leading, trailing and internal whitespace in section and parameter
  94         names is irrelevant. Leading and trailing whitespace in a parameter
  95         value is discarded. Internal whitespace within a parameter value
  96         is retained verbatim.</P
  97 ><P
  98 >Any line beginning with a semicolon (';') or a hash ('#')
  99         character is ignored, as are lines containing only whitespace.</P
 100 ><P
 101 >Any line ending in a '\' is continued
 102         on the next line in the customary UNIX fashion.</P
 103 ><P
 104 >The values following the equals sign in parameters are all
 105         either a string (no quotes needed) or a boolean, which may be given
 106         as yes/no, 0/1 or true/false. Case is not significant in boolean
 107         values, but is preserved in string values. Some items such as
 108         create modes are numeric.</P
 109 ></DIV
 110 ><DIV
 111 CLASS="REFSECT1"
 112 ><A
 113 NAME="AEN28"
 114 ></A
 115 ><H2
 116 >SECTION DESCRIPTIONS</H2
 117 ><P
 118 >Each section in the configuration file (except for the
 119         [global] section) describes a shared resource (known
 120         as a "share"). The section name is the name of the
 121         shared resource and the parameters within the section define
 122         the shares attributes.</P
 123 ><P
 124 >There are three special sections, [global],
 125         [homes] and [printers], which are
 126         described under <EM
 127 >special sections</EM
 128 >. The
 129         following notes apply to ordinary section descriptions.</P
 130 ><P
 131 >A share consists of a directory to which access is being
 132         given plus a description of the access rights which are granted
 133         to the user of the service. Some housekeeping options are
 134         also specifiable.</P
 135 ><P
 136 >Sections are either file share services (used by the
 137         client as an extension of their native file systems) or
 138         printable services (used by the client to access print services
 139         on the host running the server).</P
 140 ><P
 141 >Sections may be designated <EM
 142 >guest</EM
 143 > services,
 144         in which case no password is required to access them. A specified
 145         UNIX <EM
 146 >guest account</EM
 147 > is used to define access
 148         privileges in this case.</P
 149 ><P
 150 >Sections other than guest services will require a password
 151         to access them. The client provides the username. As older clients
 152         only provide passwords and not usernames, you may specify a list
 153         of usernames to check against the password using the "user="
 154         option in the share definition. For modern clients such as
 155         Windows 95/98/ME/NT/2000, this should not be necessary.</P
 156 ><P
 157 >Note that the access rights granted by the server are
 158         masked by the access rights granted to the specified or guest
 159         UNIX user by the host system. The server does not grant more
 160         access than the host system grants.</P
 161 ><P
 162 >The following sample section defines a file space share.
 163         The user has write access to the path <TT
 164 CLASS="FILENAME"
 165 >/home/bar</TT
 166 >.
 167         The share is accessed via the share name "foo":</P
 168 ><TABLE
 169 BORDER="0"
 170 BGCOLOR="#E0E0E0"
 171 WIDTH="100%"
 172 ><TR
 173 ><TD
 174 ><PRE
 175 CLASS="SCREEN"
 176 >       <TT
 177 CLASS="COMPUTEROUTPUT"
 178 >       [foo]
 179                 path = /home/bar
 180                 writeable = true
 181         </TT
 182 >
 183         </PRE
 184 ></TD
 185 ></TR
 186 ></TABLE
 187 ><P
 188 >The following sample section defines a printable share.
 189         The share is readonly, but printable. That is, the only write
 190         access permitted is via calls to open, write to and close a
 191         spool file. The <EM
 192 >guest ok</EM
 193 > parameter means
 194         access will be permitted as the default guest user (specified
 195         elsewhere):</P
 196 ><TABLE
 197 BORDER="0"
 198 BGCOLOR="#E0E0E0"
 199 WIDTH="100%"
 200 ><TR
 201 ><TD
 202 ><PRE
 203 CLASS="SCREEN"
 204 >       <TT
 205 CLASS="COMPUTEROUTPUT"
 206 >       [aprinter]
 207                 path = /usr/spool/public
 208                 writeable = false
 209                 printable = true
 210                 guest ok = true
 211         </TT
 212 >
 213         </PRE
 214 ></TD
 215 ></TR
 216 ></TABLE
 217 ></DIV
 218 ><DIV
 219 CLASS="REFSECT1"
 220 ><A
 221 NAME="AEN48"
 222 ></A
 223 ><H2
 224 >SPECIAL SECTIONS</H2
 225 ><DIV
 226 CLASS="REFSECT2"
 227 ><A
 228 NAME="AEN50"
 229 ></A
 230 ><H3
 231 >The [global] section</H3
 232 ><P
 233 >parameters in this section apply to the server
 234                 as a whole, or are defaults for sections which do not
 235                 specifically define certain items. See the notes
 236                 under PARAMETERS for more information.</P
 237 ></DIV
 238 ><DIV
 239 CLASS="REFSECT2"
 240 ><A
 241 NAME="AEN53"
 242 ></A
 243 ><H3
 244 >The [homes] section</H3
 245 ><P
 246 >If a section called homes is included in the
 247                 configuration file, services connecting clients to their
 248                 home directories can be created on the fly by the server.</P
 249 ><P
 250 >When the connection request is made, the existing
 251                 sections are scanned. If a match is found, it is used. If no
 252                 match is found, the requested section name is treated as a
 253                 user name and looked up in the local password file. If the
 254                 name exists and the correct password has been given, a share is
 255                 created by cloning the [homes] section.</P
 256 ><P
 257 >Some modifications are then made to the newly
 258                 created share:</P
 259 ><P
 260 ></P
 261 ><UL
 262 ><LI
 263 ><P
 264 >The share name is changed from homes to
 265                 the located username.</P
 266 ></LI
 267 ><LI
 268 ><P
 269 >If no path was given, the path is set to
 270                 the user's home directory.</P
 271 ></LI
 272 ></UL
 273 ><P
 274 >If you decide to use a <EM
 275 >path=</EM
 276 > line
 277                 in your [homes] section then you may find it useful
 278                 to use the %S macro. For example :</P
 279 ><P
 280 ><TT
 281 CLASS="USERINPUT"
 282 ><B
 283 >path=/data/pchome/%S</B
 284 ></TT
 285 ></P
 286 ><P
 287 >would be useful if you have different home directories
 288                 for your PCs than for UNIX access.</P
 289 ><P
 290 >This is a fast and simple way to give a large number
 291                 of clients access to their home directories with a minimum
 292                 of fuss.</P
 293 ><P
 294 >A similar process occurs if the requested section
 295                 name is "homes", except that the share name is not
 296                 changed to that of the requesting user. This method of using
 297                 the [homes] section works well if different users share
 298                 a client PC.</P
 299 ><P
 300 >The [homes] section can specify all the parameters
 301                 a normal service section can specify, though some make more sense
 302                 than others. The following is a typical and suitable [homes]
 303                 section:</P
 304 ><TABLE
 305 BORDER="0"
 306 BGCOLOR="#E0E0E0"
 307 WIDTH="100%"
 308 ><TR
 309 ><TD
 310 ><PRE
 311 CLASS="SCREEN"
 312 >               <TT
 313 CLASS="COMPUTEROUTPUT"
 314 >               [homes]
 315                         writeable = yes
 316                 </TT
 317 >
 318                 </PRE
 319 ></TD
 320 ></TR
 321 ></TABLE
 322 ><P
 323 >An important point is that if guest access is specified
 324                 in the [homes] section, all home directories will be
 325                 visible to all clients <EM
 326 >without a password</EM
 327 >.
 328                 In the very unlikely event that this is actually desirable, it
 329                 would be wise to also specify <EM
 330 >read only
 331                 access</EM
 332 >.</P
 333 ><P
 334 >Note that the <EM
 335 >browseable</EM
 336 > flag for
 337                 auto home directories will be inherited from the global browseable
 338                 flag, not the [homes] browseable flag. This is useful as
 339                 it means setting browseable=no in the [homes] section
 340                 will hide the [homes] share but make any auto home
 341                 directories visible.</P
 342 ></DIV
 343 ><DIV
 344 CLASS="REFSECT2"
 345 ><A
 346 NAME="AEN78"
 347 ></A
 348 ><H3
 349 >The [printers] section</H3
 350 ><P
 351 >This section works like [homes],
 352                 but for printers.</P
 353 ><P
 354 >If a [printers] section occurs in the
 355                 configuration file, users are able to connect to any printer
 356                 specified in the local host's printcap file.</P
 357 ><P
 358 >When a connection request is made, the existing sections
 359                 are scanned. If a match is found, it is used. If no match is found,
 360                 but a [homes] section exists, it is used as described
 361                 above. Otherwise, the requested section name is treated as a
 362                 printer name and the appropriate printcap file is scanned to see
 363                 if the requested section name is a valid printer share name. If
 364                 a match is found, a new printer share is created by cloning
 365                 the [printers] section.</P
 366 ><P
 367 >A few modifications are then made to the newly created
 368                 share:</P
 369 ><P
 370 ></P
 371 ><UL
 372 ><LI
 373 ><P
 374 >The share name is set to the located printer
 375                 name</P
 376 ></LI
 377 ><LI
 378 ><P
 379 >If no printer name was given, the printer name
 380                 is set to the located printer name</P
 381 ></LI
 382 ><LI
 383 ><P
 384 >If the share does not permit guest access and
 385                 no username was given, the username is set to the located
 386                 printer name.</P
 387 ></LI
 388 ></UL
 389 ><P
 390 >Note that the [printers] service MUST be
 391                 printable - if you specify otherwise, the server will refuse
 392                 to load the configuration file.</P
 393 ><P
 394 >Typically the path specified would be that of a
 395                 world-writeable spool directory with the sticky bit set on
 396                 it. A typical [printers] entry would look like
 397                 this:</P
 398 ><TABLE
 399 BORDER="0"
 400 BGCOLOR="#E0E0E0"
 401 WIDTH="100%"
 402 ><TR
 403 ><TD
 404 ><PRE
 405 CLASS="SCREEN"
 406 ><TT
 407 CLASS="COMPUTEROUTPUT"
 408 >               [printers]
 409                         path = /usr/spool/public
 410                         guest ok = yes
 411                         printable = yes
 412                 </TT
 413 ></PRE
 414 ></TD
 415 ></TR
 416 ></TABLE
 417 ><P
 418 >All aliases given for a printer in the printcap file
 419                 are legitimate printer names as far as the server is concerned.
 420                 If your printing subsystem doesn't work like that, you will have
 421                 to set up a pseudo-printcap. This is a file consisting of one or
 422                 more lines like this:</P
 423 ><TABLE
 424 BORDER="0"
 425 BGCOLOR="#E0E0E0"
 426 WIDTH="100%"
 427 ><TR
 428 ><TD
 429 ><PRE
 430 CLASS="SCREEN"
 431 >               <TT
 432 CLASS="COMPUTEROUTPUT"
 433 >               alias|alias|alias|alias...
 434                 </TT
 435 >
 436                 </PRE
 437 ></TD
 438 ></TR
 439 ></TABLE
 440 ><P
 441 >Each alias should be an acceptable printer name for
 442                 your printing subsystem. In the [global] section, specify
 443                 the new file as your printcap.  The server will then only recognize
 444                 names found in your pseudo-printcap, which of course can contain
 445                 whatever aliases you like. The same technique could be used
 446                 simply to limit access to a subset of your local printers.</P
 447 ><P
 448 >An alias, by the way, is defined as any component of the
 449                 first entry of a printcap record. Records are separated by newlines,
 450                 components (if there are more than one) are separated by vertical
 451                 bar symbols ('|').</P
 452 ><P
 453 >NOTE: On SYSV systems which use lpstat to determine what
 454                 printers are defined on the system you may be able to use
 455                 "printcap name = lpstat" to automatically obtain a list
 456                 of printers. See the "printcap name" option
 457                 for more details.</P
 458 ></DIV
 459 ></DIV
 460 ><DIV
 461 CLASS="REFSECT1"
 462 ><A
 463 NAME="AEN101"
 464 ></A
 465 ><H2
 466 >PARAMETERS</H2
 467 ><P
 468 >parameters define the specific attributes of sections.</P
 469 ><P
 470 >Some parameters are specific to the [global] section
 471         (e.g., <EM
 472 >security</EM
 473 >).  Some parameters are usable
 474         in all sections (e.g., <EM
 475 >create mode</EM
 476 >). All others
 477         are permissible only in normal sections. For the purposes of the
 478         following descriptions the [homes] and [printers]
 479         sections will be considered normal.  The letter <EM
 480 >G</EM
 481 >
 482         in parentheses indicates that a parameter is specific to the
 483         [global] section. The letter <EM
 484 >S</EM
 485 >
 486         indicates that a parameter can be specified in a service specific
 487         section. Note that all <EM
 488 >S</EM
 489 > parameters can also be specified in
 490         the [global] section - in which case they will define
 491         the default behavior for all services.</P
 492 ><P
 493 >parameters are arranged here in alphabetical order - this may
 494         not create best bedfellows, but at least you can find them! Where
 495         there are synonyms, the preferred synonym is described, others refer
 496         to the preferred synonym.</P
 497 ></DIV
 498 ><DIV
 499 CLASS="REFSECT1"
 500 ><A
 501 NAME="AEN111"
 502 ></A
 503 ><H2
 504 >VARIABLE SUBSTITUTIONS</H2
 505 ><P
 506 >Many of the strings that are settable in the config file
 507         can take substitutions. For example the option "path =
 508         /tmp/%u" would be interpreted as "path =
 509         /tmp/john" if the user connected with the username john.</P
 510 ><P
 511 >These substitutions are mostly noted in the descriptions below,
 512         but there are some general substitutions which apply whenever they
 513         might be relevant. These are:</P
 514 ><P
 515 ></P
 516 ><DIV
 517 CLASS="VARIABLELIST"
 518 ><DL
 519 ><DT
 520 >%S</DT
 521 ><DD
 522 ><P
 523 >the name of the current service, if any.</P
 524 ></DD
 525 ><DT
 526 >%P</DT
 527 ><DD
 528 ><P
 529 >the root directory of the current service,
 530                 if any.</P
 531 ></DD
 532 ><DT
 533 >%u</DT
 534 ><DD
 535 ><P
 536 >user name of the current service, if any.</P
 537 ></DD
 538 ><DT
 539 >%g</DT
 540 ><DD
 541 ><P
 542 >primary group name of %u.</P
 543 ></DD
 544 ><DT
 545 >%U</DT
 546 ><DD
 547 ><P
 548 >session user name (the user name that the client
 549                 wanted, not necessarily the same as the one they got).</P
 550 ></DD
 551 ><DT
 552 >%G</DT
 553 ><DD
 554 ><P
 555 >primary group name of %U.</P
 556 ></DD
 557 ><DT
 558 >%H</DT
 559 ><DD
 560 ><P
 561 >the home directory of the user given
 562                 by %u.</P
 563 ></DD
 564 ><DT
 565 >%v</DT
 566 ><DD
 567 ><P
 568 >the Samba version.</P
 569 ></DD
 570 ><DT
 571 >%h</DT
 572 ><DD
 573 ><P
 574 >the Internet hostname that Samba is running
 575                 on.</P
 576 ></DD
 577 ><DT
 578 >%m</DT
 579 ><DD
 580 ><P
 581 >the NetBIOS name of the client machine
 582                 (very useful).</P
 583 ></DD
 584 ><DT
 585 >%L</DT
 586 ><DD
 587 ><P
 588 >the NetBIOS name of the server. This allows you
 589                 to change your config based on what the client calls you. Your
 590                 server can have a "dual personality".</P
 591 ></DD
 592 ><DT
 593 >%M</DT
 594 ><DD
 595 ><P
 596 >the Internet name of the client machine.
 597                 </P
 598 ></DD
 599 ><DT
 600 >%N</DT
 601 ><DD
 602 ><P
 603 >the name of your NIS home directory server.
 604                 This is obtained from your NIS auto.map entry.  If you have
 605                 not compiled Samba with the <EM
 606 >--with-automount</EM
 607 >
 608                 option then this value will be the same as %.</P
 609 ></DD
 610 ><DT
 611 >%p</DT
 612 ><DD
 613 ><P
 614 >the path of the service's home directory,
 615                 obtained from your NIS auto.map entry. The NIS auto.map entry
 616                 is split up as "%N:%p".</P
 617 ></DD
 618 ><DT
 619 >%R</DT
 620 ><DD
 621 ><P
 622 >the selected protocol level after
 623                 protocol negotiation. It can be one of CORE, COREPLUS,
 624                 LANMAN1, LANMAN2 or NT1.</P
 625 ></DD
 626 ><DT
 627 >%d</DT
 628 ><DD
 629 ><P
 630 >The process id of the current server
 631                 process.</P
 632 ></DD
 633 ><DT
 634 >%a</DT
 635 ><DD
 636 ><P
 637 >the architecture of the remote
 638                 machine. Only some are recognized, and those may not be
 639                 100% reliable. It currently recognizes Samba, WfWg,
 640                 WinNT and Win95. Anything else will be known as
 641                 "UNKNOWN". If it gets it wrong then sending a level
 642                 3 log to <A
 643 HREF="mailto:samba@samba.org"
 644 TARGET="_top"
 645 >samba@samba.org
 646                 </A
 647 > should allow it to be fixed.</P
 648 ></DD
 649 ><DT
 650 >%I</DT
 651 ><DD
 652 ><P
 653 >The IP address of the client machine.</P
 654 ></DD
 655 ><DT
 656 >%T</DT
 657 ><DD
 658 ><P
 659 >the current date and time.</P
 660 ></DD
 661 ><DT
 662 >%$(<TT
 663 CLASS="REPLACEABLE"
 664 ><I
 665 >envvar</I
 666 ></TT
 667 >)</DT
 668 ><DD
 669 ><P
 670 >The value of the environment variable
 671                 <TT
 672 CLASS="REPLACEABLE"
 673 ><I
 674 >envar</I
 675 ></TT
 676 >.</P
 677 ></DD
 678 ></DL
 679 ></DIV
 680 ><P
 681 >There are some quite creative things that can be done
 682         with these substitutions and other smb.conf options.</P
 683 ></DIV
 684 ><DIV
 685 CLASS="REFSECT1"
 686 ><A
 687 NAME="AEN201"
 688 ></A
 689 ><H2
 690 >NAME MANGLING</H2
 691 ><P
 692 >Samba supports "name mangling" so that DOS and
 693         Windows clients can use files that don't conform to the 8.3 format.
 694         It can also be set to adjust the case of 8.3 format filenames.</P
 695 ><P
 696 >There are several options that control the way mangling is
 697         performed, and they are grouped here rather than listed separately.
 698         For the defaults look at the output of the testparm program. </P
 699 ><P
 700 >All of these options can be set separately for each service
 701         (or globally, of course). </P
 702 ><P
 703 >The options are: </P
 704 ><P
 705 ></P
 706 ><DIV
 707 CLASS="VARIABLELIST"
 708 ><DL
 709 ><DT
 710 >mangle case= yes/no</DT
 711 ><DD
 712 ><P
 713 > controls if names that have characters that
 714                 aren't of the "default" case are mangled. For example,
 715                 if this is yes then a name like "Mail" would be mangled.
 716                 Default <EM
 717 >no</EM
 718 >.</P
 719 ></DD
 720 ><DT
 721 >case sensitive = yes/no</DT
 722 ><DD
 723 ><P
 724 >controls whether filenames are case sensitive. If
 725                 they aren't then Samba must do a filename search and match on passed
 726                 names. Default <EM
 727 >no</EM
 728 >.</P
 729 ></DD
 730 ><DT
 731 >default case = upper/lower</DT
 732 ><DD
 733 ><P
 734 >controls what the default case is for new
 735                 filenames. Default <EM
 736 >lower</EM
 737 >.</P
 738 ></DD
 739 ><DT
 740 >preserve case = yes/no</DT
 741 ><DD
 742 ><P
 743 >controls if new files are created with the
 744                 case that the client passes, or if they are forced to be the
 745                 "default" case. Default <EM
 746 >yes</EM
 747 >.
 748                 </P
 749 ></DD
 750 ><DT
 751 >short preserve case = yes/no</DT
 752 ><DD
 753 ><P
 754 >controls if new files which conform to 8.3 syntax,
 755                 that is all in upper case and of suitable length, are created
 756                 upper case, or if they are forced to be the "default"
 757                 case. This option can be use with "preserve case = yes"
 758                 to permit long filenames to retain their case, while short names
 759                 are lowered. Default <EM
 760 >yes</EM
 761 >.</P
 762 ></DD
 763 ></DL
 764 ></DIV
 765 ><P
 766 >By default, Samba 2.2 has the same semantics as a Windows
 767         NT server, in that it is case insensitive but case preserving.</P
 768 ></DIV
 769 ><DIV
 770 CLASS="REFSECT1"
 771 ><A
 772 NAME="AEN234"
 773 ></A
 774 ><H2
 775 >NOTE ABOUT USERNAME/PASSWORD VALIDATION</H2
 776 ><P
 777 >There are a number of ways in which a user can connect
 778         to a service. The server uses the following steps in determining
 779         if it will allow a connection to a specified service. If all the
 780         steps fail, then the connection request is rejected.  However, if one of the
 781         steps succeeds, then the following steps are not checked.</P
 782 ><P
 783 >If the service is marked "guest only = yes" then
 784         steps 1 to 5 are skipped.</P
 785 ><P
 786 ></P
 787 ><OL
 788 TYPE="1"
 789 ><LI
 790 ><P
 791 >If the client has passed a username/password
 792                 pair and that username/password pair is validated by the UNIX
 793                 system's password programs then the connection is made as that
 794                 username. Note that this includes the
 795                 \\server\service%<TT
 796 CLASS="REPLACEABLE"
 797 ><I
 798 >username</I
 799 ></TT
 800 > method of passing
 801                 a username.</P
 802 ></LI
 803 ><LI
 804 ><P
 805 >If the client has previously registered a username
 806                 with the system and now supplies a correct password for that
 807                 username then the connection is allowed.</P
 808 ></LI
 809 ><LI
 810 ><P
 811 >The client's netbios name and any previously
 812                 used user names are checked against the supplied password, if
 813                 they match then the connection is allowed as the corresponding
 814                 user.</P
 815 ></LI
 816 ><LI
 817 ><P
 818 >If the client has previously validated a
 819                 username/password pair with the server and the client has passed
 820                 the validation token then that username is used. </P
 821 ></LI
 822 ><LI
 823 ><P
 824 >If a "user = " field is given in the
 825                 <TT
 826 CLASS="FILENAME"
 827 >smb.conf</TT
 828 > file for the service and the client
 829                 has supplied a password, and that password matches (according to
 830                 the UNIX system's password checking) with one of the usernames
 831                 from the "user=" field then the connection is made as
 832                 the username in the "user=" line. If one
 833                 of the username in the "user=" list begins with a
 834                 '@' then that name expands to a list of names in
 835                 the group of the same name.</P
 836 ></LI
 837 ><LI
 838 ><P
 839 >If the service is a guest service then a
 840                 connection is made as the username given in the "guest
 841                 account =" for the service, irrespective of the
 842                 supplied password.</P
 843 ></LI
 844 ></OL
 845 ></DIV
 846 ><DIV
 847 CLASS="REFSECT1"
 848 ><A
 849 NAME="AEN253"
 850 ></A
 851 ><H2
 852 >COMPLETE LIST OF GLOBAL PARAMETERS</H2
 853 ><P
 854 >Here is a list of all global parameters. See the section of
 855         each parameter for details.  Note that some are synonyms.</P
 856 ><P
 857 ></P
 858 ><UL
 859 ><LI
 860 ><P
 861 ><A
 862 HREF="#ADDUSERSCRIPT"
 863 ><TT
 864 CLASS="PARAMETER"
 865 ><I
 866 >add user script</I
 867 ></TT
 868 ></A
 869 ></P
 870 ></LI
 871 ><LI
 872 ><P
 873 ><A
 874 HREF="#ADDPRINTERCOMMAND"
 875 ><TT
 876 CLASS="PARAMETER"
 877 ><I
 878 >addprinter command</I
 879 ></TT
 880 ></A
 881 ></P
 882 ></LI
 883 ><LI
 884 ><P
 885 ><A
 886 HREF="#ALLOWTRUSTEDDOMAINS"
 887 ><TT
 888 CLASS="PARAMETER"
 889 ><I
 890 >allow trusted domains</I
 891 ></TT
 892 ></A
 893 ></P
 894 ></LI
 895 ><LI
 896 ><P
 897 ><A
 898 HREF="#ANNOUNCEAS"
 899 ><TT
 900 CLASS="PARAMETER"
 901 ><I
 902 >announce as</I
 903 ></TT
 904 ></A
 905 ></P
 906 ></LI
 907 ><LI
 908 ><P
 909 ><A
 910 HREF="#ANNOUNCEVERSION"
 911 ><TT
 912 CLASS="PARAMETER"
 913 ><I
 914 >announce version</I
 915 ></TT
 916 ></A
 917 ></P
 918 ></LI
 919 ><LI
 920 ><P
 921 ><A
 922 HREF="#AUTOSERVICES"
 923 ><TT
 924 CLASS="PARAMETER"
 925 ><I
 926 >auto services</I
 927 ></TT
 928 ></A
 929 ></P
 930 ></LI
 931 ><LI
 932 ><P
 933 ><A
 934 HREF="#BINDINTERFACESONLY"
 935 ><TT
 936 CLASS="PARAMETER"
 937 ><I
 938 >bind interfaces only</I
 939 ></TT
 940 ></A
 941 ></P
 942 ></LI
 943 ><LI
 944 ><P
 945 ><A
 946 HREF="#BROWSELIST"
 947 ><TT
 948 CLASS="PARAMETER"
 949 ><I
 950 >browse list</I
 951 ></TT
 952 ></A
 953 ></P
 954 ></LI
 955 ><LI
 956 ><P
 957 ><A
 958 HREF="#CHANGENOTIFYTIMEOUT"
 959 ><TT
 960 CLASS="PARAMETER"
 961 ><I
 962 >change notify timeout</I
 963 ></TT
 964 ></A
 965 ></P
 966 ></LI
 967 ><LI
 968 ><P
 969 ><A
 970 HREF="#CHARACTERSET"
 971 ><TT
 972 CLASS="PARAMETER"
 973 ><I
 974 >character set</I
 975 ></TT
 976 ></A
 977 ></P
 978 ></LI
 979 ><LI
 980 ><P
 981 ><A
 982 HREF="#CLIENTCODEPAGE"
 983 ><TT
 984 CLASS="PARAMETER"
 985 ><I
 986 >client code page</I
 987 ></TT
 988 ></A
 989 ></P
 990 ></LI
 991 ><LI
 992 ><P
 993 ><A
 994 HREF="#CODEPAGEDIRECTORY"
 995 ><TT
 996 CLASS="PARAMETER"
 997 ><I
 998 >code page directory</I
 999 ></TT
1000 ></A
1001 ></P
1002 ></LI
1003 ><LI
1004 ><P
1005 ><A
1006 HREF="#CODINGSYSTEM"
1007 ><TT
1008 CLASS="PARAMETER"
1009 ><I
1010 >coding system</I
1011 ></TT
1012 ></A
1013 ></P
1014 ></LI
1015 ><LI
1016 ><P
1017 ><A
1018 HREF="#CONFIGFILE"
1019 ><TT
1020 CLASS="PARAMETER"
1021 ><I
1022 >config file</I
1023 ></TT
1024 ></A
1025 ></P
1026 ></LI
1027 ><LI
1028 ><P
1029 ><A
1030 HREF="#DEADTIME"
1031 ><TT
1032 CLASS="PARAMETER"
1033 ><I
1034 >deadtime</I
1035 ></TT
1036 ></A
1037 ></P
1038 ></LI
1039 ><LI
1040 ><P
1041 ><A
1042 HREF="#DEBUGHIRESTIMESTAMP"
1043 ><TT
1044 CLASS="PARAMETER"
1045 ><I
1046 >debug hires timestamp</I
1047 ></TT
1048 ></A
1049 ></P
1050 ></LI
1051 ><LI
1052 ><P
1053 ><A
1054 HREF="#DEBUGPID"
1055 ><TT
1056 CLASS="PARAMETER"
1057 ><I
1058 >debug pid</I
1059 ></TT
1060 ></A
1061 ></P
1062 ></LI
1063 ><LI
1064 ><P
1065 ><A
1066 HREF="#DEBUGTIMESTAMP"
1067 ><TT
1068 CLASS="PARAMETER"
1069 ><I
1070 >debug timestamp</I
1071 ></TT
1072 ></A
1073 ></P
1074 ></LI
1075 ><LI
1076 ><P
1077 ><A
1078 HREF="#DEBUGUID"
1079 ><TT
1080 CLASS="PARAMETER"
1081 ><I
1082 >debug uid</I
1083 ></TT
1084 ></A
1085 ></P
1086 ></LI
1087 ><LI
1088 ><P
1089 ><A
1090 HREF="#DEBUGLEVEL"
1091 ><TT
1092 CLASS="PARAMETER"
1093 ><I
1094 >debuglevel</I
1095 ></TT
1096 ></A
1097 ></P
1098 ></LI
1099 ><LI
1100 ><P
1101 ><A
1102 HREF="#DEFAULT"
1103 ><TT
1104 CLASS="PARAMETER"
1105 ><I
1106 >default</I
1107 ></TT
1108 ></A
1109 ></P
1110 ></LI
1111 ><LI
1112 ><P
1113 ><A
1114 HREF="#DEFAULTSERVICE"
1115 ><TT
1116 CLASS="PARAMETER"
1117 ><I
1118 >default service</I
1119 ></TT
1120 ></A
1121 ></P
1122 ></LI
1123 ><LI
1124 ><P
1125 ><A
1126 HREF="#DELETEUSERSCRIPT"
1127 ><TT
1128 CLASS="PARAMETER"
1129 ><I
1130 >delete user script</I
1131 ></TT
1132 ></A
1133 ></P
1134 ></LI
1135 ><LI
1136 ><P
1137 ><A
1138 HREF="#DELETEPRINTERCOMMAND"
1139 ><TT
1140 CLASS="PARAMETER"
1141 ><I
1142 >deleteprinter command</I
1143 ></TT
1144 ></A
1145 ></P
1146 ></LI
1147 ><LI
1148 ><P
1149 ><A
1150 HREF="#DFREECOMMAND"
1151 ><TT
1152 CLASS="PARAMETER"
1153 ><I
1154 >dfree command</I
1155 ></TT
1156 ></A
1157 ></P
1158 ></LI
1159 ><LI
1160 ><P
1161 ><A
1162 HREF="#DNSPROXY"
1163 ><TT
1164 CLASS="PARAMETER"
1165 ><I
1166 >dns proxy</I
1167 ></TT
1168 ></A
1169 ></P
1170 ></LI
1171 ><LI
1172 ><P
1173 ><A
1174 HREF="#DOMAINADMINGROUP"
1175 ><TT
1176 CLASS="PARAMETER"
1177 ><I
1178 >domain admin group</I
1179 ></TT
1180 ></A
1181 ></P
1182 ></LI
1183 ><LI
1184 ><P
1185 ><A
1186 HREF="#DOMAINADMINUSERS"
1187 ><TT
1188 CLASS="PARAMETER"
1189 ><I
1190 >domain admin users</I
1191 ></TT
1192 ></A
1193 ></P
1194 ></LI
1195 ><LI
1196 ><P
1197 ><A
1198 HREF="#DOMAINGROUPS"
1199 ><TT
1200 CLASS="PARAMETER"
1201 ><I
1202 >domain groups</I
1203 ></TT
1204 ></A
1205 ></P
1206 ></LI
1207 ><LI
1208 ><P
1209 ><A
1210 HREF="#DOMAINGUESTGROUP"
1211 ><TT
1212 CLASS="PARAMETER"
1213 ><I
1214 >domain guest group</I
1215 ></TT
1216 ></A
1217 ></P
1218 ></LI
1219 ><LI
1220 ><P
1221 ><A
1222 HREF="#DOMAINGUESTUSERS"
1223 ><TT
1224 CLASS="PARAMETER"
1225 ><I
1226 >domain guest users</I
1227 ></TT
1228 ></A
1229 ></P
1230 ></LI
1231 ><LI
1232 ><P
1233 ><A
1234 HREF="#DOMAINLOGONS"
1235 ><TT
1236 CLASS="PARAMETER"
1237 ><I
1238 >domain logons</I
1239 ></TT
1240 ></A
1241 ></P
1242 ></LI
1243 ><LI
1244 ><P
1245 ><A
1246 HREF="#DOMAINMASTER"
1247 ><TT
1248 CLASS="PARAMETER"
1249 ><I
1250 >domain master</I
1251 ></TT
1252 ></A
1253 ></P
1254 ></LI
1255 ><LI
1256 ><P
1257 ><A
1258 HREF="#ENCRYPTPASSWORDS"
1259 ><TT
1260 CLASS="PARAMETER"
1261 ><I
1262 >encrypt passwords</I
1263 ></TT
1264 ></A
1265 ></P
1266 ></LI
1267 ><LI
1268 ><P
1269 ><A
1270 HREF="#ENHANCEDBROWSING"
1271 ><TT
1272 CLASS="PARAMETER"
1273 ><I
1274 >enhanced browsing</I
1275 ></TT
1276 ></A
1277 ></P
1278 ></LI
1279 ><LI
1280 ><P
1281 ><A
1282 HREF="#ENUMPORTSCOMMAND"
1283 ><TT
1284 CLASS="PARAMETER"
1285 ><I
1286 >enumports command</I
1287 ></TT
1288 ></A
1289 ></P
1290 ></LI
1291 ><LI
1292 ><P
1293 ><A
1294 HREF="#GETWDCACHE"
1295 ><TT
1296 CLASS="PARAMETER"
1297 ><I
1298 >getwd cache</I
1299 ></TT
1300 ></A
1301 ></P
1302 ></LI
1303 ><LI
1304 ><P
1305 ><A
1306 HREF="#HIDELOCALUSERS"
1307 ><TT
1308 CLASS="PARAMETER"
1309 ><I
1310 >hide local users</I
1311 ></TT
1312 ></A
1313 ></P
1314 ></LI
1315 ><LI
1316 ><P
1317 ><A
1318 HREF="#HOMEDIRMAP"
1319 ><TT
1320 CLASS="PARAMETER"
1321 ><I
1322 >homedir map</I
1323 ></TT
1324 ></A
1325 ></P
1326 ></LI
1327 ><LI
1328 ><P
1329 ><A
1330 HREF="#HOSTMSDFS"
1331 ><TT
1332 CLASS="PARAMETER"
1333 ><I
1334 >host msdfs</I
1335 ></TT
1336 ></A
1337 ></P
1338 ></LI
1339 ><LI
1340 ><P
1341 ><A
1342 HREF="#HOSTSEQUIV"
1343 ><TT
1344 CLASS="PARAMETER"
1345 ><I
1346 >hosts equiv</I
1347 ></TT
1348 ></A
1349 ></P
1350 ></LI
1351 ><LI
1352 ><P
1353 ><A
1354 HREF="#INTERFACES"
1355 ><TT
1356 CLASS="PARAMETER"
1357 ><I
1358 >interfaces</I
1359 ></TT
1360 ></A
1361 ></P
1362 ></LI
1363 ><LI
1364 ><P
1365 ><A
1366 HREF="#KEEPALIVE"
1367 ><TT
1368 CLASS="PARAMETER"
1369 ><I
1370 >keepalive</I
1371 ></TT
1372 ></A
1373 ></P
1374 ></LI
1375 ><LI
1376 ><P
1377 ><A
1378 HREF="#KERNELOPLOCKS"
1379 ><TT
1380 CLASS="PARAMETER"
1381 ><I
1382 >kernel oplocks</I
1383 ></TT
1384 ></A
1385 ></P
1386 ></LI
1387 ><LI
1388 ><P
1389 ><A
1390 HREF="#LANMANAUTH"
1391 ><TT
1392 CLASS="PARAMETER"
1393 ><I
1394 >lanman auth</I
1395 ></TT
1396 ></A
1397 ></P
1398 ></LI
1399 ><LI
1400 ><P
1401 ><A
1402 HREF="#LMANNOUNCE"
1403 ><TT
1404 CLASS="PARAMETER"
1405 ><I
1406 >lm announce</I
1407 ></TT
1408 ></A
1409 ></P
1410 ></LI
1411 ><LI
1412 ><P
1413 ><A
1414 HREF="#LMINTERVAL"
1415 ><TT
1416 CLASS="PARAMETER"
1417 ><I
1418 >lm interval</I
1419 ></TT
1420 ></A
1421 ></P
1422 ></LI
1423 ><LI
1424 ><P
1425 ><A
1426 HREF="#LOADPRINTERS"
1427 ><TT
1428 CLASS="PARAMETER"
1429 ><I
1430 >load printers</I
1431 ></TT
1432 ></A
1433 ></P
1434 ></LI
1435 ><LI
1436 ><P
1437 ><A
1438 HREF="#LOCALMASTER"
1439 ><TT
1440 CLASS="PARAMETER"
1441 ><I
1442 >local master</I
1443 ></TT
1444 ></A
1445 ></P
1446 ></LI
1447 ><LI
1448 ><P
1449 ><A
1450 HREF="#LOCKDIR"
1451 ><TT
1452 CLASS="PARAMETER"
1453 ><I
1454 >lock dir</I
1455 ></TT
1456 ></A
1457 ></P
1458 ></LI
1459 ><LI
1460 ><P
1461 ><A
1462 HREF="#LOCKDIRECTORY"
1463 ><TT
1464 CLASS="PARAMETER"
1465 ><I
1466 >lock directory</I
1467 ></TT
1468 ></A
1469 ></P
1470 ></LI
1471 ><LI
1472 ><P
1473 ><A
1474 HREF="#LOGFILE"
1475 ><TT
1476 CLASS="PARAMETER"
1477 ><I
1478 >log file</I
1479 ></TT
1480 ></A
1481 ></P
1482 ></LI
1483 ><LI
1484 ><P
1485 ><A
1486 HREF="#LOGLEVEL"
1487 ><TT
1488 CLASS="PARAMETER"
1489 ><I
1490 >log level</I
1491 ></TT
1492 ></A
1493 ></P
1494 ></LI
1495 ><LI
1496 ><P
1497 ><A
1498 HREF="#LOGONDRIVE"
1499 ><TT
1500 CLASS="PARAMETER"
1501 ><I
1502 >logon drive</I
1503 ></TT
1504 ></A
1505 ></P
1506 ></LI
1507 ><LI
1508 ><P
1509 ><A
1510 HREF="#LOGONHOME"
1511 ><TT
1512 CLASS="PARAMETER"
1513 ><I
1514 >logon home</I
1515 ></TT
1516 ></A
1517 ></P
1518 ></LI
1519 ><LI
1520 ><P
1521 ><A
1522 HREF="#LOGONPATH"
1523 ><TT
1524 CLASS="PARAMETER"
1525 ><I
1526 >logon path</I
1527 ></TT
1528 ></A
1529 ></P
1530 ></LI
1531 ><LI
1532 ><P
1533 ><A
1534 HREF="#LOGONSCRIPT"
1535 ><TT
1536 CLASS="PARAMETER"
1537 ><I
1538 >logon script</I
1539 ></TT
1540 ></A
1541 ></P
1542 ></LI
1543 ><LI
1544 ><P
1545 ><A
1546 HREF="#LPQCACHETIME"
1547 ><TT
1548 CLASS="PARAMETER"
1549 ><I
1550 >lpq cache time</I
1551 ></TT
1552 ></A
1553 ></P
1554 ></LI
1555 ><LI
1556 ><P
1557 ><A
1558 HREF="#MACHINEPASSWORDTIMEOUT"
1559 ><TT
1560 CLASS="PARAMETER"
1561 ><I
1562 >machine password timeout</I
1563 ></TT
1564 ></A
1565 ></P
1566 ></LI
1567 ><LI
1568 ><P
1569 ><A
1570 HREF="#MANGLEDSTACK"
1571 ><TT
1572 CLASS="PARAMETER"
1573 ><I
1574 >mangled stack</I
1575 ></TT
1576 ></A
1577 ></P
1578 ></LI
1579 ><LI
1580 ><P
1581 ><A
1582 HREF="#MAPTOGUEST"
1583 ><TT
1584 CLASS="PARAMETER"
1585 ><I
1586 >map to guest</I
1587 ></TT
1588 ></A
1589 ></P
1590 ></LI
1591 ><LI
1592 ><P
1593 ><A
1594 HREF="#MAXDISKSIZE"
1595 ><TT
1596 CLASS="PARAMETER"
1597 ><I
1598 >max disk size</I
1599 ></TT
1600 ></A
1601 ></P
1602 ></LI
1603 ><LI
1604 ><P
1605 ><A
1606 HREF="#MAXLOGSIZE"
1607 ><TT
1608 CLASS="PARAMETER"
1609 ><I
1610 >max log size</I
1611 ></TT
1612 ></A
1613 ></P
1614 ></LI
1615 ><LI
1616 ><P
1617 ><A
1618 HREF="#MAXMUX"
1619 ><TT
1620 CLASS="PARAMETER"
1621 ><I
1622 >max mux</I
1623 ></TT
1624 ></A
1625 ></P
1626 ></LI
1627 ><LI
1628 ><P
1629 ><A
1630 HREF="#MAXOPENFILES"
1631 ><TT
1632 CLASS="PARAMETER"
1633 ><I
1634 >max open files</I
1635 ></TT
1636 ></A
1637 ></P
1638 ></LI
1639 ><LI
1640 ><P
1641 ><A
1642 HREF="#MAXPROTOCOL"
1643 ><TT
1644 CLASS="PARAMETER"
1645 ><I
1646 >max protocol</I
1647 ></TT
1648 ></A
1649 ></P
1650 ></LI
1651 ><LI
1652 ><P
1653 ><A
1654 HREF="#MAXSMBDPROCESSES"
1655 ><TT
1656 CLASS="PARAMETER"
1657 ><I
1658 >max smbd processes</I
1659 ></TT
1660 ></A
1661 ></P
1662 ></LI
1663 ><LI
1664 ><P
1665 ><A
1666 HREF="#MAXTTL"
1667 ><TT
1668 CLASS="PARAMETER"
1669 ><I
1670 >max ttl</I
1671 ></TT
1672 ></A
1673 ></P
1674 ></LI
1675 ><LI
1676 ><P
1677 ><A
1678 HREF="#MAXWINSTTL"
1679 ><TT
1680 CLASS="PARAMETER"
1681 ><I
1682 >max wins ttl</I
1683 ></TT
1684 ></A
1685 ></P
1686 ></LI
1687 ><LI
1688 ><P
1689 ><A
1690 HREF="#MAXXMIT"
1691 ><TT
1692 CLASS="PARAMETER"
1693 ><I
1694 >max xmit</I
1695 ></TT
1696 ></A
1697 ></P
1698 ></LI
1699 ><LI
1700 ><P
1701 ><A
1702 HREF="#MESSAGECOMMAND"
1703 ><TT
1704 CLASS="PARAMETER"
1705 ><I
1706 >message command</I
1707 ></TT
1708 ></A
1709 ></P
1710 ></LI
1711 ><LI
1712 ><P
1713 ><A
1714 HREF="#MINPASSWDLENGTH"
1715 ><TT
1716 CLASS="PARAMETER"
1717 ><I
1718 >min passwd length</I
1719 ></TT
1720 ></A
1721 ></P
1722 ></LI
1723 ><LI
1724 ><P
1725 ><A
1726 HREF="#MINPASSWORDLENGTH"
1727 ><TT
1728 CLASS="PARAMETER"
1729 ><I
1730 >min password length</I
1731 ></TT
1732 ></A
1733 ></P
1734 ></LI
1735 ><LI
1736 ><P
1737 ><A
1738 HREF="#MINPROTOCOL"
1739 ><TT
1740 CLASS="PARAMETER"
1741 ><I
1742 >min protocol</I
1743 ></TT
1744 ></A
1745 ></P
1746 ></LI
1747 ><LI
1748 ><P
1749 ><A
1750 HREF="#MINWINSTTL"
1751 ><TT
1752 CLASS="PARAMETER"
1753 ><I
1754 >min wins ttl</I
1755 ></TT
1756 ></A
1757 ></P
1758 ></LI
1759 ><LI
1760 ><P
1761 ><A
1762 HREF="#NAMERESOLVEORDER"
1763 ><TT
1764 CLASS="PARAMETER"
1765 ><I
1766 >name resolve order</I
1767 ></TT
1768 ></A
1769 ></P
1770 ></LI
1771 ><LI
1772 ><P
1773 ><A
1774 HREF="#NETBIOSALIASES"
1775 ><TT
1776 CLASS="PARAMETER"
1777 ><I
1778 >netbios aliases</I
1779 ></TT
1780 ></A
1781 ></P
1782 ></LI
1783 ><LI
1784 ><P
1785 ><A
1786 HREF="#NETBIOSNAME"
1787 ><TT
1788 CLASS="PARAMETER"
1789 ><I
1790 >netbios name</I
1791 ></TT
1792 ></A
1793 ></P
1794 ></LI
1795 ><LI
1796 ><P
1797 ><A
1798 HREF="#NETBIOSSCOPE"
1799 ><TT
1800 CLASS="PARAMETER"
1801 ><I
1802 >netbios scope</I
1803 ></TT
1804 ></A
1805 ></P
1806 ></LI
1807 ><LI
1808 ><P
1809 ><A
1810 HREF="#NISHOMEDIR"
1811 ><TT
1812 CLASS="PARAMETER"
1813 ><I
1814 >nis homedir</I
1815 ></TT
1816 ></A
1817 ></P
1818 ></LI
1819 ><LI
1820 ><P
1821 ><A
1822 HREF="#NTACLSUPPORT"
1823 ><TT
1824 CLASS="PARAMETER"
1825 ><I
1826 >nt acl support</I
1827 ></TT
1828 ></A
1829 ></P
1830 ></LI
1831 ><LI
1832 ><P
1833 ><A
1834 HREF="#NTPIPESUPPORT"
1835 ><TT
1836 CLASS="PARAMETER"
1837 ><I
1838 >nt pipe support</I
1839 ></TT
1840 ></A
1841 ></P
1842 ></LI
1843 ><LI
1844 ><P
1845 ><A
1846 HREF="#NTSMBSUPPORT"
1847 ><TT
1848 CLASS="PARAMETER"
1849 ><I
1850 >nt smb support</I
1851 ></TT
1852 ></A
1853 ></P
1854 ></LI
1855 ><LI
1856 ><P
1857 ><A
1858 HREF="#NULLPASSWORDS"
1859 ><TT
1860 CLASS="PARAMETER"
1861 ><I
1862 >null passwords</I
1863 ></TT
1864 ></A
1865 ></P
1866 ></LI
1867 ><LI
1868 ><P
1869 ><A
1870 HREF="#OPLOCKBREAKWAITTIME"
1871 ><TT
1872 CLASS="PARAMETER"
1873 ><I
1874 >oplock break wait time</I
1875 ></TT
1876 ></A
1877 ></P
1878 ></LI
1879 ><LI
1880 ><P
1881 ><A
1882 HREF="#OSLEVEL"
1883 ><TT
1884 CLASS="PARAMETER"
1885 ><I
1886 >os level</I
1887 ></TT
1888 ></A
1889 ></P
1890 ></LI
1891 ><LI
1892 ><P
1893 ><A
1894 HREF="#OS2DRIVERMAP"
1895 ><TT
1896 CLASS="PARAMETER"
1897 ><I
1898 >os2 driver map</I
1899 ></TT
1900 ></A
1901 ></P
1902 ></LI
1903 ><LI
1904 ><P
1905 ><A
1906 HREF="#PANICACTION"
1907 ><TT
1908 CLASS="PARAMETER"
1909 ><I
1910 >panic action</I
1911 ></TT
1912 ></A
1913 ></P
1914 ></LI
1915 ><LI
1916 ><P
1917 ><A
1918 HREF="#PASSWDCHAT"
1919 ><TT
1920 CLASS="PARAMETER"
1921 ><I
1922 >passwd chat</I
1923 ></TT
1924 ></A
1925 ></P
1926 ></LI
1927 ><LI
1928 ><P
1929 ><A
1930 HREF="#PASSWDCHATDEBUG"
1931 ><TT
1932 CLASS="PARAMETER"
1933 ><I
1934 >passwd chat debug</I
1935 ></TT
1936 ></A
1937 ></P
1938 ></LI
1939 ><LI
1940 ><P
1941 ><A
1942 HREF="#PASSWDPROGRAM"
1943 ><TT
1944 CLASS="PARAMETER"
1945 ><I
1946 >passwd program</I
1947 ></TT
1948 ></A
1949 ></P
1950 ></LI
1951 ><LI
1952 ><P
1953 ><A
1954 HREF="#PASSWORDLEVEL"
1955 ><TT
1956 CLASS="PARAMETER"
1957 ><I
1958 >password level</I
1959 ></TT
1960 ></A
1961 ></P
1962 ></LI
1963 ><LI
1964 ><P
1965 ><A
1966 HREF="#PASSWORDSERVER"
1967 ><TT
1968 CLASS="PARAMETER"
1969 ><I
1970 >password server</I
1971 ></TT
1972 ></A
1973 ></P
1974 ></LI
1975 ><LI
1976 ><P
1977 ><A
1978 HREF="#PREFEREDMASTER"
1979 ><TT
1980 CLASS="PARAMETER"
1981 ><I
1982 >prefered master</I
1983 ></TT
1984 ></A
1985 ></P
1986 ></LI
1987 ><LI
1988 ><P
1989 ><A
1990 HREF="#PREFERREDMASTER"
1991 ><TT
1992 CLASS="PARAMETER"
1993 ><I
1994 >preferred master</I
1995 ></TT
1996 ></A
1997 ></P
1998 ></LI
1999 ><LI
2000 ><P
2001 ><A
2002 HREF="#PRELOAD"
2003 ><TT
2004 CLASS="PARAMETER"
2005 ><I
2006 >preload</I
2007 ></TT
2008 ></A
2009 ></P
2010 ></LI
2011 ><LI
2012 ><P
2013 ><A
2014 HREF="#PRINTCAP"
2015 ><TT
2016 CLASS="PARAMETER"
2017 ><I
2018 >printcap</I
2019 ></TT
2020 ></A
2021 ></P
2022 ></LI
2023 ><LI
2024 ><P
2025 ><A
2026 HREF="#PRINTCAPNAME"
2027 ><TT
2028 CLASS="PARAMETER"
2029 ><I
2030 >printcap name</I
2031 ></TT
2032 ></A
2033 ></P
2034 ></LI
2035 ><LI
2036 ><P
2037 ><A
2038 HREF="#PRINTERDRIVERFILE"
2039 ><TT
2040 CLASS="PARAMETER"
2041 ><I
2042 >printer driver file</I
2043 ></TT
2044 ></A
2045 ></P
2046 ></LI
2047 ><LI
2048 ><P
2049 ><A
2050 HREF="#PROTOCOL"
2051 ><TT
2052 CLASS="PARAMETER"
2053 ><I
2054 >protocol</I
2055 ></TT
2056 ></A
2057 ></P
2058 ></LI
2059 ><LI
2060 ><P
2061 ><A
2062 HREF="#READBMPX"
2063 ><TT
2064 CLASS="PARAMETER"
2065 ><I
2066 >read bmpx</I
2067 ></TT
2068 ></A
2069 ></P
2070 ></LI
2071 ><LI
2072 ><P
2073 ><A
2074 HREF="#READRAW"
2075 ><TT
2076 CLASS="PARAMETER"
2077 ><I
2078 >read raw</I
2079 ></TT
2080 ></A
2081 ></P
2082 ></LI
2083 ><LI
2084 ><P
2085 ><A
2086 HREF="#READSIZE"
2087 ><TT
2088 CLASS="PARAMETER"
2089 ><I
2090 >read size</I
2091 ></TT
2092 ></A
2093 ></P
2094 ></LI
2095 ><LI
2096 ><P
2097 ><A
2098 HREF="#REMOTEANNOUNCE"
2099 ><TT
2100 CLASS="PARAMETER"
2101 ><I
2102 >remote announce</I
2103 ></TT
2104 ></A
2105 ></P
2106 ></LI
2107 ><LI
2108 ><P
2109 ><A
2110 HREF="#REMOTEBROWSESYNC"
2111 ><TT
2112 CLASS="PARAMETER"
2113 ><I
2114 >remote browse sync</I
2115 ></TT
2116 ></A
2117 ></P
2118 ></LI
2119 ><LI
2120 ><P
2121 ><A
2122 HREF="#RESTRICTANONYMOUS"
2123 ><TT
2124 CLASS="PARAMETER"
2125 ><I
2126 >restrict anonymous</I
2127 ></TT
2128 ></A
2129 ></P
2130 ></LI
2131 ><LI
2132 ><P
2133 ><A
2134 HREF="#ROOT"
2135 ><TT
2136 CLASS="PARAMETER"
2137 ><I
2138 >root</I
2139 ></TT
2140 ></A
2141 ></P
2142 ></LI
2143 ><LI
2144 ><P
2145 ><A
2146 HREF="#ROOTDIR"
2147 ><TT
2148 CLASS="PARAMETER"
2149 ><I
2150 >root dir</I
2151 ></TT
2152 ></A
2153 ></P
2154 ></LI
2155 ><LI
2156 ><P
2157 ><A
2158 HREF="#ROOTDIRECTORY"
2159 ><TT
2160 CLASS="PARAMETER"
2161 ><I
2162 >root directory</I
2163 ></TT
2164 ></A
2165 ></P
2166 ></LI
2167 ><LI
2168 ><P
2169 ><A
2170 HREF="#SECURITY"
2171 ><TT
2172 CLASS="PARAMETER"
2173 ><I
2174 >security</I
2175 ></TT
2176 ></A
2177 ></P
2178 ></LI
2179 ><LI
2180 ><P
2181 ><A
2182 HREF="#SERVERSTRING"
2183 ><TT
2184 CLASS="PARAMETER"
2185 ><I
2186 >server string</I
2187 ></TT
2188 ></A
2189 ></P
2190 ></LI
2191 ><LI
2192 ><P
2193 ><A
2194 HREF="#SHOWADDPRINTERWIZARD"
2195 ><TT
2196 CLASS="PARAMETER"
2197 ><I
2198 >show add printer wizard</I
2199 ></TT
2200 ></A
2201 ></P
2202 ></LI
2203 ><LI
2204 ><P
2205 ><A
2206 HREF="#SMBPASSWDFILE"
2207 ><TT
2208 CLASS="PARAMETER"
2209 ><I
2210 >smb passwd file</I
2211 ></TT
2212 ></A
2213 ></P
2214 ></LI
2215 ><LI
2216 ><P
2217 ><A
2218 HREF="#SOCKETADDRESS"
2219 ><TT
2220 CLASS="PARAMETER"
2221 ><I
2222 >socket address</I
2223 ></TT
2224 ></A
2225 ></P
2226 ></LI
2227 ><LI
2228 ><P
2229 ><A
2230 HREF="#SOCKETOPTIONS"
2231 ><TT
2232 CLASS="PARAMETER"
2233 ><I
2234 >socket options</I
2235 ></TT
2236 ></A
2237 ></P
2238 ></LI
2239 ><LI
2240 ><P
2241 ><A
2242 HREF="#SOURCEENVIRONMENT"
2243 ><TT
2244 CLASS="PARAMETER"
2245 ><I
2246 >source environment</I
2247 ></TT
2248 ></A
2249 ></P
2250 ></LI
2251 ><LI
2252 ><P
2253 ><A
2254 HREF="#SSL"
2255 ><TT
2256 CLASS="PARAMETER"
2257 ><I
2258 >ssl</I
2259 ></TT
2260 ></A
2261 ></P
2262 ></LI
2263 ><LI
2264 ><P
2265 ><A
2266 HREF="#SSLCACERTDIR"
2267 ><TT
2268 CLASS="PARAMETER"
2269 ><I
2270 >ssl CA certDir</I
2271 ></TT
2272 ></A
2273 ></P
2274 ></LI
2275 ><LI
2276 ><P
2277 ><A
2278 HREF="#SSLCACERTFILE"
2279 ><TT
2280 CLASS="PARAMETER"
2281 ><I
2282 >ssl CA certFile</I
2283 ></TT
2284 ></A
2285 ></P
2286 ></LI
2287 ><LI
2288 ><P
2289 ><A
2290 HREF="#SSLCIPHERS"
2291 ><TT
2292 CLASS="PARAMETER"
2293 ><I
2294 >ssl ciphers</I
2295 ></TT
2296 ></A
2297 ></P
2298 ></LI
2299 ><LI
2300 ><P
2301 ><A
2302 HREF="#SSLCLIENTCERT"
2303 ><TT
2304 CLASS="PARAMETER"
2305 ><I
2306 >ssl client cert</I
2307 ></TT
2308 ></A
2309 ></P
2310 ></LI
2311 ><LI
2312 ><P
2313 ><A
2314 HREF="#SSLCLIENTKEY"
2315 ><TT
2316 CLASS="PARAMETER"
2317 ><I
2318 >ssl client key</I
2319 ></TT
2320 ></A
2321 ></P
2322 ></LI
2323 ><LI
2324 ><P
2325 ><A
2326 HREF="#SSLCOMPATIBILITY"
2327 ><TT
2328 CLASS="PARAMETER"
2329 ><I
2330 >ssl compatibility</I
2331 ></TT
2332 ></A
2333 ></P
2334 ></LI
2335 ><LI
2336 ><P
2337 ><A
2338 HREF="#SSLHOSTS"
2339 ><TT
2340 CLASS="PARAMETER"
2341 ><I
2342 >ssl hosts</I
2343 ></TT
2344 ></A
2345 ></P
2346 ></LI
2347 ><LI
2348 ><P
2349 ><A
2350 HREF="#SSLHOSTSRESIGN"
2351 ><TT
2352 CLASS="PARAMETER"
2353 ><I
2354 >ssl hosts resign</I
2355 ></TT
2356 ></A
2357 ></P
2358 ></LI
2359 ><LI
2360 ><P
2361 ><A
2362 HREF="#SSLREQUIRECLIENTCERT"
2363 ><TT
2364 CLASS="PARAMETER"
2365 ><I
2366 >ssl require clientcert</I
2367 ></TT
2368 ></A
2369 ></P
2370 ></LI
2371 ><LI
2372 ><P
2373 ><A
2374 HREF="#SSLREQUIRESERVERCERT"
2375 ><TT
2376 CLASS="PARAMETER"
2377 ><I
2378 >ssl require servercert</I
2379 ></TT
2380 ></A
2381 ></P
2382 ></LI
2383 ><LI
2384 ><P
2385 ><A
2386 HREF="#SSLSERVERCERT"
2387 ><TT
2388 CLASS="PARAMETER"
2389 ><I
2390 >ssl server cert</I
2391 ></TT
2392 ></A
2393 ></P
2394 ></LI
2395 ><LI
2396 ><P
2397 ><A
2398 HREF="#SSLSERVERKEY"
2399 ><TT
2400 CLASS="PARAMETER"
2401 ><I
2402 >ssl server key</I
2403 ></TT
2404 ></A
2405 ></P
2406 ></LI
2407 ><LI
2408 ><P
2409 ><A
2410 HREF="#SSLVERSION"
2411 ><TT
2412 CLASS="PARAMETER"
2413 ><I
2414 >ssl version</I
2415 ></TT
2416 ></A
2417 ></P
2418 ></LI
2419 ><LI
2420 ><P
2421 ><A
2422 HREF="#STATCACHE"
2423 ><TT
2424 CLASS="PARAMETER"
2425 ><I
2426 >stat cache</I
2427 ></TT
2428 ></A
2429 ></P
2430 ></LI
2431 ><LI
2432 ><P
2433 ><A
2434 HREF="#STATCACHESIZE"
2435 ><TT
2436 CLASS="PARAMETER"
2437 ><I
2438 >stat cache size</I
2439 ></TT
2440 ></A
2441 ></P
2442 ></LI
2443 ><LI
2444 ><P
2445 ><A
2446 HREF="#STRIPDOT"
2447 ><TT
2448 CLASS="PARAMETER"
2449 ><I
2450 >strip dot</I
2451 ></TT
2452 ></A
2453 ></P
2454 ></LI
2455 ><LI
2456 ><P
2457 ><A
2458 HREF="#SYSLOG"
2459 ><TT
2460 CLASS="PARAMETER"
2461 ><I
2462 >syslog</I
2463 ></TT
2464 ></A
2465 ></P
2466 ></LI
2467 ><LI
2468 ><P
2469 ><A
2470 HREF="#SYSLOGONLY"
2471 ><TT
2472 CLASS="PARAMETER"
2473 ><I
2474 >syslog only</I
2475 ></TT
2476 ></A
2477 ></P
2478 ></LI
2479 ><LI
2480 ><P
2481 ><A
2482 HREF="#TEMPLATEHOMEDIR"
2483 ><TT
2484 CLASS="PARAMETER"
2485 ><I
2486 >template homedir</I
2487 ></TT
2488 ></A
2489 ></P
2490 ></LI
2491 ><LI
2492 ><P
2493 ><A
2494 HREF="#TEMPLATESHELL"
2495 ><TT
2496 CLASS="PARAMETER"
2497 ><I
2498 >template shell</I
2499 ></TT
2500 ></A
2501 ></P
2502 ></LI
2503 ><LI
2504 ><P
2505 ><A
2506 HREF="#TIMEOFFSET"
2507 ><TT
2508 CLASS="PARAMETER"
2509 ><I
2510 >time offset</I
2511 ></TT
2512 ></A
2513 ></P
2514 ></LI
2515 ><LI
2516 ><P
2517 ><A
2518 HREF="#TIMESERVER"
2519 ><TT
2520 CLASS="PARAMETER"
2521 ><I
2522 >time server</I
2523 ></TT
2524 ></A
2525 ></P
2526 ></LI
2527 ><LI
2528 ><P
2529 ><A
2530 HREF="#TIMESTAMPLOGS"
2531 ><TT
2532 CLASS="PARAMETER"
2533 ><I
2534 >timestamp logs</I
2535 ></TT
2536 ></A
2537 ></P
2538 ></LI
2539 ><LI
2540 ><P
2541 ><A
2542 HREF="#TOTALPRINTJOBS"
2543 ><TT
2544 CLASS="PARAMETER"
2545 ><I
2546 >total print jobs</I
2547 ></TT
2548 ></A
2549 ></P
2550 ></LI
2551 ><LI
2552 ><P
2553 ><A
2554 HREF="#UNIXPASSWORDSYNC"
2555 ><TT
2556 CLASS="PARAMETER"
2557 ><I
2558 >unix password sync</I
2559 ></TT
2560 ></A
2561 ></P
2562 ></LI
2563 ><LI
2564 ><P
2565 ><A
2566 HREF="#UPDATEENCRYPTED"
2567 ><TT
2568 CLASS="PARAMETER"
2569 ><I
2570 >update encrypted</I
2571 ></TT
2572 ></A
2573 ></P
2574 ></LI
2575 ><LI
2576 ><P
2577 ><A
2578 HREF="#USERHOSTS"
2579 ><TT
2580 CLASS="PARAMETER"
2581 ><I
2582 >use rhosts</I
2583 ></TT
2584 ></A
2585 ></P
2586 ></LI
2587 ><LI
2588 ><P
2589 ><A
2590 HREF="#USERNAMELEVEL"
2591 ><TT
2592 CLASS="PARAMETER"
2593 ><I
2594 >username level</I
2595 ></TT
2596 ></A
2597 ></P
2598 ></LI
2599 ><LI
2600 ><P
2601 ><A
2602 HREF="#USERNAMEMAP"
2603 ><TT
2604 CLASS="PARAMETER"
2605 ><I
2606 >username map</I
2607 ></TT
2608 ></A
2609 ></P
2610 ></LI
2611 ><LI
2612 ><P
2613 ><A
2614 HREF="#UTMPDIRECTORY"
2615 ><TT
2616 CLASS="PARAMETER"
2617 ><I
2618 >utmp directory</I
2619 ></TT
2620 ></A
2621 ></P
2622 ></LI
2623 ><LI
2624 ><P
2625 ><A
2626 HREF="#VALIDCHARS"
2627 ><TT
2628 CLASS="PARAMETER"
2629 ><I
2630 >valid chars</I
2631 ></TT
2632 ></A
2633 ></P
2634 ></LI
2635 ><LI
2636 ><P
2637 ><A
2638 HREF="#WINBINDCACHETIME"
2639 ><TT
2640 CLASS="PARAMETER"
2641 ><I
2642 >winbind cache time</I
2643 ></TT
2644 ></A
2645 ></P
2646 ></LI
2647 ><LI
2648 ><P
2649 ><A
2650 HREF="#WINBINDGID"
2651 ><TT
2652 CLASS="PARAMETER"
2653 ><I
2654 >winbind gid</I
2655 ></TT
2656 ></A
2657 ></P
2658 ></LI
2659 ><LI
2660 ><P
2661 ><A
2662 HREF="#WINBINDSEPARATOR"
2663 ><TT
2664 CLASS="PARAMETER"
2665 ><I
2666 >winbind separator</I
2667 ></TT
2668 ></A
2669 ></P
2670 ></LI
2671 ><LI
2672 ><P
2673 ><A
2674 HREF="#WINBINDUID"
2675 ><TT
2676 CLASS="PARAMETER"
2677 ><I
2678 >winbind uid</I
2679 ></TT
2680 ></A
2681 ></P
2682 ></LI
2683 ><LI
2684 ><P
2685 ><A
2686 HREF="#WINSHOOK"
2687 ><TT
2688 CLASS="PARAMETER"
2689 ><I
2690 >wins hook</I
2691 ></TT
2692 ></A
2693 ></P
2694 ></LI
2695 ><LI
2696 ><P
2697 ><A
2698 HREF="#WINSPROXY"
2699 ><TT
2700 CLASS="PARAMETER"
2701 ><I
2702 >wins proxy</I
2703 ></TT
2704 ></A
2705 ></P
2706 ></LI
2707 ><LI
2708 ><P
2709 ><A
2710 HREF="#WINSSERVER"
2711 ><TT
2712 CLASS="PARAMETER"
2713 ><I
2714 >wins server</I
2715 ></TT
2716 ></A
2717 ></P
2718 ></LI
2719 ><LI
2720 ><P
2721 ><A
2722 HREF="#WINSSUPPORT"
2723 ><TT
2724 CLASS="PARAMETER"
2725 ><I
2726 >wins support</I
2727 ></TT
2728 ></A
2729 ></P
2730 ></LI
2731 ><LI
2732 ><P
2733 ><A
2734 HREF="#WORKGROUP"
2735 ><TT
2736 CLASS="PARAMETER"
2737 ><I
2738 >workgroup</I
2739 ></TT
2740 ></A
2741 ></P
2742 ></LI
2743 ><LI
2744 ><P
2745 ><A
2746 HREF="#WRITERAW"
2747 ><TT
2748 CLASS="PARAMETER"
2749 ><I
2750 >write raw</I
2751 ></TT
2752 ></A
2753 ></P
2754 ></LI
2755 ></UL
2756 ></DIV
2757 ><DIV
2758 CLASS="REFSECT1"
2759 ><A
2760 NAME="AEN889"
2761 ></A
2762 ><H2
2763 >COMPLETE LIST OF SERVICE PARAMETERS</H2
2764 ><P
2765 >Here is a list of all service parameters. See the section on
2766         each parameter for details. Note that some are synonyms.</P
2767 ><P
2768 ></P
2769 ><UL
2770 ><LI
2771 ><P
2772 ><A
2773 HREF="#ADMINUSERS"
2774 ><TT
2775 CLASS="PARAMETER"
2776 ><I
2777 >admin users</I
2778 ></TT
2779 ></A
2780 ></P
2781 ></LI
2782 ><LI
2783 ><P
2784 ><A
2785 HREF="#ALLOWHOSTS"
2786 ><TT
2787 CLASS="PARAMETER"
2788 ><I
2789 >allow hosts</I
2790 ></TT
2791 ></A
2792 ></P
2793 ></LI
2794 ><LI
2795 ><P
2796 ><A
2797 HREF="#AVAILABLE"
2798 ><TT
2799 CLASS="PARAMETER"
2800 ><I
2801 >available</I
2802 ></TT
2803 ></A
2804 ></P
2805 ></LI
2806 ><LI
2807 ><P
2808 ><A
2809 HREF="#BLOCKINGLOCKS"
2810 ><TT
2811 CLASS="PARAMETER"
2812 ><I
2813 >blocking locks</I
2814 ></TT
2815 ></A
2816 ></P
2817 ></LI
2818 ><LI
2819 ><P
2820 ><A
2821 HREF="#BROWSABLE"
2822 ><TT
2823 CLASS="PARAMETER"
2824 ><I
2825 >browsable</I
2826 ></TT
2827 ></A
2828 ></P
2829 ></LI
2830 ><LI
2831 ><P
2832 ><A
2833 HREF="#BROWSEABLE"
2834 ><TT
2835 CLASS="PARAMETER"
2836 ><I
2837 >browseable</I
2838 ></TT
2839 ></A
2840 ></P
2841 ></LI
2842 ><LI
2843 ><P
2844 ><A
2845 HREF="#CASESENSITIVE"
2846 ><TT
2847 CLASS="PARAMETER"
2848 ><I
2849 >case sensitive</I
2850 ></TT
2851 ></A
2852 ></P
2853 ></LI
2854 ><LI
2855 ><P
2856 ><A
2857 HREF="#CASESIGNAMES"
2858 ><TT
2859 CLASS="PARAMETER"
2860 ><I
2861 >casesignames</I
2862 ></TT
2863 ></A
2864 ></P
2865 ></LI
2866 ><LI
2867 ><P
2868 ><A
2869 HREF="#COMMENT"
2870 ><TT
2871 CLASS="PARAMETER"
2872 ><I
2873 >comment</I
2874 ></TT
2875 ></A
2876 ></P
2877 ></LI
2878 ><LI
2879 ><P
2880 ><A
2881 HREF="#COPY"
2882 ><TT
2883 CLASS="PARAMETER"
2884 ><I
2885 >copy</I
2886 ></TT
2887 ></A
2888 ></P
2889 ></LI
2890 ><LI
2891 ><P
2892 ><A
2893 HREF="#CREATEMASK"
2894 ><TT
2895 CLASS="PARAMETER"
2896 ><I
2897 >create mask</I
2898 ></TT
2899 ></A
2900 ></P
2901 ></LI
2902 ><LI
2903 ><P
2904 ><A
2905 HREF="#CREATEMODE"
2906 ><TT
2907 CLASS="PARAMETER"
2908 ><I
2909 >create mode</I
2910 ></TT
2911 ></A
2912 ></P
2913 ></LI
2914 ><LI
2915 ><P
2916 ><A
2917 HREF="#DEFAULTCASE"
2918 ><TT
2919 CLASS="PARAMETER"
2920 ><I
2921 >default case</I
2922 ></TT
2923 ></A
2924 ></P
2925 ></LI
2926 ><LI
2927 ><P
2928 ><A
2929 HREF="#DELETEREADONLY"
2930 ><TT
2931 CLASS="PARAMETER"
2932 ><I
2933 >delete readonly</I
2934 ></TT
2935 ></A
2936 ></P
2937 ></LI
2938 ><LI
2939 ><P
2940 ><A
2941 HREF="#DELETEVETOFILES"
2942 ><TT
2943 CLASS="PARAMETER"
2944 ><I
2945 >delete veto files</I
2946 ></TT
2947 ></A
2948 ></P
2949 ></LI
2950 ><LI
2951 ><P
2952 ><A
2953 HREF="#DENYHOSTS"
2954 ><TT
2955 CLASS="PARAMETER"
2956 ><I
2957 >deny hosts</I
2958 ></TT
2959 ></A
2960 ></P
2961 ></LI
2962 ><LI
2963 ><P
2964 ><A
2965 HREF="#DIRECTORY"
2966 ><TT
2967 CLASS="PARAMETER"
2968 ><I
2969 >directory</I
2970 ></TT
2971 ></A
2972 ></P
2973 ></LI
2974 ><LI
2975 ><P
2976 ><A
2977 HREF="#DIRECTORYMASK"
2978 ><TT
2979 CLASS="PARAMETER"
2980 ><I
2981 >directory mask</I
2982 ></TT
2983 ></A
2984 ></P
2985 ></LI
2986 ><LI
2987 ><P
2988 ><A
2989 HREF="#DIRECTORYMODE"
2990 ><TT
2991 CLASS="PARAMETER"
2992 ><I
2993 >directory mode</I
2994 ></TT
2995 ></A
2996 ></P
2997 ></LI
2998 ><LI
2999 ><P
3000 ><A
3001 HREF="#DIRECTORYSECURITYMASK"
3002 ><TT
3003 CLASS="PARAMETER"
3004 ><I
3005 >directory security mask</I
3006 ></TT
3007 ></A
3008 ></P
3009 ></LI
3010 ><LI
3011 ><P
3012 ><A
3013 HREF="#DONTDESCEND"
3014 ><TT
3015 CLASS="PARAMETER"
3016 ><I
3017 >dont descend</I
3018 ></TT
3019 ></A
3020 ></P
3021 ></LI
3022 ><LI
3023 ><P
3024 ><A
3025 HREF="#DOSFILEMODE"
3026 ><TT
3027 CLASS="PARAMETER"
3028 ><I
3029 >dos filemode</I
3030 ></TT
3031 ></A
3032 ></P
3033 ></LI
3034 ><LI
3035 ><P
3036 ><A
3037 HREF="#DOSFILETIMERESOLUTION"
3038 ><TT
3039 CLASS="PARAMETER"
3040 ><I
3041 >dos filetime resolution</I
3042 ></TT
3043 ></A
3044 ></P
3045 ></LI
3046 ><LI
3047 ><P
3048 ><A
3049 HREF="#DOSFILETIMES"
3050 ><TT
3051 CLASS="PARAMETER"
3052 ><I
3053 >dos filetimes</I
3054 ></TT
3055 ></A
3056 ></P
3057 ></LI
3058 ><LI
3059 ><P
3060 ><A
3061 HREF="#EXEC"
3062 ><TT
3063 CLASS="PARAMETER"
3064 ><I
3065 >exec</I
3066 ></TT
3067 ></A
3068 ></P
3069 ></LI
3070 ><LI
3071 ><P
3072 ><A
3073 HREF="#FAKEDIRECTORYCREATETIMES"
3074 ><TT
3075 CLASS="PARAMETER"
3076 ><I
3077 >fake directory create times</I
3078 ></TT
3079 ></A
3080 ></P
3081 ></LI
3082 ><LI
3083 ><P
3084 ><A
3085 HREF="#FAKEOPLOCKS"
3086 ><TT
3087 CLASS="PARAMETER"
3088 ><I
3089 >fake oplocks</I
3090 ></TT
3091 ></A
3092 ></P
3093 ></LI
3094 ><LI
3095 ><P
3096 ><A
3097 HREF="#FOLLOWSYMLINKS"
3098 ><TT
3099 CLASS="PARAMETER"
3100 ><I
3101 >follow symlinks</I
3102 ></TT
3103 ></A
3104 ></P
3105 ></LI
3106 ><LI
3107 ><P
3108 ><A
3109 HREF="#FORCECREATEMODE"
3110 ><TT
3111 CLASS="PARAMETER"
3112 ><I
3113 >force create mode</I
3114 ></TT
3115 ></A
3116 ></P
3117 ></LI
3118 ><LI
3119 ><P
3120 ><A
3121 HREF="#FORCEDIRECTORYMODE"
3122 ><TT
3123 CLASS="PARAMETER"
3124 ><I
3125 >force directory mode</I
3126 ></TT
3127 ></A
3128 ></P
3129 ></LI
3130 ><LI
3131 ><P
3132 ><A
3133 HREF="#FORCEDIRECTORYSECURITYMODE"
3134 ><TT
3135 CLASS="PARAMETER"
3136 ><I
3137 >force directory security mode</I
3138 ></TT
3139 ></A
3140 ></P
3141 ></LI
3142 ><LI
3143 ><P
3144 ><A
3145 HREF="#FORCEGROUP"
3146 ><TT
3147 CLASS="PARAMETER"
3148 ><I
3149 >force group</I
3150 ></TT
3151 ></A
3152 ></P
3153 ></LI
3154 ><LI
3155 ><P
3156 ><A
3157 HREF="#FORCESECURITYMODE"
3158 ><TT
3159 CLASS="PARAMETER"
3160 ><I
3161 >force security mode</I
3162 ></TT
3163 ></A
3164 ></P
3165 ></LI
3166 ><LI
3167 ><P
3168 ><A
3169 HREF="#FORCEUSER"
3170 ><TT
3171 CLASS="PARAMETER"
3172 ><I
3173 >force user</I
3174 ></TT
3175 ></A
3176 ></P
3177 ></LI
3178 ><LI
3179 ><P
3180 ><A
3181 HREF="#FSTYPE"
3182 ><TT
3183 CLASS="PARAMETER"
3184 ><I
3185 >fstype</I
3186 ></TT
3187 ></A
3188 ></P
3189 ></LI
3190 ><LI
3191 ><P
3192 ><A
3193 HREF="#GROUP"
3194 ><TT
3195 CLASS="PARAMETER"
3196 ><I
3197 >group</I
3198 ></TT
3199 ></A
3200 ></P
3201 ></LI
3202 ><LI
3203 ><P
3204 ><A
3205 HREF="#GUESTACCOUNT"
3206 ><TT
3207 CLASS="PARAMETER"
3208 ><I
3209 >guest account</I
3210 ></TT
3211 ></A
3212 ></P
3213 ></LI
3214 ><LI
3215 ><P
3216 ><A
3217 HREF="#GUESTOK"
3218 ><TT
3219 CLASS="PARAMETER"
3220 ><I
3221 >guest ok</I
3222 ></TT
3223 ></A
3224 ></P
3225 ></LI
3226 ><LI
3227 ><P
3228 ><A
3229 HREF="#GUESTONLY"
3230 ><TT
3231 CLASS="PARAMETER"
3232 ><I
3233 >guest only</I
3234 ></TT
3235 ></A
3236 ></P
3237 ></LI
3238 ><LI
3239 ><P
3240 ><A
3241 HREF="#HIDEDOTFILES"
3242 ><TT
3243 CLASS="PARAMETER"
3244 ><I
3245 >hide dot files</I
3246 ></TT
3247 ></A
3248 ></P
3249 ></LI
3250 ><LI
3251 ><P
3252 ><A
3253 HREF="#HIDEFILES"
3254 ><TT
3255 CLASS="PARAMETER"
3256 ><I
3257 >hide files</I
3258 ></TT
3259 ></A
3260 ></P
3261 ></LI
3262 ><LI
3263 ><P
3264 ><A
3265 HREF="#HOSTSALLOW"
3266 ><TT
3267 CLASS="PARAMETER"
3268 ><I
3269 >hosts allow</I
3270 ></TT
3271 ></A
3272 ></P
3273 ></LI
3274 ><LI
3275 ><P
3276 ><A
3277 HREF="#HOSTSDENY"
3278 ><TT
3279 CLASS="PARAMETER"
3280 ><I
3281 >hosts deny</I
3282 ></TT
3283 ></A
3284 ></P
3285 ></LI
3286 ><LI
3287 ><P
3288 ><A
3289 HREF="#INCLUDE"
3290 ><TT
3291 CLASS="PARAMETER"
3292 ><I
3293 >include</I
3294 ></TT
3295 ></A
3296 ></P
3297 ></LI
3298 ><LI
3299 ><P
3300 ><A
3301 HREF="#INHERITPERMISSIONS"
3302 ><TT
3303 CLASS="PARAMETER"
3304 ><I
3305 >inherit permissions</I
3306 ></TT
3307 ></A
3308 ></P
3309 ></LI
3310 ><LI
3311 ><P
3312 ><A
3313 HREF="#INVALIDUSERS"
3314 ><TT
3315 CLASS="PARAMETER"
3316 ><I
3317 >invalid users</I
3318 ></TT
3319 ></A
3320 ></P
3321 ></LI
3322 ><LI
3323 ><P
3324 ><A
3325 HREF="#LEVEL2OPLOCKS"
3326 ><TT
3327 CLASS="PARAMETER"
3328 ><I
3329 >level2 oplocks</I
3330 ></TT
3331 ></A
3332 ></P
3333 ></LI
3334 ><LI
3335 ><P
3336 ><A
3337 HREF="#LOCKING"
3338 ><TT
3339 CLASS="PARAMETER"
3340 ><I
3341 >locking</I
3342 ></TT
3343 ></A
3344 ></P
3345 ></LI
3346 ><LI
3347 ><P
3348 ><A
3349 HREF="#LPPAUSECOMMAND"
3350 ><TT
3351 CLASS="PARAMETER"
3352 ><I
3353 >lppause command</I
3354 ></TT
3355 ></A
3356 ></P
3357 ></LI
3358 ><LI
3359 ><P
3360 ><A
3361 HREF="#LPQCOMMAND"
3362 ><TT
3363 CLASS="PARAMETER"
3364 ><I
3365 >lpq command</I
3366 ></TT
3367 ></A
3368 ></P
3369 ></LI
3370 ><LI
3371 ><P
3372 ><A
3373 HREF="#LPRESUMECOMMAND"
3374 ><TT
3375 CLASS="PARAMETER"
3376 ><I
3377 >lpresume command</I
3378 ></TT
3379 ></A
3380 ></P
3381 ></LI
3382 ><LI
3383 ><P
3384 ><A
3385 HREF="#LPRMCOMMAND"
3386 ><TT
3387 CLASS="PARAMETER"
3388 ><I
3389 >lprm command</I
3390 ></TT
3391 ></A
3392 ></P
3393 ></LI
3394 ><LI
3395 ><P
3396 ><A
3397 HREF="#MAGICOUTPUT"
3398 ><TT
3399 CLASS="PARAMETER"
3400 ><I
3401 >magic output</I
3402 ></TT
3403 ></A
3404 ></P
3405 ></LI
3406 ><LI
3407 ><P
3408 ><A
3409 HREF="#MAGICSCRIPT"
3410 ><TT
3411 CLASS="PARAMETER"
3412 ><I
3413 >magic script</I
3414 ></TT
3415 ></A
3416 ></P
3417 ></LI
3418 ><LI
3419 ><P
3420 ><A
3421 HREF="#MANGLECASE"
3422 ><TT
3423 CLASS="PARAMETER"
3424 ><I
3425 >mangle case</I
3426 ></TT
3427 ></A
3428 ></P
3429 ></LI
3430 ><LI
3431 ><P
3432 ><A
3433 HREF="#MANGLEDMAP"
3434 ><TT
3435 CLASS="PARAMETER"
3436 ><I
3437 >mangled map</I
3438 ></TT
3439 ></A
3440 ></P
3441 ></LI
3442 ><LI
3443 ><P
3444 ><A
3445 HREF="#MANGLEDNAMES"
3446 ><TT
3447 CLASS="PARAMETER"
3448 ><I
3449 >mangled names</I
3450 ></TT
3451 ></A
3452 ></P
3453 ></LI
3454 ><LI
3455 ><P
3456 ><A
3457 HREF="#MANGLINGCHAR"
3458 ><TT
3459 CLASS="PARAMETER"
3460 ><I
3461 >mangling char</I
3462 ></TT
3463 ></A
3464 ></P
3465 ></LI
3466 ><LI
3467 ><P
3468 ><A
3469 HREF="#MAPARCHIVE"
3470 ><TT
3471 CLASS="PARAMETER"
3472 ><I
3473 >map archive</I
3474 ></TT
3475 ></A
3476 ></P
3477 ></LI
3478 ><LI
3479 ><P
3480 ><A
3481 HREF="#MAPHIDDEN"
3482 ><TT
3483 CLASS="PARAMETER"
3484 ><I
3485 >map hidden</I
3486 ></TT
3487 ></A
3488 ></P
3489 ></LI
3490 ><LI
3491 ><P
3492 ><A
3493 HREF="#MAPSYSTEM"
3494 ><TT
3495 CLASS="PARAMETER"
3496 ><I
3497 >map system</I
3498 ></TT
3499 ></A
3500 ></P
3501 ></LI
3502 ><LI
3503 ><P
3504 ><A
3505 HREF="#MAXCONNECTIONS"
3506 ><TT
3507 CLASS="PARAMETER"
3508 ><I
3509 >max connections</I
3510 ></TT
3511 ></A
3512 ></P
3513 ></LI
3514 ><LI
3515 ><P
3516 ><A
3517 HREF="#MAXPRINTJOBS"
3518 ><TT
3519 CLASS="PARAMETER"
3520 ><I
3521 >max print jobs</I
3522 ></TT
3523 ></A
3524 ></P
3525 ></LI
3526 ><LI
3527 ><P
3528 ><A
3529 HREF="#MINPRINTSPACE"
3530 ><TT
3531 CLASS="PARAMETER"
3532 ><I
3533 >min print space</I
3534 ></TT
3535 ></A
3536 ></P
3537 ></LI
3538 ><LI
3539 ><P
3540 ><A
3541 HREF="#MSDFSROOT"
3542 ><TT
3543 CLASS="PARAMETER"
3544 ><I
3545 >msdfs root</I
3546 ></TT
3547 ></A
3548 ></P
3549 ></LI
3550 ><LI
3551 ><P
3552 ><A
3553 HREF="#ONLYGUEST"
3554 ><TT
3555 CLASS="PARAMETER"
3556 ><I
3557 >only guest</I
3558 ></TT
3559 ></A
3560 ></P
3561 ></LI
3562 ><LI
3563 ><P
3564 ><A
3565 HREF="#ONLYUSER"
3566 ><TT
3567 CLASS="PARAMETER"
3568 ><I
3569 >only user</I
3570 ></TT
3571 ></A
3572 ></P
3573 ></LI
3574 ><LI
3575 ><P
3576 ><A
3577 HREF="#OPLOCKCONTENTIONLIMIT"
3578 ><TT
3579 CLASS="PARAMETER"
3580 ><I
3581 >oplock contention limit</I
3582 ></TT
3583 ></A
3584 ></P
3585 ></LI
3586 ><LI
3587 ><P
3588 ><A
3589 HREF="#OPLOCKS"
3590 ><TT
3591 CLASS="PARAMETER"
3592 ><I
3593 >oplocks</I
3594 ></TT
3595 ></A
3596 ></P
3597 ></LI
3598 ><LI
3599 ><P
3600 ><A
3601 HREF="#PATH"
3602 ><TT
3603 CLASS="PARAMETER"
3604 ><I
3605 >path</I
3606 ></TT
3607 ></A
3608 ></P
3609 ></LI
3610 ><LI
3611 ><P
3612 ><A
3613 HREF="#POSIXLOCKING"
3614 ><TT
3615 CLASS="PARAMETER"
3616 ><I
3617 >posix locking</I
3618 ></TT
3619 ></A
3620 ></P
3621 ></LI
3622 ><LI
3623 ><P
3624 ><A
3625 HREF="#POSTEXEC"
3626 ><TT
3627 CLASS="PARAMETER"
3628 ><I
3629 >postexec</I
3630 ></TT
3631 ></A
3632 ></P
3633 ></LI
3634 ><LI
3635 ><P
3636 ><A
3637 HREF="#POSTSCRIPT"
3638 ><TT
3639 CLASS="PARAMETER"
3640 ><I
3641 >postscript</I
3642 ></TT
3643 ></A
3644 ></P
3645 ></LI
3646 ><LI
3647 ><P
3648 ><A
3649 HREF="#PREEXEC"
3650 ><TT
3651 CLASS="PARAMETER"
3652 ><I
3653 >preexec</I
3654 ></TT
3655 ></A
3656 ></P
3657 ></LI
3658 ><LI
3659 ><P
3660 ><A
3661 HREF="#PREEXECCLOSE"
3662 ><TT
3663 CLASS="PARAMETER"
3664 ><I
3665 >preexec close</I
3666 ></TT
3667 ></A
3668 ></P
3669 ></LI
3670 ><LI
3671 ><P
3672 ><A
3673 HREF="#PRESERVECASE"
3674 ><TT
3675 CLASS="PARAMETER"
3676 ><I
3677 >preserve case</I
3678 ></TT
3679 ></A
3680 ></P
3681 ></LI
3682 ><LI
3683 ><P
3684 ><A
3685 HREF="#PRINTCOMMAND"
3686 ><TT
3687 CLASS="PARAMETER"
3688 ><I
3689 >print command</I
3690 ></TT
3691 ></A
3692 ></P
3693 ></LI
3694 ><LI
3695 ><P
3696 ><A
3697 HREF="#PRINTOK"
3698 ><TT
3699 CLASS="PARAMETER"
3700 ><I
3701 >print ok</I
3702 ></TT
3703 ></A
3704 ></P
3705 ></LI
3706 ><LI
3707 ><P
3708 ><A
3709 HREF="#PRINTABLE"
3710 ><TT
3711 CLASS="PARAMETER"
3712 ><I
3713 >printable</I
3714 ></TT
3715 ></A
3716 ></P
3717 ></LI
3718 ><LI
3719 ><P
3720 ><A
3721 HREF="#PRINTER"
3722 ><TT
3723 CLASS="PARAMETER"
3724 ><I
3725 >printer</I
3726 ></TT
3727 ></A
3728 ></P
3729 ></LI
3730 ><LI
3731 ><P
3732 ><A
3733 HREF="#PRINTERADMIN"
3734 ><TT
3735 CLASS="PARAMETER"
3736 ><I
3737 >printer admin</I
3738 ></TT
3739 ></A
3740 ></P
3741 ></LI
3742 ><LI
3743 ><P
3744 ><A
3745 HREF="#PRINTERDRIVER"
3746 ><TT
3747 CLASS="PARAMETER"
3748 ><I
3749 >printer driver</I
3750 ></TT
3751 ></A
3752 ></P
3753 ></LI
3754 ><LI
3755 ><P
3756 ><A
3757 HREF="#PRINTERDRIVERLOCATION"
3758 ><TT
3759 CLASS="PARAMETER"
3760 ><I
3761 >printer driver location</I
3762 ></TT
3763 ></A
3764 ></P
3765 ></LI
3766 ><LI
3767 ><P
3768 ><A
3769 HREF="#PRINTERNAME"
3770 ><TT
3771 CLASS="PARAMETER"
3772 ><I
3773 >printer name</I
3774 ></TT
3775 ></A
3776 ></P
3777 ></LI
3778 ><LI
3779 ><P
3780 ><A
3781 HREF="#PRINTING"
3782 ><TT
3783 CLASS="PARAMETER"
3784 ><I
3785 >printing</I
3786 ></TT
3787 ></A
3788 ></P
3789 ></LI
3790 ><LI
3791 ><P
3792 ><A
3793 HREF="#PUBLIC"
3794 ><TT
3795 CLASS="PARAMETER"
3796 ><I
3797 >public</I
3798 ></TT
3799 ></A
3800 ></P
3801 ></LI
3802 ><LI
3803 ><P
3804 ><A
3805 HREF="#QUEUEPAUSECOMMAND"
3806 ><TT
3807 CLASS="PARAMETER"
3808 ><I
3809 >queuepause command</I
3810 ></TT
3811 ></A
3812 ></P
3813 ></LI
3814 ><LI
3815 ><P
3816 ><A
3817 HREF="#QUEUERESUMECOMMAND"
3818 ><TT
3819 CLASS="PARAMETER"
3820 ><I
3821 >queueresume command</I
3822 ></TT
3823 ></A
3824 ></P
3825 ></LI
3826 ><LI
3827 ><P
3828 ><A
3829 HREF="#READLIST"
3830 ><TT
3831 CLASS="PARAMETER"
3832 ><I
3833 >read list</I
3834 ></TT
3835 ></A
3836 ></P
3837 ></LI
3838 ><LI
3839 ><P
3840 ><A
3841 HREF="#READONLY"
3842 ><TT
3843 CLASS="PARAMETER"
3844 ><I
3845 >read only</I
3846 ></TT
3847 ></A
3848 ></P
3849 ></LI
3850 ><LI
3851 ><P
3852 ><A
3853 HREF="#ROOTPOSTEXEC"
3854 ><TT
3855 CLASS="PARAMETER"
3856 ><I
3857 >root postexec</I
3858 ></TT
3859 ></A
3860 ></P
3861 ></LI
3862 ><LI
3863 ><P
3864 ><A
3865 HREF="#ROOTPREEXEC"
3866 ><TT
3867 CLASS="PARAMETER"
3868 ><I
3869 >root preexec</I
3870 ></TT
3871 ></A
3872 ></P
3873 ></LI
3874 ><LI
3875 ><P
3876 ><A
3877 HREF="#ROOTPREEXECCLOSE"
3878 ><TT
3879 CLASS="PARAMETER"
3880 ><I
3881 >root preexec close</I
3882 ></TT
3883 ></A
3884 ></P
3885 ></LI
3886 ><LI
3887 ><P
3888 ><A
3889 HREF="#SECURITYMASK"
3890 ><TT
3891 CLASS="PARAMETER"
3892 ><I
3893 >security mask</I
3894 ></TT
3895 ></A
3896 ></P
3897 ></LI
3898 ><LI
3899 ><P
3900 ><A
3901 HREF="#SETDIRECTORY"
3902 ><TT
3903 CLASS="PARAMETER"
3904 ><I
3905 >set directory</I
3906 ></TT
3907 ></A
3908 ></P
3909 ></LI
3910 ><LI
3911 ><P
3912 ><A
3913 HREF="#SHAREMODES"
3914 ><TT
3915 CLASS="PARAMETER"
3916 ><I
3917 >share modes</I
3918 ></TT
3919 ></A
3920 ></P
3921 ></LI
3922 ><LI
3923 ><P
3924 ><A
3925 HREF="#SHORTPRESERVECASE"
3926 ><TT
3927 CLASS="PARAMETER"
3928 ><I
3929 >short preserve case</I
3930 ></TT
3931 ></A
3932 ></P
3933 ></LI
3934 ><LI
3935 ><P
3936 ><A
3937 HREF="#STATUS"
3938 ><TT
3939 CLASS="PARAMETER"
3940 ><I
3941 >status</I
3942 ></TT
3943 ></A
3944 ></P
3945 ></LI
3946 ><LI
3947 ><P
3948 ><A
3949 HREF="#STRICTLOCKING"
3950 ><TT
3951 CLASS="PARAMETER"
3952 ><I
3953 >strict locking</I
3954 ></TT
3955 ></A
3956 ></P
3957 ></LI
3958 ><LI
3959 ><P
3960 ><A
3961 HREF="#STRICTSYNC"
3962 ><TT
3963 CLASS="PARAMETER"
3964 ><I
3965 >strict sync</I
3966 ></TT
3967 ></A
3968 ></P
3969 ></LI
3970 ><LI
3971 ><P
3972 ><A
3973 HREF="#SYNCALWAYS"
3974 ><TT
3975 CLASS="PARAMETER"
3976 ><I
3977 >sync always</I
3978 ></TT
3979 ></A
3980 ></P
3981 ></LI
3982 ><LI
3983 ><P
3984 ><A
3985 HREF="#USER"
3986 ><TT
3987 CLASS="PARAMETER"
3988 ><I
3989 >user</I
3990 ></TT
3991 ></A
3992 ></P
3993 ></LI
3994 ><LI
3995 ><P
3996 ><A
3997 HREF="#USERNAME"
3998 ><TT
3999 CLASS="PARAMETER"
4000 ><I
4001 >username</I
4002 ></TT
4003 ></A
4004 ></P
4005 ></LI
4006 ><LI
4007 ><P
4008 ><A
4009 HREF="#USERS"
4010 ><TT
4011 CLASS="PARAMETER"
4012 ><I
4013 >users</I
4014 ></TT
4015 ></A
4016 ></P
4017 ></LI
4018 ><LI
4019 ><P
4020 ><A
4021 HREF="#UTMP"
4022 ><TT
4023 CLASS="PARAMETER"
4024 ><I
4025 >utmp</I
4026 ></TT
4027 ></A
4028 ></P
4029 ></LI
4030 ><LI
4031 ><P
4032 ><A
4033 HREF="#VALIDUSERS"
4034 ><TT
4035 CLASS="PARAMETER"
4036 ><I
4037 >valid users</I
4038 ></TT
4039 ></A
4040 ></P
4041 ></LI
4042 ><LI
4043 ><P
4044 ><A
4045 HREF="#VETOFILES"
4046 ><TT
4047 CLASS="PARAMETER"
4048 ><I
4049 >veto files</I
4050 ></TT
4051 ></A
4052 ></P
4053 ></LI
4054 ><LI
4055 ><P
4056 ><A
4057 HREF="#VETOOPLOCKFILES"
4058 ><TT
4059 CLASS="PARAMETER"
4060 ><I
4061 >veto oplock files</I
4062 ></TT
4063 ></A
4064 ></P
4065 ></LI
4066 ><LI
4067 ><P
4068 ><A
4069 HREF="#VFSOBJECT"
4070 ><TT
4071 CLASS="PARAMETER"
4072 ><I
4073 >vfs object</I
4074 ></TT
4075 ></A
4076 ></P
4077 ></LI
4078 ><LI
4079 ><P
4080 ><A
4081 HREF="#VFSOPTIONS"
4082 ><TT
4083 CLASS="PARAMETER"
4084 ><I
4085 >vfs options</I
4086 ></TT
4087 ></A
4088 ></P
4089 ></LI
4090 ><LI
4091 ><P
4092 ><A
4093 HREF="#VOLUME"
4094 ><TT
4095 CLASS="PARAMETER"
4096 ><I
4097 >volume</I
4098 ></TT
4099 ></A
4100 ></P
4101 ></LI
4102 ><LI
4103 ><P
4104 ><A
4105 HREF="#WIDELINKS"
4106 ><TT
4107 CLASS="PARAMETER"
4108 ><I
4109 >wide links</I
4110 ></TT
4111 ></A
4112 ></P
4113 ></LI
4114 ><LI
4115 ><P
4116 ><A
4117 HREF="#WRITABLE"
4118 ><TT
4119 CLASS="PARAMETER"
4120 ><I
4121 >writable</I
4122 ></TT
4123 ></A
4124 ></P
4125 ></LI
4126 ><LI
4127 ><P
4128 ><A
4129 HREF="#WRITECACHESIZE"
4130 ><TT
4131 CLASS="PARAMETER"
4132 ><I
4133 >write cache size</I
4134 ></TT
4135 ></A
4136 ></P
4137 ></LI
4138 ><LI
4139 ><P
4140 ><A
4141 HREF="#WRITELIST"
4142 ><TT
4143 CLASS="PARAMETER"
4144 ><I
4145 >write list</I
4146 ></TT
4147 ></A
4148 ></P
4149 ></LI
4150 ><LI
4151 ><P
4152 ><A
4153 HREF="#WRITEOK"
4154 ><TT
4155 CLASS="PARAMETER"
4156 ><I
4157 >write ok</I
4158 ></TT
4159 ></A
4160 ></P
4161 ></LI
4162 ><LI
4163 ><P
4164 ><A
4165 HREF="#WRITEABLE"
4166 ><TT
4167 CLASS="PARAMETER"
4168 ><I
4169 >writeable</I
4170 ></TT
4171 ></A
4172 ></P
4173 ></LI
4174 ></UL
4175 ></DIV
4176 ><DIV
4177 CLASS="REFSECT1"
4178 ><A
4179 NAME="AEN1361"
4180 ></A
4181 ><H2
4182 >EXPLANATION OF EACH PARAMETER</H2
4183 ><P
4184 ></P
4185 ><DIV
4186 CLASS="VARIABLELIST"
4187 ><DL
4188 ><DT
4189 ><A
4190 NAME="ADDUSERSCRIPT"
4191 ></A
4192 >add user script (G)</DT
4193 ><DD
4194 ><P
4195 >This is the full pathname to a script that will
4196                 be run <EM
4197 >AS ROOT</EM
4198 > by <A
4199 HREF="smbd.8.html"
4200 TARGET="_top"
4201 >smbd(8)
4202                 </A
4203 > under special circumstances described below.</P
4204 ><P
4205 >Normally, a Samba server requires that UNIX users are
4206                 created for all users accessing files on this server. For sites
4207                 that use Windows NT account databases as their primary user database
4208                 creating these users and keeping the user list in sync with the
4209                 Windows NT PDC is an onerous task. This option allows <A
4210 HREF="smbd.8.html"
4211 TARGET="_top"
4212 >smbd</A
4213 > to create the required UNIX users
4214                 <EM
4215 >ON DEMAND</EM
4216 > when a user accesses the Samba server.</P
4217 ><P
4218 >In order to use this option, <A
4219 HREF="smbd.8.html"
4220 TARGET="_top"
4221 >smbd</A
4222 >
4223                 must be set to <TT
4224 CLASS="PARAMETER"
4225 ><I
4226 >security=server</I
4227 ></TT
4228 > or <TT
4229 CLASS="PARAMETER"
4230 ><I
4231 >               security=domain</I
4232 ></TT
4233 > and <TT
4234 CLASS="PARAMETER"
4235 ><I
4236 >add user script</I
4237 ></TT
4238 >
4239                 must be set to a full pathname for a script that will create a UNIX
4240                 user given one argument of <TT
4241 CLASS="PARAMETER"
4242 ><I
4243 >%u</I
4244 ></TT
4245 >, which expands into
4246                 the UNIX user name to create.</P
4247 ><P
4248 >When the Windows user attempts to access the Samba server,
4249                 at login (session setup in the SMB protocol) time, <A
4250 HREF="smbd.8.html"
4251 TARGET="_top"
4252 >               smbd</A
4253 > contacts the <TT
4254 CLASS="PARAMETER"
4255 ><I
4256 >password server</I
4257 ></TT
4258 > and
4259                 attempts to authenticate the given user with the given password. If the
4260                 authentication succeeds then <B
4261 CLASS="COMMAND"
4262 >smbd</B
4263 >
4264                 attempts to find a UNIX user in the UNIX password database to map the
4265                 Windows user into. If this lookup fails, and <TT
4266 CLASS="PARAMETER"
4267 ><I
4268 >add user script
4269                 </I
4270 ></TT
4271 > is set then <B
4272 CLASS="COMMAND"
4273 >smbd</B
4274 > will
4275                 call the specified script <EM
4276 >AS ROOT</EM
4277 >, expanding
4278                 any <TT
4279 CLASS="PARAMETER"
4280 ><I
4281 >%u</I
4282 ></TT
4283 > argument to be the user name to create.</P
4284 ><P
4285 >If this script successfully creates the user then <B
4286 CLASS="COMMAND"
4287 >smbd
4288                 </B
4289 > will continue on as though the UNIX user
4290                 already existed. In this way, UNIX users are dynamically created to
4291                 match existing Windows NT accounts.</P
4292 ><P
4293 >See also <A
4294 HREF="#SECURITY"
4295 ><TT
4296 CLASS="PARAMETER"
4297 ><I
4298 >               security</I
4299 ></TT
4300 ></A
4301 >, <A
4302 HREF="#PASSWORDSERVER"
4303 >               <TT
4304 CLASS="PARAMETER"
4305 ><I
4306 >password server</I
4307 ></TT
4308 ></A
4309 >,
4310                 <A
4311 HREF="#DELETEUSERSCRIPT"
4312 ><TT
4313 CLASS="PARAMETER"
4314 ><I
4315 >delete user
4316                 script</I
4317 ></TT
4318 ></A
4319 >.</P
4320 ><P
4321 >Default: <B
4322 CLASS="COMMAND"
4323 >add user script = &#60;empty string&#62;
4324                 </B
4325 ></P
4326 ><P
4327 >Example: <B
4328 CLASS="COMMAND"
4329 >add user script = /usr/local/samba/bin/add_user
4330                 %u</B
4331 ></P
4332 ></DD
4333 ><DT
4334 ><A
4335 NAME="ADDPRINTERCOMMAND"
4336 ></A
4337 >addprinter command (G)</DT
4338 ><DD
4339 ><P
4340 >With the introduction of MS-RPC based printing
4341                 support for Windows NT/2000 clients in Samba 2.2, The MS Add
4342                 Printer Wizard (APW) icon is now also available in the
4343                 "Printers..." folder displayed a share listing.  The APW
4344                 allows for printers to be add remotely to a Samba or Windows
4345                 NT/2000 print server.</P
4346 ><P
4347 >For a Samba host this means that the printer must be
4348                 physically added to underlying printing system.  The <TT
4349 CLASS="PARAMETER"
4350 ><I
4351 >               addprinter command</I
4352 ></TT
4353 > defines a script to be run which
4354                 will perform the necessary operations for adding the printer
4355                 to the print system and to add the appropriate service definition
4356                 to the  <TT
4357 CLASS="FILENAME"
4358 >smb.conf</TT
4359 > file in order that it can be
4360                 shared by <A
4361 HREF="smbd.8.html"
4362 TARGET="_top"
4363 ><B
4364 CLASS="COMMAND"
4365 >smbd(8)</B
4366 >
4367                 </A
4368 >.</P
4369 ><P
4370 >The <TT
4371 CLASS="PARAMETER"
4372 ><I
4373 >addprinter command</I
4374 ></TT
4375 > is
4376                 automatically invoked with the following parameter (in
4377                 order:</P
4378 ><P
4379 ></P
4380 ><UL
4381 ><LI
4382 ><P
4383 ><TT
4384 CLASS="PARAMETER"
4385 ><I
4386 >printer name</I
4387 ></TT
4388 ></P
4389 ></LI
4390 ><LI
4391 ><P
4392 ><TT
4393 CLASS="PARAMETER"
4394 ><I
4395 >share name</I
4396 ></TT
4397 ></P
4398 ></LI
4399 ><LI
4400 ><P
4401 ><TT
4402 CLASS="PARAMETER"
4403 ><I
4404 >port name</I
4405 ></TT
4406 ></P
4407 ></LI
4408 ><LI
4409 ><P
4410 ><TT
4411 CLASS="PARAMETER"
4412 ><I
4413 >driver name</I
4414 ></TT
4415 ></P
4416 ></LI
4417 ><LI
4418 ><P
4419 ><TT
4420 CLASS="PARAMETER"
4421 ><I
4422 >location</I
4423 ></TT
4424 ></P
4425 ></LI
4426 ><LI
4427 ><P
4428 ><TT
4429 CLASS="PARAMETER"
4430 ><I
4431 >Windows 9x driver location</I
4432 ></TT
4433 >
4434                         </P
4435 ></LI
4436 ></UL
4437 ><P
4438 >All parameters are filled in from the PRINTER_INFO_2 structure sent
4439                 by the Windows NT/2000 client with one exception.  The "Windows 9x
4440                 driver location" parameter is included for backwards compatibility
4441                 only.  The remaining fields in the structure are generated from answers
4442                 to the APW questions.</P
4443 ><P
4444 >Once the <TT
4445 CLASS="PARAMETER"
4446 ><I
4447 >addprinter command</I
4448 ></TT
4449 > has
4450                 been executed, <B
4451 CLASS="COMMAND"
4452 >smbd</B
4453 > will reparse the <TT
4454 CLASS="FILENAME"
4455 >               smb.conf</TT
4456 > to determine if the share defined by the APW
4457                 exists.  If the sharename is still invalid, then <B
4458 CLASS="COMMAND"
4459 >smbd
4460                 </B
4461 > will return an ACCESS_DENIED error to the client.</P
4462 ><P
4463 >See also <A
4464 HREF="#DELETEPRINTERCOMMAND"
4465 ><TT
4466 CLASS="PARAMETER"
4467 ><I
4468 >               deleteprinter command</I
4469 ></TT
4470 ></A
4471 >, <A
4472 HREF="#PRINTING"
4473 ><TT
4474 CLASS="PARAMETER"
4475 ><I
4476 >printing</I
4477 ></TT
4478 ></A
4479 >,
4480                 <A
4481 HREF="#SHOWADDPRINTERWIZARD"
4482 ><TT
4483 CLASS="PARAMETER"
4484 ><I
4485 >show add
4486                 printer wizard</I
4487 ></TT
4488 ></A
4489 ></P
4490 ><P
4491 >Default: <EM
4492 >none</EM
4493 ></P
4494 ><P
4495 >Example: <B
4496 CLASS="COMMAND"
4497 >addprinter command = /usr/bin/addprinter
4498                 </B
4499 ></P
4500 ></DD
4501 ><DT
4502 ><A
4503 NAME="ADMINUSERS"
4504 ></A
4505 >admin users (S)</DT
4506 ><DD
4507 ><P
4508 >This is a list of users who will be granted
4509                 administrative privileges on the share. This means that they
4510                 will do all file operations as the super-user (root).</P
4511 ><P
4512 >You should use this option very carefully, as any user in
4513                 this list will be able to do anything they like on the share,
4514                 irrespective of file permissions.</P
4515 ><P
4516 >Default: <EM
4517 >no admin users</EM
4518 ></P
4519 ><P
4520 >Example: <B
4521 CLASS="COMMAND"
4522 >admin users = jason</B
4523 ></P
4524 ></DD
4525 ><DT
4526 ><A
4527 NAME="ALLOWHOSTS"
4528 ></A
4529 >allow hosts (S)</DT
4530 ><DD
4531 ><P
4532 >Synonym for <A
4533 HREF="#HOSTSALLOW"
4534 >               <TT
4535 CLASS="PARAMETER"
4536 ><I
4537 >hosts allow</I
4538 ></TT
4539 ></A
4540 >.</P
4541 ></DD
4542 ><DT
4543 ><A
4544 NAME="ALLOWTRUSTEDDOMAINS"
4545 ></A
4546 >allow trusted domains (G)</DT
4547 ><DD
4548 ><P
4549 >This option only takes effect when the <A
4550 HREF="#SECURITY"
4551 ><TT
4552 CLASS="PARAMETER"
4553 ><I
4554 >security</I
4555 ></TT
4556 ></A
4557 > option is set to
4558                 <TT
4559 CLASS="CONSTANT"
4560 >server</TT
4561 > or <TT
4562 CLASS="CONSTANT"
4563 >domain</TT
4564 >.
4565                 If it is set to no, then attempts to connect to a resource from
4566                 a domain or workgroup other than the one which smbd is running
4567                 in will fail, even if that domain is trusted by the remote server
4568                 doing the authentication.</P
4569 ><P
4570 >This is useful if you only want your Samba server to
4571                 serve resources to users in the domain it is a member of. As
4572                 an example, suppose that there are two domains DOMA and DOMB.  DOMB
4573                 is trusted by DOMA, which contains the Samba server.  Under normal
4574                 circumstances, a user with an account in DOMB can then access the
4575                 resources of a UNIX account with the same account name on the
4576                 Samba server even if they do not have an account in DOMA.  This
4577                 can make implementing a security boundary difficult.</P
4578 ><P
4579 >Default: <B
4580 CLASS="COMMAND"
4581 >allow trusted domains = yes</B
4582 ></P
4583 ></DD
4584 ><DT
4585 ><A
4586 NAME="ANNOUNCEAS"
4587 ></A
4588 >announce as (G)</DT
4589 ><DD
4590 ><P
4591 >This specifies what type of server
4592                 <A
4593 HREF="nmbd.8.html"
4594 TARGET="_top"
4595 ><B
4596 CLASS="COMMAND"
4597 >nmbd</B
4598 ></A
4599 >
4600                 will announce itself as, to a network neighborhood browse
4601                 list. By default this is set to Windows NT. The valid options
4602                 are : "NT Server" (which can also be written as "NT"),
4603                 "NT Workstation", "Win95" or "WfW" meaning Windows NT Server,
4604                 Windows NT Workstation, Windows 95 and Windows for Workgroups
4605                 respectively. Do not change this parameter unless you have a
4606                 specific need to stop Samba appearing as an NT server as this
4607                 may prevent Samba servers from participating as browser servers
4608                 correctly.</P
4609 ><P
4610 >Default: <B
4611 CLASS="COMMAND"
4612 >announce as = NT Server</B
4613 ></P
4614 ><P
4615 >Example: <B
4616 CLASS="COMMAND"
4617 >announce as = Win95</B
4618 ></P
4619 ></DD
4620 ><DT
4621 ><A
4622 NAME="ANNOUNCEVERSION"
4623 ></A
4624 >annouce version (G)</DT
4625 ><DD
4626 ><P
4627 >This specifies the major and minor version numbers
4628                 that nmbd will use when announcing itself as a server. The default
4629                 is 4.2.  Do not change this parameter unless you have a specific
4630                 need to set a Samba server to be a downlevel server.</P
4631 ><P
4632 >Default: <B
4633 CLASS="COMMAND"
4634 >announce version = 4.2</B
4635 ></P
4636 ><P
4637 >Example: <B
4638 CLASS="COMMAND"
4639 >announce version = 2.0</B
4640 ></P
4641 ></DD
4642 ><DT
4643 ><A
4644 NAME="AUTOSERVICES"
4645 ></A
4646 >auto services (G)</DT
4647 ><DD
4648 ><P
4649 >This is a synonym for the <A
4650 HREF="#PRELOAD"
4651 >               <TT
4652 CLASS="PARAMETER"
4653 ><I
4654 >preload</I
4655 ></TT
4656 ></A
4657 >.</P
4658 ></DD
4659 ><DT
4660 ><A
4661 NAME="AVAILABLE"
4662 ></A
4663 >available (S)</DT
4664 ><DD
4665 ><P
4666 >This parameter lets you "turn off" a service. If
4667                 <TT
4668 CLASS="PARAMETER"
4669 ><I
4670 >available = no</I
4671 ></TT
4672 >, then <EM
4673 >ALL</EM
4674 >
4675                 attempts to connect to the service will fail. Such failures are
4676                 logged.</P
4677 ><P
4678 >Default: <B
4679 CLASS="COMMAND"
4680 >available = yes</B
4681 ></P
4682 ></DD
4683 ><DT
4684 ><A
4685 NAME="BINDINTERFACESONLY"
4686 ></A
4687 >bind interfaces only (G)</DT
4688 ><DD
4689 ><P
4690 >This global parameter allows the Samba admin
4691                 to limit what interfaces on a machine will serve smb requests. If
4692                 affects file service <A
4693 HREF="smbd.8.html"
4694 TARGET="_top"
4695 >smbd(8)</A
4696 > and
4697                 name service <A
4698 HREF="nmbd.8.html"
4699 TARGET="_top"
4700 >nmbd(8)</A
4701 > in slightly
4702                 different ways.</P
4703 ><P
4704 >For name service it causes <B
4705 CLASS="COMMAND"
4706 >nmbd</B
4707 > to bind
4708                 to ports 137 and 138 on the interfaces listed in the <A
4709 HREF="#INTERFACES"
4710 >interfaces</A
4711 > parameter. <B
4712 CLASS="COMMAND"
4713 >nmbd
4714                 </B
4715 > also binds to the "all addresses" interface (0.0.0.0)
4716                 on ports 137 and 138 for the purposes of reading broadcast messages.
4717                 If this option is not set then <B
4718 CLASS="COMMAND"
4719 >nmbd</B
4720 > will service
4721                 name requests on all of these sockets. If <TT
4722 CLASS="PARAMETER"
4723 ><I
4724 >bind interfaces
4725                 only</I
4726 ></TT
4727 > is set then <B
4728 CLASS="COMMAND"
4729 >nmbd</B
4730 > will check the
4731                 source address of any packets coming in on the broadcast sockets
4732                 and discard any that don't match the broadcast addresses of the
4733                 interfaces in the <TT
4734 CLASS="PARAMETER"
4735 ><I
4736 >interfaces</I
4737 ></TT
4738 > parameter list.
4739                 As unicast packets are received on the other sockets it allows
4740                 <B
4741 CLASS="COMMAND"
4742 >nmbd</B
4743 > to refuse to serve names to machines that
4744                 send packets that arrive through any interfaces not listed in the
4745                 <TT
4746 CLASS="PARAMETER"
4747 ><I
4748 >interfaces</I
4749 ></TT
4750 > list.  IP Source address spoofing
4751                 does defeat this simple check, however so it must not be used
4752                 seriously as a security feature for <B
4753 CLASS="COMMAND"
4754 >nmbd</B
4755 >.</P
4756 ><P
4757 >For file service it causes <A
4758 HREF="smbd.8.html"
4759 TARGET="_top"
4760 >smbd(8)</A
4761 >
4762                 to bind only to the interface list given in the <A
4763 HREF="#INTERFACES"
4764 >               interfaces</A
4765 > parameter. This restricts the networks that
4766                 <B
4767 CLASS="COMMAND"
4768 >smbd</B
4769 > will serve to packets coming in those
4770                 interfaces.  Note that you should not use this parameter for machines
4771                 that are serving PPP or other intermittent or non-broadcast network
4772                 interfaces as it will not cope with non-permanent interfaces.</P
4773 ><P
4774 >If <TT
4775 CLASS="PARAMETER"
4776 ><I
4777 >bind interfaces only</I
4778 ></TT
4779 > is set then
4780                 unless the network address <EM
4781 >127.0.0.1</EM
4782 > is added
4783                 to the <TT
4784 CLASS="PARAMETER"
4785 ><I
4786 >interfaces</I
4787 ></TT
4788 > parameter list <A
4789 HREF="smbpasswd.8.html"
4790 TARGET="_top"
4791 ><B
4792 CLASS="COMMAND"
4793 >smbpasswd(8)</B
4794 ></A
4795 >
4796                 and <A
4797 HREF="swat.8.html"
4798 TARGET="_top"
4799 ><B
4800 CLASS="COMMAND"
4801 >swat(8)</B
4802 ></A
4803 > may
4804                 not work as expected due to the reasons covered below.</P
4805 ><P
4806 >To change a users SMB password, the <B
4807 CLASS="COMMAND"
4808 >smbpasswd</B
4809 >
4810                 by default connects to the <EM
4811 >localhost - 127.0.0.1</EM
4812 >
4813                 address as an SMB client to issue the password change request. If
4814                 <TT
4815 CLASS="PARAMETER"
4816 ><I
4817 >bind interfaces only</I
4818 ></TT
4819 > is set then unless the
4820                 network address <EM
4821 >127.0.0.1</EM
4822 > is added to the
4823                 <TT
4824 CLASS="PARAMETER"
4825 ><I
4826 >interfaces</I
4827 ></TT
4828 > parameter list then <B
4829 CLASS="COMMAND"
4830 >               smbpasswd</B
4831 > will fail to connect in it's default mode.
4832                 <B
4833 CLASS="COMMAND"
4834 >smbpasswd</B
4835 > can be forced to use the primary IP interface
4836                 of the local host by using its <A
4837 HREF="smbpasswd.8.html#minusr"
4838 TARGET="_top"
4839 >               <TT
4840 CLASS="PARAMETER"
4841 ><I
4842 >-r <TT
4843 CLASS="REPLACEABLE"
4844 ><I
4845 >remote machine</I
4846 ></TT
4847 ></I
4848 ></TT
4849 >
4850                 </A
4851 > parameter, with <TT
4852 CLASS="REPLACEABLE"
4853 ><I
4854 >remote machine</I
4855 ></TT
4856 > set
4857                 to the IP name of the primary interface of the local host.</P
4858 ><P
4859 >The <B
4860 CLASS="COMMAND"
4861 >swat</B
4862 > status page tries to connect with
4863                 <B
4864 CLASS="COMMAND"
4865 >smbd</B
4866 > and <B
4867 CLASS="COMMAND"
4868 >nmbd</B
4869 > at the address
4870                 <EM
4871 >127.0.0.1</EM
4872 > to determine if they are running.
4873                 Not adding <EM
4874 >127.0.0.1</EM
4875 >  will cause <B
4876 CLASS="COMMAND"
4877 >               smbd</B
4878 > and <B
4879 CLASS="COMMAND"
4880 >nmbd</B
4881 > to always show
4882                 "not running" even if they really are.  This can prevent <B
4883 CLASS="COMMAND"
4884 >               swat</B
4885 > from starting/stopping/restarting <B
4886 CLASS="COMMAND"
4887 >smbd</B
4888 >
4889                 and <B
4890 CLASS="COMMAND"
4891 >nmbd</B
4892 >.</P
4893 ><P
4894 >Default: <B
4895 CLASS="COMMAND"
4896 >bind interfaces only = no</B
4897 ></P
4898 ></DD
4899 ><DT
4900 ><A
4901 NAME="BLOCKINGLOCKS"
4902 ></A
4903 >blocking locks (S)</DT
4904 ><DD
4905 ><P
4906 >This parameter controls the behavior of <A
4907 HREF="smbd.8.html"
4908 TARGET="_top"
4909 >smbd(8)</A
4910 > when given a request by a client
4911                 to obtain a byte range lock on a region of an open file, and the
4912                 request has a time limit associated with it.</P
4913 ><P
4914 >If this parameter is set and the lock range requested
4915                 cannot be immediately satisfied, Samba 2.2 will internally
4916                 queue the lock request, and periodically attempt to obtain
4917                 the lock until the timeout period expires.</P
4918 ><P
4919 >If this parameter is set to <TT
4920 CLASS="CONSTANT"
4921 >False</TT
4922 >, then
4923                 Samba 2.2 will behave as previous versions of Samba would and
4924                 will fail the lock request immediately if the lock range
4925                 cannot be obtained.</P
4926 ><P
4927 >Default: <B
4928 CLASS="COMMAND"
4929 >blocking locks = yes</B
4930 ></P
4931 ></DD
4932 ><DT
4933 ><A
4934 NAME="BROWSABLE"
4935 ></A
4936 >browsable (S)</DT
4937 ><DD
4938 ><P
4939 >See the <A
4940 HREF="#BROWSEABLE"
4941 ><TT
4942 CLASS="PARAMETER"
4943 ><I
4944 >               browseable</I
4945 ></TT
4946 ></A
4947 >.</P
4948 ></DD
4949 ><DT
4950 ><A
4951 NAME="BROWSELIST"
4952 ></A
4953 >browse list (G)</DT
4954 ><DD
4955 ><P
4956 >This controls whether <A
4957 HREF="smbd.8.html"
4958 TARGET="_top"
4959 >               <B
4960 CLASS="COMMAND"
4961 >smbd(8)</B
4962 ></A
4963 > will serve a browse list to
4964                 a client doing a <B
4965 CLASS="COMMAND"
4966 >NetServerEnum</B
4967 > call. Normally
4968                 set to <TT
4969 CLASS="CONSTANT"
4970 >true</TT
4971 >. You should never need to change
4972                 this.</P
4973 ><P
4974 >Default: <B
4975 CLASS="COMMAND"
4976 >browse list = yes</B
4977 ></P
4978 ></DD
4979 ><DT
4980 ><A
4981 NAME="BROWSEABLE"
4982 ></A
4983 >browseable (S)</DT
4984 ><DD
4985 ><P
4986 >This controls whether this share is seen in
4987                 the list of available shares in a net view and in the browse list.</P
4988 ><P
4989 >Default: <B
4990 CLASS="COMMAND"
4991 >browseable = yes</B
4992 ></P
4993 ></DD
4994 ><DT
4995 ><A
4996 NAME="CASESENSITIVE"
4997 ></A
4998 >case sensitive (S)</DT
4999 ><DD
5000 ><P
5001 >See the discussion in the section <A
5002 HREF="#AEN201"
5003 >NAME MANGLING</A
5004 >.</P
5005 ><P
5006 >Default: <B
5007 CLASS="COMMAND"
5008 >case sensitive = no</B
5009 ></P
5010 ></DD
5011 ><DT
5012 ><A
5013 NAME="CASESIGNAMES"
5014 ></A
5015 >casesignames (S)</DT
5016 ><DD
5017 ><P
5018 >Synonym for <A
5019 HREF="#CASESENSITIVE"
5020 >case
5021                 sensitive</A
5022 >.</P
5023 ></DD
5024 ><DT
5025 ><A
5026 NAME="CHANGENOTIFYTIMEOUT"
5027 ></A
5028 >change notify timeout (G)</DT
5029 ><DD
5030 ><P
5031 >This SMB allows a client to tell a server to
5032                 "watch" a particular directory for any changes and only reply to
5033                 the SMB request when a change has occurred. Such constant scanning of
5034                 a directory is expensive under UNIX, hence an <A
5035 HREF="smbd.8.html"
5036 TARGET="_top"
5037 >               <B
5038 CLASS="COMMAND"
5039 >smbd(8)</B
5040 ></A
5041 > daemon only performs such a scan
5042                 on each requested directory once every <TT
5043 CLASS="PARAMETER"
5044 ><I
5045 >change notify
5046                 timeout</I
5047 ></TT
5048 > seconds.</P
5049 ><P
5050 >Default: <B
5051 CLASS="COMMAND"
5052 >change notify timeout = 60</B
5053 ></P
5054 ><P
5055 >Example: <B
5056 CLASS="COMMAND"
5057 >change notify timeout = 300</B
5058 ></P
5059 ><P
5060 >Would change the scan time to every 5 minutes.</P
5061 ></DD
5062 ><DT
5063 ><A
5064 NAME="CHARACTERSET"
5065 ></A
5066 >character set (G)</DT
5067 ><DD
5068 ><P
5069 >This allows a smbd to map incoming filenames
5070                 from a DOS Code page (see the <A
5071 HREF="#CLIENTCODEPAGE"
5072 >client
5073                 code page</A
5074 > parameter) to several built in UNIX character sets.
5075                 The built in code page translations are:</P
5076 ><P
5077 ></P
5078 ><UL
5079 ><LI
5080 ><P
5081 ><TT
5082 CLASS="CONSTANT"
5083 >ISO8859-1</TT
5084 > : Western European
5085                         UNIX character set. The parameter <TT
5086 CLASS="PARAMETER"
5087 ><I
5088 >client code page</I
5089 ></TT
5090 >
5091                         <EM
5092 >MUST</EM
5093 > be set to code page 850 if the
5094                         <TT
5095 CLASS="PARAMETER"
5096 ><I
5097 >character set</I
5098 ></TT
5099 > parameter is set to
5100                         <TT
5101 CLASS="CONSTANT"
5102 >ISO8859-1</TT
5103 > in order for the conversion to the
5104                         UNIX character set to be done correctly.</P
5105 ></LI
5106 ><LI
5107 ><P
5108 ><TT
5109 CLASS="CONSTANT"
5110 >ISO8859-2</TT
5111 > : Eastern European
5112                         UNIX character set. The parameter <TT
5113 CLASS="PARAMETER"
5114 ><I
5115 >client code page
5116                         </I
5117 ></TT
5118 > <EM
5119 >MUST</EM
5120 > be set to code page 852 if
5121                         the <TT
5122 CLASS="PARAMETER"
5123 ><I
5124 > character set</I
5125 ></TT
5126 > parameter is set
5127                         to <TT
5128 CLASS="CONSTANT"
5129 >ISO8859-2</TT
5130 > in order for the conversion
5131                         to the UNIX character set to be done correctly. </P
5132 ></LI
5133 ><LI
5134 ><P
5135 ><TT
5136 CLASS="CONSTANT"
5137 >ISO8859-5</TT
5138 > : Russian Cyrillic
5139                         UNIX character set. The parameter <TT
5140 CLASS="PARAMETER"
5141 ><I
5142 >client code page
5143                         </I
5144 ></TT
5145 > <EM
5146 >MUST</EM
5147 > be set to code page
5148                         866 if the <TT
5149 CLASS="PARAMETER"
5150 ><I
5151 >character set </I
5152 ></TT
5153 > parameter is
5154                         set to <TT
5155 CLASS="CONSTANT"
5156 >ISO8859-5</TT
5157 > in order for the conversion
5158                         to the UNIX character set to be done correctly. </P
5159 ></LI
5160 ><LI
5161 ><P
5162 ><TT
5163 CLASS="CONSTANT"
5164 >ISO8859-7</TT
5165 > : Greek UNIX
5166                         character set. The parameter <TT
5167 CLASS="PARAMETER"
5168 ><I
5169 >client code page
5170                         </I
5171 ></TT
5172 > <EM
5173 >MUST</EM
5174 > be set to code page
5175                         737 if the <TT
5176 CLASS="PARAMETER"
5177 ><I
5178 >character set</I
5179 ></TT
5180 > parameter is
5181                         set to <TT
5182 CLASS="CONSTANT"
5183 >ISO8859-7</TT
5184 > in order for the conversion
5185                         to the UNIX character set to be done correctly.</P
5186 ></LI
5187 ><LI
5188 ><P
5189 ><TT
5190 CLASS="CONSTANT"
5191 >KOI8-R</TT
5192 > : Alternate mapping
5193                         for Russian Cyrillic UNIX character set. The parameter
5194                         <TT
5195 CLASS="PARAMETER"
5196 ><I
5197 >client code page</I
5198 ></TT
5199 > <EM
5200 >MUST</EM
5201 >
5202                         be set to code page 866 if the <TT
5203 CLASS="PARAMETER"
5204 ><I
5205 >character set</I
5206 ></TT
5207 >
5208                         parameter is set to <TT
5209 CLASS="CONSTANT"
5210 >KOI8-R</TT
5211 > in order for the
5212                         conversion to the UNIX character set to be done correctly.</P
5213 ></LI
5214 ></UL
5215 ><P
5216 ><EM
5217 >BUG</EM
5218 >. These MSDOS code page to UNIX character
5219                 set mappings should be dynamic, like the loading of MS DOS code pages,
5220                 not static.</P
5221 ><P
5222 >Normally this parameter is not set, meaning no filename
5223                 translation is done.</P
5224 ><P
5225 >Default: <B
5226 CLASS="COMMAND"
5227 >character set = &#60;empty string&#62;</B
5228 ></P
5229 ><P
5230 >Example: <B
5231 CLASS="COMMAND"
5232 >character set = ISO8859-1</B
5233 ></P
5234 ></DD
5235 ><DT
5236 ><A
5237 NAME="CLIENTCODEPAGE"
5238 ></A
5239 >client code page (G)</DT
5240 ><DD
5241 ><P
5242 >This parameter specifies the DOS code page
5243                 that the clients accessing Samba are using. To determine what code
5244                 page a Windows or DOS client is using, open a DOS command prompt
5245                 and type the command <B
5246 CLASS="COMMAND"
5247 >chcp</B
5248 >. This will output
5249                 the code page. The default for USA MS-DOS, Windows 95, and
5250                 Windows NT releases is code page 437. The default for western
5251                 European releases of the above operating systems is code page 850.</P
5252 ><P
5253 >This parameter tells <A
5254 HREF="smbd.8.html"
5255 TARGET="_top"
5256 >smbd(8)</A
5257 >
5258                 which of the <TT
5259 CLASS="FILENAME"
5260 >codepage.<TT
5261 CLASS="REPLACEABLE"
5262 ><I
5263 >XXX</I
5264 ></TT
5265 >
5266                 </TT
5267 > files to dynamically load on startup. These files,
5268                 described more fully in the manual page <A
5269 HREF="make_smbcodepage.1.html"
5270 TARGET="_top"
5271 >               <B
5272 CLASS="COMMAND"
5273 >make_smbcodepage(1)</B
5274 ></A
5275 >, tell <B
5276 CLASS="COMMAND"
5277 >               smbd</B
5278 > how to map lower to upper case characters to provide
5279                 the case insensitivity of filenames that Windows clients expect.</P
5280 ><P
5281 >Samba currently ships with the following code page files :</P
5282 ><P
5283 ></P
5284 ><UL
5285 ><LI
5286 ><P
5287 >Code Page 437 - MS-DOS Latin US</P
5288 ></LI
5289 ><LI
5290 ><P
5291 >Code Page 737 - Windows '95 Greek</P
5292 ></LI
5293 ><LI
5294 ><P
5295 >Code Page 850 - MS-DOS Latin 1</P
5296 ></LI
5297 ><LI
5298 ><P
5299 >Code Page 852 - MS-DOS Latin 2</P
5300 ></LI
5301 ><LI
5302 ><P
5303 >Code Page 861 - MS-DOS Icelandic</P
5304 ></LI
5305 ><LI
5306 ><P
5307 >Code Page 866 - MS-DOS Cyrillic</P
5308 ></LI
5309 ><LI
5310 ><P
5311 >Code Page 932 - MS-DOS Japanese SJIS</P
5312 ></LI
5313 ><LI
5314 ><P
5315 >Code Page 936 - MS-DOS Simplified Chinese</P
5316 ></LI
5317 ><LI
5318 ><P
5319 >Code Page 949 - MS-DOS Korean Hangul</P
5320 ></LI
5321 ><LI
5322 ><P
5323 >Code Page 950 - MS-DOS Traditional Chinese</P
5324 ></LI
5325 ></UL
5326 ><P
5327 >Thus this parameter may have any of the values 437, 737, 850, 852,
5328                 861, 932, 936, 949, or 950.  If you don't find the codepage you need,
5329                 read the comments in one of the other codepage files and the
5330                 <B
5331 CLASS="COMMAND"
5332 >make_smbcodepage(1)</B
5333 > man page and write one. Please
5334                 remember to donate it back to the Samba user community.</P
5335 ><P
5336 >This parameter co-operates with the <TT
5337 CLASS="PARAMETER"
5338 ><I
5339 >valid
5340                 chars</I
5341 ></TT
5342 > parameter in determining what characters are
5343                 valid in filenames and how capitalization is done. If you set both
5344                 this parameter and the <TT
5345 CLASS="PARAMETER"
5346 ><I
5347 >valid chars</I
5348 ></TT
5349 > parameter
5350                 the <TT
5351 CLASS="PARAMETER"
5352 ><I
5353 >client code page</I
5354 ></TT
5355 > parameter
5356                 <EM
5357 >MUST</EM
5358 > be set before the <TT
5359 CLASS="PARAMETER"
5360 ><I
5361 >valid
5362                 chars</I
5363 ></TT
5364 > parameter in the <TT
5365 CLASS="FILENAME"
5366 >smb.conf</TT
5367 >
5368                 file. The <TT
5369 CLASS="PARAMETER"
5370 ><I
5371 >valid chars</I
5372 ></TT
5373 > string will then
5374                 augment the character settings in the <TT
5375 CLASS="PARAMETER"
5376 ><I
5377 >client code page</I
5378 ></TT
5379 >
5380                 parameter.</P
5381 ><P
5382 >If not set, <TT
5383 CLASS="PARAMETER"
5384 ><I
5385 >client code page</I
5386 ></TT
5387 > defaults
5388                 to 850.</P
5389 ><P
5390 >See also : <A
5391 HREF="#VALIDCHARS"
5392 ><TT
5393 CLASS="PARAMETER"
5394 ><I
5395 >valid
5396                 chars</I
5397 ></TT
5398 ></A
5399 >, <A
5400 HREF="#CODEPAGEDIRECTORY"
5401 >               <TT
5402 CLASS="PARAMETER"
5403 ><I
5404 >code page directory</I
5405 ></TT
5406 ></A
5407 ></P
5408 ><P
5409 >Default: <B
5410 CLASS="COMMAND"
5411 >client code page = 850</B
5412 ></P
5413 ><P
5414 >Example: <B
5415 CLASS="COMMAND"
5416 >client code page = 936</B
5417 ></P
5418 ></DD
5419 ><DT
5420 ><A
5421 NAME="CODEPAGEDIRECTORY"
5422 ></A
5423 >code page directory (G)</DT
5424 ><DD
5425 ><P
5426 >Define the location of the various client code page
5427                 files.</P
5428 ><P
5429 >See also <A
5430 HREF="#CLIENTCODEPAGE"
5431 ><TT
5432 CLASS="PARAMETER"
5433 ><I
5434 >client
5435                 code page</I
5436 ></TT
5437 ></A
5438 ></P
5439 ><P
5440 >Default: <B
5441 CLASS="COMMAND"
5442 >code page directory = ${prefix}/lib/codepages
5443                 </B
5444 ></P
5445 ><P
5446 >Example: <B
5447 CLASS="COMMAND"
5448 >code page directory = /usr/share/samba/codepages
5449                 </B
5450 ></P
5451 ></DD
5452 ><DT
5453 ><A
5454 NAME="CODINGSYSTEM"
5455 ></A
5456 >codingsystem (G)</DT
5457 ><DD
5458 ><P
5459 >This parameter is used to determine how incoming
5460                 Shift-JIS Japanese characters are mapped from the incoming <A
5461 HREF="#CLIENTCODEPAGE"
5462 ><TT
5463 CLASS="PARAMETER"
5464 ><I
5465 >client code page</I
5466 ></TT
5467 >
5468                 </A
5469 > used by the client, into file names in the UNIX filesystem.
5470                 Only useful if <TT
5471 CLASS="PARAMETER"
5472 ><I
5473 >client code page</I
5474 ></TT
5475 > is set to
5476                 932 (Japanese Shift-JIS).  The options are :</P
5477 ><P
5478 ></P
5479 ><UL
5480 ><LI
5481 ><P
5482 ><TT
5483 CLASS="CONSTANT"
5484 >SJIS</TT
5485 >  - Shift-JIS. Does no
5486                         conversion of the incoming filename.</P
5487 ></LI
5488 ><LI
5489 ><P
5490 ><TT
5491 CLASS="CONSTANT"
5492 >JIS8, J8BB, J8BH, J8@B,
5493                         J8@J, J8@H </TT
5494 > - Convert from incoming Shift-JIS to eight
5495                         bit JIS code with different shift-in, shift out codes.</P
5496 ></LI
5497 ><LI
5498 ><P
5499 ><TT
5500 CLASS="CONSTANT"
5501 >JIS7, J7BB, J7BH, J7@B, J7@J,
5502                         J7@H </TT
5503 > - Convert from incoming Shift-JIS to seven bit
5504                         JIS code with different shift-in, shift out codes.</P
5505 ></LI
5506 ><LI
5507 ><P
5508 ><TT
5509 CLASS="CONSTANT"
5510 >JUNET, JUBB, JUBH, JU@B, JU@J, JU@H </TT
5511 >
5512                         - Convert from incoming Shift-JIS to JUNET code with different shift-in,
5513                         shift out codes.</P
5514 ></LI
5515 ><LI
5516 ><P
5517 ><TT
5518 CLASS="CONSTANT"
5519 >EUC</TT
5520 > - Convert an incoming
5521                         Shift-JIS character to EUC code.</P
5522 ></LI
5523 ><LI
5524 ><P
5525 ><TT
5526 CLASS="CONSTANT"
5527 >HEX</TT
5528 > - Convert an incoming
5529                         Shift-JIS character to a 3 byte hex representation, i.e.
5530                         <TT
5531 CLASS="CONSTANT"
5532 >:AB</TT
5533 >.</P
5534 ></LI
5535 ><LI
5536 ><P
5537 ><TT
5538 CLASS="CONSTANT"
5539 >CAP</TT
5540 > - Convert an incoming
5541                         Shift-JIS character to the 3 byte hex representation used by
5542                         the Columbia AppleTalk Program (CAP), i.e. <TT
5543 CLASS="CONSTANT"
5544 >:AB</TT
5545 >.
5546                         This is used for compatibility between Samba and CAP.</P
5547 ></LI
5548 ></UL
5549 ><P
5550 >Default: <B
5551 CLASS="COMMAND"
5552 >coding system = &#60;empty value&#62;</B
5553 >
5554                 </P
5555 ></DD
5556 ><DT
5557 ><A
5558 NAME="COMMENT"
5559 ></A
5560 >comment (S)</DT
5561 ><DD
5562 ><P
5563 >This is a text field that is seen next to a share
5564                 when a client does a queries the server, either via the network
5565                 neighborhood or via <B
5566 CLASS="COMMAND"
5567 >net view</B
5568 > to list what shares
5569                 are available.</P
5570 ><P
5571 >If you want to set the string that is displayed next to the
5572                 machine name then see the <A
5573 HREF="#SERVERSTRING"
5574 ><TT
5575 CLASS="PARAMETER"
5576 ><I
5577 >               server string</I
5578 ></TT
5579 ></A
5580 > parameter.</P
5581 ><P
5582 >Default: <EM
5583 >No comment string</EM
5584 ></P
5585 ><P
5586 >Example: <B
5587 CLASS="COMMAND"
5588 >comment = Fred's Files</B
5589 ></P
5590 ></DD
5591 ><DT
5592 ><A
5593 NAME="CONFIGFILE"
5594 ></A
5595 >config file (G)</DT
5596 ><DD
5597 ><P
5598 >This allows you to override the config file
5599                 to use, instead of the default (usually <TT
5600 CLASS="FILENAME"
5601 >smb.conf</TT
5602 >).
5603                 There is a chicken and egg problem here as this option is set
5604                 in the config file!</P
5605 ><P
5606 >For this reason, if the name of the config file has changed
5607                 when the parameters are loaded then it will reload them from
5608                 the new config file.</P
5609 ><P
5610 >This option takes the usual substitutions, which can
5611                 be very useful.</P
5612 ><P
5613 >If the config file doesn't exist then it won't be loaded
5614                 (allowing you to special case the config files of just a few
5615                 clients).</P
5616 ><P
5617 >Example: <B
5618 CLASS="COMMAND"
5619 >config file = /usr/local/samba/lib/smb.conf.%m
5620                 </B
5621 ></P
5622 ></DD
5623 ><DT
5624 ><A
5625 NAME="COPY"
5626 ></A
5627 >copy (S)</DT
5628 ><DD
5629 ><P
5630 >This parameter allows you to "clone" service
5631                 entries. The specified service is simply duplicated under the
5632                 current service's name. Any parameters specified in the current
5633                 section will override those in the section being copied.</P
5634 ><P
5635 >This feature lets you set up a 'template' service and
5636                 create similar services easily. Note that the service being
5637                 copied must occur earlier in the configuration file than the
5638                 service doing the copying.</P
5639 ><P
5640 >Default: <EM
5641 >no value</EM
5642 ></P
5643 ><P
5644 >Example: <B
5645 CLASS="COMMAND"
5646 >copy = otherservice</B
5647 ></P
5648 ></DD
5649 ><DT
5650 ><A
5651 NAME="CREATEMASK"
5652 ></A
5653 >create mask (S)</DT
5654 ><DD
5655 ><P
5656 >A synonym for this parameter is
5657                 <A
5658 HREF="#CREATEMODE"
5659 ><TT
5660 CLASS="PARAMETER"
5661 ><I
5662 >create mode</I
5663 ></TT
5664 >
5665                 </A
5666 >.</P
5667 ><P
5668 >When a file is created, the necessary permissions are
5669                 calculated according to the mapping from DOS modes to UNIX
5670                 permissions, and the resulting UNIX mode is then bit-wise 'AND'ed
5671                 with this parameter. This parameter may be thought of as a bit-wise
5672                 MASK for the UNIX modes of a file. Any bit <EM
5673 >not</EM
5674 >
5675                 set here will be removed from the modes set on a file when it is
5676                 created.</P
5677 ><P
5678 >The default value of this parameter removes the
5679                 'group' and 'other' write and execute bits from the UNIX modes.</P
5680 ><P
5681 >Following this Samba will bit-wise 'OR' the UNIX mode created
5682                 from this parameter with the value of the <A
5683 HREF="#FORCECREATEMODE"
5684 ><TT
5685 CLASS="PARAMETER"
5686 ><I
5687 >force create mode</I
5688 ></TT
5689 ></A
5690 >
5691                 parameter which is set to 000 by default.</P
5692 ><P
5693 >This parameter does not affect directory modes. See the
5694                 parameter <A
5695 HREF="#DIRECTORYMODE"
5696 ><TT
5697 CLASS="PARAMETER"
5698 ><I
5699 >directory mode
5700                 </I
5701 ></TT
5702 ></A
5703 > for details.</P
5704 ><P
5705 >See also the <A
5706 HREF="#FORCECREATEMODE"
5707 ><TT
5708 CLASS="PARAMETER"
5709 ><I
5710 >force
5711                 create mode</I
5712 ></TT
5713 ></A
5714 > parameter for forcing particular mode
5715                 bits to be set on created files. See also the <A
5716 HREF="#DIRECTORYMODE"
5717 >               <TT
5718 CLASS="PARAMETER"
5719 ><I
5720 >directory mode"</I
5721 ></TT
5722 ></A
5723 > parameter for masking
5724                 mode bits on created directories.  See also the <A
5725 HREF="#INHERITPERMISSIONS"
5726 >               <TT
5727 CLASS="PARAMETER"
5728 ><I
5729 >inherit permissions</I
5730 ></TT
5731 ></A
5732 > parameter.</P
5733 ><P
5734 >Default: <B
5735 CLASS="COMMAND"
5736 >create mask = 0744</B
5737 ></P
5738 ><P
5739 >Example: <B
5740 CLASS="COMMAND"
5741 >create mask = 0775</B
5742 ></P
5743 ></DD
5744 ><DT
5745 ><A
5746 NAME="CREATEMODE"
5747 ></A
5748 >create mode (S)</DT
5749 ><DD
5750 ><P
5751 >This is a synonym for <A
5752 HREF="#CREATEMASK"
5753 ><TT
5754 CLASS="PARAMETER"
5755 ><I
5756 >               create mask</I
5757 ></TT
5758 ></A
5759 >.</P
5760 ></DD
5761 ><DT
5762 ><A
5763 NAME="DEADTIME"
5764 ></A
5765 >deadtime (G)</DT
5766 ><DD
5767 ><P
5768 >The value of the parameter (a decimal integer)
5769                 represents the number of minutes of inactivity before a connection
5770                 is considered dead, and it is disconnected. The deadtime only takes
5771                 effect if the number of open files is zero.</P
5772 ><P
5773 >This is useful to stop a server's resources being
5774                 exhausted by a large number of inactive connections.</P
5775 ><P
5776 >Most clients have an auto-reconnect feature when a
5777                 connection is broken so in most cases this parameter should be
5778                 transparent to users.</P
5779 ><P
5780 >Using this parameter with a timeout of a few minutes
5781                 is recommended for most systems.</P
5782 ><P
5783 >A deadtime of zero indicates that no auto-disconnection
5784                 should be performed.</P
5785 ><P
5786 >Default: <B
5787 CLASS="COMMAND"
5788 >deadtime = 0</B
5789 ></P
5790 ><P
5791 >Example: <B
5792 CLASS="COMMAND"
5793 >deadtime = 15</B
5794 ></P
5795 ></DD
5796 ><DT
5797 ><A
5798 NAME="DEBUGHIRESTIMESTAMP"
5799 ></A
5800 >debug hires timestamp (G)</DT
5801 ><DD
5802 ><P
5803 >Sometimes the timestamps in the log messages
5804                 are needed with a resolution of higher that seconds, this
5805                 boolean parameter adds microsecond resolution to the timestamp
5806                 message header when turned on.</P
5807 ><P
5808 >Note that the parameter <A
5809 HREF="#DEBUGTIMESTAMP"
5810 ><TT
5811 CLASS="PARAMETER"
5812 ><I
5813 >               debug timestamp</I
5814 ></TT
5815 ></A
5816 > must be on for this to have an
5817                 effect.</P
5818 ><P
5819 >Default: <B
5820 CLASS="COMMAND"
5821 >debug hires timestamp = no</B
5822 ></P
5823 ></DD
5824 ><DT
5825 ><A
5826 NAME="DEBUGPID"
5827 ></A
5828 >debug pid (G)</DT
5829 ><DD
5830 ><P
5831 >When using only one log file for more then one
5832                 forked smbd-process there may be hard to follow which process
5833                 outputs which message. This boolean parameter is adds the process-id
5834                 to the timestamp message headers in the logfile when turned on.</P
5835 ><P
5836 >Note that the parameter <A
5837 HREF="#DEBUGTIMESTAMP"
5838 ><TT
5839 CLASS="PARAMETER"
5840 ><I
5841 >               debug timestamp</I
5842 ></TT
5843 ></A
5844 > must be on for this to have an
5845                 effect.</P
5846 ><P
5847 >Default: <B
5848 CLASS="COMMAND"
5849 >debug pid = no</B
5850 ></P
5851 ></DD
5852 ><DT
5853 ><A
5854 NAME="DEBUGTIMESTAMP"
5855 ></A
5856 >debug timestamp (G)</DT
5857 ><DD
5858 ><P
5859 >Samba 2.2 debug log messages are timestamped
5860                 by default. If you are running at a high <A
5861 HREF="#DEBUGLEVEL"
5862 >               <TT
5863 CLASS="PARAMETER"
5864 ><I
5865 >debug level</I
5866 ></TT
5867 ></A
5868 > these timestamps
5869                 can be distracting. This boolean parameter allows timestamping
5870                 to be turned off.</P
5871 ><P
5872 >Default: <B
5873 CLASS="COMMAND"
5874 >debug timestamp = yes</B
5875 ></P
5876 ></DD
5877 ><DT
5878 ><A
5879 NAME="DEBUGUID"
5880 ></A
5881 >debug uid (G)</DT
5882 ><DD
5883 ><P
5884 >Samba is sometimes run as root and sometime
5885                 run as the connected user, this boolean parameter inserts the
5886                 current euid, egid, uid and gid to the timestamp message headers
5887                 in the log file if turned on.</P
5888 ><P
5889 >Note that the parameter <A
5890 HREF="#DEBUGTIMESTAMP"
5891 ><TT
5892 CLASS="PARAMETER"
5893 ><I
5894 >               debug timestamp</I
5895 ></TT
5896 ></A
5897 > must be on for this to have an
5898                 effect.</P
5899 ><P
5900 >Default: <B
5901 CLASS="COMMAND"
5902 >debug uid = no</B
5903 ></P
5904 ></DD
5905 ><DT
5906 ><A
5907 NAME="DEBUGLEVEL"
5908 ></A
5909 >debuglevel (G)</DT
5910 ><DD
5911 ><P
5912 >The value of the parameter (an integer) allows
5913                 the debug level (logging level) to be specified in the
5914                 <TT
5915 CLASS="FILENAME"
5916 >smb.conf</TT
5917 > file. This is to give greater
5918                 flexibility in the configuration of the system.</P
5919 ><P
5920 >The default will be the debug level specified on
5921                 the command line or level zero if none was specified.</P
5922 ><P
5923 >Example: <B
5924 CLASS="COMMAND"
5925 >debug level = 3</B
5926 ></P
5927 ></DD
5928 ><DT
5929 ><A
5930 NAME="DEFAULT"
5931 ></A
5932 >default (G)</DT
5933 ><DD
5934 ><P
5935 >A synonym for <A
5936 HREF="#DEFAULTSERVICE"
5937 ><TT
5938 CLASS="PARAMETER"
5939 ><I
5940 >               default service</I
5941 ></TT
5942 ></A
5943 >.</P
5944 ></DD
5945 ><DT
5946 ><A
5947 NAME="DEFAULTCASE"
5948 ></A
5949 >default case (S)</DT
5950 ><DD
5951 ><P
5952 >See the section on <A
5953 HREF="#AEN201"
5954 >               NAME MANGLING</A
5955 >. Also note the <A
5956 HREF="#SHORTPRESERVECASE"
5957 >               <TT
5958 CLASS="PARAMETER"
5959 ><I
5960 >short preserve case"</I
5961 ></TT
5962 ></A
5963 > parameter.</P
5964 ><P
5965 >Default: <B
5966 CLASS="COMMAND"
5967 >default case = lower</B
5968 ></P
5969 ></DD
5970 ><DT
5971 ><A
5972 NAME="DEFAULTSERVICE"
5973 ></A
5974 >default service (G)</DT
5975 ><DD
5976 ><P
5977 >This parameter specifies the name of a service
5978                 which will be connected to if the service actually requested cannot
5979                 be found. Note that the square brackets are <EM
5980 >NOT</EM
5981 >
5982                 given in the parameter value (see example below).</P
5983 ><P
5984 >There is no default value for this parameter. If this
5985                 parameter is not given, attempting to connect to a nonexistent
5986                 service results in an error.</P
5987 ><P
5988 >Typically the default service would be a <A
5989 HREF="#GUESTOK"
5990 >               <TT
5991 CLASS="PARAMETER"
5992 ><I
5993 >guest ok</I
5994 ></TT
5995 ></A
5996 >, <A
5997 HREF="#READONLY"
5998 >               <TT
5999 CLASS="PARAMETER"
6000 ><I
6001 >read-only</I
6002 ></TT
6003 ></A
6004 > service.</P
6005 ><P
6006 >Also note that the apparent service name will be changed
6007                 to equal that of the requested service, this is very useful as it
6008                 allows you to use macros like <TT
6009 CLASS="PARAMETER"
6010 ><I
6011 >%S</I
6012 ></TT
6013 > to make
6014                 a wildcard service.</P
6015 ><P
6016 >Note also that any "_" characters in the name of the service
6017                 used in the default service will get mapped to a "/". This allows for
6018                 interesting things.</P
6019 ><P
6020 >Example:</P
6021 ><P
6022 ><TABLE
6023 BORDER="0"
6024 BGCOLOR="#E0E0E0"
6025 WIDTH="90%"
6026 ><TR
6027 ><TD
6028 ><PRE
6029 CLASS="PROGRAMLISTING"
6030 >[global]
6031         default service = pub
6032
6033 [pub]
6034         path = /%S
6035                 </PRE
6036 ></TD
6037 ></TR
6038 ></TABLE
6039 ></P
6040 ></DD
6041 ><DT
6042 ><A
6043 NAME="DELETEREADONLY"
6044 ></A
6045 >delete readonly (S)</DT
6046 ><DD
6047 ><P
6048 >This parameter allows readonly files to be deleted.
6049                 This is not normal DOS semantics, but is allowed by UNIX.</P
6050 ><P
6051 >This option may be useful for running applications such
6052                 as rcs, where UNIX file ownership prevents changing file
6053                 permissions, and DOS semantics prevent deletion of a read only file.</P
6054 ><P
6055 >Default: <B
6056 CLASS="COMMAND"
6057 >delete readonly = no</B
6058 ></P
6059 ></DD
6060 ><DT
6061 ><A
6062 NAME="DELETEUSERSCRIPT"
6063 ></A
6064 >delete user script (G)</DT
6065 ><DD
6066 ><P
6067 >This is the full pathname to a script that will
6068                 be run <EM
6069 >AS ROOT</EM
6070 > by <A
6071 HREF="smbd.8.html"
6072 TARGET="_top"
6073 >               <B
6074 CLASS="COMMAND"
6075 >smbd(8)</B
6076 ></A
6077 > under special circumstances
6078                 described below.</P
6079 ><P
6080 >Normally, a Samba server requires that UNIX users are
6081                 created for all users accessing files on this server. For sites
6082                 that use Windows NT account databases as their primary user database
6083                 creating these users and keeping the user list in sync with the
6084                 Windows NT PDC is an onerous task. This option allows <B
6085 CLASS="COMMAND"
6086 >               smbd</B
6087 > to delete the required UNIX users <EM
6088 >ON
6089                 DEMAND</EM
6090 > when a user accesses the Samba server and the
6091                 Windows NT user no longer exists.</P
6092 ><P
6093 >In order to use this option, <B
6094 CLASS="COMMAND"
6095 >smbd</B
6096 > must be
6097                 set to <TT
6098 CLASS="PARAMETER"
6099 ><I
6100 >security=domain</I
6101 ></TT
6102 > and <TT
6103 CLASS="PARAMETER"
6104 ><I
6105 >delete
6106                 user script</I
6107 ></TT
6108 > must be set to a full pathname for a script
6109                 that will delete a UNIX user given one argument of <TT
6110 CLASS="PARAMETER"
6111 ><I
6112 >%u
6113                 </I
6114 ></TT
6115 >, which expands into the UNIX user name to delete.
6116                 <EM
6117 >NOTE</EM
6118 > that this is different to the <A
6119 HREF="#ADDUSERSCRIPT"
6120 ><TT
6121 CLASS="PARAMETER"
6122 ><I
6123 >add user script</I
6124 ></TT
6125 ></A
6126 >
6127                 which will work with the <TT
6128 CLASS="PARAMETER"
6129 ><I
6130 >security=server</I
6131 ></TT
6132 > option
6133                 as well as <TT
6134 CLASS="PARAMETER"
6135 ><I
6136 >security=domain</I
6137 ></TT
6138 >. The reason for this
6139                 is only when Samba is a domain member does it get the information
6140                 on an attempted user logon that a user no longer exists. In the
6141                 <TT
6142 CLASS="PARAMETER"
6143 ><I
6144 >security=server</I
6145 ></TT
6146 > mode a missing user
6147                 is treated the same as an invalid password logon attempt. Deleting
6148                 the user in this circumstance would not be a good idea.</P
6149 ><P
6150 >When the Windows user attempts to access the Samba server,
6151                 at <EM
6152 >login</EM
6153 > (session setup in the SMB protocol)
6154                 time, <B
6155 CLASS="COMMAND"
6156 >smbd</B
6157 > contacts the <A
6158 HREF="#PASSWORDSERVER"
6159 >               <TT
6160 CLASS="PARAMETER"
6161 ><I
6162 >password server</I
6163 ></TT
6164 ></A
6165 > and attempts to authenticate
6166                 the given user with the given password. If the authentication fails
6167                 with the specific Domain error code meaning that the user no longer
6168                 exists then <B
6169 CLASS="COMMAND"
6170 >smbd</B
6171 > attempts to find a UNIX user in
6172                 the UNIX password database that matches the Windows user account. If
6173                 this lookup succeeds, and <TT
6174 CLASS="PARAMETER"
6175 ><I
6176 >delete user script</I
6177 ></TT
6178 > is
6179                 set then <B
6180 CLASS="COMMAND"
6181 >smbd</B
6182 > will all the specified script
6183                 <EM
6184 >AS ROOT</EM
6185 >, expanding any <TT
6186 CLASS="PARAMETER"
6187 ><I
6188 >%u</I
6189 ></TT
6190 >
6191                 argument to be the user name to delete.</P
6192 ><P
6193 >This script should delete the given UNIX username. In this way,
6194                 UNIX users are dynamically deleted to match existing Windows NT
6195                 accounts.</P
6196 ><P
6197 >See also <A
6198 HREF="#SECURITYEQUALSDOMAIN"
6199 >security=domain</A
6200 >,
6201                 <A
6202 HREF="#PASSWORDSERVER"
6203 ><TT
6204 CLASS="PARAMETER"
6205 ><I
6206 >password server</I
6207 ></TT
6208 >
6209                 </A
6210 >, <A
6211 HREF="#ADDUSERSCRIPT"
6212 ><TT
6213 CLASS="PARAMETER"
6214 ><I
6215 >add user script</I
6216 ></TT
6217 >
6218                 </A
6219 >.</P
6220 ><P
6221 >Default: <B
6222 CLASS="COMMAND"
6223 >delete user script = &#60;empty string&#62;
6224                 </B
6225 ></P
6226 ><P
6227 >Example: <B
6228 CLASS="COMMAND"
6229 >delete user script = /usr/local/samba/bin/del_user
6230                 %u</B
6231 ></P
6232 ></DD
6233 ><DT
6234 ><A
6235 NAME="DELETEPRINTERCOMMAND"
6236 ></A
6237 >deleteprinter command (G)</DT
6238 ><DD
6239 ><P
6240 >With the introduction of MS-RPC based printer
6241                 support for Windows NT/2000 clients in Samba 2.2, it is now
6242                 possible to delete printer at run time by issuing the
6243                 DeletePrinter() RPC call.</P
6244 ><P
6245 >For a Samba host this means that the printer must be
6246                 physically deleted from underlying printing system.  The <TT
6247 CLASS="PARAMETER"
6248 ><I
6249 >               deleteprinter command</I
6250 ></TT
6251 > defines a script to be run which
6252                 will perform the necessary operations for removing the printer
6253                 from the print system and from <TT
6254 CLASS="FILENAME"
6255 >smb.conf</TT
6256 >.
6257                 </P
6258 ><P
6259 >The <TT
6260 CLASS="PARAMETER"
6261 ><I
6262 >deleteprinter command</I
6263 ></TT
6264 > is
6265                 automatically called with only one parameter: <TT
6266 CLASS="PARAMETER"
6267 ><I
6268 >               "printer name"</I
6269 ></TT
6270 >.</P
6271 ><P
6272 >Once the <TT
6273 CLASS="PARAMETER"
6274 ><I
6275 >deleteprinter command</I
6276 ></TT
6277 > has
6278                 been executed, <B
6279 CLASS="COMMAND"
6280 >smbd</B
6281 > will reparse the <TT
6282 CLASS="FILENAME"
6283 >               smb.conf</TT
6284 > to associated printer no longer exists.
6285                 If the sharename is still valid, then <B
6286 CLASS="COMMAND"
6287 >smbd
6288                 </B
6289 > will return an ACCESS_DENIED error to the client.</P
6290 ><P
6291 >See also <A
6292 HREF="#ADDPRINTERCOMMAND"
6293 ><TT
6294 CLASS="PARAMETER"
6295 ><I
6296 >               addprinter command</I
6297 ></TT
6298 ></A
6299 >, <A
6300 HREF="#PRINTING"
6301 ><TT
6302 CLASS="PARAMETER"
6303 ><I
6304 >printing</I
6305 ></TT
6306 ></A
6307 >,
6308                 <A
6309 HREF="#SHOWADDPRINTERWIZARD"
6310 ><TT
6311 CLASS="PARAMETER"
6312 ><I
6313 >show add
6314                 printer wizard</I
6315 ></TT
6316 ></A
6317 ></P
6318 ><P
6319 >Default: <EM
6320 >none</EM
6321 ></P
6322 ><P
6323 >Example: <B
6324 CLASS="COMMAND"
6325 >deleteprinter command = /usr/bin/removeprinter
6326                 </B
6327 ></P
6328 ></DD
6329 ><DT
6330 ><A
6331 NAME="DELETEVETOFILES"
6332 ></A
6333 >delete veto files (S)</DT
6334 ><DD
6335 ><P
6336 >This option is used when Samba is attempting to
6337                 delete a directory that contains one or more vetoed directories
6338                 (see the <A
6339 HREF="#VETOFILES"
6340 ><TT
6341 CLASS="PARAMETER"
6342 ><I
6343 >veto files</I
6344 ></TT
6345 ></A
6346 >
6347                 option).  If this option is set to False (the default) then if a vetoed
6348                 directory contains any non-vetoed files or directories then the
6349                 directory delete will fail. This is usually what you want.</P
6350 ><P
6351 >If this option is set to <TT
6352 CLASS="CONSTANT"
6353 >True</TT
6354 >, then Samba
6355                 will attempt to recursively delete any files and directories within
6356                 the vetoed directory. This can be useful for integration with file
6357                 serving systems such as NetAtalk which create meta-files within
6358                 directories you might normally veto DOS/Windows users from seeing
6359                 (e.g. <TT
6360 CLASS="FILENAME"
6361 >.AppleDouble</TT
6362 >)</P
6363 ><P
6364 >Setting <B
6365 CLASS="COMMAND"
6366 >delete veto files = yes</B
6367 > allows these
6368                 directories to be  transparently deleted when the parent directory
6369                 is deleted (so long as the user has permissions to do so).</P
6370 ><P
6371 >See also the <A
6372 HREF="#VETOFILES"
6373 ><TT
6374 CLASS="PARAMETER"
6375 ><I
6376 >veto
6377                 files</I
6378 ></TT
6379 ></A
6380 > parameter.</P
6381 ><P
6382 >Default: <B
6383 CLASS="COMMAND"
6384 >delete veto files = no</B
6385 ></P
6386 ></DD
6387 ><DT
6388 ><A
6389 NAME="DENYHOSTS"
6390 ></A
6391 >deny hosts (S)</DT
6392 ><DD
6393 ><P
6394 >Synonym for <A
6395 HREF="#HOSTSDENY"
6396 ><TT
6397 CLASS="PARAMETER"
6398 ><I
6399 >hosts
6400                 deny</I
6401 ></TT
6402 ></A
6403 >.</P
6404 ></DD
6405 ><DT
6406 ><A
6407 NAME="DFREECOMMAND"
6408 ></A
6409 >dfree command (G)</DT
6410 ><DD
6411 ><P
6412 >The <TT
6413 CLASS="PARAMETER"
6414 ><I
6415 >dfree command</I
6416 ></TT
6417 > setting should
6418                 only be used on systems where a problem occurs with the internal
6419                 disk space calculations. This has been known to happen with Ultrix,
6420                 but may occur with other operating systems. The symptom that was
6421                 seen was an error of "Abort Retry Ignore" at the end of each
6422                 directory listing.</P
6423 ><P
6424 >This setting allows the replacement of the internal routines to
6425                 calculate the total disk space and amount available with an external
6426                 routine. The example below gives a possible script that might fulfill
6427                 this function.</P
6428 ><P
6429 >The external program will be passed a single parameter indicating
6430                 a directory in the filesystem being queried. This will typically consist
6431                 of the string <TT
6432 CLASS="FILENAME"
6433 >./</TT
6434 >. The script should return two
6435                 integers in ASCII. The first should be the total disk space in blocks,
6436                 and the second should be the number of available blocks. An optional
6437                 third return value can give the block size in bytes. The default
6438                 blocksize is 1024 bytes.</P
6439 ><P
6440 >Note: Your script should <EM
6441 >NOT</EM
6442 > be setuid or
6443                 setgid and should be owned by (and writeable only by) root!</P
6444 ><P
6445 >Default: <EM
6446 >By default internal routines for
6447                 determining the disk capacity and remaining space will be used.
6448                 </EM
6449 ></P
6450 ><P
6451 >Example: <B
6452 CLASS="COMMAND"
6453 >dfree command = /usr/local/samba/bin/dfree
6454                 </B
6455 ></P
6456 ><P
6457 >Where the script dfree (which must be made executable) could be:</P
6458 ><P
6459 ><TABLE
6460 BORDER="0"
6461 BGCOLOR="#E0E0E0"
6462 WIDTH="90%"
6463 ><TR
6464 ><TD
6465 ><PRE
6466 CLASS="PROGRAMLISTING"
6467 >
6468                 #!/bin/sh
6469                 df $1 | tail -1 | awk '{print $2" "$4}'
6470                 </PRE
6471 ></TD
6472 ></TR
6473 ></TABLE
6474 ></P
6475 ><P
6476 >or perhaps (on Sys V based systems):</P
6477 ><P
6478 ><TABLE
6479 BORDER="0"
6480 BGCOLOR="#E0E0E0"
6481 WIDTH="90%"
6482 ><TR
6483 ><TD
6484 ><PRE
6485 CLASS="PROGRAMLISTING"
6486 >
6487                 #!/bin/sh
6488                 /usr/bin/df -k $1 | tail -1 | awk '{print $3" "$5}'
6489                 </PRE
6490 ></TD
6491 ></TR
6492 ></TABLE
6493 ></P
6494 ><P
6495 >Note that you may have to replace the command names
6496                 with full path names on some systems.</P
6497 ></DD
6498 ><DT
6499 ><A
6500 NAME="DIRECTORY"
6501 ></A
6502 >directory (S)</DT
6503 ><DD
6504 ><P
6505 >Synonym for <A
6506 HREF="#PATH"
6507 ><TT
6508 CLASS="PARAMETER"
6509 ><I
6510 >path
6511                 </I
6512 ></TT
6513 ></A
6514 >.</P
6515 ></DD
6516 ><DT
6517 ><A
6518 NAME="DIRECTORYMASK"
6519 ></A
6520 >directory mask (S)</DT
6521 ><DD
6522 ><P
6523 >This parameter is the octal modes which are
6524                 used when converting DOS modes to UNIX modes when creating UNIX
6525                 directories.</P
6526 ><P
6527 >When a directory is created, the necessary permissions are
6528                 calculated according to the mapping from DOS modes to UNIX permissions,
6529                 and the resulting UNIX mode is then bit-wise 'AND'ed with this
6530                 parameter. This parameter may be thought of as a bit-wise MASK for
6531                 the UNIX modes of a directory. Any bit <EM
6532 >not</EM
6533 > set
6534                 here will be removed from the modes set on a directory when it is
6535                 created.</P
6536 ><P
6537 >The default value of this parameter removes the 'group'
6538                 and 'other' write bits from the UNIX mode, allowing only the
6539                 user who owns the directory to modify it.</P
6540 ><P
6541 >Following this Samba will bit-wise 'OR' the UNIX mode
6542                 created from this parameter with the value of the <A
6543 HREF="#FORCEDIRECTORYMODE"
6544 ><TT
6545 CLASS="PARAMETER"
6546 ><I
6547 >force directory mode
6548                 </I
6549 ></TT
6550 ></A
6551 > parameter. This parameter is set to 000 by
6552                 default (i.e. no extra mode bits are added).</P
6553 ><P
6554 >See the <A
6555 HREF="#FORCEDIRECTORYMODE"
6556 ><TT
6557 CLASS="PARAMETER"
6558 ><I
6559 >force
6560                 directory mode</I
6561 ></TT
6562 ></A
6563 > parameter to cause particular mode
6564                 bits to always be set on created directories.</P
6565 ><P
6566 >See also the <A
6567 HREF="#CREATEMODE"
6568 ><TT
6569 CLASS="PARAMETER"
6570 ><I
6571 >create mode
6572                 </I
6573 ></TT
6574 ></A
6575 > parameter for masking mode bits on created files,
6576                 and the <A
6577 HREF="#DIRECTORYSECURITYMASK"
6578 ><TT
6579 CLASS="PARAMETER"
6580 ><I
6581 >directory
6582                 security mask</I
6583 ></TT
6584 ></A
6585 > parameter.</P
6586 ><P
6587 >Also refer to the <A
6588 HREF="#INHERITPERMISSIONS"
6589 ><TT
6590 CLASS="PARAMETER"
6591 ><I
6592 >               inherit permissions</I
6593 ></TT
6594 ></A
6595 > parameter.</P
6596 ><P
6597 >Default: <B
6598 CLASS="COMMAND"
6599 >directory mask = 0755</B
6600 ></P
6601 ><P
6602 >Example: <B
6603 CLASS="COMMAND"
6604 >directory mask = 0775</B
6605 ></P
6606 ></DD
6607 ><DT
6608 ><A
6609 NAME="DIRECTORYMODE"
6610 ></A
6611 >directory mode (S)</DT
6612 ><DD
6613 ><P
6614 >Synonym for <A
6615 HREF="#DIRECTORYMASK"
6616 ><TT
6617 CLASS="PARAMETER"
6618 ><I
6619 >               directory mask</I
6620 ></TT
6621 ></A
6622 ></P
6623 ></DD
6624 ><DT
6625 ><A
6626 NAME="DIRECTORYSECURITYMASK"
6627 ></A
6628 >directory security mask (S)</DT
6629 ><DD
6630 ><P
6631 >This parameter controls what UNIX permission bits
6632                 can be modified when a Windows NT client is manipulating the UNIX
6633                 permission on a directory using the native NT security dialog
6634                 box.</P
6635 ><P
6636 >This parameter is applied as a mask (AND'ed with) to
6637                 the changed permission bits, thus preventing any bits not in
6638                 this mask from being modified. Essentially, zero bits in this
6639                 mask may be treated as a set of bits the user is not allowed
6640                 to change.</P
6641 ><P
6642 >If not set explicitly this parameter is set to the same
6643                 value as the <A
6644 HREF="#DIRECTORYMASK"
6645 ><TT
6646 CLASS="PARAMETER"
6647 ><I
6648 >directory
6649                 mask</I
6650 ></TT
6651 ></A
6652 > parameter. To allow a user to
6653                 modify all the user/group/world permissions on a directory, set
6654                 this parameter to 0777.</P
6655 ><P
6656 ><EM
6657 >Note</EM
6658 > that users who can access the
6659                 Samba server through other means can easily bypass this restriction,
6660                 so it is primarily useful for standalone "appliance" systems.
6661                 Administrators of most normal systems will probably want to set
6662                 it to 0777.</P
6663 ><P
6664 >See also the <A
6665 HREF="#FORCEDIRECTORYSECURITYMODE"
6666 ><TT
6667 CLASS="PARAMETER"
6668 ><I
6669 >               force directory security mode</I
6670 ></TT
6671 ></A
6672 >, <A
6673 HREF="#SECURITYMASK"
6674 ><TT
6675 CLASS="PARAMETER"
6676 ><I
6677 >security mask</I
6678 ></TT
6679 ></A
6680 >,
6681                 <A
6682 HREF="#FORCESECURITYMODE"
6683 ><TT
6684 CLASS="PARAMETER"
6685 ><I
6686 >force security mode
6687                 </I
6688 ></TT
6689 ></A
6690 > parameters.</P
6691 ><P
6692 >Default: <B
6693 CLASS="COMMAND"
6694 >directory security mask = &#60;same as
6695                 directory mask&#62;</B
6696 ></P
6697 ><P
6698 >Example: <B
6699 CLASS="COMMAND"
6700 >directory security mask = 0777</B
6701 ></P
6702 ></DD
6703 ><DT
6704 ><A
6705 NAME="DNSPROXY"
6706 ></A
6707 >dns proxy (G)</DT
6708 ><DD
6709 ><P
6710 >Specifies that <A
6711 HREF="nmbd.8.html"
6712 TARGET="_top"
6713 >nmbd(8)</A
6714 >
6715                 when acting as a WINS server and finding that a NetBIOS name has not
6716                 been registered, should treat the NetBIOS name word-for-word as a DNS
6717                 name and do a lookup with the DNS server for that name on behalf of
6718                 the name-querying client.</P
6719 ><P
6720 >Note that the maximum length for a NetBIOS name is 15
6721                 characters, so the DNS name (or DNS alias) can likewise only be
6722                 15 characters, maximum.</P
6723 ><P
6724 ><B
6725 CLASS="COMMAND"
6726 >nmbd</B
6727 > spawns a second copy of itself to do the
6728                 DNS name lookup requests, as doing a name lookup is a blocking
6729                 action.</P
6730 ><P
6731 >See also the parameter <A
6732 HREF="#WINSSUPPORT"
6733 ><TT
6734 CLASS="PARAMETER"
6735 ><I
6736 >               wins support</I
6737 ></TT
6738 ></A
6739 >.</P
6740 ><P
6741 >Default: <B
6742 CLASS="COMMAND"
6743 >dns proxy = yes</B
6744 ></P
6745 ></DD
6746 ><DT
6747 ><A
6748 NAME="DOMAINADMINGROUP"
6749 ></A
6750 >domain admin group (G)</DT
6751 ><DD
6752 ><P
6753 >This is an <EM
6754 >EXPERIMENTAL</EM
6755 > parameter
6756                 that is part of the unfinished Samba NT Domain Controller Code. It may
6757                 be removed in a later release. To work with the latest code builds
6758                 that may have more support for Samba NT Domain Controller functionality
6759                 please subscribe to the mailing list <A
6760 HREF="mailto:samba-ntdom@samba.org"
6761 TARGET="_top"
6762 >samba-ntdom</A
6763 > available by
6764                 visiting the web page at <A
6765 HREF="http://lists.samba.org/"
6766 TARGET="_top"
6767 >               http://lists.samba.org/</A
6768 >.</P
6769 ></DD
6770 ><DT
6771 ><A
6772 NAME="DOMAINADMINUSERS"
6773 ></A
6774 >domain admin users (G)</DT
6775 ><DD
6776 ><P
6777 >This is an <EM
6778 >EXPERIMENTAL</EM
6779 > parameter
6780                 that is part of the unfinished Samba NT Domain Controller Code. It may
6781                 be removed in a later release. To work with the latest code builds
6782                 that may have more support for Samba NT Domain Controller functionality
6783                 please subscribe to the mailing list <A
6784 HREF="mailto:samba-ntdom@samba.org"
6785 TARGET="_top"
6786 >samba-ntdom</A
6787 > available by
6788                 visiting the web page at <A
6789 HREF="http://lists.samba.org/"
6790 TARGET="_top"
6791 >               http://lists.samba.org/</A
6792 >.</P
6793 ></DD
6794 ><DT
6795 ><A
6796 NAME="DOMAINGROUPS"
6797 ></A
6798 >domain groups (G)</DT
6799 ><DD
6800 ><P
6801 >This is an <EM
6802 >EXPERIMENTAL</EM
6803 > parameter
6804                 that is part of the unfinished Samba NT Domain Controller Code. It may
6805                 be removed in a later release. To work with the latest code builds
6806                 that may have more support for Samba NT Domain Controller functionality
6807                 please subscribe to the mailing list <A
6808 HREF="mailto:samba-ntdom@samba.org"
6809 TARGET="_top"
6810 >samba-ntdom</A
6811 > available by
6812                 visiting the web page at <A
6813 HREF="http://lists.samba.org/"
6814 TARGET="_top"
6815 >               http://lists.samba.org/</A
6816 >.</P
6817 ></DD
6818 ><DT
6819 ><A
6820 NAME="DOMAINGUESTGROUP"
6821 ></A
6822 >domain guest group (G)</DT
6823 ><DD
6824 ><P
6825 >This is an <EM
6826 >EXPERIMENTAL</EM
6827 > parameter
6828                 that is part of the unfinished Samba NT Domain Controller Code. It may
6829                 be removed in a later release. To work with the latest code builds
6830                 that may have more support for Samba NT Domain Controller functionality
6831                 please subscribe to the mailing list <A
6832 HREF="mailto:samba-ntdom@samba.org"
6833 TARGET="_top"
6834 >samba-ntdom</A
6835 > available by
6836                 visiting the web page at <A
6837 HREF="http://lists.samba.org/"
6838 TARGET="_top"
6839 >               http://lists.samba.org/</A
6840 >.</P
6841 ></DD
6842 ><DT
6843 ><A
6844 NAME="DOMAINGUESTUSERS"
6845 ></A
6846 >domain guest users (G)</DT
6847 ><DD
6848 ><P
6849 >This is an <EM
6850 >EXPERIMENTAL</EM
6851 > parameter
6852                 that is part of the unfinished Samba NT Domain Controller Code. It may
6853                 be removed in a later release. To work with the latest code builds
6854                 that may have more support for Samba NT Domain Controller functionality
6855                 please subscribe to the mailing list <A
6856 HREF="mailto:samba-ntdom@samba.org"
6857 TARGET="_top"
6858 >samba-ntdom</A
6859 > available by
6860                 visiting the web page at <A
6861 HREF="http://lists.samba.org/"
6862 TARGET="_top"
6863 >               http://lists.samba.org/</A
6864 >.</P
6865 ></DD
6866 ><DT
6867 ><A
6868 NAME="DOMAINLOGONS"
6869 ></A
6870 >domain logons (G)</DT
6871 ><DD
6872 ><P
6873 >If set to true, the Samba server will serve
6874                 Windows 95/98 Domain logons for the <A
6875 HREF="#WORKGROUP"
6876 >               <TT
6877 CLASS="PARAMETER"
6878 ><I
6879 >workgroup</I
6880 ></TT
6881 ></A
6882 > it is in. Samba 2.2 also
6883                 has limited capability to act as a domain controller for Windows
6884                 NT 4 Domains.  For more details on setting up this feature see
6885                 the file DOMAINS.txt in the Samba documentation directory <TT
6886 CLASS="FILENAME"
6887 >docs/
6888                 </TT
6889 > shipped with the source code.</P
6890 ><P
6891 >Default: <B
6892 CLASS="COMMAND"
6893 >domain logons = no</B
6894 ></P
6895 ></DD
6896 ><DT
6897 ><A
6898 NAME="DOMAINMASTER"
6899 ></A
6900 >domain master (G)</DT
6901 ><DD
6902 ><P
6903 >Tell <A
6904 HREF="nmbd.8.html"
6905 TARGET="_top"
6906 ><B
6907 CLASS="COMMAND"
6908 >               nmbd(8)</B
6909 ></A
6910 > to enable WAN-wide browse list
6911                 collation. Setting this option causes <B
6912 CLASS="COMMAND"
6913 >nmbd</B
6914 > to
6915                 claim a special domain specific NetBIOS name that identifies
6916                 it as a domain master browser for its given <A
6917 HREF="#WORKGROUP"
6918 >               <TT
6919 CLASS="PARAMETER"
6920 ><I
6921 >workgroup</I
6922 ></TT
6923 ></A
6924 >. Local master browsers
6925                 in the same <TT
6926 CLASS="PARAMETER"
6927 ><I
6928 >workgroup</I
6929 ></TT
6930 > on broadcast-isolated
6931                 subnets will give this <B
6932 CLASS="COMMAND"
6933 >nmbd</B
6934 > their local browse lists,
6935                 and then ask <A
6936 HREF="smbd.8.html"
6937 TARGET="_top"
6938 ><B
6939 CLASS="COMMAND"
6940 >smbd(8)</B
6941 ></A
6942 >
6943                 for a complete copy of the browse list for the whole wide area
6944                 network.  Browser clients will then contact their local master browser,
6945                 and will receive the domain-wide browse list, instead of just the list
6946                 for their broadcast-isolated subnet.</P
6947 ><P
6948 >Note that Windows NT Primary Domain Controllers expect to be
6949                 able to claim this <TT
6950 CLASS="PARAMETER"
6951 ><I
6952 >workgroup</I
6953 ></TT
6954 > specific special
6955                 NetBIOS name that identifies them as domain master browsers for
6956                 that <TT
6957 CLASS="PARAMETER"
6958 ><I
6959 >workgroup</I
6960 ></TT
6961 > by default (i.e. there is no
6962                 way to prevent a Windows NT PDC from attempting to do this). This
6963                 means that if this parameter is set and <B
6964 CLASS="COMMAND"
6965 >nmbd</B
6966 > claims
6967                 the special name for a <TT
6968 CLASS="PARAMETER"
6969 ><I
6970 >workgroup</I
6971 ></TT
6972 > before a Windows
6973                 NT PDC is able to do so then cross subnet browsing will behave
6974                 strangely and may fail.</P
6975 ><P
6976 >If <A
6977 HREF="#DOMAINLOGONS"
6978 ><B
6979 CLASS="COMMAND"
6980 >domain logons = yes</B
6981 >
6982                 </A
6983 >, then the default behavior is to enable the <TT
6984 CLASS="PARAMETER"
6985 ><I
6986 >domain
6987                 master</I
6988 ></TT
6989 > parameter.  If <TT
6990 CLASS="PARAMETER"
6991 ><I
6992 >domain logons</I
6993 ></TT
6994 > is
6995                 not enabled (the default setting), then neither will <TT
6996 CLASS="PARAMETER"
6997 ><I
6998 >domain
6999                 master</I
7000 ></TT
7001 > be enabled by default.</P
7002 ><P
7003 >Default: <B
7004 CLASS="COMMAND"
7005 >domain master = auto</B
7006 ></P
7007 ></DD
7008 ><DT
7009 ><A
7010 NAME="DONTDESCEND"
7011 ></A
7012 >dont descend (S)</DT
7013 ><DD
7014 ><P
7015 >There are certain directories on some systems
7016                 (e.g., the <TT
7017 CLASS="FILENAME"
7018 >/proc</TT
7019 > tree under Linux) that are either not
7020                 of interest to clients or are infinitely deep (recursive). This
7021                 parameter allows you to specify a comma-delimited list of directories
7022                 that the server should always show as empty.</P
7023 ><P
7024 >Note that Samba can be very fussy about the exact format
7025                 of the "dont descend" entries. For example you may need <TT
7026 CLASS="FILENAME"
7027 >               ./proc</TT
7028 > instead of just <TT
7029 CLASS="FILENAME"
7030 >/proc</TT
7031 >.
7032                 Experimentation is the best policy :-)  </P
7033 ><P
7034 >Default: <EM
7035 >none (i.e., all directories are OK
7036                 to descend)</EM
7037 ></P
7038 ><P
7039 >Example: <B
7040 CLASS="COMMAND"
7041 >dont descend = /proc,/dev</B
7042 ></P
7043 ></DD
7044 ><DT
7045 ><A
7046 NAME="DOSFILEMODE"
7047 ></A
7048 >dos filemode (S)</DT
7049 ><DD
7050 ><P
7051 > The default behavior in Samba is to provide
7052                 UNIX-like behavor where only the owner of a file/directory is
7053                 able to change the permissions on it.  However, this behavior
7054                 is often confusing to  DOS/Windows users.  Enabling this parameter
7055                 allows a user who has write access to the file (by whatever
7056                 means) to modify the permissions on it.  Note that a user
7057                 belonging to the group owning the file will not be allowed to
7058                 change permissions if the group is only granted read access.
7059                 Ownership of the file/directory is not changed, only the permissions
7060                 are modified.</P
7061 ><P
7062 >Default: <B
7063 CLASS="COMMAND"
7064 >dos filemode = no</B
7065 ></P
7066 ></DD
7067 ><DT
7068 ><A
7069 NAME="DOSFILETIMERESOLUTION"
7070 ></A
7071 >dos filetime resolution (S)</DT
7072 ><DD
7073 ><P
7074 >Under the DOS and Windows FAT filesystem, the finest
7075                 granularity on time resolution is two seconds. Setting this parameter
7076                 for a share causes Samba to round the reported time down to the
7077                 nearest two second boundary when a query call that requires one second
7078                 resolution is made to <A
7079 HREF="smbd.8.html"
7080 TARGET="_top"
7081 ><B
7082 CLASS="COMMAND"
7083 >smbd(8)</B
7084 >
7085                 </A
7086 >.</P
7087 ><P
7088 >This option is mainly used as a compatibility option for Visual
7089                 C++ when used against Samba shares. If oplocks are enabled on a
7090                 share, Visual C++ uses two different time reading calls to check if a
7091                 file has changed since it was last read. One of these calls uses a
7092                 one-second granularity, the other uses a two second granularity. As
7093                 the two second call rounds any odd second down, then if the file has a
7094                 timestamp of an odd number of seconds then the two timestamps will not
7095                 match and Visual C++ will keep reporting the file has changed. Setting
7096                 this option causes the two timestamps to match, and Visual C++ is
7097                 happy.</P
7098 ><P
7099 >Default: <B
7100 CLASS="COMMAND"
7101 >dos filetime resolution = no</B
7102 ></P
7103 ></DD
7104 ><DT
7105 ><A
7106 NAME="DOSFILETIMES"
7107 ></A
7108 >dos filetimes (S)</DT
7109 ><DD
7110 ><P
7111 >Under DOS and Windows, if a user can write to a
7112                 file they can change the timestamp on it. Under POSIX semantics,
7113                 only the owner of the file or root may change the timestamp. By
7114                 default, Samba runs with POSIX semantics and refuses to change the
7115                 timestamp on a file if the user <B
7116 CLASS="COMMAND"
7117 >smbd</B
7118 > is acting
7119                 on behalf of is not the file owner. Setting this option to <TT
7120 CLASS="CONSTANT"
7121 >               True</TT
7122 > allows DOS semantics and smbd will change the file
7123                 timestamp as DOS requires.</P
7124 ><P
7125 >Default: <B
7126 CLASS="COMMAND"
7127 >dos filetimes = no</B
7128 ></P
7129 ></DD
7130 ><DT
7131 ><A
7132 NAME="ENCRYPTPASSWORDS"
7133 ></A
7134 >encrypt passwords (G)</DT
7135 ><DD
7136 ><P
7137 >This boolean controls whether encrypted passwords
7138                 will be negotiated with the client. Note that Windows NT 4.0 SP3 and
7139                 above and also Windows 98 will by default expect encrypted passwords
7140                 unless a registry entry is changed. To use encrypted passwords in
7141                 Samba see the file ENCRYPTION.txt in the Samba documentation
7142                 directory <TT
7143 CLASS="FILENAME"
7144 >docs/</TT
7145 > shipped with the source code.</P
7146 ><P
7147 >In order for encrypted passwords to work correctly
7148                 <A
7149 HREF="smbd.8.html"
7150 TARGET="_top"
7151 ><B
7152 CLASS="COMMAND"
7153 >smbd(8)</B
7154 ></A
7155 > must either
7156                 have access to a local <A
7157 HREF="smbpasswd.5.html"
7158 TARGET="_top"
7159 ><TT
7160 CLASS="FILENAME"
7161 >smbpasswd(5)
7162                 </TT
7163 ></A
7164 > file (see the <A
7165 HREF="smbpasswd.8.html"
7166 TARGET="_top"
7167 ><B
7168 CLASS="COMMAND"
7169 >               smbpasswd(8)</B
7170 ></A
7171 > program for information on how to set up
7172                 and maintain this file), or set the <A
7173 HREF="#SECURITY"
7174 >security=[serve|domain]</A
7175 > parameter which
7176                 causes <B
7177 CLASS="COMMAND"
7178 >smbd</B
7179 > to authenticate against another
7180                 server.</P
7181 ><P
7182 >Default: <B
7183 CLASS="COMMAND"
7184 >encrypt passwords = no</B
7185 ></P
7186 ></DD
7187 ><DT
7188 ><A
7189 NAME="ENHANCEDBROWSING"
7190 ></A
7191 >enhanced browsing (G)</DT
7192 ><DD
7193 ><P
7194 >This option enables a couple of enhancements to
7195                 cross-subnet browse propogation that have been added in Samba
7196                 but which are not standard in Microsoft implementations.
7197                 <EM
7198 >These enhancements are currently only available in
7199                 the HEAD Samba CVS tree (not Samba 2.2.x).</EM
7200 ></P
7201 ><P
7202 >The first enhancement to browse propogation consists of a regular
7203                 wildcard query to a Samba WINS server for all Domain Master Browsers,
7204                 followed by a browse synchronisation with each of the returned
7205                 DMBs. The second enhancement consists of a regular randomised browse
7206                 synchronisation with all currently known DMBs.</P
7207 ><P
7208 >You may wish to disable this option if you have a problem with empty
7209                 workgroups not disappearing from browse lists. Due to the restrictions
7210                 of the browse protocols these enhancements can cause a empty workgroup
7211                 to stay around forever which can be annoying.</P
7212 ><P
7213 >In general you should leave this option enabled as it makes
7214                 cross-subnet browse propogation much more reliable.</P
7215 ><P
7216 >Default: <B
7217 CLASS="COMMAND"
7218 >enhanced browsing = yes</B
7219 ></P
7220 ></DD
7221 ><DT
7222 ><A
7223 NAME="ENUMPORTSCOMMAND"
7224 ></A
7225 >enumports command (G)</DT
7226 ><DD
7227 ><P
7228 >The concept of a "port" is fairly foreign
7229                 to UNIX hosts.  Under Windows NT/2000 print servers, a port
7230                 is associated with a port monitor and generally takes the form of
7231                 a local port (i.e. LPT1:, COM1:, FILE:) or a remote port
7232                 (i.e. LPD Port Monitor, etc...).  By default, Samba has only one
7233                 port defined--<TT
7234 CLASS="CONSTANT"
7235 >"Samba Printer Port"</TT
7236 >.  Under
7237                 Windows NT/2000, all printers must have a valid port name.
7238                 If you wish to have a list of ports displayed (<B
7239 CLASS="COMMAND"
7240 >smbd
7241                 </B
7242 > does not use a port name for anything) other than
7243                 the default <TT
7244 CLASS="CONSTANT"
7245 >"Samba Printer Port"</TT
7246 >, you
7247                 can define <TT
7248 CLASS="PARAMETER"
7249 ><I
7250 >enumports command</I
7251 ></TT
7252 > to point to
7253                 a program which should generate a list of ports, one per line,
7254                 to standard output.  This listing will then be used in response
7255                 to the level 1 and 2 EnumPorts() RPC.</P
7256 ><P
7257 >Default: <EM
7258 >no enumports command</EM
7259 ></P
7260 ><P
7261 >Example: <B
7262 CLASS="COMMAND"
7263 >enumports command = /usr/bin/listports
7264                 </B
7265 ></P
7266 ></DD
7267 ><DT
7268 ><A
7269 NAME="EXEC"
7270 ></A
7271 >exec (S)</DT
7272 ><DD
7273 ><P
7274 >This is a synonym for <A
7275 HREF="#PREEXEC"
7276 >               <TT
7277 CLASS="PARAMETER"
7278 ><I
7279 >preexec</I
7280 ></TT
7281 ></A
7282 >.</P
7283 ></DD
7284 ><DT
7285 ><A
7286 NAME="FAKEDIRECTORYCREATETIMES"
7287 ></A
7288 >fake directory create times (S)</DT
7289 ><DD
7290 ><P
7291 >NTFS and Windows VFAT file systems keep a create
7292                 time for all files and directories. This is not the same as the
7293                 ctime - status change time - that Unix keeps, so Samba by default
7294                 reports the earliest of the various times Unix does keep. Setting
7295                 this parameter for a share causes Samba to always report midnight
7296                 1-1-1980 as the create time for directories.</P
7297 ><P
7298 >This option is mainly used as a compatibility option for
7299                 Visual C++ when used against Samba shares. Visual C++ generated
7300                 makefiles have the object directory as a dependency for each object
7301                 file, and a make rule to create the directory. Also, when NMAKE
7302                 compares timestamps it uses the creation time when examining a
7303                 directory. Thus the object directory will be created if it does not
7304                 exist, but once it does exist it will always have an earlier
7305                 timestamp than the object files it contains.</P
7306 ><P
7307 >However, Unix time semantics mean that the create time
7308                 reported by Samba will be updated whenever a file is created or
7309                 or deleted in the directory.  NMAKE finds all object files in
7310                 the object directory.  The timestamp of the last one built is then
7311                 compared to the timestamp of the object dircetory.  If the
7312                 directory's timestamp if newer, then all object files
7313                 will be rebuilt.  Enabling this option
7314                 ensures directories always predate their contents and an NMAKE build
7315                 will proceed as expected.</P
7316 ><P
7317 >Default: <B
7318 CLASS="COMMAND"
7319 >fake directory create times = no</B
7320 ></P
7321 ></DD
7322 ><DT
7323 ><A
7324 NAME="FAKEOPLOCKS"
7325 ></A
7326 >fake oplocks (S)</DT
7327 ><DD
7328 ><P
7329 >Oplocks are the way that SMB clients get permission
7330                 from a server to locally cache file operations. If a server grants
7331                 an oplock (opportunistic lock) then the client is free to assume
7332                 that it is the only one accessing the file and it will aggressively
7333                 cache file data. With some oplock types the client may even cache
7334                 file open/close operations. This can give enormous performance benefits.
7335                 </P
7336 ><P
7337 >When you set <B
7338 CLASS="COMMAND"
7339 >fake oplocks = yes</B
7340 >, <A
7341 HREF="smbd.8.html"
7342 TARGET="_top"
7343 ><B
7344 CLASS="COMMAND"
7345 >smbd(8)</B
7346 ></A
7347 > will
7348                 always grant oplock requests no matter how many clients are using
7349                 the file.</P
7350 ><P
7351 >It is generally much better to use the real <A
7352 HREF="#OPLOCKS"
7353 ><TT
7354 CLASS="PARAMETER"
7355 ><I
7356 >oplocks</I
7357 ></TT
7358 ></A
7359 > support rather
7360                 than this parameter.</P
7361 ><P
7362 >If you enable this option on all read-only shares or
7363                 shares that you know will only be accessed from one client at a
7364                 time such as physically read-only media like CDROMs, you will see
7365                 a big performance improvement on many operations. If you enable
7366                 this option on shares where multiple clients may be accessing the
7367                 files read-write at the same time you can get data corruption. Use
7368                 this option carefully!</P
7369 ><P
7370 >Default: <B
7371 CLASS="COMMAND"
7372 >fake oplocks = no</B
7373 ></P
7374 ></DD
7375 ><DT
7376 ><A
7377 NAME="FOLLOWSYMLINKS"
7378 ></A
7379 >follow symlinks (S)</DT
7380 ><DD
7381 ><P
7382 >This parameter allows the Samba administrator
7383                 to stop <A
7384 HREF="smbd.8.html"
7385 TARGET="_top"
7386 ><B
7387 CLASS="COMMAND"
7388 >smbd(8)</B
7389 ></A
7390 >
7391                 from following symbolic links in a particular share. Setting this
7392                 parameter to <TT
7393 CLASS="CONSTANT"
7394 >no</TT
7395 > prevents any file or directory
7396                 that is a symbolic link from being followed (the user will get an
7397                 error).  This option is very useful to stop users from adding a
7398                 symbolic link to <TT
7399 CLASS="FILENAME"
7400 >/etc/passwd</TT
7401 > in their home
7402                 directory for instance.  However it will slow filename lookups
7403                 down slightly.</P
7404 ><P
7405 >This option is enabled (i.e. <B
7406 CLASS="COMMAND"
7407 >smbd</B
7408 > will
7409                 follow symbolic links) by default.</P
7410 ><P
7411 >Default: <B
7412 CLASS="COMMAND"
7413 >follow symlinks = yes</B
7414 ></P
7415 ></DD
7416 ><DT
7417 ><A
7418 NAME="FORCECREATEMODE"
7419 ></A
7420 >force create mode (S)</DT
7421 ><DD
7422 ><P
7423 >This parameter specifies a set of UNIX mode bit
7424                 permissions that will <EM
7425 >always</EM
7426 > be set on a
7427                 file created by Samba. This is done by bitwise 'OR'ing these bits onto
7428                 the mode bits of a file that is being created or having its
7429                 permissions changed. The default for this parameter is (in octal)
7430                 000. The modes in this parameter are bitwise 'OR'ed onto the file
7431                 mode after the mask set in the <TT
7432 CLASS="PARAMETER"
7433 ><I
7434 >create mask</I
7435 ></TT
7436 >
7437                 parameter is applied.</P
7438 ><P
7439 >See also the parameter <A
7440 HREF="#CREATEMASK"
7441 ><TT
7442 CLASS="PARAMETER"
7443 ><I
7444 >create
7445                 mask</I
7446 ></TT
7447 ></A
7448 > for details on masking mode bits on files.</P
7449 ><P
7450 >See also the <A
7451 HREF="#INHERITPERMISSIONS"
7452 ><TT
7453 CLASS="PARAMETER"
7454 ><I
7455 >inherit
7456                 permissions</I
7457 ></TT
7458 ></A
7459 > parameter.</P
7460 ><P
7461 >Default: <B
7462 CLASS="COMMAND"
7463 >force create mode = 000</B
7464 ></P
7465 ><P
7466 >Example: <B
7467 CLASS="COMMAND"
7468 >force create mode = 0755</B
7469 ></P
7470 ><P
7471 >would force all created files to have read and execute
7472                 permissions set for 'group' and 'other' as well as the
7473                 read/write/execute bits set for the 'user'.</P
7474 ></DD
7475 ><DT
7476 ><A
7477 NAME="FORCEDIRECTORYMODE"
7478 ></A
7479 >force directory mode (S)</DT
7480 ><DD
7481 ><P
7482 >This parameter specifies a set of UNIX mode bit
7483                 permissions that will <EM
7484 >always</EM
7485 > be set on a directory
7486                 created by Samba. This is done by bitwise 'OR'ing these bits onto the
7487                 mode bits of a directory that is being created. The default for this
7488                 parameter is (in octal) 0000 which will not add any extra permission
7489                 bits to a created directory. This operation is done after the mode
7490                 mask in the parameter <TT
7491 CLASS="PARAMETER"
7492 ><I
7493 >directory mask</I
7494 ></TT
7495 > is
7496                 applied.</P
7497 ><P
7498 >See also the parameter <A
7499 HREF="#DIRECTORYMASK"
7500 ><TT
7501 CLASS="PARAMETER"
7502 ><I
7503 >               directory mask</I
7504 ></TT
7505 ></A
7506 > for details on masking mode bits
7507                 on created directories.</P
7508 ><P
7509 >See also the <A
7510 HREF="#INHERITPERMISSIONS"
7511 ><TT
7512 CLASS="PARAMETER"
7513 ><I
7514 >               inherit permissions</I
7515 ></TT
7516 ></A
7517 > parameter.</P
7518 ><P
7519 >Default: <B
7520 CLASS="COMMAND"
7521 >force directory mode = 000</B
7522 ></P
7523 ><P
7524 >Example: <B
7525 CLASS="COMMAND"
7526 >force directory mode = 0755</B
7527 ></P
7528 ><P
7529 >would force all created directories to have read and execute
7530                 permissions set for 'group' and 'other' as well as the
7531                 read/write/execute bits set for the 'user'.</P
7532 ></DD
7533 ><DT
7534 ><A
7535 NAME="FORCEDIRECTORYSECURITYMODE"
7536 ></A
7537 >force directory
7538                 security mode (S)</DT
7539 ><DD
7540 ><P
7541 >This parameter controls what UNIX permission bits
7542                 can be modified when a Windows NT client is manipulating the UNIX
7543                 permission on a directory using the native NT security dialog box.</P
7544 ><P
7545 >This parameter is applied as a mask (OR'ed with) to the
7546                 changed permission bits, thus forcing any bits in this mask that
7547                 the user may have modified to be on. Essentially, one bits in this
7548                 mask may be treated as a set of bits that, when modifying security
7549                 on a directory, the user has always set to be 'on'.</P
7550 ><P
7551 >If not set explicitly this parameter is set to the same
7552                 value as the <A
7553 HREF="#FORCEDIRECTORYMODE"
7554 ><TT
7555 CLASS="PARAMETER"
7556 ><I
7557 >force
7558                 directory mode</I
7559 ></TT
7560 ></A
7561 > parameter. To allow
7562                 a user to modify all the user/group/world permissions on a
7563                 directory without restrictions, set this parameter to 000.</P
7564 ><P
7565 ><EM
7566 >Note</EM
7567 > that users who can access the
7568                 Samba server through other means can easily bypass this restriction,
7569                 so it is primarily useful for standalone "appliance" systems.
7570                 Administrators of most normal systems will probably want to set
7571                 it to 0000.</P
7572 ><P
7573 >See also the <A
7574 HREF="#DIRECTORYSECURITYMASK"
7575 ><TT
7576 CLASS="PARAMETER"
7577 ><I
7578 >               directory security mask</I
7579 ></TT
7580 ></A
7581 >, <A
7582 HREF="#SECURITYMASK"
7583 >               <TT
7584 CLASS="PARAMETER"
7585 ><I
7586 >security mask</I
7587 ></TT
7588 ></A
7589 >,
7590                 <A
7591 HREF="#FORCESECURITYMODE"
7592 ><TT
7593 CLASS="PARAMETER"
7594 ><I
7595 >force security mode
7596                 </I
7597 ></TT
7598 ></A
7599 > parameters.</P
7600 ><P
7601 >Default: <B
7602 CLASS="COMMAND"
7603 >force directory security mode = &#60;same as
7604                 force directory mode&#62;</B
7605 ></P
7606 ><P
7607 >Example: <B
7608 CLASS="COMMAND"
7609 >force directory security mode = 0</B
7610 ></P
7611 ></DD
7612 ><DT
7613 ><A
7614 NAME="FORCEGROUP"
7615 ></A
7616 >force group (S)</DT
7617 ><DD
7618 ><P
7619 >This specifies a UNIX group name that will be
7620                 assigned as the default primary group for all users connecting
7621                 to this service. This is useful for sharing files by ensuring
7622                 that all access to files on service will use the named group for
7623                 their permissions checking. Thus, by assigning permissions for this
7624                 group to the files and directories within this service the Samba
7625                 administrator can restrict or allow sharing of these files.</P
7626 ><P
7627 >In Samba 2.0.5 and above this parameter has extended
7628                 functionality in the following way. If the group name listed here
7629                 has a '+' character prepended to it then the current user accessing
7630                 the share only has the primary group default assigned to this group
7631                 if they are already assigned as a member of that group. This allows
7632                 an administrator to decide that only users who are already in a
7633                 particular group will create files with group ownership set to that
7634                 group. This gives a finer granularity of ownership assignment. For
7635                 example, the setting <TT
7636 CLASS="FILENAME"
7637 >force group = +sys</TT
7638 > means
7639                 that only users who are already in group sys will have their default
7640                 primary group assigned to sys when accessing this Samba share. All
7641                 other users will retain their ordinary primary group.</P
7642 ><P
7643 >If the <A
7644 HREF="#FORCEUSER"
7645 ><TT
7646 CLASS="PARAMETER"
7647 ><I
7648 >force user
7649                 </I
7650 ></TT
7651 ></A
7652 > parameter is also set the group specified in
7653                 <TT
7654 CLASS="PARAMETER"
7655 ><I
7656 >force group</I
7657 ></TT
7658 > will override the primary group
7659                 set in <TT
7660 CLASS="PARAMETER"
7661 ><I
7662 >force user</I
7663 ></TT
7664 >.</P
7665 ><P
7666 >See also <A
7667 HREF="#FORCEUSER"
7668 ><TT
7669 CLASS="PARAMETER"
7670 ><I
7671 >force
7672                 user</I
7673 ></TT
7674 ></A
7675 >.</P
7676 ><P
7677 >Default: <EM
7678 >no forced group</EM
7679 ></P
7680 ><P
7681 >Example: <B
7682 CLASS="COMMAND"
7683 >force group = agroup</B
7684 ></P
7685 ></DD
7686 ><DT
7687 ><A
7688 NAME="FORCESECURITYMODE"
7689 ></A
7690 >force security mode (S)</DT
7691 ><DD
7692 ><P
7693 >This parameter controls what UNIX permission
7694                 bits can be modified when a Windows NT client is manipulating
7695                 the UNIX permission on a file using the native NT security dialog
7696                 box.</P
7697 ><P
7698 >This parameter is applied as a mask (OR'ed with) to the
7699                 changed permission bits, thus forcing any bits in this mask that
7700                 the user may have modified to be on. Essentially, one bits in this
7701                 mask may be treated as a set of bits that, when modifying security
7702                 on a file, the user has always set to be 'on'.</P
7703 ><P
7704 >If not set explicitly this parameter is set to the same
7705                 value as the <A
7706 HREF="#FORCECREATEMODE"
7707 ><TT
7708 CLASS="PARAMETER"
7709 ><I
7710 >force
7711                 create mode</I
7712 ></TT
7713 ></A
7714 > parameter. To allow a user to
7715                 modify all the user/group/world permissions on a file, with no
7716                 restrictions set this parameter to 000.</P
7717 ><P
7718 ><EM
7719 >Note</EM
7720 > that users who can access
7721                 the Samba server through other means can easily bypass this restriction,
7722                 so it is primarily useful for standalone "appliance" systems.
7723                 Administrators of most normal systems will probably want to set
7724                 it to 0000.</P
7725 ><P
7726 >See also the <A
7727 HREF="#FORCEDIRECTORYSECURITYMODE"
7728 ><TT
7729 CLASS="PARAMETER"
7730 ><I
7731 >               force directory security mode</I
7732 ></TT
7733 ></A
7734 >,
7735                 <A
7736 HREF="#DIRECTORYSECURITYMASK"
7737 ><TT
7738 CLASS="PARAMETER"
7739 ><I
7740 >directory security
7741                 mask</I
7742 ></TT
7743 ></A
7744 >, <A
7745 HREF="#SECURITYMASK"
7746 ><TT
7747 CLASS="PARAMETER"
7748 ><I
7749 >               security mask</I
7750 ></TT
7751 ></A
7752 > parameters.</P
7753 ><P
7754 >Default: <B
7755 CLASS="COMMAND"
7756 >force security mode = &#60;same as force
7757                 create mode&#62;</B
7758 ></P
7759 ><P
7760 >Example: <B
7761 CLASS="COMMAND"
7762 >force security mode = 0</B
7763 ></P
7764 ></DD
7765 ><DT
7766 ><A
7767 NAME="FORCEUSER"
7768 ></A
7769 >force user (S)</DT
7770 ><DD
7771 ><P
7772 >This specifies a UNIX user name that will be
7773                 assigned as the default user for all users connecting to this service.
7774                 This is useful for sharing files. You should also use it carefully
7775                 as using it incorrectly can cause security problems.</P
7776 ><P
7777 >This user name only gets used once a connection is established.
7778                 Thus clients still need to connect as a valid user and supply a
7779                 valid password. Once connected, all file operations will be performed
7780                 as the "forced user", no matter what username the client connected
7781                 as.  This can be very useful.</P
7782 ><P
7783 >In Samba 2.0.5 and above this parameter also causes the
7784                 primary group of the forced user to be used as the primary group
7785                 for all file activity. Prior to 2.0.5 the primary group was left
7786                 as the primary group of the connecting user (this was a bug).</P
7787 ><P
7788 >See also <A
7789 HREF="#FORCEGROUP"
7790 ><TT
7791 CLASS="PARAMETER"
7792 ><I
7793 >force group
7794                 </I
7795 ></TT
7796 ></A
7797 ></P
7798 ><P
7799 >Default: <EM
7800 >no forced user</EM
7801 ></P
7802 ><P
7803 >Example: <B
7804 CLASS="COMMAND"
7805 >force user = auser</B
7806 ></P
7807 ></DD
7808 ><DT
7809 ><A
7810 NAME="FSTYPE"
7811 ></A
7812 >fstype (S)</DT
7813 ><DD
7814 ><P
7815 >This parameter allows the administrator to
7816                 configure the string that specifies the type of filesystem a share
7817                 is using that is reported by <A
7818 HREF="smbd.8.html"
7819 TARGET="_top"
7820 ><B
7821 CLASS="COMMAND"
7822 >smbd(8)
7823                 </B
7824 ></A
7825 > when a client queries the filesystem type
7826                 for a share. The default type is <TT
7827 CLASS="CONSTANT"
7828 >NTFS</TT
7829 > for
7830                 compatibility with Windows NT but this can be changed to other
7831                 strings such as <TT
7832 CLASS="CONSTANT"
7833 >Samba</TT
7834 > or <TT
7835 CLASS="CONSTANT"
7836 >FAT
7837                 </TT
7838 > if required.</P
7839 ><P
7840 >Default: <B
7841 CLASS="COMMAND"
7842 >fstype = NTFS</B
7843 ></P
7844 ><P
7845 >Example: <B
7846 CLASS="COMMAND"
7847 >fstype = Samba</B
7848 ></P
7849 ></DD
7850 ><DT
7851 ><A
7852 NAME="GETWDCACHE"
7853 ></A
7854 >getwd cache (G)</DT
7855 ><DD
7856 ><P
7857 >This is a tuning option. When this is enabled a
7858                 caching algorithm will be used to reduce the time taken for getwd()
7859                 calls. This can have a significant impact on performance, especially
7860                 when the <A
7861 HREF="#WIDELINKS"
7862 ><TT
7863 CLASS="PARAMETER"
7864 ><I
7865 >wide links</I
7866 ></TT
7867 >
7868                 </A
7869 >parameter is set to <TT
7870 CLASS="CONSTANT"
7871 >False</TT
7872 >.</P
7873 ><P
7874 >Default: <B
7875 CLASS="COMMAND"
7876 >getwd cache = yes</B
7877 ></P
7878 ></DD
7879 ><DT
7880 ><A
7881 NAME="GROUP"
7882 ></A
7883 >group (S)</DT
7884 ><DD
7885 ><P
7886 >Synonym for <A
7887 HREF="#FORCEGROUP"
7888 ><TT
7889 CLASS="PARAMETER"
7890 ><I
7891 >force
7892                 group</I
7893 ></TT
7894 ></A
7895 >.</P
7896 ></DD
7897 ><DT
7898 ><A
7899 NAME="GUESTACCOUNT"
7900 ></A
7901 >guest account (S)</DT
7902 ><DD
7903 ><P
7904 >This is a username which will be used for access
7905                 to services which are specified as <A
7906 HREF="#GUESTOK"
7907 ><TT
7908 CLASS="PARAMETER"
7909 ><I
7910 >               guest ok</I
7911 ></TT
7912 ></A
7913 > (see below). Whatever privileges this
7914                 user has will be available to any client connecting to the guest service.
7915                 Typically this user will exist in the password file, but will not
7916                 have a valid login. The user account "ftp" is often a good choice
7917                 for this parameter. If a username is specified in a given service,
7918                 the specified username overrides this one.</P
7919 ><P
7920 >One some systems the default guest account "nobody" may not
7921                 be able to print. Use another account in this case. You should test
7922                 this by trying to log in as your guest user (perhaps by using the
7923                 <B
7924 CLASS="COMMAND"
7925 >su -</B
7926 > command) and trying to print using the
7927                 system print command such as <B
7928 CLASS="COMMAND"
7929 >lpr(1)</B
7930 > or <B
7931 CLASS="COMMAND"
7932 >               lp(1)</B
7933 >.</P
7934 ><P
7935 >Default: <EM
7936 >specified at compile time, usually
7937                 "nobody"</EM
7938 ></P
7939 ><P
7940 >Example: <B
7941 CLASS="COMMAND"
7942 >guest account = ftp</B
7943 ></P
7944 ></DD
7945 ><DT
7946 ><A
7947 NAME="GUESTOK"
7948 ></A
7949 >guest ok (S)</DT
7950 ><DD
7951 ><P
7952 >If this parameter is <TT
7953 CLASS="CONSTANT"
7954 >yes</TT
7955 > for
7956                 a service, then no password is required to connect to the service.
7957                 Privileges will be those of the <A
7958 HREF="#GUESTACCOUNT"
7959 ><TT
7960 CLASS="PARAMETER"
7961 ><I
7962 >               guest account</I
7963 ></TT
7964 ></A
7965 >.</P
7966 ><P
7967 >See the section below on <A
7968 HREF="#SECURITY"
7969 ><TT
7970 CLASS="PARAMETER"
7971 ><I
7972 >               security</I
7973 ></TT
7974 ></A
7975 > for more information about this option.
7976                 </P
7977 ><P
7978 >Default: <B
7979 CLASS="COMMAND"
7980 >guest ok = no</B
7981 ></P
7982 ></DD
7983 ><DT
7984 ><A
7985 NAME="GUESTONLY"
7986 ></A
7987 >guest only (S)</DT
7988 ><DD
7989 ><P
7990 >If this parameter is <TT
7991 CLASS="CONSTANT"
7992 >yes</TT
7993 > for
7994                 a service, then only guest connections to the service are permitted.
7995                 This parameter will have no effect if <A
7996 HREF="#GUESTOK"
7997 >               <TT
7998 CLASS="PARAMETER"
7999 ><I
8000 >guest ok</I
8001 ></TT
8002 ></A
8003 > is not set for the service.</P
8004 ><P
8005 >See the section below on <A
8006 HREF="#SECURITY"
8007 ><TT
8008 CLASS="PARAMETER"
8009 ><I
8010 >               security</I
8011 ></TT
8012 ></A
8013 > for more information about this option.
8014                 </P
8015 ><P
8016 >Default: <B
8017 CLASS="COMMAND"
8018 >guest only = no</B
8019 ></P
8020 ></DD
8021 ><DT
8022 ><A
8023 NAME="HIDEDOTFILES"
8024 ></A
8025 >hide dot files (S)</DT
8026 ><DD
8027 ><P
8028 >This is a boolean parameter that controls whether
8029                 files starting with a dot appear as hidden files.</P
8030 ><P
8031 >Default: <B
8032 CLASS="COMMAND"
8033 >hide dot files = yes</B
8034 ></P
8035 ></DD
8036 ><DT
8037 ><A
8038 NAME="HIDEFILES"
8039 ></A
8040 >hide files(S)</DT
8041 ><DD
8042 ><P
8043 >This is a list of files or directories that are not
8044                 visible but are accessible.  The DOS 'hidden' attribute is applied
8045                 to any files or directories that match.</P
8046 ><P
8047 >Each entry in the list must be separated by a '/',
8048                 which allows spaces to be included in the entry.  '*'
8049                 and '?' can be used to specify multiple files or directories
8050                 as in DOS wildcards.</P
8051 ><P
8052 >Each entry must be a Unix path, not a DOS path and must
8053                 not include the Unix directory separator '/'.</P
8054 ><P
8055 >Note that the case sensitivity option is applicable
8056                 in hiding files.</P
8057 ><P
8058 >Setting this parameter will affect the performance of Samba,
8059                 as it will be forced to check all files and directories for a match
8060                 as they are scanned.</P
8061 ><P
8062 >See also <A
8063 HREF="#HIDEDOTFILES"
8064 ><TT
8065 CLASS="PARAMETER"
8066 ><I
8067 >hide
8068                 dot files</I
8069 ></TT
8070 ></A
8071 >, <A
8072 HREF="#VETOFILES"
8073 ><TT
8074 CLASS="PARAMETER"
8075 ><I
8076 >               veto files</I
8077 ></TT
8078 ></A
8079 > and <A
8080 HREF="#CASESENSITIVE"
8081 >               <TT
8082 CLASS="PARAMETER"
8083 ><I
8084 >case sensitive</I
8085 ></TT
8086 ></A
8087 >.</P
8088 ><P
8089 >Default: <EM
8090 >no file are hidden</EM
8091 ></P
8092 ><P
8093 >Example: <B
8094 CLASS="COMMAND"
8095 >hide files =
8096                 /.*/DesktopFolderDB/TrashFor%m/resource.frk/</B
8097 ></P
8098 ><P
8099 >The above example is based on files that the Macintosh
8100                 SMB client (DAVE) available from <A
8101 HREF="http://www.thursby.com"
8102 TARGET="_top"
8103 >
8104                 Thursby</A
8105 > creates for internal use, and also still hides
8106                 all files beginning with a dot.</P
8107 ></DD
8108 ><DT
8109 ><A
8110 NAME="HIDELOCALUSERS"
8111 ></A
8112 >hide local users(G)</DT
8113 ><DD
8114 ><P
8115 >This parameter toggles the hiding of local UNIX
8116                 users (root, wheel, floppy, etc) from remote clients.</P
8117 ><P
8118 >Default: <B
8119 CLASS="COMMAND"
8120 >hide local users = no</B
8121 ></P
8122 ></DD
8123 ><DT
8124 ><A
8125 NAME="HOMEDIRMAP"
8126 ></A
8127 >homedir map (G)</DT
8128 ><DD
8129 ><P
8130 >If<A
8131 HREF="#NISHOMEDIR"
8132 ><TT
8133 CLASS="PARAMETER"
8134 ><I
8135 >nis homedir
8136                 </I
8137 ></TT
8138 ></A
8139 > is <TT
8140 CLASS="CONSTANT"
8141 >True</TT
8142 >, and <A
8143 HREF="smbd.8.html"
8144 TARGET="_top"
8145 ><B
8146 CLASS="COMMAND"
8147 >smbd(8)</B
8148 ></A
8149 > is also acting
8150                 as a Win95/98 <TT
8151 CLASS="PARAMETER"
8152 ><I
8153 >logon server</I
8154 ></TT
8155 > then this parameter
8156                 specifies the NIS (or YP) map from which the server for the user's
8157                 home directory should be extracted.  At present, only the Sun
8158                 auto.home map format is understood. The form of the map is:</P
8159 ><P
8160 ><B
8161 CLASS="COMMAND"
8162 >username       server:/some/file/system</B
8163 ></P
8164 ><P
8165 >and the program will extract the servername from before
8166                 the first ':'.  There should probably be a better parsing system
8167                 that copes with different map formats and also Amd (another
8168                 automounter) maps.</P
8169 ><P
8170 ><EM
8171 >NOTE :</EM
8172 >A working NIS client is required on
8173                 the system for this option to work.</P
8174 ><P
8175 >See also <A
8176 HREF="#NISHOMEDIR"
8177 ><TT
8178 CLASS="PARAMETER"
8179 ><I
8180 >nis homedir</I
8181 ></TT
8182 >
8183                 </A
8184 >, <A
8185 HREF="#DOMAINLOGONS"
8186 ><TT
8187 CLASS="PARAMETER"
8188 ><I
8189 >domain logons</I
8190 ></TT
8191 >
8192                 </A
8193 >.</P
8194 ><P
8195 >Default: <B
8196 CLASS="COMMAND"
8197 >homedir map = &#60;empty string&#62;</B
8198 ></P
8199 ><P
8200 >Example: <B
8201 CLASS="COMMAND"
8202 >homedir map = amd.homedir</B
8203 ></P
8204 ></DD
8205 ><DT
8206 ><A
8207 NAME="HOSTMSDFS"
8208 ></A
8209 >host msdfs (G)</DT
8210 ><DD
8211 ><P
8212 >This boolean parameter is only available
8213                 if Samba has been configured and compiled with the <B
8214 CLASS="COMMAND"
8215 >               --with-msdfs</B
8216 > option. If set to <TT
8217 CLASS="CONSTANT"
8218 >yes</TT
8219 >,
8220                 Samba will act as a Dfs server, and  allow Dfs-aware clients
8221                 to browse Dfs trees hosted on the server.</P
8222 ><P
8223 >See also the <A
8224 HREF="#MSDFSROOT"
8225 ><TT
8226 CLASS="PARAMETER"
8227 ><I
8228 >               msdfs root</I
8229 ></TT
8230 ></A
8231 > share  level  parameter.  For
8232                 more  information  on  setting  up a Dfs tree on Samba,
8233                 refer to <A
8234 HREF="msdfs_setup.html"
8235 TARGET="_top"
8236 >msdfs_setup.html</A
8237 >.
8238                 </P
8239 ><P
8240 >Default: <B
8241 CLASS="COMMAND"
8242 >host msdfs = no</B
8243 ></P
8244 ></DD
8245 ><DT
8246 ><A
8247 NAME="HOSTSALLOW"
8248 ></A
8249 >hosts allow (S)</DT
8250 ><DD
8251 ><P
8252 >A synonym for this parameter is <TT
8253 CLASS="PARAMETER"
8254 ><I
8255 >allow
8256                 hosts</I
8257 ></TT
8258 >.</P
8259 ><P
8260 >This parameter is a comma, space, or tab delimited
8261                 set of hosts which are permitted to access a service.</P
8262 ><P
8263 >If specified in the [global] section then it will
8264                 apply to all services, regardless of whether the individual
8265                 service has a different setting.</P
8266 ><P
8267 >You can specify the hosts by name or IP number. For
8268                 example, you could restrict access to only the hosts on a
8269                 Class C subnet with something like <B
8270 CLASS="COMMAND"
8271 >allow hosts = 150.203.5.
8272                 </B
8273 >. The full syntax of the list is described in the man
8274                 page <TT
8275 CLASS="FILENAME"
8276 >hosts_access(5)</TT
8277 >. Note that this man
8278                 page may not be present on your system, so a brief description will
8279                 be given here also.</P
8280 ><P
8281 >Note that the localhost address 127.0.0.1 will always
8282                 be allowed access unless specifically denied by a <A
8283 HREF="#HOSTSDENY"
8284 ><TT
8285 CLASS="PARAMETER"
8286 ><I
8287 >hosts deny</I
8288 ></TT
8289 ></A
8290 > option.</P
8291 ><P
8292 >You can also specify hosts by network/netmask pairs and
8293                 by netgroup names if your system supports netgroups. The
8294                 <EM
8295 >EXCEPT</EM
8296 > keyword can also be used to limit a
8297                 wildcard list. The following examples may provide some help:</P
8298 ><P
8299 >Example 1: allow all IPs in 150.203.*.*; except one</P
8300 ><P
8301 ><B
8302 CLASS="COMMAND"
8303 >hosts allow = 150.203. EXCEPT 150.203.6.66</B
8304 ></P
8305 ><P
8306 >Example 2: allow hosts that match the given network/netmask</P
8307 ><P
8308 ><B
8309 CLASS="COMMAND"
8310 >hosts allow = 150.203.15.0/255.255.255.0</B
8311 ></P
8312 ><P
8313 >Example 3: allow a couple of hosts</P
8314 ><P
8315 ><B
8316 CLASS="COMMAND"
8317 >hosts allow = lapland, arvidsjaur</B
8318 ></P
8319 ><P
8320 >Example 4: allow only hosts in NIS netgroup "foonet", but
8321                 deny access from one particular host</P
8322 ><P
8323 ><B
8324 CLASS="COMMAND"
8325 >hosts allow = @foonet</B
8326 ></P
8327 ><P
8328 ><B
8329 CLASS="COMMAND"
8330 >hosts deny = pirate</B
8331 ></P
8332 ><P
8333 >Note that access still requires suitable user-level passwords.</P
8334 ><P
8335 >See <A
8336 HREF="testparm.1.html"
8337 TARGET="_top"
8338 ><B
8339 CLASS="COMMAND"
8340 >testparm(1)</B
8341 >
8342                 </A
8343 > for a way of testing your host access to see if it does
8344                 what you expect.</P
8345 ><P
8346 >Default: <EM
8347 >none (i.e., all hosts permitted access)
8348                 </EM
8349 ></P
8350 ><P
8351 >Example: <B
8352 CLASS="COMMAND"
8353 >allow hosts = 150.203.5. myhost.mynet.edu.au
8354                 </B
8355 ></P
8356 ></DD
8357 ><DT
8358 ><A
8359 NAME="HOSTSDENY"
8360 ></A
8361 >hosts deny (S)</DT
8362 ><DD
8363 ><P
8364 >The opposite of <TT
8365 CLASS="PARAMETER"
8366 ><I
8367 >hosts allow</I
8368 ></TT
8369 >
8370                 - hosts listed here are <EM
8371 >NOT</EM
8372 > permitted access to
8373                 services unless the specific services have their own lists to override
8374                 this one. Where the lists conflict, the <TT
8375 CLASS="PARAMETER"
8376 ><I
8377 >allow</I
8378 ></TT
8379 >
8380                 list takes precedence.</P
8381 ><P
8382 >Default: <EM
8383 >none (i.e., no hosts specifically excluded)
8384                 </EM
8385 ></P
8386 ><P
8387 >Example: <B
8388 CLASS="COMMAND"
8389 >hosts deny = 150.203.4. badhost.mynet.edu.au
8390                 </B
8391 ></P
8392 ></DD
8393 ><DT
8394 ><A
8395 NAME="HOSTSEQUIV"
8396 ></A
8397 >hosts equiv (G)</DT
8398 ><DD
8399 ><P
8400 >If this global parameter is a non-null string,
8401                 it specifies the name of a file to read for the names of hosts
8402                 and users who will be allowed access without specifying a password.
8403                 </P
8404 ><P
8405 >This is not be confused with <A
8406 HREF="#HOSTSALLOW"
8407 >               <TT
8408 CLASS="PARAMETER"
8409 ><I
8410 >hosts allow</I
8411 ></TT
8412 ></A
8413 > which is about hosts
8414                 access to services and is more useful for guest services. <TT
8415 CLASS="PARAMETER"
8416 ><I
8417 >               hosts equiv</I
8418 ></TT
8419 > may be useful for NT clients which will
8420                 not supply passwords to samba.</P
8421 ><P
8422 ><EM
8423 >NOTE :</EM
8424 > The use of <TT
8425 CLASS="PARAMETER"
8426 ><I
8427 >hosts equiv
8428                 </I
8429 ></TT
8430 > can be a major security hole. This is because you are
8431                 trusting the PC to supply the correct username. It is very easy to
8432                 get a PC to supply a false username. I recommend that the
8433                 <TT
8434 CLASS="PARAMETER"
8435 ><I
8436 >hosts equiv</I
8437 ></TT
8438 > option be only used if you really
8439                 know what you are doing, or perhaps on a home network where you trust
8440                 your spouse and kids. And only if you <EM
8441 >really</EM
8442 > trust
8443                 them :-).</P
8444 ><P
8445 >Default: <EM
8446 >no host equivalences</EM
8447 ></P
8448 ><P
8449 >Example: <B
8450 CLASS="COMMAND"
8451 >hosts equiv = /etc/hosts.equiv</B
8452 ></P
8453 ></DD
8454 ><DT
8455 ><A
8456 NAME="INCLUDE"
8457 ></A
8458 >include (G)</DT
8459 ><DD
8460 ><P
8461 >This allows you to include one config file
8462                 inside another.  The file is included literally, as though typed
8463                 in place.</P
8464 ><P
8465 >It takes the standard substitutions, except <TT
8466 CLASS="PARAMETER"
8467 ><I
8468 >%u
8469                 </I
8470 ></TT
8471 >, <TT
8472 CLASS="PARAMETER"
8473 ><I
8474 >%P</I
8475 ></TT
8476 > and <TT
8477 CLASS="PARAMETER"
8478 ><I
8479 >%S</I
8480 ></TT
8481 >.
8482                 </P
8483 ><P
8484 >Default: <EM
8485 >no file included</EM
8486 ></P
8487 ><P
8488 >Example: <B
8489 CLASS="COMMAND"
8490 >include = /usr/local/samba/lib/admin_smb.conf
8491                 </B
8492 ></P
8493 ></DD
8494 ><DT
8495 ><A
8496 NAME="INHERITPERMISSIONS"
8497 ></A
8498 >inherit permissions (S)</DT
8499 ><DD
8500 ><P
8501 >The permissions on new files and directories
8502                 are normally governed by <A
8503 HREF="#CREATEMASK"
8504 ><TT
8505 CLASS="PARAMETER"
8506 ><I
8507 >               create mask</I
8508 ></TT
8509 ></A
8510 >, <A
8511 HREF="#DIRECTORYMASK"
8512 >               <TT
8513 CLASS="PARAMETER"
8514 ><I
8515 >directory mask</I
8516 ></TT
8517 ></A
8518 >, <A
8519 HREF="#FORCECREATEMODE"
8520 ><TT
8521 CLASS="PARAMETER"
8522 ><I
8523 >force create mode</I
8524 ></TT
8525 >
8526                 </A
8527 > and <A
8528 HREF="#FORCEDIRECTORYMODE"
8529 ><TT
8530 CLASS="PARAMETER"
8531 ><I
8532 >force
8533                 directory mode</I
8534 ></TT
8535 ></A
8536 > but the boolean inherit
8537                 permissions parameter overrides this.</P
8538 ><P
8539 >New directories inherit the mode of the parent directory,
8540                 including bits such as setgid.</P
8541 ><P
8542 >New files inherit their read/write bits from the parent
8543                 directory.  Their execute bits continue to be determined by
8544                 <A
8545 HREF="#MAPARCHIVE"
8546 ><TT
8547 CLASS="PARAMETER"
8548 ><I
8549 >map archive</I
8550 ></TT
8551 >
8552                 </A
8553 >, <A
8554 HREF="#MAPHIDDEN"
8555 ><TT
8556 CLASS="PARAMETER"
8557 ><I
8558 >map hidden</I
8559 ></TT
8560 >
8561                 </A
8562 > and <A
8563 HREF="#MAPSYSTEM"
8564 ><TT
8565 CLASS="PARAMETER"
8566 ><I
8567 >map system</I
8568 ></TT
8569 >
8570                 </A
8571 > as usual.</P
8572 ><P
8573 >Note that the setuid bit is <EM
8574 >never</EM
8575 > set via
8576                 inheritance (the code explicitly prohibits this).</P
8577 ><P
8578 >This can be particularly useful on large systems with
8579                 many users, perhaps several thousand,to allow a single [homes]
8580                 share to be used flexibly by each user.</P
8581 ><P
8582 >See also <A
8583 HREF="#CREATEMASK"
8584 ><TT
8585 CLASS="PARAMETER"
8586 ><I
8587 >create mask
8588                 </I
8589 ></TT
8590 ></A
8591 >, <A
8592 HREF="#DIRECTORYMASK"
8593 ><TT
8594 CLASS="PARAMETER"
8595 ><I
8596 >               directory mask</I
8597 ></TT
8598 ></A
8599 >, <A
8600 HREF="#FORCECREATEMODE"
8601 >               <TT
8602 CLASS="PARAMETER"
8603 ><I
8604 >force create mode</I
8605 ></TT
8606 ></A
8607 > and <A
8608 HREF="#FORCEDIRECTORYMODE"
8609 ><TT
8610 CLASS="PARAMETER"
8611 ><I
8612 >force directory mode</I
8613 ></TT
8614 >
8615                 </A
8616 >.</P
8617 ><P
8618 >Default: <B
8619 CLASS="COMMAND"
8620 >inherit permissions = no</B
8621 ></P
8622 ></DD
8623 ><DT
8624 ><A
8625 NAME="INTERFACES"
8626 ></A
8627 >interfaces (G)</DT
8628 ><DD
8629 ><P
8630 >This option allows you to override the default
8631                 network interfaces list that Samba will use for browsing, name
8632                 registration and other NBT traffic. By default Samba will query
8633                 the kernel for the list of all active interfaces and use any
8634                 interfaces except 127.0.0.1 that are broadcast capable.</P
8635 ><P
8636 >The option takes a list of interface strings. Each string
8637                 can be in any of the following forms:</P
8638 ><P
8639 ></P
8640 ><UL
8641 ><LI
8642 ><P
8643 >a network interface name (such as eth0).
8644                         This may include shell-like wildcards so eth* will match
8645                         any interface starting with the substring "eth"</P
8646 ></LI
8647 ><LI
8648 ><P
8649 >an IP address. In this case the netmask is
8650                         determined from the list of interfaces obtained from the
8651                         kernel</P
8652 ></LI
8653 ><LI
8654 ><P
8655 >an IP/mask pair. </P
8656 ></LI
8657 ><LI
8658 ><P
8659 >a broadcast/mask pair.</P
8660 ></LI
8661 ></UL
8662 ><P
8663 >The "mask" parameters can either be a bit length (such
8664                 as 24 for a C class network) or a full netmask in dotted
8665                 decimal form.</P
8666 ><P
8667 >The "IP" parameters above can either be a full dotted
8668                 decimal IP address or a hostname which will be looked up via
8669                 the OS's normal hostname resolution mechanisms.</P
8670 ><P
8671 >For example, the following line:</P
8672 ><P
8673 ><B
8674 CLASS="COMMAND"
8675 >interfaces = eth0 192.168.2.10/24 192.168.3.10/255.255.255.0
8676                 </B
8677 ></P
8678 ><P
8679 >would configure three network interfaces corresponding
8680                 to the eth0 device and IP addresses 192.168.2.10 and 192.168.3.10.
8681                 The netmasks of the latter two interfaces would be set to 255.255.255.0.</P
8682 ><P
8683 >See also <A
8684 HREF="#BINDINTERFACESONLY"
8685 ><TT
8686 CLASS="PARAMETER"
8687 ><I
8688 >bind
8689                 interfaces only</I
8690 ></TT
8691 ></A
8692 >.</P
8693 ><P
8694 >Default: <EM
8695 >all active interfaces except 127.0.0.1
8696                 that are broadcast capable</EM
8697 ></P
8698 ></DD
8699 ><DT
8700 ><A
8701 NAME="INVALIDUSERS"
8702 ></A
8703 >invalid users (S)</DT
8704 ><DD
8705 ><P
8706 >This is a list of users that should not be allowed
8707                 to login to this service. This is really a <EM
8708 >paranoid</EM
8709 >
8710                 check to absolutely ensure an improper setting does not breach
8711                 your security.</P
8712 ><P
8713 >A name starting with a '@' is interpreted as an NIS
8714                 netgroup first (if your system supports NIS), and then as a UNIX
8715                 group if the name was not found in the NIS netgroup database.</P
8716 ><P
8717 >A name starting with '+' is interpreted only
8718                 by looking in the UNIX group database. A name starting with
8719                 '&#38;' is interpreted only by looking in the NIS netgroup database
8720                 (this requires NIS to be working on your system). The characters
8721                 '+' and '&#38;' may be used at the start of the name in either order
8722                 so the value <TT
8723 CLASS="PARAMETER"
8724 ><I
8725 >+&#38;group</I
8726 ></TT
8727 > means check the
8728                 UNIX group database, followed by the NIS netgroup database, and
8729                 the value <TT
8730 CLASS="PARAMETER"
8731 ><I
8732 >&#38;+group"</I
8733 ></TT
8734 > means check the NIS
8735                 netgroup database, followed by the UNIX group database (the
8736                 same as the '@' prefix).</P
8737 ><P
8738 >The current servicename is substituted for <TT
8739 CLASS="PARAMETER"
8740 ><I
8741 >%S</I
8742 ></TT
8743 >.
8744                 This is useful in the [homes] section.</P
8745 ><P
8746 >See also <A
8747 HREF="#VALIDUSERS"
8748 ><TT
8749 CLASS="PARAMETER"
8750 ><I
8751 >valid users
8752                 </I
8753 ></TT
8754 ></A
8755 >.</P
8756 ><P
8757 >Default: <EM
8758 >no invalid users</EM
8759 ></P
8760 ><P
8761 >Example: <B
8762 CLASS="COMMAND"
8763 >invalid users = root fred admin @wheel
8764                 </B
8765 ></P
8766 ></DD
8767 ><DT
8768 ><A
8769 NAME="KEEPALIVE"
8770 ></A
8771 >keepalive (G)</DT
8772 ><DD
8773 ><P
8774 >The value of the parameter (an integer) represents
8775                 the number of seconds between <TT
8776 CLASS="PARAMETER"
8777 ><I
8778 >keepalive</I
8779 ></TT
8780 >
8781                 packets. If this parameter is zero, no keepalive packets will be
8782                 sent. Keepalive packets, if sent, allow the server to tell whether
8783                 a client is still present and responding.</P
8784 ><P
8785 >Keepalives should, in general, not be needed if the socket
8786                 being used has the SO_KEEPALIVE attribute set on it (see <A
8787 HREF="#SOCKETOPTIONS"
8788 ><TT
8789 CLASS="PARAMETER"
8790 ><I
8791 >socket options</I
8792 ></TT
8793 ></A
8794 >).
8795                 Basically you should only use this option if you strike difficulties.</P
8796 ><P
8797 >Default: <B
8798 CLASS="COMMAND"
8799 >keepalive = 300</B
8800 ></P
8801 ><P
8802 >Example: <B
8803 CLASS="COMMAND"
8804 >keepalive = 600</B
8805 ></P
8806 ></DD
8807 ><DT
8808 ><A
8809 NAME="KERNELOPLOCKS"
8810 ></A
8811 >kernel oplocks (G)</DT
8812 ><DD
8813 ><P
8814 >For UNIXes that support kernel based <A
8815 HREF="#OPLOCKS"
8816 ><TT
8817 CLASS="PARAMETER"
8818 ><I
8819 >oplocks</I
8820 ></TT
8821 ></A
8822 >
8823                 (currently only IRIX and the Linux 2.4 kernel), this parameter
8824                 allows the use of them to be turned on or off.</P
8825 ><P
8826 >Kernel oplocks support allows Samba <TT
8827 CLASS="PARAMETER"
8828 ><I
8829 >oplocks
8830                 </I
8831 ></TT
8832 > to be broken whenever a local UNIX process or NFS operation
8833                 accesses a file that <A
8834 HREF="smbd.8.html"
8835 TARGET="_top"
8836 ><B
8837 CLASS="COMMAND"
8838 >smbd(8)</B
8839 >
8840                 </A
8841 > has oplocked. This allows complete data consistency between
8842                 SMB/CIFS, NFS and local file access (and is a <EM
8843 >very</EM
8844 >
8845                 cool feature :-).</P
8846 ><P
8847 >This parameter defaults to <TT
8848 CLASS="CONSTANT"
8849 >on</TT
8850 > on systems
8851                 that have the support, and <TT
8852 CLASS="CONSTANT"
8853 >off</TT
8854 > on systems that
8855                 don't. You should never need to touch this parameter.</P
8856 ><P
8857 >See also the <A
8858 HREF="#OPLOCKS"
8859 ><TT
8860 CLASS="PARAMETER"
8861 ><I
8862 >oplocks</I
8863 ></TT
8864 >
8865                 </A
8866 > and <A
8867 HREF="#LEVEL2OPLOCKS"
8868 ><TT
8869 CLASS="PARAMETER"
8870 ><I
8871 >level2 oplocks
8872                 </I
8873 ></TT
8874 ></A
8875 > parameters.</P
8876 ><P
8877 >Default: <B
8878 CLASS="COMMAND"
8879 >kernel oplocks = yes</B
8880 ></P
8881 ></DD
8882 ><DT
8883 ><A
8884 NAME="LANMANAUTH"
8885 ></A
8886 >lanman auth (G)</DT
8887 ><DD
8888 ><P
8889 >This parameter determines whether or not smbd will
8890                 attempt to authentication users using the LANMAN password hash.
8891                 If disabled, only clients which support NT password hashes (e.g. Windows
8892                 NT/2000 clients, smbclient, etc... but not Windows 95/98 or the MS DOS
8893                 network client) will be able to connect to the Samba host.</P
8894 ><P
8895 >Default : <B
8896 CLASS="COMMAND"
8897 >lanman auth = yes</B
8898 ></P
8899 ></DD
8900 ><DT
8901 ><A
8902 NAME="LEVEL2OPLOCKS"
8903 ></A
8904 >level2 oplocks (S)</DT
8905 ><DD
8906 ><P
8907 >This parameter controls whether Samba supports
8908                 level2 (read-only) oplocks on a share.</P
8909 ><P
8910 >Level2, or read-only oplocks allow Windows NT clients
8911                 that have an oplock on a file to downgrade from a read-write oplock
8912                 to a read-only oplock once a second client opens the file (instead
8913                 of releasing all oplocks on a second open, as in traditional,
8914                 exclusive oplocks). This allows all openers of the file that
8915                 support level2 oplocks to cache the file for read-ahead only (ie.
8916                 they may not cache writes or lock requests) and increases performance
8917                 for many accesses of files that are not commonly written (such as
8918                 application .EXE files).</P
8919 ><P
8920 >Once one of the clients which have a read-only oplock
8921                 writes to the file all clients are notified (no reply is needed
8922                 or waited for) and told to break their oplocks to "none" and
8923                 delete any read-ahead caches.</P
8924 ><P
8925 >It is recommended that this parameter be turned on
8926                 to speed access to shared executables.</P
8927 ><P
8928 >For more discussions on level2 oplocks see the CIFS spec.</P
8929 ><P
8930 >Currently, if <A
8931 HREF="#KERNELOPLOCKS"
8932 ><TT
8933 CLASS="PARAMETER"
8934 ><I
8935 >kernel
8936                 oplocks</I
8937 ></TT
8938 ></A
8939 > are supported then level2 oplocks are
8940                 not granted (even if this parameter is set to <TT
8941 CLASS="CONSTANT"
8942 >yes</TT
8943 >).
8944                 Note also, the <A
8945 HREF="#OPLOCKS"
8946 ><TT
8947 CLASS="PARAMETER"
8948 ><I
8949 >oplocks</I
8950 ></TT
8951 >
8952                 </A
8953 > parameter must be set to "true" on this share in order for
8954                 this parameter to have any effect.</P
8955 ><P
8956 >See also the <A
8957 HREF="#OPLOCKS"
8958 ><TT
8959 CLASS="PARAMETER"
8960 ><I
8961 >oplocks</I
8962 ></TT
8963 >
8964                 </A
8965 > and <A
8966 HREF="#OPLOCKS"
8967 ><TT
8968 CLASS="PARAMETER"
8969 ><I
8970 >kernel oplocks</I
8971 ></TT
8972 >
8973                 </A
8974 > parameters.</P
8975 ><P
8976 >Default: <B
8977 CLASS="COMMAND"
8978 >level2 oplocks = yes</B
8979 ></P
8980 ></DD
8981 ><DT
8982 ><A
8983 NAME="LMANNOUNCE"
8984 ></A
8985 >lm announce (G)</DT
8986 ><DD
8987 ><P
8988 >This parameter determines if <A
8989 HREF="nmbd.8.html"
8990 TARGET="_top"
8991 >               <B
8992 CLASS="COMMAND"
8993 >nmbd(8)</B
8994 ></A
8995 > will produce Lanman announce
8996                 broadcasts that are needed by OS/2 clients in order for them to see
8997                 the Samba server in their browse list. This parameter can have three
8998                 values, <TT
8999 CLASS="CONSTANT"
9000 >true</TT
9001 >, <TT
9002 CLASS="CONSTANT"
9003 >false</TT
9004 >, or
9005                 <TT
9006 CLASS="CONSTANT"
9007 >auto</TT
9008 >. The default is <TT
9009 CLASS="CONSTANT"
9010 >auto</TT
9011 >.
9012                 If set to <TT
9013 CLASS="CONSTANT"
9014 >false</TT
9015 > Samba will never produce these
9016                 broadcasts. If set to <TT
9017 CLASS="CONSTANT"
9018 >true</TT
9019 > Samba will produce
9020                 Lanman announce broadcasts at a frequency set by the parameter
9021                 <TT
9022 CLASS="PARAMETER"
9023 ><I
9024 >lm interval</I
9025 ></TT
9026 >. If set to <TT
9027 CLASS="CONSTANT"
9028 >auto</TT
9029 >
9030                 Samba will not send Lanman announce broadcasts by default but will
9031                 listen for them. If it hears such a broadcast on the wire it will
9032                 then start sending them at a frequency set by the parameter
9033                 <TT
9034 CLASS="PARAMETER"
9035 ><I
9036 >lm interval</I
9037 ></TT
9038 >.</P
9039 ><P
9040 >See also <A
9041 HREF="#LMINTERVAL"
9042 ><TT
9043 CLASS="PARAMETER"
9044 ><I
9045 >lm interval
9046                 </I
9047 ></TT
9048 ></A
9049 >.</P
9050 ><P
9051 >Default: <B
9052 CLASS="COMMAND"
9053 >lm announce = auto</B
9054 ></P
9055 ><P
9056 >Example: <B
9057 CLASS="COMMAND"
9058 >lm announce = yes</B
9059 ></P
9060 ></DD
9061 ><DT
9062 ><A
9063 NAME="LMINTERVAL"
9064 ></A
9065 >lm interval (G)</DT
9066 ><DD
9067 ><P
9068 >If Samba is set to produce Lanman announce
9069                 broadcasts needed by OS/2 clients (see the <A
9070 HREF="#LMANNOUNCE"
9071 >               <TT
9072 CLASS="PARAMETER"
9073 ><I
9074 >lm announce</I
9075 ></TT
9076 ></A
9077 > parameter) then this
9078                 parameter defines the frequency in seconds with which they will be
9079                 made.  If this is set to zero then no Lanman announcements will be
9080                 made despite the setting of the <TT
9081 CLASS="PARAMETER"
9082 ><I
9083 >lm announce</I
9084 ></TT
9085 >
9086                 parameter.</P
9087 ><P
9088 >See also <A
9089 HREF="#LMANNOUNCE"
9090 ><TT
9091 CLASS="PARAMETER"
9092 ><I
9093 >lm
9094                 announce</I
9095 ></TT
9096 ></A
9097 >.</P
9098 ><P
9099 >Default: <B
9100 CLASS="COMMAND"
9101 >lm interval = 60</B
9102 ></P
9103 ><P
9104 >Example: <B
9105 CLASS="COMMAND"
9106 >lm interval = 120</B
9107 ></P
9108 ></DD
9109 ><DT
9110 ><A
9111 NAME="LOADPRINTERS"
9112 ></A
9113 >load printers (G)</DT
9114 ><DD
9115 ><P
9116 >A boolean variable that controls whether all
9117                 printers in the printcap will be loaded for browsing by default.
9118                 See the <A
9119 HREF="#AEN78"
9120 >printers</A
9121 > section for
9122                 more details.</P
9123 ><P
9124 >Default: <B
9125 CLASS="COMMAND"
9126 >load printers = yes</B
9127 ></P
9128 ></DD
9129 ><DT
9130 ><A
9131 NAME="LOCALMASTER"
9132 ></A
9133 >local master (G)</DT
9134 ><DD
9135 ><P
9136 >This option allows <A
9137 HREF="nmbd.8.html"
9138 TARGET="_top"
9139 ><B
9140 CLASS="COMMAND"
9141 >               nmbd(8)</B
9142 ></A
9143 > to try and become a local master browser
9144                 on a subnet. If set to <TT
9145 CLASS="CONSTANT"
9146 >False</TT
9147 > then <B
9148 CLASS="COMMAND"
9149 >               nmbd</B
9150 > will not attempt to become a local master browser
9151                 on a subnet and will also lose in all browsing elections. By
9152                 default this value is set to true. Setting this value to true doesn't
9153                 mean that Samba will <EM
9154 >become</EM
9155 > the local master
9156                 browser on a subnet, just that <B
9157 CLASS="COMMAND"
9158 >nmbd</B
9159 > will <EM
9160 >               participate</EM
9161 > in elections for local master browser.</P
9162 ><P
9163 >Setting this value to False will cause <B
9164 CLASS="COMMAND"
9165 >nmbd</B
9166 >
9167                 <EM
9168 >never</EM
9169 > to become a local master browser.</P
9170 ><P
9171 >Default: <B
9172 CLASS="COMMAND"
9173 >local master = yes</B
9174 ></P
9175 ></DD
9176 ><DT
9177 ><A
9178 NAME="LOCKDIR"
9179 ></A
9180 >lock dir (G)</DT
9181 ><DD
9182 ><P
9183 >Synonym for <A
9184 HREF="#LOCKDIRECTORY"
9185 ><TT
9186 CLASS="PARAMETER"
9187 ><I
9188 >               lock directory</I
9189 ></TT
9190 ></A
9191 >.</P
9192 ></DD
9193 ><DT
9194 ><A
9195 NAME="LOCKDIRECTORY"
9196 ></A
9197 >lock directory (G)</DT
9198 ><DD
9199 ><P
9200 >This option specifies the directory where lock
9201                 files will be placed.  The lock files are used to implement the
9202                 <A
9203 HREF="#MAXCONNECTIONS"
9204 ><TT
9205 CLASS="PARAMETER"
9206 ><I
9207 >max connections</I
9208 ></TT
9209 >
9210                 </A
9211 > option.</P
9212 ><P
9213 >Default: <B
9214 CLASS="COMMAND"
9215 >lock directory = ${prefix}/var/locks</B
9216 ></P
9217 ><P
9218 >Example: <B
9219 CLASS="COMMAND"
9220 >lock directory = /var/run/samba/locks</B
9221 >
9222                 </P
9223 ></DD
9224 ><DT
9225 ><A
9226 NAME="LOCKING"
9227 ></A
9228 >locking (S)</DT
9229 ><DD
9230 ><P
9231 >This controls whether or not locking will be
9232                 performed by the server in response to lock requests from the
9233                 client.</P
9234 ><P
9235 >If <B
9236 CLASS="COMMAND"
9237 >locking = no</B
9238 >, all lock and unlock
9239                 requests will appear to succeed and all lock queries will report
9240                 that the file in question is available for locking.</P
9241 ><P
9242 >If <B
9243 CLASS="COMMAND"
9244 >locking = yes</B
9245 >, real locking will be performed
9246                 by the server.</P
9247 ><P
9248 >This option <EM
9249 >may</EM
9250 > be useful for read-only
9251                 filesystems which <EM
9252 >may</EM
9253 > not need locking (such as
9254                 cdrom drives), although setting this parameter of <TT
9255 CLASS="CONSTANT"
9256 >no</TT
9257 >
9258                 is not really recommended even in this case.</P
9259 ><P
9260 >Be careful about disabling locking either globally or in a
9261                 specific service, as lack of locking may result in data corruption.
9262                 You should never need to set this parameter.</P
9263 ><P
9264 >Default: <B
9265 CLASS="COMMAND"
9266 >locking = yes</B
9267 ></P
9268 ></DD
9269 ><DT
9270 ><A
9271 NAME="LOGFILE"
9272 ></A
9273 >log file (G)</DT
9274 ><DD
9275 ><P
9276 >This option allows you to override the name
9277                 of the Samba log file (also known as the debug file).</P
9278 ><P
9279 >This option takes the standard substitutions, allowing
9280                 you to have separate log files for each user or machine.</P
9281 ><P
9282 >Example: <B
9283 CLASS="COMMAND"
9284 >log file = /usr/local/samba/var/log.%m
9285                 </B
9286 ></P
9287 ></DD
9288 ><DT
9289 ><A
9290 NAME="LOGLEVEL"
9291 ></A
9292 >log level (G)</DT
9293 ><DD
9294 ><P
9295 >Synonym for <A
9296 HREF="#DEBUGLEVEL"
9297 ><TT
9298 CLASS="PARAMETER"
9299 ><I
9300 >               debug level</I
9301 ></TT
9302 ></A
9303 >.</P
9304 ></DD
9305 ><DT
9306 ><A
9307 NAME="LOGONDRIVE"
9308 ></A
9309 >logon drive (G)</DT
9310 ><DD
9311 ><P
9312 >This parameter specifies the local path to
9313                 which the home directory will be connected (see <A
9314 HREF="#LOGONHOME"
9315 ><TT
9316 CLASS="PARAMETER"
9317 ><I
9318 >logon home</I
9319 ></TT
9320 ></A
9321 >)
9322                 and is only used by NT Workstations. </P
9323 ><P
9324 >Note that this option is only useful if Samba is set up as a
9325                 logon server.</P
9326 ><P
9327 >Default: <B
9328 CLASS="COMMAND"
9329 >logon drive = z:</B
9330 ></P
9331 ><P
9332 >Example: <B
9333 CLASS="COMMAND"
9334 >logon drive = h:</B
9335 ></P
9336 ></DD
9337 ><DT
9338 ><A
9339 NAME="LOGONHOME"
9340 ></A
9341 >logon home (G)</DT
9342 ><DD
9343 ><P
9344 >This parameter specifies the home directory
9345                 location when a Win95/98 or NT Workstation logs into a Samba PDC.
9346                 It allows you to do </P
9347 ><P
9348 ><TT
9349 CLASS="PROMPT"
9350 >C:\&#62; </TT
9351 ><TT
9352 CLASS="USERINPUT"
9353 ><B
9354 >NET USE H: /HOME</B
9355 ></TT
9356 >
9357                 </P
9358 ><P
9359 >from a command prompt, for example.</P
9360 ><P
9361 >This option takes the standard substitutions, allowing
9362                 you to have separate logon scripts for each user or machine.</P
9363 ><P
9364 >This parameter can be used with Win9X workstations to ensure
9365                 that roaming profiles are stored in a subdirectory of the user's
9366                 home directory.  This is done in the following way:</P
9367 ><P
9368 ><B
9369 CLASS="COMMAND"
9370 >logon home = \\%N\%U\profile</B
9371 ></P
9372 ><P
9373 >This tells Samba to return the above string, with
9374                 substitutions made when a client requests the info, generally
9375                 in a NetUserGetInfo request.  Win9X clients truncate the info to
9376                 \\server\share when a user does <B
9377 CLASS="COMMAND"
9378 >net use /home"</B
9379 >
9380                 but use the whole string when dealing with profiles.</P
9381 ><P
9382 >Note that in prior versions of Samba, the <A
9383 HREF="#LOGONPATH"
9384 >               <TT
9385 CLASS="PARAMETER"
9386 ><I
9387 >logon path</I
9388 ></TT
9389 ></A
9390 > was returned rather than
9391                 <TT
9392 CLASS="PARAMETER"
9393 ><I
9394 >logon home</I
9395 ></TT
9396 >.  This broke <B
9397 CLASS="COMMAND"
9398 >net use
9399                 /home</B
9400 > but allowed profiles outside the home directory.
9401                 The current implementation is correct, and can be used for
9402                 profiles if you use the above trick.</P
9403 ><P
9404 >This option is only useful if Samba is set up as a logon
9405                 server.</P
9406 ><P
9407 >Default: <B
9408 CLASS="COMMAND"
9409 >logon home = "\\%N\%U"</B
9410 ></P
9411 ><P
9412 >Example: <B
9413 CLASS="COMMAND"
9414 >logon home = "\\remote_smb_server\%U"</B
9415 >
9416                 </P
9417 ></DD
9418 ><DT
9419 ><A
9420 NAME="LOGONPATH"
9421 ></A
9422 >logon path (G)</DT
9423 ><DD
9424 ><P
9425 >This parameter specifies the home directory
9426                 where roaming profiles (NTuser.dat etc files for Windows NT) are
9427                 stored.  Contrary to previous versions of these manual pages, it has
9428                 nothing to do with Win 9X roaming profiles.  To find out how to
9429                 handle roaming profiles for Win 9X system, see the <A
9430 HREF="#LOGONHOME"
9431 >               <TT
9432 CLASS="PARAMETER"
9433 ><I
9434 >logon home</I
9435 ></TT
9436 ></A
9437 > parameter.</P
9438 ><P
9439 >This option takes the standard substitutions, allowing you
9440                 to have separate logon scripts for each user or machine.  It also
9441                 specifies the directory from which the "Application Data",
9442                 (<TT
9443 CLASS="FILENAME"
9444 >desktop</TT
9445 >, <TT
9446 CLASS="FILENAME"
9447 >start menu</TT
9448 >,
9449                 <TT
9450 CLASS="FILENAME"
9451 >network neighborhood</TT
9452 >, <TT
9453 CLASS="FILENAME"
9454 >programs</TT
9455 >
9456                 and other folders, and their contents, are loaded and displayed on
9457                 your Windows NT client.</P
9458 ><P
9459 >The share and the path must be readable by the user for
9460                 the preferences and directories to be loaded onto the Windows NT
9461                 client.  The share must be writeable when the logs in for the first
9462                 time, in order that the Windows NT client can create the NTuser.dat
9463                 and other directories.</P
9464 ><P
9465 >Thereafter, the directories and any of the contents can,
9466                 if required, be made read-only.  It is not advisable that the
9467                 NTuser.dat file be made read-only - rename it to NTuser.man to
9468                 achieve the desired effect (a <EM
9469 >MAN</EM
9470 >datory
9471                 profile). </P
9472 ><P
9473 >Windows clients can sometimes maintain a connection to
9474                 the [homes] share, even though there is no user logged in.
9475                 Therefore, it is vital that the logon path does not include a
9476                 reference to the homes share (i.e. setting this parameter to
9477                 \%N\%U\profile_path will cause problems).</P
9478 ><P
9479 >This option takes the standard substitutions, allowing
9480                 you to have separate logon scripts for each user or machine.</P
9481 ><P
9482 >Note that this option is only useful if Samba is set up
9483                 as a logon server.</P
9484 ><P
9485 >Default: <B
9486 CLASS="COMMAND"
9487 >logon path = \\%N\%U\profile</B
9488 ></P
9489 ><P
9490 >Example: <B
9491 CLASS="COMMAND"
9492 >logon path = \\PROFILESERVER\PROFILE\%U</B
9493 ></P
9494 ></DD
9495 ><DT
9496 ><A
9497 NAME="LOGONSCRIPT"
9498 ></A
9499 >logon script (G)</DT
9500 ><DD
9501 ><P
9502 >This parameter specifies the batch file (.bat) or
9503                 NT command file (.cmd) to be downloaded and run on a machine when
9504                 a user successfully logs in.  The file must contain the DOS
9505                 style cr/lf line endings. Using a DOS-style editor to create the
9506                 file is recommended.</P
9507 ><P
9508 >The script must be a relative path to the [netlogon]
9509                 service.  If the [netlogon] service specifies a <A
9510 HREF="#PATH"
9511 >               <TT
9512 CLASS="PARAMETER"
9513 ><I
9514 >path</I
9515 ></TT
9516 ></A
9517 > of <TT
9518 CLASS="FILENAME"
9519 >/usr/local/samba/netlogon
9520                 </TT
9521 >, and <B
9522 CLASS="COMMAND"
9523 >logon script = STARTUP.BAT</B
9524 >, then
9525                 the file that will be downloaded is:</P
9526 ><P
9527 ><TT
9528 CLASS="FILENAME"
9529 >/usr/local/samba/netlogon/STARTUP.BAT</TT
9530 ></P
9531 ><P
9532 >The contents of the batch file is entirely your choice.  A
9533                 suggested command would be to add <B
9534 CLASS="COMMAND"
9535 >NET TIME \\SERVER /SET
9536                 /YES</B
9537 >, to force every machine to synchronize clocks with
9538                 the same time server.  Another use would be to add <B
9539 CLASS="COMMAND"
9540 >NET USE
9541                 U: \\SERVER\UTILS</B
9542 > for commonly used utilities, or <B
9543 CLASS="COMMAND"
9544 >               NET USE Q: \\SERVER\ISO9001_QA</B
9545 > for example.</P
9546 ><P
9547 >Note that it is particularly important not to allow write
9548                 access to the [netlogon] share, or to grant users write permission
9549                 on the batch files in a secure environment, as this would allow
9550                 the batch files to be arbitrarily modified and security to be
9551                 breached.</P
9552 ><P
9553 >This option takes the standard substitutions, allowing you
9554                 to have separate logon scripts for each user or machine.</P
9555 ><P
9556 >This option is only useful if Samba is set up as a logon
9557                 server.</P
9558 ><P
9559 >Default: <EM
9560 >no logon script defined</EM
9561 ></P
9562 ><P
9563 >Example: <B
9564 CLASS="COMMAND"
9565 >logon script = scripts\%U.bat</B
9566 ></P
9567 ></DD
9568 ><DT
9569 ><A
9570 NAME="LPPAUSECOMMAND"
9571 ></A
9572 >lppause command (S)</DT
9573 ><DD
9574 ><P
9575 >This parameter specifies the command to be
9576                 executed on the server host in order to stop printing or spooling
9577                 a specific print job.</P
9578 ><P
9579 >This command should be a program or script which takes
9580                 a printer name and job number to pause the print job. One way
9581                 of implementing this is by using job priorities, where jobs
9582                 having a too low priority won't be sent to the printer.</P
9583 ><P
9584 >If a <TT
9585 CLASS="PARAMETER"
9586 ><I
9587 >%p</I
9588 ></TT
9589 > is given then the printername
9590                 is put in its place. A <TT
9591 CLASS="PARAMETER"
9592 ><I
9593 >%j</I
9594 ></TT
9595 > is replaced with
9596                 the job number (an integer).  On HPUX (see <TT
9597 CLASS="PARAMETER"
9598 ><I
9599 >printing=hpux
9600                 </I
9601 ></TT
9602 >), if the <TT
9603 CLASS="PARAMETER"
9604 ><I
9605 >-p%p</I
9606 ></TT
9607 > option is added
9608                 to the lpq command, the job will show up with the correct status, i.e.
9609                 if the job priority is lower than the set fence priority it will
9610                 have the PAUSED status, whereas if  the priority is equal or higher it
9611                 will have the SPOOLED or PRINTING status.</P
9612 ><P
9613 >Note that it is good practice to include the absolute path
9614                 in the lppause command as the PATH may not be available to the server.</P
9615 ><P
9616 >See also the <A
9617 HREF="#PRINTING"
9618 ><TT
9619 CLASS="PARAMETER"
9620 ><I
9621 >printing
9622                 </I
9623 ></TT
9624 ></A
9625 > parameter.</P
9626 ><P
9627 >Default: Currently no default value is given to
9628                 this string, unless the value of the <TT
9629 CLASS="PARAMETER"
9630 ><I
9631 >printing</I
9632 ></TT
9633 >
9634                 parameter is <TT
9635 CLASS="CONSTANT"
9636 >SYSV</TT
9637 >, in which case the default is :</P
9638 ><P
9639 ><B
9640 CLASS="COMMAND"
9641 >lp -i %p-%j -H hold</B
9642 ></P
9643 ><P
9644 >or if the value of the <TT
9645 CLASS="PARAMETER"
9646 ><I
9647 >printing</I
9648 ></TT
9649 > parameter
9650                 is <TT
9651 CLASS="CONSTANT"
9652 >SOFTQ</TT
9653 >, then the default is:</P
9654 ><P
9655 ><B
9656 CLASS="COMMAND"
9657 >qstat -s -j%j -h</B
9658 ></P
9659 ><P
9660 >Example for HPUX: <B
9661 CLASS="COMMAND"
9662 >lppause command = /usr/bin/lpalt
9663                 %p-%j -p0</B
9664 ></P
9665 ></DD
9666 ><DT
9667 ><A
9668 NAME="LPQCACHETIME"
9669 ></A
9670 >lpq cache time (G)</DT
9671 ><DD
9672 ><P
9673 >This controls how long lpq info will be cached
9674                 for to prevent the <B
9675 CLASS="COMMAND"
9676 >lpq</B
9677 > command being called too
9678                 often. A separate cache is kept for each variation of the <B
9679 CLASS="COMMAND"
9680 >               lpq</B
9681 > command used by the system, so if you use different
9682                 <B
9683 CLASS="COMMAND"
9684 >lpq</B
9685 > commands for different users then they won't
9686                 share cache information.</P
9687 ><P
9688 >The cache files are stored in <TT
9689 CLASS="FILENAME"
9690 >/tmp/lpq.xxxx</TT
9691 >
9692                 where xxxx is a hash of the <B
9693 CLASS="COMMAND"
9694 >lpq</B
9695 > command in use.</P
9696 ><P
9697 >The default is 10 seconds, meaning that the cached results
9698                 of a previous identical <B
9699 CLASS="COMMAND"
9700 >lpq</B
9701 > command will be used
9702                 if the cached data is less than 10 seconds old. A large value may
9703                 be advisable if your <B
9704 CLASS="COMMAND"
9705 >lpq</B
9706 > command is very slow.</P
9707 ><P
9708 >A value of 0 will disable caching completely.</P
9709 ><P
9710 >See also the <A
9711 HREF="#PRINTING"
9712 ><TT
9713 CLASS="PARAMETER"
9714 ><I
9715 >printing
9716                 </I
9717 ></TT
9718 ></A
9719 > parameter.</P
9720 ><P
9721 >Default: <B
9722 CLASS="COMMAND"
9723 >lpq cache time = 10</B
9724 ></P
9725 ><P
9726 >Example: <B
9727 CLASS="COMMAND"
9728 >lpq cache time = 30</B
9729 ></P
9730 ></DD
9731 ><DT
9732 ><A
9733 NAME="LPQCOMMAND"
9734 ></A
9735 >lpq command (S)</DT
9736 ><DD
9737 ><P
9738 >This parameter specifies the command to be
9739                 executed on the server host in order to obtain <B
9740 CLASS="COMMAND"
9741 >lpq
9742                 </B
9743 >-style printer status information.</P
9744 ><P
9745 >This command should be a program or script which
9746                 takes a printer name as its only parameter and outputs printer
9747                 status information.</P
9748 ><P
9749 >Currently eight styles of printer status information
9750                 are supported; BSD, AIX, LPRNG, PLP, SYSV, HPUX, QNX and SOFTQ.
9751                 This covers most UNIX systems. You control which type is expected
9752                 using the <TT
9753 CLASS="PARAMETER"
9754 ><I
9755 >printing =</I
9756 ></TT
9757 > option.</P
9758 ><P
9759 >Some clients (notably Windows for Workgroups) may not
9760                 correctly send the connection number for the printer they are
9761                 requesting status information about. To get around this, the
9762                 server reports on the first printer service connected to by the
9763                 client. This only happens if the connection number sent is invalid.</P
9764 ><P
9765 >If a <TT
9766 CLASS="PARAMETER"
9767 ><I
9768 >%p</I
9769 ></TT
9770 > is given then the printername
9771                 is put in its place. Otherwise it is placed at the end of the
9772                 command.</P
9773 ><P
9774 >Note that it is good practice to include the absolute path
9775                 in the <TT
9776 CLASS="PARAMETER"
9777 ><I
9778 >lpq command</I
9779 ></TT
9780 > as the <TT
9781 CLASS="ENVAR"
9782 >$PATH
9783                 </TT
9784 > may not be available to the server.</P
9785 ><P
9786 >See also the <A
9787 HREF="#PRINTING"
9788 ><TT
9789 CLASS="PARAMETER"
9790 ><I
9791 >printing
9792                 </I
9793 ></TT
9794 ></A
9795 > parameter.</P
9796 ><P
9797 >Default: <EM
9798 >depends on the setting of <TT
9799 CLASS="PARAMETER"
9800 ><I
9801 >               printing</I
9802 ></TT
9803 ></EM
9804 ></P
9805 ><P
9806 >Example: <B
9807 CLASS="COMMAND"
9808 >lpq command = /usr/bin/lpq -P%p</B
9809 ></P
9810 ></DD
9811 ><DT
9812 ><A
9813 NAME="LPRESUMECOMMAND"
9814 ></A
9815 >lpresume command (S)</DT
9816 ><DD
9817 ><P
9818 >This parameter specifies the command to be
9819                 executed on the server host in order to restart or continue
9820                 printing or spooling a specific print job.</P
9821 ><P
9822 >This command should be a program or script which takes
9823                 a printer name and job number to resume the print job. See
9824                 also the <A
9825 HREF="#LPPAUSECOMMAND"
9826 ><TT
9827 CLASS="PARAMETER"
9828 ><I
9829 >lppause command
9830                 </I
9831 ></TT
9832 ></A
9833 > parameter.</P
9834 ><P
9835 >If a <TT
9836 CLASS="PARAMETER"
9837 ><I
9838 >%p</I
9839 ></TT
9840 > is given then the printername
9841                 is put in its place. A <TT
9842 CLASS="PARAMETER"
9843 ><I
9844 >%j</I
9845 ></TT
9846 > is replaced with
9847                 the job number (an integer).</P
9848 ><P
9849 >Note that it is good practice to include the absolute path
9850                 in the <TT
9851 CLASS="PARAMETER"
9852 ><I
9853 >lpresume command</I
9854 ></TT
9855 > as the PATH may not
9856                 be available to the server.</P
9857 ><P
9858 >See also the <A
9859 HREF="#PRINTING"
9860 ><TT
9861 CLASS="PARAMETER"
9862 ><I
9863 >printing
9864                 </I
9865 ></TT
9866 ></A
9867 > parameter.</P
9868 ><P
9869 >Default: Currently no default value is given
9870                 to this string, unless the value of the <TT
9871 CLASS="PARAMETER"
9872 ><I
9873 >printing</I
9874 ></TT
9875 >
9876                 parameter is <TT
9877 CLASS="CONSTANT"
9878 >SYSV</TT
9879 >, in which case the default is :</P
9880 ><P
9881 ><B
9882 CLASS="COMMAND"
9883 >lp -i %p-%j -H resume</B
9884 ></P
9885 ><P
9886 >or if the value of the <TT
9887 CLASS="PARAMETER"
9888 ><I
9889 >printing</I
9890 ></TT
9891 > parameter
9892                 is <TT
9893 CLASS="CONSTANT"
9894 >SOFTQ</TT
9895 >, then the default is:</P
9896 ><P
9897 ><B
9898 CLASS="COMMAND"
9899 >qstat -s -j%j -r</B
9900 ></P
9901 ><P
9902 >Example for HPUX: <B
9903 CLASS="COMMAND"
9904 >lpresume command = /usr/bin/lpalt
9905                 %p-%j -p2</B
9906 ></P
9907 ></DD
9908 ><DT
9909 ><A
9910 NAME="LPRMCOMMAND"
9911 ></A
9912 >lprm command (S)</DT
9913 ><DD
9914 ><P
9915 >This parameter specifies the command to be
9916                 executed on the server host in order to delete a print job.</P
9917 ><P
9918 >This command should be a program or script which takes
9919                 a printer name and job number, and deletes the print job.</P
9920 ><P
9921 >If a <TT
9922 CLASS="PARAMETER"
9923 ><I
9924 >%p</I
9925 ></TT
9926 > is given then the printername
9927                 is put in its place. A <TT
9928 CLASS="PARAMETER"
9929 ><I
9930 >%j</I
9931 ></TT
9932 > is replaced with
9933                 the job number (an integer).</P
9934 ><P
9935 >Note that it is good practice to include the absolute
9936                 path in the <TT
9937 CLASS="PARAMETER"
9938 ><I
9939 >lprm command</I
9940 ></TT
9941 > as the PATH may not be
9942                 available to the server.</P
9943 ><P
9944 >See also the <A
9945 HREF="#PRINTING"
9946 ><TT
9947 CLASS="PARAMETER"
9948 ><I
9949 >printing
9950                 </I
9951 ></TT
9952 ></A
9953 > parameter.</P
9954 ><P
9955 >Default: <EM
9956 >depends on the setting of <TT
9957 CLASS="PARAMETER"
9958 ><I
9959 >printing
9960                 </I
9961 ></TT
9962 ></EM
9963 ></P
9964 ><P
9965 >Example 1: <B
9966 CLASS="COMMAND"
9967 >lprm command = /usr/bin/lprm -P%p %j
9968                 </B
9969 ></P
9970 ><P
9971 >Example 2: <B
9972 CLASS="COMMAND"
9973 >lprm command = /usr/bin/cancel %p-%j
9974                 </B
9975 ></P
9976 ></DD
9977 ><DT
9978 ><A
9979 NAME="MACHINEPASSWORDTIMEOUT"
9980 ></A
9981 >machine password timeout (G)</DT
9982 ><DD
9983 ><P
9984 >If a Samba server is a member of an Windows
9985                 NT Domain (see the <A
9986 HREF="#SECURITYEQUALSDOMAIN"
9987 >security=domain</A
9988 >)
9989                 parameter) then periodically a running <A
9990 HREF="smbd.8.html"
9991 TARGET="_top"
9992 >               smbd(8)</A
9993 > process will try and change the MACHINE ACCOUNT
9994                 PASSWORD stored in the TDB called <TT
9995 CLASS="FILENAME"
9996 >private/secrets.tdb
9997                 </TT
9998 >.  This parameter specifies how often this password
9999                 will be changed, in seconds. The default is one week (expressed in
10000                 seconds), the same as a Windows NT Domain member server.</P
10001 ><P
10002 >See also <A
10003 HREF="smbpasswd.8.html"
10004 TARGET="_top"
10005 ><B
10006 CLASS="COMMAND"
10007 >smbpasswd(8)
10008                 </B
10009 ></A
10010 >, and the <A
10011 HREF="#SECURITYEQUALSDOMAIN"
10012 >               security=domain</A
10013 >) parameter.</P
10014 ><P
10015 >Default: <B
10016 CLASS="COMMAND"
10017 >machine password timeout = 604800</B
10018 ></P
10019 ></DD
10020 ><DT
10021 ><A
10022 NAME="MAGICOUTPUT"
10023 ></A
10024 >magic output (S)</DT
10025 ><DD
10026 ><P
10027 >This parameter specifies the name of a file
10028                 which will contain output created by a magic script (see the
10029                 <A
10030 HREF="#MAGICSCRIPT"
10031 ><TT
10032 CLASS="PARAMETER"
10033 ><I
10034 >magic script</I
10035 ></TT
10036 ></A
10037 >
10038                 parameter below).</P
10039 ><P
10040 >Warning: If two clients use the same <TT
10041 CLASS="PARAMETER"
10042 ><I
10043 >magic script
10044                 </I
10045 ></TT
10046 > in the same directory the output file content
10047                 is undefined.</P
10048 ><P
10049 >Default: <B
10050 CLASS="COMMAND"
10051 >magic output = &#60;magic script name&#62;.out
10052                 </B
10053 ></P
10054 ><P
10055 >Example: <B
10056 CLASS="COMMAND"
10057 >magic output = myfile.txt</B
10058 ></P
10059 ></DD
10060 ><DT
10061 ><A
10062 NAME="MAGICSCRIPT"
10063 ></A
10064 >magic script (S)</DT
10065 ><DD
10066 ><P
10067 >This parameter specifies the name of a file which,
10068                 if opened, will be executed by the server when the file is closed.
10069                 This allows a UNIX script to be sent to the Samba host and
10070                 executed on behalf of the connected user.</P
10071 ><P
10072 >Scripts executed in this way will be deleted upon
10073                 completion assuming that the user has the appripriate level
10074                 of priviledge and the ile permissions allow the deletion.</P
10075 ><P
10076 >If the script generates output, output will be sent to
10077                 the file specified by the <A
10078 HREF="#MAGICOUTPUT"
10079 ><TT
10080 CLASS="PARAMETER"
10081 ><I
10082 >               magic output</I
10083 ></TT
10084 ></A
10085 > parameter (see above).</P
10086 ><P
10087 >Note that some shells are unable to interpret scripts
10088                 containing CR/LF instead of CR as
10089                 the end-of-line marker. Magic scripts must be executable
10090                 <EM
10091 >as is</EM
10092 > on the host, which for some hosts and
10093                 some shells will require filtering at the DOS end.</P
10094 ><P
10095 >Magic scripts are <EM
10096 >EXPERIMENTAL</EM
10097 > and
10098                 should <EM
10099 >NOT</EM
10100 > be relied upon.</P
10101 ><P
10102 >Default: <EM
10103 >None. Magic scripts disabled.</EM
10104 ></P
10105 ><P
10106 >Example: <B
10107 CLASS="COMMAND"
10108 >magic script = user.csh</B
10109 ></P
10110 ></DD
10111 ><DT
10112 ><A
10113 NAME="MANGLECASE"
10114 ></A
10115 >mangle case (S)</DT
10116 ><DD
10117 ><P
10118 >See the section on <A
10119 HREF="#AEN201"
10120 >               NAME MANGLING</A
10121 ></P
10122 ><P
10123 >Default: <B
10124 CLASS="COMMAND"
10125 >mangle case = no</B
10126 ></P
10127 ></DD
10128 ><DT
10129 ><A
10130 NAME="MANGLEDMAP"
10131 ></A
10132 >mangled map (S)</DT
10133 ><DD
10134 ><P
10135 >This is for those who want to directly map UNIX
10136                 file names which can not be represented on Windows/DOS.  The mangling
10137                 of names is not always what is needed.  In particular you may have
10138                 documents with file extensions that differ between DOS and UNIX.
10139                 For example, under UNIX it is common to use <TT
10140 CLASS="FILENAME"
10141 >.html</TT
10142 >
10143                 for HTML files, whereas under Windows/DOS <TT
10144 CLASS="FILENAME"
10145 >.htm</TT
10146 >
10147                 is more commonly used.</P
10148 ><P
10149 >So to map <TT
10150 CLASS="FILENAME"
10151 >html</TT
10152 > to <TT
10153 CLASS="FILENAME"
10154 >htm</TT
10155 >
10156                 you would use:</P
10157 ><P
10158 ><B
10159 CLASS="COMMAND"
10160 >mangled map = (*.html *.htm)</B
10161 ></P
10162 ><P
10163 >One very useful case is to remove the annoying <TT
10164 CLASS="FILENAME"
10165 >;1
10166                 </TT
10167 > off the ends of filenames on some CDROMS (only visible
10168                 under some UNIXes). To do this use a map of (*;1 *;).</P
10169 ><P
10170 >Default: <EM
10171 >no mangled map</EM
10172 ></P
10173 ><P
10174 >Example: <B
10175 CLASS="COMMAND"
10176 >mangled map = (*;1 *;)</B
10177 ></P
10178 ></DD
10179 ><DT
10180 ><A
10181 NAME="MANGLEDNAMES"
10182 ></A
10183 >mangled names (S)</DT
10184 ><DD
10185 ><P
10186 >This controls whether non-DOS names under UNIX
10187                 should be mapped to DOS-compatible names ("mangled") and made visible,
10188                 or whether non-DOS names should simply be ignored.</P
10189 ><P
10190 >See the section on <A
10191 HREF="#AEN201"
10192 >               NAME MANGLING</A
10193 > for details on how to control the mangling process.</P
10194 ><P
10195 >If mangling is used then the mangling algorithm is as follows:</P
10196 ><P
10197 ></P
10198 ><UL
10199 ><LI
10200 ><P
10201 >The first (up to) five alphanumeric characters
10202                         before the rightmost dot of the filename are preserved, forced
10203                         to upper case, and appear as the first (up to) five characters
10204                         of the mangled name.</P
10205 ></LI
10206 ><LI
10207 ><P
10208 >A tilde "~" is appended to the first part of the mangled
10209                         name, followed by a two-character unique sequence, based on the
10210                         original root name (i.e., the original filename minus its final
10211                         extension). The final extension is included in the hash calculation
10212                         only if it contains any upper case characters or is longer than three
10213                         characters.</P
10214 ><P
10215 >Note that the character to use may be specified using
10216                         the <A
10217 HREF="#MANGLINGCHAR"
10218 ><TT
10219 CLASS="PARAMETER"
10220 ><I
10221 >mangling char</I
10222 ></TT
10223 >
10224                         </A
10225 > option, if you don't like '~'.</P
10226 ></LI
10227 ><LI
10228 ><P
10229 >The first three alphanumeric characters of the final
10230                         extension are preserved, forced to upper case and appear as the
10231                         extension of the mangled name. The final extension is defined as that
10232                         part of the original filename after the rightmost dot. If there are no
10233                         dots in the filename, the mangled name will have no extension (except
10234                         in the case of "hidden files" - see below).</P
10235 ></LI
10236 ><LI
10237 ><P
10238 >Files whose UNIX name begins with a dot will be
10239                         presented as DOS hidden files. The mangled name will be created as
10240                         for other filenames, but with the leading dot removed and "___" as
10241                         its extension regardless of actual original extension (that's three
10242                         underscores).</P
10243 ></LI
10244 ></UL
10245 ><P
10246 >The two-digit hash value consists of upper case
10247                 alphanumeric characters.</P
10248 ><P
10249 >This algorithm can cause name collisions only if files
10250                 in a directory share the same first five alphanumeric characters.
10251                 The probability of such a clash is 1/1300.</P
10252 ><P
10253 >The name mangling (if enabled) allows a file to be
10254                 copied between UNIX directories from Windows/DOS while retaining
10255                 the long UNIX filename. UNIX files can be renamed to a new extension
10256                 from Windows/DOS and will retain the same basename. Mangled names
10257                 do not change between sessions.</P
10258 ><P
10259 >Default: <B
10260 CLASS="COMMAND"
10261 >mangled names = yes</B
10262 ></P
10263 ></DD
10264 ><DT
10265 ><A
10266 NAME="MANGLEDSTACK"
10267 ></A
10268 >mangled stack (G)</DT
10269 ><DD
10270 ><P
10271 >This parameter controls the number of mangled names
10272                 that should be cached in the Samba server <A
10273 HREF="smbd.8.html"
10274 TARGET="_top"
10275 >               smbd(8)</A
10276 >.</P
10277 ><P
10278 >This stack is a list of recently mangled base names
10279                 (extensions are only maintained if they are longer than 3 characters
10280                 or contains upper case characters).</P
10281 ><P
10282 >The larger this value, the more likely it is that mangled
10283                 names can be successfully converted to correct long UNIX names.
10284                 However, large stack sizes will slow most directory access. Smaller
10285                 stacks save memory in the server (each stack element costs 256 bytes).
10286                 </P
10287 ><P
10288 >It is not possible to absolutely guarantee correct long
10289                 file names, so be prepared for some surprises!</P
10290 ><P
10291 >Default: <B
10292 CLASS="COMMAND"
10293 >mangled stack = 50</B
10294 ></P
10295 ><P
10296 >Example: <B
10297 CLASS="COMMAND"
10298 >mangled stack = 100</B
10299 ></P
10300 ></DD
10301 ><DT
10302 ><A
10303 NAME="MANGLINGCHAR"
10304 ></A
10305 >mangling char (S)</DT
10306 ><DD
10307 ><P
10308 >This controls what character is used as
10309                 the <EM
10310 >magic</EM
10311 > character in <A
10312 HREF="#AEN201"
10313 >name mangling</A
10314 >. The default is a '~'
10315                 but this may interfere with some software. Use this option to set
10316                 it to whatever you prefer.</P
10317 ><P
10318 >Default: <B
10319 CLASS="COMMAND"
10320 >mangling char = ~</B
10321 ></P
10322 ><P
10323 >Example: <B
10324 CLASS="COMMAND"
10325 >mangling char = ^</B
10326 ></P
10327 ></DD
10328 ><DT
10329 ><A
10330 NAME="MAPARCHIVE"
10331 ></A
10332 >map archive (S)</DT
10333 ><DD
10334 ><P
10335 >This controls whether the DOS archive attribute
10336                 should be mapped to the UNIX owner execute bit.  The DOS archive bit
10337                 is set when a file has been modified since its last backup.  One
10338                 motivation for this option it to keep Samba/your PC from making
10339                 any file it touches from becoming executable under UNIX.  This can
10340                 be quite annoying for shared source code, documents, etc...</P
10341 ><P
10342 >Note that this requires the <TT
10343 CLASS="PARAMETER"
10344 ><I
10345 >create mask</I
10346 ></TT
10347 >
10348                 parameter to be set such that owner execute bit is not masked out
10349                 (i.e. it must include 100). See the parameter <A
10350 HREF="#CREATEMASK"
10351 >               <TT
10352 CLASS="PARAMETER"
10353 ><I
10354 >create mask</I
10355 ></TT
10356 ></A
10357 > for details.</P
10358 ><P
10359 >Default: <B
10360 CLASS="COMMAND"
10361 >map archive = yes</B
10362 ></P
10363 ></DD
10364 ><DT
10365 ><A
10366 NAME="MAPHIDDEN"
10367 ></A
10368 >map hidden (S)</DT
10369 ><DD
10370 ><P
10371 >This controls whether DOS style hidden files
10372                 should be mapped to the UNIX world execute bit.</P
10373 ><P
10374 >Note that this requires the <TT
10375 CLASS="PARAMETER"
10376 ><I
10377 >create mask</I
10378 ></TT
10379 >
10380                 to be set such that the world execute bit is not masked out (i.e.
10381                 it must include 001). See the parameter <A
10382 HREF="#CREATEMASK"
10383 >               <TT
10384 CLASS="PARAMETER"
10385 ><I
10386 >create mask</I
10387 ></TT
10388 ></A
10389 > for details.</P
10390 ><P
10391 >Default: <B
10392 CLASS="COMMAND"
10393 >map hidden = no</B
10394 ></P
10395 ></DD
10396 ><DT
10397 ><A
10398 NAME="MAPSYSTEM"
10399 ></A
10400 >map system (S)</DT
10401 ><DD
10402 ><P
10403 >This controls whether DOS style system files
10404                 should be mapped to the UNIX group execute bit.</P
10405 ><P
10406 >Note that this requires the <TT
10407 CLASS="PARAMETER"
10408 ><I
10409 >create mask</I
10410 ></TT
10411 >
10412                 to be set such that the group execute bit is not masked out (i.e.
10413                 it must include 010). See the parameter <A
10414 HREF="#CREATEMASK"
10415 >               <TT
10416 CLASS="PARAMETER"
10417 ><I
10418 >create mask</I
10419 ></TT
10420 ></A
10421 > for details.</P
10422 ><P
10423 >Default: <B
10424 CLASS="COMMAND"
10425 >map system = no</B
10426 ></P
10427 ></DD
10428 ><DT
10429 ><A
10430 NAME="MAPTOGUEST"
10431 ></A
10432 >map to guest (G)</DT
10433 ><DD
10434 ><P
10435 >This parameter is only useful in <A
10436 HREF="#SECURITY"
10437 >               security</A
10438 > modes other than <TT
10439 CLASS="PARAMETER"
10440 ><I
10441 >security=share</I
10442 ></TT
10443 >
10444                 - i.e. <TT
10445 CLASS="CONSTANT"
10446 >user</TT
10447 >, <TT
10448 CLASS="CONSTANT"
10449 >server</TT
10450 >,
10451                 and <TT
10452 CLASS="CONSTANT"
10453 >domain</TT
10454 >.</P
10455 ><P
10456 >This parameter can take three different values, which tell
10457                 <A
10458 HREF="smbd.8.html"
10459 TARGET="_top"
10460 >smbd(8)</A
10461 > what to do with user
10462                 login requests that don't match a valid UNIX user in some way.</P
10463 ><P
10464 >The three settings are :</P
10465 ><P
10466 ></P
10467 ><UL
10468 ><LI
10469 ><P
10470 ><TT
10471 CLASS="CONSTANT"
10472 >Never</TT
10473 > - Means user login
10474                         requests with an invalid password are rejected. This is the
10475                         default.</P
10476 ></LI
10477 ><LI
10478 ><P
10479 ><TT
10480 CLASS="CONSTANT"
10481 >Bad User</TT
10482 > - Means user
10483                         logins with an invalid password are rejected, unless the username
10484                         does not exist, in which case it is treated as a guest login and
10485                         mapped into the <A
10486 HREF="#GUESTACCOUNT"
10487 ><TT
10488 CLASS="PARAMETER"
10489 ><I
10490 >                       guest account</I
10491 ></TT
10492 ></A
10493 >.</P
10494 ></LI
10495 ><LI
10496 ><P
10497 ><TT
10498 CLASS="CONSTANT"
10499 >Bad Password</TT
10500 > - Means user logins
10501                         with an invalid password are treated as a guest login and mapped
10502                         into the <A
10503 HREF="#GUESTACCOUNT"
10504 >guest account</A
10505 >. Note that
10506                         this can cause problems as it means that any user incorrectly typing
10507                         their password will be silently logged on as "guest" - and
10508                         will not know the reason they cannot access files they think
10509                         they should - there will have been no message given to them
10510                         that they got their password wrong. Helpdesk services will
10511                         <EM
10512 >hate</EM
10513 > you if you set the <TT
10514 CLASS="PARAMETER"
10515 ><I
10516 >map to
10517                         guest</I
10518 ></TT
10519 > parameter this way :-).</P
10520 ></LI
10521 ></UL
10522 ><P
10523 >Note that this parameter is needed to set up "Guest"
10524                 share services when using <TT
10525 CLASS="PARAMETER"
10526 ><I
10527 >security</I
10528 ></TT
10529 > modes other than
10530                 share. This is because in these modes the name of the resource being
10531                 requested is <EM
10532 >not</EM
10533 > sent to the server until after
10534                 the server has successfully authenticated the client so the server
10535                 cannot make authentication decisions at the correct time (connection
10536                 to the share) for "Guest" shares.</P
10537 ><P
10538 >For people familiar with the older Samba releases, this
10539                 parameter maps to the old compile-time setting of the <TT
10540 CLASS="CONSTANT"
10541 >               GUEST_SESSSETUP</TT
10542 > value in local.h.</P
10543 ><P
10544 >Default: <B
10545 CLASS="COMMAND"
10546 >map to guest = Never</B
10547 ></P
10548 ><P
10549 >Example: <B
10550 CLASS="COMMAND"
10551 >map to guest = Bad User</B
10552 ></P
10553 ></DD
10554 ><DT
10555 ><A
10556 NAME="MAXCONNECTIONS"
10557 ></A
10558 >max connections (S)</DT
10559 ><DD
10560 ><P
10561 >This option allows the number of simultaneous
10562                 connections to a service to be limited. If <TT
10563 CLASS="PARAMETER"
10564 ><I
10565 >max connections
10566                 </I
10567 ></TT
10568 > is greater than 0 then connections will be refused if
10569                 this number of connections to the service are already open. A value
10570                 of zero mean an unlimited number of connections may be made.</P
10571 ><P
10572 >Record lock files are used to implement this feature. The
10573                 lock files will be stored in the directory specified by the <A
10574 HREF="#LOCKDIRECTORY"
10575 ><TT
10576 CLASS="PARAMETER"
10577 ><I
10578 >lock directory</I
10579 ></TT
10580 ></A
10581 >
10582                 option.</P
10583 ><P
10584 >Default: <B
10585 CLASS="COMMAND"
10586 >max connections = 0</B
10587 ></P
10588 ><P
10589 >Example: <B
10590 CLASS="COMMAND"
10591 >max connections = 10</B
10592 ></P
10593 ></DD
10594 ><DT
10595 ><A
10596 NAME="MAXDISKSIZE"
10597 ></A
10598 >max disk size (G)</DT
10599 ><DD
10600 ><P
10601 >This option allows you to put an upper limit
10602                 on the apparent size of disks. If you set this option to 100
10603                 then all shares will appear to be not larger than 100 MB in
10604                 size.</P
10605 ><P
10606 >Note that this option does not limit the amount of
10607                 data you can put on the disk. In the above case you could still
10608                 store much more than 100 MB on the disk, but if a client ever asks
10609                 for the amount of free disk space or the total disk size then the
10610                 result will be bounded by the amount specified in <TT
10611 CLASS="PARAMETER"
10612 ><I
10613 >max
10614                 disk size</I
10615 ></TT
10616 >.</P
10617 ><P
10618 >This option is primarily useful to work around bugs
10619                 in some pieces of software that can't handle very large disks,
10620                 particularly disks over 1GB in size.</P
10621 ><P
10622 >A <TT
10623 CLASS="PARAMETER"
10624 ><I
10625 >max disk size</I
10626 ></TT
10627 > of 0 means no limit.</P
10628 ><P
10629 >Default: <B
10630 CLASS="COMMAND"
10631 >max disk size = 0</B
10632 ></P
10633 ><P
10634 >Example: <B
10635 CLASS="COMMAND"
10636 >max disk size = 1000</B
10637 ></P
10638 ></DD
10639 ><DT
10640 ><A
10641 NAME="MAXLOGSIZE"
10642 ></A
10643 >max log size (G)</DT
10644 ><DD
10645 ><P
10646 >This option (an integer in kilobytes) specifies
10647                 the max size the log file should grow to. Samba periodically checks
10648                 the size and if it is exceeded it will rename the file, adding
10649                 a <TT
10650 CLASS="FILENAME"
10651 >.old</TT
10652 > extension.</P
10653 ><P
10654 >A size of 0 means no limit.</P
10655 ><P
10656 >Default: <B
10657 CLASS="COMMAND"
10658 >max log size = 5000</B
10659 ></P
10660 ><P
10661 >Example: <B
10662 CLASS="COMMAND"
10663 >max log size = 1000</B
10664 ></P
10665 ></DD
10666 ><DT
10667 ><A
10668 NAME="MAXMUX"
10669 ></A
10670 >max mux (G)</DT
10671 ><DD
10672 ><P
10673 >This option controls the maximum number of
10674                 outstanding simultaneous SMB operations that samba tells the client
10675                 it will allow. You should never need to set this parameter.</P
10676 ><P
10677 >Default: <B
10678 CLASS="COMMAND"
10679 >max mux = 50</B
10680 ></P
10681 ></DD
10682 ><DT
10683 ><A
10684 NAME="MAXOPENFILES"
10685 ></A
10686 >max open files (G)</DT
10687 ><DD
10688 ><P
10689 >This parameter limits the maximum number of
10690                 open files that one <A
10691 HREF="smbd.8.html"
10692 TARGET="_top"
10693 >smbd(8)</A
10694 > file
10695                 serving process may have open for a client at any one time. The
10696                 default for this parameter is set very high (10,000) as Samba uses
10697                 only one bit per unopened file.</P
10698 ><P
10699 >The limit of the number of open files is usually set
10700                 by the UNIX per-process file descriptor limit rather than
10701                 this parameter so you should never need to touch this parameter.</P
10702 ><P
10703 >Default: <B
10704 CLASS="COMMAND"
10705 >max open files = 10000</B
10706 ></P
10707 ></DD
10708 ><DT
10709 ><A
10710 NAME="MAXPRINTJOBS"
10711 ></A
10712 >max print jobs (S)</DT
10713 ><DD
10714 ><P
10715 >This parameter limits the maximum number of
10716                 jobs allowable in a Samba printer queue at any given moment.
10717                 If this number is exceeded, <A
10718 HREF="smbd.8.html"
10719 TARGET="_top"
10720 ><B
10721 CLASS="COMMAND"
10722 >               smbd(8)</B
10723 ></A
10724 > will remote "Out of Space" to the client.
10725                 See all <A
10726 HREF="#TOTALPRINTJOBS"
10727 ><TT
10728 CLASS="PARAMETER"
10729 ><I
10730 >total
10731                 print jobs</I
10732 ></TT
10733 ></A
10734 >.
10735                 </P
10736 ><P
10737 >Default: <B
10738 CLASS="COMMAND"
10739 >max print jobs = 1000</B
10740 ></P
10741 ><P
10742 >Example: <B
10743 CLASS="COMMAND"
10744 >max print jobs = 5000</B
10745 ></P
10746 ></DD
10747 ><DT
10748 ><A
10749 NAME="MAXPROTOCOL"
10750 ></A
10751 >max protocol (G)</DT
10752 ><DD
10753 ><P
10754 >The value of the parameter (a string) is the highest
10755                 protocol level that will be supported by the server.</P
10756 ><P
10757 >Possible values are :</P
10758 ><P
10759 ></P
10760 ><UL
10761 ><LI
10762 ><P
10763 ><TT
10764 CLASS="CONSTANT"
10765 >CORE</TT
10766 >: Earliest version. No
10767                         concept of user names.</P
10768 ></LI
10769 ><LI
10770 ><P
10771 ><TT
10772 CLASS="CONSTANT"
10773 >COREPLUS</TT
10774 >: Slight improvements on
10775                         CORE for efficiency.</P
10776 ></LI
10777 ><LI
10778 ><P
10779 ><TT
10780 CLASS="CONSTANT"
10781 >LANMAN1</TT
10782 >: First <EM
10783 >                       modern</EM
10784 > version of the protocol. Long filename
10785                         support.</P
10786 ></LI
10787 ><LI
10788 ><P
10789 ><TT
10790 CLASS="CONSTANT"
10791 >LANMAN2</TT
10792 >: Updates to Lanman1 protocol.
10793                         </P
10794 ></LI
10795 ><LI
10796 ><P
10797 ><TT
10798 CLASS="CONSTANT"
10799 >NT1</TT
10800 >: Current up to date version of
10801                         the protocol. Used by Windows NT. Known as CIFS.</P
10802 ></LI
10803 ></UL
10804 ><P
10805 >Normally this option should not be set as the automatic
10806                 negotiation phase in the SMB protocol takes care of choosing
10807                 the appropriate protocol.</P
10808 ><P
10809 >See also <A
10810 HREF="#MINPROTOCOL"
10811 ><TT
10812 CLASS="PARAMETER"
10813 ><I
10814 >min
10815                 protocol</I
10816 ></TT
10817 ></A
10818 ></P
10819 ><P
10820 >Default: <B
10821 CLASS="COMMAND"
10822 >max protocol = NT1</B
10823 ></P
10824 ><P
10825 >Example: <B
10826 CLASS="COMMAND"
10827 >max protocol = LANMAN1</B
10828 ></P
10829 ></DD
10830 ><DT
10831 ><A
10832 NAME="MAXSMBDPROCESSES"
10833 ></A
10834 >max smbd processes (G)</DT
10835 ><DD
10836 ><P
10837 >This parameter limits the maximum number of
10838                 <A
10839 HREF="smbd.8.html"
10840 TARGET="_top"
10841 ><B
10842 CLASS="COMMAND"
10843 >smbd(8)</B
10844 ></A
10845 >
10846                 processes concurrently running on a system and is intended
10847                 as a stop gap to prevent degrading service to clients in the event
10848                 that the server has insufficient resources to handle more than this
10849                 number of connections.  Remember that under normal operating
10850                 conditions, each user will have an smbd associated with him or her
10851                 to handle connections to all shares from a given host.
10852                 </P
10853 ><P
10854 >Default: <B
10855 CLASS="COMMAND"
10856 >max smbd processes = 0</B
10857 >   ## no limit</P
10858 ><P
10859 >Example: <B
10860 CLASS="COMMAND"
10861 >max smbd processes = 1000</B
10862 ></P
10863 ></DD
10864 ><DT
10865 ><A
10866 NAME="MAXTTL"
10867 ></A
10868 >max ttl (G)</DT
10869 ><DD
10870 ><P
10871 >This option tells <A
10872 HREF="nmbd.8.html"
10873 TARGET="_top"
10874 >nmbd(8)</A
10875 >
10876                 what the default 'time to live' of NetBIOS names should be (in seconds)
10877                 when <B
10878 CLASS="COMMAND"
10879 >nmbd</B
10880 > is requesting a name using either a
10881                 broadcast packet or from a WINS server. You should never need to
10882                 change this parameter. The default is 3 days.</P
10883 ><P
10884 >Default: <B
10885 CLASS="COMMAND"
10886 >max ttl = 259200</B
10887 ></P
10888 ></DD
10889 ><DT
10890 ><A
10891 NAME="MAXWINSTTL"
10892 ></A
10893 >max wins ttl (G)</DT
10894 ><DD
10895 ><P
10896 >This option tells <A
10897 HREF="nmbd.8.html"
10898 TARGET="_top"
10899 >nmbd(8)
10900                 </A
10901 > when acting as a WINS server (<A
10902 HREF="#WINSSUPPORT"
10903 >               <TT
10904 CLASS="PARAMETER"
10905 ><I
10906 >wins support=yes</I
10907 ></TT
10908 ></A
10909 >) what the maximum
10910                 'time to live' of NetBIOS names that <B
10911 CLASS="COMMAND"
10912 >nmbd</B
10913 >
10914                 will grant will be (in seconds). You should never need to change this
10915                 parameter.  The default is 6 days (518400 seconds).</P
10916 ><P
10917 >See also the <A
10918 HREF="#MINWINSTTL"
10919 ><TT
10920 CLASS="PARAMETER"
10921 ><I
10922 >min
10923                 wins ttl"</I
10924 ></TT
10925 ></A
10926 > parameter.</P
10927 ><P
10928 >Default: <B
10929 CLASS="COMMAND"
10930 >max wins ttl = 518400</B
10931 ></P
10932 ></DD
10933 ><DT
10934 ><A
10935 NAME="MAXXMIT"
10936 ></A
10937 >max xmit (G)</DT
10938 ><DD
10939 ><P
10940 >This option controls the maximum packet size
10941                 that will be negotiated by Samba. The default is 65535, which
10942                 is the maximum. In some cases you may find you get better performance
10943                 with a smaller value. A value below 2048 is likely to cause problems.
10944                 </P
10945 ><P
10946 >Default: <B
10947 CLASS="COMMAND"
10948 >max xmit = 65535</B
10949 ></P
10950 ><P
10951 >Example: <B
10952 CLASS="COMMAND"
10953 >max xmit = 8192</B
10954 ></P
10955 ></DD
10956 ><DT
10957 ><A
10958 NAME="MESSAGECOMMAND"
10959 ></A
10960 >message command (G)</DT
10961 ><DD
10962 ><P
10963 >This specifies what command to run when the
10964                 server receives a WinPopup style message.</P
10965 ><P
10966 >This would normally be a command that would
10967                 deliver the message somehow. How this is to be done is
10968                 up to your imagination.</P
10969 ><P
10970 >An example is:</P
10971 ><P
10972 ><B
10973 CLASS="COMMAND"
10974 >message command = csh -c 'xedit %s;rm %s' &#38;</B
10975 >
10976                 </P
10977 ><P
10978 >This delivers the message using <B
10979 CLASS="COMMAND"
10980 >xedit</B
10981 >, then
10982                 removes it afterwards. <EM
10983 >NOTE THAT IT IS VERY IMPORTANT
10984                 THAT THIS COMMAND RETURN IMMEDIATELY</EM
10985 >. That's why I
10986                 have the '&#38;' on the end. If it doesn't return immediately then
10987                 your PCs may freeze when sending messages (they should recover
10988                 after 30secs, hopefully).</P
10989 ><P
10990 >All messages are delivered as the global guest user.
10991                 The command takes the standard substitutions, although <TT
10992 CLASS="PARAMETER"
10993 ><I
10994 >               %u</I
10995 ></TT
10996 > won't work (<TT
10997 CLASS="PARAMETER"
10998 ><I
10999 >%U</I
11000 ></TT
11001 > may be better
11002                 in this case).</P
11003 ><P
11004 >Apart from the standard substitutions, some additional
11005                 ones apply. In particular:</P
11006 ><P
11007 ></P
11008 ><UL
11009 ><LI
11010 ><P
11011 ><TT
11012 CLASS="PARAMETER"
11013 ><I
11014 >%s</I
11015 ></TT
11016 > = the filename containing
11017                         the message.</P
11018 ></LI
11019 ><LI
11020 ><P
11021 ><TT
11022 CLASS="PARAMETER"
11023 ><I
11024 >%t</I
11025 ></TT
11026 > = the destination that
11027                         the message was sent to (probably the server name).</P
11028 ></LI
11029 ><LI
11030 ><P
11031 ><TT
11032 CLASS="PARAMETER"
11033 ><I
11034 >%f</I
11035 ></TT
11036 > = who the message
11037                         is from.</P
11038 ></LI
11039 ></UL
11040 ><P
11041 >You could make this command send mail, or whatever else
11042                 takes your fancy. Please let us know of any really interesting
11043                 ideas you have.</P
11044 ><P
11045 >Here's a way of sending the messages as mail to root:</P
11046 ><P
11047 ><B
11048 CLASS="COMMAND"
11049 >message command = /bin/mail -s 'message from %f on
11050                 %m' root &#60; %s; rm %s</B
11051 ></P
11052 ><P
11053 >If you don't have a message command then the message
11054                 won't be delivered and Samba will tell the sender there was
11055                 an error. Unfortunately WfWg totally ignores the error code
11056                 and carries on regardless, saying that the message was delivered.
11057                 </P
11058 ><P
11059 >If you want to silently delete it then try:</P
11060 ><P
11061 ><B
11062 CLASS="COMMAND"
11063 >message command = rm %s</B
11064 ></P
11065 ><P
11066 >Default: <EM
11067 >no message command</EM
11068 ></P
11069 ><P
11070 >Example: <B
11071 CLASS="COMMAND"
11072 >message command = csh -c 'xedit %s;
11073                 rm %s' &#38;</B
11074 ></P
11075 ></DD
11076 ><DT
11077 ><A
11078 NAME="MINPASSWDLENGTH"
11079 ></A
11080 >min passwd length (G)</DT
11081 ><DD
11082 ><P
11083 >Synonym for <A
11084 HREF="#MINPASSWORDLENGTH"
11085 >               <TT
11086 CLASS="PARAMETER"
11087 ><I
11088 >min password length</I
11089 ></TT
11090 ></A
11091 >.</P
11092 ></DD
11093 ><DT
11094 ><A
11095 NAME="MINPASSWORDLENGTH"
11096 ></A
11097 >min password length (G)</DT
11098 ><DD
11099 ><P
11100 >This option sets the minimum length in characters
11101                 of a plaintext password that <B
11102 CLASS="COMMAND"
11103 >smbd</B
11104 > will accept when performing
11105                 UNIX password changing.</P
11106 ><P
11107 >See also <A
11108 HREF="#UNIXPASSWORDSYNC"
11109 ><TT
11110 CLASS="PARAMETER"
11111 ><I
11112 >unix
11113                 password sync</I
11114 ></TT
11115 ></A
11116 >, <A
11117 HREF="#PASSWDPROGRAM"
11118 >               <TT
11119 CLASS="PARAMETER"
11120 ><I
11121 >passwd program</I
11122 ></TT
11123 ></A
11124 > and <A
11125 HREF="#PASSWDCHATDEBUG"
11126 ><TT
11127 CLASS="PARAMETER"
11128 ><I
11129 >passwd chat debug</I
11130 ></TT
11131 >
11132                 </A
11133 >.</P
11134 ><P
11135 >Default: <B
11136 CLASS="COMMAND"
11137 >min password length = 5</B
11138 ></P
11139 ></DD
11140 ><DT
11141 ><A
11142 NAME="MINPRINTSPACE"
11143 ></A
11144 >min print space (S)</DT
11145 ><DD
11146 ><P
11147 >This sets the minimum amount of free disk
11148                 space that must be available before a user will be able to spool
11149                 a print job. It is specified in kilobytes. The default is 0, which
11150                 means a user can always spool a print job.</P
11151 ><P
11152 >See also the <A
11153 HREF="#PRINTING"
11154 ><TT
11155 CLASS="PARAMETER"
11156 ><I
11157 >printing
11158                 </I
11159 ></TT
11160 ></A
11161 > parameter.</P
11162 ><P
11163 >Default: <B
11164 CLASS="COMMAND"
11165 >min print space = 0</B
11166 ></P
11167 ><P
11168 >Example: <B
11169 CLASS="COMMAND"
11170 >min print space = 2000</B
11171 ></P
11172 ></DD
11173 ><DT
11174 ><A
11175 NAME="MINPROTOCOL"
11176 ></A
11177 >min protocol (G)</DT
11178 ><DD
11179 ><P
11180 >The value of the parameter (a string) is the
11181                 lowest SMB protocol dialect than Samba will support.  Please refer
11182                 to the <A
11183 HREF="#MAXPROTOCOL"
11184 ><TT
11185 CLASS="PARAMETER"
11186 ><I
11187 >max protocol</I
11188 ></TT
11189 ></A
11190 >
11191                 parameter for a list of valid protocol names and a brief description
11192                 of each.  You may also wish to refer to the C source code in
11193                 <TT
11194 CLASS="FILENAME"
11195 >source/smbd/negprot.c</TT
11196 > for a listing of known protocol
11197                 dialects supported by clients.</P
11198 ><P
11199 >If you are viewing this parameter as a security measure, you should
11200                 also refer to the <A
11201 HREF="#LANMANAUTH"
11202 ><TT
11203 CLASS="PARAMETER"
11204 ><I
11205 >lanman
11206                 auth</I
11207 ></TT
11208 ></A
11209 > parameter.  Otherwise, you should never need
11210                 to change this parameter.</P
11211 ><P
11212 >Default : <B
11213 CLASS="COMMAND"
11214 >min protocol = CORE</B
11215 ></P
11216 ><P
11217 >Example : <B
11218 CLASS="COMMAND"
11219 >min protocol = NT1</B
11220 >  # disable DOS
11221                 clients</P
11222 ></DD
11223 ><DT
11224 ><A
11225 NAME="MINWINSTTL"
11226 ></A
11227 >min wins ttl (G)</DT
11228 ><DD
11229 ><P
11230 >This option tells <A
11231 HREF="nmbd.8.html"
11232 TARGET="_top"
11233 >nmbd(8)</A
11234 >
11235                 when acting as a WINS server (<A
11236 HREF="#WINSSUPPORT"
11237 ><TT
11238 CLASS="PARAMETER"
11239 ><I
11240 >               wins support = yes</I
11241 ></TT
11242 ></A
11243 >) what the minimum 'time to live'
11244                 of NetBIOS names that <B
11245 CLASS="COMMAND"
11246 >nmbd</B
11247 > will grant will be (in
11248                 seconds). You should never need to change this parameter.  The default
11249                 is 6 hours (21600 seconds).</P
11250 ><P
11251 >Default: <B
11252 CLASS="COMMAND"
11253 >min wins ttl = 21600</B
11254 ></P
11255 ></DD
11256 ><DT
11257 ><A
11258 NAME="MSDFSROOT"
11259 ></A
11260 >msdfs root (S)</DT
11261 ><DD
11262 ><P
11263 >This boolean parameter is only available if
11264                 Samba is configured  and  compiled with the <B
11265 CLASS="COMMAND"
11266 >               --with-msdfs</B
11267 > option.  If set to <TT
11268 CLASS="CONSTANT"
11269 >yes&#62;</TT
11270 >,
11271                 Samba treats the share as a Dfs root and  allows clients to browse
11272                 the distributed file system tree rooted at the share directory.
11273                 Dfs links are specified  in  the share directory by symbolic
11274                 links of the form <TT
11275 CLASS="FILENAME"
11276 >msdfs:serverA\shareA,serverB\shareB
11277                 </TT
11278 > and so on.  For more information on setting up a Dfs tree
11279                 on Samba,  refer to <A
11280 HREF="msdfs_setup.html"
11281 TARGET="_top"
11282 >msdfs_setup.html
11283                 </A
11284 >.</P
11285 ><P
11286 >See also <A
11287 HREF="#HOSTMSDFS"
11288 ><TT
11289 CLASS="PARAMETER"
11290 ><I
11291 >host msdfs
11292                 </I
11293 ></TT
11294 ></A
11295 ></P
11296 ><P
11297 >Default: <B
11298 CLASS="COMMAND"
11299 >msdfs root = no</B
11300 ></P
11301 ></DD
11302 ><DT
11303 ><A
11304 NAME="NAMERESOLVEORDER"
11305 ></A
11306 >name resolve order (G)</DT
11307 ><DD
11308 ><P
11309 >This option is used by the programs in the Samba
11310                 suite to determine what naming services to use and in what order
11311                 to resolve host names to IP addresses. The option takes a space
11312                 separated string of name resolution options.</P
11313 ><P
11314 >The options are :"lmhosts", "host", "wins" and "bcast". They
11315                 cause names to be resolved as follows :</P
11316 ><P
11317 ></P
11318 ><UL
11319 ><LI
11320 ><P
11321 ><TT
11322 CLASS="CONSTANT"
11323 >lmhosts</TT
11324 > : Lookup an IP
11325                         address in the Samba lmhosts file. If the line in lmhosts has
11326                         no name type attached to the NetBIOS name (see the <A
11327 HREF="lmhosts.5.html"
11328 TARGET="_top"
11329 >lmhosts(5)</A
11330 > for details) then
11331                         any name type matches for lookup.</P
11332 ></LI
11333 ><LI
11334 ><P
11335 ><TT
11336 CLASS="CONSTANT"
11337 >host</TT
11338 > : Do a standard host
11339                         name to IP address resolution, using the system <TT
11340 CLASS="FILENAME"
11341 >/etc/hosts
11342                         </TT
11343 >, NIS, or DNS lookups. This method of name resolution
11344                         is operating system depended for instance on IRIX or Solaris this
11345                         may be controlled by the <TT
11346 CLASS="FILENAME"
11347 >/etc/nsswitch.conf</TT
11348 >
11349                         file).  Note that this method is only used if the NetBIOS name
11350                         type being queried is the 0x20 (server) name type, otherwise
11351                         it is ignored.</P
11352 ></LI
11353 ><LI
11354 ><P
11355 ><TT
11356 CLASS="CONSTANT"
11357 >wins</TT
11358 > : Query a name with
11359                         the IP address listed in the <A
11360 HREF="#WINSSERVER"
11361 ><TT
11362 CLASS="PARAMETER"
11363 ><I
11364 >                       wins server</I
11365 ></TT
11366 ></A
11367 > parameter.  If no WINS server has
11368                         been specified this method will be ignored.</P
11369 ></LI
11370 ><LI
11371 ><P
11372 ><TT
11373 CLASS="CONSTANT"
11374 >bcast</TT
11375 > : Do a broadcast on
11376                         each of the known local interfaces listed in the <A
11377 HREF="#INTERFACES"
11378 ><TT
11379 CLASS="PARAMETER"
11380 ><I
11381 >interfaces</I
11382 ></TT
11383 ></A
11384 >
11385                         parameter. This is the least reliable of the name resolution
11386                         methods as it depends on the target host being on a locally
11387                         connected subnet.</P
11388 ></LI
11389 ></UL
11390 ><P
11391 >Default: <B
11392 CLASS="COMMAND"
11393 >name resolve order = lmhosts host wins bcast
11394                 </B
11395 ></P
11396 ><P
11397 >Example: <B
11398 CLASS="COMMAND"
11399 >name resolve order = lmhosts bcast host
11400                 </B
11401 ></P
11402 ><P
11403 >This will cause the local lmhosts file to be examined
11404                 first, followed by a broadcast attempt, followed by a normal
11405                 system hostname lookup.</P
11406 ></DD
11407 ><DT
11408 ><A
11409 NAME="NETBIOSALIASES"
11410 ></A
11411 >netbios aliases (G)</DT
11412 ><DD
11413 ><P
11414 >This is a list of NetBIOS names that <A
11415 HREF="nmbd.8.html"
11416 TARGET="_top"
11417 >nmbd(8)</A
11418 > will advertise as additional
11419                 names by which the Samba server is known. This allows one machine
11420                 to appear in browse lists under multiple names. If a machine is
11421                 acting as a browse server or logon server none
11422                 of these names will be advertised as either browse server or logon
11423                 servers, only the primary name of the machine will be advertised
11424                 with these capabilities.</P
11425 ><P
11426 >See also <A
11427 HREF="#NETBIOSNAME"
11428 ><TT
11429 CLASS="PARAMETER"
11430 ><I
11431 >netbios
11432                 name</I
11433 ></TT
11434 ></A
11435 >.</P
11436 ><P
11437 >Default: <EM
11438 >empty string (no additional names)</EM
11439 ></P
11440 ><P
11441 >Example: <B
11442 CLASS="COMMAND"
11443 >netbios aliases = TEST TEST1 TEST2</B
11444 ></P
11445 ></DD
11446 ><DT
11447 ><A
11448 NAME="NETBIOSNAME"
11449 ></A
11450 >netbios name (G)</DT
11451 ><DD
11452 ><P
11453 >This sets the NetBIOS name by which a Samba
11454                 server is known. By default it is the same as the first component
11455                 of the host's DNS name. If a machine is a browse server or
11456                 logon server this name (or the first component
11457                 of the hosts DNS name) will be the name that these services are
11458                 advertised under.</P
11459 ><P
11460 >See also <A
11461 HREF="#NETBIOSALIASES"
11462 ><TT
11463 CLASS="PARAMETER"
11464 ><I
11465 >netbios
11466                 aliases</I
11467 ></TT
11468 ></A
11469 >.</P
11470 ><P
11471 >Default: <EM
11472 >machine DNS name</EM
11473 ></P
11474 ><P
11475 >Example: <B
11476 CLASS="COMMAND"
11477 >netbios name = MYNAME</B
11478 ></P
11479 ></DD
11480 ><DT
11481 ><A
11482 NAME="NETBIOSSCOPE"
11483 ></A
11484 >netbios scope (G)</DT
11485 ><DD
11486 ><P
11487 >This sets the NetBIOS scope that Samba will
11488                 operate under. This should not be set unless every machine
11489                 on your LAN also sets this value.</P
11490 ></DD
11491 ><DT
11492 ><A
11493 NAME="NISHOMEDIR"
11494 ></A
11495 >nis homedir (G)</DT
11496 ><DD
11497 ><P
11498 >Get the home share server from a NIS map. For
11499                 UNIX systems that use an automounter, the user's home directory
11500                 will often be mounted on a workstation on demand from a remote
11501                 server. </P
11502 ><P
11503 >When the Samba logon server is not the actual home directory
11504                 server, but is mounting the home directories via NFS then two
11505                 network hops would be required to access the users home directory
11506                 if the logon server told the client to use itself as the SMB server
11507                 for home directories (one over SMB and one over NFS). This can
11508                 be very slow.</P
11509 ><P
11510 >This option allows Samba to return the home share as
11511                 being on a different server to the logon server and as
11512                 long as a Samba daemon is running on the home directory server,
11513                 it will be mounted on the Samba client directly from the directory
11514                 server. When Samba is returning the home share to the client, it
11515                 will consult the NIS map specified in <A
11516 HREF="#HOMEDIRMAP"
11517 >               <TT
11518 CLASS="PARAMETER"
11519 ><I
11520 >homedir map</I
11521 ></TT
11522 ></A
11523 > and return the server
11524                 listed there.</P
11525 ><P
11526 >Note that for this option to work there must be a working
11527                 NIS system and the Samba server with this option must also
11528                 be a logon server.</P
11529 ><P
11530 >Default: <B
11531 CLASS="COMMAND"
11532 >nis homedir = no</B
11533 ></P
11534 ></DD
11535 ><DT
11536 ><A
11537 NAME="NTACLSUPPORT"
11538 ></A
11539 >nt acl support (G)</DT
11540 ><DD
11541 ><P
11542 >This boolean parameter controls whether
11543                 <A
11544 HREF="smbd.8.html"
11545 TARGET="_top"
11546 >smbd(8)</A
11547 > will attempt to map
11548                 UNIX permissions into Windows NT access control lists.</P
11549 ><P
11550 >Default: <B
11551 CLASS="COMMAND"
11552 >nt acl support = yes</B
11553 ></P
11554 ></DD
11555 ><DT
11556 ><A
11557 NAME="NTPIPESUPPORT"
11558 ></A
11559 >nt pipe support (G)</DT
11560 ><DD
11561 ><P
11562 >This boolean parameter controls whether
11563                 <A
11564 HREF="smbd.8.html"
11565 TARGET="_top"
11566 >smbd(8)</A
11567 > will allow Windows NT
11568                 clients to connect to the NT SMB specific <TT
11569 CLASS="CONSTANT"
11570 >IPC$</TT
11571 >
11572                 pipes. This is a developer debugging option and can be left
11573                 alone.</P
11574 ><P
11575 >Default: <B
11576 CLASS="COMMAND"
11577 >nt pipe support = yes</B
11578 ></P
11579 ></DD
11580 ><DT
11581 ><A
11582 NAME="NTSMBSUPPORT"
11583 ></A
11584 >nt smb support (G)</DT
11585 ><DD
11586 ><P
11587 >This boolean parameter controls whether <A
11588 HREF="smbd.8.html"
11589 TARGET="_top"
11590 >smbd(8)</A
11591 > will negotiate NT specific SMB
11592                 support with Windows NT clients. Although this is a developer
11593                 debugging option and should be left alone, benchmarking has discovered
11594                 that Windows NT clients give faster performance with this option
11595                 set to <TT
11596 CLASS="CONSTANT"
11597 >no</TT
11598 >. This is still being investigated.
11599                 If this option is set to <TT
11600 CLASS="CONSTANT"
11601 >no</TT
11602 > then Samba offers
11603                 exactly the same SMB calls that versions prior to Samba 2.0 offered.
11604                 This information may be of use if any users are having problems
11605                 with NT SMB support.</P
11606 ><P
11607 >You should not need to ever disable this parameter.</P
11608 ><P
11609 >Default: <B
11610 CLASS="COMMAND"
11611 >nt smb support = yes</B
11612 ></P
11613 ></DD
11614 ><DT
11615 ><A
11616 NAME="NULLPASSWORDS"
11617 ></A
11618 >null passwords (G)</DT
11619 ><DD
11620 ><P
11621 >Allow or disallow client access to accounts
11622                 that have null passwords. </P
11623 ><P
11624 >See also <A
11625 HREF="smbpasswd.5.html"
11626 TARGET="_top"
11627 >smbpasswd (5)</A
11628 >.</P
11629 ><P
11630 >Default: <B
11631 CLASS="COMMAND"
11632 >null passwords = no</B
11633 ></P
11634 ></DD
11635 ><DT
11636 ><A
11637 NAME="ONLYUSER"
11638 ></A
11639 >only user (S)</DT
11640 ><DD
11641 ><P
11642 >This is a boolean option that controls whether
11643                 connections with usernames not in the <TT
11644 CLASS="PARAMETER"
11645 ><I
11646 >user</I
11647 ></TT
11648 >
11649                 list will be allowed. By default this option is disabled so that a
11650                 client can supply a username to be used by the server.  Enabling
11651                 this parameter will force the server to only user the login
11652                 names from the <TT
11653 CLASS="PARAMETER"
11654 ><I
11655 >user</I
11656 ></TT
11657 > list and is only really
11658                 useful in <A
11659 HREF="#SECURITYEQUALSSHARE"
11660 >shave level</A
11661 >
11662                 security.</P
11663 ><P
11664 >Note that this also means Samba won't try to deduce
11665                 usernames from the service name. This can be annoying for
11666                 the [homes] section. To get around this you could use <B
11667 CLASS="COMMAND"
11668 >user =
11669                 %S</B
11670 > which means your <TT
11671 CLASS="PARAMETER"
11672 ><I
11673 >user</I
11674 ></TT
11675 > list
11676                 will be just the service name, which for home directories is the
11677                 name of the user.</P
11678 ><P
11679 >See also the <A
11680 HREF="#USER"
11681 ><TT
11682 CLASS="PARAMETER"
11683 ><I
11684 >user</I
11685 ></TT
11686 >
11687                 </A
11688 > parameter.</P
11689 ><P
11690 >Default: <B
11691 CLASS="COMMAND"
11692 >only user = no</B
11693 ></P
11694 ></DD
11695 ><DT
11696 ><A
11697 NAME="OLELOCKINGCOMPATIBILITY"
11698 ></A
11699 >ole locking compatibility (G)</DT
11700 ><DD
11701 ><P
11702 >This parameter allows an administrator to turn
11703                 off the byte range lock manipulation that is done within Samba to
11704                 give compatibility for OLE applications. Windows OLE applications
11705                 use byte range locking as a form of inter-process communication, by
11706                 locking ranges of bytes around the 2^32 region of a file range. This
11707                 can cause certain UNIX lock managers to crash or otherwise cause
11708                 problems. Setting this parameter to <TT
11709 CLASS="CONSTANT"
11710 >no</TT
11711 > means you
11712                 trust your UNIX lock manager to handle such cases correctly.</P
11713 ><P
11714 >Default: <B
11715 CLASS="COMMAND"
11716 >ole locking compatibility = yes</B
11717 ></P
11718 ></DD
11719 ><DT
11720 ><A
11721 NAME="ONLYGUEST"
11722 ></A
11723 >only guest (S)</DT
11724 ><DD
11725 ><P
11726 >A synonym for <A
11727 HREF="#GUESTONLY"
11728 ><TT
11729 CLASS="PARAMETER"
11730 ><I
11731 >               guest only</I
11732 ></TT
11733 ></A
11734 >.</P
11735 ></DD
11736 ><DT
11737 ><A
11738 NAME="OPLOCKBREAKWAITTIME"
11739 ></A
11740 >oplock break wait time (G)</DT
11741 ><DD
11742 ><P
11743 >This is a tuning parameter added due to bugs in
11744                 both Windows 9x and WinNT. If Samba responds to a client too
11745                 quickly when that client issues an SMB that can cause an oplock
11746                 break request, then the network client can fail and not respond
11747                 to the break request. This tuning parameter (which is set in milliseconds)
11748                 is the amount of time Samba will wait before sending an oplock break
11749                 request to such (broken) clients.</P
11750 ><P
11751 ><EM
11752 >DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ
11753                 AND UNDERSTOOD THE SAMBA OPLOCK CODE</EM
11754 >.</P
11755 ><P
11756 >Default: <B
11757 CLASS="COMMAND"
11758 >oplock break wait time = 0</B
11759 ></P
11760 ></DD
11761 ><DT
11762 ><A
11763 NAME="OPLOCKCONTENTIONLIMIT"
11764 ></A
11765 >oplock contention limit (S)</DT
11766 ><DD
11767 ><P
11768 >This is a <EM
11769 >very</EM
11770 > advanced
11771                 <A
11772 HREF="smbd.8.html"
11773 TARGET="_top"
11774 >smbd(8)</A
11775 > tuning option to
11776                 improve the efficiency of the granting of oplocks under multiple
11777                 client contention for the same file.</P
11778 ><P
11779 >In brief it specifies a number, which causes smbd not to
11780                 grant an oplock even when requested if the approximate number of
11781                 clients contending for an oplock on the same file goes over this
11782                 limit. This causes <B
11783 CLASS="COMMAND"
11784 >smbd</B
11785 > to behave in a similar
11786                 way to Windows NT.</P
11787 ><P
11788 ><EM
11789 >DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ
11790                 AND UNDERSTOOD THE SAMBA OPLOCK CODE</EM
11791 >.</P
11792 ><P
11793 >Default: <B
11794 CLASS="COMMAND"
11795 >oplock contention limit = 2</B
11796 ></P
11797 ></DD
11798 ><DT
11799 ><A
11800 NAME="OPLOCKS"
11801 ></A
11802 >oplocks (S)</DT
11803 ><DD
11804 ><P
11805 >This boolean option tells smbd whether to
11806                 issue oplocks (opportunistic locks) to file open requests on this
11807                 share. The oplock code can dramatically (approx. 30% or more) improve
11808                 the speed of access to files on Samba servers. It allows the clients
11809                 to aggressively cache files locally and you may want to disable this
11810                 option for unreliable network environments (it is turned on by
11811                 default in Windows NT Servers).  For more information see the file
11812                 <TT
11813 CLASS="FILENAME"
11814 >Speed.txt</TT
11815 > in the Samba <TT
11816 CLASS="FILENAME"
11817 >docs/</TT
11818 >
11819                 directory.</P
11820 ><P
11821 >Oplocks may be selectively turned off on certain files with a
11822                 share. See the <A
11823 HREF="#VETOOPLOCKFILES"
11824 ><TT
11825 CLASS="PARAMETER"
11826 ><I
11827 >               veto oplock files</I
11828 ></TT
11829 ></A
11830 > parameter. On some systems
11831                 oplocks are recognized by the underlying operating system. This
11832                 allows data synchronization between all access to oplocked files,
11833                 whether it be via Samba or NFS or a local UNIX process. See the
11834                 <TT
11835 CLASS="PARAMETER"
11836 ><I
11837 >kernel oplocks</I
11838 ></TT
11839 > parameter for details.</P
11840 ><P
11841 >See also the <A
11842 HREF="#KERNELOPLOCKS"
11843 ><TT
11844 CLASS="PARAMETER"
11845 ><I
11846 >kernel
11847                 oplocks</I
11848 ></TT
11849 ></A
11850 > and <A
11851 HREF="#LEVEL2OPLOCKS"
11852 ><TT
11853 CLASS="PARAMETER"
11854 ><I
11855 >               level2 oplocks</I
11856 ></TT
11857 ></A
11858 > parameters.</P
11859 ><P
11860 >Default: <B
11861 CLASS="COMMAND"
11862 >oplocks = yes</B
11863 ></P
11864 ></DD
11865 ><DT
11866 ><A
11867 NAME="OSLEVEL"
11868 ></A
11869 >os level (G)</DT
11870 ><DD
11871 ><P
11872 >This integer value controls what level Samba
11873                 advertises itself as for browse elections. The value of this
11874                 parameter determines whether <A
11875 HREF="nmbd.8.html"
11876 TARGET="_top"
11877 >nmbd(8)</A
11878 >
11879                 has a chance of becoming a local master browser for the <TT
11880 CLASS="PARAMETER"
11881 ><I
11882 >               WORKGROUP</I
11883 ></TT
11884 > in the local broadcast area.</P
11885 ><P
11886 ><EM
11887 >Note :</EM
11888 >By default, Samba will win
11889                 a local master browsing election over all Microsoft operating
11890                 systems except a Windows NT 4.0/2000 Domain Controller.  This
11891                 means that a misconfigured Samba host can effectively isolate
11892                 a subnet for browsing purposes.  See <TT
11893 CLASS="FILENAME"
11894 >BROWSING.txt
11895                 </TT
11896 > in the Samba <TT
11897 CLASS="FILENAME"
11898 >docs/</TT
11899 > directory
11900                 for details.</P
11901 ><P
11902 >Default: <B
11903 CLASS="COMMAND"
11904 >os level = 20</B
11905 ></P
11906 ><P
11907 >Example: <B
11908 CLASS="COMMAND"
11909 >os level = 65 </B
11910 ></P
11911 ></DD
11912 ><DT
11913 ><A
11914 NAME="OS2DRIVERMAP"
11915 ></A
11916 >os2 driver map (G)</DT
11917 ><DD
11918 ><P
11919 >The parameter is used to define the absolute
11920                 path to a file containing a mapping of Windows NT printer driver
11921                 names to OS/2 printer driver names.  The format is:</P
11922 ><P
11923 >&#60;nt driver name&#62; = &#60;os2 driver
11924                 name&#62;.&#60;device name&#62;</P
11925 ><P
11926 >For example, a valid entry using the HP LaserJet 5
11927                 printer driver woudl appear as <B
11928 CLASS="COMMAND"
11929 >HP LaserJet 5L = LASERJET.HP
11930                 LaserJet 5L</B
11931 >.</P
11932 ><P
11933 >The need for the file is due to the printer driver namespace
11934                 problem described in the <A
11935 HREF="printer_driver2.html"
11936 TARGET="_top"
11937 >Samba
11938                 Printing HOWTO</A
11939 >.  For more details on OS/2 clients, please
11940                 refer to the <A
11941 HREF="OS2-Client-HOWTO.html"
11942 TARGET="_top"
11943 >OS2-Client-HOWTO
11944                 </A
11945 > containing in the Samba documentation.</P
11946 ><P
11947 >Default: <B
11948 CLASS="COMMAND"
11949 >os2 driver map = &#60;empty string&#62;
11950                 </B
11951 ></P
11952 ></DD
11953 ><DT
11954 ><A
11955 NAME="PANICACTION"
11956 ></A
11957 >panic action (G)</DT
11958 ><DD
11959 ><P
11960 >This is a Samba developer option that allows a
11961                 system command to be called when either <A
11962 HREF="smbd.8.html"
11963 TARGET="_top"
11964 >               smbd(8)</A
11965 > or <A
11966 HREF="nmbd.8.html"
11967 TARGET="_top"
11968 >nmbd(8)</A
11969 >
11970                 crashes. This is usually used to draw attention to the fact that
11971                 a problem occurred.</P
11972 ><P
11973 >Default: <B
11974 CLASS="COMMAND"
11975 >panic action = &#60;empty string&#62;</B
11976 ></P
11977 ><P
11978 >Example: <B
11979 CLASS="COMMAND"
11980 >panic action = "/bin/sleep 90000"</B
11981 ></P
11982 ></DD
11983 ><DT
11984 ><A
11985 NAME="PASSWDCHAT"
11986 ></A
11987 >passwd chat (G)</DT
11988 ><DD
11989 ><P
11990 >This string controls the <EM
11991 >"chat"</EM
11992 >
11993                 conversation that takes places between <A
11994 HREF="smbd.8.html"
11995 TARGET="_top"
11996 >smbd</A
11997 > and the local password changing
11998                 program to change the users password. The string describes a
11999                 sequence of response-receive pairs that <A
12000 HREF="smbd.8.html"
12001 TARGET="_top"
12002 >               smbd(8)</A
12003 > uses to determine what to send to the
12004                 <A
12005 HREF="#PASSWDPROGRAM"
12006 ><TT
12007 CLASS="PARAMETER"
12008 ><I
12009 >passwd program</I
12010 ></TT
12011 >
12012                 </A
12013 > and what to expect back. If the expected output is not
12014                 received then the password is not changed.</P
12015 ><P
12016 >This chat sequence is often quite site specific, depending
12017                 on what local methods are used for password control (such as NIS
12018                 etc).</P
12019 ><P
12020 >The string can contain the macros <TT
12021 CLASS="PARAMETER"
12022 ><I
12023 >%o</I
12024 ></TT
12025 >
12026                 and <TT
12027 CLASS="PARAMETER"
12028 ><I
12029 >%n</I
12030 ></TT
12031 > which are substituted for the old
12032                 and new passwords respectively. It can also contain the standard
12033                 macros <TT
12034 CLASS="CONSTANT"
12035 >\n</TT
12036 >, <TT
12037 CLASS="CONSTANT"
12038 >\r</TT
12039 >, <TT
12040 CLASS="CONSTANT"
12041 >               \t</TT
12042 > and <TT
12043 CLASS="CONSTANT"
12044 >%s</TT
12045 > to give line-feed,
12046                 carriage-return, tab and space.</P
12047 ><P
12048 >The string can also contain a '*' which matches
12049                 any sequence of characters.</P
12050 ><P
12051 >Double quotes can be used to collect strings with spaces
12052                 in them into a single string.</P
12053 ><P
12054 >If the send string in any part of the chat sequence
12055                 is a fullstop ".",  then no string is sent. Similarly,
12056                 if the expect string is a fullstop then no string is expected.</P
12057 ><P
12058 >Note that if the <A
12059 HREF="#UNIXPASSWORDSYNC"
12060 ><TT
12061 CLASS="PARAMETER"
12062 ><I
12063 >unix
12064                 password sync</I
12065 ></TT
12066 ></A
12067 > parameter is set to true, then this
12068                 sequence is called <EM
12069 >AS ROOT</EM
12070 > when the SMB password
12071                 in the smbpasswd file is being changed, without access to the old
12072                 password cleartext. In this case the old password cleartext is set
12073                 to "" (the empty string).</P
12074 ><P
12075 >See also <A
12076 HREF="#UNIXPASSWORDSYNC"
12077 ><TT
12078 CLASS="PARAMETER"
12079 ><I
12080 >unix password
12081                 sync</I
12082 ></TT
12083 ></A
12084 >, <A
12085 HREF="#PASSWDPROGRAM"
12086 ><TT
12087 CLASS="PARAMETER"
12088 ><I
12089 >               passwd program</I
12090 ></TT
12091 ></A
12092 > and <A
12093 HREF="#PASSWDCHATDEBUG"
12094 >               <TT
12095 CLASS="PARAMETER"
12096 ><I
12097 >passwd chat debug</I
12098 ></TT
12099 ></A
12100 >.</P
12101 ><P
12102 >Default: <B
12103 CLASS="COMMAND"
12104 >passwd chat = *new*password* %n\n
12105                 *new*password* %n\n *changed*</B
12106 ></P
12107 ><P
12108 >Example: <B
12109 CLASS="COMMAND"
12110 >passwd chat = "*Enter OLD password*" %o\n
12111                 "*Enter NEW password*" %n\n "*Reenter NEW password*" %n\n "*Password
12112                 changed*"</B
12113 ></P
12114 ></DD
12115 ><DT
12116 ><A
12117 NAME="PASSWDCHATDEBUG"
12118 ></A
12119 >passwd chat debug (G)</DT
12120 ><DD
12121 ><P
12122 >This boolean specifies if the passwd chat script
12123                 parameter is run in <EM
12124 >debug</EM
12125 > mode. In this mode the
12126                 strings passed to and received from the passwd chat are printed
12127                 in the <A
12128 HREF="smbd.8.html"
12129 TARGET="_top"
12130 >smbd(8)</A
12131 > log with a
12132                 <A
12133 HREF="#DEBUGLEVEL"
12134 ><TT
12135 CLASS="PARAMETER"
12136 ><I
12137 >debug level</I
12138 ></TT
12139 ></A
12140 >
12141                 of 100. This is a dangerous option as it will allow plaintext passwords
12142                 to be seen in the <B
12143 CLASS="COMMAND"
12144 >smbd</B
12145 > log. It is available to help
12146                 Samba admins debug their <TT
12147 CLASS="PARAMETER"
12148 ><I
12149 >passwd chat</I
12150 ></TT
12151 > scripts
12152                 when calling the <TT
12153 CLASS="PARAMETER"
12154 ><I
12155 >passwd program</I
12156 ></TT
12157 > and should
12158                 be turned off after this has been done. This parameter is off by
12159                 default.</P
12160 ><P
12161 >See also &#60;<A
12162 HREF="#PASSWDCHAT"
12163 ><TT
12164 CLASS="PARAMETER"
12165 ><I
12166 >passwd chat</I
12167 ></TT
12168 >
12169                 </A
12170 >, <A
12171 HREF="#PASSWDPROGRAM"
12172 ><TT
12173 CLASS="PARAMETER"
12174 ><I
12175 >passwd program</I
12176 ></TT
12177 >
12178                 </A
12179 >.</P
12180 ><P
12181 >Default: <B
12182 CLASS="COMMAND"
12183 >passwd chat debug = no</B
12184 ></P
12185 ></DD
12186 ><DT
12187 ><A
12188 NAME="PASSWDPROGRAM"
12189 ></A
12190 >passwd program (G)</DT
12191 ><DD
12192 ><P
12193 >The name of a program that can be used to set
12194                 UNIX user passwords.  Any occurrences of <TT
12195 CLASS="PARAMETER"
12196 ><I
12197 >%u</I
12198 ></TT
12199 >
12200                 will be replaced with the user name. The user name is checked for
12201                 existence before calling the password changing program.</P
12202 ><P
12203 >Also note that many passwd programs insist in <EM
12204 >reasonable
12205                 </EM
12206 > passwords, such as a minimum length, or the inclusion
12207                 of mixed case chars and digits. This can pose a problem as some clients
12208                 (such as Windows for Workgroups) uppercase the password before sending
12209                 it.</P
12210 ><P
12211 ><EM
12212 >Note</EM
12213 > that if the <TT
12214 CLASS="PARAMETER"
12215 ><I
12216 >unix
12217                 password sync</I
12218 ></TT
12219 > parameter is set to <TT
12220 CLASS="CONSTANT"
12221 >True
12222                 </TT
12223 > then this program is called <EM
12224 >AS ROOT</EM
12225 >
12226                 before the SMB password in the <A
12227 HREF="smbpasswd.5.html"
12228 TARGET="_top"
12229 >smbpasswd(5)
12230                 </A
12231 > file is changed. If this UNIX password change fails, then
12232                 <B
12233 CLASS="COMMAND"
12234 >smbd</B
12235 > will fail to change the SMB password also
12236                 (this is by design).</P
12237 ><P
12238 >If the <TT
12239 CLASS="PARAMETER"
12240 ><I
12241 >unix password sync</I
12242 ></TT
12243 > parameter
12244                 is set this parameter <EM
12245 >MUST USE ABSOLUTE PATHS</EM
12246 >
12247                 for <EM
12248 >ALL</EM
12249 > programs called, and must be examined
12250                 for security implications. Note that by default <TT
12251 CLASS="PARAMETER"
12252 ><I
12253 >unix
12254                 password sync</I
12255 ></TT
12256 > is set to <TT
12257 CLASS="CONSTANT"
12258 >False</TT
12259 >.</P
12260 ><P
12261 >See also <A
12262 HREF="#UNIXPASSWORDSYNC"
12263 ><TT
12264 CLASS="PARAMETER"
12265 ><I
12266 >unix
12267                 password sync</I
12268 ></TT
12269 ></A
12270 >.</P
12271 ><P
12272 >Default: <B
12273 CLASS="COMMAND"
12274 >passwd program = /bin/passwd</B
12275 ></P
12276 ><P
12277 >Example: <B
12278 CLASS="COMMAND"
12279 >passwd program = /sbin/npasswd %u</B
12280 >
12281                 </P
12282 ></DD
12283 ><DT
12284 ><A
12285 NAME="PASSWORDLEVEL"
12286 ></A
12287 >password level (G)</DT
12288 ><DD
12289 ><P
12290 >Some client/server combinations have difficulty
12291                 with mixed-case passwords.  One offending client is Windows for
12292                 Workgroups, which for some reason forces passwords to upper
12293                 case when using the LANMAN1 protocol, but leaves them alone when
12294                 using COREPLUS!  Another problem child is the Windows 95/98
12295                 family of operating systems.  These clients upper case clear
12296                 text passwords even when NT LM 0.12 selected by the protocol
12297                 negotiation request/response.</P
12298 ><P
12299 >This parameter defines the maximum number of characters
12300                 that may be upper case in passwords.</P
12301 ><P
12302 >For example, say the password given was "FRED". If <TT
12303 CLASS="PARAMETER"
12304 ><I
12305 >               password level</I
12306 ></TT
12307 > is set to 1, the following combinations
12308                 would be tried if "FRED" failed:</P
12309 ><P
12310 >"Fred", "fred", "fRed", "frEd","freD"</P
12311 ><P
12312 >If <TT
12313 CLASS="PARAMETER"
12314 ><I
12315 >password level</I
12316 ></TT
12317 > was set to 2,
12318                 the following combinations would also be tried: </P
12319 ><P
12320 >"FRed", "FrEd", "FreD", "fREd", "fReD", "frED", ..</P
12321 ><P
12322 >And so on.</P
12323 ><P
12324 >The higher value this parameter is set to the more likely
12325                 it is that a mixed case password will be matched against a single
12326                 case password. However, you should be aware that use of this
12327                 parameter reduces security and increases the time taken to
12328                 process a new connection.</P
12329 ><P
12330 >A value of zero will cause only two attempts to be
12331                 made - the password as is and the password in all-lower case.</P
12332 ><P
12333 >Default: <B
12334 CLASS="COMMAND"
12335 >password level = 0</B
12336 ></P
12337 ><P
12338 >Example: <B
12339 CLASS="COMMAND"
12340 >password level = 4</B
12341 ></P
12342 ></DD
12343 ><DT
12344 ><A
12345 NAME="PASSWORDSERVER"
12346 ></A
12347 >password server (G)</DT
12348 ><DD
12349 ><P
12350 >By specifying the name of another SMB server (such
12351                 as a WinNT box) with this option, and using <B
12352 CLASS="COMMAND"
12353 >security = domain
12354                 </B
12355 > or <B
12356 CLASS="COMMAND"
12357 >security = server</B
12358 > you can get Samba
12359                 to do all its username/password validation via a remote server.</P
12360 ><P
12361 >This option sets the name of the password server to use.
12362                 It must be a NetBIOS name, so if the machine's NetBIOS name is
12363                 different from its Internet name then you may have to add its NetBIOS
12364                 name to the lmhosts  file which is stored in the same directory
12365                 as the <TT
12366 CLASS="FILENAME"
12367 >smb.conf</TT
12368 > file.</P
12369 ><P
12370 >The name of the password server is looked up using the
12371                 parameter <A
12372 HREF="#NAMERESOLVEORDER"
12373 ><TT
12374 CLASS="PARAMETER"
12375 ><I
12376 >name
12377                 resolve order</I
12378 ></TT
12379 ></A
12380 > and so may resolved
12381                 by any method and order described in that parameter.</P
12382 ><P
12383 >The password server much be a machine capable of using
12384                 the "LM1.2X002" or the "NT LM 0.12" protocol, and it must be in
12385                 user level security mode.</P
12386 ><P
12387 ><EM
12388 >NOTE:</EM
12389 > Using a password server
12390                 means your UNIX box (running Samba) is only as secure as your
12391                 password server. <EM
12392 >DO NOT CHOOSE A PASSWORD SERVER THAT
12393                 YOU DON'T COMPLETELY TRUST</EM
12394 >.</P
12395 ><P
12396 >Never point a Samba server at itself for password
12397                 serving. This will cause a loop and could lock up your Samba
12398                 server!</P
12399 ><P
12400 >The name of the password server takes the standard
12401                 substitutions, but probably the only useful one is <TT
12402 CLASS="PARAMETER"
12403 ><I
12404 >%m
12405                 </I
12406 ></TT
12407 >, which means the Samba server will use the incoming
12408                 client as the password server. If you use this then you better
12409                 trust your clients, and you had better restrict them with hosts allow!</P
12410 ><P
12411 >If the <TT
12412 CLASS="PARAMETER"
12413 ><I
12414 >security</I
12415 ></TT
12416 > parameter is set to
12417                 <TT
12418 CLASS="CONSTANT"
12419 >domain</TT
12420 >, then the list of machines in this
12421                 option must be a list of Primary or Backup Domain controllers for the
12422                 Domain or the character '*', as the Samba server is effectively
12423                 in that domain, and will use cryptographically authenticated RPC calls
12424                 to authenticate the user logging on. The advantage of using <B
12425 CLASS="COMMAND"
12426 >               security = domain</B
12427 > is that if you list several hosts in the
12428                 <TT
12429 CLASS="PARAMETER"
12430 ><I
12431 >password server</I
12432 ></TT
12433 > option then <B
12434 CLASS="COMMAND"
12435 >smbd
12436                 </B
12437 > will try each in turn till it finds one that responds. This
12438                 is useful in case your primary server goes down.</P
12439 ><P
12440 >If the <TT
12441 CLASS="PARAMETER"
12442 ><I
12443 >password server</I
12444 ></TT
12445 > option is set
12446                 to the character '*', then Samba will attempt to auto-locate the
12447                 Primary or Backup Domain controllers to authenticate against by
12448                 doing a query for the name <TT
12449 CLASS="CONSTANT"
12450 >WORKGROUP&#60;1C&#62;</TT
12451 >
12452                 and then contacting each server returned in the list of IP
12453                 addresses from the name resolution source. </P
12454 ><P
12455 >If the <TT
12456 CLASS="PARAMETER"
12457 ><I
12458 >security</I
12459 ></TT
12460 > parameter is
12461                 set to <TT
12462 CLASS="CONSTANT"
12463 >server</TT
12464 >, then there are different
12465                 restrictions that <B
12466 CLASS="COMMAND"
12467 >security = domain</B
12468 > doesn't
12469                 suffer from:</P
12470 ><P
12471 ></P
12472 ><UL
12473 ><LI
12474 ><P
12475 >You may list several password servers in
12476                         the <TT
12477 CLASS="PARAMETER"
12478 ><I
12479 >password server</I
12480 ></TT
12481 > parameter, however if an
12482                         <B
12483 CLASS="COMMAND"
12484 >smbd</B
12485 > makes a connection to a password server,
12486                         and then the password server fails, no more users will be able
12487                         to be authenticated from this <B
12488 CLASS="COMMAND"
12489 >smbd</B
12490 >.  This is a
12491                         restriction of the SMB/CIFS protocol when in <B
12492 CLASS="COMMAND"
12493 >security=server
12494                         </B
12495 > mode and cannot be fixed in Samba.</P
12496 ></LI
12497 ><LI
12498 ><P
12499 >If you are using a Windows NT server as your
12500                         password server then you will have to ensure that your users
12501                         are able to login from the Samba server, as when in <B
12502 CLASS="COMMAND"
12503 >                       security=server</B
12504 >  mode the network logon will appear to
12505                         come from there rather than from the users workstation.</P
12506 ></LI
12507 ></UL
12508 ><P
12509 >See also the <A
12510 HREF="#SECURITY"
12511 ><TT
12512 CLASS="PARAMETER"
12513 ><I
12514 >security
12515                 </I
12516 ></TT
12517 ></A
12518 > parameter.</P
12519 ><P
12520 >Default: <B
12521 CLASS="COMMAND"
12522 >password server = &#60;empty string&#62;</B
12523 >
12524                 </P
12525 ><P
12526 >Example: <B
12527 CLASS="COMMAND"
12528 >password server = NT-PDC, NT-BDC1, NT-BDC2
12529                 </B
12530 ></P
12531 ><P
12532 >Example: <B
12533 CLASS="COMMAND"
12534 >password server = *</B
12535 ></P
12536 ></DD
12537 ><DT
12538 ><A
12539 NAME="PATH"
12540 ></A
12541 >path (S)</DT
12542 ><DD
12543 ><P
12544 >This parameter specifies a directory to which
12545                 the user of the service is to be given access. In the case of
12546                 printable services, this is where print data will spool prior to
12547                 being submitted to the host for printing.</P
12548 ><P
12549 >For a printable service offering guest access, the service
12550                 should be readonly and the path should be world-writeable and
12551                 have the sticky bit set. This is not mandatory of course, but
12552                 you probably won't get the results you expect if you do
12553                 otherwise.</P
12554 ><P
12555 >Any occurrences of <TT
12556 CLASS="PARAMETER"
12557 ><I
12558 >%u</I
12559 ></TT
12560 > in the path
12561                 will be replaced with the UNIX username that the client is using
12562                 on this connection. Any occurrences of <TT
12563 CLASS="PARAMETER"
12564 ><I
12565 >%m</I
12566 ></TT
12567 >
12568                 will be replaced by the NetBIOS name of the machine they are
12569                 connecting from. These replacements are very useful for setting
12570                 up pseudo home directories for users.</P
12571 ><P
12572 >Note that this path will be based on <A
12573 HREF="#ROOTDIR"
12574 >               <TT
12575 CLASS="PARAMETER"
12576 ><I
12577 >root dir</I
12578 ></TT
12579 ></A
12580 > if one was specified.</P
12581 ><P
12582 >Default: <EM
12583 >none</EM
12584 ></P
12585 ><P
12586 >Example: <B
12587 CLASS="COMMAND"
12588 >path = /home/fred</B
12589 ></P
12590 ></DD
12591 ><DT
12592 ><A
12593 NAME="POSIXLOCKING"
12594 ></A
12595 >posix locking (S)</DT
12596 ><DD
12597 ><P
12598 >The <A
12599 HREF="smbd.8.html"
12600 TARGET="_top"
12601 ><B
12602 CLASS="COMMAND"
12603 >smbd(8)</B
12604 ></A
12605 >
12606                 daemon maintains an database of file locks obtained by SMB clients.
12607                 The default behavior is to map this internal database to POSIX
12608                 locks.  This means that file locks obtained by SMB clients are
12609                 consistent with those seen by POSIX compliant applications accessing
12610                 the files via a non-SMB method (e.g. NFS or local file access).
12611                 You should never need to disable this parameter.</P
12612 ><P
12613 >Default: <B
12614 CLASS="COMMAND"
12615 >posix locking = yes</B
12616 ></P
12617 ></DD
12618 ><DT
12619 ><A
12620 NAME="POSTEXEC"
12621 ></A
12622 >postexec (S)</DT
12623 ><DD
12624 ><P
12625 >This option specifies a command to be run
12626                 whenever the service is disconnected. It takes the usual
12627                 substitutions. The command may be run as the root on some
12628                 systems.</P
12629 ><P
12630 >An interesting example may be do unmount server
12631                 resources:</P
12632 ><P
12633 ><B
12634 CLASS="COMMAND"
12635 >postexec = /etc/umount /cdrom</B
12636 ></P
12637 ><P
12638 >See also <A
12639 HREF="#PREEXEC"
12640 ><TT
12641 CLASS="PARAMETER"
12642 ><I
12643 >preexec</I
12644 ></TT
12645 >
12646                 </A
12647 >.</P
12648 ><P
12649 >Default: <EM
12650 >none (no command executed)</EM
12651 >
12652                 </P
12653 ><P
12654 >Example: <B
12655 CLASS="COMMAND"
12656 >postexec = echo \"%u disconnected from %S
12657                 from %m (%I)\" &#62;&#62; /tmp/log</B
12658 ></P
12659 ></DD
12660 ><DT
12661 ><A
12662 NAME="POSTSCRIPT"
12663 ></A
12664 >postscript (S)</DT
12665 ><DD
12666 ><P
12667 >This parameter forces a printer to interpret
12668                 the print files as postscript. This is done by adding a <TT
12669 CLASS="CONSTANT"
12670 >%!
12671                 </TT
12672 > to the start of print output.</P
12673 ><P
12674 >This is most useful when you have lots of PCs that persist
12675                 in putting a control-D at the start of print jobs, which then
12676                 confuses your printer.</P
12677 ><P
12678 >Default: <B
12679 CLASS="COMMAND"
12680 >postscript = no</B
12681 ></P
12682 ></DD
12683 ><DT
12684 ><A
12685 NAME="PREEXEC"
12686 ></A
12687 >preexec (S)</DT
12688 ><DD
12689 ><P
12690 >This option specifies a command to be run whenever
12691                 the service is connected to. It takes the usual substitutions.</P
12692 ><P
12693 >An interesting example is to send the users a welcome
12694                 message every time they log in. Maybe a message of the day? Here
12695                 is an example:</P
12696 ><P
12697 ><B
12698 CLASS="COMMAND"
12699 >preexec = csh -c 'echo \"Welcome to %S!\" |
12700                  /usr/local/samba/bin/smbclient -M %m -I %I' &#38; </B
12701 ></P
12702 ><P
12703 >Of course, this could get annoying after a while :-)</P
12704 ><P
12705 >See also <A
12706 HREF="#PREEXECCLOSE"
12707 ><TT
12708 CLASS="PARAMETER"
12709 ><I
12710 >preexec close
12711                 </I
12712 ></TT
12713 ></A
12714 > and <A
12715 HREF="#POSTEXEC"
12716 ><TT
12717 CLASS="PARAMETER"
12718 ><I
12719 >postexec
12720                 </I
12721 ></TT
12722 ></A
12723 >.</P
12724 ><P
12725 >Default: <EM
12726 >none (no command executed)</EM
12727 ></P
12728 ><P
12729 >Example: <B
12730 CLASS="COMMAND"
12731 >preexec = echo \"%u connected to %S from %m
12732                 (%I)\" &#62;&#62; /tmp/log</B
12733 ></P
12734 ></DD
12735 ><DT
12736 ><A
12737 NAME="PREEXECCLOSE"
12738 ></A
12739 >preexec close (S)</DT
12740 ><DD
12741 ><P
12742 >This boolean option controls whether a non-zero
12743                 return code from <A
12744 HREF="#PREEXEC"
12745 ><TT
12746 CLASS="PARAMETER"
12747 ><I
12748 >preexec
12749                 </I
12750 ></TT
12751 ></A
12752 > should close the service being connected to.</P
12753 ><P
12754 >Default: <B
12755 CLASS="COMMAND"
12756 >preexec close = no</B
12757 ></P
12758 ></DD
12759 ><DT
12760 ><A
12761 NAME="PREFERREDMASTER"
12762 ></A
12763 >preferred master (G)</DT
12764 ><DD
12765 ><P
12766 >This boolean parameter controls if <A
12767 HREF="nmbd.8.html"
12768 TARGET="_top"
12769 >nmbd(8)</A
12770 > is a preferred master browser
12771                 for its workgroup.</P
12772 ><P
12773 >If this is set to true, on startup, <B
12774 CLASS="COMMAND"
12775 >nmbd</B
12776 >
12777                 will force an election, and it will have a slight advantage in
12778                 winning the election.  It is recommended that this parameter is
12779                 used in conjunction with <B
12780 CLASS="COMMAND"
12781 ><A
12782 HREF="#DOMAINMASTER"
12783 ><TT
12784 CLASS="PARAMETER"
12785 ><I
12786 >               domain master</I
12787 ></TT
12788 ></A
12789 > = yes</B
12790 >, so that <B
12791 CLASS="COMMAND"
12792 >               nmbd</B
12793 > can guarantee becoming a domain master.</P
12794 ><P
12795 >Use this option with caution, because if there are several
12796                 hosts (whether Samba servers, Windows 95 or NT) that are preferred
12797                 master browsers on the same subnet, they will each periodically
12798                 and continuously attempt to become the local master browser.
12799                 This will result in unnecessary broadcast traffic and reduced browsing
12800                 capabilities.</P
12801 ><P
12802 >See also <A
12803 HREF="#OSLEVEL"
12804 ><TT
12805 CLASS="PARAMETER"
12806 ><I
12807 >os level</I
12808 ></TT
12809 >
12810                 </A
12811 >.</P
12812 ><P
12813 >Default: <B
12814 CLASS="COMMAND"
12815 >preferred master = auto</B
12816 ></P
12817 ></DD
12818 ><DT
12819 ><A
12820 NAME="PREFEREDMASTER"
12821 ></A
12822 >prefered master (G)</DT
12823 ><DD
12824 ><P
12825 >Synonym for <A
12826 HREF="#PREFERREDMASTER"
12827 ><TT
12828 CLASS="PARAMETER"
12829 ><I
12830 >               preferred master</I
12831 ></TT
12832 ></A
12833 > for people who cannot spell :-).</P
12834 ></DD
12835 ><DT
12836 ><A
12837 NAME="PRELOAD"
12838 ></A
12839 >preload</DT
12840 ><DD
12841 ><P
12842 >This is a list of services that you want to be
12843                 automatically added to the browse lists. This is most useful
12844                 for homes and printers services that would otherwise not be
12845                 visible.</P
12846 ><P
12847 >Note that if you just want all printers in your
12848                 printcap file loaded then the <A
12849 HREF="#LOADPRINTERS"
12850 >               <TT
12851 CLASS="PARAMETER"
12852 ><I
12853 >load printers</I
12854 ></TT
12855 ></A
12856 > option is easier.</P
12857 ><P
12858 >Default: <EM
12859 >no preloaded services</EM
12860 ></P
12861 ><P
12862 >Example: <B
12863 CLASS="COMMAND"
12864 >preload = fred lp colorlp</B
12865 ></P
12866 ></DD
12867 ><DT
12868 ><A
12869 NAME="PRESERVECASE"
12870 ></A
12871 >preserve case (S)</DT
12872 ><DD
12873 ><P
12874 > This controls if new filenames are created
12875                 with the case that the client passes, or if they are forced to
12876                 be the <A
12877 HREF="#DEFAULTCASE"
12878 ><TT
12879 CLASS="PARAMETER"
12880 ><I
12881 >default case
12882                 </I
12883 ></TT
12884 ></A
12885 >.</P
12886 ><P
12887 >Default: <B
12888 CLASS="COMMAND"
12889 >preserve case = yes</B
12890 ></P
12891 ><P
12892 >See the section on <A
12893 HREF="#AEN201"
12894 >NAME
12895                 MANGLING</A
12896 > for a fuller discussion.</P
12897 ></DD
12898 ><DT
12899 ><A
12900 NAME="PRINTCOMMAND"
12901 ></A
12902 >print command (S)</DT
12903 ><DD
12904 ><P
12905 >After a print job has finished spooling to
12906                 a service, this command will be used via a <B
12907 CLASS="COMMAND"
12908 >system()</B
12909 >
12910                 call to process the spool file. Typically the command specified will
12911                 submit the spool file to the host's printing subsystem, but there
12912                 is no requirement that this be the case. The server will not remove
12913                 the spool file, so whatever command you specify should remove the
12914                 spool file when it has been processed, otherwise you will need to
12915                 manually remove old spool files.</P
12916 ><P
12917 >The print command is simply a text string. It will be used
12918                 verbatim, with two exceptions: All occurrences of <TT
12919 CLASS="PARAMETER"
12920 ><I
12921 >%s
12922                 </I
12923 ></TT
12924 > and <TT
12925 CLASS="PARAMETER"
12926 ><I
12927 >%f</I
12928 ></TT
12929 > will be replaced by the
12930                 appropriate spool file name, and all occurrences of <TT
12931 CLASS="PARAMETER"
12932 ><I
12933 >%p
12934                 </I
12935 ></TT
12936 > will be replaced by the appropriate printer name. The
12937                 spool file name is generated automatically by the server, the printer
12938                 name is discussed below.</P
12939 ><P
12940 >The print command <EM
12941 >MUST</EM
12942 > contain at least
12943                 one occurrence of <TT
12944 CLASS="PARAMETER"
12945 ><I
12946 >%s</I
12947 ></TT
12948 > or <TT
12949 CLASS="PARAMETER"
12950 ><I
12951 >%f
12952                 </I
12953 ></TT
12954 > - the <TT
12955 CLASS="PARAMETER"
12956 ><I
12957 >%p</I
12958 ></TT
12959 > is optional. At the time
12960                 a job is submitted, if no printer name is supplied the <TT
12961 CLASS="PARAMETER"
12962 ><I
12963 >%p
12964                 </I
12965 ></TT
12966 > will be silently removed from the printer command.</P
12967 ><P
12968 >If specified in the [global] section, the print command given
12969                 will be used for any printable service that does not have its own
12970                 print command specified.</P
12971 ><P
12972 >If there is neither a specified print command for a
12973                 printable service nor a global print command, spool files will
12974                 be created but not processed and (most importantly) not removed.</P
12975 ><P
12976 >Note that printing may fail on some UNIXes from the
12977                 <TT
12978 CLASS="CONSTANT"
12979 >nobody</TT
12980 > account. If this happens then create
12981                 an alternative guest account that can print and set the <A
12982 HREF="#GUESTACCOUNT"
12983 ><TT
12984 CLASS="PARAMETER"
12985 ><I
12986 >guest account</I
12987 ></TT
12988 ></A
12989 >
12990                 in the [global] section.</P
12991 ><P
12992 >You can form quite complex print commands by realizing
12993                 that they are just passed to a shell. For example the following
12994                 will log a print job, print the file, then remove it. Note that
12995                 ';' is the usual separator for command in shell scripts.</P
12996 ><P
12997 ><B
12998 CLASS="COMMAND"
12999 >print command = echo Printing %s &#62;&#62;
13000                 /tmp/print.log; lpr -P %p %s; rm %s</B
13001 ></P
13002 ><P
13003 >You may have to vary this command considerably depending
13004                 on how you normally print files on your system. The default for
13005                 the parameter varies depending on the setting of the <A
13006 HREF="#PRINTING"
13007 >               <TT
13008 CLASS="PARAMETER"
13009 ><I
13010 >printing</I
13011 ></TT
13012 ></A
13013 > parameter.</P
13014 ><P
13015 >Default: For <B
13016 CLASS="COMMAND"
13017 >printing= BSD, AIX, QNX, LPRNG
13018                 or PLP :</B
13019 ></P
13020 ><P
13021 ><B
13022 CLASS="COMMAND"
13023 >print command = lpr -r -P%p %s</B
13024 ></P
13025 ><P
13026 >For <B
13027 CLASS="COMMAND"
13028 >printing= SYS or HPUX :</B
13029 ></P
13030 ><P
13031 ><B
13032 CLASS="COMMAND"
13033 >print command = lp -c -d%p %s; rm %s</B
13034 ></P
13035 ><P
13036 >For <B
13037 CLASS="COMMAND"
13038 >printing=SOFTQ :</B
13039 ></P
13040 ><P
13041 ><B
13042 CLASS="COMMAND"
13043 >print command = lp -d%p -s %s; rm %s</B
13044 ></P
13045 ><P
13046 >Example: <B
13047 CLASS="COMMAND"
13048 >print command = /usr/local/samba/bin/myprintscript
13049                 %p %s</B
13050 ></P
13051 ></DD
13052 ><DT
13053 ><A
13054 NAME="PRINTOK"
13055 ></A
13056 >print ok (S)</DT
13057 ><DD
13058 ><P
13059 >Synonym for <A
13060 HREF="#PRINTABLE"
13061 >               <TT
13062 CLASS="PARAMETER"
13063 ><I
13064 >printable</I
13065 ></TT
13066 ></A
13067 >.</P
13068 ></DD
13069 ><DT
13070 ><A
13071 NAME="PRINTABLE"
13072 ></A
13073 >printable (S)</DT
13074 ><DD
13075 ><P
13076 >If this parameter is <TT
13077 CLASS="CONSTANT"
13078 >yes</TT
13079 >, then
13080                 clients may open, write to and submit spool files on the directory
13081                 specified for the service. </P
13082 ><P
13083 >Note that a printable service will ALWAYS allow writing
13084                 to the service path (user privileges permitting) via the spooling
13085                 of print data. The <A
13086 HREF="#WRITEABLE"
13087 ><TT
13088 CLASS="PARAMETER"
13089 ><I
13090 >writeable
13091                 </I
13092 ></TT
13093 ></A
13094 > parameter controls only non-printing access to
13095                 the resource.</P
13096 ><P
13097 >Default: <B
13098 CLASS="COMMAND"
13099 >printable = no</B
13100 ></P
13101 ></DD
13102 ><DT
13103 ><A
13104 NAME="PRINTCAP"
13105 ></A
13106 >printcap (G)</DT
13107 ><DD
13108 ><P
13109 >Synonym for    <A
13110 HREF="#PRINTCAPNAME"
13111 ><TT
13112 CLASS="PARAMETER"
13113 ><I
13114 >               printcap name</I
13115 ></TT
13116 ></A
13117 >.</P
13118 ></DD
13119 ><DT
13120 ><A
13121 NAME="PRINTCAPNAME"
13122 ></A
13123 >printcap name (G)</DT
13124 ><DD
13125 ><P
13126 >This parameter may be used to override the
13127                 compiled-in default printcap name used by the server (usually <TT
13128 CLASS="FILENAME"
13129 >               /etc/printcap</TT
13130 >). See the discussion of the <A
13131 HREF="#AEN78"
13132 >[printers]</A
13133 > section above for reasons
13134                 why you might want to do this.</P
13135 ><P
13136 >On System V systems that use <B
13137 CLASS="COMMAND"
13138 >lpstat</B
13139 > to
13140                 list available printers you can use <B
13141 CLASS="COMMAND"
13142 >printcap name = lpstat
13143                 </B
13144 > to automatically obtain lists of available printers. This
13145                 is the default for systems that define SYSV at configure time in
13146                 Samba (this includes most System V based systems). If <TT
13147 CLASS="PARAMETER"
13148 ><I
13149 >               printcap name</I
13150 ></TT
13151 > is set to <B
13152 CLASS="COMMAND"
13153 >lpstat</B
13154 > on
13155                 these systems then Samba will launch <B
13156 CLASS="COMMAND"
13157 >lpstat -v</B
13158 > and
13159                 attempt to parse the output to obtain a printer list.</P
13160 ><P
13161 >A minimal printcap file would look something like this:</P
13162 ><P
13163 ><TABLE
13164 BORDER="0"
13165 BGCOLOR="#E0E0E0"
13166 WIDTH="90%"
13167 ><TR
13168 ><TD
13169 ><PRE
13170 CLASS="PROGRAMLISTING"
13171 >               print1|My Printer 1
13172                 print2|My Printer 2
13173                 print3|My Printer 3
13174                 print4|My Printer 4
13175                 print5|My Printer 5
13176                 </PRE
13177 ></TD
13178 ></TR
13179 ></TABLE
13180 ></P
13181 ><P
13182 >where the '|' separates aliases of a printer. The fact
13183                 that the second alias has a space in it gives a hint to Samba
13184                 that it's a comment.</P
13185 ><P
13186 ><EM
13187 >NOTE</EM
13188 >: Under AIX the default printcap
13189                 name is <TT
13190 CLASS="FILENAME"
13191 >/etc/qconfig</TT
13192 >. Samba will assume the
13193                 file is in AIX <TT
13194 CLASS="FILENAME"
13195 >qconfig</TT
13196 > format if the string
13197                 <TT
13198 CLASS="FILENAME"
13199 >qconfig</TT
13200 > appears in the printcap filename.</P
13201 ><P
13202 >Default: <B
13203 CLASS="COMMAND"
13204 >printcap name = /etc/printcap</B
13205 ></P
13206 ><P
13207 >Example: <B
13208 CLASS="COMMAND"
13209 >printcap name = /etc/myprintcap</B
13210 ></P
13211 ></DD
13212 ><DT
13213 ><A
13214 NAME="PRINTERADMIN"
13215 ></A
13216 >printer admin (S)</DT
13217 ><DD
13218 ><P
13219 >This is a list of users that can do anything to
13220                 printers via the remote administration interfaces offered by MS-RPC
13221                 (usually using a NT workstation). Note that the root user always
13222                 has admin rights.</P
13223 ><P
13224 >Default: <B
13225 CLASS="COMMAND"
13226 >printer admin = &#60;empty string&#62;</B
13227 >
13228                 </P
13229 ><P
13230 >Example: <B
13231 CLASS="COMMAND"
13232 >printer admin = admin, @staff</B
13233 ></P
13234 ></DD
13235 ><DT
13236 ><A
13237 NAME="PRINTERDRIVER"
13238 ></A
13239 >printer driver (S)</DT
13240 ><DD
13241 ><P
13242 ><EM
13243 >Note :</EM
13244 >This is a depreciated
13245                 parameter and will be removed in the next major release
13246                 following version 2.2.  Please see the instructions in
13247                 <TT
13248 CLASS="FILENAME"
13249 >PRINTER_DRIVER2.txt</TT
13250 > in the <TT
13251 CLASS="FILENAME"
13252 >docs
13253                 </TT
13254 > of the Samba distribution for more information
13255                 on the new method of loading printer drivers onto a Samba server.
13256                 </P
13257 ><P
13258 >This option allows you to control the string
13259                 that clients receive when they ask the server for the printer driver
13260                 associated with a printer. If you are using Windows95 or Windows NT
13261                 then you can use this to automate the setup of printers on your
13262                 system.</P
13263 ><P
13264 >You need to set this parameter to the exact string (case
13265                 sensitive) that describes the appropriate printer driver for your
13266                 system. If you don't know the exact string to use then you should
13267                 first try with no <A
13268 HREF="#PRINTERDRIVER"
13269 ><TT
13270 CLASS="PARAMETER"
13271 ><I
13272 >               printer driver</I
13273 ></TT
13274 ></A
13275 > option set and the client will
13276                 give you a list of printer drivers. The appropriate strings are
13277                 shown in a scroll box after you have chosen the printer manufacturer.</P
13278 ><P
13279 >See also <A
13280 HREF="#PRINTERDRIVERFILE"
13281 ><TT
13282 CLASS="PARAMETER"
13283 ><I
13284 >printer
13285                 driver file</I
13286 ></TT
13287 ></A
13288 >.</P
13289 ><P
13290 >Example: <B
13291 CLASS="COMMAND"
13292 >printer driver = HP LaserJet 4L</B
13293 ></P
13294 ></DD
13295 ><DT
13296 ><A
13297 NAME="PRINTERDRIVERFILE"
13298 ></A
13299 >printer driver file (G)</DT
13300 ><DD
13301 ><P
13302 ><EM
13303 >Note :</EM
13304 >This is a depreciated
13305                 parameter and will be removed in the next major release
13306                 following version 2.2.  Please see the instructions in
13307                 <TT
13308 CLASS="FILENAME"
13309 >PRINTER_DRIVER2.txt</TT
13310 > in the <TT
13311 CLASS="FILENAME"
13312 >docs
13313                 </TT
13314 > of the Samba distribution for more information
13315                 on the new method of loading printer drivers onto a Samba server.
13316                 </P
13317 ><P
13318 >This parameter tells Samba where the printer driver
13319                 definition file, used when serving drivers to Windows 95 clients, is
13320                 to be found. If this is not set, the default is :</P
13321 ><P
13322 ><TT
13323 CLASS="FILENAME"
13324 ><TT
13325 CLASS="REPLACEABLE"
13326 ><I
13327 >SAMBA_INSTALL_DIRECTORY</I
13328 ></TT
13329 >
13330                 /lib/printers.def</TT
13331 ></P
13332 ><P
13333 >This file is created from Windows 95 <TT
13334 CLASS="FILENAME"
13335 >msprint.inf
13336                 </TT
13337 > files found on the Windows 95 client system. For more
13338                 details on setting up serving of printer drivers to Windows 95
13339                 clients, see the documentation file in the <TT
13340 CLASS="FILENAME"
13341 >docs/</TT
13342 >
13343                 directory, <TT
13344 CLASS="FILENAME"
13345 >PRINTER_DRIVER.txt</TT
13346 >.</P
13347 ><P
13348 >See also <A
13349 HREF="#PRINTERDRIVERLOCATION"
13350 ><TT
13351 CLASS="PARAMETER"
13352 ><I
13353 >               printer driver location</I
13354 ></TT
13355 ></A
13356 >.</P
13357 ><P
13358 >Default: <EM
13359 >None (set in compile).</EM
13360 ></P
13361 ><P
13362 >Example: <B
13363 CLASS="COMMAND"
13364 >printer driver file =
13365                 /usr/local/samba/printers/drivers.def</B
13366 ></P
13367 ></DD
13368 ><DT
13369 ><A
13370 NAME="PRINTERDRIVERLOCATION"
13371 ></A
13372 >printer driver location (S)</DT
13373 ><DD
13374 ><P
13375 ><EM
13376 >Note :</EM
13377 >This is a depreciated
13378                 parameter and will be removed in the next major release
13379                 following version 2.2.  Please see the instructions in
13380                 <TT
13381 CLASS="FILENAME"
13382 >PRINTER_DRIVER2.txt</TT
13383 > in the <TT
13384 CLASS="FILENAME"
13385 >docs
13386                 </TT
13387 > of the Samba distribution for more information
13388                 on the new method of loading printer drivers onto a Samba server.
13389                 </P
13390 ><P
13391 >This parameter tells clients of a particular printer
13392                 share where to find the printer driver files for the automatic
13393                 installation of drivers for Windows 95 machines. If Samba is set up
13394                 to serve printer drivers to Windows 95 machines, this should be set to</P
13395 ><P
13396 ><B
13397 CLASS="COMMAND"
13398 >\\MACHINE\PRINTER$</B
13399 ></P
13400 ><P
13401 >Where MACHINE is the NetBIOS name of your Samba server,
13402                 and PRINTER$ is a share you set up for serving printer driver
13403                 files. For more details on setting this up see the documentation
13404                 file in the <TT
13405 CLASS="FILENAME"
13406 >docs/</TT
13407 > directory, <TT
13408 CLASS="FILENAME"
13409 >               PRINTER_DRIVER.txt</TT
13410 >.</P
13411 ><P
13412 >See also <A
13413 HREF="#PRINTERDRIVERFILE"
13414 ><TT
13415 CLASS="PARAMETER"
13416 ><I
13417 >               printer driver file</I
13418 ></TT
13419 ></A
13420 >.</P
13421 ><P
13422 >Default: <B
13423 CLASS="COMMAND"
13424 >none</B
13425 ></P
13426 ><P
13427 >Example: <B
13428 CLASS="COMMAND"
13429 >printer driver location = \\MACHINE\PRINTER$
13430                 </B
13431 ></P
13432 ></DD
13433 ><DT
13434 ><A
13435 NAME="PRINTERNAME"
13436 ></A
13437 >printer name (S)</DT
13438 ><DD
13439 ><P
13440 >This parameter specifies the name of the printer
13441                 to which print jobs spooled through a printable service will be sent.</P
13442 ><P
13443 >If specified in the [global] section, the printer
13444                 name given will be used for any printable service that does
13445                 not have its own printer name specified.</P
13446 ><P
13447 >Default: <EM
13448 >none (but may be <TT
13449 CLASS="CONSTANT"
13450 >lp</TT
13451 >
13452                 on many systems)</EM
13453 ></P
13454 ><P
13455 >Example: <B
13456 CLASS="COMMAND"
13457 >printer name = laserwriter</B
13458 ></P
13459 ></DD
13460 ><DT
13461 ><A
13462 NAME="PRINTER"
13463 ></A
13464 >printer (S)</DT
13465 ><DD
13466 ><P
13467 >Synonym for <A
13468 HREF="#PRINTERNAME"
13469 ><TT
13470 CLASS="PARAMETER"
13471 ><I
13472 >               printer name</I
13473 ></TT
13474 ></A
13475 >.</P
13476 ></DD
13477 ><DT
13478 ><A
13479 NAME="PRINTING"
13480 ></A
13481 >printing (S)</DT
13482 ><DD
13483 ><P
13484 >This parameters controls how printer status
13485                 information is interpreted on your system. It also affects the
13486                 default values for the <TT
13487 CLASS="PARAMETER"
13488 ><I
13489 >print command</I
13490 ></TT
13491 >,
13492                 <TT
13493 CLASS="PARAMETER"
13494 ><I
13495 >lpq command</I
13496 ></TT
13497 >, <TT
13498 CLASS="PARAMETER"
13499 ><I
13500 >lppause command
13501                 </I
13502 ></TT
13503 >, <TT
13504 CLASS="PARAMETER"
13505 ><I
13506 >lpresume command</I
13507 ></TT
13508 >, and
13509                 <TT
13510 CLASS="PARAMETER"
13511 ><I
13512 >lprm command</I
13513 ></TT
13514 > if specified in the
13515                 [global]f&#62; section.</P
13516 ><P
13517 >Currently eight printing styles are supported. They are
13518                 <TT
13519 CLASS="CONSTANT"
13520 >BSD</TT
13521 >, <TT
13522 CLASS="CONSTANT"
13523 >AIX</TT
13524 >,
13525                 <TT
13526 CLASS="CONSTANT"
13527 >LPRNG</TT
13528 >, <TT
13529 CLASS="CONSTANT"
13530 >PLP</TT
13531 >,
13532                 <TT
13533 CLASS="CONSTANT"
13534 >SYSV</TT
13535 >, <TT
13536 CLASS="CONSTANT"
13537 >HPUX</TT
13538 >,
13539                 <TT
13540 CLASS="CONSTANT"
13541 >QNX</TT
13542 >, <TT
13543 CLASS="CONSTANT"
13544 >SOFTQ</TT
13545 >,
13546                 and <TT
13547 CLASS="CONSTANT"
13548 >CUPS</TT
13549 >.</P
13550 ><P
13551 >To see what the defaults are for the other print
13552                 commands when using the various options use the <A
13553 HREF="testparm.1.html"
13554 TARGET="_top"
13555 >testparm(1)</A
13556 > program.</P
13557 ><P
13558 >This option can be set on a per printer basis</P
13559 ><P
13560 >See also the discussion in the <A
13561 HREF="#AEN78"
13562 >               [printers]</A
13563 > section.</P
13564 ></DD
13565 ><DT
13566 ><A
13567 NAME="PROTOCOL"
13568 ></A
13569 >protocol (G)</DT
13570 ><DD
13571 ><P
13572 >Synonym for <A
13573 HREF="#MAXPROTOCOL"
13574 >               <TT
13575 CLASS="PARAMETER"
13576 ><I
13577 >max protocol</I
13578 ></TT
13579 ></A
13580 >.</P
13581 ></DD
13582 ><DT
13583 ><A
13584 NAME="PUBLIC"
13585 ></A
13586 >public (S)</DT
13587 ><DD
13588 ><P
13589 >Synonym for <A
13590 HREF="#GUESTOK"
13591 ><TT
13592 CLASS="PARAMETER"
13593 ><I
13594 >guest
13595                 ok</I
13596 ></TT
13597 ></A
13598 >.</P
13599 ></DD
13600 ><DT
13601 ><A
13602 NAME="QUEUEPAUSECOMMAND"
13603 ></A
13604 >queuepause command (S)</DT
13605 ><DD
13606 ><P
13607 >This parameter specifies the command to be
13608                 executed on the server host in order to pause the printerqueue.</P
13609 ><P
13610 >This command should be a program or script which takes
13611                 a printer name as its only parameter and stops the printerqueue,
13612                 such that no longer jobs are submitted to the printer.</P
13613 ><P
13614 >This command is not supported by Windows for Workgroups,
13615                 but can be issued from the Printer's window under Windows 95
13616                 and NT.</P
13617 ><P
13618 >If a <TT
13619 CLASS="PARAMETER"
13620 ><I
13621 >%p</I
13622 ></TT
13623 > is given then the printername
13624                 is put in its place. Otherwise it is placed at the end of the command.
13625                 </P
13626 ><P
13627 >Note that it is good practice to include the absolute
13628                 path in the command as the PATH may not be available to the
13629                 server.</P
13630 ><P
13631 >Default: <EM
13632 >depends on the setting of <TT
13633 CLASS="PARAMETER"
13634 ><I
13635 >printing
13636                 </I
13637 ></TT
13638 ></EM
13639 ></P
13640 ><P
13641 >Example: <B
13642 CLASS="COMMAND"
13643 >queuepause command = disable %p</B
13644 ></P
13645 ></DD
13646 ><DT
13647 ><A
13648 NAME="QUEUERESUMECOMMAND"
13649 ></A
13650 >queueresume command (S)</DT
13651 ><DD
13652 ><P
13653 >This parameter specifies the command to be
13654                 executed on the server host in order to resume the printerqueue. It
13655                 is the command to undo the behavior that is caused by the
13656                 previous parameter (<A
13657 HREF="#QUEUEPAUSECOMMAND"
13658 ><TT
13659 CLASS="PARAMETER"
13660 ><I
13661 >               queuepause command</I
13662 ></TT
13663 ></A
13664 >).</P
13665 ><P
13666 >This command should be a program or script which takes
13667                 a printer name as its only parameter and resumes the printerqueue,
13668                 such that queued jobs are resubmitted to the printer.</P
13669 ><P
13670 >This command is not supported by Windows for Workgroups,
13671                 but can be issued from the Printer's window under Windows 95
13672                 and NT.</P
13673 ><P
13674 >If a <TT
13675 CLASS="PARAMETER"
13676 ><I
13677 >%p</I
13678 ></TT
13679 > is given then the printername
13680                 is put in its place. Otherwise it is placed at the end of the
13681                 command.</P
13682 ><P
13683 >Note that it is good practice to include the absolute
13684                 path in the command as the PATH may not be available to the
13685                 server.</P
13686 ><P
13687 >Default: <EM
13688 >depends on the setting of <A
13689 HREF="#PRINTING"
13690 ><TT
13691 CLASS="PARAMETER"
13692 ><I
13693 >printing</I
13694 ></TT
13695 ></A
13696 ></EM
13697 >
13698                 </P
13699 ><P
13700 >Example: <B
13701 CLASS="COMMAND"
13702 >queuepause command = enable %p
13703                 </B
13704 ></P
13705 ></DD
13706 ><DT
13707 ><A
13708 NAME="READBMPX"
13709 ></A
13710 >read bmpx (G)</DT
13711 ><DD
13712 ><P
13713 >This boolean parameter controls whether <A
13714 HREF="smbd.8.html"
13715 TARGET="_top"
13716 >smbd(8)</A
13717 > will support the "Read
13718                 Block Multiplex" SMB. This is now rarely used and defaults to
13719                 <TT
13720 CLASS="CONSTANT"
13721 >no</TT
13722 >. You should never need to set this
13723                 parameter.</P
13724 ><P
13725 >Default: <B
13726 CLASS="COMMAND"
13727 >read bmpx = no</B
13728 ></P
13729 ></DD
13730 ><DT
13731 ><A
13732 NAME="READLIST"
13733 ></A
13734 >read list (S)</DT
13735 ><DD
13736 ><P
13737 >This is a list of users that are given read-only
13738                 access to a service. If the connecting user is in this list then
13739                 they will not be given write access, no matter what the <A
13740 HREF="#WRITEABLE"
13741 ><TT
13742 CLASS="PARAMETER"
13743 ><I
13744 >writeable</I
13745 ></TT
13746 ></A
13747 >
13748                 option is set to. The list can include group names using the
13749                 syntax described in the <A
13750 HREF="#INVALIDUSERS"
13751 ><TT
13752 CLASS="PARAMETER"
13753 ><I
13754 >               invalid users</I
13755 ></TT
13756 ></A
13757 > parameter.</P
13758 ><P
13759 >See also the <A
13760 HREF="#WRITELIST"
13761 ><TT
13762 CLASS="PARAMETER"
13763 ><I
13764 >               write list</I
13765 ></TT
13766 ></A
13767 > parameter and the <A
13768 HREF="#INVALIDUSERS"
13769 ><TT
13770 CLASS="PARAMETER"
13771 ><I
13772 >invalid users</I
13773 ></TT
13774 >
13775                 </A
13776 > parameter.</P
13777 ><P
13778 >Default: <B
13779 CLASS="COMMAND"
13780 >read list = &#60;empty string&#62;</B
13781 ></P
13782 ><P
13783 >Example: <B
13784 CLASS="COMMAND"
13785 >read list = mary, @students</B
13786 ></P
13787 ></DD
13788 ><DT
13789 ><A
13790 NAME="READONLY"
13791 ></A
13792 >read only (S)</DT
13793 ><DD
13794 ><P
13795 >Note that this is an inverted synonym for <A
13796 HREF="#WRITEABLE"
13797 ><TT
13798 CLASS="PARAMETER"
13799 ><I
13800 >writeable</I
13801 ></TT
13802 ></A
13803 >.</P
13804 ></DD
13805 ><DT
13806 ><A
13807 NAME="READRAW"
13808 ></A
13809 >read raw (G)</DT
13810 ><DD
13811 ><P
13812 >This parameter controls whether or not the server
13813                 will support the raw read SMB requests when transferring data
13814                 to clients.</P
13815 ><P
13816 >If enabled, raw reads allow reads of 65535 bytes in
13817                 one packet. This typically provides a major performance benefit.
13818                 </P
13819 ><P
13820 >However, some clients either negotiate the allowable
13821                 block size incorrectly or are incapable of supporting larger block
13822                 sizes, and for these clients you may need to disable raw reads.</P
13823 ><P
13824 >In general this parameter should be viewed as a system tuning
13825                 tool and left severely alone. See also <A
13826 HREF="#WRITERAW"
13827 >               <TT
13828 CLASS="PARAMETER"
13829 ><I
13830 >write raw</I
13831 ></TT
13832 ></A
13833 >.</P
13834 ><P
13835 >Default: <B
13836 CLASS="COMMAND"
13837 >read raw = yes</B
13838 ></P
13839 ></DD
13840 ><DT
13841 ><A
13842 NAME="READSIZE"
13843 ></A
13844 >read size (G)</DT
13845 ><DD
13846 ><P
13847 >The option <TT
13848 CLASS="PARAMETER"
13849 ><I
13850 >read size</I
13851 ></TT
13852 >
13853                 affects the overlap of disk reads/writes with network reads/writes.
13854                 If the amount of data being transferred in several of the SMB
13855                 commands (currently SMBwrite, SMBwriteX and SMBreadbraw) is larger
13856                 than this value then the server begins writing the data before it
13857                 has received the whole packet from the network, or in the case of
13858                 SMBreadbraw, it begins writing to the network before all the data
13859                 has been read from disk.</P
13860 ><P
13861 >This overlapping works best when the speeds of disk and
13862                 network access are similar, having very little effect when the
13863                 speed of one is much greater than the other.</P
13864 ><P
13865 >The default value is 16384, but very little experimentation
13866                 has been done yet to determine the optimal value, and it is likely
13867                 that the best value will vary greatly between systems anyway.
13868                 A value over 65536 is pointless and will cause you to allocate
13869                 memory unnecessarily.</P
13870 ><P
13871 >Default: <B
13872 CLASS="COMMAND"
13873 >read size = 16384</B
13874 ></P
13875 ><P
13876 >Example: <B
13877 CLASS="COMMAND"
13878 >read size = 8192</B
13879 ></P
13880 ></DD
13881 ><DT
13882 ><A
13883 NAME="REMOTEANNOUNCE"
13884 ></A
13885 >remote announce (G)</DT
13886 ><DD
13887 ><P
13888 >This option allows you to setup <A
13889 HREF="nmbd.8.html"
13890 TARGET="_top"
13891 >nmbd(8)</A
13892 > to periodically announce itself
13893                 to arbitrary IP addresses with an arbitrary workgroup name.</P
13894 ><P
13895 >This is useful if you want your Samba server to appear
13896                 in a remote workgroup for which the normal browse propagation
13897                 rules don't work. The remote workgroup can be anywhere that you
13898                 can send IP packets to.</P
13899 ><P
13900 >For example:</P
13901 ><P
13902 ><B
13903 CLASS="COMMAND"
13904 >remote announce = 192.168.2.255/SERVERS
13905                 192.168.4.255/STAFF</B
13906 ></P
13907 ><P
13908 >the above line would cause nmbd to announce itself
13909                 to the two given IP addresses using the given workgroup names.
13910                 If you leave out the workgroup name then the one given in
13911                 the <A
13912 HREF="#WORKGROUP"
13913 ><TT
13914 CLASS="PARAMETER"
13915 ><I
13916 >workgroup</I
13917 ></TT
13918 ></A
13919 >
13920                 parameter is used instead.</P
13921 ><P
13922 >The IP addresses you choose would normally be the broadcast
13923                 addresses of the remote networks, but can also be the IP addresses
13924                 of known browse masters if your network config is that stable.</P
13925 ><P
13926 >See the documentation file <TT
13927 CLASS="FILENAME"
13928 >BROWSING.txt</TT
13929 >
13930                 in the <TT
13931 CLASS="FILENAME"
13932 >docs/</TT
13933 > directory.</P
13934 ><P
13935 >Default: <B
13936 CLASS="COMMAND"
13937 >remote announce = &#60;empty string&#62;
13938                 </B
13939 ></P
13940 ></DD
13941 ><DT
13942 ><A
13943 NAME="REMOTEBROWSESYNC"
13944 ></A
13945 >remote browse sync (G)</DT
13946 ><DD
13947 ><P
13948 >This option allows you to setup <A
13949 HREF="nmbd.8.html"
13950 TARGET="_top"
13951 >nmbd(8)</A
13952 > to periodically request
13953                 synchronization of browse lists with the master browser of a samba
13954                 server that is on a remote segment. This option will allow you to
13955                 gain browse lists for multiple workgroups across routed networks. This
13956                 is done in a manner that does not work with any non-samba servers.</P
13957 ><P
13958 >This is useful if you want your Samba server and all local
13959                 clients to appear in a remote workgroup for which the normal browse
13960                 propagation rules don't work. The remote workgroup can be anywhere
13961                 that you can send IP packets to.</P
13962 ><P
13963 >For example:</P
13964 ><P
13965 ><B
13966 CLASS="COMMAND"
13967 >remote browse sync = 192.168.2.255 192.168.4.255
13968                 </B
13969 ></P
13970 ><P
13971 >the above line would cause <B
13972 CLASS="COMMAND"
13973 >nmbd</B
13974 > to request
13975                 the master browser on the specified subnets or addresses to
13976                 synchronize their browse lists with the local server.</P
13977 ><P
13978 >The IP addresses you choose would normally be the broadcast
13979                 addresses of the remote networks, but can also be the IP addresses
13980                 of known browse masters if your network config is that stable. If
13981                 a machine IP address is given Samba makes NO attempt to validate
13982                 that the remote machine is available, is listening, nor that it
13983                 is in fact the browse master on it's segment.</P
13984 ><P
13985 >Default: <B
13986 CLASS="COMMAND"
13987 >remote browse sync = &#60;empty string&#62;
13988                 </B
13989 ></P
13990 ></DD
13991 ><DT
13992 ><A
13993 NAME="RESTRICTANONYMOUS"
13994 ></A
13995 >restrict anonymous (G)</DT
13996 ><DD
13997 ><P
13998 >This is a boolean parameter.  If it is true, then
13999                 anonymous access to the server will be restricted, namely in the
14000                 case where the server is expecting the client to send a username,
14001                 but it doesn't.  Setting it to true will force these anonymous
14002                 connections to be denied, and the client will be required to always
14003                 supply a username and password when connecting. Use of this parameter
14004                 is only recommended for homogeneous NT client environments.</P
14005 ><P
14006 >This parameter makes the use of macro expansions that rely
14007                 on the username (%U, %G, etc) consistent.  NT 4.0
14008                 likes to use anonymous connections when refreshing the share list,
14009                 and this is a way to work around that.</P
14010 ><P
14011 >When restrict anonymous is true, all anonymous connections
14012                 are denied no matter what they are for.  This can effect the ability
14013                 of a machine to access the samba Primary Domain Controller to revalidate
14014                 it's machine account after someone else has logged on the client
14015                 interactively.  The NT client will display a message saying that
14016                 the machine's account in  the domain doesn't exist or the password is
14017                 bad.  The best way to deal  with this is to reboot NT client machines
14018                 between interactive logons,  using "Shutdown and Restart", rather
14019                 than "Close all programs and logon as a different user".</P
14020 ><P
14021 >Default: <B
14022 CLASS="COMMAND"
14023 >restrict anonymous = no</B
14024 ></P
14025 ></DD
14026 ><DT
14027 ><A
14028 NAME="ROOT"
14029 ></A
14030 >root (G)</DT
14031 ><DD
14032 ><P
14033 >Synonym for <A
14034 HREF="#ROOTDIRECTORY"
14035 >               <TT
14036 CLASS="PARAMETER"
14037 ><I
14038 >root directory"</I
14039 ></TT
14040 ></A
14041 >.</P
14042 ></DD
14043 ><DT
14044 ><A
14045 NAME="ROOTDIR"
14046 ></A
14047 >root dir (G)</DT
14048 ><DD
14049 ><P
14050 >Synonym for <A
14051 HREF="#ROOTDIRECTORY"
14052 >               <TT
14053 CLASS="PARAMETER"
14054 ><I
14055 >root directory"</I
14056 ></TT
14057 ></A
14058 >.</P
14059 ></DD
14060 ><DT
14061 ><A
14062 NAME="ROOTDIRECTORY"
14063 ></A
14064 >root directory (G)</DT
14065 ><DD
14066 ><P
14067 >The server will <B
14068 CLASS="COMMAND"
14069 >chroot()</B
14070 > (i.e.
14071                 Change it's root directory) to this directory on startup. This is
14072                 not strictly necessary for secure operation. Even without it the
14073                 server will deny access to files not in one of the service entries.
14074                 It may also check for, and deny access to, soft links to other
14075                 parts of the filesystem, or attempts to use ".." in file names
14076                 to access other directories (depending on the setting of the <A
14077 HREF="#WIDELINKS"
14078 ><TT
14079 CLASS="PARAMETER"
14080 ><I
14081 >wide links</I
14082 ></TT
14083 ></A
14084 >
14085                 parameter).</P
14086 ><P
14087 >Adding a <TT
14088 CLASS="PARAMETER"
14089 ><I
14090 >root directory</I
14091 ></TT
14092 > entry other
14093                 than "/" adds an extra level of security, but at a price. It
14094                 absolutely ensures that no access is given to files not in the
14095                 sub-tree specified in the <TT
14096 CLASS="PARAMETER"
14097 ><I
14098 >root directory</I
14099 ></TT
14100 >
14101                 option, <EM
14102 >including</EM
14103 > some files needed for
14104                 complete operation of the server. To maintain full operability
14105                 of the server you will need to mirror some system files
14106                 into the <TT
14107 CLASS="PARAMETER"
14108 ><I
14109 >root directory</I
14110 ></TT
14111 > tree. In particular
14112                 you will need to mirror <TT
14113 CLASS="FILENAME"
14114 >/etc/passwd</TT
14115 > (or a
14116                 subset of it), and any binaries or configuration files needed for
14117                 printing (if required). The set of files that must be mirrored is
14118                 operating system dependent.</P
14119 ><P
14120 >Default: <B
14121 CLASS="COMMAND"
14122 >root directory = /</B
14123 ></P
14124 ><P
14125 >Example: <B
14126 CLASS="COMMAND"
14127 >root directory = /homes/smb</B
14128 ></P
14129 ></DD
14130 ><DT
14131 ><A
14132 NAME="ROOTPOSTEXEC"
14133 ></A
14134 >root postexec (S)</DT
14135 ><DD
14136 ><P
14137 >This is the same as the <TT
14138 CLASS="PARAMETER"
14139 ><I
14140 >postexec</I
14141 ></TT
14142 >
14143                 parameter except that the command is run as root. This
14144                 is useful for unmounting filesystems
14145                 (such as cdroms) after a connection is closed.</P
14146 ><P
14147 >See also <A
14148 HREF="#POSTEXEC"
14149 ><TT
14150 CLASS="PARAMETER"
14151 ><I
14152 >               postexec</I
14153 ></TT
14154 ></A
14155 >.</P
14156 ><P
14157 >Default: <B
14158 CLASS="COMMAND"
14159 >root postexec = &#60;empty string&#62;
14160                 </B
14161 ></P
14162 ></DD
14163 ><DT
14164 ><A
14165 NAME="ROOTPREEXEC"
14166 ></A
14167 >root preexec (S)</DT
14168 ><DD
14169 ><P
14170 >This is the same as the <TT
14171 CLASS="PARAMETER"
14172 ><I
14173 >preexec</I
14174 ></TT
14175 >
14176                 parameter except that the command is run as root. This
14177                 is useful for mounting filesystems (such as cdroms) after a
14178                 connection is closed.</P
14179 ><P
14180 >See also <A
14181 HREF="#PREEXEC"
14182 ><TT
14183 CLASS="PARAMETER"
14184 ><I
14185 >               preexec</I
14186 ></TT
14187 ></A
14188 > and <A
14189 HREF="#PREEXECCLOSE"
14190 >               <TT
14191 CLASS="PARAMETER"
14192 ><I
14193 >preexec close</I
14194 ></TT
14195 ></A
14196 >.</P
14197 ><P
14198 >Default: <B
14199 CLASS="COMMAND"
14200 >root preexec = &#60;empty string&#62;
14201                 </B
14202 ></P
14203 ></DD
14204 ><DT
14205 ><A
14206 NAME="ROOTPREEXECCLOSE"
14207 ></A
14208 >root preexec close (S)</DT
14209 ><DD
14210 ><P
14211 >This is the same as the <TT
14212 CLASS="PARAMETER"
14213 ><I
14214 >preexec close
14215                 </I
14216 ></TT
14217 > parameter except that the command is run as root.</P
14218 ><P
14219 >See also <A
14220 HREF="#PREEXEC"
14221 ><TT
14222 CLASS="PARAMETER"
14223 ><I
14224 >               preexec</I
14225 ></TT
14226 ></A
14227 > and <A
14228 HREF="#PREEXECCLOSE"
14229 >               <TT
14230 CLASS="PARAMETER"
14231 ><I
14232 >preexec close</I
14233 ></TT
14234 ></A
14235 >.</P
14236 ><P
14237 >Default: <B
14238 CLASS="COMMAND"
14239 >root preexec close = no</B
14240 ></P
14241 ></DD
14242 ><DT
14243 ><A
14244 NAME="SECURITY"
14245 ></A
14246 >security (G)</DT
14247 ><DD
14248 ><P
14249 >This option affects how clients respond to
14250                 Samba and is one of the most important settings in the <TT
14251 CLASS="FILENAME"
14252 >               smb.conf</TT
14253 > file.</P
14254 ><P
14255 >The option sets the "security mode bit" in replies to
14256                 protocol negotiations with <A
14257 HREF="smbd.8.html"
14258 TARGET="_top"
14259 >smbd(8)
14260                 </A
14261 > to turn share level security on or off. Clients decide
14262                 based on this bit whether (and how) to transfer user and password
14263                 information to the server.</P
14264 ><P
14265 >The default is <B
14266 CLASS="COMMAND"
14267 >security = user</B
14268 >, as this is
14269                 the most common setting needed when talking to Windows 98 and
14270                 Windows NT.</P
14271 ><P
14272 >The alternatives are <B
14273 CLASS="COMMAND"
14274 >security = share</B
14275 >,
14276                 <B
14277 CLASS="COMMAND"
14278 >security = server</B
14279 > or <B
14280 CLASS="COMMAND"
14281 >security=domain
14282                 </B
14283 >.</P
14284 ><P
14285 >In versions of Samba prior to 2..0, the default was
14286                 <B
14287 CLASS="COMMAND"
14288 >security = share</B
14289 > mainly because that was
14290                 the only option at one stage.</P
14291 ><P
14292 >There is a bug in WfWg that has relevance to this
14293                 setting. When in user or server level security a WfWg client
14294                 will totally ignore the password you type in the "connect
14295                 drive" dialog box. This makes it very difficult (if not impossible)
14296                 to connect to a Samba service as anyone except the user that
14297                 you are logged into WfWg as.</P
14298 ><P
14299 >If your PCs use usernames that are the same as their
14300                 usernames on the UNIX machine then you will want to use
14301                 <B
14302 CLASS="COMMAND"
14303 >security = user</B
14304 >. If you mostly use usernames
14305                 that don't exist on the UNIX box then use <B
14306 CLASS="COMMAND"
14307 >security =
14308                 share</B
14309 >.</P
14310 ><P
14311 >You should also use <B
14312 CLASS="COMMAND"
14313 >security = share</B
14314 > if you
14315                 want to mainly setup shares without a password (guest shares). This
14316                 is commonly used for a shared printer server. It is more difficult
14317                 to setup guest shares with <B
14318 CLASS="COMMAND"
14319 >security = user</B
14320 >, see
14321                 the <A
14322 HREF="#MAPTOGUEST"
14323 ><TT
14324 CLASS="PARAMETER"
14325 ><I
14326 >map to guest</I
14327 ></TT
14328 >
14329                 </A
14330 >parameter for details.</P
14331 ><P
14332 >It is possible to use <B
14333 CLASS="COMMAND"
14334 >smbd</B
14335 > in a <EM
14336 >               hybrid mode</EM
14337 > where it is offers both user and share
14338                 level security under different <A
14339 HREF="#NETBIOSALIASES"
14340 >               <TT
14341 CLASS="PARAMETER"
14342 ><I
14343 >NetBIOS aliases</I
14344 ></TT
14345 ></A
14346 >. </P
14347 ><P
14348 >The different settings will now be explained.</P
14349 ><P
14350 ><A
14351 NAME="SECURITYEQUALSSHARE"
14352 ></A
14353 ><EM
14354 >SECURITY = SHARE
14355                 </EM
14356 ></P
14357 ><P
14358 >When clients connect to a share level security server then
14359                 need not log onto the server with a valid username and password before
14360                 attempting to connect to a shared resource (although modern clients
14361                 such as Windows 95/98 and Windows NT will send a logon request with
14362                 a username but no password when talking to a <B
14363 CLASS="COMMAND"
14364 >security = share
14365                 </B
14366 > server). Instead, the clients send authentication information
14367                 (passwords) on a per-share basis, at the time they attempt to connect
14368                 to that share.</P
14369 ><P
14370 >Note that <B
14371 CLASS="COMMAND"
14372 >smbd</B
14373 > <EM
14374 >ALWAYS</EM
14375 >
14376                 uses a valid UNIX user to act on behalf of the client, even in
14377                 <B
14378 CLASS="COMMAND"
14379 >security = share</B
14380 > level security.</P
14381 ><P
14382 >As clients are not required to send a username to the server
14383                 in share level security, <B
14384 CLASS="COMMAND"
14385 >smbd</B
14386 > uses several
14387                 techniques to determine the correct UNIX user to use on behalf
14388                 of the client.</P
14389 ><P
14390 >A list of possible UNIX usernames to match with the given
14391                 client password is constructed using the following methods :</P
14392 ><P
14393 ></P
14394 ><UL
14395 ><LI
14396 ><P
14397 >If the <A
14398 HREF="#GUESTONLY"
14399 ><TT
14400 CLASS="PARAMETER"
14401 ><I
14402 >guest
14403                         only</I
14404 ></TT
14405 ></A
14406 > parameter is set, then all the other
14407                         stages are missed and only the <A
14408 HREF="#GUESTACCOUNT"
14409 >                       <TT
14410 CLASS="PARAMETER"
14411 ><I
14412 >guest account</I
14413 ></TT
14414 ></A
14415 > username is checked.
14416                         </P
14417 ></LI
14418 ><LI
14419 ><P
14420 >Is a username is sent with the share connection
14421                         request, then this username (after mapping - see <A
14422 HREF="#USERNAMEMAP"
14423 ><TT
14424 CLASS="PARAMETER"
14425 ><I
14426 >username map</I
14427 ></TT
14428 ></A
14429 >),
14430                         is added as a potential username.</P
14431 ></LI
14432 ><LI
14433 ><P
14434 >If the client did a previous <EM
14435 >logon
14436                         </EM
14437 > request (the SessionSetup SMB call) then the
14438                         username sent in this SMB will be added as a potential username.
14439                         </P
14440 ></LI
14441 ><LI
14442 ><P
14443 >The name of the service the client requested is
14444                         added as a potential username.</P
14445 ></LI
14446 ><LI
14447 ><P
14448 >The NetBIOS name of the client is added to
14449                         the list as a potential username.</P
14450 ></LI
14451 ><LI
14452 ><P
14453 >Any users on the <A
14454 HREF="#USER"
14455 ><TT
14456 CLASS="PARAMETER"
14457 ><I
14458 >                       user</I
14459 ></TT
14460 ></A
14461 > list are added as potential usernames.
14462                         </P
14463 ></LI
14464 ></UL
14465 ><P
14466 >If the <TT
14467 CLASS="PARAMETER"
14468 ><I
14469 >guest only</I
14470 ></TT
14471 > parameter is
14472                 not set, then this list is then tried with the supplied password.
14473                 The first user for whom the password matches will be used as the
14474                 UNIX user.</P
14475 ><P
14476 >If the <TT
14477 CLASS="PARAMETER"
14478 ><I
14479 >guest only</I
14480 ></TT
14481 > parameter is
14482                 set, or no username can be determined then if the share is marked
14483                 as available to the <TT
14484 CLASS="PARAMETER"
14485 ><I
14486 >guest account</I
14487 ></TT
14488 >, then this
14489                 guest user will be used, otherwise access is denied.</P
14490 ><P
14491 >Note that it can be <EM
14492 >very</EM
14493 > confusing
14494                 in share-level security as to which UNIX username will eventually
14495                 be used in granting access.</P
14496 ><P
14497 >See also the section <A
14498 HREF="#AEN234"
14499 >               NOTE ABOUT USERNAME/PASSWORD VALIDATION</A
14500 >.</P
14501 ><P
14502 ><A
14503 NAME="SECURITYEQUALSUSER"
14504 ></A
14505 ><EM
14506 >SECURIYT = USER
14507                 </EM
14508 ></P
14509 ><P
14510 >This is the default security setting in Samba 2.2.
14511                 With user-level security a client must first "log=on" with a
14512                 valid username and password (which can be mapped using the <A
14513 HREF="#USERNAMEMAP"
14514 ><TT
14515 CLASS="PARAMETER"
14516 ><I
14517 >username map</I
14518 ></TT
14519 ></A
14520 >
14521                 parameter). Encrypted passwords (see the <A
14522 HREF="#ENCRYPTPASSWORDS"
14523 >               <TT
14524 CLASS="PARAMETER"
14525 ><I
14526 >encrypted passwords</I
14527 ></TT
14528 ></A
14529 > parameter) can also
14530                 be used in this security mode. Parameters such as <A
14531 HREF="#USER"
14532 >               <TT
14533 CLASS="PARAMETER"
14534 ><I
14535 >user</I
14536 ></TT
14537 ></A
14538 > and <A
14539 HREF="#GUESTONLY"
14540 >               <TT
14541 CLASS="PARAMETER"
14542 ><I
14543 >guest only</I
14544 ></TT
14545 ></A
14546 > if set        are then applied and
14547                 may change the UNIX user to use on this connection, but only after
14548                 the user has been successfully authenticated.</P
14549 ><P
14550 ><EM
14551 >Note</EM
14552 > that the name of the resource being
14553                 requested is <EM
14554 >not</EM
14555 > sent to the server until after
14556                 the server has successfully authenticated the client. This is why
14557                 guest shares don't work in user level security without allowing
14558                 the server to automatically map unknown users into the <A
14559 HREF="#GUESTACCOUNT"
14560 ><TT
14561 CLASS="PARAMETER"
14562 ><I
14563 >guest account</I
14564 ></TT
14565 ></A
14566 >.
14567                 See the <A
14568 HREF="#MAPTOGUEST"
14569 ><TT
14570 CLASS="PARAMETER"
14571 ><I
14572 >map to guest</I
14573 ></TT
14574 >
14575                 </A
14576 > parameter for details on doing this.</P
14577 ><P
14578 >See also the section <A
14579 HREF="#AEN234"
14580 >               NOTE ABOUT USERNAME/PASSWORD VALIDATION</A
14581 >.</P
14582 ><P
14583 ><A
14584 NAME="SECURITYEQUALSSERVER"
14585 ></A
14586 ><EM
14587 >SECURITY = SERVER
14588                 </EM
14589 ></P
14590 ><P
14591 >In this mode Samba will try to validate the username/password
14592                 by passing it to another SMB server, such as an NT box. If this
14593                 fails it will revert to <B
14594 CLASS="COMMAND"
14595 >security = user</B
14596 >, but note
14597                 that if encrypted passwords have been negotiated then Samba cannot
14598                 revert back to checking the UNIX password file, it must have a valid
14599                 <TT
14600 CLASS="FILENAME"
14601 >smbpasswd</TT
14602 > file to check users against. See the
14603                 documentation file in the <TT
14604 CLASS="FILENAME"
14605 >docs/</TT
14606 > directory
14607                 <TT
14608 CLASS="FILENAME"
14609 >ENCRYPTION.txt</TT
14610 > for details on how to set this
14611                 up.</P
14612 ><P
14613 ><EM
14614 >Note</EM
14615 > that from the clients point of
14616                 view <B
14617 CLASS="COMMAND"
14618 >security = server</B
14619 > is the same as <B
14620 CLASS="COMMAND"
14621 >               security = user</B
14622 >.  It only affects how the server deals
14623                 with the authentication, it does not in any way affect what the
14624                 client sees.</P
14625 ><P
14626 ><EM
14627 >Note</EM
14628 > that the name of the resource being
14629                 requested is <EM
14630 >not</EM
14631 > sent to the server until after
14632                 the server has successfully authenticated the client. This is why
14633                 guest shares don't work in user level security without allowing
14634                 the server to automatically map unknown users into the <A
14635 HREF="#GUESTACCOUNT"
14636 ><TT
14637 CLASS="PARAMETER"
14638 ><I
14639 >guest account</I
14640 ></TT
14641 ></A
14642 >.
14643                 See the <A
14644 HREF="#MAPTOGUEST"
14645 ><TT
14646 CLASS="PARAMETER"
14647 ><I
14648 >map to guest</I
14649 ></TT
14650 >
14651                 </A
14652 > parameter for details on doing this.</P
14653 ><P
14654 >See also the section <A
14655 HREF="#AEN234"
14656 >               NOTE ABOUT USERNAME/PASSWORD VALIDATION</A
14657 >.</P
14658 ><P
14659 >See also the <A
14660 HREF="#PASSWORDSERVER"
14661 ><TT
14662 CLASS="PARAMETER"
14663 ><I
14664 >password
14665                 server</I
14666 ></TT
14667 ></A
14668 > parameter and the <A
14669 HREF="#ENCRYPTPASSWORDS"
14670 ><TT
14671 CLASS="PARAMETER"
14672 ><I
14673 >encrypted passwords</I
14674 ></TT
14675 >
14676                 </A
14677 > parameter.</P
14678 ><P
14679 ><A
14680 NAME="SECURITYEQUALSDOMAIN"
14681 ></A
14682 ><EM
14683 >SECURITY = DOMAIN
14684                 </EM
14685 ></P
14686 ><P
14687 >This mode will only work correctly if <A
14688 HREF="smbpasswd.8.html"
14689 TARGET="_top"
14690 >smbpasswd(8)</A
14691 > has been used to add this
14692                 machine into a Windows NT Domain. It expects the <A
14693 HREF="#ENCRYPTPASSWORDS"
14694 ><TT
14695 CLASS="PARAMETER"
14696 ><I
14697 >encrypted passwords</I
14698 ></TT
14699 >
14700                 </A
14701 > parameter to be set to <TT
14702 CLASS="CONSTANT"
14703 >true</TT
14704 >. In this
14705                 mode Samba will try to validate the username/password by passing
14706                 it to a Windows NT Primary or Backup Domain Controller, in exactly
14707                 the same way that a Windows NT Server would do.</P
14708 ><P
14709 ><EM
14710 >Note</EM
14711 > that a valid UNIX user must still
14712                 exist as well as the account on the Domain Controller to allow
14713                 Samba to have a valid UNIX account to map file access to.</P
14714 ><P
14715 ><EM
14716 >Note</EM
14717 > that from the clients point
14718                 of view <B
14719 CLASS="COMMAND"
14720 >security = domain</B
14721 > is the same as <B
14722 CLASS="COMMAND"
14723 >security = user
14724                 </B
14725 >. It only affects how the server deals with the authentication,
14726                 it does not in any way affect what the client sees.</P
14727 ><P
14728 ><EM
14729 >Note</EM
14730 > that the name of the resource being
14731                 requested is <EM
14732 >not</EM
14733 > sent to the server until after
14734                 the server has successfully authenticated the client. This is why
14735                 guest shares don't work in user level security without allowing
14736                 the server to automatically map unknown users into the <A
14737 HREF="#GUESTACCOUNT"
14738 ><TT
14739 CLASS="PARAMETER"
14740 ><I
14741 >guest account</I
14742 ></TT
14743 ></A
14744 >.
14745                 See the <A
14746 HREF="#MAPTOGUEST"
14747 ><TT
14748 CLASS="PARAMETER"
14749 ><I
14750 >map to guest</I
14751 ></TT
14752 >
14753                 </A
14754 > parameter for details on doing this.</P
14755 ><P
14756 ><EM
14757 >BUG:</EM
14758 > There is currently a bug in the
14759                 implementation of <B
14760 CLASS="COMMAND"
14761 >security = domain</B
14762 > with respect
14763                 to multi-byte character set usernames. The communication with a
14764                 Domain Controller must be done in UNICODE and Samba currently
14765                 does not widen multi-byte user names to UNICODE correctly, thus
14766                 a multi-byte username will not be recognized correctly at the
14767                 Domain Controller. This issue will be addressed in a future release.</P
14768 ><P
14769 >See also the section <A
14770 HREF="#AEN234"
14771 >               NOTE ABOUT USERNAME/PASSWORD VALIDATION</A
14772 >.</P
14773 ><P
14774 >See also the <A
14775 HREF="#PASSWORDSERVER"
14776 ><TT
14777 CLASS="PARAMETER"
14778 ><I
14779 >password
14780                 server</I
14781 ></TT
14782 ></A
14783 > parameter and the <A
14784 HREF="#ENCRYPTPASSWORDS"
14785 ><TT
14786 CLASS="PARAMETER"
14787 ><I
14788 >encrypted passwords</I
14789 ></TT
14790 >
14791                 </A
14792 > parameter.</P
14793 ><P
14794 >Default: <B
14795 CLASS="COMMAND"
14796 >security = USER</B
14797 ></P
14798 ><P
14799 >Example: <B
14800 CLASS="COMMAND"
14801 >security = DOMAIN</B
14802 ></P
14803 ></DD
14804 ><DT
14805 ><A
14806 NAME="SECURITYMASK"
14807 ></A
14808 >security mask (S)</DT
14809 ><DD
14810 ><P
14811 >This parameter controls what UNIX permission
14812                 bits can be modified when a Windows NT client is manipulating
14813                 the UNIX permission on a file using the native NT security
14814                 dialog box.</P
14815 ><P
14816 >This parameter is applied as a mask (AND'ed with) to
14817                 the changed permission bits, thus preventing any bits not in
14818                 this mask from being modified. Essentially, zero bits in this
14819                 mask may be treated as a set of bits the user is not allowed
14820                 to change.</P
14821 ><P
14822 >If not set explicitly this parameter is set to the same
14823                 value as the <A
14824 HREF="#CREATEMASK"
14825 ><TT
14826 CLASS="PARAMETER"
14827 ><I
14828 >create mask
14829                 </I
14830 ></TT
14831 ></A
14832 > parameter. To allow a user to modify all the
14833                 user/group/world permissions on a file, set this parameter to
14834                 0777.</P
14835 ><P
14836 ><EM
14837 >Note</EM
14838 > that users who can access the
14839                 Samba server through other means can easily bypass this
14840                 restriction, so it is primarily useful for standalone
14841                 "appliance" systems.  Administrators of most normal systems will
14842                 probably want to set it to 0777.</P
14843 ><P
14844 >See also the <A
14845 HREF="#FORCEDIRECTORYSECURITYMODE"
14846 >               <TT
14847 CLASS="PARAMETER"
14848 ><I
14849 >force directory security mode</I
14850 ></TT
14851 ></A
14852 >,
14853                 <A
14854 HREF="#DIRECTORYSECURITYMASK"
14855 ><TT
14856 CLASS="PARAMETER"
14857 ><I
14858 >directory
14859                 security mask</I
14860 ></TT
14861 ></A
14862 >, <A
14863 HREF="#FORCESECURITYMODE"
14864 >               <TT
14865 CLASS="PARAMETER"
14866 ><I
14867 >force security mode</I
14868 ></TT
14869 ></A
14870 > parameters.</P
14871 ><P
14872 >Default: <B
14873 CLASS="COMMAND"
14874 >security mask = &#60;same as create mask&#62;
14875                 </B
14876 ></P
14877 ><P
14878 >Example: <B
14879 CLASS="COMMAND"
14880 >security mask = 0777</B
14881 ></P
14882 ></DD
14883 ><DT
14884 ><A
14885 NAME="SERVERSTRING"
14886 ></A
14887 >server string (G)</DT
14888 ><DD
14889 ><P
14890 >This controls what string will show up in the
14891                 printer comment box in print manager and next to the IPC connection
14892                 in <B
14893 CLASS="COMMAND"
14894 >net view"</B
14895 >. It can be any string that you wish
14896                 to show to your users.</P
14897 ><P
14898 >It also sets what will appear in browse lists next
14899                 to the machine name.</P
14900 ><P
14901 >A <TT
14902 CLASS="PARAMETER"
14903 ><I
14904 >%v</I
14905 ></TT
14906 > will be replaced with the Samba
14907                 version number.</P
14908 ><P
14909 >A <TT
14910 CLASS="PARAMETER"
14911 ><I
14912 >%h</I
14913 ></TT
14914 > will be replaced with the
14915                 hostname.</P
14916 ><P
14917 >Default: <B
14918 CLASS="COMMAND"
14919 >server string = Samba %v</B
14920 ></P
14921 ><P
14922 >Example: <B
14923 CLASS="COMMAND"
14924 >server string = University of GNUs Samba
14925                 Server</B
14926 ></P
14927 ></DD
14928 ><DT
14929 ><A
14930 NAME="SETDIRECTORY"
14931 ></A
14932 >set directory (S)</DT
14933 ><DD
14934 ><P
14935 >If <B
14936 CLASS="COMMAND"
14937 >set directory = no</B
14938 >, then
14939                 users of the service may not use the setdir command to change
14940                 directory.</P
14941 ><P
14942 >The <B
14943 CLASS="COMMAND"
14944 >setdir</B
14945 > command is only implemented
14946                 in the Digital Pathworks client. See the Pathworks documentation
14947                 for details.</P
14948 ><P
14949 >Default: <B
14950 CLASS="COMMAND"
14951 >set directory = no</B
14952 ></P
14953 ></DD
14954 ><DT
14955 ><A
14956 NAME="SHAREMODES"
14957 ></A
14958 >share modes (S)</DT
14959 ><DD
14960 ><P
14961 >This enables or disables the honoring of
14962                 the <TT
14963 CLASS="PARAMETER"
14964 ><I
14965 >share modes</I
14966 ></TT
14967 > during a file open. These
14968                 modes are used by clients to gain exclusive read or write access
14969                 to a file.</P
14970 ><P
14971 >These open modes are not directly supported by UNIX, so
14972                 they are simulated using shared memory, or lock files if your
14973                 UNIX doesn't support shared memory (almost all do).</P
14974 ><P
14975 >The share modes that are enabled by this option are
14976                 <TT
14977 CLASS="CONSTANT"
14978 >DENY_DOS</TT
14979 >, <TT
14980 CLASS="CONSTANT"
14981 >DENY_ALL</TT
14982 >,
14983                 <TT
14984 CLASS="CONSTANT"
14985 >DENY_READ</TT
14986 >, <TT
14987 CLASS="CONSTANT"
14988 >DENY_WRITE</TT
14989 >,
14990                 <TT
14991 CLASS="CONSTANT"
14992 >DENY_NONE</TT
14993 > and <TT
14994 CLASS="CONSTANT"
14995 >DENY_FCB</TT
14996 >.
14997                 </P
14998 ><P
14999 >This option gives full share compatibility and enabled
15000                 by default.</P
15001 ><P
15002 >You should <EM
15003 >NEVER</EM
15004 > turn this parameter
15005                 off as many Windows applications will break if you do so.</P
15006 ><P
15007 >Default: <B
15008 CLASS="COMMAND"
15009 >share modes = yes</B
15010 ></P
15011 ></DD
15012 ><DT
15013 ><A
15014 NAME="SHORTPRESERVECASE"
15015 ></A
15016 >short preserve case (S)</DT
15017 ><DD
15018 ><P
15019 >This boolean parameter controls if new files
15020                 which conform to 8.3 syntax, that is all in upper case and of
15021                 suitable length, are created upper case, or if they are forced
15022                 to be the <A
15023 HREF="#DEFAULTCASE"
15024 ><TT
15025 CLASS="PARAMETER"
15026 ><I
15027 >default case
15028                 </I
15029 ></TT
15030 ></A
15031 >. This  option can be use with <A
15032 HREF="#PRESERVECASE"
15033 ><B
15034 CLASS="COMMAND"
15035 >preserve case = yes</B
15036 >
15037                 </A
15038 > to permit long filenames to retain their case, while short
15039                 names are lowered. </P
15040 ><P
15041 >See the section on <A
15042 HREF="#AEN201"
15043 >               NAME MANGLING</A
15044 >.</P
15045 ><P
15046 >Default: <B
15047 CLASS="COMMAND"
15048 >short preserve case = yes</B
15049 ></P
15050 ></DD
15051 ><DT
15052 ><A
15053 NAME="SHOWADDPRINTERWIZARD"
15054 ></A
15055 >show add printer wizard (G)</DT
15056 ><DD
15057 ><P
15058 >With the introduction of MS-RPC based printing support
15059                 for Windows NT/2000 client in Samba 2.2, a "Printers..." folder will
15060                 appear on Samba hosts in the share listing.  Normally this folder will
15061                 contain an icon for the MS Add Printer Wizard (APW).  However, it is
15062                 possible to disable this feature regardless of the level of privilege
15063                 of the connected user.</P
15064 ><P
15065 >Under normal circumstances, the Windows NT/2000 client will
15066                 open a handle on the printer server with OpenPrinterEx() asking for
15067                 Administrator privileges.  If the user does not have administrative
15068                 access on the print server (i.e is not root or a member of the
15069                 <TT
15070 CLASS="PARAMETER"
15071 ><I
15072 >printer admin</I
15073 ></TT
15074 > group), the OpenPrinterEx()
15075                 call fails and the clients another open call with a request for
15076                 a lower privilege level.  This should succeed, however the APW
15077                 icon will not be displayed.</P
15078 ><P
15079 >Disabling the <TT
15080 CLASS="PARAMETER"
15081 ><I
15082 >show add printer wizard</I
15083 ></TT
15084 >
15085                 parameter will always cause the OpenPrinterEx() on the server
15086                 to fail.  Thus the APW icon will never be displayed. <EM
15087 >               Note :</EM
15088 >This does not prevent the same user from having
15089                 administrative privilege on an individual printer.</P
15090 ><P
15091 >See also <A
15092 HREF="#ADDPRINTERCOMMAND"
15093 ><TT
15094 CLASS="PARAMETER"
15095 ><I
15096 >addprinter
15097                 command</I
15098 ></TT
15099 ></A
15100 >, <A
15101 HREF="#DELETEPRINTERCOMMAND"
15102 >               <TT
15103 CLASS="PARAMETER"
15104 ><I
15105 >deleteprinter command</I
15106 ></TT
15107 ></A
15108 >, <A
15109 HREF="#PRINTERADMIN"
15110 ><TT
15111 CLASS="PARAMETER"
15112 ><I
15113 >printer admin</I
15114 ></TT
15115 ></A
15116 ></P
15117 ><P
15118 >Default :<B
15119 CLASS="COMMAND"
15120 >show add printer wizard = yes</B
15121 ></P
15122 ></DD
15123 ><DT
15124 ><A
15125 NAME="SMBPASSWDFILE"
15126 ></A
15127 >smb passwd file (G)</DT
15128 ><DD
15129 ><P
15130 >This option sets the path to the encrypted
15131                 smbpasswd file.  By default the path to the smbpasswd file
15132                 is compiled into Samba.</P
15133 ><P
15134 >Default: <B
15135 CLASS="COMMAND"
15136 >smb passwd file = ${prefix}/private/smbpasswd
15137                 </B
15138 ></P
15139 ><P
15140 >Example: <B
15141 CLASS="COMMAND"
15142 >smb passwd file = /etc/samba/smbpasswd
15143                 </B
15144 ></P
15145 ></DD
15146 ><DT
15147 ><A
15148 NAME="SOCKETADDRESS"
15149 ></A
15150 >socket address (G)</DT
15151 ><DD
15152 ><P
15153 >This option allows you to control what
15154                 address Samba will listen for connections on. This is used to
15155                 support multiple virtual interfaces on the one server, each
15156                 with a different configuration.</P
15157 ><P
15158 >By default samba will accept connections on any
15159                 address.</P
15160 ><P
15161 >Example: <B
15162 CLASS="COMMAND"
15163 >socket address = 192.168.2.20</B
15164 >
15165                 </P
15166 ></DD
15167 ><DT
15168 ><A
15169 NAME="SOCKETOPTIONS"
15170 ></A
15171 >socket options (G)</DT
15172 ><DD
15173 ><P
15174 >This option allows you to set socket options
15175                 to be used when talking with the client.</P
15176 ><P
15177 >Socket options are controls on the networking layer
15178                 of the operating systems which allow the connection to be
15179                 tuned.</P
15180 ><P
15181 >This option will typically be used to tune your Samba
15182                 server for optimal performance for your local network. There is
15183                 no way that Samba can know what the optimal parameters are for
15184                 your net, so you must experiment and choose them yourself. We
15185                 strongly suggest you read the appropriate documentation for your
15186                 operating system first (perhaps <B
15187 CLASS="COMMAND"
15188 >man setsockopt</B
15189 >
15190                 will help).</P
15191 ><P
15192 >You may find that on some systems Samba will say
15193                 "Unknown socket option" when you supply an option. This means you
15194                 either incorrectly  typed it or you need to add an include file
15195                 to includes.h for your OS.  If the latter is the case please
15196                 send the patch to <A
15197 HREF="mailto:samba@samba.org"
15198 TARGET="_top"
15199 >               samba@samba.org</A
15200 >.</P
15201 ><P
15202 >Any of the supported socket options may be combined
15203                 in any way you like, as long as your OS allows it.</P
15204 ><P
15205 >This is the list of socket options currently settable
15206                 using this option:</P
15207 ><P
15208 ></P
15209 ><UL
15210 ><LI
15211 ><P
15212 >SO_KEEPALIVE</P
15213 ></LI
15214 ><LI
15215 ><P
15216 >SO_REUSEADDR</P
15217 ></LI
15218 ><LI
15219 ><P
15220 >SO_BROADCAST</P
15221 ></LI
15222 ><LI
15223 ><P
15224 >TCP_NODELAY</P
15225 ></LI
15226 ><LI
15227 ><P
15228 >IPTOS_LOWDELAY</P
15229 ></LI
15230 ><LI
15231 ><P
15232 >IPTOS_THROUGHPUT</P
15233 ></LI
15234 ><LI
15235 ><P
15236 >SO_SNDBUF *</P
15237 ></LI
15238 ><LI
15239 ><P
15240 >SO_RCVBUF *</P
15241 ></LI
15242 ><LI
15243 ><P
15244 >SO_SNDLOWAT *</P
15245 ></LI
15246 ><LI
15247 ><P
15248 >SO_RCVLOWAT *</P
15249 ></LI
15250 ></UL
15251 ><P
15252 >Those marked with a <EM
15253 >'*'</EM
15254 > take an integer
15255                 argument. The others can optionally take a 1 or 0 argument to enable
15256                 or disable the option, by default they will be enabled if you
15257                 don't specify 1 or 0.</P
15258 ><P
15259 >To specify an argument use the syntax SOME_OPTION=VALUE
15260                 for example <B
15261 CLASS="COMMAND"
15262 >SO_SNDBUF=8192</B
15263 >. Note that you must
15264                 not have any spaces before or after the = sign.</P
15265 ><P
15266 >If you are on a local network then a sensible option
15267                 might be</P
15268 ><P
15269 ><B
15270 CLASS="COMMAND"
15271 >socket options = IPTOS_LOWDELAY</B
15272 ></P
15273 ><P
15274 >If you have a local network then you could try:</P
15275 ><P
15276 ><B
15277 CLASS="COMMAND"
15278 >socket options = IPTOS_LOWDELAY TCP_NODELAY</B
15279 ></P
15280 ><P
15281 >If you are on a wide area network then perhaps try
15282                 setting IPTOS_THROUGHPUT. </P
15283 ><P
15284 >Note that several of the options may cause your Samba
15285                 server to fail completely. Use these options with caution!</P
15286 ><P
15287 >Default: <B
15288 CLASS="COMMAND"
15289 >socket options = TCP_NODELAY</B
15290 ></P
15291 ><P
15292 >Example: <B
15293 CLASS="COMMAND"
15294 >socket options = IPTOS_LOWDELAY</B
15295 ></P
15296 ></DD
15297 ><DT
15298 ><A
15299 NAME="SOURCEENVIRONMENT"
15300 ></A
15301 >source environment (G)</DT
15302 ><DD
15303 ><P
15304 >This parameter causes Samba to set environment
15305                 variables as per the content of the file named.</P
15306 ><P
15307 >If the value of this parameter starts with a "|" character
15308                 then Samba will treat that value as a pipe command to open and
15309                 will set the environment variables from the output of the pipe.</P
15310 ><P
15311 >The contents of the file or the output of the pipe should
15312                 be formatted as the output of the standard Unix <B
15313 CLASS="COMMAND"
15314 >env(1)
15315                 </B
15316 > command. This is of the form :</P
15317 ><P
15318 >Example environment entry:</P
15319 ><P
15320 ><B
15321 CLASS="COMMAND"
15322 >SAMBA_NETBIOS_NAME=myhostname</B
15323 ></P
15324 ><P
15325 >Default: <EM
15326 >No default value</EM
15327 ></P
15328 ><P
15329 >Examples: <B
15330 CLASS="COMMAND"
15331 >source environment = |/etc/smb.conf.sh
15332                 </B
15333 ></P
15334 ><P
15335 >Example: <B
15336 CLASS="COMMAND"
15337 >source environment =
15338                 /usr/local/smb_env_vars</B
15339 ></P
15340 ></DD
15341 ><DT
15342 ><A
15343 NAME="SSL"
15344 ></A
15345 >ssl (G)</DT
15346 ><DD
15347 ><P
15348 >This variable is part of SSL-enabled Samba. This
15349                 is only available if the SSL libraries have been compiled on your
15350                 system and the configure option <B
15351 CLASS="COMMAND"
15352 >--with-ssl</B
15353 > was
15354                 given at configure time.</P
15355 ><P
15356 ><EM
15357 >Note</EM
15358 > that for export control reasons
15359                 this code is <EM
15360 >NOT</EM
15361 > enabled by default in any
15362                 current binary version of Samba.</P
15363 ><P
15364 >This variable enables or disables the entire SSL mode. If
15365                 it is set to <TT
15366 CLASS="CONSTANT"
15367 >no</TT
15368 >, the SSL enabled samba behaves
15369                 exactly like the non-SSL samba. If set to <TT
15370 CLASS="CONSTANT"
15371 >yes</TT
15372 >,
15373                 it depends on the variables <A
15374 HREF="#SSLHOSTS"
15375 ><TT
15376 CLASS="PARAMETER"
15377 ><I
15378 >               ssl hosts</I
15379 ></TT
15380 ></A
15381 > and <A
15382 HREF="#SSLHOSTSRESIGN"
15383 >               <TT
15384 CLASS="PARAMETER"
15385 ><I
15386 >ssl hosts resign</I
15387 ></TT
15388 ></A
15389 > whether an SSL
15390                 connection will be required.</P
15391 ><P
15392 >Default: <B
15393 CLASS="COMMAND"
15394 >ssl=no</B
15395 ></P
15396 ></DD
15397 ><DT
15398 ><A
15399 NAME="SSLCACERTDIR"
15400 ></A
15401 >ssl CA certDir (G)</DT
15402 ><DD
15403 ><P
15404 >This variable is part of SSL-enabled Samba. This
15405                 is only available if the SSL libraries have been compiled on your
15406                 system and the configure option <B
15407 CLASS="COMMAND"
15408 >--with-ssl</B
15409 > was
15410                 given at configure time.</P
15411 ><P
15412 ><EM
15413 >Note</EM
15414 > that for export control reasons
15415                 this code is <EM
15416 >NOT</EM
15417 > enabled by default in any
15418                 current binary version of Samba.</P
15419 ><P
15420 >This variable defines where to look up the Certification
15421                 Authorities. The given directory should contain one file for
15422                 each CA that samba will trust.  The file name must be the hash
15423                 value over the "Distinguished Name" of the CA. How this directory
15424                 is set up is explained later in this document. All files within the
15425                 directory that don't fit into this naming scheme are ignored. You
15426                 don't need this variable if you don't verify client certificates.</P
15427 ><P
15428 >Default: <B
15429 CLASS="COMMAND"
15430 >ssl CA certDir = /usr/local/ssl/certs
15431                 </B
15432 ></P
15433 ></DD
15434 ><DT
15435 ><A
15436 NAME="SSLCACERTFILE"
15437 ></A
15438 >ssl CA certFile (G)</DT
15439 ><DD
15440 ><P
15441 >This variable is part of SSL-enabled Samba. This
15442                 is only available if the SSL libraries have been compiled on your
15443                 system and the configure option <B
15444 CLASS="COMMAND"
15445 >--with-ssl</B
15446 > was
15447                 given at configure time.</P
15448 ><P
15449 ><EM
15450 >Note</EM
15451 > that for export control reasons
15452                 this code is <EM
15453 >NOT</EM
15454 > enabled by default in any
15455                 current binary version of Samba.</P
15456 ><P
15457 >This variable is a second way to define the trusted CAs.
15458                 The certificates of the trusted CAs are collected in one big
15459                 file and this variable points to the file. You will probably
15460                 only use one of the two ways to define your CAs. The first choice is
15461                 preferable if you have many CAs or want to be flexible, the second
15462                 is preferable if you only have one CA and want to keep things
15463                 simple (you won't need to create the hashed file names). You
15464                 don't need this variable if you don't verify client certificates.</P
15465 ><P
15466 >Default: <B
15467 CLASS="COMMAND"
15468 >ssl CA certFile = /usr/local/ssl/certs/trustedCAs.pem
15469                 </B
15470 ></P
15471 ></DD
15472 ><DT
15473 ><A
15474 NAME="SSLCIPHERS"
15475 ></A
15476 >ssl ciphers (G)</DT
15477 ><DD
15478 ><P
15479 >This variable is part of SSL-enabled Samba. This
15480                 is only available if the SSL libraries have been compiled on your
15481                 system and the configure option <B
15482 CLASS="COMMAND"
15483 >--with-ssl</B
15484 > was
15485                 given at configure time.</P
15486 ><P
15487 ><EM
15488 >Note</EM
15489 > that for export control reasons
15490                 this code is <EM
15491 >NOT</EM
15492 > enabled by default in any
15493                 current binary version of Samba.</P
15494 ><P
15495 >This variable defines the ciphers that should be offered
15496                 during SSL negotiation. You should not set this variable unless
15497                 you know what you are doing.</P
15498 ></DD
15499 ><DT
15500 ><A
15501 NAME="SSLCLIENTCERT"
15502 ></A
15503 >ssl client cert (G)</DT
15504 ><DD
15505 ><P
15506 >This variable is part of SSL-enabled Samba. This
15507                 is only available if the SSL libraries have been compiled on your
15508                 system and the configure option <B
15509 CLASS="COMMAND"
15510 >--with-ssl</B
15511 > was
15512                 given at configure time.</P
15513 ><P
15514 ><EM
15515 >Note</EM
15516 > that for export control reasons
15517                 this code is <EM
15518 >NOT</EM
15519 > enabled by default in any
15520                 current binary version of Samba.</P
15521 ><P
15522 >The certificate in this file is used by <A
15523 HREF="smbclient.1.html"
15524 TARGET="_top"
15525 >               <B
15526 CLASS="COMMAND"
15527 >smbclient(1)</B
15528 ></A
15529 > if it exists. It's needed
15530                 if the server requires a client certificate.</P
15531 ><P
15532 >Default: <B
15533 CLASS="COMMAND"
15534 >ssl client cert = /usr/local/ssl/certs/smbclient.pem
15535                 </B
15536 ></P
15537 ></DD
15538 ><DT
15539 ><A
15540 NAME="SSLCLIENTKEY"
15541 ></A
15542 >ssl client key (G)</DT
15543 ><DD
15544 ><P
15545 >This variable is part of SSL-enabled Samba. This
15546                 is only available if the SSL libraries have been compiled on your
15547                 system and the configure option <B
15548 CLASS="COMMAND"
15549 >--with-ssl</B
15550 > was
15551                 given at configure time.</P
15552 ><P
15553 ><EM
15554 >Note</EM
15555 > that for export control reasons
15556                 this code is <EM
15557 >NOT</EM
15558 > enabled by default in any
15559                 current binary version of Samba.</P
15560 ><P
15561 >This is the private key for <A
15562 HREF="smbclient.1.html"
15563 TARGET="_top"
15564 >               <B
15565 CLASS="COMMAND"
15566 >smbclient(1)</B
15567 ></A
15568 >. It's only needed if the
15569                 client should have a certificate. </P
15570 ><P
15571 >Default: <B
15572 CLASS="COMMAND"
15573 >ssl client key = /usr/local/ssl/private/smbclient.pem
15574                 </B
15575 ></P
15576 ></DD
15577 ><DT
15578 ><A
15579 NAME="SSLCOMPATIBILITY"
15580 ></A
15581 >ssl compatibility (G)</DT
15582 ><DD
15583 ><P
15584 >This variable is part of SSL-enabled Samba. This
15585                 is only available if the SSL libraries have been compiled on your
15586                 system and the configure option <B
15587 CLASS="COMMAND"
15588 >--with-ssl</B
15589 > was
15590                 given at configure time.</P
15591 ><P
15592 ><EM
15593 >Note</EM
15594 > that for export control reasons
15595                 this code is <EM
15596 >NOT</EM
15597 > enabled by default in any
15598                 current binary version of Samba.</P
15599 ><P
15600 >This variable defines whether SSLeay should be configured
15601                 for bug compatibility with other SSL implementations. This is
15602                 probably not desirable because currently no clients with SSL
15603                 implementations other than SSLeay exist.</P
15604 ><P
15605 >Default: <B
15606 CLASS="COMMAND"
15607 >ssl compatibility = no</B
15608 ></P
15609 ></DD
15610 ><DT
15611 ><A
15612 NAME="SSLHOSTS"
15613 ></A
15614 >ssl hosts (G)</DT
15615 ><DD
15616 ><P
15617 >See <A
15618 HREF="#SSLHOSTSRESIGN"
15619 ><TT
15620 CLASS="PARAMETER"
15621 ><I
15622 >               ssl hosts resign</I
15623 ></TT
15624 ></A
15625 >.</P
15626 ></DD
15627 ><DT
15628 ><A
15629 NAME="SSLHOSTSRESIGN"
15630 ></A
15631 >ssl hosts resign (G)</DT
15632 ><DD
15633 ><P
15634 >This variable is part of SSL-enabled Samba. This
15635                 is only available if the SSL libraries have been compiled on your
15636                 system and the configure option <B
15637 CLASS="COMMAND"
15638 >--with-ssl</B
15639 > was
15640                 given at configure time.</P
15641 ><P
15642 ><EM
15643 >Note</EM
15644 > that for export control reasons
15645                 this code is <EM
15646 >NOT</EM
15647 > enabled by default in any
15648                 current binary version of Samba.</P
15649 ><P
15650 >These two variables define whether samba will go
15651                 into SSL mode or not. If none of them is defined, samba will
15652                 allow only SSL connections. If the <A
15653 HREF="#SSLHOSTS"
15654 >               <TT
15655 CLASS="PARAMETER"
15656 ><I
15657 >ssl hosts</I
15658 ></TT
15659 ></A
15660 > variable lists
15661                 hosts (by IP-address, IP-address range, net group or name),
15662                 only these hosts will be forced into SSL mode. If the <TT
15663 CLASS="PARAMETER"
15664 ><I
15665 >               ssl hosts resign</I
15666 ></TT
15667 > variable lists hosts, only these
15668                 hosts will NOT be forced into SSL mode. The syntax for these two
15669                 variables is the same as for the <A
15670 HREF="#HOSTSALLOW"
15671 ><TT
15672 CLASS="PARAMETER"
15673 ><I
15674 >               hosts allow</I
15675 ></TT
15676 ></A
15677 > and <A
15678 HREF="#HOSTSDENY"
15679 >               <TT
15680 CLASS="PARAMETER"
15681 ><I
15682 >hosts deny</I
15683 ></TT
15684 ></A
15685 > pair of variables, only
15686                 that the subject of the decision is different: It's not the access
15687                 right but whether SSL is used or not. </P
15688 ><P
15689 >The example below requires SSL connections from all hosts
15690                 outside the local net (which is 192.168.*.*).</P
15691 ><P
15692 >Default: <B
15693 CLASS="COMMAND"
15694 >ssl hosts = &#60;empty string&#62;</B
15695 ></P
15696 ><P
15697 ><B
15698 CLASS="COMMAND"
15699 >ssl hosts resign = &#60;empty string&#62;</B
15700 ></P
15701 ><P
15702 >Example: <B
15703 CLASS="COMMAND"
15704 >ssl hosts resign = 192.168.</B
15705 ></P
15706 ></DD
15707 ><DT
15708 ><A
15709 NAME="SSLREQUIRECLIENTCERT"
15710 ></A
15711 >ssl require clientcert (G)</DT
15712 ><DD
15713 ><P
15714 >This variable is part of SSL-enabled Samba. This
15715                 is only available if the SSL libraries have been compiled on your
15716                 system and the configure option <B
15717 CLASS="COMMAND"
15718 >--with-ssl</B
15719 > was
15720                 given at configure time.</P
15721 ><P
15722 ><EM
15723 >Note</EM
15724 > that for export control reasons
15725                 this code is <EM
15726 >NOT</EM
15727 > enabled by default in any
15728                 current binary version of Samba.</P
15729 ><P
15730 >If this variable is set to <TT
15731 CLASS="CONSTANT"
15732 >yes</TT
15733 >, the
15734                 server will not tolerate connections from clients that don't
15735                 have a valid certificate. The directory/file given in <A
15736 HREF="#SSLCACERTDIR"
15737 ><TT
15738 CLASS="PARAMETER"
15739 ><I
15740 >ssl CA certDir</I
15741 ></TT
15742 >
15743                 </A
15744 > and <A
15745 HREF="#SSLCACERTFILE"
15746 ><TT
15747 CLASS="PARAMETER"
15748 ><I
15749 >ssl CA certFile
15750                 </I
15751 ></TT
15752 ></A
15753 > will be used to look up the CAs that issued
15754                 the client's certificate. If the certificate can't be verified
15755                 positively, the connection will be terminated.  If this variable
15756                 is set to <TT
15757 CLASS="CONSTANT"
15758 >no</TT
15759 >, clients don't need certificates.
15760                 Contrary to web applications you really <EM
15761 >should</EM
15762 >
15763                 require client certificates. In the web environment the client's
15764                 data is sensitive (credit card numbers) and the server must prove
15765                 to be trustworthy. In a file server environment the server's data
15766                 will be sensitive and the clients must prove to be trustworthy.</P
15767 ><P
15768 >Default: <B
15769 CLASS="COMMAND"
15770 >ssl require clientcert = no</B
15771 ></P
15772 ></DD
15773 ><DT
15774 ><A
15775 NAME="SSLREQUIRESERVERCERT"
15776 ></A
15777 >ssl require servercert (G)</DT
15778 ><DD
15779 ><P
15780 >This variable is part of SSL-enabled Samba. This
15781                 is only available if the SSL libraries have been compiled on your
15782                 system and the configure option <B
15783 CLASS="COMMAND"
15784 >--with-ssl</B
15785 > was
15786                 given at configure time.</P
15787 ><P
15788 ><EM
15789 >Note</EM
15790 > that for export control reasons
15791                 this code is <EM
15792 >NOT</EM
15793 > enabled by default in any
15794                 current binary version of Samba.</P
15795 ><P
15796 >If this variable is set to <TT
15797 CLASS="CONSTANT"
15798 >yes</TT
15799 >, the
15800                 <A
15801 HREF="smbclient.1.html"
15802 TARGET="_top"
15803 ><B
15804 CLASS="COMMAND"
15805 >smbclient(1)</B
15806 >
15807                 </A
15808 > will request a certificate from the server. Same as
15809                 <A
15810 HREF="#SSLREQUIRECLIENTCERT"
15811 ><TT
15812 CLASS="PARAMETER"
15813 ><I
15814 >ssl require
15815                 clientcert</I
15816 ></TT
15817 ></A
15818 > for the server.</P
15819 ><P
15820 >Default: <B
15821 CLASS="COMMAND"
15822 >ssl require servercert = no</B
15823 >
15824                 </P
15825 ></DD
15826 ><DT
15827 ><A
15828 NAME="SSLSERVERCERT"
15829 ></A
15830 >ssl server cert (G)</DT
15831 ><DD
15832 ><P
15833 >This variable is part of SSL-enabled Samba. This
15834                 is only available if the SSL libraries have been compiled on your
15835                 system and the configure option <B
15836 CLASS="COMMAND"
15837 >--with-ssl</B
15838 > was
15839                 given at configure time.</P
15840 ><P
15841 ><EM
15842 >Note</EM
15843 > that for export control reasons
15844                 this code is <EM
15845 >NOT</EM
15846 > enabled by default in any
15847                 current binary version of Samba.</P
15848 ><P
15849 >This is the file containing the server's certificate.
15850                 The server <EM
15851 >must</EM
15852 > have a certificate. The
15853                 file may also contain the server's private key. See later for
15854                 how certificates and private keys are created.</P
15855 ><P
15856 >Default: <B
15857 CLASS="COMMAND"
15858 >ssl server cert = &#60;empty string&#62;
15859                 </B
15860 ></P
15861 ></DD
15862 ><DT
15863 ><A
15864 NAME="SSLSERVERKEY"
15865 ></A
15866 >ssl server key (G)</DT
15867 ><DD
15868 ><P
15869 >This variable is part of SSL-enabled Samba. This
15870                 is only available if the SSL libraries have been compiled on your
15871                 system and the configure option <B
15872 CLASS="COMMAND"
15873 >--with-ssl</B
15874 > was
15875                 given at configure time.</P
15876 ><P
15877 ><EM
15878 >Note</EM
15879 > that for export control reasons
15880                 this code is <EM
15881 >NOT</EM
15882 > enabled by default in any
15883                 current binary version of Samba.</P
15884 ><P
15885 >This file contains the private key of the server. If
15886                 this variable is not defined, the key is looked up in the
15887                 certificate file (it may be appended to the certificate).
15888                 The server <EM
15889 >must</EM
15890 > have a private key
15891                 and the certificate <EM
15892 >must</EM
15893 >
15894                 match this private key.</P
15895 ><P
15896 >Default: <B
15897 CLASS="COMMAND"
15898 >ssl server key = &#60;empty string&#62;
15899                 </B
15900 ></P
15901 ></DD
15902 ><DT
15903 ><A
15904 NAME="SSLVERSION"
15905 ></A
15906 >ssl version (G)</DT
15907 ><DD
15908 ><P
15909 >This variable is part of SSL-enabled Samba. This
15910                 is only available if the SSL libraries have been compiled on your
15911                 system and the configure option <B
15912 CLASS="COMMAND"
15913 >--with-ssl</B
15914 > was
15915                 given at configure time.</P
15916 ><P
15917 ><EM
15918 >Note</EM
15919 > that for export control reasons
15920                 this code is <EM
15921 >NOT</EM
15922 > enabled by default in any
15923                 current binary version of Samba.</P
15924 ><P
15925 >This enumeration variable defines the versions of the
15926                 SSL protocol that will be used. <TT
15927 CLASS="CONSTANT"
15928 >ssl2or3</TT
15929 > allows
15930                 dynamic negotiation of SSL v2 or v3, <TT
15931 CLASS="CONSTANT"
15932 >ssl2</TT
15933 > results
15934                 in SSL v2, <TT
15935 CLASS="CONSTANT"
15936 >ssl3</TT
15937 > results in SSL v3 and
15938                 <TT
15939 CLASS="CONSTANT"
15940 >tls1</TT
15941 > results in TLS v1. TLS (Transport Layer
15942                 Security) is the new standard for SSL.</P
15943 ><P
15944 >Default: <B
15945 CLASS="COMMAND"
15946 >ssl version = "ssl2or3"</B
15947 ></P
15948 ></DD
15949 ><DT
15950 ><A
15951 NAME="STATCACHE"
15952 ></A
15953 >stat cache (G)</DT
15954 ><DD
15955 ><P
15956 >This parameter determines if <A
15957 HREF="smbd.8.html"
15958 TARGET="_top"
15959 >smbd(8)</A
15960 > will use a cache in order to
15961                 speed up case insensitive name mappings. You should never need
15962                 to change this parameter.</P
15963 ><P
15964 >Default: <B
15965 CLASS="COMMAND"
15966 >stat cache = yes</B
15967 ></P
15968 ></DD
15969 ><DT
15970 ><A
15971 NAME="STATCACHESIZE"
15972 ></A
15973 >stat cache size (G)</DT
15974 ><DD
15975 ><P
15976 >This parameter determines the number of
15977                 entries in the <TT
15978 CLASS="PARAMETER"
15979 ><I
15980 >stat cache</I
15981 ></TT
15982 >.  You should
15983                 never need to change this parameter.</P
15984 ><P
15985 >Default: <B
15986 CLASS="COMMAND"
15987 >stat cache size = 50</B
15988 ></P
15989 ></DD
15990 ><DT
15991 ><A
15992 NAME="STATUS"
15993 ></A
15994 >status (G)</DT
15995 ><DD
15996 ><P
15997 >This enables or disables logging of connections
15998                 to a status file that <A
15999 HREF="smbstatus.1.html"
16000 TARGET="_top"
16001 >smbstatus(1)</A
16002 >
16003                 can read.</P
16004 ><P
16005 >With this disabled <B
16006 CLASS="COMMAND"
16007 >smbstatus</B
16008 > won't be able
16009                 to tell you what connections are active. You should never need to
16010                 change this parameter.</P
16011 ><P
16012 >Default: <B
16013 CLASS="COMMAND"
16014 >status = yes</B
16015 ></P
16016 ></DD
16017 ><DT
16018 ><A
16019 NAME="STRICTLOCKING"
16020 ></A
16021 >strict locking (S)</DT
16022 ><DD
16023 ><P
16024 >This is a boolean that controls the handling of
16025                 file locking in the server. When this is set to <TT
16026 CLASS="CONSTANT"
16027 >yes</TT
16028 >
16029                 the server will check every read and write access for file locks, and
16030                 deny access if locks exist. This can be slow on some systems.</P
16031 ><P
16032 >When strict locking is <TT
16033 CLASS="CONSTANT"
16034 >no</TT
16035 > the server does file
16036                 lock checks only when the client explicitly asks for them.</P
16037 ><P
16038 >Well behaved clients always ask for lock checks when it
16039                 is important, so in the vast majority of cases <B
16040 CLASS="COMMAND"
16041 >strict
16042                 locking = no</B
16043 > is preferable.</P
16044 ><P
16045 >Default: <B
16046 CLASS="COMMAND"
16047 >strict locking = no</B
16048 ></P
16049 ></DD
16050 ><DT
16051 ><A
16052 NAME="STRICTSYNC"
16053 ></A
16054 >strict sync (S)</DT
16055 ><DD
16056 ><P
16057 >Many Windows applications (including the Windows
16058                 98 explorer shell) seem to confuse flushing buffer contents to
16059                 disk with doing a sync to disk. Under UNIX, a sync call forces
16060                 the process to be suspended until the kernel has ensured that
16061                 all outstanding data in kernel disk buffers has been safely stored
16062                 onto stable storage. This is very slow and should only be done
16063                 rarely. Setting this parameter to <TT
16064 CLASS="CONSTANT"
16065 >no</TT
16066 > (the
16067                 default) means that smbd ignores the Windows applications requests for
16068                 a sync call. There is only a possibility of losing data if the
16069                 operating system itself that Samba is running on crashes, so there is
16070                 little danger in this default setting. In addition, this fixes many
16071                 performance problems that people have reported with the new Windows98
16072                 explorer shell file copies.</P
16073 ><P
16074 >See also the <A
16075 HREF="#SYNCALWAYS"
16076 ><TT
16077 CLASS="PARAMETER"
16078 ><I
16079 >sync
16080                 always&#62;</I
16081 ></TT
16082 ></A
16083 > parameter.</P
16084 ><P
16085 >Default: <B
16086 CLASS="COMMAND"
16087 >strict sync = no</B
16088 ></P
16089 ></DD
16090 ><DT
16091 ><A
16092 NAME="STRIPDOT"
16093 ></A
16094 >strip dot (G)</DT
16095 ><DD
16096 ><P
16097 >This is a boolean that controls whether to
16098                 strip trailing dots off UNIX filenames. This helps with some
16099                 CDROMs that have filenames ending in a single dot.</P
16100 ><P
16101 >Default: <B
16102 CLASS="COMMAND"
16103 >strip dot = no</B
16104 ></P
16105 ></DD
16106 ><DT
16107 ><A
16108 NAME="SYNCALWAYS"
16109 ></A
16110 >sync always (S)</DT
16111 ><DD
16112 ><P
16113 >This is a boolean parameter that controls
16114                 whether writes will always be written to stable storage before
16115                 the write call returns. If this is false then the server will be
16116                 guided by the client's request in each write call (clients can
16117                 set a bit indicating that a particular write should be synchronous).
16118                 If this is true then every write will be followed by a <B
16119 CLASS="COMMAND"
16120 >fsync()
16121                 </B
16122 > call to ensure the data is written to disk. Note that
16123                 the <TT
16124 CLASS="PARAMETER"
16125 ><I
16126 >strict sync</I
16127 ></TT
16128 > parameter must be set to
16129                 <TT
16130 CLASS="CONSTANT"
16131 >yes</TT
16132 > in order for this parameter to have
16133                 any affect.</P
16134 ><P
16135 >See also the <A
16136 HREF="#STRICTSYNC"
16137 ><TT
16138 CLASS="PARAMETER"
16139 ><I
16140 >strict
16141                 sync</I
16142 ></TT
16143 ></A
16144 > parameter.</P
16145 ><P
16146 >Default: <B
16147 CLASS="COMMAND"
16148 >sync always = no</B
16149 ></P
16150 ></DD
16151 ><DT
16152 ><A
16153 NAME="SYSLOG"
16154 ></A
16155 >syslog (G)</DT
16156 ><DD
16157 ><P
16158 >This parameter maps how Samba debug messages
16159                 are logged onto the system syslog logging levels. Samba debug
16160                 level zero maps onto syslog <TT
16161 CLASS="CONSTANT"
16162 >LOG_ERR</TT
16163 >, debug
16164                 level one maps onto <TT
16165 CLASS="CONSTANT"
16166 >LOG_WARNING</TT
16167 >, debug level
16168                 two maps onto <TT
16169 CLASS="CONSTANT"
16170 >LOG_NOTICE</TT
16171 >, debug level three
16172                 maps onto LOG_INFO. All higher levels are mapped to <TT
16173 CLASS="CONSTANT"
16174 >               LOG_DEBUG</TT
16175 >.</P
16176 ><P
16177 >This parameter sets the threshold for sending messages
16178                 to syslog.  Only messages with debug level less than this value
16179                 will be sent to syslog.</P
16180 ><P
16181 >Default: <B
16182 CLASS="COMMAND"
16183 >syslog = 1</B
16184 ></P
16185 ></DD
16186 ><DT
16187 ><A
16188 NAME="SYSLOGONLY"
16189 ></A
16190 >syslog only (G)</DT
16191 ><DD
16192 ><P
16193 >If this parameter is set then Samba debug
16194                 messages are logged into the system syslog only, and not to
16195                 the debug log files.</P
16196 ><P
16197 >Default: <B
16198 CLASS="COMMAND"
16199 >syslog only = no</B
16200 ></P
16201 ></DD
16202 ><DT
16203 ><A
16204 NAME="TEMPLATEHOMEDIR"
16205 ></A
16206 >template homedir (G)</DT
16207 ><DD
16208 ><P
16209 ><EM
16210 >NOTE:</EM
16211 > this parameter is
16212                 only available in Samba 3.0.</P
16213 ><P
16214 >When filling out the user information for a Windows NT
16215                 user, the <A
16216 HREF="winbindd.8.html"
16217 TARGET="_top"
16218 >winbindd(8)</A
16219 > daemon
16220                 uses this parameter to fill in the home directory for that user.
16221                 If the string <TT
16222 CLASS="PARAMETER"
16223 ><I
16224 >%D</I
16225 ></TT
16226 > is present it is substituted
16227                 with the user's Windows NT domain name.  If the string <TT
16228 CLASS="PARAMETER"
16229 ><I
16230 >%U
16231                 </I
16232 ></TT
16233 > is present it is substituted with the user's Windows
16234                 NT user name.</P
16235 ><P
16236 >Default: <B
16237 CLASS="COMMAND"
16238 >template homedir = /home/%D/%U</B
16239 ></P
16240 ></DD
16241 ><DT
16242 ><A
16243 NAME="TEMPLATESHELL"
16244 ></A
16245 >template shell (G)</DT
16246 ><DD
16247 ><P
16248 ><EM
16249 >NOTE:</EM
16250 > this parameter is
16251                 only available in Samba 3.0.</P
16252 ><P
16253 >When filling out the user information for a Windows NT
16254                 user, the <A
16255 HREF="winbindd.8.html"
16256 TARGET="_top"
16257 >winbindd(8)</A
16258 > daemon
16259                 uses this parameter to fill in the login shell for that user.</P
16260 ><P
16261 >Default: <B
16262 CLASS="COMMAND"
16263 >template shell = /bin/false</B
16264 ></P
16265 ></DD
16266 ><DT
16267 ><A
16268 NAME="TIMEOFFSET"
16269 ></A
16270 >time offset (G)</DT
16271 ><DD
16272 ><P
16273 >This parameter is a setting in minutes to add
16274                 to the normal GMT to local time conversion. This is useful if
16275                 you are serving a lot of PCs that have incorrect daylight
16276                 saving time handling.</P
16277 ><P
16278 >Default: <B
16279 CLASS="COMMAND"
16280 >time offset = 0</B
16281 ></P
16282 ><P
16283 >Example: <B
16284 CLASS="COMMAND"
16285 >time offset = 60</B
16286 ></P
16287 ></DD
16288 ><DT
16289 ><A
16290 NAME="TIMESERVER"
16291 ></A
16292 >time server (G)</DT
16293 ><DD
16294 ><P
16295 >This parameter determines if <A
16296 HREF="nmbd.8.html"
16297 TARGET="_top"
16298 >
16299                 nmbd(8)</A
16300 > advertises itself as a time server to Windows
16301                 clients.</P
16302 ><P
16303 >Default: <B
16304 CLASS="COMMAND"
16305 >time server = no</B
16306 ></P
16307 ></DD
16308 ><DT
16309 ><A
16310 NAME="TIMESTAMPLOGS"
16311 ></A
16312 >timestamp logs (G)</DT
16313 ><DD
16314 ><P
16315 >Synonym for <A
16316 HREF="#DEBUGTIMESTAMP"
16317 ><TT
16318 CLASS="PARAMETER"
16319 ><I
16320 >               debug timestamp</I
16321 ></TT
16322 ></A
16323 >.</P
16324 ></DD
16325 ><DT
16326 ><A
16327 NAME="TOTALPRINTJOBS"
16328 ></A
16329 >total print jobs (G)</DT
16330 ><DD
16331 ><P
16332 >This parameter accepts an integer value which defines
16333                 a limit on the maximum number of print jobs that will be accepted
16334                 system wide at any given time.  If a print job is submitted
16335                 by a client which will exceed this number, then smbd will return an
16336                 error indicating that no space is available on the server.  The
16337                 default value of 0 means that no such limit exists.  This parameter
16338                 can be used to prevent a server from exceeding its capacity and is
16339                 designed as a printing throttle.  See also
16340                 <A
16341 HREF="#MAXPRINTJOBS"
16342 ><TT
16343 CLASS="PARAMETER"
16344 ><I
16345 >max print jobs</I
16346 ></TT
16347 ></A
16348 >.
16349                 </P
16350 ><P
16351 >Default: <B
16352 CLASS="COMMAND"
16353 >total print jobs = 0</B
16354 ></P
16355 ><P
16356 >Example: <B
16357 CLASS="COMMAND"
16358 >total print jobs = 5000</B
16359 ></P
16360 ></DD
16361 ><DT
16362 ><A
16363 NAME="UNIXPASSWORDSYNC"
16364 ></A
16365 >unix password sync (G)</DT
16366 ><DD
16367 ><P
16368 >This boolean parameter controls whether Samba
16369                 attempts to synchronize the UNIX password with the SMB password
16370                 when the encrypted SMB password in the smbpasswd file is changed.
16371                 If this is set to true the program specified in the <TT
16372 CLASS="PARAMETER"
16373 ><I
16374 >passwd
16375                 program</I
16376 ></TT
16377 >parameter is called <EM
16378 >AS ROOT</EM
16379 > -
16380                 to allow the new UNIX password to be set without access to the
16381                 old UNIX password (as the SMB password has change code has no
16382                 access to the old password cleartext, only the new).</P
16383 ><P
16384 >See also <A
16385 HREF="#PASSWDPROGRAM"
16386 ><TT
16387 CLASS="PARAMETER"
16388 ><I
16389 >passwd
16390                 program</I
16391 ></TT
16392 ></A
16393 >, <A
16394 HREF="#PASSWDCHAT"
16395 ><TT
16396 CLASS="PARAMETER"
16397 ><I
16398 >               passwd chat</I
16399 ></TT
16400 ></A
16401 >.</P
16402 ><P
16403 >Default: <B
16404 CLASS="COMMAND"
16405 >unix password sync = no</B
16406 ></P
16407 ></DD
16408 ><DT
16409 ><A
16410 NAME="UPDATEENCRYPTED"
16411 ></A
16412 >update encrypted (G)</DT
16413 ><DD
16414 ><P
16415 >This boolean parameter allows a user logging
16416                 on with a plaintext password to have their encrypted (hashed)
16417                 password in the smbpasswd file to be updated automatically as
16418                 they log on. This option allows a site to migrate from plaintext
16419                 password authentication (users authenticate with plaintext
16420                 password over the wire, and are checked against a UNIX account
16421                 database) to encrypted password authentication (the SMB
16422                 challenge/response authentication mechanism) without forcing
16423                 all users to re-enter their passwords via smbpasswd at the time the
16424                 change is made. This is a convenience option to allow the change over
16425                 to encrypted passwords to be made over a longer period. Once all users
16426                 have encrypted representations of their passwords in the smbpasswd
16427                 file this parameter should be set to <TT
16428 CLASS="CONSTANT"
16429 >no</TT
16430 >.</P
16431 ><P
16432 >In order for this parameter to work correctly the <A
16433 HREF="#ENCRYPTPASSWORDS"
16434 ><TT
16435 CLASS="PARAMETER"
16436 ><I
16437 >encrypt passwords</I
16438 ></TT
16439 >
16440                 </A
16441 > parameter must be set to <TT
16442 CLASS="CONSTANT"
16443 >no</TT
16444 > when
16445                 this parameter is set to <TT
16446 CLASS="CONSTANT"
16447 >yes</TT
16448 >.</P
16449 ><P
16450 >Note that even when this parameter is set a user
16451                 authenticating to <B
16452 CLASS="COMMAND"
16453 >smbd</B
16454 > must still enter a valid
16455                 password in order to connect correctly, and to update their hashed
16456                 (smbpasswd) passwords.</P
16457 ><P
16458 >Default: <B
16459 CLASS="COMMAND"
16460 >update encrypted = no</B
16461 ></P
16462 ></DD
16463 ><DT
16464 ><A
16465 NAME="USERHOSTS"
16466 ></A
16467 >use rhosts (G)</DT
16468 ><DD
16469 ><P
16470 >If this global parameter is a true, it specifies
16471                 that the UNIX users <TT
16472 CLASS="FILENAME"
16473 >.rhosts</TT
16474 > file in their home directory
16475                 will be read to find the names of hosts and users who will be allowed
16476                 access without specifying a password.</P
16477 ><P
16478 ><EM
16479 >NOTE:</EM
16480 > The use of <TT
16481 CLASS="PARAMETER"
16482 ><I
16483 >use rhosts
16484                 </I
16485 ></TT
16486 > can be a major security hole. This is because you are
16487                 trusting the PC to supply the correct username. It is very easy to
16488                 get a PC to supply a false username. I recommend that the <TT
16489 CLASS="PARAMETER"
16490 ><I
16491 >               use rhosts</I
16492 ></TT
16493 > option be only used if you really know what
16494                 you are doing.</P
16495 ><P
16496 >Default: <B
16497 CLASS="COMMAND"
16498 >use rhosts = no</B
16499 ></P
16500 ></DD
16501 ><DT
16502 ><A
16503 NAME="USER"
16504 ></A
16505 >user (S)</DT
16506 ><DD
16507 ><P
16508 >Synonym for <A
16509 HREF="#USERNAME"
16510 ><TT
16511 CLASS="PARAMETER"
16512 ><I
16513 >               username</I
16514 ></TT
16515 ></A
16516 >.</P
16517 ></DD
16518 ><DT
16519 ><A
16520 NAME="USERS"
16521 ></A
16522 >users (S)</DT
16523 ><DD
16524 ><P
16525 >Synonym for <A
16526 HREF="#USERNAME"
16527 ><TT
16528 CLASS="PARAMETER"
16529 ><I
16530 >               username</I
16531 ></TT
16532 ></A
16533 >.</P
16534 ></DD
16535 ><DT
16536 ><A
16537 NAME="USERNAME"
16538 ></A
16539 >username (S)</DT
16540 ><DD
16541 ><P
16542 >Multiple users may be specified in a comma-delimited
16543                 list, in which case the supplied password will be tested against
16544                 each username in turn (left to right).</P
16545 ><P
16546 >The <TT
16547 CLASS="PARAMETER"
16548 ><I
16549 >username</I
16550 ></TT
16551 > line is needed only when
16552                 the PC is unable to supply its own username. This is the case
16553                 for the COREPLUS protocol or where your users have different WfWg
16554                 usernames to UNIX usernames. In both these cases you may also be
16555                 better using the \\server\share%user syntax instead.</P
16556 ><P
16557 >The <TT
16558 CLASS="PARAMETER"
16559 ><I
16560 >username</I
16561 ></TT
16562 > line is not a great
16563                 solution in many cases as it means Samba will try to validate
16564                 the supplied password against each of the usernames in the
16565                 <TT
16566 CLASS="PARAMETER"
16567 ><I
16568 >username</I
16569 ></TT
16570 > line in turn. This is slow and
16571                 a bad idea for lots of users in case of duplicate passwords.
16572                 You may get timeouts or security breaches using this parameter
16573                 unwisely.</P
16574 ><P
16575 >Samba relies on the underlying UNIX security. This
16576                 parameter does not restrict who can login, it just offers hints
16577                 to the Samba server as to what usernames might correspond to the
16578                 supplied password. Users can login as whoever they please and
16579                 they will be able to do no more damage than if they started a
16580                 telnet session. The daemon runs as the user that they log in as,
16581                 so they cannot do anything that user cannot do.</P
16582 ><P
16583 >To restrict a service to a particular set of users you
16584                 can use the <A
16585 HREF="#VALIDUSERS"
16586 ><TT
16587 CLASS="PARAMETER"
16588 ><I
16589 >valid users
16590                 </I
16591 ></TT
16592 ></A
16593 > parameter.</P
16594 ><P
16595 >If any of the usernames begin with a '@' then the name
16596                 will be looked up first in the yp netgroups list (if Samba
16597                 is compiled with netgroup support), followed by a lookup in
16598                 the UNIX groups database and will expand to a list of all users
16599                 in the group of that name.</P
16600 ><P
16601 >If any of the usernames begin with a '+' then the name
16602                 will be looked up only in the UNIX groups database and will
16603                 expand to a list of all users in the group of that name.</P
16604 ><P
16605 >If any of the usernames begin with a '&#38;'then the name
16606                 will be looked up only in the yp netgroups database (if Samba
16607                 is compiled with netgroup support) and will expand to a list
16608                 of all users in the netgroup group of that name.</P
16609 ><P
16610 >Note that searching though a groups database can take
16611                 quite some time, and some clients may time out during the
16612                 search.</P
16613 ><P
16614 >See the section <A
16615 HREF="#AEN234"
16616 >NOTE ABOUT
16617                 USERNAME/PASSWORD VALIDATION</A
16618 > for more information on how
16619                 this parameter determines access to the services.</P
16620 ><P
16621 >Default: <B
16622 CLASS="COMMAND"
16623 >The guest account if a guest service,
16624                 else &#60;empty string&#62;.</B
16625 ></P
16626 ><P
16627 >Examples:<B
16628 CLASS="COMMAND"
16629 >username = fred, mary, jack, jane,
16630                 @users, @pcgroup</B
16631 ></P
16632 ></DD
16633 ><DT
16634 ><A
16635 NAME="USERNAMELEVEL"
16636 ></A
16637 >username level (G)</DT
16638 ><DD
16639 ><P
16640 >This option helps Samba to try and 'guess' at
16641                 the real UNIX username, as many DOS clients send an all-uppercase
16642                 username. By default Samba tries all lowercase, followed by the
16643                 username with the first letter capitalized, and fails if the
16644                 username is not found on the UNIX machine.</P
16645 ><P
16646 >If this parameter is set to non-zero the behavior changes.
16647                 This parameter is a number that specifies the number of uppercase
16648                 combinations to try while trying to determine the UNIX user name. The
16649                 higher the number the more combinations will be tried, but the slower
16650                 the discovery of usernames will be. Use this parameter when you have
16651                 strange usernames on your UNIX machine, such as <TT
16652 CLASS="CONSTANT"
16653 >AstrangeUser
16654                 </TT
16655 >.</P
16656 ><P
16657 >Default: <B
16658 CLASS="COMMAND"
16659 >username level = 0</B
16660 ></P
16661 ><P
16662 >Example: <B
16663 CLASS="COMMAND"
16664 >username level = 5</B
16665 ></P
16666 ></DD
16667 ><DT
16668 ><A
16669 NAME="USERNAMEMAP"
16670 ></A
16671 >username map (G)</DT
16672 ><DD
16673 ><P
16674 >This option allows you to specify a file containing
16675                 a mapping of usernames from the clients to the server. This can be
16676                 used for several purposes. The most common is to map usernames
16677                 that users use on DOS or Windows machines to those that the UNIX
16678                 box uses. The other is to map multiple users to a single username
16679                 so that they can more easily share files.</P
16680 ><P
16681 >The map file is parsed line by line. Each line should
16682                 contain a single UNIX username on the left then a '=' followed
16683                 by a list of usernames on the right. The list of usernames on the
16684                 right may contain names of the form @group in which case they
16685                 will match any UNIX username in that group. The special client
16686                 name '*' is a wildcard and matches any name. Each line of the
16687                 map file may be up to 1023 characters long.</P
16688 ><P
16689 >The file is processed on each line by taking the
16690                 supplied username and comparing it with each username on the right
16691                 hand side of the '=' signs. If the supplied name matches any of
16692                 the names on the right hand side then it is replaced with the name
16693                 on the left. Processing then continues with the next line.</P
16694 ><P
16695 >If any line begins with a '#' or a ';' then it is
16696                 ignored</P
16697 ><P
16698 >If any line begins with an '!' then the processing
16699                 will stop after that line if a mapping was done by the line.
16700                 Otherwise mapping continues with every line being processed.
16701                 Using '!' is most useful when you have a wildcard mapping line
16702                 later in the file.</P
16703 ><P
16704 >For example to map from the name <TT
16705 CLASS="CONSTANT"
16706 >admin</TT
16707 >
16708                 or <TT
16709 CLASS="CONSTANT"
16710 >administrator</TT
16711 > to the UNIX name <TT
16712 CLASS="CONSTANT"
16713 >               root</TT
16714 > you would use:</P
16715 ><P
16716 ><B
16717 CLASS="COMMAND"
16718 >root = admin administrator</B
16719 ></P
16720 ><P
16721 >Or to map anyone in the UNIX group <TT
16722 CLASS="CONSTANT"
16723 >system</TT
16724 >
16725                 to the UNIX name <TT
16726 CLASS="CONSTANT"
16727 >sys</TT
16728 > you would use:</P
16729 ><P
16730 ><B
16731 CLASS="COMMAND"
16732 >sys = @system</B
16733 ></P
16734 ><P
16735 >You can have as many mappings as you like in a username
16736                 map file.</P
16737 ><P
16738 >If your system supports the NIS NETGROUP option then
16739                 the netgroup database is checked before the <TT
16740 CLASS="FILENAME"
16741 >/etc/group
16742                 </TT
16743 > database for matching groups.</P
16744 ><P
16745 >You can map Windows usernames that have spaces in them
16746                  by using double quotes around the name. For example:</P
16747 ><P
16748 ><B
16749 CLASS="COMMAND"
16750 >tridge = "Andrew Tridgell"</B
16751 ></P
16752 ><P
16753 >would map the windows username "Andrew Tridgell" to the
16754                 unix username "tridge".</P
16755 ><P
16756 >The following example would map mary and fred to the
16757                 unix user sys, and map the rest to guest. Note the use of the
16758                 '!' to tell Samba to stop processing if it gets a match on
16759                 that line.</P
16760 ><P
16761 ><TABLE
16762 BORDER="0"
16763 BGCOLOR="#E0E0E0"
16764 WIDTH="90%"
16765 ><TR
16766 ><TD
16767 ><PRE
16768 CLASS="PROGRAMLISTING"
16769 >               !sys = mary fred
16770                 guest = *
16771                 </PRE
16772 ></TD
16773 ></TR
16774 ></TABLE
16775 ></P
16776 ><P
16777 >Note that the remapping is applied to all occurrences
16778                 of usernames. Thus if you connect to \\server\fred and <TT
16779 CLASS="CONSTANT"
16780 >               fred</TT
16781 > is remapped to <TT
16782 CLASS="CONSTANT"
16783 >mary</TT
16784 > then you
16785                 will actually be connecting to \\server\mary and will need to
16786                 supply a password suitable for <TT
16787 CLASS="CONSTANT"
16788 >mary</TT
16789 > not
16790                 <TT
16791 CLASS="CONSTANT"
16792 >fred</TT
16793 >. The only exception to this is the
16794                 username passed to the <A
16795 HREF="#PASSWORDSERVER"
16796 ><TT
16797 CLASS="PARAMETER"
16798 ><I
16799 >               password server</I
16800 ></TT
16801 ></A
16802 > (if you have one). The password
16803                 server will receive whatever username the client supplies without
16804                 modification.</P
16805 ><P
16806 >Also note that no reverse mapping is done. The main effect
16807                 this has is with printing. Users who have been mapped may have
16808                 trouble deleting print jobs as PrintManager under WfWg will think
16809                 they don't own the print job.</P
16810 ><P
16811 >Default: <EM
16812 >no username map</EM
16813 ></P
16814 ><P
16815 >Example: <B
16816 CLASS="COMMAND"
16817 >username map = /usr/local/samba/lib/users.map
16818                 </B
16819 ></P
16820 ></DD
16821 ><DT
16822 ><A
16823 NAME="UTMP"
16824 ></A
16825 >utmp (S)</DT
16826 ><DD
16827 ><P
16828 >This boolean parameter is only available if
16829                 Samba has been configured and compiled  with the option <B
16830 CLASS="COMMAND"
16831 >               --with-utmp</B
16832 >. If set to True then Samba will attempt
16833                 to add utmp or utmpx records (depending on the UNIX system) whenever a
16834                 connection is made to a Samba server. Sites may use this to record the
16835                 user connecting to a Samba share.</P
16836 ><P
16837 >See also the <A
16838 HREF="#UTMPDIRECTORY"
16839 ><TT
16840 CLASS="PARAMETER"
16841 ><I
16842 >               utmp directory</I
16843 ></TT
16844 ></A
16845 > parameter.</P
16846 ><P
16847 >Default: <B
16848 CLASS="COMMAND"
16849 >utmp = no</B
16850 ></P
16851 ></DD
16852 ><DT
16853 ><A
16854 NAME="UTMPDIRECTORY"
16855 ></A
16856 >utmp directory(G)</DT
16857 ><DD
16858 ><P
16859 >This parameter is only available if Samba has
16860                 been configured and compiled with the option <B
16861 CLASS="COMMAND"
16862 >               --with-utmp</B
16863 >. It specifies a directory pathname that is
16864                 used to store the utmp or utmpx files (depending on the UNIX system) that
16865                 record user connections to a Samba server. See also the <A
16866 HREF="#UTMP"
16867 >               <TT
16868 CLASS="PARAMETER"
16869 ><I
16870 >utmp</I
16871 ></TT
16872 ></A
16873 > parameter. By default this is
16874                 not set, meaning the system will use whatever utmp file the
16875                 native system is set to use (usually
16876                 <TT
16877 CLASS="FILENAME"
16878 >/var/run/utmp</TT
16879 > on Linux).</P
16880 ><P
16881 >Default: <EM
16882 >no utmp directory</EM
16883 ></P
16884 ></DD
16885 ><DT
16886 ><A
16887 NAME="VALIDCHARS"
16888 ></A
16889 >valid chars (G)</DT
16890 ><DD
16891 ><P
16892 >The option allows you to specify additional
16893                 characters that should be considered valid by the server in
16894                 filenames. This is particularly useful for national character
16895                 sets, such as adding u-umlaut or a-ring.</P
16896 ><P
16897 >The option takes a list of characters in either integer
16898                 or character form with spaces between them. If you give two
16899                 characters with a colon between them then it will be taken as
16900                 an lowercase:uppercase pair.</P
16901 ><P
16902 >If you have an editor capable of entering the characters
16903                 into the config file then it is probably easiest to use this
16904                 method. Otherwise you can specify the characters in octal,
16905                 decimal or hexadecimal form using the usual C notation.</P
16906 ><P
16907 >For example to add the single character 'Z' to the charset
16908                 (which is a pointless thing to do as it's already there) you could
16909                 do one of the following</P
16910 ><P
16911 ><TABLE
16912 BORDER="0"
16913 BGCOLOR="#E0E0E0"
16914 WIDTH="90%"
16915 ><TR
16916 ><TD
16917 ><PRE
16918 CLASS="PROGRAMLISTING"
16919 >               valid chars = Z
16920                 valid chars = z:Z
16921                 valid chars = 0132:0172
16922                 </PRE
16923 ></TD
16924 ></TR
16925 ></TABLE
16926 ></P
16927 ><P
16928 >The last two examples above actually add two characters,
16929                 and alter the uppercase and lowercase mappings appropriately.</P
16930 ><P
16931 >Note that you <EM
16932 >MUST</EM
16933 > specify this parameter
16934                 after the <TT
16935 CLASS="PARAMETER"
16936 ><I
16937 >client code page</I
16938 ></TT
16939 > parameter if you
16940                 have both set. If <TT
16941 CLASS="PARAMETER"
16942 ><I
16943 >client code page</I
16944 ></TT
16945 > is set after
16946                 the <TT
16947 CLASS="PARAMETER"
16948 ><I
16949 >valid chars</I
16950 ></TT
16951 > parameter the <TT
16952 CLASS="PARAMETER"
16953 ><I
16954 >valid
16955                 chars</I
16956 ></TT
16957 > settings will be overwritten.</P
16958 ><P
16959 >See also the <A
16960 HREF="#CLIENTCODEPAGE"
16961 ><TT
16962 CLASS="PARAMETER"
16963 ><I
16964 >client
16965                 code page</I
16966 ></TT
16967 ></A
16968 > parameter.</P
16969 ><P
16970 >Default: <EM
16971 >Samba defaults to using a reasonable set
16972                 of valid characters for English systems</EM
16973 ></P
16974 ><P
16975 >Example: <B
16976 CLASS="COMMAND"
16977 >valid chars = 0345:0305 0366:0326 0344:0304
16978                 </B
16979 ></P
16980 ><P
16981 >The above example allows filenames to have the Swedish
16982                 characters in them.</P
16983 ><P
16984 ><EM
16985 >NOTE:</EM
16986 > It is actually quite difficult to
16987                 correctly produce a <TT
16988 CLASS="PARAMETER"
16989 ><I
16990 >valid chars</I
16991 ></TT
16992 > line for
16993                 a particular system. To automate the process <A
16994 HREF="mailto:tino@augsburg.net"
16995 TARGET="_top"
16996 >tino@augsburg.net</A
16997 > has written
16998                 a package called <B
16999 CLASS="COMMAND"
17000 >validchars</B
17001 > which will automatically
17002                 produce a complete <TT
17003 CLASS="PARAMETER"
17004 ><I
17005 >valid chars</I
17006 ></TT
17007 > line for
17008                 a given client system. Look in the <TT
17009 CLASS="FILENAME"
17010 >examples/validchars/
17011                 </TT
17012 > subdirectory of your Samba source code distribution
17013                 for this package.</P
17014 ></DD
17015 ><DT
17016 ><A
17017 NAME="VALIDUSERS"
17018 ></A
17019 >valid users (S)</DT
17020 ><DD
17021 ><P
17022 >This is a list of users that should be allowed
17023                 to login to this service. Names starting with '@', '+' and  '&#38;'
17024                 are interpreted using the same rules as described in the
17025                 <TT
17026 CLASS="PARAMETER"
17027 ><I
17028 >invalid users</I
17029 ></TT
17030 > parameter.</P
17031 ><P
17032 >If this is empty (the default) then any user can login.
17033                 If a username is in both this list and the <TT
17034 CLASS="PARAMETER"
17035 ><I
17036 >invalid
17037                 users</I
17038 ></TT
17039 > list then access is denied for that user.</P
17040 ><P
17041 >The current servicename is substituted for <TT
17042 CLASS="PARAMETER"
17043 ><I
17044 >%S
17045                 </I
17046 ></TT
17047 >. This is useful in the [homes] section.</P
17048 ><P
17049 >See also <A
17050 HREF="#INVALIDUSERS"
17051 ><TT
17052 CLASS="PARAMETER"
17053 ><I
17054 >invalid users
17055                 </I
17056 ></TT
17057 ></A
17058 ></P
17059 ><P
17060 >Default: <EM
17061 >No valid users list (anyone can login)
17062                 </EM
17063 ></P
17064 ><P
17065 >Example: <B
17066 CLASS="COMMAND"
17067 >valid users = greg, @pcusers</B
17068 ></P
17069 ></DD
17070 ><DT
17071 ><A
17072 NAME="VETOFILES"
17073 ></A
17074 >veto files(S)</DT
17075 ><DD
17076 ><P
17077 >This is a list of files and directories that
17078                 are neither visible nor accessible.  Each entry in the list must
17079                 be separated by a '/', which allows spaces to be included
17080                 in the entry. '*' and '?' can be used to specify multiple files
17081                 or directories as in DOS wildcards.</P
17082 ><P
17083 >Each entry must be a unix path, not a DOS path and
17084                 must <EM
17085 >not</EM
17086 > include the  unix directory
17087                 separator '/'.</P
17088 ><P
17089 >Note that the <TT
17090 CLASS="PARAMETER"
17091 ><I
17092 >case sensitive</I
17093 ></TT
17094 > option
17095                 is applicable in vetoing files.</P
17096 ><P
17097 >One feature of the veto files parameter that it is important
17098                 to be aware of, is that if a directory contains nothing but files
17099                 that match the veto files parameter (which means that Windows/DOS
17100                 clients cannot ever see them) is deleted, the veto files within
17101                 that directory <EM
17102 >are automatically deleted</EM
17103 > along
17104                 with it, if the user has UNIX permissions to do so.</P
17105 ><P
17106 >Setting this parameter will affect the performance
17107                 of Samba, as it will be forced to check all files and directories
17108                 for a match as they are scanned.</P
17109 ><P
17110 >See also <A
17111 HREF="#HIDEFILES"
17112 ><TT
17113 CLASS="PARAMETER"
17114 ><I
17115 >hide files
17116                 </I
17117 ></TT
17118 ></A
17119 > and <A
17120 HREF="#CASESENSITIVE"
17121 ><TT
17122 CLASS="PARAMETER"
17123 ><I
17124 >               case sensitive</I
17125 ></TT
17126 ></A
17127 >.</P
17128 ><P
17129 >Default: <EM
17130 >No files or directories are vetoed.
17131                 </EM
17132 ></P
17133 ><P
17134 >Examples:<TABLE
17135 BORDER="0"
17136 BGCOLOR="#E0E0E0"
17137 WIDTH="90%"
17138 ><TR
17139 ><TD
17140 ><PRE
17141 CLASS="PROGRAMLISTING"
17142 >          ; Veto any files containing the word Security,
17143         ; any ending in .tmp, and any directory containing the
17144         ; word root.
17145                 veto files = /*Security*/*.tmp/*root*/
17146
17147                 ; Veto the Apple specific files that a NetAtalk server
17148         ; creates.
17149                 veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/
17150                 </PRE
17151 ></TD
17152 ></TR
17153 ></TABLE
17154 ></P
17155 ></DD
17156 ><DT
17157 ><A
17158 NAME="VETOOPLOCKFILES"
17159 ></A
17160 >veto oplock files (S)</DT
17161 ><DD
17162 ><P
17163 >This parameter is only valid when the <A
17164 HREF="#OPLOCKS"
17165 ><TT
17166 CLASS="PARAMETER"
17167 ><I
17168 >oplocks</I
17169 ></TT
17170 ></A
17171 >
17172                 parameter is turned on for a share. It allows the Samba administrator
17173                 to selectively turn off the granting of oplocks on selected files that
17174                 match a wildcarded list, similar to the wildcarded list used in the
17175                 <A
17176 HREF="#VETOFILES"
17177 ><TT
17178 CLASS="PARAMETER"
17179 ><I
17180 >veto files</I
17181 ></TT
17182 ></A
17183 >
17184                 parameter.</P
17185 ><P
17186 >Default: <EM
17187 >No files are vetoed for oplock
17188                 grants</EM
17189 ></P
17190 ><P
17191 >You might want to do this on files that you know will
17192                 be heavily contended for by clients. A good example of this
17193                 is in the NetBench SMB benchmark program, which causes heavy
17194                 client contention for files ending in <TT
17195 CLASS="FILENAME"
17196 >.SEM</TT
17197 >.
17198                 To cause Samba not to grant oplocks on these files you would use
17199                 the line (either in the [global] section or in the section for
17200                 the particular NetBench share :</P
17201 ><P
17202 >Example: <B
17203 CLASS="COMMAND"
17204 >veto oplock files = /*;.SEM/
17205                 </B
17206 ></P
17207 ></DD
17208 ><DT
17209 ><A
17210 NAME="VFSOBJECT"
17211 ></A
17212 >vfs object (S)</DT
17213 ><DD
17214 ><P
17215 >This parameter specifies a shared object file that
17216                 is used for Samba VFS I/O operations.  By default, normal
17217                 disk I/O operations are used but these can be overloaded
17218                 with a VFS object.  The Samba VFS layer is new to Samba 2.2 and
17219                 must be enabled at compile time with --with-vfs.</P
17220 ><P
17221 >Default : <EM
17222 >no value</EM
17223 ></P
17224 ></DD
17225 ><DT
17226 ><A
17227 NAME="VFSOPTIONS"
17228 ></A
17229 >vfs options (S)</DT
17230 ><DD
17231 ><P
17232 >This parameter allows parameters to be passed
17233                 to the vfs layer at initialisation time.  The Samba VFS layer
17234                 is new to Samba 2.2 and must be enabled at compile time
17235                 with --with-vfs.  See also <A
17236 HREF="#VFSOBJECT"
17237 ><TT
17238 CLASS="PARAMETER"
17239 ><I
17240 >               vfs object</I
17241 ></TT
17242 ></A
17243 >.</P
17244 ><P
17245 >Default : <EM
17246 >no value</EM
17247 ></P
17248 ></DD
17249 ><DT
17250 ><A
17251 NAME="VOLUME"
17252 ></A
17253 >volume (S)</DT
17254 ><DD
17255 ><P
17256 > This allows you to override the volume label
17257                 returned for a share. Useful for CDROMs with installation programs
17258                 that insist on a particular volume label.</P
17259 ><P
17260 >Default: <EM
17261 >the name of the share</EM
17262 ></P
17263 ></DD
17264 ><DT
17265 ><A
17266 NAME="WIDELINKS"
17267 ></A
17268 >wide links (S)</DT
17269 ><DD
17270 ><P
17271 >This parameter controls whether or not links
17272                 in the UNIX file system may be followed by the server. Links
17273                 that point to areas within the directory tree exported by the
17274                 server are always allowed; this parameter controls access only
17275                 to areas that are outside the directory tree being exported.</P
17276 ><P
17277 >Note that setting this parameter can have a negative
17278                 effect on your server performance due to the extra system calls
17279                 that Samba has to  do in order to perform the link checks.</P
17280 ><P
17281 >Default: <B
17282 CLASS="COMMAND"
17283 >wide links = yes</B
17284 ></P
17285 ></DD
17286 ><DT
17287 ><A
17288 NAME="WINBINDCACHETIME"
17289 ></A
17290 >winbind cache time</DT
17291 ><DD
17292 ><P
17293 ><EM
17294 >NOTE:</EM
17295 > this parameter is only
17296                 available in Samba 3.0.</P
17297 ><P
17298 >This parameter specifies the number of seconds the
17299                 <A
17300 HREF="winbindd.8.html"
17301 TARGET="_top"
17302 >winbindd(8)</A
17303 > daemon will cache
17304                 user and group information before querying a Windows NT server
17305                 again.</P
17306 ><P
17307 >Default: <B
17308 CLASS="COMMAND"
17309 >winbind cache type = 15</B
17310 ></P
17311 ></DD
17312 ><DT
17313 ><A
17314 NAME="WINBINDGID"
17315 ></A
17316 >winbind gid</DT
17317 ><DD
17318 ><P
17319 ><EM
17320 >NOTE:</EM
17321 > this parameter is only
17322                 available in Samba 3.0.</P
17323 ><P
17324 >The winbind gid parameter specifies the range of group
17325                 ids that are allocated by the <A
17326 HREF="winbindd.8.html"
17327 TARGET="_top"
17328 >               winbindd(8)</A
17329 > daemon.  This range of group ids should have no
17330                 existing local or nis groups within it as strange conflicts can
17331                 occur otherwise.</P
17332 ><P
17333 >Default: <B
17334 CLASS="COMMAND"
17335 >winbind gid = &#60;empty string&#62;
17336                 </B
17337 ></P
17338 ><P
17339 >Example: <B
17340 CLASS="COMMAND"
17341 >winbind gid = 10000-20000</B
17342 ></P
17343 ></DD
17344 ><DT
17345 ><A
17346 NAME="WINBINDSEPARATOR"
17347 ></A
17348 >winbind separator</DT
17349 ><DD
17350 ><P
17351 ><EM
17352 >NOTE:</EM
17353 > this parameter is only
17354                 available in Samba 3.0.</P
17355 ><P
17356 >This parameter allows an admin to define the character
17357                 used when listing a username of the form of <TT
17358 CLASS="REPLACEABLE"
17359 ><I
17360 >DOMAIN
17361                 </I
17362 ></TT
17363 >\<TT
17364 CLASS="REPLACEABLE"
17365 ><I
17366 >user</I
17367 ></TT
17368 >.  This parameter
17369                 is only applicable when using the <TT
17370 CLASS="FILENAME"
17371 >pam_winbind.so</TT
17372 >
17373                 and <TT
17374 CLASS="FILENAME"
17375 >nss_winbind.so</TT
17376 > modules for UNIX services.
17377                 </P
17378 ><P
17379 >Example: <B
17380 CLASS="COMMAND"
17381 >winbind separator = \</B
17382 ></P
17383 ><P
17384 >Example: <B
17385 CLASS="COMMAND"
17386 >winbind separator = +</B
17387 ></P
17388 ></DD
17389 ><DT
17390 ><A
17391 NAME="WINBINDUID"
17392 ></A
17393 >winbind uid</DT
17394 ><DD
17395 ><P
17396 ><EM
17397 >NOTE:</EM
17398 > this parameter is only
17399                 available in Samba 3.0.</P
17400 ><P
17401 >The winbind gid parameter specifies the range of group
17402                 ids that are allocated by the <A
17403 HREF="winbindd.8.html"
17404 TARGET="_top"
17405 >               winbindd(8)</A
17406 > daemon.  This range of ids should have no
17407                 existing local or nis users within it as strange conflicts can
17408                 occur otherwise.</P
17409 ><P
17410 >Default: <B
17411 CLASS="COMMAND"
17412 >winbind uid = &#60;empty string&#62;
17413                 </B
17414 ></P
17415 ><P
17416 >Example: <B
17417 CLASS="COMMAND"
17418 >winbind uid = 10000-20000</B
17419 ></P
17420 ></DD
17421 ><DT
17422 ><A
17423 NAME="WINSHOOK"
17424 ></A
17425 >wins hook (G)</DT
17426 ><DD
17427 ><P
17428 >When Samba is running as a WINS server this
17429                 allows you to call an external program for all changes to the
17430                 WINS database. The primary use for this option is to allow the
17431                 dynamic update of external name resolution databases such as
17432                 dynamic DNS.</P
17433 ><P
17434 >The wins hook parameter specifies the name of a script
17435                 or executable that will be called as follows:</P
17436 ><P
17437 ><B
17438 CLASS="COMMAND"
17439 >wins_hook operation name nametype ttl IP_list
17440                 </B
17441 ></P
17442 ><P
17443 ></P
17444 ><UL
17445 ><LI
17446 ><P
17447 >The first argument is the operation and is one
17448                         of "add", "delete", or "refresh". In most cases the operation can
17449                         be ignored as the rest of the parameters provide sufficient
17450                         information. Note that "refresh" may sometimes be called when the
17451                         name has not previously been added, in that case it should be treated
17452                         as an add.</P
17453 ></LI
17454 ><LI
17455 ><P
17456 >The second argument is the netbios name. If the
17457                         name is not a legal name then the wins hook is not called.
17458                         Legal names contain only  letters, digits, hyphens, underscores
17459                         and periods.</P
17460 ></LI
17461 ><LI
17462 ><P
17463 >The third argument is the netbios name
17464                         type as a 2 digit hexadecimal number. </P
17465 ></LI
17466 ><LI
17467 ><P
17468 >The fourth argument is the TTL (time to live)
17469                         for the name in seconds.</P
17470 ></LI
17471 ><LI
17472 ><P
17473 >The fifth and subsequent arguments are the IP
17474                         addresses currently registered for that name. If this list is
17475                         empty then the name should be deleted.</P
17476 ></LI
17477 ></UL
17478 ><P
17479 >An example script that calls the BIND dynamic DNS update
17480                 program <B
17481 CLASS="COMMAND"
17482 >nsupdate</B
17483 > is provided in the examples
17484                 directory of the Samba source code. </P
17485 ></DD
17486 ><DT
17487 ><A
17488 NAME="WINSPROXY"
17489 ></A
17490 >wins proxy (G)</DT
17491 ><DD
17492 ><P
17493 >This is a boolean that controls if <A
17494 HREF="nmbd.8.html"
17495 TARGET="_top"
17496 >nmbd(8)</A
17497 > will respond to broadcast name
17498                 queries on behalf of  other hosts. You may need to set this
17499                 to <TT
17500 CLASS="CONSTANT"
17501 >yes</TT
17502 > for some older clients.</P
17503 ><P
17504 >Default: <B
17505 CLASS="COMMAND"
17506 >wins proxy = no</B
17507 ></P
17508 ></DD
17509 ><DT
17510 ><A
17511 NAME="WINSSERVER"
17512 ></A
17513 >wins server (G)</DT
17514 ><DD
17515 ><P
17516 >This specifies the IP address (or DNS name: IP
17517                 address for preference) of the WINS server that <A
17518 HREF="nmbd.8.html"
17519 TARGET="_top"
17520 >               nmbd(8)</A
17521 > should register with. If you have a WINS server on
17522                 your network then you should set this to the WINS server's IP.</P
17523 ><P
17524 >You should point this at your WINS server if you have a
17525                 multi-subnetted network.</P
17526 ><P
17527 ><EM
17528 >NOTE</EM
17529 >. You need to set up Samba to point
17530                 to a WINS server if you have multiple subnets and wish cross-subnet
17531                 browsing to work correctly.</P
17532 ><P
17533 >See the documentation file <TT
17534 CLASS="FILENAME"
17535 >BROWSING.txt</TT
17536 >
17537                 in the docs/ directory of your Samba source distribution.</P
17538 ><P
17539 >Default: <EM
17540 >not enabled</EM
17541 ></P
17542 ><P
17543 >Example: <B
17544 CLASS="COMMAND"
17545 >wins server = 192.9.200.1</B
17546 ></P
17547 ></DD
17548 ><DT
17549 ><A
17550 NAME="WINSSUPPORT"
17551 ></A
17552 >wins support (G)</DT
17553 ><DD
17554 ><P
17555 >This boolean controls if the <A
17556 HREF="nmbd.8.html"
17557 TARGET="_top"
17558 >
17559                 nmbd(8)</A
17560 > process in Samba will act as a WINS server. You should
17561                 not set this to true unless you have a multi-subnetted network and
17562                 you wish a particular <B
17563 CLASS="COMMAND"
17564 >nmbd</B
17565 > to be your WINS server.
17566                 Note that you should <EM
17567 >NEVER</EM
17568 > set this to true
17569                 on more than one machine in your network.</P
17570 ><P
17571 >Default: <B
17572 CLASS="COMMAND"
17573 >wins support = no</B
17574 ></P
17575 ></DD
17576 ><DT
17577 ><A
17578 NAME="WORKGROUP"
17579 ></A
17580 >workgroup (G)</DT
17581 ><DD
17582 ><P
17583 >This controls what workgroup your server will
17584                 appear to be in when queried by clients. Note that this parameter
17585                 also controls the Domain name used with the <A
17586 HREF="#SECURITYEQUALSDOMAIN"
17587 ><B
17588 CLASS="COMMAND"
17589 >security=domain</B
17590 ></A
17591 >
17592                 setting.</P
17593 ><P
17594 >Default: <EM
17595 >set at compile time to WORKGROUP</EM
17596 ></P
17597 ><P
17598 >Example: <B
17599 CLASS="COMMAND"
17600 >workgroup = MYGROUP</B
17601 ></P
17602 ></DD
17603 ><DT
17604 ><A
17605 NAME="WRITABLE"
17606 ></A
17607 >writable (S)</DT
17608 ><DD
17609 ><P
17610 >Synonym for <A
17611 HREF="#WRITEABLE"
17612 ><TT
17613 CLASS="PARAMETER"
17614 ><I
17615 >               writeable</I
17616 ></TT
17617 ></A
17618 > for people who can't spell :-).</P
17619 ></DD
17620 ><DT
17621 ><A
17622 NAME="WRITECACHESIZE"
17623 ></A
17624 >write cache size (S)</DT
17625 ><DD
17626 ><P
17627 >If this integer parameter is set to non-zero value,
17628                 Samba will create an in-memory cache for each oplocked file
17629                 (it does <EM
17630 >not</EM
17631 > do this for
17632                 non-oplocked files). All writes that the client does not request
17633                 to be flushed directly to disk will be stored in this cache if possible.
17634                 The cache is flushed onto disk when a write comes in whose offset
17635                 would not fit into the cache or when the file is closed by the client.
17636                 Reads for the file are also served from this cache if the data is stored
17637                 within it.</P
17638 ><P
17639 >This cache allows Samba to batch client writes into a more
17640                 efficient write size for RAID disks (ie. writes may be tuned to
17641                 be the RAID stripe size) and can improve performance on systems
17642                 where the disk subsystem is a bottleneck but there is free
17643                 memory for userspace programs.</P
17644 ><P
17645 >The integer parameter specifies the size of this cache
17646                 (per oplocked file) in bytes.</P
17647 ><P
17648 >Default: <B
17649 CLASS="COMMAND"
17650 >write cache size = 0</B
17651 ></P
17652 ><P
17653 >Example: <B
17654 CLASS="COMMAND"
17655 >write cache size = 262144</B
17656 ></P
17657 ><P
17658 >for a 256k cache size per file.</P
17659 ></DD
17660 ><DT
17661 ><A
17662 NAME="WRITELIST"
17663 ></A
17664 >write list (S)</DT
17665 ><DD
17666 ><P
17667 >This is a list of users that are given read-write
17668                 access to a service. If the connecting user is in this list then
17669                 they will be given write access, no matter what the <A
17670 HREF="#WRITEABLE"
17671 ><TT
17672 CLASS="PARAMETER"
17673 ><I
17674 >writeable</I
17675 ></TT
17676 ></A
17677 >
17678                 option is set to. The list can include group names using the
17679                 @group syntax.</P
17680 ><P
17681 >Note that if a user is in both the read list and the
17682                 write list then they will be given write access.</P
17683 ><P
17684 >See also the <A
17685 HREF="#READLIST"
17686 ><TT
17687 CLASS="PARAMETER"
17688 ><I
17689 >read list
17690                 </I
17691 ></TT
17692 ></A
17693 > option.</P
17694 ><P
17695 >Default: <B
17696 CLASS="COMMAND"
17697 >write list = &#60;empty string&#62;
17698                 </B
17699 ></P
17700 ><P
17701 >Example: <B
17702 CLASS="COMMAND"
17703 >write list = admin, root, @staff
17704                 </B
17705 ></P
17706 ></DD
17707 ><DT
17708 ><A
17709 NAME="WRITEOK"
17710 ></A
17711 >write ok (S)</DT
17712 ><DD
17713 ><P
17714 >Synonym for <A
17715 HREF="#WRITEABLE"
17716 ><TT
17717 CLASS="PARAMETER"
17718 ><I
17719 >               writeable</I
17720 ></TT
17721 ></A
17722 >.</P
17723 ></DD
17724 ><DT
17725 ><A
17726 NAME="WRITERAW"
17727 ></A
17728 >write raw (G)</DT
17729 ><DD
17730 ><P
17731 >This parameter controls whether or not the server
17732                 will support raw writes SMB's when transferring data from clients.
17733                 You should never need to change this parameter.</P
17734 ><P
17735 >Default: <B
17736 CLASS="COMMAND"
17737 >write raw = yes</B
17738 ></P
17739 ></DD
17740 ><DT
17741 ><A
17742 NAME="WRITEABLE"
17743 ></A
17744 >writeable (S)</DT
17745 ><DD
17746 ><P
17747 >An inverted synonym is <A
17748 HREF="#READONLY"
17749 >               <TT
17750 CLASS="PARAMETER"
17751 ><I
17752 >read only</I
17753 ></TT
17754 ></A
17755 >.</P
17756 ><P
17757 >If this parameter is <TT
17758 CLASS="CONSTANT"
17759 >no</TT
17760 >, then users
17761                 of a service may not create or modify files in the service's
17762                 directory.</P
17763 ><P
17764 >Note that a printable service (<B
17765 CLASS="COMMAND"
17766 >printable = yes</B
17767 >)
17768                 will <EM
17769 >ALWAYS</EM
17770 > allow writing to the directory
17771                 (user privileges permitting), but only via spooling operations.</P
17772 ><P
17773 >Default: <B
17774 CLASS="COMMAND"
17775 >writeable = no</B
17776 ></P
17777 ></DD
17778 ></DL
17779 ></DIV
17780 ></DIV
17781 ><DIV
17782 CLASS="REFSECT1"
17783 ><A
17784 NAME="AEN5643"
17785 ></A
17786 ><H2
17787 >WARNINGS</H2
17788 ><P
17789 >Although the configuration file permits service names
17790         to contain spaces, your client software may not. Spaces will
17791         be ignored in comparisons anyway, so it shouldn't be a
17792         problem - but be aware of the possibility.</P
17793 ><P
17794 >On a similar note, many clients - especially DOS clients -
17795         limit service names to eight characters. <A
17796 HREF="smbd.8.html"
17797 TARGET="_top"
17798 >smbd(8)
17799         </A
17800 > has no such limitation, but attempts to connect from such
17801         clients will fail if they truncate the service names.  For this reason
17802         you should probably keep your service names down to eight characters
17803         in length.</P
17804 ><P
17805 >Use of the [homes] and [printers] special sections make life
17806         for an administrator easy, but the various combinations of default
17807         attributes can be tricky. Take extreme care when designing these
17808         sections. In particular, ensure that the permissions on spool
17809         directories are correct.</P
17810 ></DIV
17811 ><DIV
17812 CLASS="REFSECT1"
17813 ><A
17814 NAME="AEN5649"
17815 ></A
17816 ><H2
17817 >VERSION</H2
17818 ><P
17819 >This man page is correct for version 2.2 of
17820         the Samba suite.</P
17821 ></DIV
17822 ><DIV
17823 CLASS="REFSECT1"
17824 ><A
17825 NAME="AEN5652"
17826 ></A
17827 ><H2
17828 >SEE ALSO</H2
17829 ><P
17830 ><A
17831 HREF="samba.7.html"
17832 TARGET="_top"
17833 >samba(7)</A
17834 >,
17835         <A
17836 HREF="smbpasswd.8.html"
17837 TARGET="_top"
17838 ><B
17839 CLASS="COMMAND"
17840 >smbpasswd(8)</B
17841 ></A
17842 >,
17843         <A
17844 HREF="swat.8.html"
17845 TARGET="_top"
17846 ><B
17847 CLASS="COMMAND"
17848 >swat(8)</B
17849 ></A
17850 >,
17851         <A
17852 HREF="smbd.8.html"
17853 TARGET="_top"
17854 ><B
17855 CLASS="COMMAND"
17856 >smbd(8)</B
17857 ></A
17858 >,
17859         <A
17860 HREF="nmbd.8.html"
17861 TARGET="_top"
17862 ><B
17863 CLASS="COMMAND"
17864 >nmbd(8)</B
17865 ></A
17866 >,
17867         <A
17868 HREF="smbclient.1.html"
17869 TARGET="_top"
17870 ><B
17871 CLASS="COMMAND"
17872 >smbclient(1)</B
17873 ></A
17874 >,
17875         <A
17876 HREF="nmblookup.1.html"
17877 TARGET="_top"
17878 ><B
17879 CLASS="COMMAND"
17880 >nmblookup(1)</B
17881 ></A
17882 >,
17883         <A
17884 HREF="testparm.1.html"
17885 TARGET="_top"
17886 ><B
17887 CLASS="COMMAND"
17888 >testparm(1)</B
17889 ></A
17890 >,
17891         <A
17892 HREF="testprns.1.html"
17893 TARGET="_top"
17894 ><B
17895 CLASS="COMMAND"
17896 >testprns(1)</B
17897 ></A
17898 >
17899         </P
17900 ></DIV
17901 ><DIV
17902 CLASS="REFSECT1"
17903 ><A
17904 NAME="AEN5672"
17905 ></A
17906 ><H2
17907 >AUTHOR</H2
17908 ><P
17909 >The original Samba software and related utilities
17910         were created by Andrew Tridgell. Samba is now developed
17911         by the Samba Team as an Open Source project similar
17912         to the way the Linux kernel is developed.</P
17913 ><P
17914 >The original Samba man pages were written by Karl Auer.
17915         The man page sources were converted to YODL format (another
17916         excellent piece of Open Source software, available at
17917         <A
17918 HREF="ftp://ftp.icce.rug.nl/pub/unix/"
17919 TARGET="_top"
17920 >       ftp://ftp.icce.rug.nl/pub/unix/</A
17921 >) and updated for the Samba 2.0
17922         release by Jeremy Allison.  The conversion to DocBook for
17923         Samba 2.2 was done by Gerald Carter</P
17924 ></DIV
17925 ></BODY
17926 ></HTML
17927 >