docs/htmldocs/smb.conf.5.html

   1 <HTML
   2 ><HEAD
   3 ><TITLE
   4 >smb.conf</TITLE
   5 ><META
   6 NAME="GENERATOR"
   7 CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD
   8 ><BODY
   9 CLASS="REFENTRY"
  10 BGCOLOR="#FFFFFF"
  11 TEXT="#000000"
  12 LINK="#0000FF"
  13 VLINK="#840084"
  14 ALINK="#0000FF"
  15 ><H1
  16 ><A
  17 NAME="SMB.CONF"
  18 >smb.conf</A
  19 ></H1
  20 ><DIV
  21 CLASS="REFNAMEDIV"
  22 ><A
  23 NAME="AEN5"
  24 ></A
  25 ><H2
  26 >Name</H2
  27 >smb.conf&nbsp;--&nbsp;The configuration file for the Samba suite</DIV
  28 ><DIV
  29 CLASS="REFSECT1"
  30 ><A
  31 NAME="AEN8"
  32 ></A
  33 ><H2
  34 >SYNOPSIS</H2
  35 ><P
  36 >The <TT
  37 CLASS="FILENAME"
  38 >smb.conf</TT
  39 > file is a configuration
  40         file for the Samba suite. <TT
  41 CLASS="FILENAME"
  42 >smb.conf</TT
  43 > contains
  44         runtime configuration information for the Samba programs. The
  45         <TT
  46 CLASS="FILENAME"
  47 >smb.conf</TT
  48 > file is designed to be configured and
  49         administered by the <A
  50 HREF="swat.8.html"
  51 TARGET="_top"
  52 ><B
  53 CLASS="COMMAND"
  54 >swat(8)</B
  55 >
  56         </A
  57 > program. The complete description of the file format and
  58         possible parameters held within are here for reference purposes.</P
  59 ></DIV
  60 ><DIV
  61 CLASS="REFSECT1"
  62 ><A
  63 NAME="AEN16"
  64 ></A
  65 ><H2
  66 >FILE FORMAT</H2
  67 ><P
  68 >The file consists of sections and parameters. A section
  69         begins with the name of the section in square brackets and continues
  70         until the next section begins. Sections contain parameters of the
  71         form</P
  72 ><P
  73 ><TT
  74 CLASS="REPLACEABLE"
  75 ><I
  76 >name</I
  77 ></TT
  78 > = <TT
  79 CLASS="REPLACEABLE"
  80 ><I
  81 >value
  82         </I
  83 ></TT
  84 ></P
  85 ><P
  86 >The file is line-based - that is, each newline-terminated
  87         line represents either a comment, a section name or a parameter.</P
  88 ><P
  89 >Section and parameter names are not case sensitive.</P
  90 ><P
  91 >Only the first equals sign in a parameter is significant.
  92         Whitespace before or after the first equals sign is discarded.
  93         Leading, trailing and internal whitespace in section and parameter
  94         names is irrelevant. Leading and trailing whitespace in a parameter
  95         value is discarded. Internal whitespace within a parameter value
  96         is retained verbatim.</P
  97 ><P
  98 >Any line beginning with a semicolon (';') or a hash ('#')
  99         character is ignored, as are lines containing only whitespace.</P
 100 ><P
 101 >Any line ending in a '\' is continued
 102         on the next line in the customary UNIX fashion.</P
 103 ><P
 104 >The values following the equals sign in parameters are all
 105         either a string (no quotes needed) or a boolean, which may be given
 106         as yes/no, 0/1 or true/false. Case is not significant in boolean
 107         values, but is preserved in string values. Some items such as
 108         create modes are numeric.</P
 109 ></DIV
 110 ><DIV
 111 CLASS="REFSECT1"
 112 ><A
 113 NAME="AEN28"
 114 ></A
 115 ><H2
 116 >SECTION DESCRIPTIONS</H2
 117 ><P
 118 >Each section in the configuration file (except for the
 119         [global] section) describes a shared resource (known
 120         as a "share"). The section name is the name of the
 121         shared resource and the parameters within the section define
 122         the shares attributes.</P
 123 ><P
 124 >There are three special sections, [global],
 125         [homes] and [printers], which are
 126         described under <EM
 127 >special sections</EM
 128 >. The
 129         following notes apply to ordinary section descriptions.</P
 130 ><P
 131 >A share consists of a directory to which access is being
 132         given plus a description of the access rights which are granted
 133         to the user of the service. Some housekeeping options are
 134         also specifiable.</P
 135 ><P
 136 >Sections are either file share services (used by the
 137         client as an extension of their native file systems) or
 138         printable services (used by the client to access print services
 139         on the host running the server).</P
 140 ><P
 141 >Sections may be designated <EM
 142 >guest</EM
 143 > services,
 144         in which case no password is required to access them. A specified
 145         UNIX <EM
 146 >guest account</EM
 147 > is used to define access
 148         privileges in this case.</P
 149 ><P
 150 >Sections other than guest services will require a password
 151         to access them. The client provides the username. As older clients
 152         only provide passwords and not usernames, you may specify a list
 153         of usernames to check against the password using the "user ="
 154         option in the share definition. For modern clients such as
 155         Windows 95/98/ME/NT/2000, this should not be necessary.</P
 156 ><P
 157 >Note that the access rights granted by the server are
 158         masked by the access rights granted to the specified or guest
 159         UNIX user by the host system. The server does not grant more
 160         access than the host system grants.</P
 161 ><P
 162 >The following sample section defines a file space share.
 163         The user has write access to the path <TT
 164 CLASS="FILENAME"
 165 >/home/bar</TT
 166 >.
 167         The share is accessed via the share name "foo":</P
 168 ><TABLE
 169 BORDER="0"
 170 BGCOLOR="#E0E0E0"
 171 WIDTH="100%"
 172 ><TR
 173 ><TD
 174 ><PRE
 175 CLASS="SCREEN"
 176 >       <TT
 177 CLASS="COMPUTEROUTPUT"
 178 >       [foo]
 179                 path = /home/bar
 180                 writeable = true
 181         </TT
 182 >
 183         </PRE
 184 ></TD
 185 ></TR
 186 ></TABLE
 187 ><P
 188 >The following sample section defines a printable share.
 189         The share is readonly, but printable. That is, the only write
 190         access permitted is via calls to open, write to and close a
 191         spool file. The <EM
 192 >guest ok</EM
 193 > parameter means
 194         access will be permitted as the default guest user (specified
 195         elsewhere):</P
 196 ><TABLE
 197 BORDER="0"
 198 BGCOLOR="#E0E0E0"
 199 WIDTH="100%"
 200 ><TR
 201 ><TD
 202 ><PRE
 203 CLASS="SCREEN"
 204 >       <TT
 205 CLASS="COMPUTEROUTPUT"
 206 >       [aprinter]
 207                 path = /usr/spool/public
 208                 writeable = false
 209                 printable = true
 210                 guest ok = true
 211         </TT
 212 >
 213         </PRE
 214 ></TD
 215 ></TR
 216 ></TABLE
 217 ></DIV
 218 ><DIV
 219 CLASS="REFSECT1"
 220 ><A
 221 NAME="AEN48"
 222 ></A
 223 ><H2
 224 >SPECIAL SECTIONS</H2
 225 ><DIV
 226 CLASS="REFSECT2"
 227 ><A
 228 NAME="AEN50"
 229 ></A
 230 ><H3
 231 >The [global] section</H3
 232 ><P
 233 >parameters in this section apply to the server
 234                 as a whole, or are defaults for sections which do not
 235                 specifically define certain items. See the notes
 236                 under PARAMETERS for more information.</P
 237 ></DIV
 238 ><DIV
 239 CLASS="REFSECT2"
 240 ><A
 241 NAME="AEN53"
 242 ></A
 243 ><H3
 244 >The [homes] section</H3
 245 ><P
 246 >If a section called homes is included in the
 247                 configuration file, services connecting clients to their
 248                 home directories can be created on the fly by the server.</P
 249 ><P
 250 >When the connection request is made, the existing
 251                 sections are scanned. If a match is found, it is used. If no
 252                 match is found, the requested section name is treated as a
 253                 user name and looked up in the local password file. If the
 254                 name exists and the correct password has been given, a share is
 255                 created by cloning the [homes] section.</P
 256 ><P
 257 >Some modifications are then made to the newly
 258                 created share:</P
 259 ><P
 260 ></P
 261 ><UL
 262 ><LI
 263 ><P
 264 >The share name is changed from homes to
 265                 the located username.</P
 266 ></LI
 267 ><LI
 268 ><P
 269 >If no path was given, the path is set to
 270                 the user's home directory.</P
 271 ></LI
 272 ></UL
 273 ><P
 274 >If you decide to use a <EM
 275 >path =</EM
 276 > line
 277                 in your [homes] section then you may find it useful
 278                 to use the %S macro. For example :</P
 279 ><P
 280 ><TT
 281 CLASS="USERINPUT"
 282 ><B
 283 >path = /data/pchome/%S</B
 284 ></TT
 285 ></P
 286 ><P
 287 >would be useful if you have different home directories
 288                 for your PCs than for UNIX access.</P
 289 ><P
 290 >This is a fast and simple way to give a large number
 291                 of clients access to their home directories with a minimum
 292                 of fuss.</P
 293 ><P
 294 >A similar process occurs if the requested section
 295                 name is "homes", except that the share name is not
 296                 changed to that of the requesting user. This method of using
 297                 the [homes] section works well if different users share
 298                 a client PC.</P
 299 ><P
 300 >The [homes] section can specify all the parameters
 301                 a normal service section can specify, though some make more sense
 302                 than others. The following is a typical and suitable [homes]
 303                 section:</P
 304 ><TABLE
 305 BORDER="0"
 306 BGCOLOR="#E0E0E0"
 307 WIDTH="100%"
 308 ><TR
 309 ><TD
 310 ><PRE
 311 CLASS="SCREEN"
 312 >               <TT
 313 CLASS="COMPUTEROUTPUT"
 314 >               [homes]
 315                         writeable = yes
 316                 </TT
 317 >
 318                 </PRE
 319 ></TD
 320 ></TR
 321 ></TABLE
 322 ><P
 323 >An important point is that if guest access is specified
 324                 in the [homes] section, all home directories will be
 325                 visible to all clients <EM
 326 >without a password</EM
 327 >.
 328                 In the very unlikely event that this is actually desirable, it
 329                 would be wise to also specify <EM
 330 >read only
 331                 access</EM
 332 >.</P
 333 ><P
 334 >Note that the <EM
 335 >browseable</EM
 336 > flag for
 337                 auto home directories will be inherited from the global browseable
 338                 flag, not the [homes] browseable flag. This is useful as
 339                 it means setting <EM
 340 >browseable = no</EM
 341 > in
 342                 the [homes] section will hide the [homes] share but make
 343                 any auto home directories visible.</P
 344 ></DIV
 345 ><DIV
 346 CLASS="REFSECT2"
 347 ><A
 348 NAME="AEN79"
 349 ></A
 350 ><H3
 351 >The [printers] section</H3
 352 ><P
 353 >This section works like [homes],
 354                 but for printers.</P
 355 ><P
 356 >If a [printers] section occurs in the
 357                 configuration file, users are able to connect to any printer
 358                 specified in the local host's printcap file.</P
 359 ><P
 360 >When a connection request is made, the existing sections
 361                 are scanned. If a match is found, it is used. If no match is found,
 362                 but a [homes] section exists, it is used as described
 363                 above. Otherwise, the requested section name is treated as a
 364                 printer name and the appropriate printcap file is scanned to see
 365                 if the requested section name is a valid printer share name. If
 366                 a match is found, a new printer share is created by cloning
 367                 the [printers] section.</P
 368 ><P
 369 >A few modifications are then made to the newly created
 370                 share:</P
 371 ><P
 372 ></P
 373 ><UL
 374 ><LI
 375 ><P
 376 >The share name is set to the located printer
 377                 name</P
 378 ></LI
 379 ><LI
 380 ><P
 381 >If no printer name was given, the printer name
 382                 is set to the located printer name</P
 383 ></LI
 384 ><LI
 385 ><P
 386 >If the share does not permit guest access and
 387                 no username was given, the username is set to the located
 388                 printer name.</P
 389 ></LI
 390 ></UL
 391 ><P
 392 >Note that the [printers] service MUST be
 393                 printable - if you specify otherwise, the server will refuse
 394                 to load the configuration file.</P
 395 ><P
 396 >Typically the path specified would be that of a
 397                 world-writeable spool directory with the sticky bit set on
 398                 it. A typical [printers] entry would look like
 399                 this:</P
 400 ><TABLE
 401 BORDER="0"
 402 BGCOLOR="#E0E0E0"
 403 WIDTH="100%"
 404 ><TR
 405 ><TD
 406 ><PRE
 407 CLASS="SCREEN"
 408 ><TT
 409 CLASS="COMPUTEROUTPUT"
 410 >               [printers]
 411                         path = /usr/spool/public
 412                         guest ok = yes
 413                         printable = yes
 414                 </TT
 415 ></PRE
 416 ></TD
 417 ></TR
 418 ></TABLE
 419 ><P
 420 >All aliases given for a printer in the printcap file
 421                 are legitimate printer names as far as the server is concerned.
 422                 If your printing subsystem doesn't work like that, you will have
 423                 to set up a pseudo-printcap. This is a file consisting of one or
 424                 more lines like this:</P
 425 ><TABLE
 426 BORDER="0"
 427 BGCOLOR="#E0E0E0"
 428 WIDTH="100%"
 429 ><TR
 430 ><TD
 431 ><PRE
 432 CLASS="SCREEN"
 433 >               <TT
 434 CLASS="COMPUTEROUTPUT"
 435 >               alias|alias|alias|alias...
 436                 </TT
 437 >
 438                 </PRE
 439 ></TD
 440 ></TR
 441 ></TABLE
 442 ><P
 443 >Each alias should be an acceptable printer name for
 444                 your printing subsystem. In the [global] section, specify
 445                 the new file as your printcap.  The server will then only recognize
 446                 names found in your pseudo-printcap, which of course can contain
 447                 whatever aliases you like. The same technique could be used
 448                 simply to limit access to a subset of your local printers.</P
 449 ><P
 450 >An alias, by the way, is defined as any component of the
 451                 first entry of a printcap record. Records are separated by newlines,
 452                 components (if there are more than one) are separated by vertical
 453                 bar symbols ('|').</P
 454 ><P
 455 >NOTE: On SYSV systems which use lpstat to determine what
 456                 printers are defined on the system you may be able to use
 457                 "printcap name = lpstat" to automatically obtain a list
 458                 of printers. See the "printcap name" option
 459                 for more details.</P
 460 ></DIV
 461 ></DIV
 462 ><DIV
 463 CLASS="REFSECT1"
 464 ><A
 465 NAME="AEN102"
 466 ></A
 467 ><H2
 468 >PARAMETERS</H2
 469 ><P
 470 >parameters define the specific attributes of sections.</P
 471 ><P
 472 >Some parameters are specific to the [global] section
 473         (e.g., <EM
 474 >security</EM
 475 >).  Some parameters are usable
 476         in all sections (e.g., <EM
 477 >create mode</EM
 478 >). All others
 479         are permissible only in normal sections. For the purposes of the
 480         following descriptions the [homes] and [printers]
 481         sections will be considered normal.  The letter <EM
 482 >G</EM
 483 >
 484         in parentheses indicates that a parameter is specific to the
 485         [global] section. The letter <EM
 486 >S</EM
 487 >
 488         indicates that a parameter can be specified in a service specific
 489         section. Note that all <EM
 490 >S</EM
 491 > parameters can also be specified in
 492         the [global] section - in which case they will define
 493         the default behavior for all services.</P
 494 ><P
 495 >parameters are arranged here in alphabetical order - this may
 496         not create best bedfellows, but at least you can find them! Where
 497         there are synonyms, the preferred synonym is described, others refer
 498         to the preferred synonym.</P
 499 ></DIV
 500 ><DIV
 501 CLASS="REFSECT1"
 502 ><A
 503 NAME="AEN112"
 504 ></A
 505 ><H2
 506 >VARIABLE SUBSTITUTIONS</H2
 507 ><P
 508 >Many of the strings that are settable in the config file
 509         can take substitutions. For example the option "path =
 510         /tmp/%u" would be interpreted as "path =
 511         /tmp/john" if the user connected with the username john.</P
 512 ><P
 513 >These substitutions are mostly noted in the descriptions below,
 514         but there are some general substitutions which apply whenever they
 515         might be relevant. These are:</P
 516 ><P
 517 ></P
 518 ><DIV
 519 CLASS="VARIABLELIST"
 520 ><DL
 521 ><DT
 522 >%S</DT
 523 ><DD
 524 ><P
 525 >the name of the current service, if any.</P
 526 ></DD
 527 ><DT
 528 >%P</DT
 529 ><DD
 530 ><P
 531 >the root directory of the current service,
 532                 if any.</P
 533 ></DD
 534 ><DT
 535 >%u</DT
 536 ><DD
 537 ><P
 538 >user name of the current service, if any.</P
 539 ></DD
 540 ><DT
 541 >%g</DT
 542 ><DD
 543 ><P
 544 >primary group name of %u.</P
 545 ></DD
 546 ><DT
 547 >%U</DT
 548 ><DD
 549 ><P
 550 >session user name (the user name that the client
 551                 wanted, not necessarily the same as the one they got).</P
 552 ></DD
 553 ><DT
 554 >%G</DT
 555 ><DD
 556 ><P
 557 >primary group name of %U.</P
 558 ></DD
 559 ><DT
 560 >%H</DT
 561 ><DD
 562 ><P
 563 >the home directory of the user given
 564                 by %u.</P
 565 ></DD
 566 ><DT
 567 >%v</DT
 568 ><DD
 569 ><P
 570 >the Samba version.</P
 571 ></DD
 572 ><DT
 573 >%h</DT
 574 ><DD
 575 ><P
 576 >the Internet hostname that Samba is running
 577                 on.</P
 578 ></DD
 579 ><DT
 580 >%m</DT
 581 ><DD
 582 ><P
 583 >the NetBIOS name of the client machine
 584                 (very useful).</P
 585 ></DD
 586 ><DT
 587 >%L</DT
 588 ><DD
 589 ><P
 590 >the NetBIOS name of the server. This allows you
 591                 to change your config based on what the client calls you. Your
 592                 server can have a "dual personality".</P
 593 ><P
 594 >Note that this paramater is not available when Samba listens
 595                 on port 445, as clients no longer send this information </P
 596 ></DD
 597 ><DT
 598 >%M</DT
 599 ><DD
 600 ><P
 601 >the Internet name of the client machine.
 602                 </P
 603 ></DD
 604 ><DT
 605 >%N</DT
 606 ><DD
 607 ><P
 608 >the name of your NIS home directory server.
 609                 This is obtained from your NIS auto.map entry.  If you have
 610                 not compiled Samba with the <EM
 611 >--with-automount</EM
 612 >
 613                 option then this value will be the same as %L.</P
 614 ></DD
 615 ><DT
 616 >%p</DT
 617 ><DD
 618 ><P
 619 >the path of the service's home directory,
 620                 obtained from your NIS auto.map entry. The NIS auto.map entry
 621                 is split up as "%N:%p".</P
 622 ></DD
 623 ><DT
 624 >%R</DT
 625 ><DD
 626 ><P
 627 >the selected protocol level after
 628                 protocol negotiation. It can be one of CORE, COREPLUS,
 629                 LANMAN1, LANMAN2 or NT1.</P
 630 ></DD
 631 ><DT
 632 >%d</DT
 633 ><DD
 634 ><P
 635 >The process id of the current server
 636                 process.</P
 637 ></DD
 638 ><DT
 639 >%a</DT
 640 ><DD
 641 ><P
 642 >the architecture of the remote
 643                 machine. Only some are recognized, and those may not be
 644                 100% reliable. It currently recognizes Samba, WfWg, Win95,
 645                 WinNT and Win2k. Anything else will be known as
 646                 "UNKNOWN". If it gets it wrong then sending a level
 647                 3 log to <A
 648 HREF="mailto:samba@samba.org"
 649 TARGET="_top"
 650 >samba@samba.org
 651                 </A
 652 > should allow it to be fixed.</P
 653 ></DD
 654 ><DT
 655 >%I</DT
 656 ><DD
 657 ><P
 658 >The IP address of the client machine.</P
 659 ></DD
 660 ><DT
 661 >%T</DT
 662 ><DD
 663 ><P
 664 >the current date and time.</P
 665 ></DD
 666 ><DT
 667 >%$(<TT
 668 CLASS="REPLACEABLE"
 669 ><I
 670 >envvar</I
 671 ></TT
 672 >)</DT
 673 ><DD
 674 ><P
 675 >The value of the environment variable
 676                 <TT
 677 CLASS="REPLACEABLE"
 678 ><I
 679 >envar</I
 680 ></TT
 681 >.</P
 682 ></DD
 683 ></DL
 684 ></DIV
 685 ><P
 686 >There are some quite creative things that can be done
 687         with these substitutions and other smb.conf options.</P
 688 ></DIV
 689 ><DIV
 690 CLASS="REFSECT1"
 691 ><A
 692 NAME="AEN203"
 693 ></A
 694 ><H2
 695 >NAME MANGLING</H2
 696 ><P
 697 >Samba supports "name mangling" so that DOS and
 698         Windows clients can use files that don't conform to the 8.3 format.
 699         It can also be set to adjust the case of 8.3 format filenames.</P
 700 ><P
 701 >There are several options that control the way mangling is
 702         performed, and they are grouped here rather than listed separately.
 703         For the defaults look at the output of the testparm program. </P
 704 ><P
 705 >All of these options can be set separately for each service
 706         (or globally, of course). </P
 707 ><P
 708 >The options are: </P
 709 ><P
 710 ></P
 711 ><DIV
 712 CLASS="VARIABLELIST"
 713 ><DL
 714 ><DT
 715 >mangle case = yes/no</DT
 716 ><DD
 717 ><P
 718 > controls if names that have characters that
 719                 aren't of the "default" case are mangled. For example,
 720                 if this is yes then a name like "Mail" would be mangled.
 721                 Default <EM
 722 >no</EM
 723 >.</P
 724 ></DD
 725 ><DT
 726 >case sensitive = yes/no</DT
 727 ><DD
 728 ><P
 729 >controls whether filenames are case sensitive. If
 730                 they aren't then Samba must do a filename search and match on passed
 731                 names. Default <EM
 732 >no</EM
 733 >.</P
 734 ></DD
 735 ><DT
 736 >default case = upper/lower</DT
 737 ><DD
 738 ><P
 739 >controls what the default case is for new
 740                 filenames. Default <EM
 741 >lower</EM
 742 >.</P
 743 ></DD
 744 ><DT
 745 >preserve case = yes/no</DT
 746 ><DD
 747 ><P
 748 >controls if new files are created with the
 749                 case that the client passes, or if they are forced to be the
 750                 "default" case. Default <EM
 751 >yes</EM
 752 >.
 753                 </P
 754 ></DD
 755 ><DT
 756 >short preserve case = yes/no</DT
 757 ><DD
 758 ><P
 759 >controls if new files which conform to 8.3 syntax,
 760                 that is all in upper case and of suitable length, are created
 761                 upper case, or if they are forced to be the "default"
 762                 case. This option can be use with "preserve case = yes"
 763                 to permit long filenames to retain their case, while short names
 764                 are lowercased. Default <EM
 765 >yes</EM
 766 >.</P
 767 ></DD
 768 ></DL
 769 ></DIV
 770 ><P
 771 >By default, Samba 2.2 has the same semantics as a Windows
 772         NT server, in that it is case insensitive but case preserving.</P
 773 ></DIV
 774 ><DIV
 775 CLASS="REFSECT1"
 776 ><A
 777 NAME="AEN236"
 778 ></A
 779 ><H2
 780 >NOTE ABOUT USERNAME/PASSWORD VALIDATION</H2
 781 ><P
 782 >There are a number of ways in which a user can connect
 783         to a service. The server uses the following steps in determining
 784         if it will allow a connection to a specified service. If all the
 785         steps fail, then the connection request is rejected.  However, if one of the
 786         steps succeeds, then the following steps are not checked.</P
 787 ><P
 788 >If the service is marked "guest only = yes" then
 789         steps 1 to 5 are skipped.</P
 790 ><P
 791 ></P
 792 ><OL
 793 TYPE="1"
 794 ><LI
 795 ><P
 796 >If the client has passed a username/password
 797                 pair and that username/password pair is validated by the UNIX
 798                 system's password programs then the connection is made as that
 799                 username. Note that this includes the
 800                 \\server\service%<TT
 801 CLASS="REPLACEABLE"
 802 ><I
 803 >username</I
 804 ></TT
 805 > method of passing
 806                 a username.</P
 807 ></LI
 808 ><LI
 809 ><P
 810 >If the client has previously registered a username
 811                 with the system and now supplies a correct password for that
 812                 username then the connection is allowed.</P
 813 ></LI
 814 ><LI
 815 ><P
 816 >The client's NetBIOS name and any previously
 817                 used user names are checked against the supplied password, if
 818                 they match then the connection is allowed as the corresponding
 819                 user.</P
 820 ></LI
 821 ><LI
 822 ><P
 823 >If the client has previously validated a
 824                 username/password pair with the server and the client has passed
 825                 the validation token then that username is used. </P
 826 ></LI
 827 ><LI
 828 ><P
 829 >If a "user = " field is given in the
 830                 <TT
 831 CLASS="FILENAME"
 832 >smb.conf</TT
 833 > file for the service and the client
 834                 has supplied a password, and that password matches (according to
 835                 the UNIX system's password checking) with one of the usernames
 836                 from the "user =" field then the connection is made as
 837                 the username in the "user =" line. If one
 838                 of the username in the "user =" list begins with a
 839                 '@' then that name expands to a list of names in
 840                 the group of the same name.</P
 841 ></LI
 842 ><LI
 843 ><P
 844 >If the service is a guest service then a
 845                 connection is made as the username given in the "guest
 846                 account =" for the service, irrespective of the
 847                 supplied password.</P
 848 ></LI
 849 ></OL
 850 ></DIV
 851 ><DIV
 852 CLASS="REFSECT1"
 853 ><A
 854 NAME="AEN255"
 855 ></A
 856 ><H2
 857 >COMPLETE LIST OF GLOBAL PARAMETERS</H2
 858 ><P
 859 >Here is a list of all global parameters. See the section of
 860         each parameter for details.  Note that some are synonyms.</P
 861 ><P
 862 ></P
 863 ><UL
 864 ><LI
 865 ><P
 866 ><A
 867 HREF="#ABORTSHUTDOWNSCRIPT"
 868 ><TT
 869 CLASS="PARAMETER"
 870 ><I
 871 >abort shutdown script</I
 872 ></TT
 873 ></A
 874 ></P
 875 ></LI
 876 ><LI
 877 ><P
 878 ><A
 879 HREF="#ADDPRINTERCOMMAND"
 880 ><TT
 881 CLASS="PARAMETER"
 882 ><I
 883 >add printer command</I
 884 ></TT
 885 ></A
 886 ></P
 887 ></LI
 888 ><LI
 889 ><P
 890 ><A
 891 HREF="#ADDSHARECOMMAND"
 892 ><TT
 893 CLASS="PARAMETER"
 894 ><I
 895 >add share command</I
 896 ></TT
 897 ></A
 898 ></P
 899 ></LI
 900 ><LI
 901 ><P
 902 ><A
 903 HREF="#ADDUSERSCRIPT"
 904 ><TT
 905 CLASS="PARAMETER"
 906 ><I
 907 >add user script</I
 908 ></TT
 909 ></A
 910 ></P
 911 ></LI
 912 ><LI
 913 ><P
 914 ><A
 915 HREF="#ADDMACHINESCRIPT"
 916 ><TT
 917 CLASS="PARAMETER"
 918 ><I
 919 >add machine script</I
 920 ></TT
 921 ></A
 922 ></P
 923 ></LI
 924 ><LI
 925 ><P
 926 ><A
 927 HREF="#ALLOWTRUSTEDDOMAINS"
 928 ><TT
 929 CLASS="PARAMETER"
 930 ><I
 931 >allow trusted domains</I
 932 ></TT
 933 ></A
 934 ></P
 935 ></LI
 936 ><LI
 937 ><P
 938 ><A
 939 HREF="#ANNOUNCEAS"
 940 ><TT
 941 CLASS="PARAMETER"
 942 ><I
 943 >announce as</I
 944 ></TT
 945 ></A
 946 ></P
 947 ></LI
 948 ><LI
 949 ><P
 950 ><A
 951 HREF="#ANNOUNCEVERSION"
 952 ><TT
 953 CLASS="PARAMETER"
 954 ><I
 955 >announce version</I
 956 ></TT
 957 ></A
 958 ></P
 959 ></LI
 960 ><LI
 961 ><P
 962 ><A
 963 HREF="#AUTHMETHODS"
 964 ><TT
 965 CLASS="PARAMETER"
 966 ><I
 967 >auth methods</I
 968 ></TT
 969 ></A
 970 ></P
 971 ></LI
 972 ><LI
 973 ><P
 974 ><A
 975 HREF="#AUTOSERVICES"
 976 ><TT
 977 CLASS="PARAMETER"
 978 ><I
 979 >auto services</I
 980 ></TT
 981 ></A
 982 ></P
 983 ></LI
 984 ><LI
 985 ><P
 986 ><A
 987 HREF="#BINDINTERFACESONLY"
 988 ><TT
 989 CLASS="PARAMETER"
 990 ><I
 991 >bind interfaces only</I
 992 ></TT
 993 ></A
 994 ></P
 995 ></LI
 996 ><LI
 997 ><P
 998 ><A
 999 HREF="#BROWSELIST"
1000 ><TT
1001 CLASS="PARAMETER"
1002 ><I
1003 >browse list</I
1004 ></TT
1005 ></A
1006 ></P
1007 ></LI
1008 ><LI
1009 ><P
1010 ><A
1011 HREF="#CHANGENOTIFYTIMEOUT"
1012 ><TT
1013 CLASS="PARAMETER"
1014 ><I
1015 >change notify timeout</I
1016 ></TT
1017 ></A
1018 ></P
1019 ></LI
1020 ><LI
1021 ><P
1022 ><A
1023 HREF="#CHANGESHARECOMMAND"
1024 ><TT
1025 CLASS="PARAMETER"
1026 ><I
1027 >change share command</I
1028 ></TT
1029 ></A
1030 ></P
1031 ></LI
1032 ><LI
1033 ><P
1034 ><A
1035 HREF="#CONFIGFILE"
1036 ><TT
1037 CLASS="PARAMETER"
1038 ><I
1039 >config file</I
1040 ></TT
1041 ></A
1042 ></P
1043 ></LI
1044 ><LI
1045 ><P
1046 ><A
1047 HREF="#DEADTIME"
1048 ><TT
1049 CLASS="PARAMETER"
1050 ><I
1051 >deadtime</I
1052 ></TT
1053 ></A
1054 ></P
1055 ></LI
1056 ><LI
1057 ><P
1058 ><A
1059 HREF="#DEBUGHIRESTIMESTAMP"
1060 ><TT
1061 CLASS="PARAMETER"
1062 ><I
1063 >debug hires timestamp</I
1064 ></TT
1065 ></A
1066 ></P
1067 ></LI
1068 ><LI
1069 ><P
1070 ><A
1071 HREF="#DEBUGPID"
1072 ><TT
1073 CLASS="PARAMETER"
1074 ><I
1075 >debug pid</I
1076 ></TT
1077 ></A
1078 ></P
1079 ></LI
1080 ><LI
1081 ><P
1082 ><A
1083 HREF="#DEBUGTIMESTAMP"
1084 ><TT
1085 CLASS="PARAMETER"
1086 ><I
1087 >debug timestamp</I
1088 ></TT
1089 ></A
1090 ></P
1091 ></LI
1092 ><LI
1093 ><P
1094 ><A
1095 HREF="#DEBUGUID"
1096 ><TT
1097 CLASS="PARAMETER"
1098 ><I
1099 >debug uid</I
1100 ></TT
1101 ></A
1102 ></P
1103 ></LI
1104 ><LI
1105 ><P
1106 ><A
1107 HREF="#DEBUGLEVEL"
1108 ><TT
1109 CLASS="PARAMETER"
1110 ><I
1111 >debuglevel</I
1112 ></TT
1113 ></A
1114 ></P
1115 ></LI
1116 ><LI
1117 ><P
1118 ><A
1119 HREF="#DEFAULT"
1120 ><TT
1121 CLASS="PARAMETER"
1122 ><I
1123 >default</I
1124 ></TT
1125 ></A
1126 ></P
1127 ></LI
1128 ><LI
1129 ><P
1130 ><A
1131 HREF="#DEFAULTSERVICE"
1132 ><TT
1133 CLASS="PARAMETER"
1134 ><I
1135 >default service</I
1136 ></TT
1137 ></A
1138 ></P
1139 ></LI
1140 ><LI
1141 ><P
1142 ><A
1143 HREF="#DELETEPRINTERCOMMAND"
1144 ><TT
1145 CLASS="PARAMETER"
1146 ><I
1147 >delete printer command</I
1148 ></TT
1149 ></A
1150 ></P
1151 ></LI
1152 ><LI
1153 ><P
1154 ><A
1155 HREF="#DELETESHARECOMMAND"
1156 ><TT
1157 CLASS="PARAMETER"
1158 ><I
1159 >delete share command</I
1160 ></TT
1161 ></A
1162 ></P
1163 ></LI
1164 ><LI
1165 ><P
1166 ><A
1167 HREF="#DELETEUSERSCRIPT"
1168 ><TT
1169 CLASS="PARAMETER"
1170 ><I
1171 >delete user script</I
1172 ></TT
1173 ></A
1174 ></P
1175 ></LI
1176 ><LI
1177 ><P
1178 ><A
1179 HREF="#DFREECOMMAND"
1180 ><TT
1181 CLASS="PARAMETER"
1182 ><I
1183 >dfree command</I
1184 ></TT
1185 ></A
1186 ></P
1187 ></LI
1188 ><LI
1189 ><P
1190 ><A
1191 HREF="#DISABLESPOOLSS"
1192 ><TT
1193 CLASS="PARAMETER"
1194 ><I
1195 >disable spoolss</I
1196 ></TT
1197 ></A
1198 ></P
1199 ></LI
1200 ><LI
1201 ><P
1202 ><A
1203 HREF="#DNSPROXY"
1204 ><TT
1205 CLASS="PARAMETER"
1206 ><I
1207 >dns proxy</I
1208 ></TT
1209 ></A
1210 ></P
1211 ></LI
1212 ><LI
1213 ><P
1214 ><A
1215 HREF="#DOMAINADMINGROUP"
1216 ><TT
1217 CLASS="PARAMETER"
1218 ><I
1219 >domain admin group</I
1220 ></TT
1221 ></A
1222 ></P
1223 ></LI
1224 ><LI
1225 ><P
1226 ><A
1227 HREF="#DOMAINGUESTGROUP"
1228 ><TT
1229 CLASS="PARAMETER"
1230 ><I
1231 >domain guest group</I
1232 ></TT
1233 ></A
1234 ></P
1235 ></LI
1236 ><LI
1237 ><P
1238 ><A
1239 HREF="#DOMAINLOGONS"
1240 ><TT
1241 CLASS="PARAMETER"
1242 ><I
1243 >domain logons</I
1244 ></TT
1245 ></A
1246 ></P
1247 ></LI
1248 ><LI
1249 ><P
1250 ><A
1251 HREF="#DOMAINMASTER"
1252 ><TT
1253 CLASS="PARAMETER"
1254 ><I
1255 >domain master</I
1256 ></TT
1257 ></A
1258 ></P
1259 ></LI
1260 ><LI
1261 ><P
1262 ><A
1263 HREF="#ENCRYPTPASSWORDS"
1264 ><TT
1265 CLASS="PARAMETER"
1266 ><I
1267 >encrypt passwords</I
1268 ></TT
1269 ></A
1270 ></P
1271 ></LI
1272 ><LI
1273 ><P
1274 ><A
1275 HREF="#ENHANCEDBROWSING"
1276 ><TT
1277 CLASS="PARAMETER"
1278 ><I
1279 >enhanced browsing</I
1280 ></TT
1281 ></A
1282 ></P
1283 ></LI
1284 ><LI
1285 ><P
1286 ><A
1287 HREF="#ENUMPORTSCOMMAND"
1288 ><TT
1289 CLASS="PARAMETER"
1290 ><I
1291 >enumports command</I
1292 ></TT
1293 ></A
1294 ></P
1295 ></LI
1296 ><LI
1297 ><P
1298 ><A
1299 HREF="#GETWDCACHE"
1300 ><TT
1301 CLASS="PARAMETER"
1302 ><I
1303 >getwd cache</I
1304 ></TT
1305 ></A
1306 ></P
1307 ></LI
1308 ><LI
1309 ><P
1310 ><A
1311 HREF="#HIDELOCALUSERS"
1312 ><TT
1313 CLASS="PARAMETER"
1314 ><I
1315 >hide local users</I
1316 ></TT
1317 ></A
1318 ></P
1319 ></LI
1320 ><LI
1321 ><P
1322 ><A
1323 HREF="#HIDEUNREADABLE"
1324 ><TT
1325 CLASS="PARAMETER"
1326 ><I
1327 >hide unreadable</I
1328 ></TT
1329 ></A
1330 ></P
1331 ></LI
1332 ><LI
1333 ><P
1334 ><A
1335 HREF="#HOMEDIRMAP"
1336 ><TT
1337 CLASS="PARAMETER"
1338 ><I
1339 >homedir map</I
1340 ></TT
1341 ></A
1342 ></P
1343 ></LI
1344 ><LI
1345 ><P
1346 ><A
1347 HREF="#HOSTMSDFS"
1348 ><TT
1349 CLASS="PARAMETER"
1350 ><I
1351 >host msdfs</I
1352 ></TT
1353 ></A
1354 ></P
1355 ></LI
1356 ><LI
1357 ><P
1358 ><A
1359 HREF="#HOSTSEQUIV"
1360 ><TT
1361 CLASS="PARAMETER"
1362 ><I
1363 >hosts equiv</I
1364 ></TT
1365 ></A
1366 ></P
1367 ></LI
1368 ><LI
1369 ><P
1370 ><A
1371 HREF="#INTERFACES"
1372 ><TT
1373 CLASS="PARAMETER"
1374 ><I
1375 >interfaces</I
1376 ></TT
1377 ></A
1378 ></P
1379 ></LI
1380 ><LI
1381 ><P
1382 ><A
1383 HREF="#KEEPALIVE"
1384 ><TT
1385 CLASS="PARAMETER"
1386 ><I
1387 >keepalive</I
1388 ></TT
1389 ></A
1390 ></P
1391 ></LI
1392 ><LI
1393 ><P
1394 ><A
1395 HREF="#KERNELOPLOCKS"
1396 ><TT
1397 CLASS="PARAMETER"
1398 ><I
1399 >kernel oplocks</I
1400 ></TT
1401 ></A
1402 ></P
1403 ></LI
1404 ><LI
1405 ><P
1406 ><A
1407 HREF="#LANMANAUTH"
1408 ><TT
1409 CLASS="PARAMETER"
1410 ><I
1411 >lanman auth</I
1412 ></TT
1413 ></A
1414 ></P
1415 ></LI
1416 ><LI
1417 ><P
1418 ><A
1419 HREF="#LARGEREADWRITE"
1420 ><TT
1421 CLASS="PARAMETER"
1422 ><I
1423 >large readwrite</I
1424 ></TT
1425 ></A
1426 ></P
1427 ></LI
1428 ><LI
1429 ><P
1430 ><A
1431 HREF="#LDAPADMINDN"
1432 ><TT
1433 CLASS="PARAMETER"
1434 ><I
1435 >ldap admin dn</I
1436 ></TT
1437 ></A
1438 ></P
1439 ></LI
1440 ><LI
1441 ><P
1442 ><A
1443 HREF="#LDAPFILTER"
1444 ><TT
1445 CLASS="PARAMETER"
1446 ><I
1447 >ldap filter</I
1448 ></TT
1449 ></A
1450 ></P
1451 ></LI
1452 ><LI
1453 ><P
1454 ><A
1455 HREF="#LDAPPORT"
1456 ><TT
1457 CLASS="PARAMETER"
1458 ><I
1459 >ldap port</I
1460 ></TT
1461 ></A
1462 ></P
1463 ></LI
1464 ><LI
1465 ><P
1466 ><A
1467 HREF="#LDAPSERVER"
1468 ><TT
1469 CLASS="PARAMETER"
1470 ><I
1471 >ldap server</I
1472 ></TT
1473 ></A
1474 ></P
1475 ></LI
1476 ><LI
1477 ><P
1478 ><A
1479 HREF="#LDAPSSL"
1480 ><TT
1481 CLASS="PARAMETER"
1482 ><I
1483 >ldap ssl</I
1484 ></TT
1485 ></A
1486 ></P
1487 ></LI
1488 ><LI
1489 ><P
1490 ><A
1491 HREF="#LDAPSUFFIX"
1492 ><TT
1493 CLASS="PARAMETER"
1494 ><I
1495 >ldap suffix</I
1496 ></TT
1497 ></A
1498 ></P
1499 ></LI
1500 ><LI
1501 ><P
1502 ><A
1503 HREF="#LMANNOUNCE"
1504 ><TT
1505 CLASS="PARAMETER"
1506 ><I
1507 >lm announce</I
1508 ></TT
1509 ></A
1510 ></P
1511 ></LI
1512 ><LI
1513 ><P
1514 ><A
1515 HREF="#LMINTERVAL"
1516 ><TT
1517 CLASS="PARAMETER"
1518 ><I
1519 >lm interval</I
1520 ></TT
1521 ></A
1522 ></P
1523 ></LI
1524 ><LI
1525 ><P
1526 ><A
1527 HREF="#LOADPRINTERS"
1528 ><TT
1529 CLASS="PARAMETER"
1530 ><I
1531 >load printers</I
1532 ></TT
1533 ></A
1534 ></P
1535 ></LI
1536 ><LI
1537 ><P
1538 ><A
1539 HREF="#LOCALMASTER"
1540 ><TT
1541 CLASS="PARAMETER"
1542 ><I
1543 >local master</I
1544 ></TT
1545 ></A
1546 ></P
1547 ></LI
1548 ><LI
1549 ><P
1550 ><A
1551 HREF="#LOCKDIR"
1552 ><TT
1553 CLASS="PARAMETER"
1554 ><I
1555 >lock dir</I
1556 ></TT
1557 ></A
1558 ></P
1559 ></LI
1560 ><LI
1561 ><P
1562 ><A
1563 HREF="#LOCKDIRECTORY"
1564 ><TT
1565 CLASS="PARAMETER"
1566 ><I
1567 >lock directory</I
1568 ></TT
1569 ></A
1570 ></P
1571 ></LI
1572 ><LI
1573 ><P
1574 ><A
1575 HREF="#LOGFILE"
1576 ><TT
1577 CLASS="PARAMETER"
1578 ><I
1579 >log file</I
1580 ></TT
1581 ></A
1582 ></P
1583 ></LI
1584 ><LI
1585 ><P
1586 ><A
1587 HREF="#LOGLEVEL"
1588 ><TT
1589 CLASS="PARAMETER"
1590 ><I
1591 >log level</I
1592 ></TT
1593 ></A
1594 ></P
1595 ></LI
1596 ><LI
1597 ><P
1598 ><A
1599 HREF="#LOGONDRIVE"
1600 ><TT
1601 CLASS="PARAMETER"
1602 ><I
1603 >logon drive</I
1604 ></TT
1605 ></A
1606 ></P
1607 ></LI
1608 ><LI
1609 ><P
1610 ><A
1611 HREF="#LOGONHOME"
1612 ><TT
1613 CLASS="PARAMETER"
1614 ><I
1615 >logon home</I
1616 ></TT
1617 ></A
1618 ></P
1619 ></LI
1620 ><LI
1621 ><P
1622 ><A
1623 HREF="#LOGONPATH"
1624 ><TT
1625 CLASS="PARAMETER"
1626 ><I
1627 >logon path</I
1628 ></TT
1629 ></A
1630 ></P
1631 ></LI
1632 ><LI
1633 ><P
1634 ><A
1635 HREF="#LOGONSCRIPT"
1636 ><TT
1637 CLASS="PARAMETER"
1638 ><I
1639 >logon script</I
1640 ></TT
1641 ></A
1642 ></P
1643 ></LI
1644 ><LI
1645 ><P
1646 ><A
1647 HREF="#LPQCACHETIME"
1648 ><TT
1649 CLASS="PARAMETER"
1650 ><I
1651 >lpq cache time</I
1652 ></TT
1653 ></A
1654 ></P
1655 ></LI
1656 ><LI
1657 ><P
1658 ><A
1659 HREF="#MACHINEPASSWORDTIMEOUT"
1660 ><TT
1661 CLASS="PARAMETER"
1662 ><I
1663 >machine password timeout</I
1664 ></TT
1665 ></A
1666 ></P
1667 ></LI
1668 ><LI
1669 ><P
1670 ><A
1671 HREF="#MANGLEDSTACK"
1672 ><TT
1673 CLASS="PARAMETER"
1674 ><I
1675 >mangled stack</I
1676 ></TT
1677 ></A
1678 ></P
1679 ></LI
1680 ><LI
1681 ><P
1682 ><A
1683 HREF="#MAPTOGUEST"
1684 ><TT
1685 CLASS="PARAMETER"
1686 ><I
1687 >map to guest</I
1688 ></TT
1689 ></A
1690 ></P
1691 ></LI
1692 ><LI
1693 ><P
1694 ><A
1695 HREF="#MAXDISKSIZE"
1696 ><TT
1697 CLASS="PARAMETER"
1698 ><I
1699 >max disk size</I
1700 ></TT
1701 ></A
1702 ></P
1703 ></LI
1704 ><LI
1705 ><P
1706 ><A
1707 HREF="#MAXLOGSIZE"
1708 ><TT
1709 CLASS="PARAMETER"
1710 ><I
1711 >max log size</I
1712 ></TT
1713 ></A
1714 ></P
1715 ></LI
1716 ><LI
1717 ><P
1718 ><A
1719 HREF="#MAXMUX"
1720 ><TT
1721 CLASS="PARAMETER"
1722 ><I
1723 >max mux</I
1724 ></TT
1725 ></A
1726 ></P
1727 ></LI
1728 ><LI
1729 ><P
1730 ><A
1731 HREF="#MAXOPENFILES"
1732 ><TT
1733 CLASS="PARAMETER"
1734 ><I
1735 >max open files</I
1736 ></TT
1737 ></A
1738 ></P
1739 ></LI
1740 ><LI
1741 ><P
1742 ><A
1743 HREF="#MAXPROTOCOL"
1744 ><TT
1745 CLASS="PARAMETER"
1746 ><I
1747 >max protocol</I
1748 ></TT
1749 ></A
1750 ></P
1751 ></LI
1752 ><LI
1753 ><P
1754 ><A
1755 HREF="#MAXSMBDPROCESSES"
1756 ><TT
1757 CLASS="PARAMETER"
1758 ><I
1759 >max smbd processes</I
1760 ></TT
1761 ></A
1762 ></P
1763 ></LI
1764 ><LI
1765 ><P
1766 ><A
1767 HREF="#MAXTTL"
1768 ><TT
1769 CLASS="PARAMETER"
1770 ><I
1771 >max ttl</I
1772 ></TT
1773 ></A
1774 ></P
1775 ></LI
1776 ><LI
1777 ><P
1778 ><A
1779 HREF="#MAXWINSTTL"
1780 ><TT
1781 CLASS="PARAMETER"
1782 ><I
1783 >max wins ttl</I
1784 ></TT
1785 ></A
1786 ></P
1787 ></LI
1788 ><LI
1789 ><P
1790 ><A
1791 HREF="#MAXXMIT"
1792 ><TT
1793 CLASS="PARAMETER"
1794 ><I
1795 >max xmit</I
1796 ></TT
1797 ></A
1798 ></P
1799 ></LI
1800 ><LI
1801 ><P
1802 ><A
1803 HREF="#MESSAGECOMMAND"
1804 ><TT
1805 CLASS="PARAMETER"
1806 ><I
1807 >message command</I
1808 ></TT
1809 ></A
1810 ></P
1811 ></LI
1812 ><LI
1813 ><P
1814 ><A
1815 HREF="#MINPASSWDLENGTH"
1816 ><TT
1817 CLASS="PARAMETER"
1818 ><I
1819 >min passwd length</I
1820 ></TT
1821 ></A
1822 ></P
1823 ></LI
1824 ><LI
1825 ><P
1826 ><A
1827 HREF="#MINPASSWORDLENGTH"
1828 ><TT
1829 CLASS="PARAMETER"
1830 ><I
1831 >min password length</I
1832 ></TT
1833 ></A
1834 ></P
1835 ></LI
1836 ><LI
1837 ><P
1838 ><A
1839 HREF="#MINPROTOCOL"
1840 ><TT
1841 CLASS="PARAMETER"
1842 ><I
1843 >min protocol</I
1844 ></TT
1845 ></A
1846 ></P
1847 ></LI
1848 ><LI
1849 ><P
1850 ><A
1851 HREF="#MINWINSTTL"
1852 ><TT
1853 CLASS="PARAMETER"
1854 ><I
1855 >min wins ttl</I
1856 ></TT
1857 ></A
1858 ></P
1859 ></LI
1860 ><LI
1861 ><P
1862 ><A
1863 HREF="#NAMERESOLVEORDER"
1864 ><TT
1865 CLASS="PARAMETER"
1866 ><I
1867 >name resolve order</I
1868 ></TT
1869 ></A
1870 ></P
1871 ></LI
1872 ><LI
1873 ><P
1874 ><A
1875 HREF="#NETBIOSALIASES"
1876 ><TT
1877 CLASS="PARAMETER"
1878 ><I
1879 >netbios aliases</I
1880 ></TT
1881 ></A
1882 ></P
1883 ></LI
1884 ><LI
1885 ><P
1886 ><A
1887 HREF="#NETBIOSNAME"
1888 ><TT
1889 CLASS="PARAMETER"
1890 ><I
1891 >netbios name</I
1892 ></TT
1893 ></A
1894 ></P
1895 ></LI
1896 ><LI
1897 ><P
1898 ><A
1899 HREF="#NETBIOSSCOPE"
1900 ><TT
1901 CLASS="PARAMETER"
1902 ><I
1903 >netbios scope</I
1904 ></TT
1905 ></A
1906 ></P
1907 ></LI
1908 ><LI
1909 ><P
1910 ><A
1911 HREF="#NISHOMEDIR"
1912 ><TT
1913 CLASS="PARAMETER"
1914 ><I
1915 >nis homedir</I
1916 ></TT
1917 ></A
1918 ></P
1919 ></LI
1920 ><LI
1921 ><P
1922 ><A
1923 HREF="#NONUNIXACCOUNTRANGE"
1924 ><TT
1925 CLASS="PARAMETER"
1926 ><I
1927 >non unix account range</I
1928 ></TT
1929 ></A
1930 ></P
1931 ></LI
1932 ><LI
1933 ><P
1934 ><A
1935 HREF="#NTPIPESUPPORT"
1936 ><TT
1937 CLASS="PARAMETER"
1938 ><I
1939 >nt pipe support</I
1940 ></TT
1941 ></A
1942 ></P
1943 ></LI
1944 ><LI
1945 ><P
1946 ><A
1947 HREF="#NULLPASSWORDS"
1948 ><TT
1949 CLASS="PARAMETER"
1950 ><I
1951 >null passwords</I
1952 ></TT
1953 ></A
1954 ></P
1955 ></LI
1956 ><LI
1957 ><P
1958 ><A
1959 HREF="#OBEYPAMRESTRICTIONS"
1960 ><TT
1961 CLASS="PARAMETER"
1962 ><I
1963 >obey pam restrictions</I
1964 ></TT
1965 ></A
1966 ></P
1967 ></LI
1968 ><LI
1969 ><P
1970 ><A
1971 HREF="#OPLOCKBREAKWAITTIME"
1972 ><TT
1973 CLASS="PARAMETER"
1974 ><I
1975 >oplock break wait time</I
1976 ></TT
1977 ></A
1978 ></P
1979 ></LI
1980 ><LI
1981 ><P
1982 ><A
1983 HREF="#OSLEVEL"
1984 ><TT
1985 CLASS="PARAMETER"
1986 ><I
1987 >os level</I
1988 ></TT
1989 ></A
1990 ></P
1991 ></LI
1992 ><LI
1993 ><P
1994 ><A
1995 HREF="#OS2DRIVERMAP"
1996 ><TT
1997 CLASS="PARAMETER"
1998 ><I
1999 >os2 driver map</I
2000 ></TT
2001 ></A
2002 ></P
2003 ></LI
2004 ><LI
2005 ><P
2006 ><A
2007 HREF="#PAMPASSWORDCHANGE"
2008 ><TT
2009 CLASS="PARAMETER"
2010 ><I
2011 >pam password change</I
2012 ></TT
2013 ></A
2014 ></P
2015 ></LI
2016 ><LI
2017 ><P
2018 ><A
2019 HREF="#PANICACTION"
2020 ><TT
2021 CLASS="PARAMETER"
2022 ><I
2023 >panic action</I
2024 ></TT
2025 ></A
2026 ></P
2027 ></LI
2028 ><LI
2029 ><P
2030 ><A
2031 HREF="#PASSDBBACKEND"
2032 ><TT
2033 CLASS="PARAMETER"
2034 ><I
2035 >passdb backend</I
2036 ></TT
2037 ></A
2038 ></P
2039 ></LI
2040 ><LI
2041 ><P
2042 ><A
2043 HREF="#PASSWDCHAT"
2044 ><TT
2045 CLASS="PARAMETER"
2046 ><I
2047 >passwd chat</I
2048 ></TT
2049 ></A
2050 ></P
2051 ></LI
2052 ><LI
2053 ><P
2054 ><A
2055 HREF="#PASSWDCHATDEBUG"
2056 ><TT
2057 CLASS="PARAMETER"
2058 ><I
2059 >passwd chat debug</I
2060 ></TT
2061 ></A
2062 ></P
2063 ></LI
2064 ><LI
2065 ><P
2066 ><A
2067 HREF="#PASSWDPROGRAM"
2068 ><TT
2069 CLASS="PARAMETER"
2070 ><I
2071 >passwd program</I
2072 ></TT
2073 ></A
2074 ></P
2075 ></LI
2076 ><LI
2077 ><P
2078 ><A
2079 HREF="#PASSWORDLEVEL"
2080 ><TT
2081 CLASS="PARAMETER"
2082 ><I
2083 >password level</I
2084 ></TT
2085 ></A
2086 ></P
2087 ></LI
2088 ><LI
2089 ><P
2090 ><A
2091 HREF="#PASSWORDSERVER"
2092 ><TT
2093 CLASS="PARAMETER"
2094 ><I
2095 >password server</I
2096 ></TT
2097 ></A
2098 ></P
2099 ></LI
2100 ><LI
2101 ><P
2102 ><A
2103 HREF="#PREFEREDMASTER"
2104 ><TT
2105 CLASS="PARAMETER"
2106 ><I
2107 >prefered master</I
2108 ></TT
2109 ></A
2110 ></P
2111 ></LI
2112 ><LI
2113 ><P
2114 ><A
2115 HREF="#PREFERREDMASTER"
2116 ><TT
2117 CLASS="PARAMETER"
2118 ><I
2119 >preferred master</I
2120 ></TT
2121 ></A
2122 ></P
2123 ></LI
2124 ><LI
2125 ><P
2126 ><A
2127 HREF="#PRELOAD"
2128 ><TT
2129 CLASS="PARAMETER"
2130 ><I
2131 >preload</I
2132 ></TT
2133 ></A
2134 ></P
2135 ></LI
2136 ><LI
2137 ><P
2138 ><A
2139 HREF="#PRINTCAP"
2140 ><TT
2141 CLASS="PARAMETER"
2142 ><I
2143 >printcap</I
2144 ></TT
2145 ></A
2146 ></P
2147 ></LI
2148 ><LI
2149 ><P
2150 ><A
2151 HREF="#PRINTCAPNAME"
2152 ><TT
2153 CLASS="PARAMETER"
2154 ><I
2155 >printcap name</I
2156 ></TT
2157 ></A
2158 ></P
2159 ></LI
2160 ><LI
2161 ><P
2162 ><A
2163 HREF="#PRINTERDRIVERFILE"
2164 ><TT
2165 CLASS="PARAMETER"
2166 ><I
2167 >printer driver file</I
2168 ></TT
2169 ></A
2170 ></P
2171 ></LI
2172 ><LI
2173 ><P
2174 ><A
2175 HREF="#PRIVATEDIR"
2176 ><TT
2177 CLASS="PARAMETER"
2178 ><I
2179 >private dir</I
2180 ></TT
2181 ></A
2182 ></P
2183 ></LI
2184 ><LI
2185 ><P
2186 ><A
2187 HREF="#PROTOCOL"
2188 ><TT
2189 CLASS="PARAMETER"
2190 ><I
2191 >protocol</I
2192 ></TT
2193 ></A
2194 ></P
2195 ></LI
2196 ><LI
2197 ><P
2198 ><A
2199 HREF="#READBMPX"
2200 ><TT
2201 CLASS="PARAMETER"
2202 ><I
2203 >read bmpx</I
2204 ></TT
2205 ></A
2206 ></P
2207 ></LI
2208 ><LI
2209 ><P
2210 ><A
2211 HREF="#READRAW"
2212 ><TT
2213 CLASS="PARAMETER"
2214 ><I
2215 >read raw</I
2216 ></TT
2217 ></A
2218 ></P
2219 ></LI
2220 ><LI
2221 ><P
2222 ><A
2223 HREF="#READSIZE"
2224 ><TT
2225 CLASS="PARAMETER"
2226 ><I
2227 >read size</I
2228 ></TT
2229 ></A
2230 ></P
2231 ></LI
2232 ><LI
2233 ><P
2234 ><A
2235 HREF="#REMOTEANNOUNCE"
2236 ><TT
2237 CLASS="PARAMETER"
2238 ><I
2239 >remote announce</I
2240 ></TT
2241 ></A
2242 ></P
2243 ></LI
2244 ><LI
2245 ><P
2246 ><A
2247 HREF="#REMOTEBROWSESYNC"
2248 ><TT
2249 CLASS="PARAMETER"
2250 ><I
2251 >remote browse sync</I
2252 ></TT
2253 ></A
2254 ></P
2255 ></LI
2256 ><LI
2257 ><P
2258 ><A
2259 HREF="#RESTRICTANONYMOUS"
2260 ><TT
2261 CLASS="PARAMETER"
2262 ><I
2263 >restrict anonymous</I
2264 ></TT
2265 ></A
2266 ></P
2267 ></LI
2268 ><LI
2269 ><P
2270 ><A
2271 HREF="#ROOT"
2272 ><TT
2273 CLASS="PARAMETER"
2274 ><I
2275 >root</I
2276 ></TT
2277 ></A
2278 ></P
2279 ></LI
2280 ><LI
2281 ><P
2282 ><A
2283 HREF="#ROOTDIR"
2284 ><TT
2285 CLASS="PARAMETER"
2286 ><I
2287 >root dir</I
2288 ></TT
2289 ></A
2290 ></P
2291 ></LI
2292 ><LI
2293 ><P
2294 ><A
2295 HREF="#ROOTDIRECTORY"
2296 ><TT
2297 CLASS="PARAMETER"
2298 ><I
2299 >root directory</I
2300 ></TT
2301 ></A
2302 ></P
2303 ></LI
2304 ><LI
2305 ><P
2306 ><A
2307 HREF="#SECURITY"
2308 ><TT
2309 CLASS="PARAMETER"
2310 ><I
2311 >security</I
2312 ></TT
2313 ></A
2314 ></P
2315 ></LI
2316 ><LI
2317 ><P
2318 ><A
2319 HREF="#SERVERSTRING"
2320 ><TT
2321 CLASS="PARAMETER"
2322 ><I
2323 >server string</I
2324 ></TT
2325 ></A
2326 ></P
2327 ></LI
2328 ><LI
2329 ><P
2330 ><A
2331 HREF="#SHOWADDPRINTERWIZARD"
2332 ><TT
2333 CLASS="PARAMETER"
2334 ><I
2335 >show add printer wizard</I
2336 ></TT
2337 ></A
2338 ></P
2339 ></LI
2340 ><LI
2341 ><P
2342 ><A
2343 HREF="#SHUTDOWNSCRIPT"
2344 ><TT
2345 CLASS="PARAMETER"
2346 ><I
2347 >shutdown script</I
2348 ></TT
2349 ></A
2350 ></P
2351 ></LI
2352 ><LI
2353 ><P
2354 ><A
2355 HREF="#SMBPASSWDFILE"
2356 ><TT
2357 CLASS="PARAMETER"
2358 ><I
2359 >smb passwd file</I
2360 ></TT
2361 ></A
2362 ></P
2363 ></LI
2364 ><LI
2365 ><P
2366 ><A
2367 HREF="#SOCKETADDRESS"
2368 ><TT
2369 CLASS="PARAMETER"
2370 ><I
2371 >socket address</I
2372 ></TT
2373 ></A
2374 ></P
2375 ></LI
2376 ><LI
2377 ><P
2378 ><A
2379 HREF="#SOCKETOPTIONS"
2380 ><TT
2381 CLASS="PARAMETER"
2382 ><I
2383 >socket options</I
2384 ></TT
2385 ></A
2386 ></P
2387 ></LI
2388 ><LI
2389 ><P
2390 ><A
2391 HREF="#SOURCEENVIRONMENT"
2392 ><TT
2393 CLASS="PARAMETER"
2394 ><I
2395 >source environment</I
2396 ></TT
2397 ></A
2398 ></P
2399 ></LI
2400 ><LI
2401 ><P
2402 ><A
2403 HREF="#SSL"
2404 ><TT
2405 CLASS="PARAMETER"
2406 ><I
2407 >ssl</I
2408 ></TT
2409 ></A
2410 ></P
2411 ></LI
2412 ><LI
2413 ><P
2414 ><A
2415 HREF="#SSLCACERTDIR"
2416 ><TT
2417 CLASS="PARAMETER"
2418 ><I
2419 >ssl CA certDir</I
2420 ></TT
2421 ></A
2422 ></P
2423 ></LI
2424 ><LI
2425 ><P
2426 ><A
2427 HREF="#SSLCACERTFILE"
2428 ><TT
2429 CLASS="PARAMETER"
2430 ><I
2431 >ssl CA certFile</I
2432 ></TT
2433 ></A
2434 ></P
2435 ></LI
2436 ><LI
2437 ><P
2438 ><A
2439 HREF="#SSLCIPHERS"
2440 ><TT
2441 CLASS="PARAMETER"
2442 ><I
2443 >ssl ciphers</I
2444 ></TT
2445 ></A
2446 ></P
2447 ></LI
2448 ><LI
2449 ><P
2450 ><A
2451 HREF="#SSLCLIENTCERT"
2452 ><TT
2453 CLASS="PARAMETER"
2454 ><I
2455 >ssl client cert</I
2456 ></TT
2457 ></A
2458 ></P
2459 ></LI
2460 ><LI
2461 ><P
2462 ><A
2463 HREF="#SSLCLIENTKEY"
2464 ><TT
2465 CLASS="PARAMETER"
2466 ><I
2467 >ssl client key</I
2468 ></TT
2469 ></A
2470 ></P
2471 ></LI
2472 ><LI
2473 ><P
2474 ><A
2475 HREF="#SSLCOMPATIBILITY"
2476 ><TT
2477 CLASS="PARAMETER"
2478 ><I
2479 >ssl compatibility</I
2480 ></TT
2481 ></A
2482 ></P
2483 ></LI
2484 ><LI
2485 ><P
2486 ><A
2487 HREF="#SSLEGDSOCKET"
2488 ><TT
2489 CLASS="PARAMETER"
2490 ><I
2491 >ssl egd socket</I
2492 ></TT
2493 ></A
2494 ></P
2495 ></LI
2496 ><LI
2497 ><P
2498 ><A
2499 HREF="#SSLENTROPYBYTES"
2500 ><TT
2501 CLASS="PARAMETER"
2502 ><I
2503 >ssl entropy bytes</I
2504 ></TT
2505 ></A
2506 ></P
2507 ></LI
2508 ><LI
2509 ><P
2510 ><A
2511 HREF="#SSLENTROPYFILE"
2512 ><TT
2513 CLASS="PARAMETER"
2514 ><I
2515 >ssl entropy file</I
2516 ></TT
2517 ></A
2518 ></P
2519 ></LI
2520 ><LI
2521 ><P
2522 ><A
2523 HREF="#SSLHOSTS"
2524 ><TT
2525 CLASS="PARAMETER"
2526 ><I
2527 >ssl hosts</I
2528 ></TT
2529 ></A
2530 ></P
2531 ></LI
2532 ><LI
2533 ><P
2534 ><A
2535 HREF="#SSLHOSTSRESIGN"
2536 ><TT
2537 CLASS="PARAMETER"
2538 ><I
2539 >ssl hosts resign</I
2540 ></TT
2541 ></A
2542 ></P
2543 ></LI
2544 ><LI
2545 ><P
2546 ><A
2547 HREF="#SSLREQUIRECLIENTCERT"
2548 ><TT
2549 CLASS="PARAMETER"
2550 ><I
2551 >ssl require clientcert</I
2552 ></TT
2553 ></A
2554 ></P
2555 ></LI
2556 ><LI
2557 ><P
2558 ><A
2559 HREF="#SSLREQUIRESERVERCERT"
2560 ><TT
2561 CLASS="PARAMETER"
2562 ><I
2563 >ssl require servercert</I
2564 ></TT
2565 ></A
2566 ></P
2567 ></LI
2568 ><LI
2569 ><P
2570 ><A
2571 HREF="#SSLSERVERCERT"
2572 ><TT
2573 CLASS="PARAMETER"
2574 ><I
2575 >ssl server cert</I
2576 ></TT
2577 ></A
2578 ></P
2579 ></LI
2580 ><LI
2581 ><P
2582 ><A
2583 HREF="#SSLSERVERKEY"
2584 ><TT
2585 CLASS="PARAMETER"
2586 ><I
2587 >ssl server key</I
2588 ></TT
2589 ></A
2590 ></P
2591 ></LI
2592 ><LI
2593 ><P
2594 ><A
2595 HREF="#SSLVERSION"
2596 ><TT
2597 CLASS="PARAMETER"
2598 ><I
2599 >ssl version</I
2600 ></TT
2601 ></A
2602 ></P
2603 ></LI
2604 ><LI
2605 ><P
2606 ><A
2607 HREF="#STATCACHE"
2608 ><TT
2609 CLASS="PARAMETER"
2610 ><I
2611 >stat cache</I
2612 ></TT
2613 ></A
2614 ></P
2615 ></LI
2616 ><LI
2617 ><P
2618 ><A
2619 HREF="#STATCACHESIZE"
2620 ><TT
2621 CLASS="PARAMETER"
2622 ><I
2623 >stat cache size</I
2624 ></TT
2625 ></A
2626 ></P
2627 ></LI
2628 ><LI
2629 ><P
2630 ><A
2631 HREF="#STRIPDOT"
2632 ><TT
2633 CLASS="PARAMETER"
2634 ><I
2635 >strip dot</I
2636 ></TT
2637 ></A
2638 ></P
2639 ></LI
2640 ><LI
2641 ><P
2642 ><A
2643 HREF="#SYSLOG"
2644 ><TT
2645 CLASS="PARAMETER"
2646 ><I
2647 >syslog</I
2648 ></TT
2649 ></A
2650 ></P
2651 ></LI
2652 ><LI
2653 ><P
2654 ><A
2655 HREF="#SYSLOGONLY"
2656 ><TT
2657 CLASS="PARAMETER"
2658 ><I
2659 >syslog only</I
2660 ></TT
2661 ></A
2662 ></P
2663 ></LI
2664 ><LI
2665 ><P
2666 ><A
2667 HREF="#TEMPLATEHOMEDIR"
2668 ><TT
2669 CLASS="PARAMETER"
2670 ><I
2671 >template homedir</I
2672 ></TT
2673 ></A
2674 ></P
2675 ></LI
2676 ><LI
2677 ><P
2678 ><A
2679 HREF="#TEMPLATESHELL"
2680 ><TT
2681 CLASS="PARAMETER"
2682 ><I
2683 >template shell</I
2684 ></TT
2685 ></A
2686 ></P
2687 ></LI
2688 ><LI
2689 ><P
2690 ><A
2691 HREF="#TIMEOFFSET"
2692 ><TT
2693 CLASS="PARAMETER"
2694 ><I
2695 >time offset</I
2696 ></TT
2697 ></A
2698 ></P
2699 ></LI
2700 ><LI
2701 ><P
2702 ><A
2703 HREF="#TIMESERVER"
2704 ><TT
2705 CLASS="PARAMETER"
2706 ><I
2707 >time server</I
2708 ></TT
2709 ></A
2710 ></P
2711 ></LI
2712 ><LI
2713 ><P
2714 ><A
2715 HREF="#TIMESTAMPLOGS"
2716 ><TT
2717 CLASS="PARAMETER"
2718 ><I
2719 >timestamp logs</I
2720 ></TT
2721 ></A
2722 ></P
2723 ></LI
2724 ><LI
2725 ><P
2726 ><A
2727 HREF="#TOTALPRINTJOBS"
2728 ><TT
2729 CLASS="PARAMETER"
2730 ><I
2731 >total print jobs</I
2732 ></TT
2733 ></A
2734 ></P
2735 ></LI
2736 ><LI
2737 ><P
2738 ><A
2739 HREF="#UNIXEXTENSIONS"
2740 ><TT
2741 CLASS="PARAMETER"
2742 ><I
2743 >unix extensions</I
2744 ></TT
2745 ></A
2746 ></P
2747 ></LI
2748 ><LI
2749 ><P
2750 ><A
2751 HREF="#UNIXPASSWORDSYNC"
2752 ><TT
2753 CLASS="PARAMETER"
2754 ><I
2755 >unix password sync</I
2756 ></TT
2757 ></A
2758 ></P
2759 ></LI
2760 ><LI
2761 ><P
2762 ><A
2763 HREF="#UPDATEENCRYPTED"
2764 ><TT
2765 CLASS="PARAMETER"
2766 ><I
2767 >update encrypted</I
2768 ></TT
2769 ></A
2770 ></P
2771 ></LI
2772 ><LI
2773 ><P
2774 ><A
2775 HREF="#USEMMAP"
2776 ><TT
2777 CLASS="PARAMETER"
2778 ><I
2779 >use mmap</I
2780 ></TT
2781 ></A
2782 ></P
2783 ></LI
2784 ><LI
2785 ><P
2786 ><A
2787 HREF="#USERHOSTS"
2788 ><TT
2789 CLASS="PARAMETER"
2790 ><I
2791 >use rhosts</I
2792 ></TT
2793 ></A
2794 ></P
2795 ></LI
2796 ><LI
2797 ><P
2798 ><A
2799 HREF="#USERNAMELEVEL"
2800 ><TT
2801 CLASS="PARAMETER"
2802 ><I
2803 >username level</I
2804 ></TT
2805 ></A
2806 ></P
2807 ></LI
2808 ><LI
2809 ><P
2810 ><A
2811 HREF="#USERNAMEMAP"
2812 ><TT
2813 CLASS="PARAMETER"
2814 ><I
2815 >username map</I
2816 ></TT
2817 ></A
2818 ></P
2819 ></LI
2820 ><LI
2821 ><P
2822 ><A
2823 HREF="#UTMP"
2824 ><TT
2825 CLASS="PARAMETER"
2826 ><I
2827 >utmp</I
2828 ></TT
2829 ></A
2830 ></P
2831 ></LI
2832 ><LI
2833 ><P
2834 ><A
2835 HREF="#UTMPDIRECTORY"
2836 ><TT
2837 CLASS="PARAMETER"
2838 ><I
2839 >utmp directory</I
2840 ></TT
2841 ></A
2842 ></P
2843 ></LI
2844 ><LI
2845 ><P
2846 ><A
2847 HREF="#WINBINDCACHETIME"
2848 ><TT
2849 CLASS="PARAMETER"
2850 ><I
2851 >winbind cache time</I
2852 ></TT
2853 ></A
2854 ></P
2855 ></LI
2856 ><LI
2857 ><P
2858 ><A
2859 HREF="#WINBINDENUMUSERS"
2860 ><TT
2861 CLASS="PARAMETER"
2862 ><I
2863 >winbind enum users</I
2864 ></TT
2865 ></A
2866 ></P
2867 ></LI
2868 ><LI
2869 ><P
2870 ><A
2871 HREF="#WINBINDENUMGROUPS"
2872 ><TT
2873 CLASS="PARAMETER"
2874 ><I
2875 >winbind enum groups</I
2876 ></TT
2877 ></A
2878 ></P
2879 ></LI
2880 ><LI
2881 ><P
2882 ><A
2883 HREF="#WINBINDGID"
2884 ><TT
2885 CLASS="PARAMETER"
2886 ><I
2887 >winbind gid</I
2888 ></TT
2889 ></A
2890 ></P
2891 ></LI
2892 ><LI
2893 ><P
2894 ><A
2895 HREF="#WINBINDSEPARATOR"
2896 ><TT
2897 CLASS="PARAMETER"
2898 ><I
2899 >winbind separator</I
2900 ></TT
2901 ></A
2902 ></P
2903 ></LI
2904 ><LI
2905 ><P
2906 ><A
2907 HREF="#WINBINDUID"
2908 ><TT
2909 CLASS="PARAMETER"
2910 ><I
2911 >winbind uid</I
2912 ></TT
2913 ></A
2914 ></P
2915 ></LI
2916 ><LI
2917 ><P
2918 ><A
2919 HREF="#WINBINDUSEDEFAULTDOMAIN"
2920 ><TT
2921 CLASS="PARAMETER"
2922 ><I
2923 >winbind use default domain</I
2924 ></TT
2925 ></A
2926 ></P
2927 ></LI
2928 ><LI
2929 ><P
2930 ><A
2931 HREF="#WINSHOOK"
2932 ><TT
2933 CLASS="PARAMETER"
2934 ><I
2935 >wins hook</I
2936 ></TT
2937 ></A
2938 ></P
2939 ></LI
2940 ><LI
2941 ><P
2942 ><A
2943 HREF="#WINSPROXY"
2944 ><TT
2945 CLASS="PARAMETER"
2946 ><I
2947 >wins proxy</I
2948 ></TT
2949 ></A
2950 ></P
2951 ></LI
2952 ><LI
2953 ><P
2954 ><A
2955 HREF="#WINSSERVER"
2956 ><TT
2957 CLASS="PARAMETER"
2958 ><I
2959 >wins server</I
2960 ></TT
2961 ></A
2962 ></P
2963 ></LI
2964 ><LI
2965 ><P
2966 ><A
2967 HREF="#WINSSUPPORT"
2968 ><TT
2969 CLASS="PARAMETER"
2970 ><I
2971 >wins support</I
2972 ></TT
2973 ></A
2974 ></P
2975 ></LI
2976 ><LI
2977 ><P
2978 ><A
2979 HREF="#WORKGROUP"
2980 ><TT
2981 CLASS="PARAMETER"
2982 ><I
2983 >workgroup</I
2984 ></TT
2985 ></A
2986 ></P
2987 ></LI
2988 ><LI
2989 ><P
2990 ><A
2991 HREF="#WRITERAW"
2992 ><TT
2993 CLASS="PARAMETER"
2994 ><I
2995 >write raw</I
2996 ></TT
2997 ></A
2998 ></P
2999 ></LI
3000 ></UL
3001 ></DIV
3002 ><DIV
3003 CLASS="REFSECT1"
3004 ><A
3005 NAME="AEN971"
3006 ></A
3007 ><H2
3008 >COMPLETE LIST OF SERVICE PARAMETERS</H2
3009 ><P
3010 >Here is a list of all service parameters. See the section on
3011         each parameter for details. Note that some are synonyms.</P
3012 ><P
3013 ></P
3014 ><UL
3015 ><LI
3016 ><P
3017 ><A
3018 HREF="#ADMINUSERS"
3019 ><TT
3020 CLASS="PARAMETER"
3021 ><I
3022 >admin users</I
3023 ></TT
3024 ></A
3025 ></P
3026 ></LI
3027 ><LI
3028 ><P
3029 ><A
3030 HREF="#ALLOWHOSTS"
3031 ><TT
3032 CLASS="PARAMETER"
3033 ><I
3034 >allow hosts</I
3035 ></TT
3036 ></A
3037 ></P
3038 ></LI
3039 ><LI
3040 ><P
3041 ><A
3042 HREF="#AVAILABLE"
3043 ><TT
3044 CLASS="PARAMETER"
3045 ><I
3046 >available</I
3047 ></TT
3048 ></A
3049 ></P
3050 ></LI
3051 ><LI
3052 ><P
3053 ><A
3054 HREF="#BLOCKINGLOCKS"
3055 ><TT
3056 CLASS="PARAMETER"
3057 ><I
3058 >blocking locks</I
3059 ></TT
3060 ></A
3061 ></P
3062 ></LI
3063 ><LI
3064 ><P
3065 ><A
3066 HREF="#BROWSABLE"
3067 ><TT
3068 CLASS="PARAMETER"
3069 ><I
3070 >browsable</I
3071 ></TT
3072 ></A
3073 ></P
3074 ></LI
3075 ><LI
3076 ><P
3077 ><A
3078 HREF="#BROWSEABLE"
3079 ><TT
3080 CLASS="PARAMETER"
3081 ><I
3082 >browseable</I
3083 ></TT
3084 ></A
3085 ></P
3086 ></LI
3087 ><LI
3088 ><P
3089 ><A
3090 HREF="#CASESENSITIVE"
3091 ><TT
3092 CLASS="PARAMETER"
3093 ><I
3094 >case sensitive</I
3095 ></TT
3096 ></A
3097 ></P
3098 ></LI
3099 ><LI
3100 ><P
3101 ><A
3102 HREF="#CASESIGNAMES"
3103 ><TT
3104 CLASS="PARAMETER"
3105 ><I
3106 >casesignames</I
3107 ></TT
3108 ></A
3109 ></P
3110 ></LI
3111 ><LI
3112 ><P
3113 ><A
3114 HREF="#COMMENT"
3115 ><TT
3116 CLASS="PARAMETER"
3117 ><I
3118 >comment</I
3119 ></TT
3120 ></A
3121 ></P
3122 ></LI
3123 ><LI
3124 ><P
3125 ><A
3126 HREF="#COPY"
3127 ><TT
3128 CLASS="PARAMETER"
3129 ><I
3130 >copy</I
3131 ></TT
3132 ></A
3133 ></P
3134 ></LI
3135 ><LI
3136 ><P
3137 ><A
3138 HREF="#CREATEMASK"
3139 ><TT
3140 CLASS="PARAMETER"
3141 ><I
3142 >create mask</I
3143 ></TT
3144 ></A
3145 ></P
3146 ></LI
3147 ><LI
3148 ><P
3149 ><A
3150 HREF="#CREATEMODE"
3151 ><TT
3152 CLASS="PARAMETER"
3153 ><I
3154 >create mode</I
3155 ></TT
3156 ></A
3157 ></P
3158 ></LI
3159 ><LI
3160 ><P
3161 ><A
3162 HREF="#DEFAULTCASE"
3163 ><TT
3164 CLASS="PARAMETER"
3165 ><I
3166 >default case</I
3167 ></TT
3168 ></A
3169 ></P
3170 ></LI
3171 ><LI
3172 ><P
3173 ><A
3174 HREF="#DEFAULTDEVMODE"
3175 ><TT
3176 CLASS="PARAMETER"
3177 ><I
3178 >default devmode</I
3179 ></TT
3180 ></A
3181 ></P
3182 ></LI
3183 ><LI
3184 ><P
3185 ><A
3186 HREF="#DELETEREADONLY"
3187 ><TT
3188 CLASS="PARAMETER"
3189 ><I
3190 >delete readonly</I
3191 ></TT
3192 ></A
3193 ></P
3194 ></LI
3195 ><LI
3196 ><P
3197 ><A
3198 HREF="#DELETEVETOFILES"
3199 ><TT
3200 CLASS="PARAMETER"
3201 ><I
3202 >delete veto files</I
3203 ></TT
3204 ></A
3205 ></P
3206 ></LI
3207 ><LI
3208 ><P
3209 ><A
3210 HREF="#DENYHOSTS"
3211 ><TT
3212 CLASS="PARAMETER"
3213 ><I
3214 >deny hosts</I
3215 ></TT
3216 ></A
3217 ></P
3218 ></LI
3219 ><LI
3220 ><P
3221 ><A
3222 HREF="#DIRECTORY"
3223 ><TT
3224 CLASS="PARAMETER"
3225 ><I
3226 >directory</I
3227 ></TT
3228 ></A
3229 ></P
3230 ></LI
3231 ><LI
3232 ><P
3233 ><A
3234 HREF="#DIRECTORYMASK"
3235 ><TT
3236 CLASS="PARAMETER"
3237 ><I
3238 >directory mask</I
3239 ></TT
3240 ></A
3241 ></P
3242 ></LI
3243 ><LI
3244 ><P
3245 ><A
3246 HREF="#DIRECTORYMODE"
3247 ><TT
3248 CLASS="PARAMETER"
3249 ><I
3250 >directory mode</I
3251 ></TT
3252 ></A
3253 ></P
3254 ></LI
3255 ><LI
3256 ><P
3257 ><A
3258 HREF="#DIRECTORYSECURITYMASK"
3259 ><TT
3260 CLASS="PARAMETER"
3261 ><I
3262 >directory security mask</I
3263 ></TT
3264 ></A
3265 ></P
3266 ></LI
3267 ><LI
3268 ><P
3269 ><A
3270 HREF="#DONTDESCEND"
3271 ><TT
3272 CLASS="PARAMETER"
3273 ><I
3274 >dont descend</I
3275 ></TT
3276 ></A
3277 ></P
3278 ></LI
3279 ><LI
3280 ><P
3281 ><A
3282 HREF="#DOSFILEMODE"
3283 ><TT
3284 CLASS="PARAMETER"
3285 ><I
3286 >dos filemode</I
3287 ></TT
3288 ></A
3289 ></P
3290 ></LI
3291 ><LI
3292 ><P
3293 ><A
3294 HREF="#DOSFILETIMERESOLUTION"
3295 ><TT
3296 CLASS="PARAMETER"
3297 ><I
3298 >dos filetime resolution</I
3299 ></TT
3300 ></A
3301 ></P
3302 ></LI
3303 ><LI
3304 ><P
3305 ><A
3306 HREF="#DOSFILETIMES"
3307 ><TT
3308 CLASS="PARAMETER"
3309 ><I
3310 >dos filetimes</I
3311 ></TT
3312 ></A
3313 ></P
3314 ></LI
3315 ><LI
3316 ><P
3317 ><A
3318 HREF="#EXEC"
3319 ><TT
3320 CLASS="PARAMETER"
3321 ><I
3322 >exec</I
3323 ></TT
3324 ></A
3325 ></P
3326 ></LI
3327 ><LI
3328 ><P
3329 ><A
3330 HREF="#FAKEDIRECTORYCREATETIMES"
3331 ><TT
3332 CLASS="PARAMETER"
3333 ><I
3334 >fake directory create times</I
3335 ></TT
3336 ></A
3337 ></P
3338 ></LI
3339 ><LI
3340 ><P
3341 ><A
3342 HREF="#FAKEOPLOCKS"
3343 ><TT
3344 CLASS="PARAMETER"
3345 ><I
3346 >fake oplocks</I
3347 ></TT
3348 ></A
3349 ></P
3350 ></LI
3351 ><LI
3352 ><P
3353 ><A
3354 HREF="#FOLLOWSYMLINKS"
3355 ><TT
3356 CLASS="PARAMETER"
3357 ><I
3358 >follow symlinks</I
3359 ></TT
3360 ></A
3361 ></P
3362 ></LI
3363 ><LI
3364 ><P
3365 ><A
3366 HREF="#FORCECREATEMODE"
3367 ><TT
3368 CLASS="PARAMETER"
3369 ><I
3370 >force create mode</I
3371 ></TT
3372 ></A
3373 ></P
3374 ></LI
3375 ><LI
3376 ><P
3377 ><A
3378 HREF="#FORCEDIRECTORYMODE"
3379 ><TT
3380 CLASS="PARAMETER"
3381 ><I
3382 >force directory mode</I
3383 ></TT
3384 ></A
3385 ></P
3386 ></LI
3387 ><LI
3388 ><P
3389 ><A
3390 HREF="#FORCEDIRECTORYSECURITYMODE"
3391 ><TT
3392 CLASS="PARAMETER"
3393 ><I
3394 >force directory security mode</I
3395 ></TT
3396 ></A
3397 ></P
3398 ></LI
3399 ><LI
3400 ><P
3401 ><A
3402 HREF="#FORCEGROUP"
3403 ><TT
3404 CLASS="PARAMETER"
3405 ><I
3406 >force group</I
3407 ></TT
3408 ></A
3409 ></P
3410 ></LI
3411 ><LI
3412 ><P
3413 ><A
3414 HREF="#FORCESECURITYMODE"
3415 ><TT
3416 CLASS="PARAMETER"
3417 ><I
3418 >force security mode</I
3419 ></TT
3420 ></A
3421 ></P
3422 ></LI
3423 ><LI
3424 ><P
3425 ><A
3426 HREF="#FORCEUSER"
3427 ><TT
3428 CLASS="PARAMETER"
3429 ><I
3430 >force user</I
3431 ></TT
3432 ></A
3433 ></P
3434 ></LI
3435 ><LI
3436 ><P
3437 ><A
3438 HREF="#FSTYPE"
3439 ><TT
3440 CLASS="PARAMETER"
3441 ><I
3442 >fstype</I
3443 ></TT
3444 ></A
3445 ></P
3446 ></LI
3447 ><LI
3448 ><P
3449 ><A
3450 HREF="#GROUP"
3451 ><TT
3452 CLASS="PARAMETER"
3453 ><I
3454 >group</I
3455 ></TT
3456 ></A
3457 ></P
3458 ></LI
3459 ><LI
3460 ><P
3461 ><A
3462 HREF="#GUESTACCOUNT"
3463 ><TT
3464 CLASS="PARAMETER"
3465 ><I
3466 >guest account</I
3467 ></TT
3468 ></A
3469 ></P
3470 ></LI
3471 ><LI
3472 ><P
3473 ><A
3474 HREF="#GUESTOK"
3475 ><TT
3476 CLASS="PARAMETER"
3477 ><I
3478 >guest ok</I
3479 ></TT
3480 ></A
3481 ></P
3482 ></LI
3483 ><LI
3484 ><P
3485 ><A
3486 HREF="#GUESTONLY"
3487 ><TT
3488 CLASS="PARAMETER"
3489 ><I
3490 >guest only</I
3491 ></TT
3492 ></A
3493 ></P
3494 ></LI
3495 ><LI
3496 ><P
3497 ><A
3498 HREF="#HIDEDOTFILES"
3499 ><TT
3500 CLASS="PARAMETER"
3501 ><I
3502 >hide dot files</I
3503 ></TT
3504 ></A
3505 ></P
3506 ></LI
3507 ><LI
3508 ><P
3509 ><A
3510 HREF="#HIDEFILES"
3511 ><TT
3512 CLASS="PARAMETER"
3513 ><I
3514 >hide files</I
3515 ></TT
3516 ></A
3517 ></P
3518 ></LI
3519 ><LI
3520 ><P
3521 ><A
3522 HREF="#HOSTSALLOW"
3523 ><TT
3524 CLASS="PARAMETER"
3525 ><I
3526 >hosts allow</I
3527 ></TT
3528 ></A
3529 ></P
3530 ></LI
3531 ><LI
3532 ><P
3533 ><A
3534 HREF="#HOSTSDENY"
3535 ><TT
3536 CLASS="PARAMETER"
3537 ><I
3538 >hosts deny</I
3539 ></TT
3540 ></A
3541 ></P
3542 ></LI
3543 ><LI
3544 ><P
3545 ><A
3546 HREF="#INCLUDE"
3547 ><TT
3548 CLASS="PARAMETER"
3549 ><I
3550 >include</I
3551 ></TT
3552 ></A
3553 ></P
3554 ></LI
3555 ><LI
3556 ><P
3557 ><A
3558 HREF="#INHERITPERMISSIONS"
3559 ><TT
3560 CLASS="PARAMETER"
3561 ><I
3562 >inherit permissions</I
3563 ></TT
3564 ></A
3565 ></P
3566 ></LI
3567 ><LI
3568 ><P
3569 ><A
3570 HREF="#INVALIDUSERS"
3571 ><TT
3572 CLASS="PARAMETER"
3573 ><I
3574 >invalid users</I
3575 ></TT
3576 ></A
3577 ></P
3578 ></LI
3579 ><LI
3580 ><P
3581 ><A
3582 HREF="#LEVEL2OPLOCKS"
3583 ><TT
3584 CLASS="PARAMETER"
3585 ><I
3586 >level2 oplocks</I
3587 ></TT
3588 ></A
3589 ></P
3590 ></LI
3591 ><LI
3592 ><P
3593 ><A
3594 HREF="#LOCKING"
3595 ><TT
3596 CLASS="PARAMETER"
3597 ><I
3598 >locking</I
3599 ></TT
3600 ></A
3601 ></P
3602 ></LI
3603 ><LI
3604 ><P
3605 ><A
3606 HREF="#LPPAUSECOMMAND"
3607 ><TT
3608 CLASS="PARAMETER"
3609 ><I
3610 >lppause command</I
3611 ></TT
3612 ></A
3613 ></P
3614 ></LI
3615 ><LI
3616 ><P
3617 ><A
3618 HREF="#LPQCOMMAND"
3619 ><TT
3620 CLASS="PARAMETER"
3621 ><I
3622 >lpq command</I
3623 ></TT
3624 ></A
3625 ></P
3626 ></LI
3627 ><LI
3628 ><P
3629 ><A
3630 HREF="#LPRESUMECOMMAND"
3631 ><TT
3632 CLASS="PARAMETER"
3633 ><I
3634 >lpresume command</I
3635 ></TT
3636 ></A
3637 ></P
3638 ></LI
3639 ><LI
3640 ><P
3641 ><A
3642 HREF="#LPRMCOMMAND"
3643 ><TT
3644 CLASS="PARAMETER"
3645 ><I
3646 >lprm command</I
3647 ></TT
3648 ></A
3649 ></P
3650 ></LI
3651 ><LI
3652 ><P
3653 ><A
3654 HREF="#MAGICOUTPUT"
3655 ><TT
3656 CLASS="PARAMETER"
3657 ><I
3658 >magic output</I
3659 ></TT
3660 ></A
3661 ></P
3662 ></LI
3663 ><LI
3664 ><P
3665 ><A
3666 HREF="#MAGICSCRIPT"
3667 ><TT
3668 CLASS="PARAMETER"
3669 ><I
3670 >magic script</I
3671 ></TT
3672 ></A
3673 ></P
3674 ></LI
3675 ><LI
3676 ><P
3677 ><A
3678 HREF="#MANGLECASE"
3679 ><TT
3680 CLASS="PARAMETER"
3681 ><I
3682 >mangle case</I
3683 ></TT
3684 ></A
3685 ></P
3686 ></LI
3687 ><LI
3688 ><P
3689 ><A
3690 HREF="#MANGLEDMAP"
3691 ><TT
3692 CLASS="PARAMETER"
3693 ><I
3694 >mangled map</I
3695 ></TT
3696 ></A
3697 ></P
3698 ></LI
3699 ><LI
3700 ><P
3701 ><A
3702 HREF="#MANGLEDNAMES"
3703 ><TT
3704 CLASS="PARAMETER"
3705 ><I
3706 >mangled names</I
3707 ></TT
3708 ></A
3709 ></P
3710 ></LI
3711 ><LI
3712 ><P
3713 ><A
3714 HREF="#MANGLINGCHAR"
3715 ><TT
3716 CLASS="PARAMETER"
3717 ><I
3718 >mangling char</I
3719 ></TT
3720 ></A
3721 ></P
3722 ></LI
3723 ><LI
3724 ><P
3725 ><A
3726 HREF="#MAPARCHIVE"
3727 ><TT
3728 CLASS="PARAMETER"
3729 ><I
3730 >map archive</I
3731 ></TT
3732 ></A
3733 ></P
3734 ></LI
3735 ><LI
3736 ><P
3737 ><A
3738 HREF="#MAPHIDDEN"
3739 ><TT
3740 CLASS="PARAMETER"
3741 ><I
3742 >map hidden</I
3743 ></TT
3744 ></A
3745 ></P
3746 ></LI
3747 ><LI
3748 ><P
3749 ><A
3750 HREF="#MAPSYSTEM"
3751 ><TT
3752 CLASS="PARAMETER"
3753 ><I
3754 >map system</I
3755 ></TT
3756 ></A
3757 ></P
3758 ></LI
3759 ><LI
3760 ><P
3761 ><A
3762 HREF="#MAXCONNECTIONS"
3763 ><TT
3764 CLASS="PARAMETER"
3765 ><I
3766 >max connections</I
3767 ></TT
3768 ></A
3769 ></P
3770 ></LI
3771 ><LI
3772 ><P
3773 ><A
3774 HREF="#MAXPRINTJOBS"
3775 ><TT
3776 CLASS="PARAMETER"
3777 ><I
3778 >max print jobs</I
3779 ></TT
3780 ></A
3781 ></P
3782 ></LI
3783 ><LI
3784 ><P
3785 ><A
3786 HREF="#MINPRINTSPACE"
3787 ><TT
3788 CLASS="PARAMETER"
3789 ><I
3790 >min print space</I
3791 ></TT
3792 ></A
3793 ></P
3794 ></LI
3795 ><LI
3796 ><P
3797 ><A
3798 HREF="#MSDFSROOT"
3799 ><TT
3800 CLASS="PARAMETER"
3801 ><I
3802 >msdfs root</I
3803 ></TT
3804 ></A
3805 ></P
3806 ></LI
3807 ><LI
3808 ><P
3809 ><A
3810 HREF="#NTACLSUPPORT"
3811 ><TT
3812 CLASS="PARAMETER"
3813 ><I
3814 >nt acl support</I
3815 ></TT
3816 ></A
3817 ></P
3818 ></LI
3819 ><LI
3820 ><P
3821 ><A
3822 HREF="#ONLYGUEST"
3823 ><TT
3824 CLASS="PARAMETER"
3825 ><I
3826 >only guest</I
3827 ></TT
3828 ></A
3829 ></P
3830 ></LI
3831 ><LI
3832 ><P
3833 ><A
3834 HREF="#ONLYUSER"
3835 ><TT
3836 CLASS="PARAMETER"
3837 ><I
3838 >only user</I
3839 ></TT
3840 ></A
3841 ></P
3842 ></LI
3843 ><LI
3844 ><P
3845 ><A
3846 HREF="#OPLOCKCONTENTIONLIMIT"
3847 ><TT
3848 CLASS="PARAMETER"
3849 ><I
3850 >oplock contention limit</I
3851 ></TT
3852 ></A
3853 ></P
3854 ></LI
3855 ><LI
3856 ><P
3857 ><A
3858 HREF="#OPLOCKS"
3859 ><TT
3860 CLASS="PARAMETER"
3861 ><I
3862 >oplocks</I
3863 ></TT
3864 ></A
3865 ></P
3866 ></LI
3867 ><LI
3868 ><P
3869 ><A
3870 HREF="#PATH"
3871 ><TT
3872 CLASS="PARAMETER"
3873 ><I
3874 >path</I
3875 ></TT
3876 ></A
3877 ></P
3878 ></LI
3879 ><LI
3880 ><P
3881 ><A
3882 HREF="#POSIXLOCKING"
3883 ><TT
3884 CLASS="PARAMETER"
3885 ><I
3886 >posix locking</I
3887 ></TT
3888 ></A
3889 ></P
3890 ></LI
3891 ><LI
3892 ><P
3893 ><A
3894 HREF="#POSTEXEC"
3895 ><TT
3896 CLASS="PARAMETER"
3897 ><I
3898 >postexec</I
3899 ></TT
3900 ></A
3901 ></P
3902 ></LI
3903 ><LI
3904 ><P
3905 ><A
3906 HREF="#POSTSCRIPT"
3907 ><TT
3908 CLASS="PARAMETER"
3909 ><I
3910 >postscript</I
3911 ></TT
3912 ></A
3913 ></P
3914 ></LI
3915 ><LI
3916 ><P
3917 ><A
3918 HREF="#PREEXEC"
3919 ><TT
3920 CLASS="PARAMETER"
3921 ><I
3922 >preexec</I
3923 ></TT
3924 ></A
3925 ></P
3926 ></LI
3927 ><LI
3928 ><P
3929 ><A
3930 HREF="#PREEXECCLOSE"
3931 ><TT
3932 CLASS="PARAMETER"
3933 ><I
3934 >preexec close</I
3935 ></TT
3936 ></A
3937 ></P
3938 ></LI
3939 ><LI
3940 ><P
3941 ><A
3942 HREF="#PRESERVECASE"
3943 ><TT
3944 CLASS="PARAMETER"
3945 ><I
3946 >preserve case</I
3947 ></TT
3948 ></A
3949 ></P
3950 ></LI
3951 ><LI
3952 ><P
3953 ><A
3954 HREF="#PRINTCOMMAND"
3955 ><TT
3956 CLASS="PARAMETER"
3957 ><I
3958 >print command</I
3959 ></TT
3960 ></A
3961 ></P
3962 ></LI
3963 ><LI
3964 ><P
3965 ><A
3966 HREF="#PRINTOK"
3967 ><TT
3968 CLASS="PARAMETER"
3969 ><I
3970 >print ok</I
3971 ></TT
3972 ></A
3973 ></P
3974 ></LI
3975 ><LI
3976 ><P
3977 ><A
3978 HREF="#PRINTABLE"
3979 ><TT
3980 CLASS="PARAMETER"
3981 ><I
3982 >printable</I
3983 ></TT
3984 ></A
3985 ></P
3986 ></LI
3987 ><LI
3988 ><P
3989 ><A
3990 HREF="#PRINTER"
3991 ><TT
3992 CLASS="PARAMETER"
3993 ><I
3994 >printer</I
3995 ></TT
3996 ></A
3997 ></P
3998 ></LI
3999 ><LI
4000 ><P
4001 ><A
4002 HREF="#PRINTERADMIN"
4003 ><TT
4004 CLASS="PARAMETER"
4005 ><I
4006 >printer admin</I
4007 ></TT
4008 ></A
4009 ></P
4010 ></LI
4011 ><LI
4012 ><P
4013 ><A
4014 HREF="#PRINTERDRIVER"
4015 ><TT
4016 CLASS="PARAMETER"
4017 ><I
4018 >printer driver</I
4019 ></TT
4020 ></A
4021 ></P
4022 ></LI
4023 ><LI
4024 ><P
4025 ><A
4026 HREF="#PRINTERDRIVERLOCATION"
4027 ><TT
4028 CLASS="PARAMETER"
4029 ><I
4030 >printer driver location</I
4031 ></TT
4032 ></A
4033 ></P
4034 ></LI
4035 ><LI
4036 ><P
4037 ><A
4038 HREF="#PRINTERNAME"
4039 ><TT
4040 CLASS="PARAMETER"
4041 ><I
4042 >printer name</I
4043 ></TT
4044 ></A
4045 ></P
4046 ></LI
4047 ><LI
4048 ><P
4049 ><A
4050 HREF="#PRINTING"
4051 ><TT
4052 CLASS="PARAMETER"
4053 ><I
4054 >printing</I
4055 ></TT
4056 ></A
4057 ></P
4058 ></LI
4059 ><LI
4060 ><P
4061 ><A
4062 HREF="#PUBLIC"
4063 ><TT
4064 CLASS="PARAMETER"
4065 ><I
4066 >public</I
4067 ></TT
4068 ></A
4069 ></P
4070 ></LI
4071 ><LI
4072 ><P
4073 ><A
4074 HREF="#QUEUEPAUSECOMMAND"
4075 ><TT
4076 CLASS="PARAMETER"
4077 ><I
4078 >queuepause command</I
4079 ></TT
4080 ></A
4081 ></P
4082 ></LI
4083 ><LI
4084 ><P
4085 ><A
4086 HREF="#QUEUERESUMECOMMAND"
4087 ><TT
4088 CLASS="PARAMETER"
4089 ><I
4090 >queueresume command</I
4091 ></TT
4092 ></A
4093 ></P
4094 ></LI
4095 ><LI
4096 ><P
4097 ><A
4098 HREF="#READLIST"
4099 ><TT
4100 CLASS="PARAMETER"
4101 ><I
4102 >read list</I
4103 ></TT
4104 ></A
4105 ></P
4106 ></LI
4107 ><LI
4108 ><P
4109 ><A
4110 HREF="#READONLY"
4111 ><TT
4112 CLASS="PARAMETER"
4113 ><I
4114 >read only</I
4115 ></TT
4116 ></A
4117 ></P
4118 ></LI
4119 ><LI
4120 ><P
4121 ><A
4122 HREF="#ROOTPOSTEXEC"
4123 ><TT
4124 CLASS="PARAMETER"
4125 ><I
4126 >root postexec</I
4127 ></TT
4128 ></A
4129 ></P
4130 ></LI
4131 ><LI
4132 ><P
4133 ><A
4134 HREF="#ROOTPREEXEC"
4135 ><TT
4136 CLASS="PARAMETER"
4137 ><I
4138 >root preexec</I
4139 ></TT
4140 ></A
4141 ></P
4142 ></LI
4143 ><LI
4144 ><P
4145 ><A
4146 HREF="#ROOTPREEXECCLOSE"
4147 ><TT
4148 CLASS="PARAMETER"
4149 ><I
4150 >root preexec close</I
4151 ></TT
4152 ></A
4153 ></P
4154 ></LI
4155 ><LI
4156 ><P
4157 ><A
4158 HREF="#SECURITYMASK"
4159 ><TT
4160 CLASS="PARAMETER"
4161 ><I
4162 >security mask</I
4163 ></TT
4164 ></A
4165 ></P
4166 ></LI
4167 ><LI
4168 ><P
4169 ><A
4170 HREF="#SETDIRECTORY"
4171 ><TT
4172 CLASS="PARAMETER"
4173 ><I
4174 >set directory</I
4175 ></TT
4176 ></A
4177 ></P
4178 ></LI
4179 ><LI
4180 ><P
4181 ><A
4182 HREF="#SHORTPRESERVECASE"
4183 ><TT
4184 CLASS="PARAMETER"
4185 ><I
4186 >short preserve case</I
4187 ></TT
4188 ></A
4189 ></P
4190 ></LI
4191 ><LI
4192 ><P
4193 ><A
4194 HREF="#STATUS"
4195 ><TT
4196 CLASS="PARAMETER"
4197 ><I
4198 >status</I
4199 ></TT
4200 ></A
4201 ></P
4202 ></LI
4203 ><LI
4204 ><P
4205 ><A
4206 HREF="#STRICTALLOCATE"
4207 ><TT
4208 CLASS="PARAMETER"
4209 ><I
4210 >strict allocate</I
4211 ></TT
4212 ></A
4213 ></P
4214 ></LI
4215 ><LI
4216 ><P
4217 ><A
4218 HREF="#STRICTLOCKING"
4219 ><TT
4220 CLASS="PARAMETER"
4221 ><I
4222 >strict locking</I
4223 ></TT
4224 ></A
4225 ></P
4226 ></LI
4227 ><LI
4228 ><P
4229 ><A
4230 HREF="#STRICTSYNC"
4231 ><TT
4232 CLASS="PARAMETER"
4233 ><I
4234 >strict sync</I
4235 ></TT
4236 ></A
4237 ></P
4238 ></LI
4239 ><LI
4240 ><P
4241 ><A
4242 HREF="#SYNCALWAYS"
4243 ><TT
4244 CLASS="PARAMETER"
4245 ><I
4246 >sync always</I
4247 ></TT
4248 ></A
4249 ></P
4250 ></LI
4251 ><LI
4252 ><P
4253 ><A
4254 HREF="#USECLIENTDRIVER"
4255 ><TT
4256 CLASS="PARAMETER"
4257 ><I
4258 >use client driver</I
4259 ></TT
4260 ></A
4261 ></P
4262 ></LI
4263 ><LI
4264 ><P
4265 ><A
4266 HREF="#USER"
4267 ><TT
4268 CLASS="PARAMETER"
4269 ><I
4270 >user</I
4271 ></TT
4272 ></A
4273 ></P
4274 ></LI
4275 ><LI
4276 ><P
4277 ><A
4278 HREF="#USERNAME"
4279 ><TT
4280 CLASS="PARAMETER"
4281 ><I
4282 >username</I
4283 ></TT
4284 ></A
4285 ></P
4286 ></LI
4287 ><LI
4288 ><P
4289 ><A
4290 HREF="#USERS"
4291 ><TT
4292 CLASS="PARAMETER"
4293 ><I
4294 >users</I
4295 ></TT
4296 ></A
4297 ></P
4298 ></LI
4299 ><LI
4300 ><P
4301 ><A
4302 HREF="#VALIDUSERS"
4303 ><TT
4304 CLASS="PARAMETER"
4305 ><I
4306 >valid users</I
4307 ></TT
4308 ></A
4309 ></P
4310 ></LI
4311 ><LI
4312 ><P
4313 ><A
4314 HREF="#VETOFILES"
4315 ><TT
4316 CLASS="PARAMETER"
4317 ><I
4318 >veto files</I
4319 ></TT
4320 ></A
4321 ></P
4322 ></LI
4323 ><LI
4324 ><P
4325 ><A
4326 HREF="#VETOOPLOCKFILES"
4327 ><TT
4328 CLASS="PARAMETER"
4329 ><I
4330 >veto oplock files</I
4331 ></TT
4332 ></A
4333 ></P
4334 ></LI
4335 ><LI
4336 ><P
4337 ><A
4338 HREF="#VFSOBJECT"
4339 ><TT
4340 CLASS="PARAMETER"
4341 ><I
4342 >vfs object</I
4343 ></TT
4344 ></A
4345 ></P
4346 ></LI
4347 ><LI
4348 ><P
4349 ><A
4350 HREF="#VFSOPTIONS"
4351 ><TT
4352 CLASS="PARAMETER"
4353 ><I
4354 >vfs options</I
4355 ></TT
4356 ></A
4357 ></P
4358 ></LI
4359 ><LI
4360 ><P
4361 ><A
4362 HREF="#VOLUME"
4363 ><TT
4364 CLASS="PARAMETER"
4365 ><I
4366 >volume</I
4367 ></TT
4368 ></A
4369 ></P
4370 ></LI
4371 ><LI
4372 ><P
4373 ><A
4374 HREF="#WIDELINKS"
4375 ><TT
4376 CLASS="PARAMETER"
4377 ><I
4378 >wide links</I
4379 ></TT
4380 ></A
4381 ></P
4382 ></LI
4383 ><LI
4384 ><P
4385 ><A
4386 HREF="#WRITABLE"
4387 ><TT
4388 CLASS="PARAMETER"
4389 ><I
4390 >writable</I
4391 ></TT
4392 ></A
4393 ></P
4394 ></LI
4395 ><LI
4396 ><P
4397 ><A
4398 HREF="#WRITECACHESIZE"
4399 ><TT
4400 CLASS="PARAMETER"
4401 ><I
4402 >write cache size</I
4403 ></TT
4404 ></A
4405 ></P
4406 ></LI
4407 ><LI
4408 ><P
4409 ><A
4410 HREF="#WRITELIST"
4411 ><TT
4412 CLASS="PARAMETER"
4413 ><I
4414 >write list</I
4415 ></TT
4416 ></A
4417 ></P
4418 ></LI
4419 ><LI
4420 ><P
4421 ><A
4422 HREF="#WRITEOK"
4423 ><TT
4424 CLASS="PARAMETER"
4425 ><I
4426 >write ok</I
4427 ></TT
4428 ></A
4429 ></P
4430 ></LI
4431 ><LI
4432 ><P
4433 ><A
4434 HREF="#WRITEABLE"
4435 ><TT
4436 CLASS="PARAMETER"
4437 ><I
4438 >writeable</I
4439 ></TT
4440 ></A
4441 ></P
4442 ></LI
4443 ></UL
4444 ></DIV
4445 ><DIV
4446 CLASS="REFSECT1"
4447 ><A
4448 NAME="AEN1451"
4449 ></A
4450 ><H2
4451 >EXPLANATION OF EACH PARAMETER</H2
4452 ><P
4453 ></P
4454 ><DIV
4455 CLASS="VARIABLELIST"
4456 ><DL
4457 ><DT
4458 ><A
4459 NAME="ABORTSHUTDOWNSCRIPT"
4460 ></A
4461 >abort shutdown script (G)</DT
4462 ><DD
4463 ><P
4464 ><EM
4465 >This parameter only exists in the HEAD cvs branch</EM
4466 >
4467                 This a full path name to a script called by
4468                 <A
4469 HREF="smbd.8.html"
4470 TARGET="_top"
4471 ><B
4472 CLASS="COMMAND"
4473 >smbd(8)</B
4474 ></A
4475 >  that
4476                 should stop a shutdown procedure issued by the <A
4477 HREF="#SHUTDOWNSCRIPT"
4478 ><TT
4479 CLASS="PARAMETER"
4480 ><I
4481 >shutdown script</I
4482 ></TT
4483 ></A
4484 >.</P
4485 ><P
4486 >This command will be run as user.</P
4487 ><P
4488 >Default: <EM
4489 >None</EM
4490 >.</P
4491 ><P
4492 >Example: <B
4493 CLASS="COMMAND"
4494 >abort shutdown script = /sbin/shutdown -c</B
4495 ></P
4496 ></DD
4497 ><DT
4498 ><A
4499 NAME="ADDPRINTERCOMMAND"
4500 ></A
4501 >add printer command (G)</DT
4502 ><DD
4503 ><P
4504 >With the introduction of MS-RPC based printing
4505                 support for Windows NT/2000 clients in Samba 2.2, The MS Add
4506                 Printer Wizard (APW) icon is now also available in the
4507                 "Printers..." folder displayed a share listing.  The APW
4508                 allows for printers to be add remotely to a Samba or Windows
4509                 NT/2000 print server.</P
4510 ><P
4511 >For a Samba host this means that the printer must be
4512                 physically added to the underlying printing system.  The <TT
4513 CLASS="PARAMETER"
4514 ><I
4515 >add
4516                 printer command</I
4517 ></TT
4518 > defines a script to be run which
4519                 will perform the necessary operations for adding the printer
4520                 to the print system and to add the appropriate service definition
4521                 to the  <TT
4522 CLASS="FILENAME"
4523 >smb.conf</TT
4524 > file in order that it can be
4525                 shared by <A
4526 HREF="smbd.8.html"
4527 TARGET="_top"
4528 ><B
4529 CLASS="COMMAND"
4530 >smbd(8)</B
4531 >
4532                 </A
4533 >.</P
4534 ><P
4535 >The <TT
4536 CLASS="PARAMETER"
4537 ><I
4538 >add printer command</I
4539 ></TT
4540 > is
4541                 automatically invoked with the following parameter (in
4542                 order:</P
4543 ><P
4544 ></P
4545 ><UL
4546 ><LI
4547 ><P
4548 ><TT
4549 CLASS="PARAMETER"
4550 ><I
4551 >printer name</I
4552 ></TT
4553 ></P
4554 ></LI
4555 ><LI
4556 ><P
4557 ><TT
4558 CLASS="PARAMETER"
4559 ><I
4560 >share name</I
4561 ></TT
4562 ></P
4563 ></LI
4564 ><LI
4565 ><P
4566 ><TT
4567 CLASS="PARAMETER"
4568 ><I
4569 >port name</I
4570 ></TT
4571 ></P
4572 ></LI
4573 ><LI
4574 ><P
4575 ><TT
4576 CLASS="PARAMETER"
4577 ><I
4578 >driver name</I
4579 ></TT
4580 ></P
4581 ></LI
4582 ><LI
4583 ><P
4584 ><TT
4585 CLASS="PARAMETER"
4586 ><I
4587 >location</I
4588 ></TT
4589 ></P
4590 ></LI
4591 ><LI
4592 ><P
4593 ><TT
4594 CLASS="PARAMETER"
4595 ><I
4596 >Windows 9x driver location</I
4597 ></TT
4598 >
4599                         </P
4600 ></LI
4601 ></UL
4602 ><P
4603 >All parameters are filled in from the PRINTER_INFO_2 structure sent
4604                 by the Windows NT/2000 client with one exception.  The "Windows 9x
4605                 driver location" parameter is included for backwards compatibility
4606                 only.  The remaining fields in the structure are generated from answers
4607                 to the APW questions.</P
4608 ><P
4609 >Once the <TT
4610 CLASS="PARAMETER"
4611 ><I
4612 >add printer command</I
4613 ></TT
4614 > has
4615                 been executed, <B
4616 CLASS="COMMAND"
4617 >smbd</B
4618 > will reparse the <TT
4619 CLASS="FILENAME"
4620 >               smb.conf</TT
4621 > to determine if the share defined by the APW
4622                 exists.  If the sharename is still invalid, then <B
4623 CLASS="COMMAND"
4624 >smbd
4625                 </B
4626 > will return an ACCESS_DENIED error to the client.</P
4627 ><P
4628 >See also <A
4629 HREF="#DELETEPRINTERCOMMAND"
4630 ><TT
4631 CLASS="PARAMETER"
4632 ><I
4633 >               delete printer command</I
4634 ></TT
4635 ></A
4636 >, <A
4637 HREF="#PRINTING"
4638 ><TT
4639 CLASS="PARAMETER"
4640 ><I
4641 >printing</I
4642 ></TT
4643 ></A
4644 >,
4645                 <A
4646 HREF="#SHOWADDPRINTERWIZARD"
4647 ><TT
4648 CLASS="PARAMETER"
4649 ><I
4650 >show add
4651                 printer wizard</I
4652 ></TT
4653 ></A
4654 ></P
4655 ><P
4656 >Default: <EM
4657 >none</EM
4658 ></P
4659 ><P
4660 >Example: <B
4661 CLASS="COMMAND"
4662 >addprinter command = /usr/bin/addprinter
4663                 </B
4664 ></P
4665 ></DD
4666 ><DT
4667 ><A
4668 NAME="ADDSHARECOMMAND"
4669 ></A
4670 >add share command (G)</DT
4671 ><DD
4672 ><P
4673 >Samba 2.2.0 introduced the ability to dynamically
4674                 add and delete shares via the Windows NT 4.0 Server Manager.  The
4675                 <TT
4676 CLASS="PARAMETER"
4677 ><I
4678 >add share command</I
4679 ></TT
4680 > is used to define an
4681                 external program or script which will add a new service definition
4682                 to <TT
4683 CLASS="FILENAME"
4684 >smb.conf</TT
4685 >.  In order to successfully
4686                 execute the <TT
4687 CLASS="PARAMETER"
4688 ><I
4689 >add share command</I
4690 ></TT
4691 >, <B
4692 CLASS="COMMAND"
4693 >smbd</B
4694 >
4695                 requires that the administrator be connected using a root account (i.e.
4696                 uid == 0).
4697                 </P
4698 ><P
4699 >               When executed, <B
4700 CLASS="COMMAND"
4701 >smbd</B
4702 > will automatically invoke the
4703                 <TT
4704 CLASS="PARAMETER"
4705 ><I
4706 >add share command</I
4707 ></TT
4708 > with four parameters.
4709                 </P
4710 ><P
4711 ></P
4712 ><UL
4713 ><LI
4714 ><P
4715 ><TT
4716 CLASS="PARAMETER"
4717 ><I
4718 >configFile</I
4719 ></TT
4720 > - the location
4721                         of the global <TT
4722 CLASS="FILENAME"
4723 >smb.conf</TT
4724 > file.
4725                         </P
4726 ></LI
4727 ><LI
4728 ><P
4729 ><TT
4730 CLASS="PARAMETER"
4731 ><I
4732 >shareName</I
4733 ></TT
4734 > - the name of the new
4735                         share.
4736                         </P
4737 ></LI
4738 ><LI
4739 ><P
4740 ><TT
4741 CLASS="PARAMETER"
4742 ><I
4743 >pathName</I
4744 ></TT
4745 > - path to an **existing**
4746                         directory on disk.
4747                         </P
4748 ></LI
4749 ><LI
4750 ><P
4751 ><TT
4752 CLASS="PARAMETER"
4753 ><I
4754 >comment</I
4755 ></TT
4756 > - comment string to associate
4757                         with the new share.
4758                         </P
4759 ></LI
4760 ></UL
4761 ><P
4762 >               This parameter is only used for add file shares.  To add printer shares,
4763                 see the <A
4764 HREF="#ADDPRINTERCOMMAND"
4765 ><TT
4766 CLASS="PARAMETER"
4767 ><I
4768 >add printer
4769                 command</I
4770 ></TT
4771 ></A
4772 >.
4773                 </P
4774 ><P
4775 >               See also <A
4776 HREF="#CHANGESHARECOMMAND"
4777 ><TT
4778 CLASS="PARAMETER"
4779 ><I
4780 >change share
4781                 command</I
4782 ></TT
4783 ></A
4784 >, <A
4785 HREF="#DELETESHARECOMMAND"
4786 ><TT
4787 CLASS="PARAMETER"
4788 ><I
4789 >delete share
4790                 command</I
4791 ></TT
4792 ></A
4793 >.
4794                 </P
4795 ><P
4796 >Default: <EM
4797 >none</EM
4798 ></P
4799 ><P
4800 >Example: <B
4801 CLASS="COMMAND"
4802 >add share command = /usr/local/bin/addshare</B
4803 ></P
4804 ></DD
4805 ><DT
4806 ><A
4807 NAME="ADDMACHINESCRIPT"
4808 ></A
4809 >add machine script (G)</DT
4810 ><DD
4811 ><P
4812 >This is the full pathname to a script that will
4813                 be run by <A
4814 HREF="smbd.8.html"
4815 TARGET="_top"
4816 >smbd(8)</A
4817 >  when a machine is added
4818                 to it's domain using the administrator username and password method. </P
4819 ><P
4820 >This option is only required when using sam back-ends tied to the
4821                 Unix uid method of RID calculation such as smbpasswd.  This option is only
4822                 available in Samba 3.0.</P
4823 ><P
4824 >Default: <B
4825 CLASS="COMMAND"
4826 >add machine script = &#60;empty string&#62;
4827                 </B
4828 ></P
4829 ><P
4830 >Example: <B
4831 CLASS="COMMAND"
4832 >add machine script = /usr/sbin/adduser -n -g machines -c Machine -d /dev/null -s /bin/false %u
4833                 </B
4834 ></P
4835 ></DD
4836 ><DT
4837 ><A
4838 NAME="ADDUSERSCRIPT"
4839 ></A
4840 >add user script (G)</DT
4841 ><DD
4842 ><P
4843 >This is the full pathname to a script that will
4844                 be run <EM
4845 >AS ROOT</EM
4846 > by <A
4847 HREF="smbd.8.html"
4848 TARGET="_top"
4849 >smbd(8)
4850                 </A
4851 > under special circumstances described below.</P
4852 ><P
4853 >Normally, a Samba server requires that UNIX users are
4854                 created for all users accessing files on this server. For sites
4855                 that use Windows NT account databases as their primary user database
4856                 creating these users and keeping the user list in sync with the
4857                 Windows NT PDC is an onerous task. This option allows <A
4858 HREF="smbd.8.html"
4859 TARGET="_top"
4860 >smbd</A
4861 > to create the required UNIX users
4862                 <EM
4863 >ON DEMAND</EM
4864 > when a user accesses the Samba server.</P
4865 ><P
4866 >In order to use this option, <A
4867 HREF="smbd.8.html"
4868 TARGET="_top"
4869 >smbd</A
4870 >
4871                 must <EM
4872 >NOT</EM
4873 > be set to <TT
4874 CLASS="PARAMETER"
4875 ><I
4876 >security = share</I
4877 ></TT
4878 >
4879                 and <TT
4880 CLASS="PARAMETER"
4881 ><I
4882 >add user script</I
4883 ></TT
4884 >
4885                 must be set to a full pathname for a script that will create a UNIX
4886                 user given one argument of <TT
4887 CLASS="PARAMETER"
4888 ><I
4889 >%u</I
4890 ></TT
4891 >, which expands into
4892                 the UNIX user name to create.</P
4893 ><P
4894 >When the Windows user attempts to access the Samba server,
4895                 at login (session setup in the SMB protocol) time, <A
4896 HREF="smbd.8.html"
4897 TARGET="_top"
4898 >               smbd</A
4899 > contacts the <TT
4900 CLASS="PARAMETER"
4901 ><I
4902 >password server</I
4903 ></TT
4904 > and
4905                 attempts to authenticate the given user with the given password. If the
4906                 authentication succeeds then <B
4907 CLASS="COMMAND"
4908 >smbd</B
4909 >
4910                 attempts to find a UNIX user in the UNIX password database to map the
4911                 Windows user into. If this lookup fails, and <TT
4912 CLASS="PARAMETER"
4913 ><I
4914 >add user script
4915                 </I
4916 ></TT
4917 > is set then <B
4918 CLASS="COMMAND"
4919 >smbd</B
4920 > will
4921                 call the specified script <EM
4922 >AS ROOT</EM
4923 >, expanding
4924                 any <TT
4925 CLASS="PARAMETER"
4926 ><I
4927 >%u</I
4928 ></TT
4929 > argument to be the user name to create.</P
4930 ><P
4931 >If this script successfully creates the user then <B
4932 CLASS="COMMAND"
4933 >smbd
4934                 </B
4935 > will continue on as though the UNIX user
4936                 already existed. In this way, UNIX users are dynamically created to
4937                 match existing Windows NT accounts.</P
4938 ><P
4939 >See also <A
4940 HREF="#SECURITY"
4941 ><TT
4942 CLASS="PARAMETER"
4943 ><I
4944 >               security</I
4945 ></TT
4946 ></A
4947 >, <A
4948 HREF="#PASSWORDSERVER"
4949 >               <TT
4950 CLASS="PARAMETER"
4951 ><I
4952 >password server</I
4953 ></TT
4954 ></A
4955 >,
4956                 <A
4957 HREF="#DELETEUSERSCRIPT"
4958 ><TT
4959 CLASS="PARAMETER"
4960 ><I
4961 >delete user
4962                 script</I
4963 ></TT
4964 ></A
4965 >.</P
4966 ><P
4967 >Default: <B
4968 CLASS="COMMAND"
4969 >add user script = &#60;empty string&#62;
4970                 </B
4971 ></P
4972 ><P
4973 >Example: <B
4974 CLASS="COMMAND"
4975 >add user script = /usr/local/samba/bin/add_user
4976                 %u</B
4977 ></P
4978 ></DD
4979 ><DT
4980 ><A
4981 NAME="ADMINUSERS"
4982 ></A
4983 >admin users (S)</DT
4984 ><DD
4985 ><P
4986 >This is a list of users who will be granted
4987                 administrative privileges on the share. This means that they
4988                 will do all file operations as the super-user (root).</P
4989 ><P
4990 >You should use this option very carefully, as any user in
4991                 this list will be able to do anything they like on the share,
4992                 irrespective of file permissions.</P
4993 ><P
4994 >Default: <EM
4995 >no admin users</EM
4996 ></P
4997 ><P
4998 >Example: <B
4999 CLASS="COMMAND"
5000 >admin users = jason</B
5001 ></P
5002 ></DD
5003 ><DT
5004 ><A
5005 NAME="ALLOWHOSTS"
5006 ></A
5007 >allow hosts (S)</DT
5008 ><DD
5009 ><P
5010 >Synonym for <A
5011 HREF="#HOSTSALLOW"
5012 >               <TT
5013 CLASS="PARAMETER"
5014 ><I
5015 >hosts allow</I
5016 ></TT
5017 ></A
5018 >.</P
5019 ></DD
5020 ><DT
5021 ><A
5022 NAME="ALLOWTRUSTEDDOMAINS"
5023 ></A
5024 >allow trusted domains (G)</DT
5025 ><DD
5026 ><P
5027 >This option only takes effect when the <A
5028 HREF="#SECURITY"
5029 ><TT
5030 CLASS="PARAMETER"
5031 ><I
5032 >security</I
5033 ></TT
5034 ></A
5035 > option is set to
5036                 <TT
5037 CLASS="CONSTANT"
5038 >server</TT
5039 > or <TT
5040 CLASS="CONSTANT"
5041 >domain</TT
5042 >.
5043                 If it is set to no, then attempts to connect to a resource from
5044                 a domain or workgroup other than the one which <A
5045 HREF="smbd.8.html"
5046 TARGET="_top"
5047 >smbd</A
5048 > is running
5049                 in will fail, even if that domain is trusted by the remote server
5050                 doing the authentication.</P
5051 ><P
5052 >This is useful if you only want your Samba server to
5053                 serve resources to users in the domain it is a member of. As
5054                 an example, suppose that there are two domains DOMA and DOMB.  DOMB
5055                 is trusted by DOMA, which contains the Samba server.  Under normal
5056                 circumstances, a user with an account in DOMB can then access the
5057                 resources of a UNIX account with the same account name on the
5058                 Samba server even if they do not have an account in DOMA.  This
5059                 can make implementing a security boundary difficult.</P
5060 ><P
5061 >Default: <B
5062 CLASS="COMMAND"
5063 >allow trusted domains = yes</B
5064 ></P
5065 ></DD
5066 ><DT
5067 ><A
5068 NAME="ANNOUNCEAS"
5069 ></A
5070 >announce as (G)</DT
5071 ><DD
5072 ><P
5073 >This specifies what type of server
5074                 <A
5075 HREF="nmbd.8.html"
5076 TARGET="_top"
5077 ><B
5078 CLASS="COMMAND"
5079 >nmbd</B
5080 ></A
5081 >
5082                 will announce itself as, to a network neighborhood browse
5083                 list. By default this is set to Windows NT. The valid options
5084                 are : "NT Server" (which can also be written as "NT"),
5085                 "NT Workstation", "Win95" or "WfW" meaning Windows NT Server,
5086                 Windows NT Workstation, Windows 95 and Windows for Workgroups
5087                 respectively. Do not change this parameter unless you have a
5088                 specific need to stop Samba appearing as an NT server as this
5089                 may prevent Samba servers from participating as browser servers
5090                 correctly.</P
5091 ><P
5092 >Default: <B
5093 CLASS="COMMAND"
5094 >announce as = NT Server</B
5095 ></P
5096 ><P
5097 >Example: <B
5098 CLASS="COMMAND"
5099 >announce as = Win95</B
5100 ></P
5101 ></DD
5102 ><DT
5103 ><A
5104 NAME="ANNOUNCEVERSION"
5105 ></A
5106 >announce version (G)</DT
5107 ><DD
5108 ><P
5109 >This specifies the major and minor version numbers
5110                 that nmbd will use when announcing itself as a server. The default
5111                 is 4.2.  Do not change this parameter unless you have a specific
5112                 need to set a Samba server to be a downlevel server.</P
5113 ><P
5114 >Default: <B
5115 CLASS="COMMAND"
5116 >announce version = 4.5</B
5117 ></P
5118 ><P
5119 >Example: <B
5120 CLASS="COMMAND"
5121 >announce version = 2.0</B
5122 ></P
5123 ></DD
5124 ><DT
5125 ><A
5126 NAME="AUTOSERVICES"
5127 ></A
5128 >auto services (G)</DT
5129 ><DD
5130 ><P
5131 >This is a synonym for the <A
5132 HREF="#PRELOAD"
5133 >               <TT
5134 CLASS="PARAMETER"
5135 ><I
5136 >preload</I
5137 ></TT
5138 ></A
5139 >.</P
5140 ></DD
5141 ><DT
5142 ><A
5143 NAME="AUTHMETHODS"
5144 ></A
5145 >auth methods (G)</DT
5146 ><DD
5147 ><P
5148 >This option allows the administrator to chose what
5149                 authentication methods <B
5150 CLASS="COMMAND"
5151 >smbd</B
5152 > will use when authenticating
5153                 a user.  This option defaults to sensible values based on <A
5154 HREF="#SECURITY"
5155 ><TT
5156 CLASS="PARAMETER"
5157 ><I
5158 >               security</I
5159 ></TT
5160 ></A
5161 >.
5162
5163                 Each entry in the list attempts to authenticate the user in turn, until
5164                 the user authenticates.  In practice only one method will ever actually
5165                 be able to complete the authentication.
5166                 </P
5167 ><P
5168 >Default: <B
5169 CLASS="COMMAND"
5170 >auth methods = &#60;empty string&#62;</B
5171 ></P
5172 ><P
5173 >Example: <B
5174 CLASS="COMMAND"
5175 >auth methods = guest sam ntdomain</B
5176 ></P
5177 ></DD
5178 ><DT
5179 ><A
5180 NAME="AVAILABLE"
5181 ></A
5182 >available (S)</DT
5183 ><DD
5184 ><P
5185 >This parameter lets you "turn off" a service. If
5186                 <TT
5187 CLASS="PARAMETER"
5188 ><I
5189 >available = no</I
5190 ></TT
5191 >, then <EM
5192 >ALL</EM
5193 >
5194                 attempts to connect to the service will fail. Such failures are
5195                 logged.</P
5196 ><P
5197 >Default: <B
5198 CLASS="COMMAND"
5199 >available = yes</B
5200 ></P
5201 ></DD
5202 ><DT
5203 ><A
5204 NAME="BINDINTERFACESONLY"
5205 ></A
5206 >bind interfaces only (G)</DT
5207 ><DD
5208 ><P
5209 >This global parameter allows the Samba admin
5210                 to limit what interfaces on a machine will serve SMB requests. If
5211                 affects file service <A
5212 HREF="smbd.8.html"
5213 TARGET="_top"
5214 >smbd(8)</A
5215 > and
5216                 name service <A
5217 HREF="nmbd.8.html"
5218 TARGET="_top"
5219 >nmbd(8)</A
5220 > in slightly
5221                 different ways.</P
5222 ><P
5223 >For name service it causes <B
5224 CLASS="COMMAND"
5225 >nmbd</B
5226 > to bind
5227                 to ports 137 and 138 on the interfaces listed in the <A
5228 HREF="#INTERFACES"
5229 >interfaces</A
5230 > parameter. <B
5231 CLASS="COMMAND"
5232 >nmbd
5233                 </B
5234 > also binds to the "all addresses" interface (0.0.0.0)
5235                 on ports 137 and 138 for the purposes of reading broadcast messages.
5236                 If this option is not set then <B
5237 CLASS="COMMAND"
5238 >nmbd</B
5239 > will service
5240                 name requests on all of these sockets. If <TT
5241 CLASS="PARAMETER"
5242 ><I
5243 >bind interfaces
5244                 only</I
5245 ></TT
5246 > is set then <B
5247 CLASS="COMMAND"
5248 >nmbd</B
5249 > will check the
5250                 source address of any packets coming in on the broadcast sockets
5251                 and discard any that don't match the broadcast addresses of the
5252                 interfaces in the <TT
5253 CLASS="PARAMETER"
5254 ><I
5255 >interfaces</I
5256 ></TT
5257 > parameter list.
5258                 As unicast packets are received on the other sockets it allows
5259                 <B
5260 CLASS="COMMAND"
5261 >nmbd</B
5262 > to refuse to serve names to machines that
5263                 send packets that arrive through any interfaces not listed in the
5264                 <TT
5265 CLASS="PARAMETER"
5266 ><I
5267 >interfaces</I
5268 ></TT
5269 > list.  IP Source address spoofing
5270                 does defeat this simple check, however so it must not be used
5271                 seriously as a security feature for <B
5272 CLASS="COMMAND"
5273 >nmbd</B
5274 >.</P
5275 ><P
5276 >For file service it causes <A
5277 HREF="smbd.8.html"
5278 TARGET="_top"
5279 >smbd(8)</A
5280 >
5281                 to bind only to the interface list given in the <A
5282 HREF="#INTERFACES"
5283 >               interfaces</A
5284 > parameter. This restricts the networks that
5285                 <B
5286 CLASS="COMMAND"
5287 >smbd</B
5288 > will serve to packets coming in those
5289                 interfaces.  Note that you should not use this parameter for machines
5290                 that are serving PPP or other intermittent or non-broadcast network
5291                 interfaces as it will not cope with non-permanent interfaces.</P
5292 ><P
5293 >If <TT
5294 CLASS="PARAMETER"
5295 ><I
5296 >bind interfaces only</I
5297 ></TT
5298 > is set then
5299                 unless the network address <EM
5300 >127.0.0.1</EM
5301 > is added
5302                 to the <TT
5303 CLASS="PARAMETER"
5304 ><I
5305 >interfaces</I
5306 ></TT
5307 > parameter list <A
5308 HREF="smbpasswd.8.html"
5309 TARGET="_top"
5310 ><B
5311 CLASS="COMMAND"
5312 >smbpasswd(8)</B
5313 ></A
5314 >
5315                 and <A
5316 HREF="swat.8.html"
5317 TARGET="_top"
5318 ><B
5319 CLASS="COMMAND"
5320 >swat(8)</B
5321 ></A
5322 > may
5323                 not work as expected due to the reasons covered below.</P
5324 ><P
5325 >To change a users SMB password, the <B
5326 CLASS="COMMAND"
5327 >smbpasswd</B
5328 >
5329                 by default connects to the <EM
5330 >localhost - 127.0.0.1</EM
5331 >
5332                 address as an SMB client to issue the password change request. If
5333                 <TT
5334 CLASS="PARAMETER"
5335 ><I
5336 >bind interfaces only</I
5337 ></TT
5338 > is set then unless the
5339                 network address <EM
5340 >127.0.0.1</EM
5341 > is added to the
5342                 <TT
5343 CLASS="PARAMETER"
5344 ><I
5345 >interfaces</I
5346 ></TT
5347 > parameter list then <B
5348 CLASS="COMMAND"
5349 >               smbpasswd</B
5350 > will fail to connect in it's default mode.
5351                 <B
5352 CLASS="COMMAND"
5353 >smbpasswd</B
5354 > can be forced to use the primary IP interface
5355                 of the local host by using its <A
5356 HREF="smbpasswd.8.html#minusr"
5357 TARGET="_top"
5358 >               <TT
5359 CLASS="PARAMETER"
5360 ><I
5361 >-r <TT
5362 CLASS="REPLACEABLE"
5363 ><I
5364 >remote machine</I
5365 ></TT
5366 ></I
5367 ></TT
5368 >
5369                 </A
5370 > parameter, with <TT
5371 CLASS="REPLACEABLE"
5372 ><I
5373 >remote machine</I
5374 ></TT
5375 > set
5376                 to the IP name of the primary interface of the local host.</P
5377 ><P
5378 >The <B
5379 CLASS="COMMAND"
5380 >swat</B
5381 > status page tries to connect with
5382                 <B
5383 CLASS="COMMAND"
5384 >smbd</B
5385 > and <B
5386 CLASS="COMMAND"
5387 >nmbd</B
5388 > at the address
5389                 <EM
5390 >127.0.0.1</EM
5391 > to determine if they are running.
5392                 Not adding <EM
5393 >127.0.0.1</EM
5394 >  will cause <B
5395 CLASS="COMMAND"
5396 >               smbd</B
5397 > and <B
5398 CLASS="COMMAND"
5399 >nmbd</B
5400 > to always show
5401                 "not running" even if they really are.  This can prevent <B
5402 CLASS="COMMAND"
5403 >               swat</B
5404 > from starting/stopping/restarting <B
5405 CLASS="COMMAND"
5406 >smbd</B
5407 >
5408                 and <B
5409 CLASS="COMMAND"
5410 >nmbd</B
5411 >.</P
5412 ><P
5413 >Default: <B
5414 CLASS="COMMAND"
5415 >bind interfaces only = no</B
5416 ></P
5417 ></DD
5418 ><DT
5419 ><A
5420 NAME="BLOCKINGLOCKS"
5421 ></A
5422 >blocking locks (S)</DT
5423 ><DD
5424 ><P
5425 >This parameter controls the behavior of <A
5426 HREF="smbd.8.html"
5427 TARGET="_top"
5428 >smbd(8)</A
5429 > when given a request by a client
5430                 to obtain a byte range lock on a region of an open file, and the
5431                 request has a time limit associated with it.</P
5432 ><P
5433 >If this parameter is set and the lock range requested
5434                 cannot be immediately satisfied, Samba 2.2 will internally
5435                 queue the lock request, and periodically attempt to obtain
5436                 the lock until the timeout period expires.</P
5437 ><P
5438 >If this parameter is set to <TT
5439 CLASS="CONSTANT"
5440 >false</TT
5441 >, then
5442                 Samba 2.2 will behave as previous versions of Samba would and
5443                 will fail the lock request immediately if the lock range
5444                 cannot be obtained.</P
5445 ><P
5446 >Default: <B
5447 CLASS="COMMAND"
5448 >blocking locks = yes</B
5449 ></P
5450 ></DD
5451 ><DT
5452 ><A
5453 NAME="BROWSABLE"
5454 ></A
5455 >browsable (S)</DT
5456 ><DD
5457 ><P
5458 >See the <A
5459 HREF="#BROWSEABLE"
5460 ><TT
5461 CLASS="PARAMETER"
5462 ><I
5463 >               browseable</I
5464 ></TT
5465 ></A
5466 >.</P
5467 ></DD
5468 ><DT
5469 ><A
5470 NAME="BROWSELIST"
5471 ></A
5472 >browse list (G)</DT
5473 ><DD
5474 ><P
5475 >This controls whether <A
5476 HREF="smbd.8.html"
5477 TARGET="_top"
5478 >               <B
5479 CLASS="COMMAND"
5480 >smbd(8)</B
5481 ></A
5482 > will serve a browse list to
5483                 a client doing a <B
5484 CLASS="COMMAND"
5485 >NetServerEnum</B
5486 > call. Normally
5487                 set to <TT
5488 CLASS="CONSTANT"
5489 >true</TT
5490 >. You should never need to change
5491                 this.</P
5492 ><P
5493 >Default: <B
5494 CLASS="COMMAND"
5495 >browse list = yes</B
5496 ></P
5497 ></DD
5498 ><DT
5499 ><A
5500 NAME="BROWSEABLE"
5501 ></A
5502 >browseable (S)</DT
5503 ><DD
5504 ><P
5505 >This controls whether this share is seen in
5506                 the list of available shares in a net view and in the browse list.</P
5507 ><P
5508 >Default: <B
5509 CLASS="COMMAND"
5510 >browseable = yes</B
5511 ></P
5512 ></DD
5513 ><DT
5514 ><A
5515 NAME="CASESENSITIVE"
5516 ></A
5517 >case sensitive (S)</DT
5518 ><DD
5519 ><P
5520 >See the discussion in the section <A
5521 HREF="#AEN203"
5522 >NAME MANGLING</A
5523 >.</P
5524 ><P
5525 >Default: <B
5526 CLASS="COMMAND"
5527 >case sensitive = no</B
5528 ></P
5529 ></DD
5530 ><DT
5531 ><A
5532 NAME="CASESIGNAMES"
5533 ></A
5534 >casesignames (S)</DT
5535 ><DD
5536 ><P
5537 >Synonym for <A
5538 HREF="#CASESENSITIVE"
5539 >case
5540                 sensitive</A
5541 >.</P
5542 ></DD
5543 ><DT
5544 ><A
5545 NAME="CHANGENOTIFYTIMEOUT"
5546 ></A
5547 >change notify timeout (G)</DT
5548 ><DD
5549 ><P
5550 >This SMB allows a client to tell a server to
5551                 "watch" a particular directory for any changes and only reply to
5552                 the SMB request when a change has occurred. Such constant scanning of
5553                 a directory is expensive under UNIX, hence an <A
5554 HREF="smbd.8.html"
5555 TARGET="_top"
5556 >               <B
5557 CLASS="COMMAND"
5558 >smbd(8)</B
5559 ></A
5560 > daemon only performs such a scan
5561                 on each requested directory once every <TT
5562 CLASS="PARAMETER"
5563 ><I
5564 >change notify
5565                 timeout</I
5566 ></TT
5567 > seconds.</P
5568 ><P
5569 >Default: <B
5570 CLASS="COMMAND"
5571 >change notify timeout = 60</B
5572 ></P
5573 ><P
5574 >Example: <B
5575 CLASS="COMMAND"
5576 >change notify timeout = 300</B
5577 ></P
5578 ><P
5579 >Would change the scan time to every 5 minutes.</P
5580 ></DD
5581 ><DT
5582 ><A
5583 NAME="CHANGESHARECOMMAND"
5584 ></A
5585 >change share command (G)</DT
5586 ><DD
5587 ><P
5588 >Samba 2.2.0 introduced the ability to dynamically
5589                 add and delete shares via the Windows NT 4.0 Server Manager.  The
5590                 <TT
5591 CLASS="PARAMETER"
5592 ><I
5593 >change share command</I
5594 ></TT
5595 > is used to define an
5596                 external program or script which will modify an existing service definition
5597                 in <TT
5598 CLASS="FILENAME"
5599 >smb.conf</TT
5600 >.  In order to successfully
5601                 execute the <TT
5602 CLASS="PARAMETER"
5603 ><I
5604 >change share command</I
5605 ></TT
5606 >, <B
5607 CLASS="COMMAND"
5608 >smbd</B
5609 >
5610                 requires that the administrator be connected using a root account (i.e.
5611                 uid == 0).
5612                 </P
5613 ><P
5614 >               When executed, <B
5615 CLASS="COMMAND"
5616 >smbd</B
5617 > will automatically invoke the
5618                 <TT
5619 CLASS="PARAMETER"
5620 ><I
5621 >change share command</I
5622 ></TT
5623 > with four parameters.
5624                 </P
5625 ><P
5626 ></P
5627 ><UL
5628 ><LI
5629 ><P
5630 ><TT
5631 CLASS="PARAMETER"
5632 ><I
5633 >configFile</I
5634 ></TT
5635 > - the location
5636                         of the global <TT
5637 CLASS="FILENAME"
5638 >smb.conf</TT
5639 > file.
5640                         </P
5641 ></LI
5642 ><LI
5643 ><P
5644 ><TT
5645 CLASS="PARAMETER"
5646 ><I
5647 >shareName</I
5648 ></TT
5649 > - the name of the new
5650                         share.
5651                         </P
5652 ></LI
5653 ><LI
5654 ><P
5655 ><TT
5656 CLASS="PARAMETER"
5657 ><I
5658 >pathName</I
5659 ></TT
5660 > - path to an **existing**
5661                         directory on disk.
5662                         </P
5663 ></LI
5664 ><LI
5665 ><P
5666 ><TT
5667 CLASS="PARAMETER"
5668 ><I
5669 >comment</I
5670 ></TT
5671 > - comment string to associate
5672                         with the new share.
5673                         </P
5674 ></LI
5675 ></UL
5676 ><P
5677 >               This parameter is only used modify existing file shares definitions.  To modify
5678                 printer shares, use the "Printers..." folder as seen when browsing the Samba host.
5679                 </P
5680 ><P
5681 >               See also <A
5682 HREF="#ADDSHARECOMMAND"
5683 ><TT
5684 CLASS="PARAMETER"
5685 ><I
5686 >add share
5687                 command</I
5688 ></TT
5689 ></A
5690 >, <A
5691 HREF="#DELETESHARECOMMAND"
5692 ><TT
5693 CLASS="PARAMETER"
5694 ><I
5695 >delete
5696                 share command</I
5697 ></TT
5698 ></A
5699 >.
5700                 </P
5701 ><P
5702 >Default: <EM
5703 >none</EM
5704 ></P
5705 ><P
5706 >Example: <B
5707 CLASS="COMMAND"
5708 >change share command = /usr/local/bin/addshare</B
5709 ></P
5710 ></DD
5711 ><DT
5712 ><A
5713 NAME="COMMENT"
5714 ></A
5715 >comment (S)</DT
5716 ><DD
5717 ><P
5718 >This is a text field that is seen next to a share
5719                 when a client does a queries the server, either via the network
5720                 neighborhood or via <B
5721 CLASS="COMMAND"
5722 >net view</B
5723 > to list what shares
5724                 are available.</P
5725 ><P
5726 >If you want to set the string that is displayed next to the
5727                 machine name then see the <A
5728 HREF="#SERVERSTRING"
5729 ><TT
5730 CLASS="PARAMETER"
5731 ><I
5732 >               server string</I
5733 ></TT
5734 ></A
5735 > parameter.</P
5736 ><P
5737 >Default: <EM
5738 >No comment string</EM
5739 ></P
5740 ><P
5741 >Example: <B
5742 CLASS="COMMAND"
5743 >comment = Fred's Files</B
5744 ></P
5745 ></DD
5746 ><DT
5747 ><A
5748 NAME="CONFIGFILE"
5749 ></A
5750 >config file (G)</DT
5751 ><DD
5752 ><P
5753 >This allows you to override the config file
5754                 to use, instead of the default (usually <TT
5755 CLASS="FILENAME"
5756 >smb.conf</TT
5757 >).
5758                 There is a chicken and egg problem here as this option is set
5759                 in the config file!</P
5760 ><P
5761 >For this reason, if the name of the config file has changed
5762                 when the parameters are loaded then it will reload them from
5763                 the new config file.</P
5764 ><P
5765 >This option takes the usual substitutions, which can
5766                 be very useful.</P
5767 ><P
5768 >If the config file doesn't exist then it won't be loaded
5769                 (allowing you to special case the config files of just a few
5770                 clients).</P
5771 ><P
5772 >Example: <B
5773 CLASS="COMMAND"
5774 >config file = /usr/local/samba/lib/smb.conf.%m
5775                 </B
5776 ></P
5777 ></DD
5778 ><DT
5779 ><A
5780 NAME="COPY"
5781 ></A
5782 >copy (S)</DT
5783 ><DD
5784 ><P
5785 >This parameter allows you to "clone" service
5786                 entries. The specified service is simply duplicated under the
5787                 current service's name. Any parameters specified in the current
5788                 section will override those in the section being copied.</P
5789 ><P
5790 >This feature lets you set up a 'template' service and
5791                 create similar services easily. Note that the service being
5792                 copied must occur earlier in the configuration file than the
5793                 service doing the copying.</P
5794 ><P
5795 >Default: <EM
5796 >no value</EM
5797 ></P
5798 ><P
5799 >Example: <B
5800 CLASS="COMMAND"
5801 >copy = otherservice</B
5802 ></P
5803 ></DD
5804 ><DT
5805 ><A
5806 NAME="CREATEMASK"
5807 ></A
5808 >create mask (S)</DT
5809 ><DD
5810 ><P
5811 >A synonym for this parameter is
5812                 <A
5813 HREF="#CREATEMODE"
5814 ><TT
5815 CLASS="PARAMETER"
5816 ><I
5817 >create mode</I
5818 ></TT
5819 >
5820                 </A
5821 >.</P
5822 ><P
5823 >When a file is created, the necessary permissions are
5824                 calculated according to the mapping from DOS modes to UNIX
5825                 permissions, and the resulting UNIX mode is then bit-wise 'AND'ed
5826                 with this parameter. This parameter may be thought of as a bit-wise
5827                 MASK for the UNIX modes of a file. Any bit <EM
5828 >not</EM
5829 >
5830                 set here will be removed from the modes set on a file when it is
5831                 created.</P
5832 ><P
5833 >The default value of this parameter removes the
5834                 'group' and 'other' write and execute bits from the UNIX modes.</P
5835 ><P
5836 >Following this Samba will bit-wise 'OR' the UNIX mode created
5837                 from this parameter with the value of the <A
5838 HREF="#FORCECREATEMODE"
5839 ><TT
5840 CLASS="PARAMETER"
5841 ><I
5842 >force create mode</I
5843 ></TT
5844 ></A
5845 >
5846                 parameter which is set to 000 by default.</P
5847 ><P
5848 >This parameter does not affect directory modes. See the
5849                 parameter <A
5850 HREF="#DIRECTORYMODE"
5851 ><TT
5852 CLASS="PARAMETER"
5853 ><I
5854 >directory mode
5855                 </I
5856 ></TT
5857 ></A
5858 > for details.</P
5859 ><P
5860 >See also the <A
5861 HREF="#FORCECREATEMODE"
5862 ><TT
5863 CLASS="PARAMETER"
5864 ><I
5865 >force
5866                 create mode</I
5867 ></TT
5868 ></A
5869 > parameter for forcing particular mode
5870                 bits to be set on created files. See also the <A
5871 HREF="#DIRECTORYMODE"
5872 >               <TT
5873 CLASS="PARAMETER"
5874 ><I
5875 >directory mode</I
5876 ></TT
5877 ></A
5878 > parameter for masking
5879                 mode bits on created directories.  See also the <A
5880 HREF="#INHERITPERMISSIONS"
5881 >               <TT
5882 CLASS="PARAMETER"
5883 ><I
5884 >inherit permissions</I
5885 ></TT
5886 ></A
5887 > parameter.</P
5888 ><P
5889 >Note that this parameter does not apply to permissions
5890                 set by Windows NT/2000 ACL editors. If the administrator wishes to enforce
5891                 a mask on access control lists also, they need to set the <A
5892 HREF="#SECURITYMASK"
5893 ><TT
5894 CLASS="PARAMETER"
5895 ><I
5896 >security mask</I
5897 ></TT
5898 ></A
5899 >.</P
5900 ><P
5901 >Default: <B
5902 CLASS="COMMAND"
5903 >create mask = 0744</B
5904 ></P
5905 ><P
5906 >Example: <B
5907 CLASS="COMMAND"
5908 >create mask = 0775</B
5909 ></P
5910 ></DD
5911 ><DT
5912 ><A
5913 NAME="CREATEMODE"
5914 ></A
5915 >create mode (S)</DT
5916 ><DD
5917 ><P
5918 >This is a synonym for <A
5919 HREF="#CREATEMASK"
5920 ><TT
5921 CLASS="PARAMETER"
5922 ><I
5923 >               create mask</I
5924 ></TT
5925 ></A
5926 >.</P
5927 ></DD
5928 ><DT
5929 ><A
5930 NAME="DEADTIME"
5931 ></A
5932 >deadtime (G)</DT
5933 ><DD
5934 ><P
5935 >The value of the parameter (a decimal integer)
5936                 represents the number of minutes of inactivity before a connection
5937                 is considered dead, and it is disconnected. The deadtime only takes
5938                 effect if the number of open files is zero.</P
5939 ><P
5940 >This is useful to stop a server's resources being
5941                 exhausted by a large number of inactive connections.</P
5942 ><P
5943 >Most clients have an auto-reconnect feature when a
5944                 connection is broken so in most cases this parameter should be
5945                 transparent to users.</P
5946 ><P
5947 >Using this parameter with a timeout of a few minutes
5948                 is recommended for most systems.</P
5949 ><P
5950 >A deadtime of zero indicates that no auto-disconnection
5951                 should be performed.</P
5952 ><P
5953 >Default: <B
5954 CLASS="COMMAND"
5955 >deadtime = 0</B
5956 ></P
5957 ><P
5958 >Example: <B
5959 CLASS="COMMAND"
5960 >deadtime = 15</B
5961 ></P
5962 ></DD
5963 ><DT
5964 ><A
5965 NAME="DEBUGHIRESTIMESTAMP"
5966 ></A
5967 >debug hires timestamp (G)</DT
5968 ><DD
5969 ><P
5970 >Sometimes the timestamps in the log messages
5971                 are needed with a resolution of higher that seconds, this
5972                 boolean parameter adds microsecond resolution to the timestamp
5973                 message header when turned on.</P
5974 ><P
5975 >Note that the parameter <A
5976 HREF="#DEBUGTIMESTAMP"
5977 ><TT
5978 CLASS="PARAMETER"
5979 ><I
5980 >               debug timestamp</I
5981 ></TT
5982 ></A
5983 > must be on for this to have an
5984                 effect.</P
5985 ><P
5986 >Default: <B
5987 CLASS="COMMAND"
5988 >debug hires timestamp = no</B
5989 ></P
5990 ></DD
5991 ><DT
5992 ><A
5993 NAME="DEBUGPID"
5994 ></A
5995 >debug pid (G)</DT
5996 ><DD
5997 ><P
5998 >When using only one log file for more then one
5999                 forked <A
6000 HREF="smbd.8.html"
6001 TARGET="_top"
6002 >smbd</A
6003 >-process there may be hard to follow which process
6004                 outputs which message. This boolean parameter is adds the process-id
6005                 to the timestamp message headers in the logfile when turned on.</P
6006 ><P
6007 >Note that the parameter <A
6008 HREF="#DEBUGTIMESTAMP"
6009 ><TT
6010 CLASS="PARAMETER"
6011 ><I
6012 >               debug timestamp</I
6013 ></TT
6014 ></A
6015 > must be on for this to have an
6016                 effect.</P
6017 ><P
6018 >Default: <B
6019 CLASS="COMMAND"
6020 >debug pid = no</B
6021 ></P
6022 ></DD
6023 ><DT
6024 ><A
6025 NAME="DEBUGTIMESTAMP"
6026 ></A
6027 >debug timestamp (G)</DT
6028 ><DD
6029 ><P
6030 >Samba 2.2 debug log messages are timestamped
6031                 by default. If you are running at a high <A
6032 HREF="#DEBUGLEVEL"
6033 >               <TT
6034 CLASS="PARAMETER"
6035 ><I
6036 >debug level</I
6037 ></TT
6038 ></A
6039 > these timestamps
6040                 can be distracting. This boolean parameter allows timestamping
6041                 to be turned off.</P
6042 ><P
6043 >Default: <B
6044 CLASS="COMMAND"
6045 >debug timestamp = yes</B
6046 ></P
6047 ></DD
6048 ><DT
6049 ><A
6050 NAME="DEBUGUID"
6051 ></A
6052 >debug uid (G)</DT
6053 ><DD
6054 ><P
6055 >Samba is sometimes run as root and sometime
6056                 run as the connected user, this boolean parameter inserts the
6057                 current euid, egid, uid and gid to the timestamp message headers
6058                 in the log file if turned on.</P
6059 ><P
6060 >Note that the parameter <A
6061 HREF="#DEBUGTIMESTAMP"
6062 ><TT
6063 CLASS="PARAMETER"
6064 ><I
6065 >               debug timestamp</I
6066 ></TT
6067 ></A
6068 > must be on for this to have an
6069                 effect.</P
6070 ><P
6071 >Default: <B
6072 CLASS="COMMAND"
6073 >debug uid = no</B
6074 ></P
6075 ></DD
6076 ><DT
6077 ><A
6078 NAME="DEBUGLEVEL"
6079 ></A
6080 >debuglevel (G)</DT
6081 ><DD
6082 ><P
6083 >Synonym for <A
6084 HREF="#LOGLEVEL"
6085 ><TT
6086 CLASS="PARAMETER"
6087 ><I
6088 >               log level</I
6089 ></TT
6090 ></A
6091 >.</P
6092 ></DD
6093 ><DT
6094 ><A
6095 NAME="DEFAULT"
6096 ></A
6097 >default (G)</DT
6098 ><DD
6099 ><P
6100 >A synonym for <A
6101 HREF="#DEFAULTSERVICE"
6102 ><TT
6103 CLASS="PARAMETER"
6104 ><I
6105 >               default service</I
6106 ></TT
6107 ></A
6108 >.</P
6109 ></DD
6110 ><DT
6111 ><A
6112 NAME="DEFAULTCASE"
6113 ></A
6114 >default case (S)</DT
6115 ><DD
6116 ><P
6117 >See the section on <A
6118 HREF="#AEN203"
6119 >               NAME MANGLING</A
6120 >. Also note the <A
6121 HREF="#SHORTPRESERVECASE"
6122 >               <TT
6123 CLASS="PARAMETER"
6124 ><I
6125 >short preserve case</I
6126 ></TT
6127 ></A
6128 > parameter.</P
6129 ><P
6130 >Default: <B
6131 CLASS="COMMAND"
6132 >default case = lower</B
6133 ></P
6134 ></DD
6135 ><DT
6136 ><A
6137 NAME="DEFAULTDEVMODE"
6138 ></A
6139 >default devmode (S)</DT
6140 ><DD
6141 ><P
6142 >This parameter is only applicable to <A
6143 HREF="#PRINTOK"
6144 >printable</A
6145 > services.  When smbd is serving
6146                 Printer Drivers to Windows NT/2k/XP clients, each printer on the Samba
6147                 server has a Device Mode which defines things such as paper size and
6148                 orientation and duplex settings.  The device mode can only correctly be
6149                 generated by the printer driver itself (which can only be executed on a
6150                 Win32 platform).  Because smbd is unable to execute the driver code
6151                 to generate the device mode, the default behavior is to set this field
6152                 to NULL.
6153                 </P
6154 ><P
6155 >Most problems with serving printer drivers to Windows NT/2k/XP clients
6156                 can be traced to a problem with the generated device mode.  Certain drivers
6157                 will do things such as crashing the client's Explorer.exe with a NULL devmode.
6158                 However, other printer drivers can cause the client's spooler service
6159                 (spoolsv.exe) to die if the devmode was not created by the driver itself
6160                 (i.e. smbd generates a default devmode).
6161                 </P
6162 ><P
6163 >This parameter should be used with care and tested with the printer
6164                 driver in question.  It is better to leave the device mode to NULL
6165                 and let the Windows client set the correct values.  Because drivers do not
6166                 do this all the time, setting <B
6167 CLASS="COMMAND"
6168 >default devmode = yes</B
6169 >
6170                 will instruct smbd to generate a default one.
6171                 </P
6172 ><P
6173 >For more information on Windows NT/2k printing and Device Modes,
6174                 see the <A
6175 HREF="http://msdn.microsoft.com/"
6176 TARGET="_top"
6177 >MSDN documentation</A
6178 >.
6179                 </P
6180 ><P
6181 >Default: <B
6182 CLASS="COMMAND"
6183 >default devmode = no</B
6184 ></P
6185 ></DD
6186 ><DT
6187 ><A
6188 NAME="DEFAULTSERVICE"
6189 ></A
6190 >default service (G)</DT
6191 ><DD
6192 ><P
6193 >This parameter specifies the name of a service
6194                 which will be connected to if the service actually requested cannot
6195                 be found. Note that the square brackets are <EM
6196 >NOT</EM
6197 >
6198                 given in the parameter value (see example below).</P
6199 ><P
6200 >There is no default value for this parameter. If this
6201                 parameter is not given, attempting to connect to a nonexistent
6202                 service results in an error.</P
6203 ><P
6204 >Typically the default service would be a <A
6205 HREF="#GUESTOK"
6206 >               <TT
6207 CLASS="PARAMETER"
6208 ><I
6209 >guest ok</I
6210 ></TT
6211 ></A
6212 >, <A
6213 HREF="#READONLY"
6214 >               <TT
6215 CLASS="PARAMETER"
6216 ><I
6217 >read-only</I
6218 ></TT
6219 ></A
6220 > service.</P
6221 ><P
6222 >Also note that the apparent service name will be changed
6223                 to equal that of the requested service, this is very useful as it
6224                 allows you to use macros like <TT
6225 CLASS="PARAMETER"
6226 ><I
6227 >%S</I
6228 ></TT
6229 > to make
6230                 a wildcard service.</P
6231 ><P
6232 >Note also that any "_" characters in the name of the service
6233                 used in the default service will get mapped to a "/". This allows for
6234                 interesting things.</P
6235 ><P
6236 >Example:</P
6237 ><P
6238 ><TABLE
6239 BORDER="0"
6240 BGCOLOR="#E0E0E0"
6241 WIDTH="90%"
6242 ><TR
6243 ><TD
6244 ><PRE
6245 CLASS="PROGRAMLISTING"
6246 >[global]
6247         default service = pub
6248
6249 [pub]
6250         path = /%S
6251                 </PRE
6252 ></TD
6253 ></TR
6254 ></TABLE
6255 ></P
6256 ></DD
6257 ><DT
6258 ><A
6259 NAME="DELETEPRINTERCOMMAND"
6260 ></A
6261 >delete printer command (G)</DT
6262 ><DD
6263 ><P
6264 >With the introduction of MS-RPC based printer
6265                 support for Windows NT/2000 clients in Samba 2.2, it is now
6266                 possible to delete printer at run time by issuing the
6267                 DeletePrinter() RPC call.</P
6268 ><P
6269 >For a Samba host this means that the printer must be
6270                 physically deleted from underlying printing system.  The <TT
6271 CLASS="PARAMETER"
6272 ><I
6273 >               deleteprinter command</I
6274 ></TT
6275 > defines a script to be run which
6276                 will perform the necessary operations for removing the printer
6277                 from the print system and from <TT
6278 CLASS="FILENAME"
6279 >smb.conf</TT
6280 >.
6281                 </P
6282 ><P
6283 >The <TT
6284 CLASS="PARAMETER"
6285 ><I
6286 >delete printer command</I
6287 ></TT
6288 > is
6289                 automatically called with only one parameter: <TT
6290 CLASS="PARAMETER"
6291 ><I
6292 >               "printer name"</I
6293 ></TT
6294 >.</P
6295 ><P
6296 >Once the <TT
6297 CLASS="PARAMETER"
6298 ><I
6299 >delete printer command</I
6300 ></TT
6301 > has
6302                 been executed, <B
6303 CLASS="COMMAND"
6304 >smbd</B
6305 > will reparse the <TT
6306 CLASS="FILENAME"
6307 >               smb.conf</TT
6308 > to associated printer no longer exists.
6309                 If the sharename is still valid, then <B
6310 CLASS="COMMAND"
6311 >smbd
6312                 </B
6313 > will return an ACCESS_DENIED error to the client.</P
6314 ><P
6315 >See also <A
6316 HREF="#ADDPRINTERCOMMAND"
6317 ><TT
6318 CLASS="PARAMETER"
6319 ><I
6320 >               add printer command</I
6321 ></TT
6322 ></A
6323 >, <A
6324 HREF="#PRINTING"
6325 ><TT
6326 CLASS="PARAMETER"
6327 ><I
6328 >printing</I
6329 ></TT
6330 ></A
6331 >,
6332                 <A
6333 HREF="#SHOWADDPRINTERWIZARD"
6334 ><TT
6335 CLASS="PARAMETER"
6336 ><I
6337 >show add
6338                 printer wizard</I
6339 ></TT
6340 ></A
6341 ></P
6342 ><P
6343 >Default: <EM
6344 >none</EM
6345 ></P
6346 ><P
6347 >Example: <B
6348 CLASS="COMMAND"
6349 >deleteprinter command = /usr/bin/removeprinter
6350                 </B
6351 ></P
6352 ></DD
6353 ><DT
6354 ><A
6355 NAME="DELETEREADONLY"
6356 ></A
6357 >delete readonly (S)</DT
6358 ><DD
6359 ><P
6360 >This parameter allows readonly files to be deleted.
6361                 This is not normal DOS semantics, but is allowed by UNIX.</P
6362 ><P
6363 >This option may be useful for running applications such
6364                 as rcs, where UNIX file ownership prevents changing file
6365                 permissions, and DOS semantics prevent deletion of a read only file.</P
6366 ><P
6367 >Default: <B
6368 CLASS="COMMAND"
6369 >delete readonly = no</B
6370 ></P
6371 ></DD
6372 ><DT
6373 ><A
6374 NAME="DELETESHARECOMMAND"
6375 ></A
6376 >delete share command (G)</DT
6377 ><DD
6378 ><P
6379 >Samba 2.2.0 introduced the ability to dynamically
6380                 add and delete shares via the Windows NT 4.0 Server Manager.  The
6381                 <TT
6382 CLASS="PARAMETER"
6383 ><I
6384 >delete share command</I
6385 ></TT
6386 > is used to define an
6387                 external program or script which will remove an existing service
6388                 definition from <TT
6389 CLASS="FILENAME"
6390 >smb.conf</TT
6391 >.  In order to successfully
6392                 execute the <TT
6393 CLASS="PARAMETER"
6394 ><I
6395 >delete share command</I
6396 ></TT
6397 >, <B
6398 CLASS="COMMAND"
6399 >smbd</B
6400 >
6401                 requires that the administrator be connected using a root account (i.e.
6402                 uid == 0).
6403                 </P
6404 ><P
6405 >               When executed, <B
6406 CLASS="COMMAND"
6407 >smbd</B
6408 > will automatically invoke the
6409                 <TT
6410 CLASS="PARAMETER"
6411 ><I
6412 >delete share command</I
6413 ></TT
6414 > with two parameters.
6415                 </P
6416 ><P
6417 ></P
6418 ><UL
6419 ><LI
6420 ><P
6421 ><TT
6422 CLASS="PARAMETER"
6423 ><I
6424 >configFile</I
6425 ></TT
6426 > - the location
6427                         of the global <TT
6428 CLASS="FILENAME"
6429 >smb.conf</TT
6430 > file.
6431                         </P
6432 ></LI
6433 ><LI
6434 ><P
6435 ><TT
6436 CLASS="PARAMETER"
6437 ><I
6438 >shareName</I
6439 ></TT
6440 > - the name of
6441                         the existing service.
6442                         </P
6443 ></LI
6444 ></UL
6445 ><P
6446 >               This parameter is only used to remove file shares.  To delete printer shares,
6447                 see the <A
6448 HREF="#DELETEPRINTERCOMMAND"
6449 ><TT
6450 CLASS="PARAMETER"
6451 ><I
6452 >delete printer
6453                 command</I
6454 ></TT
6455 ></A
6456 >.
6457                 </P
6458 ><P
6459 >               See also <A
6460 HREF="#ADDSHARECOMMAND"
6461 ><TT
6462 CLASS="PARAMETER"
6463 ><I
6464 >add share
6465                 command</I
6466 ></TT
6467 ></A
6468 >, <A
6469 HREF="#CHANGESHARECOMMAND"
6470 ><TT
6471 CLASS="PARAMETER"
6472 ><I
6473 >change
6474                 share command</I
6475 ></TT
6476 ></A
6477 >.
6478                 </P
6479 ><P
6480 >Default: <EM
6481 >none</EM
6482 ></P
6483 ><P
6484 >Example: <B
6485 CLASS="COMMAND"
6486 >delete share command = /usr/local/bin/delshare</B
6487 ></P
6488 ></DD
6489 ><DT
6490 ><A
6491 NAME="DELETEUSERSCRIPT"
6492 ></A
6493 >delete user script (G)</DT
6494 ><DD
6495 ><P
6496 >This is the full pathname to a script that will
6497                 be run <EM
6498 >AS ROOT</EM
6499 > by <A
6500 HREF="smbd.8.html"
6501 TARGET="_top"
6502 >               <B
6503 CLASS="COMMAND"
6504 >smbd(8)</B
6505 ></A
6506 > under special circumstances
6507                 described below.</P
6508 ><P
6509 >Normally, a Samba server requires that UNIX users are
6510                 created for all users accessing files on this server. For sites
6511                 that use Windows NT account databases as their primary user database
6512                 creating these users and keeping the user list in sync with the
6513                 Windows NT PDC is an onerous task. This option allows <B
6514 CLASS="COMMAND"
6515 >               smbd</B
6516 > to delete the required UNIX users <EM
6517 >ON
6518                 DEMAND</EM
6519 > when a user accesses the Samba server and the
6520                 Windows NT user no longer exists.</P
6521 ><P
6522 >In order to use this option, <B
6523 CLASS="COMMAND"
6524 >smbd</B
6525 > must be
6526                 set to <TT
6527 CLASS="PARAMETER"
6528 ><I
6529 >security = domain</I
6530 ></TT
6531 > or <TT
6532 CLASS="PARAMETER"
6533 ><I
6534 >security =
6535                 user</I
6536 ></TT
6537 > and <TT
6538 CLASS="PARAMETER"
6539 ><I
6540 >delete user script</I
6541 ></TT
6542 >
6543                 must be set to a full pathname for a script
6544                 that will delete a UNIX user given one argument of <TT
6545 CLASS="PARAMETER"
6546 ><I
6547 >%u</I
6548 ></TT
6549 >,
6550                 which expands into the UNIX user name to delete.</P
6551 ><P
6552 >When the Windows user attempts to access the Samba server,
6553                 at <EM
6554 >login</EM
6555 > (session setup in the SMB protocol)
6556                 time, <B
6557 CLASS="COMMAND"
6558 >smbd</B
6559 > contacts the <A
6560 HREF="#PASSWORDSERVER"
6561 >               <TT
6562 CLASS="PARAMETER"
6563 ><I
6564 >password server</I
6565 ></TT
6566 ></A
6567 > and attempts to authenticate
6568                 the given user with the given password. If the authentication fails
6569                 with the specific Domain error code meaning that the user no longer
6570                 exists then <B
6571 CLASS="COMMAND"
6572 >smbd</B
6573 > attempts to find a UNIX user in
6574                 the UNIX password database that matches the Windows user account. If
6575                 this lookup succeeds, and <TT
6576 CLASS="PARAMETER"
6577 ><I
6578 >delete user script</I
6579 ></TT
6580 > is
6581                 set then <B
6582 CLASS="COMMAND"
6583 >smbd</B
6584 > will all the specified script
6585                 <EM
6586 >AS ROOT</EM
6587 >, expanding any <TT
6588 CLASS="PARAMETER"
6589 ><I
6590 >%u</I
6591 ></TT
6592 >
6593                 argument to be the user name to delete.</P
6594 ><P
6595 >This script should delete the given UNIX username. In this way,
6596                 UNIX users are dynamically deleted to match existing Windows NT
6597                 accounts.</P
6598 ><P
6599 >See also <A
6600 HREF="#SECURITYEQUALSDOMAIN"
6601 >security = domain</A
6602 >,
6603                 <A
6604 HREF="#PASSWORDSERVER"
6605 ><TT
6606 CLASS="PARAMETER"
6607 ><I
6608 >password server</I
6609 ></TT
6610 >
6611                 </A
6612 >, <A
6613 HREF="#ADDUSERSCRIPT"
6614 ><TT
6615 CLASS="PARAMETER"
6616 ><I
6617 >add user script</I
6618 ></TT
6619 >
6620                 </A
6621 >.</P
6622 ><P
6623 >Default: <B
6624 CLASS="COMMAND"
6625 >delete user script = &#60;empty string&#62;
6626                 </B
6627 ></P
6628 ><P
6629 >Example: <B
6630 CLASS="COMMAND"
6631 >delete user script = /usr/local/samba/bin/del_user
6632                 %u</B
6633 ></P
6634 ></DD
6635 ><DT
6636 ><A
6637 NAME="DELETEVETOFILES"
6638 ></A
6639 >delete veto files (S)</DT
6640 ><DD
6641 ><P
6642 >This option is used when Samba is attempting to
6643                 delete a directory that contains one or more vetoed directories
6644                 (see the <A
6645 HREF="#VETOFILES"
6646 ><TT
6647 CLASS="PARAMETER"
6648 ><I
6649 >veto files</I
6650 ></TT
6651 ></A
6652 >
6653                 option).  If this option is set to <TT
6654 CLASS="CONSTANT"
6655 >false</TT
6656 > (the default) then if a vetoed
6657                 directory contains any non-vetoed files or directories then the
6658                 directory delete will fail. This is usually what you want.</P
6659 ><P
6660 >If this option is set to <TT
6661 CLASS="CONSTANT"
6662 >true</TT
6663 >, then Samba
6664                 will attempt to recursively delete any files and directories within
6665                 the vetoed directory. This can be useful for integration with file
6666                 serving systems such as NetAtalk which create meta-files within
6667                 directories you might normally veto DOS/Windows users from seeing
6668                 (e.g. <TT
6669 CLASS="FILENAME"
6670 >.AppleDouble</TT
6671 >)</P
6672 ><P
6673 >Setting <B
6674 CLASS="COMMAND"
6675 >delete veto files = yes</B
6676 > allows these
6677                 directories to be  transparently deleted when the parent directory
6678                 is deleted (so long as the user has permissions to do so).</P
6679 ><P
6680 >See also the <A
6681 HREF="#VETOFILES"
6682 ><TT
6683 CLASS="PARAMETER"
6684 ><I
6685 >veto
6686                 files</I
6687 ></TT
6688 ></A
6689 > parameter.</P
6690 ><P
6691 >Default: <B
6692 CLASS="COMMAND"
6693 >delete veto files = no</B
6694 ></P
6695 ></DD
6696 ><DT
6697 ><A
6698 NAME="DENYHOSTS"
6699 ></A
6700 >deny hosts (S)</DT
6701 ><DD
6702 ><P
6703 >Synonym for <A
6704 HREF="#HOSTSDENY"
6705 ><TT
6706 CLASS="PARAMETER"
6707 ><I
6708 >hosts
6709                 deny</I
6710 ></TT
6711 ></A
6712 >.</P
6713 ></DD
6714 ><DT
6715 ><A
6716 NAME="DFREECOMMAND"
6717 ></A
6718 >dfree command (G)</DT
6719 ><DD
6720 ><P
6721 >The <TT
6722 CLASS="PARAMETER"
6723 ><I
6724 >dfree command</I
6725 ></TT
6726 > setting should
6727                 only be used on systems where a problem occurs with the internal
6728                 disk space calculations. This has been known to happen with Ultrix,
6729                 but may occur with other operating systems. The symptom that was
6730                 seen was an error of "Abort Retry Ignore" at the end of each
6731                 directory listing.</P
6732 ><P
6733 >This setting allows the replacement of the internal routines to
6734                 calculate the total disk space and amount available with an external
6735                 routine. The example below gives a possible script that might fulfill
6736                 this function.</P
6737 ><P
6738 >The external program will be passed a single parameter indicating
6739                 a directory in the filesystem being queried. This will typically consist
6740                 of the string <TT
6741 CLASS="FILENAME"
6742 >./</TT
6743 >. The script should return two
6744                 integers in ASCII. The first should be the total disk space in blocks,
6745                 and the second should be the number of available blocks. An optional
6746                 third return value can give the block size in bytes. The default
6747                 blocksize is 1024 bytes.</P
6748 ><P
6749 >Note: Your script should <EM
6750 >NOT</EM
6751 > be setuid or
6752                 setgid and should be owned by (and writeable only by) root!</P
6753 ><P
6754 >Default: <EM
6755 >By default internal routines for
6756                 determining the disk capacity and remaining space will be used.
6757                 </EM
6758 ></P
6759 ><P
6760 >Example: <B
6761 CLASS="COMMAND"
6762 >dfree command = /usr/local/samba/bin/dfree
6763                 </B
6764 ></P
6765 ><P
6766 >Where the script dfree (which must be made executable) could be:</P
6767 ><P
6768 ><TABLE
6769 BORDER="0"
6770 BGCOLOR="#E0E0E0"
6771 WIDTH="90%"
6772 ><TR
6773 ><TD
6774 ><PRE
6775 CLASS="PROGRAMLISTING"
6776 >
6777                 #!/bin/sh
6778                 df $1 | tail -1 | awk '{print $2" "$4}'
6779                 </PRE
6780 ></TD
6781 ></TR
6782 ></TABLE
6783 ></P
6784 ><P
6785 >or perhaps (on Sys V based systems):</P
6786 ><P
6787 ><TABLE
6788 BORDER="0"
6789 BGCOLOR="#E0E0E0"
6790 WIDTH="90%"
6791 ><TR
6792 ><TD
6793 ><PRE
6794 CLASS="PROGRAMLISTING"
6795 >
6796                 #!/bin/sh
6797                 /usr/bin/df -k $1 | tail -1 | awk '{print $3" "$5}'
6798                 </PRE
6799 ></TD
6800 ></TR
6801 ></TABLE
6802 ></P
6803 ><P
6804 >Note that you may have to replace the command names
6805                 with full path names on some systems.</P
6806 ></DD
6807 ><DT
6808 ><A
6809 NAME="DIRECTORY"
6810 ></A
6811 >directory (S)</DT
6812 ><DD
6813 ><P
6814 >Synonym for <A
6815 HREF="#PATH"
6816 ><TT
6817 CLASS="PARAMETER"
6818 ><I
6819 >path
6820                 </I
6821 ></TT
6822 ></A
6823 >.</P
6824 ></DD
6825 ><DT
6826 ><A
6827 NAME="DIRECTORYMASK"
6828 ></A
6829 >directory mask (S)</DT
6830 ><DD
6831 ><P
6832 >This parameter is the octal modes which are
6833                 used when converting DOS modes to UNIX modes when creating UNIX
6834                 directories.</P
6835 ><P
6836 >When a directory is created, the necessary permissions are
6837                 calculated according to the mapping from DOS modes to UNIX permissions,
6838                 and the resulting UNIX mode is then bit-wise 'AND'ed with this
6839                 parameter. This parameter may be thought of as a bit-wise MASK for
6840                 the UNIX modes of a directory. Any bit <EM
6841 >not</EM
6842 > set
6843                 here will be removed from the modes set on a directory when it is
6844                 created.</P
6845 ><P
6846 >The default value of this parameter removes the 'group'
6847                 and 'other' write bits from the UNIX mode, allowing only the
6848                 user who owns the directory to modify it.</P
6849 ><P
6850 >Following this Samba will bit-wise 'OR' the UNIX mode
6851                 created from this parameter with the value of the <A
6852 HREF="#FORCEDIRECTORYMODE"
6853 ><TT
6854 CLASS="PARAMETER"
6855 ><I
6856 >force directory mode
6857                 </I
6858 ></TT
6859 ></A
6860 > parameter. This parameter is set to 000 by
6861                 default (i.e. no extra mode bits are added).</P
6862 ><P
6863 >Note that this parameter does not apply to permissions
6864                 set by Windows NT/2000 ACL editors. If the administrator wishes to enforce
6865                 a mask on access control lists also, they need to set the <A
6866 HREF="#DIRECTORYSECURITYMASK"
6867 ><TT
6868 CLASS="PARAMETER"
6869 ><I
6870 >directory security mask</I
6871 ></TT
6872 ></A
6873 >.</P
6874 ><P
6875 >See the <A
6876 HREF="#FORCEDIRECTORYMODE"
6877 ><TT
6878 CLASS="PARAMETER"
6879 ><I
6880 >force
6881                 directory mode</I
6882 ></TT
6883 ></A
6884 > parameter to cause particular mode
6885                 bits to always be set on created directories.</P
6886 ><P
6887 >See also the <A
6888 HREF="#CREATEMODE"
6889 ><TT
6890 CLASS="PARAMETER"
6891 ><I
6892 >create mode
6893                 </I
6894 ></TT
6895 ></A
6896 > parameter for masking mode bits on created files,
6897                 and the <A
6898 HREF="#DIRECTORYSECURITYMASK"
6899 ><TT
6900 CLASS="PARAMETER"
6901 ><I
6902 >directory
6903                 security mask</I
6904 ></TT
6905 ></A
6906 > parameter.</P
6907 ><P
6908 >Also refer to the <A
6909 HREF="#INHERITPERMISSIONS"
6910 ><TT
6911 CLASS="PARAMETER"
6912 ><I
6913 >               inherit permissions</I
6914 ></TT
6915 ></A
6916 > parameter.</P
6917 ><P
6918 >Default: <B
6919 CLASS="COMMAND"
6920 >directory mask = 0755</B
6921 ></P
6922 ><P
6923 >Example: <B
6924 CLASS="COMMAND"
6925 >directory mask = 0775</B
6926 ></P
6927 ></DD
6928 ><DT
6929 ><A
6930 NAME="DIRECTORYMODE"
6931 ></A
6932 >directory mode (S)</DT
6933 ><DD
6934 ><P
6935 >Synonym for <A
6936 HREF="#DIRECTORYMASK"
6937 ><TT
6938 CLASS="PARAMETER"
6939 ><I
6940 >               directory mask</I
6941 ></TT
6942 ></A
6943 ></P
6944 ></DD
6945 ><DT
6946 ><A
6947 NAME="DIRECTORYSECURITYMASK"
6948 ></A
6949 >directory security mask (S)</DT
6950 ><DD
6951 ><P
6952 >This parameter controls what UNIX permission bits
6953                 can be modified when a Windows NT client is manipulating the UNIX
6954                 permission on a directory using the native NT security dialog
6955                 box.</P
6956 ><P
6957 >This parameter is applied as a mask (AND'ed with) to
6958                 the changed permission bits, thus preventing any bits not in
6959                 this mask from being modified. Essentially, zero bits in this
6960                 mask may be treated as a set of bits the user is not allowed
6961                 to change.</P
6962 ><P
6963 >If not set explicitly this parameter is set to 0777
6964                 meaning a user is allowed to modify all the user/group/world
6965                 permissions on a directory.</P
6966 ><P
6967 ><EM
6968 >Note</EM
6969 > that users who can access the
6970                 Samba server through other means can easily bypass this restriction,
6971                 so it is primarily useful for standalone "appliance" systems.
6972                 Administrators of most normal systems will probably want to leave
6973                 it as the default of <TT
6974 CLASS="CONSTANT"
6975 >0777</TT
6976 >.</P
6977 ><P
6978 >See also the <A
6979 HREF="#FORCEDIRECTORYSECURITYMODE"
6980 ><TT
6981 CLASS="PARAMETER"
6982 ><I
6983 >               force directory security mode</I
6984 ></TT
6985 ></A
6986 >, <A
6987 HREF="#SECURITYMASK"
6988 ><TT
6989 CLASS="PARAMETER"
6990 ><I
6991 >security mask</I
6992 ></TT
6993 ></A
6994 >,
6995                 <A
6996 HREF="#FORCESECURITYMODE"
6997 ><TT
6998 CLASS="PARAMETER"
6999 ><I
7000 >force security mode
7001                 </I
7002 ></TT
7003 ></A
7004 > parameters.</P
7005 ><P
7006 >Default: <B
7007 CLASS="COMMAND"
7008 >directory security mask = 0777</B
7009 ></P
7010 ><P
7011 >Example: <B
7012 CLASS="COMMAND"
7013 >directory security mask = 0700</B
7014 ></P
7015 ></DD
7016 ><DT
7017 ><A
7018 NAME="DISABLESPOOLSS"
7019 ></A
7020 >disable spoolss (G)</DT
7021 ><DD
7022 ><P
7023 >Enabling this parameter will disables Samba's support
7024                 for the SPOOLSS set of MS-RPC's and will yield identical behavior
7025                 as Samba 2.0.x.  Windows NT/2000 clients will downgrade to using
7026                 Lanman style printing commands. Windows 9x/ME will be uneffected by
7027                 the parameter. However, this will also disable the ability to upload
7028                 printer drivers to a Samba server via the Windows NT Add Printer
7029                 Wizard or by using the NT printer properties dialog window.  It will
7030                 also disable the capability of Windows NT/2000 clients to download
7031                 print drivers from the Samba host upon demand.
7032                 <EM
7033 >Be very careful about enabling this parameter.</EM
7034 >
7035                 </P
7036 ><P
7037 >See also <A
7038 HREF="#USECLIENTDRIVER"
7039 >use client driver</A
7040 >
7041                 </P
7042 ><P
7043 >Default : <B
7044 CLASS="COMMAND"
7045 >disable spoolss = no</B
7046 ></P
7047 ></DD
7048 ><DT
7049 ><A
7050 NAME="DNSPROXY"
7051 ></A
7052 >dns proxy (G)</DT
7053 ><DD
7054 ><P
7055 >Specifies that <A
7056 HREF="nmbd.8.html"
7057 TARGET="_top"
7058 >nmbd(8)</A
7059 >
7060                 when acting as a WINS server and finding that a NetBIOS name has not
7061                 been registered, should treat the NetBIOS name word-for-word as a DNS
7062                 name and do a lookup with the DNS server for that name on behalf of
7063                 the name-querying client.</P
7064 ><P
7065 >Note that the maximum length for a NetBIOS name is 15
7066                 characters, so the DNS name (or DNS alias) can likewise only be
7067                 15 characters, maximum.</P
7068 ><P
7069 ><B
7070 CLASS="COMMAND"
7071 >nmbd</B
7072 > spawns a second copy of itself to do the
7073                 DNS name lookup requests, as doing a name lookup is a blocking
7074                 action.</P
7075 ><P
7076 >See also the parameter <A
7077 HREF="#WINSSUPPORT"
7078 ><TT
7079 CLASS="PARAMETER"
7080 ><I
7081 >               wins support</I
7082 ></TT
7083 ></A
7084 >.</P
7085 ><P
7086 >Default: <B
7087 CLASS="COMMAND"
7088 >dns proxy = yes</B
7089 ></P
7090 ></DD
7091 ><DT
7092 ><A
7093 NAME="DOMAINADMINGROUP"
7094 ></A
7095 >domain admin group (G)</DT
7096 ><DD
7097 ><P
7098 >This parameter is intended as a temporary solution
7099                 to enable users to be a member of the "Domain Admins" group when
7100                 a Samba host is acting as a PDC.  A complete solution will be provided
7101                 by a system for mapping Windows NT/2000 groups onto UNIX groups.
7102                 Please note that this parameter has a somewhat confusing name.  It
7103                 accepts a list of usernames and of group names in standard
7104                 <TT
7105 CLASS="FILENAME"
7106 >smb.conf</TT
7107 >       notation.
7108                 </P
7109 ><P
7110 >See also <A
7111 HREF="#DOMAINGUESTGROUP"
7112 ><TT
7113 CLASS="PARAMETER"
7114 ><I
7115 >domain
7116                 guest group</I
7117 ></TT
7118 ></A
7119 >, <A
7120 HREF="#DOMAINLOGONS"
7121 ><TT
7122 CLASS="PARAMETER"
7123 ><I
7124 >domain
7125                 logons</I
7126 ></TT
7127 ></A
7128 >
7129                 </P
7130 ><P
7131 >Default: <EM
7132 >no domain administrators</EM
7133 ></P
7134 ><P
7135 >Example: <B
7136 CLASS="COMMAND"
7137 >domain admin group = root @wheel</B
7138 ></P
7139 ></DD
7140 ><DT
7141 ><A
7142 NAME="DOMAINGUESTGROUP"
7143 ></A
7144 >domain guest group (G)</DT
7145 ><DD
7146 ><P
7147 >This parameter is intended as a temporary solution
7148                 to enable users to be a member of the "Domain Guests" group when
7149                 a Samba host is acting as a PDC.  A complete solution will be provided
7150                 by a system for mapping Windows NT/2000 groups onto UNIX groups.
7151                 Please note that this parameter has a somewhat confusing name.  It
7152                 accepts a list of usernames and of group names in standard
7153                 <TT
7154 CLASS="FILENAME"
7155 >smb.conf</TT
7156 >       notation.
7157                 </P
7158 ><P
7159 >See also <A
7160 HREF="#DOMAINADMINGROUP"
7161 ><TT
7162 CLASS="PARAMETER"
7163 ><I
7164 >domain
7165                 admin group</I
7166 ></TT
7167 ></A
7168 >, <A
7169 HREF="#DOMAINLOGONS"
7170 ><TT
7171 CLASS="PARAMETER"
7172 ><I
7173 >domain
7174                 logons</I
7175 ></TT
7176 ></A
7177 >
7178                 </P
7179 ><P
7180 >Default: <EM
7181 >no domain guests</EM
7182 ></P
7183 ><P
7184 >Example: <B
7185 CLASS="COMMAND"
7186 >domain guest group = nobody @guest</B
7187 ></P
7188 ></DD
7189 ><DT
7190 ><A
7191 NAME="DOMAINLOGONS"
7192 ></A
7193 >domain logons (G)</DT
7194 ><DD
7195 ><P
7196 >If set to <TT
7197 CLASS="CONSTANT"
7198 >true</TT
7199 >, the Samba server will serve
7200                 Windows 95/98 Domain logons for the <A
7201 HREF="#WORKGROUP"
7202 >               <TT
7203 CLASS="PARAMETER"
7204 ><I
7205 >workgroup</I
7206 ></TT
7207 ></A
7208 > it is in. Samba 2.2 also
7209                 has limited capability to act as a domain controller for Windows
7210                 NT 4 Domains.  For more details on setting up this feature see
7211                 the Samba-PDC-HOWTO included in the <TT
7212 CLASS="FILENAME"
7213 >htmldocs/</TT
7214 >
7215                 directory shipped with the source code.</P
7216 ><P
7217 >Default: <B
7218 CLASS="COMMAND"
7219 >domain logons = no</B
7220 ></P
7221 ></DD
7222 ><DT
7223 ><A
7224 NAME="DOMAINMASTER"
7225 ></A
7226 >domain master (G)</DT
7227 ><DD
7228 ><P
7229 >Tell <A
7230 HREF="nmbd.8.html"
7231 TARGET="_top"
7232 ><B
7233 CLASS="COMMAND"
7234 >               nmbd(8)</B
7235 ></A
7236 > to enable WAN-wide browse list
7237                 collation. Setting this option causes <B
7238 CLASS="COMMAND"
7239 >nmbd</B
7240 > to
7241                 claim a special domain specific NetBIOS name that identifies
7242                 it as a domain master browser for its given <A
7243 HREF="#WORKGROUP"
7244 >               <TT
7245 CLASS="PARAMETER"
7246 ><I
7247 >workgroup</I
7248 ></TT
7249 ></A
7250 >. Local master browsers
7251                 in the same <TT
7252 CLASS="PARAMETER"
7253 ><I
7254 >workgroup</I
7255 ></TT
7256 > on broadcast-isolated
7257                 subnets will give this <B
7258 CLASS="COMMAND"
7259 >nmbd</B
7260 > their local browse lists,
7261                 and then ask <A
7262 HREF="smbd.8.html"
7263 TARGET="_top"
7264 ><B
7265 CLASS="COMMAND"
7266 >smbd(8)</B
7267 ></A
7268 >
7269                 for a complete copy of the browse list for the whole wide area
7270                 network.  Browser clients will then contact their local master browser,
7271                 and will receive the domain-wide browse list, instead of just the list
7272                 for their broadcast-isolated subnet.</P
7273 ><P
7274 >Note that Windows NT Primary Domain Controllers expect to be
7275                 able to claim this <TT
7276 CLASS="PARAMETER"
7277 ><I
7278 >workgroup</I
7279 ></TT
7280 > specific special
7281                 NetBIOS name that identifies them as domain master browsers for
7282                 that <TT
7283 CLASS="PARAMETER"
7284 ><I
7285 >workgroup</I
7286 ></TT
7287 > by default (i.e. there is no
7288                 way to prevent a Windows NT PDC from attempting to do this). This
7289                 means that if this parameter is set and <B
7290 CLASS="COMMAND"
7291 >nmbd</B
7292 > claims
7293                 the special name for a <TT
7294 CLASS="PARAMETER"
7295 ><I
7296 >workgroup</I
7297 ></TT
7298 > before a Windows
7299                 NT PDC is able to do so then cross subnet browsing will behave
7300                 strangely and may fail.</P
7301 ><P
7302 >If <A
7303 HREF="#DOMAINLOGONS"
7304 ><B
7305 CLASS="COMMAND"
7306 >domain logons = yes</B
7307 >
7308                 </A
7309 >, then the default behavior is to enable the <TT
7310 CLASS="PARAMETER"
7311 ><I
7312 >domain
7313                 master</I
7314 ></TT
7315 > parameter.  If <TT
7316 CLASS="PARAMETER"
7317 ><I
7318 >domain logons</I
7319 ></TT
7320 > is
7321                 not enabled (the default setting), then neither will <TT
7322 CLASS="PARAMETER"
7323 ><I
7324 >domain
7325                 master</I
7326 ></TT
7327 > be enabled by default.</P
7328 ><P
7329 >Default: <B
7330 CLASS="COMMAND"
7331 >domain master = auto</B
7332 ></P
7333 ></DD
7334 ><DT
7335 ><A
7336 NAME="DONTDESCEND"
7337 ></A
7338 >dont descend (S)</DT
7339 ><DD
7340 ><P
7341 >There are certain directories on some systems
7342                 (e.g., the <TT
7343 CLASS="FILENAME"
7344 >/proc</TT
7345 > tree under Linux) that are either not
7346                 of interest to clients or are infinitely deep (recursive). This
7347                 parameter allows you to specify a comma-delimited list of directories
7348                 that the server should always show as empty.</P
7349 ><P
7350 >Note that Samba can be very fussy about the exact format
7351                 of the "dont descend" entries. For example you may need <TT
7352 CLASS="FILENAME"
7353 >               ./proc</TT
7354 > instead of just <TT
7355 CLASS="FILENAME"
7356 >/proc</TT
7357 >.
7358                 Experimentation is the best policy :-)  </P
7359 ><P
7360 >Default: <EM
7361 >none (i.e., all directories are OK
7362                 to descend)</EM
7363 ></P
7364 ><P
7365 >Example: <B
7366 CLASS="COMMAND"
7367 >dont descend = /proc,/dev</B
7368 ></P
7369 ></DD
7370 ><DT
7371 ><A
7372 NAME="DOSFILEMODE"
7373 ></A
7374 >dos filemode (S)</DT
7375 ><DD
7376 ><P
7377 > The default behavior in Samba is to provide
7378                 UNIX-like behavior where only the owner of a file/directory is
7379                 able to change the permissions on it.  However, this behavior
7380                 is often confusing to  DOS/Windows users.  Enabling this parameter
7381                 allows a user who has write access to the file (by whatever
7382                 means) to modify the permissions on it.  Note that a user
7383                 belonging to the group owning the file will not be allowed to
7384                 change permissions if the group is only granted read access.
7385                 Ownership of the file/directory is not changed, only the permissions
7386                 are modified.</P
7387 ><P
7388 >Default: <B
7389 CLASS="COMMAND"
7390 >dos filemode = no</B
7391 ></P
7392 ></DD
7393 ><DT
7394 ><A
7395 NAME="DOSFILETIMERESOLUTION"
7396 ></A
7397 >dos filetime resolution (S)</DT
7398 ><DD
7399 ><P
7400 >Under the DOS and Windows FAT filesystem, the finest
7401                 granularity on time resolution is two seconds. Setting this parameter
7402                 for a share causes Samba to round the reported time down to the
7403                 nearest two second boundary when a query call that requires one second
7404                 resolution is made to <A
7405 HREF="smbd.8.html"
7406 TARGET="_top"
7407 ><B
7408 CLASS="COMMAND"
7409 >smbd(8)</B
7410 >
7411                 </A
7412 >.</P
7413 ><P
7414 >This option is mainly used as a compatibility option for Visual
7415                 C++ when used against Samba shares. If oplocks are enabled on a
7416                 share, Visual C++ uses two different time reading calls to check if a
7417                 file has changed since it was last read. One of these calls uses a
7418                 one-second granularity, the other uses a two second granularity. As
7419                 the two second call rounds any odd second down, then if the file has a
7420                 timestamp of an odd number of seconds then the two timestamps will not
7421                 match and Visual C++ will keep reporting the file has changed. Setting
7422                 this option causes the two timestamps to match, and Visual C++ is
7423                 happy.</P
7424 ><P
7425 >Default: <B
7426 CLASS="COMMAND"
7427 >dos filetime resolution = no</B
7428 ></P
7429 ></DD
7430 ><DT
7431 ><A
7432 NAME="DOSFILETIMES"
7433 ></A
7434 >dos filetimes (S)</DT
7435 ><DD
7436 ><P
7437 >Under DOS and Windows, if a user can write to a
7438                 file they can change the timestamp on it. Under POSIX semantics,
7439                 only the owner of the file or root may change the timestamp. By
7440                 default, Samba runs with POSIX semantics and refuses to change the
7441                 timestamp on a file if the user <B
7442 CLASS="COMMAND"
7443 >smbd</B
7444 > is acting
7445                 on behalf of is not the file owner. Setting this option to <TT
7446 CLASS="CONSTANT"
7447 >               true</TT
7448 > allows DOS semantics and <A
7449 HREF="smbd.8.html"
7450 TARGET="_top"
7451 >smbd</A
7452 > will change the file
7453                 timestamp as DOS requires.</P
7454 ><P
7455 >Default: <B
7456 CLASS="COMMAND"
7457 >dos filetimes = no</B
7458 ></P
7459 ></DD
7460 ><DT
7461 ><A
7462 NAME="ENCRYPTPASSWORDS"
7463 ></A
7464 >encrypt passwords (G)</DT
7465 ><DD
7466 ><P
7467 >This boolean controls whether encrypted passwords
7468                 will be negotiated with the client. Note that Windows NT 4.0 SP3 and
7469                 above and also Windows 98 will by default expect encrypted passwords
7470                 unless a registry entry is changed. To use encrypted passwords in
7471                 Samba see the file ENCRYPTION.txt in the Samba documentation
7472                 directory <TT
7473 CLASS="FILENAME"
7474 >docs/</TT
7475 > shipped with the source code.</P
7476 ><P
7477 >In order for encrypted passwords to work correctly
7478                 <A
7479 HREF="smbd.8.html"
7480 TARGET="_top"
7481 ><B
7482 CLASS="COMMAND"
7483 >smbd(8)</B
7484 ></A
7485 > must either
7486                 have access to a local <A
7487 HREF="smbpasswd.5.html"
7488 TARGET="_top"
7489 ><TT
7490 CLASS="FILENAME"
7491 >smbpasswd(5)
7492                 </TT
7493 ></A
7494 > file (see the <A
7495 HREF="smbpasswd.8.html"
7496 TARGET="_top"
7497 ><B
7498 CLASS="COMMAND"
7499 >               smbpasswd(8)</B
7500 ></A
7501 > program for information on how to set up
7502                 and maintain this file), or set the <A
7503 HREF="#SECURITY"
7504 >security = [server|domain|ads]</A
7505 > parameter which
7506                 causes <B
7507 CLASS="COMMAND"
7508 >smbd</B
7509 > to authenticate against another
7510                 server.</P
7511 ><P
7512 >Default: <B
7513 CLASS="COMMAND"
7514 >encrypt passwords = yes</B
7515 ></P
7516 ></DD
7517 ><DT
7518 ><A
7519 NAME="ENHANCEDBROWSING"
7520 ></A
7521 >enhanced browsing (G)</DT
7522 ><DD
7523 ><P
7524 >This option enables a couple of enhancements to
7525                 cross-subnet browse propagation that have been added in Samba
7526                 but which are not standard in Microsoft implementations.
7527                 </P
7528 ><P
7529 >The first enhancement to browse propagation consists of a regular
7530                 wildcard query to a Samba WINS server for all Domain Master Browsers,
7531                 followed by a browse synchronization with each of the returned
7532                 DMBs. The second enhancement consists of a regular randomised browse
7533                 synchronization with all currently known DMBs.</P
7534 ><P
7535 >You may wish to disable this option if you have a problem with empty
7536                 workgroups not disappearing from browse lists. Due to the restrictions
7537                 of the browse protocols these enhancements can cause a empty workgroup
7538                 to stay around forever which can be annoying.</P
7539 ><P
7540 >In general you should leave this option enabled as it makes
7541                 cross-subnet browse propagation much more reliable.</P
7542 ><P
7543 >Default: <B
7544 CLASS="COMMAND"
7545 >enhanced browsing = yes</B
7546 ></P
7547 ></DD
7548 ><DT
7549 ><A
7550 NAME="ENUMPORTSCOMMAND"
7551 ></A
7552 >enumports command (G)</DT
7553 ><DD
7554 ><P
7555 >The concept of a "port" is fairly foreign
7556                 to UNIX hosts.  Under Windows NT/2000 print servers, a port
7557                 is associated with a port monitor and generally takes the form of
7558                 a local port (i.e. LPT1:, COM1:, FILE:) or a remote port
7559                 (i.e. LPD Port Monitor, etc...).  By default, Samba has only one
7560                 port defined--<TT
7561 CLASS="CONSTANT"
7562 >"Samba Printer Port"</TT
7563 >.  Under
7564                 Windows NT/2000, all printers must have a valid port name.
7565                 If you wish to have a list of ports displayed (<B
7566 CLASS="COMMAND"
7567 >smbd
7568                 </B
7569 > does not use a port name for anything) other than
7570                 the default <TT
7571 CLASS="CONSTANT"
7572 >"Samba Printer Port"</TT
7573 >, you
7574                 can define <TT
7575 CLASS="PARAMETER"
7576 ><I
7577 >enumports command</I
7578 ></TT
7579 > to point to
7580                 a program which should generate a list of ports, one per line,
7581                 to standard output.  This listing will then be used in response
7582                 to the level 1 and 2 EnumPorts() RPC.</P
7583 ><P
7584 >Default: <EM
7585 >no enumports command</EM
7586 ></P
7587 ><P
7588 >Example: <B
7589 CLASS="COMMAND"
7590 >enumports command = /usr/bin/listports
7591                 </B
7592 ></P
7593 ></DD
7594 ><DT
7595 ><A
7596 NAME="EXEC"
7597 ></A
7598 >exec (S)</DT
7599 ><DD
7600 ><P
7601 >This is a synonym for <A
7602 HREF="#PREEXEC"
7603 >               <TT
7604 CLASS="PARAMETER"
7605 ><I
7606 >preexec</I
7607 ></TT
7608 ></A
7609 >.</P
7610 ></DD
7611 ><DT
7612 ><A
7613 NAME="FAKEDIRECTORYCREATETIMES"
7614 ></A
7615 >fake directory create times (S)</DT
7616 ><DD
7617 ><P
7618 >NTFS and Windows VFAT file systems keep a create
7619                 time for all files and directories. This is not the same as the
7620                 ctime - status change time - that Unix keeps, so Samba by default
7621                 reports the earliest of the various times Unix does keep. Setting
7622                 this parameter for a share causes Samba to always report midnight
7623                 1-1-1980 as the create time for directories.</P
7624 ><P
7625 >This option is mainly used as a compatibility option for
7626                 Visual C++ when used against Samba shares. Visual C++ generated
7627                 makefiles have the object directory as a dependency for each object
7628                 file, and a make rule to create the directory. Also, when NMAKE
7629                 compares timestamps it uses the creation time when examining a
7630                 directory. Thus the object directory will be created if it does not
7631                 exist, but once it does exist it will always have an earlier
7632                 timestamp than the object files it contains.</P
7633 ><P
7634 >However, Unix time semantics mean that the create time
7635                 reported by Samba will be updated whenever a file is created or
7636                 or deleted in the directory.  NMAKE finds all object files in
7637                 the object directory.  The timestamp of the last one built is then
7638                 compared to the timestamp of the object directory.  If the
7639                 directory's timestamp if newer, then all object files
7640                 will be rebuilt.  Enabling this option
7641                 ensures directories always predate their contents and an NMAKE build
7642                 will proceed as expected.</P
7643 ><P
7644 >Default: <B
7645 CLASS="COMMAND"
7646 >fake directory create times = no</B
7647 ></P
7648 ></DD
7649 ><DT
7650 ><A
7651 NAME="FAKEOPLOCKS"
7652 ></A
7653 >fake oplocks (S)</DT
7654 ><DD
7655 ><P
7656 >Oplocks are the way that SMB clients get permission
7657                 from a server to locally cache file operations. If a server grants
7658                 an oplock (opportunistic lock) then the client is free to assume
7659                 that it is the only one accessing the file and it will aggressively
7660                 cache file data. With some oplock types the client may even cache
7661                 file open/close operations. This can give enormous performance benefits.
7662                 </P
7663 ><P
7664 >When you set <B
7665 CLASS="COMMAND"
7666 >fake oplocks = yes</B
7667 >, <A
7668 HREF="smbd.8.html"
7669 TARGET="_top"
7670 ><B
7671 CLASS="COMMAND"
7672 >smbd(8)</B
7673 ></A
7674 > will
7675                 always grant oplock requests no matter how many clients are using
7676                 the file.</P
7677 ><P
7678 >It is generally much better to use the real <A
7679 HREF="#OPLOCKS"
7680 ><TT
7681 CLASS="PARAMETER"
7682 ><I
7683 >oplocks</I
7684 ></TT
7685 ></A
7686 > support rather
7687                 than this parameter.</P
7688 ><P
7689 >If you enable this option on all read-only shares or
7690                 shares that you know will only be accessed from one client at a
7691                 time such as physically read-only media like CDROMs, you will see
7692                 a big performance improvement on many operations. If you enable
7693                 this option on shares where multiple clients may be accessing the
7694                 files read-write at the same time you can get data corruption. Use
7695                 this option carefully!</P
7696 ><P
7697 >Default: <B
7698 CLASS="COMMAND"
7699 >fake oplocks = no</B
7700 ></P
7701 ></DD
7702 ><DT
7703 ><A
7704 NAME="FOLLOWSYMLINKS"
7705 ></A
7706 >follow symlinks (S)</DT
7707 ><DD
7708 ><P
7709 >This parameter allows the Samba administrator
7710                 to stop <A
7711 HREF="smbd.8.html"
7712 TARGET="_top"
7713 ><B
7714 CLASS="COMMAND"
7715 >smbd(8)</B
7716 ></A
7717 >
7718                 from following symbolic links in a particular share. Setting this
7719                 parameter to <TT
7720 CLASS="CONSTANT"
7721 >no</TT
7722 > prevents any file or directory
7723                 that is a symbolic link from being followed (the user will get an
7724                 error).  This option is very useful to stop users from adding a
7725                 symbolic link to <TT
7726 CLASS="FILENAME"
7727 >/etc/passwd</TT
7728 > in their home
7729                 directory for instance.  However it will slow filename lookups
7730                 down slightly.</P
7731 ><P
7732 >This option is enabled (i.e. <B
7733 CLASS="COMMAND"
7734 >smbd</B
7735 > will
7736                 follow symbolic links) by default.</P
7737 ><P
7738 >Default: <B
7739 CLASS="COMMAND"
7740 >follow symlinks = yes</B
7741 ></P
7742 ></DD
7743 ><DT
7744 ><A
7745 NAME="FORCECREATEMODE"
7746 ></A
7747 >force create mode (S)</DT
7748 ><DD
7749 ><P
7750 >This parameter specifies a set of UNIX mode bit
7751                 permissions that will <EM
7752 >always</EM
7753 > be set on a
7754                 file created by Samba. This is done by bitwise 'OR'ing these bits onto
7755                 the mode bits of a file that is being created or having its
7756                 permissions changed. The default for this parameter is (in octal)
7757                 000. The modes in this parameter are bitwise 'OR'ed onto the file
7758                 mode after the mask set in the <TT
7759 CLASS="PARAMETER"
7760 ><I
7761 >create mask</I
7762 ></TT
7763 >
7764                 parameter is applied.</P
7765 ><P
7766 >See also the parameter <A
7767 HREF="#CREATEMASK"
7768 ><TT
7769 CLASS="PARAMETER"
7770 ><I
7771 >create
7772                 mask</I
7773 ></TT
7774 ></A
7775 > for details on masking mode bits on files.</P
7776 ><P
7777 >See also the <A
7778 HREF="#INHERITPERMISSIONS"
7779 ><TT
7780 CLASS="PARAMETER"
7781 ><I
7782 >inherit
7783                 permissions</I
7784 ></TT
7785 ></A
7786 > parameter.</P
7787 ><P
7788 >Default: <B
7789 CLASS="COMMAND"
7790 >force create mode = 000</B
7791 ></P
7792 ><P
7793 >Example: <B
7794 CLASS="COMMAND"
7795 >force create mode = 0755</B
7796 ></P
7797 ><P
7798 >would force all created files to have read and execute
7799                 permissions set for 'group' and 'other' as well as the
7800                 read/write/execute bits set for the 'user'.</P
7801 ></DD
7802 ><DT
7803 ><A
7804 NAME="FORCEDIRECTORYMODE"
7805 ></A
7806 >force directory mode (S)</DT
7807 ><DD
7808 ><P
7809 >This parameter specifies a set of UNIX mode bit
7810                 permissions that will <EM
7811 >always</EM
7812 > be set on a directory
7813                 created by Samba. This is done by bitwise 'OR'ing these bits onto the
7814                 mode bits of a directory that is being created. The default for this
7815                 parameter is (in octal) 0000 which will not add any extra permission
7816                 bits to a created directory. This operation is done after the mode
7817                 mask in the parameter <TT
7818 CLASS="PARAMETER"
7819 ><I
7820 >directory mask</I
7821 ></TT
7822 > is
7823                 applied.</P
7824 ><P
7825 >See also the parameter <A
7826 HREF="#DIRECTORYMASK"
7827 ><TT
7828 CLASS="PARAMETER"
7829 ><I
7830 >               directory mask</I
7831 ></TT
7832 ></A
7833 > for details on masking mode bits
7834                 on created directories.</P
7835 ><P
7836 >See also the <A
7837 HREF="#INHERITPERMISSIONS"
7838 ><TT
7839 CLASS="PARAMETER"
7840 ><I
7841 >               inherit permissions</I
7842 ></TT
7843 ></A
7844 > parameter.</P
7845 ><P
7846 >Default: <B
7847 CLASS="COMMAND"
7848 >force directory mode = 000</B
7849 ></P
7850 ><P
7851 >Example: <B
7852 CLASS="COMMAND"
7853 >force directory mode = 0755</B
7854 ></P
7855 ><P
7856 >would force all created directories to have read and execute
7857                 permissions set for 'group' and 'other' as well as the
7858                 read/write/execute bits set for the 'user'.</P
7859 ></DD
7860 ><DT
7861 ><A
7862 NAME="FORCEDIRECTORYSECURITYMODE"
7863 ></A
7864 >force directory
7865                 security mode (S)</DT
7866 ><DD
7867 ><P
7868 >This parameter controls what UNIX permission bits
7869                 can be modified when a Windows NT client is manipulating the UNIX
7870                 permission on a directory using the native NT security dialog box.</P
7871 ><P
7872 >This parameter is applied as a mask (OR'ed with) to the
7873                 changed permission bits, thus forcing any bits in this mask that
7874                 the user may have modified to be on. Essentially, one bits in this
7875                 mask may be treated as a set of bits that, when modifying security
7876                 on a directory, the user has always set to be 'on'.</P
7877 ><P
7878 >If not set explicitly this parameter is 000, which
7879                 allows a user to modify all the user/group/world permissions on a
7880                 directory without restrictions.</P
7881 ><P
7882 ><EM
7883 >Note</EM
7884 > that users who can access the
7885                 Samba server through other means can easily bypass this restriction,
7886                 so it is primarily useful for standalone "appliance" systems.
7887                 Administrators of most normal systems will probably want to leave
7888                 it set as 0000.</P
7889 ><P
7890 >See also the <A
7891 HREF="#DIRECTORYSECURITYMASK"
7892 ><TT
7893 CLASS="PARAMETER"
7894 ><I
7895 >               directory security mask</I
7896 ></TT
7897 ></A
7898 >, <A
7899 HREF="#SECURITYMASK"
7900 >               <TT
7901 CLASS="PARAMETER"
7902 ><I
7903 >security mask</I
7904 ></TT
7905 ></A
7906 >,
7907                 <A
7908 HREF="#FORCESECURITYMODE"
7909 ><TT
7910 CLASS="PARAMETER"
7911 ><I
7912 >force security mode
7913                 </I
7914 ></TT
7915 ></A
7916 > parameters.</P
7917 ><P
7918 >Default: <B
7919 CLASS="COMMAND"
7920 >force directory security mode = 0</B
7921 ></P
7922 ><P
7923 >Example: <B
7924 CLASS="COMMAND"
7925 >force directory security mode = 700</B
7926 ></P
7927 ></DD
7928 ><DT
7929 ><A
7930 NAME="FORCEGROUP"
7931 ></A
7932 >force group (S)</DT
7933 ><DD
7934 ><P
7935 >This specifies a UNIX group name that will be
7936                 assigned as the default primary group for all users connecting
7937                 to this service. This is useful for sharing files by ensuring
7938                 that all access to files on service will use the named group for
7939                 their permissions checking. Thus, by assigning permissions for this
7940                 group to the files and directories within this service the Samba
7941                 administrator can restrict or allow sharing of these files.</P
7942 ><P
7943 >In Samba 2.0.5 and above this parameter has extended
7944                 functionality in the following way. If the group name listed here
7945                 has a '+' character prepended to it then the current user accessing
7946                 the share only has the primary group default assigned to this group
7947                 if they are already assigned as a member of that group. This allows
7948                 an administrator to decide that only users who are already in a
7949                 particular group will create files with group ownership set to that
7950                 group. This gives a finer granularity of ownership assignment. For
7951                 example, the setting <TT
7952 CLASS="FILENAME"
7953 >force group = +sys</TT
7954 > means
7955                 that only users who are already in group sys will have their default
7956                 primary group assigned to sys when accessing this Samba share. All
7957                 other users will retain their ordinary primary group.</P
7958 ><P
7959 >If the <A
7960 HREF="#FORCEUSER"
7961 ><TT
7962 CLASS="PARAMETER"
7963 ><I
7964 >force user
7965                 </I
7966 ></TT
7967 ></A
7968 > parameter is also set the group specified in
7969                 <TT
7970 CLASS="PARAMETER"
7971 ><I
7972 >force group</I
7973 ></TT
7974 > will override the primary group
7975                 set in <TT
7976 CLASS="PARAMETER"
7977 ><I
7978 >force user</I
7979 ></TT
7980 >.</P
7981 ><P
7982 >See also <A
7983 HREF="#FORCEUSER"
7984 ><TT
7985 CLASS="PARAMETER"
7986 ><I
7987 >force
7988                 user</I
7989 ></TT
7990 ></A
7991 >.</P
7992 ><P
7993 >Default: <EM
7994 >no forced group</EM
7995 ></P
7996 ><P
7997 >Example: <B
7998 CLASS="COMMAND"
7999 >force group = agroup</B
8000 ></P
8001 ></DD
8002 ><DT
8003 ><A
8004 NAME="FORCESECURITYMODE"
8005 ></A
8006 >force security mode (S)</DT
8007 ><DD
8008 ><P
8009 >This parameter controls what UNIX permission
8010                 bits can be modified when a Windows NT client is manipulating
8011                 the UNIX permission on a file using the native NT security dialog
8012                 box.</P
8013 ><P
8014 >This parameter is applied as a mask (OR'ed with) to the
8015                 changed permission bits, thus forcing any bits in this mask that
8016                 the user may have modified to be on. Essentially, one bits in this
8017                 mask may be treated as a set of bits that, when modifying security
8018                 on a file, the user has always set to be 'on'.</P
8019 ><P
8020 >If not set explicitly this parameter is set to 0,
8021                 and allows a user to modify all the user/group/world permissions on a file,
8022                 with no restrictions.</P
8023 ><P
8024 ><EM
8025 >Note</EM
8026 > that users who can access
8027                 the Samba server through other means can easily bypass this restriction,
8028                 so it is primarily useful for standalone "appliance" systems.
8029                 Administrators of most normal systems will probably want to leave
8030                 this set to 0000.</P
8031 ><P
8032 >See also the <A
8033 HREF="#FORCEDIRECTORYSECURITYMODE"
8034 ><TT
8035 CLASS="PARAMETER"
8036 ><I
8037 >               force directory security mode</I
8038 ></TT
8039 ></A
8040 >,
8041                 <A
8042 HREF="#DIRECTORYSECURITYMASK"
8043 ><TT
8044 CLASS="PARAMETER"
8045 ><I
8046 >directory security
8047                 mask</I
8048 ></TT
8049 ></A
8050 >, <A
8051 HREF="#SECURITYMASK"
8052 ><TT
8053 CLASS="PARAMETER"
8054 ><I
8055 >               security mask</I
8056 ></TT
8057 ></A
8058 > parameters.</P
8059 ><P
8060 >Default: <B
8061 CLASS="COMMAND"
8062 >force security mode = 0</B
8063 ></P
8064 ><P
8065 >Example: <B
8066 CLASS="COMMAND"
8067 >force security mode = 700</B
8068 ></P
8069 ></DD
8070 ><DT
8071 ><A
8072 NAME="FORCEUSER"
8073 ></A
8074 >force user (S)</DT
8075 ><DD
8076 ><P
8077 >This specifies a UNIX user name that will be
8078                 assigned as the default user for all users connecting to this service.
8079                 This is useful for sharing files. You should also use it carefully
8080                 as using it incorrectly can cause security problems.</P
8081 ><P
8082 >This user name only gets used once a connection is established.
8083                 Thus clients still need to connect as a valid user and supply a
8084                 valid password. Once connected, all file operations will be performed
8085                 as the "forced user", no matter what username the client connected
8086                 as.  This can be very useful.</P
8087 ><P
8088 >In Samba 2.0.5 and above this parameter also causes the
8089                 primary group of the forced user to be used as the primary group
8090                 for all file activity. Prior to 2.0.5 the primary group was left
8091                 as the primary group of the connecting user (this was a bug).</P
8092 ><P
8093 >See also <A
8094 HREF="#FORCEGROUP"
8095 ><TT
8096 CLASS="PARAMETER"
8097 ><I
8098 >force group
8099                 </I
8100 ></TT
8101 ></A
8102 ></P
8103 ><P
8104 >Default: <EM
8105 >no forced user</EM
8106 ></P
8107 ><P
8108 >Example: <B
8109 CLASS="COMMAND"
8110 >force user = auser</B
8111 ></P
8112 ></DD
8113 ><DT
8114 ><A
8115 NAME="FSTYPE"
8116 ></A
8117 >fstype (S)</DT
8118 ><DD
8119 ><P
8120 >This parameter allows the administrator to
8121                 configure the string that specifies the type of filesystem a share
8122                 is using that is reported by <A
8123 HREF="smbd.8.html"
8124 TARGET="_top"
8125 ><B
8126 CLASS="COMMAND"
8127 >smbd(8)
8128                 </B
8129 ></A
8130 > when a client queries the filesystem type
8131                 for a share. The default type is <TT
8132 CLASS="CONSTANT"
8133 >NTFS</TT
8134 > for
8135                 compatibility with Windows NT but this can be changed to other
8136                 strings such as <TT
8137 CLASS="CONSTANT"
8138 >Samba</TT
8139 > or <TT
8140 CLASS="CONSTANT"
8141 >FAT
8142                 </TT
8143 > if required.</P
8144 ><P
8145 >Default: <B
8146 CLASS="COMMAND"
8147 >fstype = NTFS</B
8148 ></P
8149 ><P
8150 >Example: <B
8151 CLASS="COMMAND"
8152 >fstype = Samba</B
8153 ></P
8154 ></DD
8155 ><DT
8156 ><A
8157 NAME="GETWDCACHE"
8158 ></A
8159 >getwd cache (G)</DT
8160 ><DD
8161 ><P
8162 >This is a tuning option. When this is enabled a
8163                 caching algorithm will be used to reduce the time taken for getwd()
8164                 calls. This can have a significant impact on performance, especially
8165                 when the <A
8166 HREF="#WIDELINKS"
8167 ><TT
8168 CLASS="PARAMETER"
8169 ><I
8170 >wide links</I
8171 ></TT
8172 >
8173                 </A
8174 >parameter is set to <TT
8175 CLASS="CONSTANT"
8176 >false</TT
8177 >.</P
8178 ><P
8179 >Default: <B
8180 CLASS="COMMAND"
8181 >getwd cache = yes</B
8182 ></P
8183 ></DD
8184 ><DT
8185 ><A
8186 NAME="GROUP"
8187 ></A
8188 >group (S)</DT
8189 ><DD
8190 ><P
8191 >Synonym for <A
8192 HREF="#FORCEGROUP"
8193 ><TT
8194 CLASS="PARAMETER"
8195 ><I
8196 >force
8197                 group</I
8198 ></TT
8199 ></A
8200 >.</P
8201 ></DD
8202 ><DT
8203 ><A
8204 NAME="GUESTACCOUNT"
8205 ></A
8206 >guest account (S)</DT
8207 ><DD
8208 ><P
8209 >This is a username which will be used for access
8210                 to services which are specified as <A
8211 HREF="#GUESTOK"
8212 ><TT
8213 CLASS="PARAMETER"
8214 ><I
8215 >               guest ok</I
8216 ></TT
8217 ></A
8218 > (see below). Whatever privileges this
8219                 user has will be available to any client connecting to the guest service.
8220                 Typically this user will exist in the password file, but will not
8221                 have a valid login. The user account "ftp" is often a good choice
8222                 for this parameter. If a username is specified in a given service,
8223                 the specified username overrides this one.</P
8224 ><P
8225 >One some systems the default guest account "nobody" may not
8226                 be able to print. Use another account in this case. You should test
8227                 this by trying to log in as your guest user (perhaps by using the
8228                 <B
8229 CLASS="COMMAND"
8230 >su -</B
8231 > command) and trying to print using the
8232                 system print command such as <B
8233 CLASS="COMMAND"
8234 >lpr(1)</B
8235 > or <B
8236 CLASS="COMMAND"
8237 >               lp(1)</B
8238 >.</P
8239 ><P
8240 >Default: <EM
8241 >specified at compile time, usually
8242                 "nobody"</EM
8243 ></P
8244 ><P
8245 >Example: <B
8246 CLASS="COMMAND"
8247 >guest account = ftp</B
8248 ></P
8249 ></DD
8250 ><DT
8251 ><A
8252 NAME="GUESTOK"
8253 ></A
8254 >guest ok (S)</DT
8255 ><DD
8256 ><P
8257 >If this parameter is <TT
8258 CLASS="CONSTANT"
8259 >yes</TT
8260 > for
8261                 a service, then no password is required to connect to the service.
8262                 Privileges will be those of the <A
8263 HREF="#GUESTACCOUNT"
8264 ><TT
8265 CLASS="PARAMETER"
8266 ><I
8267 >               guest account</I
8268 ></TT
8269 ></A
8270 >.</P
8271 ><P
8272 >See the section below on <A
8273 HREF="#SECURITY"
8274 ><TT
8275 CLASS="PARAMETER"
8276 ><I
8277 >               security</I
8278 ></TT
8279 ></A
8280 > for more information about this option.
8281                 </P
8282 ><P
8283 >Default: <B
8284 CLASS="COMMAND"
8285 >guest ok = no</B
8286 ></P
8287 ></DD
8288 ><DT
8289 ><A
8290 NAME="GUESTONLY"
8291 ></A
8292 >guest only (S)</DT
8293 ><DD
8294 ><P
8295 >If this parameter is <TT
8296 CLASS="CONSTANT"
8297 >yes</TT
8298 > for
8299                 a service, then only guest connections to the service are permitted.
8300                 This parameter will have no effect if <A
8301 HREF="#GUESTOK"
8302 >               <TT
8303 CLASS="PARAMETER"
8304 ><I
8305 >guest ok</I
8306 ></TT
8307 ></A
8308 > is not set for the service.</P
8309 ><P
8310 >See the section below on <A
8311 HREF="#SECURITY"
8312 ><TT
8313 CLASS="PARAMETER"
8314 ><I
8315 >               security</I
8316 ></TT
8317 ></A
8318 > for more information about this option.
8319                 </P
8320 ><P
8321 >Default: <B
8322 CLASS="COMMAND"
8323 >guest only = no</B
8324 ></P
8325 ></DD
8326 ><DT
8327 ><A
8328 NAME="HIDEDOTFILES"
8329 ></A
8330 >hide dot files (S)</DT
8331 ><DD
8332 ><P
8333 >This is a boolean parameter that controls whether
8334                 files starting with a dot appear as hidden files.</P
8335 ><P
8336 >Default: <B
8337 CLASS="COMMAND"
8338 >hide dot files = yes</B
8339 ></P
8340 ></DD
8341 ><DT
8342 ><A
8343 NAME="HIDEFILES"
8344 ></A
8345 >hide files(S)</DT
8346 ><DD
8347 ><P
8348 >This is a list of files or directories that are not
8349                 visible but are accessible.  The DOS 'hidden' attribute is applied
8350                 to any files or directories that match.</P
8351 ><P
8352 >Each entry in the list must be separated by a '/',
8353                 which allows spaces to be included in the entry.  '*'
8354                 and '?' can be used to specify multiple files or directories
8355                 as in DOS wildcards.</P
8356 ><P
8357 >Each entry must be a Unix path, not a DOS path and must
8358                 not include the Unix directory separator '/'.</P
8359 ><P
8360 >Note that the case sensitivity option is applicable
8361                 in hiding files.</P
8362 ><P
8363 >Setting this parameter will affect the performance of Samba,
8364                 as it will be forced to check all files and directories for a match
8365                 as they are scanned.</P
8366 ><P
8367 >See also <A
8368 HREF="#HIDEDOTFILES"
8369 ><TT
8370 CLASS="PARAMETER"
8371 ><I
8372 >hide
8373                 dot files</I
8374 ></TT
8375 ></A
8376 >, <A
8377 HREF="#VETOFILES"
8378 ><TT
8379 CLASS="PARAMETER"
8380 ><I
8381 >               veto files</I
8382 ></TT
8383 ></A
8384 > and <A
8385 HREF="#CASESENSITIVE"
8386 >               <TT
8387 CLASS="PARAMETER"
8388 ><I
8389 >case sensitive</I
8390 ></TT
8391 ></A
8392 >.</P
8393 ><P
8394 >Default: <EM
8395 >no file are hidden</EM
8396 ></P
8397 ><P
8398 >Example: <B
8399 CLASS="COMMAND"
8400 >hide files =
8401                 /.*/DesktopFolderDB/TrashFor%m/resource.frk/</B
8402 ></P
8403 ><P
8404 >The above example is based on files that the Macintosh
8405                 SMB client (DAVE) available from <A
8406 HREF="http://www.thursby.com"
8407 TARGET="_top"
8408 >
8409                 Thursby</A
8410 > creates for internal use, and also still hides
8411                 all files beginning with a dot.</P
8412 ></DD
8413 ><DT
8414 ><A
8415 NAME="HIDELOCALUSERS"
8416 ></A
8417 >hide local users(G)</DT
8418 ><DD
8419 ><P
8420 >This parameter toggles the hiding of local UNIX
8421                 users (root, wheel, floppy, etc) from remote clients.</P
8422 ><P
8423 >Default: <B
8424 CLASS="COMMAND"
8425 >hide local users = no</B
8426 ></P
8427 ></DD
8428 ><DT
8429 ><A
8430 NAME="HIDEUNREADABLE"
8431 ></A
8432 >hide unreadable (S)</DT
8433 ><DD
8434 ><P
8435 >This parameter prevents clients from seeing the
8436                 existance of files that cannot be read. Defaults to off.</P
8437 ><P
8438 >Default: <B
8439 CLASS="COMMAND"
8440 >hide unreadable = no</B
8441 ></P
8442 ></DD
8443 ><DT
8444 ><A
8445 NAME="HOMEDIRMAP"
8446 ></A
8447 >homedir map (G)</DT
8448 ><DD
8449 ><P
8450 >If<A
8451 HREF="#NISHOMEDIR"
8452 ><TT
8453 CLASS="PARAMETER"
8454 ><I
8455 >nis homedir
8456                 </I
8457 ></TT
8458 ></A
8459 > is <TT
8460 CLASS="CONSTANT"
8461 >true</TT
8462 >, and <A
8463 HREF="smbd.8.html"
8464 TARGET="_top"
8465 ><B
8466 CLASS="COMMAND"
8467 >smbd(8)</B
8468 ></A
8469 > is also acting
8470                 as a Win95/98 <TT
8471 CLASS="PARAMETER"
8472 ><I
8473 >logon server</I
8474 ></TT
8475 > then this parameter
8476                 specifies the NIS (or YP) map from which the server for the user's
8477                 home directory should be extracted.  At present, only the Sun
8478                 auto.home map format is understood. The form of the map is:</P
8479 ><P
8480 ><B
8481 CLASS="COMMAND"
8482 >username       server:/some/file/system</B
8483 ></P
8484 ><P
8485 >and the program will extract the servername from before
8486                 the first ':'.  There should probably be a better parsing system
8487                 that copes with different map formats and also Amd (another
8488                 automounter) maps.</P
8489 ><P
8490 ><EM
8491 >NOTE :</EM
8492 >A working NIS client is required on
8493                 the system for this option to work.</P
8494 ><P
8495 >See also <A
8496 HREF="#NISHOMEDIR"
8497 ><TT
8498 CLASS="PARAMETER"
8499 ><I
8500 >nis homedir</I
8501 ></TT
8502 >
8503                 </A
8504 >, <A
8505 HREF="#DOMAINLOGONS"
8506 ><TT
8507 CLASS="PARAMETER"
8508 ><I
8509 >domain logons</I
8510 ></TT
8511 >
8512                 </A
8513 >.</P
8514 ><P
8515 >Default: <B
8516 CLASS="COMMAND"
8517 >homedir map = &#60;empty string&#62;</B
8518 ></P
8519 ><P
8520 >Example: <B
8521 CLASS="COMMAND"
8522 >homedir map = amd.homedir</B
8523 ></P
8524 ></DD
8525 ><DT
8526 ><A
8527 NAME="HOSTMSDFS"
8528 ></A
8529 >host msdfs (G)</DT
8530 ><DD
8531 ><P
8532 >This boolean parameter is only available
8533                 if Samba has been configured and compiled with the <B
8534 CLASS="COMMAND"
8535 >               --with-msdfs</B
8536 > option. If set to <TT
8537 CLASS="CONSTANT"
8538 >yes</TT
8539 >,
8540                 Samba will act as a Dfs server, and  allow Dfs-aware clients
8541                 to browse Dfs trees hosted on the server.</P
8542 ><P
8543 >See also the <A
8544 HREF="#MSDFSROOT"
8545 ><TT
8546 CLASS="PARAMETER"
8547 ><I
8548 >               msdfs root</I
8549 ></TT
8550 ></A
8551 > share  level  parameter.  For
8552                 more  information  on  setting  up a Dfs tree on Samba,
8553                 refer to <A
8554 HREF="msdfs_setup.html"
8555 TARGET="_top"
8556 >msdfs_setup.html</A
8557 >.
8558                 </P
8559 ><P
8560 >Default: <B
8561 CLASS="COMMAND"
8562 >host msdfs = no</B
8563 ></P
8564 ></DD
8565 ><DT
8566 ><A
8567 NAME="HOSTSALLOW"
8568 ></A
8569 >hosts allow (S)</DT
8570 ><DD
8571 ><P
8572 >A synonym for this parameter is <TT
8573 CLASS="PARAMETER"
8574 ><I
8575 >allow
8576                 hosts</I
8577 ></TT
8578 >.</P
8579 ><P
8580 >This parameter is a comma, space, or tab delimited
8581                 set of hosts which are permitted to access a service.</P
8582 ><P
8583 >If specified in the [global] section then it will
8584                 apply to all services, regardless of whether the individual
8585                 service has a different setting.</P
8586 ><P
8587 >You can specify the hosts by name or IP number. For
8588                 example, you could restrict access to only the hosts on a
8589                 Class C subnet with something like <B
8590 CLASS="COMMAND"
8591 >allow hosts = 150.203.5.
8592                 </B
8593 >. The full syntax of the list is described in the man
8594                 page <TT
8595 CLASS="FILENAME"
8596 >hosts_access(5)</TT
8597 >. Note that this man
8598                 page may not be present on your system, so a brief description will
8599                 be given here also.</P
8600 ><P
8601 >Note that the localhost address 127.0.0.1 will always
8602                 be allowed access unless specifically denied by a <A
8603 HREF="#HOSTSDENY"
8604 ><TT
8605 CLASS="PARAMETER"
8606 ><I
8607 >hosts deny</I
8608 ></TT
8609 ></A
8610 > option.</P
8611 ><P
8612 >You can also specify hosts by network/netmask pairs and
8613                 by netgroup names if your system supports netgroups. The
8614                 <EM
8615 >EXCEPT</EM
8616 > keyword can also be used to limit a
8617                 wildcard list. The following examples may provide some help:</P
8618 ><P
8619 >Example 1: allow all IPs in 150.203.*.*; except one</P
8620 ><P
8621 ><B
8622 CLASS="COMMAND"
8623 >hosts allow = 150.203. EXCEPT 150.203.6.66</B
8624 ></P
8625 ><P
8626 >Example 2: allow hosts that match the given network/netmask</P
8627 ><P
8628 ><B
8629 CLASS="COMMAND"
8630 >hosts allow = 150.203.15.0/255.255.255.0</B
8631 ></P
8632 ><P
8633 >Example 3: allow a couple of hosts</P
8634 ><P
8635 ><B
8636 CLASS="COMMAND"
8637 >hosts allow = lapland, arvidsjaur</B
8638 ></P
8639 ><P
8640 >Example 4: allow only hosts in NIS netgroup "foonet", but
8641                 deny access from one particular host</P
8642 ><P
8643 ><B
8644 CLASS="COMMAND"
8645 >hosts allow = @foonet</B
8646 ></P
8647 ><P
8648 ><B
8649 CLASS="COMMAND"
8650 >hosts deny = pirate</B
8651 ></P
8652 ><P
8653 >Note that access still requires suitable user-level passwords.</P
8654 ><P
8655 >See <A
8656 HREF="testparm.1.html"
8657 TARGET="_top"
8658 ><B
8659 CLASS="COMMAND"
8660 >testparm(1)</B
8661 >
8662                 </A
8663 > for a way of testing your host access to see if it does
8664                 what you expect.</P
8665 ><P
8666 >Default: <EM
8667 >none (i.e., all hosts permitted access)
8668                 </EM
8669 ></P
8670 ><P
8671 >Example: <B
8672 CLASS="COMMAND"
8673 >allow hosts = 150.203.5. myhost.mynet.edu.au
8674                 </B
8675 ></P
8676 ></DD
8677 ><DT
8678 ><A
8679 NAME="HOSTSDENY"
8680 ></A
8681 >hosts deny (S)</DT
8682 ><DD
8683 ><P
8684 >The opposite of <TT
8685 CLASS="PARAMETER"
8686 ><I
8687 >hosts allow</I
8688 ></TT
8689 >
8690                 - hosts listed here are <EM
8691 >NOT</EM
8692 > permitted access to
8693                 services unless the specific services have their own lists to override
8694                 this one. Where the lists conflict, the <TT
8695 CLASS="PARAMETER"
8696 ><I
8697 >allow</I
8698 ></TT
8699 >
8700                 list takes precedence.</P
8701 ><P
8702 >Default: <EM
8703 >none (i.e., no hosts specifically excluded)
8704                 </EM
8705 ></P
8706 ><P
8707 >Example: <B
8708 CLASS="COMMAND"
8709 >hosts deny = 150.203.4. badhost.mynet.edu.au
8710                 </B
8711 ></P
8712 ></DD
8713 ><DT
8714 ><A
8715 NAME="HOSTSEQUIV"
8716 ></A
8717 >hosts equiv (G)</DT
8718 ><DD
8719 ><P
8720 >If this global parameter is a non-null string,
8721                 it specifies the name of a file to read for the names of hosts
8722                 and users who will be allowed access without specifying a password.
8723                 </P
8724 ><P
8725 >This is not be confused with <A
8726 HREF="#HOSTSALLOW"
8727 >               <TT
8728 CLASS="PARAMETER"
8729 ><I
8730 >hosts allow</I
8731 ></TT
8732 ></A
8733 > which is about hosts
8734                 access to services and is more useful for guest services. <TT
8735 CLASS="PARAMETER"
8736 ><I
8737 >               hosts equiv</I
8738 ></TT
8739 > may be useful for NT clients which will
8740                 not supply passwords to Samba.</P
8741 ><P
8742 ><EM
8743 >NOTE :</EM
8744 > The use of <TT
8745 CLASS="PARAMETER"
8746 ><I
8747 >hosts equiv
8748                 </I
8749 ></TT
8750 > can be a major security hole. This is because you are
8751                 trusting the PC to supply the correct username. It is very easy to
8752                 get a PC to supply a false username. I recommend that the
8753                 <TT
8754 CLASS="PARAMETER"
8755 ><I
8756 >hosts equiv</I
8757 ></TT
8758 > option be only used if you really
8759                 know what you are doing, or perhaps on a home network where you trust
8760                 your spouse and kids. And only if you <EM
8761 >really</EM
8762 > trust
8763                 them :-).</P
8764 ><P
8765 >Default: <EM
8766 >no host equivalences</EM
8767 ></P
8768 ><P
8769 >Example: <B
8770 CLASS="COMMAND"
8771 >hosts equiv = /etc/hosts.equiv</B
8772 ></P
8773 ></DD
8774 ><DT
8775 ><A
8776 NAME="INCLUDE"
8777 ></A
8778 >include (G)</DT
8779 ><DD
8780 ><P
8781 >This allows you to include one config file
8782                 inside another.  The file is included literally, as though typed
8783                 in place.</P
8784 ><P
8785 >It takes the standard substitutions, except <TT
8786 CLASS="PARAMETER"
8787 ><I
8788 >%u
8789                 </I
8790 ></TT
8791 >, <TT
8792 CLASS="PARAMETER"
8793 ><I
8794 >%P</I
8795 ></TT
8796 > and <TT
8797 CLASS="PARAMETER"
8798 ><I
8799 >%S</I
8800 ></TT
8801 >.
8802                 </P
8803 ><P
8804 >Default: <EM
8805 >no file included</EM
8806 ></P
8807 ><P
8808 >Example: <B
8809 CLASS="COMMAND"
8810 >include = /usr/local/samba/lib/admin_smb.conf
8811                 </B
8812 ></P
8813 ></DD
8814 ><DT
8815 ><A
8816 NAME="INHERITPERMISSIONS"
8817 ></A
8818 >inherit permissions (S)</DT
8819 ><DD
8820 ><P
8821 >The permissions on new files and directories
8822                 are normally governed by <A
8823 HREF="#CREATEMASK"
8824 ><TT
8825 CLASS="PARAMETER"
8826 ><I
8827 >               create mask</I
8828 ></TT
8829 ></A
8830 >, <A
8831 HREF="#DIRECTORYMASK"
8832 >               <TT
8833 CLASS="PARAMETER"
8834 ><I
8835 >directory mask</I
8836 ></TT
8837 ></A
8838 >, <A
8839 HREF="#FORCECREATEMODE"
8840 ><TT
8841 CLASS="PARAMETER"
8842 ><I
8843 >force create mode</I
8844 ></TT
8845 >
8846                 </A
8847 > and <A
8848 HREF="#FORCEDIRECTORYMODE"
8849 ><TT
8850 CLASS="PARAMETER"
8851 ><I
8852 >force
8853                 directory mode</I
8854 ></TT
8855 ></A
8856 > but the boolean inherit
8857                 permissions parameter overrides this.</P
8858 ><P
8859 >New directories inherit the mode of the parent directory,
8860                 including bits such as setgid.</P
8861 ><P
8862 >New files inherit their read/write bits from the parent
8863                 directory.  Their execute bits continue to be determined by
8864                 <A
8865 HREF="#MAPARCHIVE"
8866 ><TT
8867 CLASS="PARAMETER"
8868 ><I
8869 >map archive</I
8870 ></TT
8871 >
8872                 </A
8873 >, <A
8874 HREF="#MAPHIDDEN"
8875 ><TT
8876 CLASS="PARAMETER"
8877 ><I
8878 >map hidden</I
8879 ></TT
8880 >
8881                 </A
8882 > and <A
8883 HREF="#MAPSYSTEM"
8884 ><TT
8885 CLASS="PARAMETER"
8886 ><I
8887 >map system</I
8888 ></TT
8889 >
8890                 </A
8891 > as usual.</P
8892 ><P
8893 >Note that the setuid bit is <EM
8894 >never</EM
8895 > set via
8896                 inheritance (the code explicitly prohibits this).</P
8897 ><P
8898 >This can be particularly useful on large systems with
8899                 many users, perhaps several thousand, to allow a single [homes]
8900                 share to be used flexibly by each user.</P
8901 ><P
8902 >See also <A
8903 HREF="#CREATEMASK"
8904 ><TT
8905 CLASS="PARAMETER"
8906 ><I
8907 >create mask
8908                 </I
8909 ></TT
8910 ></A
8911 >, <A
8912 HREF="#DIRECTORYMASK"
8913 ><TT
8914 CLASS="PARAMETER"
8915 ><I
8916 >               directory mask</I
8917 ></TT
8918 ></A
8919 >, <A
8920 HREF="#FORCECREATEMODE"
8921 >               <TT
8922 CLASS="PARAMETER"
8923 ><I
8924 >force create mode</I
8925 ></TT
8926 ></A
8927 > and <A
8928 HREF="#FORCEDIRECTORYMODE"
8929 ><TT
8930 CLASS="PARAMETER"
8931 ><I
8932 >force directory mode</I
8933 ></TT
8934 >
8935                 </A
8936 >.</P
8937 ><P
8938 >Default: <B
8939 CLASS="COMMAND"
8940 >inherit permissions = no</B
8941 ></P
8942 ></DD
8943 ><DT
8944 ><A
8945 NAME="INTERFACES"
8946 ></A
8947 >interfaces (G)</DT
8948 ><DD
8949 ><P
8950 >This option allows you to override the default
8951                 network interfaces list that Samba will use for browsing, name
8952                 registration and other NBT traffic. By default Samba will query
8953                 the kernel for the list of all active interfaces and use any
8954                 interfaces except 127.0.0.1 that are broadcast capable.</P
8955 ><P
8956 >The option takes a list of interface strings. Each string
8957                 can be in any of the following forms:</P
8958 ><P
8959 ></P
8960 ><UL
8961 ><LI
8962 ><P
8963 >a network interface name (such as eth0).
8964                         This may include shell-like wildcards so eth* will match
8965                         any interface starting with the substring "eth"</P
8966 ></LI
8967 ><LI
8968 ><P
8969 >an IP address. In this case the netmask is
8970                         determined from the list of interfaces obtained from the
8971                         kernel</P
8972 ></LI
8973 ><LI
8974 ><P
8975 >an IP/mask pair. </P
8976 ></LI
8977 ><LI
8978 ><P
8979 >a broadcast/mask pair.</P
8980 ></LI
8981 ></UL
8982 ><P
8983 >The "mask" parameters can either be a bit length (such
8984                 as 24 for a C class network) or a full netmask in dotted
8985                 decimal form.</P
8986 ><P
8987 >The "IP" parameters above can either be a full dotted
8988                 decimal IP address or a hostname which will be looked up via
8989                 the OS's normal hostname resolution mechanisms.</P
8990 ><P
8991 >For example, the following line:</P
8992 ><P
8993 ><B
8994 CLASS="COMMAND"
8995 >interfaces = eth0 192.168.2.10/24 192.168.3.10/255.255.255.0
8996                 </B
8997 ></P
8998 ><P
8999 >would configure three network interfaces corresponding
9000                 to the eth0 device and IP addresses 192.168.2.10 and 192.168.3.10.
9001                 The netmasks of the latter two interfaces would be set to 255.255.255.0.</P
9002 ><P
9003 >See also <A
9004 HREF="#BINDINTERFACESONLY"
9005 ><TT
9006 CLASS="PARAMETER"
9007 ><I
9008 >bind
9009                 interfaces only</I
9010 ></TT
9011 ></A
9012 >.</P
9013 ><P
9014 >Default: <EM
9015 >all active interfaces except 127.0.0.1
9016                 that are broadcast capable</EM
9017 ></P
9018 ></DD
9019 ><DT
9020 ><A
9021 NAME="INVALIDUSERS"
9022 ></A
9023 >invalid users (S)</DT
9024 ><DD
9025 ><P
9026 >This is a list of users that should not be allowed
9027                 to login to this service. This is really a <EM
9028 >paranoid</EM
9029 >
9030                 check to absolutely ensure an improper setting does not breach
9031                 your security.</P
9032 ><P
9033 >A name starting with a '@' is interpreted as an NIS
9034                 netgroup first (if your system supports NIS), and then as a UNIX
9035                 group if the name was not found in the NIS netgroup database.</P
9036 ><P
9037 >A name starting with '+' is interpreted only
9038                 by looking in the UNIX group database. A name starting with
9039                 '&#38;' is interpreted only by looking in the NIS netgroup database
9040                 (this requires NIS to be working on your system). The characters
9041                 '+' and '&#38;' may be used at the start of the name in either order
9042                 so the value <TT
9043 CLASS="PARAMETER"
9044 ><I
9045 >+&#38;group</I
9046 ></TT
9047 > means check the
9048                 UNIX group database, followed by the NIS netgroup database, and
9049                 the value <TT
9050 CLASS="PARAMETER"
9051 ><I
9052 >&#38;+group</I
9053 ></TT
9054 > means check the NIS
9055                 netgroup database, followed by the UNIX group database (the
9056                 same as the '@' prefix).</P
9057 ><P
9058 >The current servicename is substituted for <TT
9059 CLASS="PARAMETER"
9060 ><I
9061 >%S</I
9062 ></TT
9063 >.
9064                 This is useful in the [homes] section.</P
9065 ><P
9066 >See also <A
9067 HREF="#VALIDUSERS"
9068 ><TT
9069 CLASS="PARAMETER"
9070 ><I
9071 >valid users
9072                 </I
9073 ></TT
9074 ></A
9075 >.</P
9076 ><P
9077 >Default: <EM
9078 >no invalid users</EM
9079 ></P
9080 ><P
9081 >Example: <B
9082 CLASS="COMMAND"
9083 >invalid users = root fred admin @wheel
9084                 </B
9085 ></P
9086 ></DD
9087 ><DT
9088 ><A
9089 NAME="KEEPALIVE"
9090 ></A
9091 >keepalive (G)</DT
9092 ><DD
9093 ><P
9094 >The value of the parameter (an integer) represents
9095                 the number of seconds between <TT
9096 CLASS="PARAMETER"
9097 ><I
9098 >keepalive</I
9099 ></TT
9100 >
9101                 packets. If this parameter is zero, no keepalive packets will be
9102                 sent. Keepalive packets, if sent, allow the server to tell whether
9103                 a client is still present and responding.</P
9104 ><P
9105 >Keepalives should, in general, not be needed if the socket
9106                 being used has the SO_KEEPALIVE attribute set on it (see <A
9107 HREF="#SOCKETOPTIONS"
9108 ><TT
9109 CLASS="PARAMETER"
9110 ><I
9111 >socket options</I
9112 ></TT
9113 ></A
9114 >).
9115                 Basically you should only use this option if you strike difficulties.</P
9116 ><P
9117 >Default: <B
9118 CLASS="COMMAND"
9119 >keepalive = 300</B
9120 ></P
9121 ><P
9122 >Example: <B
9123 CLASS="COMMAND"
9124 >keepalive = 600</B
9125 ></P
9126 ></DD
9127 ><DT
9128 ><A
9129 NAME="KERNELOPLOCKS"
9130 ></A
9131 >kernel oplocks (G)</DT
9132 ><DD
9133 ><P
9134 >For UNIXes that support kernel based <A
9135 HREF="#OPLOCKS"
9136 ><TT
9137 CLASS="PARAMETER"
9138 ><I
9139 >oplocks</I
9140 ></TT
9141 ></A
9142 >
9143                 (currently only IRIX and the Linux 2.4 kernel), this parameter
9144                 allows the use of them to be turned on or off.</P
9145 ><P
9146 >Kernel oplocks support allows Samba <TT
9147 CLASS="PARAMETER"
9148 ><I
9149 >oplocks
9150                 </I
9151 ></TT
9152 > to be broken whenever a local UNIX process or NFS operation
9153                 accesses a file that <A
9154 HREF="smbd.8.html"
9155 TARGET="_top"
9156 ><B
9157 CLASS="COMMAND"
9158 >smbd(8)</B
9159 >
9160                 </A
9161 > has oplocked. This allows complete data consistency between
9162                 SMB/CIFS, NFS and local file access (and is a <EM
9163 >very</EM
9164 >
9165                 cool feature :-).</P
9166 ><P
9167 >This parameter defaults to <TT
9168 CLASS="CONSTANT"
9169 >on</TT
9170 >, but is translated
9171                 to a no-op on systems that no not have the necessary kernel support.
9172                 You should never need to touch this parameter.</P
9173 ><P
9174 >See also the <A
9175 HREF="#OPLOCKS"
9176 ><TT
9177 CLASS="PARAMETER"
9178 ><I
9179 >oplocks</I
9180 ></TT
9181 >
9182                 </A
9183 > and <A
9184 HREF="#LEVEL2OPLOCKS"
9185 ><TT
9186 CLASS="PARAMETER"
9187 ><I
9188 >level2 oplocks
9189                 </I
9190 ></TT
9191 ></A
9192 > parameters.</P
9193 ><P
9194 >Default: <B
9195 CLASS="COMMAND"
9196 >kernel oplocks = yes</B
9197 ></P
9198 ></DD
9199 ><DT
9200 ><A
9201 NAME="LANMANAUTH"
9202 ></A
9203 >lanman auth (G)</DT
9204 ><DD
9205 ><P
9206 >This parameter determines whether or not <A
9207 HREF="smbd.8.html"
9208 TARGET="_top"
9209 >smbd</A
9210 > will
9211                 attempt to authenticate users using the LANMAN password hash.
9212                 If disabled, only clients which support NT password hashes (e.g. Windows
9213                 NT/2000 clients, smbclient, etc... but not Windows 95/98 or the MS DOS
9214                 network client) will be able to connect to the Samba host.</P
9215 ><P
9216 >Default : <B
9217 CLASS="COMMAND"
9218 >lanman auth = yes</B
9219 ></P
9220 ></DD
9221 ><DT
9222 ><A
9223 NAME="LARGEREADWRITE"
9224 ></A
9225 >large readwrite (G)</DT
9226 ><DD
9227 ><P
9228 >This parameter determines whether or not <A
9229 HREF="smbd.8.html"
9230 TARGET="_top"
9231 >smbd</A
9232 >
9233                 supports the new 64k streaming read and write varient SMB requests introduced
9234                 with Windows 2000. Note that due to Windows 2000 client redirector bugs
9235                 this requires Samba to be running on a 64-bit capable operating system such
9236                 as IRIX, Solaris or a Linux 2.4 kernel. Can improve performance by 10% with
9237                 Windows 2000 clients. Defaults to on. Not as tested as some other Samba
9238                 code paths.
9239                 </P
9240 ><P
9241 >Default : <B
9242 CLASS="COMMAND"
9243 >large readwrite = yes</B
9244 ></P
9245 ></DD
9246 ><DT
9247 ><A
9248 NAME="LDAPADMINDN"
9249 ></A
9250 >ldap admin dn (G)</DT
9251 ><DD
9252 ><P
9253 >This parameter is only available if Samba has been
9254                 configure to include the <B
9255 CLASS="COMMAND"
9256 >--with-ldapsam</B
9257 > option
9258                 at compile time. This option should be considered experimental and
9259                 under active development.
9260                 </P
9261 ><P
9262 >               The <TT
9263 CLASS="PARAMETER"
9264 ><I
9265 >ldap admin dn</I
9266 ></TT
9267 > defines the Distinguished
9268                 Name (DN) name used by Samba to contact the <A
9269 HREF="#LDAPSERVER"
9270 >ldap
9271                 server</A
9272 > when retreiving user account information. The <TT
9273 CLASS="PARAMETER"
9274 ><I
9275 >ldap
9276                 admin dn</I
9277 ></TT
9278 > is used in conjunction with the admin dn password
9279                 stored in the <TT
9280 CLASS="FILENAME"
9281 >private/secrets.tdb</TT
9282 > file.  See the
9283                 <A
9284 HREF="smbpasswd.8.html"
9285 TARGET="_top"
9286 ><B
9287 CLASS="COMMAND"
9288 >smbpasswd(8)</B
9289 ></A
9290 > man
9291                 page for more information on how to accmplish this.
9292                 </P
9293 ><P
9294 >Default : <EM
9295 >none</EM
9296 ></P
9297 ></DD
9298 ><DT
9299 ><A
9300 NAME="LDAPFILTER"
9301 ></A
9302 >ldap filter (G)</DT
9303 ><DD
9304 ><P
9305 >This parameter is only available if Samba has been
9306                 configure to include the <B
9307 CLASS="COMMAND"
9308 >--with-ldapsam</B
9309 > option
9310                 at compile time. This option should be considered experimental and
9311                 under active development.
9312                 </P
9313 ><P
9314 >               This parameter specifies the RFC 2254 compliant LDAP search filter.
9315                 The default is to match the login name with the <TT
9316 CLASS="CONSTANT"
9317 >uid</TT
9318 >
9319                 attribute for all entries matching the <TT
9320 CLASS="CONSTANT"
9321 >sambaAccount</TT
9322 >
9323                 objectclass.  Note that this filter should only return one entry.
9324                 </P
9325 ><P
9326 >Default : <B
9327 CLASS="COMMAND"
9328 >ldap filter = (&#38;(uid=%u)(objectclass=sambaAccount))</B
9329 ></P
9330 ></DD
9331 ><DT
9332 ><A
9333 NAME="LDAPPORT"
9334 ></A
9335 >ldap port (G)</DT
9336 ><DD
9337 ><P
9338 >This parameter is only available if Samba has been
9339                 configure to include the <B
9340 CLASS="COMMAND"
9341 >--with-ldapsam</B
9342 > option
9343                 at compile time. This option should be considered experimental and
9344                 under active development.
9345                 </P
9346 ><P
9347 >               This option is used to control the tcp port number used to contact
9348                 the <A
9349 HREF="#LDAPSERVER"
9350 ><TT
9351 CLASS="PARAMETER"
9352 ><I
9353 >ldap server</I
9354 ></TT
9355 ></A
9356 >.
9357                 The default is to use the stand LDAPS port 636.
9358                 </P
9359 ><P
9360 >See Also: <A
9361 HREF="#LDAPSSL"
9362 >ldap ssl</A
9363 >
9364                 </P
9365 ><P
9366 >Default : <B
9367 CLASS="COMMAND"
9368 >ldap port = 636</B
9369 ></P
9370 ></DD
9371 ><DT
9372 ><A
9373 NAME="LDAPSERVER"
9374 ></A
9375 >ldap server (G)</DT
9376 ><DD
9377 ><P
9378 >This parameter is only available if Samba has been
9379                 configure to include the <B
9380 CLASS="COMMAND"
9381 >--with-ldapsam</B
9382 > option
9383                 at compile time. This option should be considered experimental and
9384                 under active development.
9385                 </P
9386 ><P
9387 >               This parameter should contains the FQDN of the ldap directory
9388                 server which should be queried to locate user account information.
9389                 </P
9390 ><P
9391 >Default : <B
9392 CLASS="COMMAND"
9393 >ldap server = localhost</B
9394 ></P
9395 ></DD
9396 ><DT
9397 ><A
9398 NAME="LDAPSSL"
9399 ></A
9400 >ldap ssl (G)</DT
9401 ><DD
9402 ><P
9403 >This parameter is only available if Samba has been
9404                 configure to include the <B
9405 CLASS="COMMAND"
9406 >--with-ldapsam</B
9407 > option
9408                 at compile time. This option should be considered experimental and
9409                 under active development.
9410                 </P
9411 ><P
9412 >               This option is used to define whether or not Samba should
9413                 use SSL when connecting to the <A
9414 HREF="#LDAPSERVER"
9415 ><TT
9416 CLASS="PARAMETER"
9417 ><I
9418 >ldap
9419                 server</I
9420 ></TT
9421 ></A
9422 >.  This is <EM
9423 >NOT</EM
9424 > related to
9425                 Samba SSL support which is enabled by specifying the
9426                 <B
9427 CLASS="COMMAND"
9428 >--with-ssl</B
9429 > option to the <TT
9430 CLASS="FILENAME"
9431 >configure</TT
9432 >
9433                 script (see <A
9434 HREF="#SSL"
9435 ><TT
9436 CLASS="PARAMETER"
9437 ><I
9438 >ssl</I
9439 ></TT
9440 ></A
9441 >).
9442                 </P
9443 ><P
9444 >               The <TT
9445 CLASS="PARAMETER"
9446 ><I
9447 >ldap ssl</I
9448 ></TT
9449 > can be set to one of three values:
9450                 (a) <TT
9451 CLASS="CONSTANT"
9452 >on</TT
9453 > - Always use SSL when contacting the
9454                 <TT
9455 CLASS="PARAMETER"
9456 ><I
9457 >ldap   server</I
9458 ></TT
9459 >, (b) <TT
9460 CLASS="CONSTANT"
9461 >off</TT
9462 > -
9463                 Never use SSL when querying the directory, or (c) <TT
9464 CLASS="CONSTANT"
9465 >start_tls</TT
9466 >
9467                 - Use the LDAPv3 StartTLS extended operation
9468                 (RFC2830) for communicating with the directory server.
9469                 </P
9470 ><P
9471 >Default : <B
9472 CLASS="COMMAND"
9473 >ldap ssl = on</B
9474 ></P
9475 ></DD
9476 ><DT
9477 ><A
9478 NAME="LDAPSUFFIX"
9479 ></A
9480 >ldap suffix (G)</DT
9481 ><DD
9482 ><P
9483 >This parameter is only available if Samba has been
9484                 configure to include the <B
9485 CLASS="COMMAND"
9486 >--with-ldapsam</B
9487 > option
9488                 at compile time. This option should be considered experimental and
9489                 under active development.
9490                 </P
9491 ><P
9492 >Default : <EM
9493 >none</EM
9494 ></P
9495 ></DD
9496 ><DT
9497 ><A
9498 NAME="LEVEL2OPLOCKS"
9499 ></A
9500 >level2 oplocks (S)</DT
9501 ><DD
9502 ><P
9503 >This parameter controls whether Samba supports
9504                 level2 (read-only) oplocks on a share.</P
9505 ><P
9506 >Level2, or read-only oplocks allow Windows NT clients
9507                 that have an oplock on a file to downgrade from a read-write oplock
9508                 to a read-only oplock once a second client opens the file (instead
9509                 of releasing all oplocks on a second open, as in traditional,
9510                 exclusive oplocks). This allows all openers of the file that
9511                 support level2 oplocks to cache the file for read-ahead only (ie.
9512                 they may not cache writes or lock requests) and increases performance
9513                 for many accesses of files that are not commonly written (such as
9514                 application .EXE files).</P
9515 ><P
9516 >Once one of the clients which have a read-only oplock
9517                 writes to the file all clients are notified (no reply is needed
9518                 or waited for) and told to break their oplocks to "none" and
9519                 delete any read-ahead caches.</P
9520 ><P
9521 >It is recommended that this parameter be turned on
9522                 to speed access to shared executables.</P
9523 ><P
9524 >For more discussions on level2 oplocks see the CIFS spec.</P
9525 ><P
9526 >Currently, if <A
9527 HREF="#KERNELOPLOCKS"
9528 ><TT
9529 CLASS="PARAMETER"
9530 ><I
9531 >kernel
9532                 oplocks</I
9533 ></TT
9534 ></A
9535 > are supported then level2 oplocks are
9536                 not granted (even if this parameter is set to <TT
9537 CLASS="CONSTANT"
9538 >yes</TT
9539 >).
9540                 Note also, the <A
9541 HREF="#OPLOCKS"
9542 ><TT
9543 CLASS="PARAMETER"
9544 ><I
9545 >oplocks</I
9546 ></TT
9547 >
9548                 </A
9549 > parameter must be set to <TT
9550 CLASS="CONSTANT"
9551 >true</TT
9552 > on this share in order for
9553                 this parameter to have any effect.</P
9554 ><P
9555 >See also the <A
9556 HREF="#OPLOCKS"
9557 ><TT
9558 CLASS="PARAMETER"
9559 ><I
9560 >oplocks</I
9561 ></TT
9562 >
9563                 </A
9564 > and <A
9565 HREF="#OPLOCKS"
9566 ><TT
9567 CLASS="PARAMETER"
9568 ><I
9569 >kernel oplocks</I
9570 ></TT
9571 >
9572                 </A
9573 > parameters.</P
9574 ><P
9575 >Default: <B
9576 CLASS="COMMAND"
9577 >level2 oplocks = yes</B
9578 ></P
9579 ></DD
9580 ><DT
9581 ><A
9582 NAME="LMANNOUNCE"
9583 ></A
9584 >lm announce (G)</DT
9585 ><DD
9586 ><P
9587 >This parameter determines if <A
9588 HREF="nmbd.8.html"
9589 TARGET="_top"
9590 >               <B
9591 CLASS="COMMAND"
9592 >nmbd(8)</B
9593 ></A
9594 > will produce Lanman announce
9595                 broadcasts that are needed by OS/2 clients in order for them to see
9596                 the Samba server in their browse list. This parameter can have three
9597                 values, <TT
9598 CLASS="CONSTANT"
9599 >true</TT
9600 >, <TT
9601 CLASS="CONSTANT"
9602 >false</TT
9603 >, or
9604                 <TT
9605 CLASS="CONSTANT"
9606 >auto</TT
9607 >. The default is <TT
9608 CLASS="CONSTANT"
9609 >auto</TT
9610 >.
9611                 If set to <TT
9612 CLASS="CONSTANT"
9613 >false</TT
9614 > Samba will never produce these
9615                 broadcasts. If set to <TT
9616 CLASS="CONSTANT"
9617 >true</TT
9618 > Samba will produce
9619                 Lanman announce broadcasts at a frequency set by the parameter
9620                 <TT
9621 CLASS="PARAMETER"
9622 ><I
9623 >lm interval</I
9624 ></TT
9625 >. If set to <TT
9626 CLASS="CONSTANT"
9627 >auto</TT
9628 >
9629                 Samba will not send Lanman announce broadcasts by default but will
9630                 listen for them. If it hears such a broadcast on the wire it will
9631                 then start sending them at a frequency set by the parameter
9632                 <TT
9633 CLASS="PARAMETER"
9634 ><I
9635 >lm interval</I
9636 ></TT
9637 >.</P
9638 ><P
9639 >See also <A
9640 HREF="#LMINTERVAL"
9641 ><TT
9642 CLASS="PARAMETER"
9643 ><I
9644 >lm interval
9645                 </I
9646 ></TT
9647 ></A
9648 >.</P
9649 ><P
9650 >Default: <B
9651 CLASS="COMMAND"
9652 >lm announce = auto</B
9653 ></P
9654 ><P
9655 >Example: <B
9656 CLASS="COMMAND"
9657 >lm announce = yes</B
9658 ></P
9659 ></DD
9660 ><DT
9661 ><A
9662 NAME="LMINTERVAL"
9663 ></A
9664 >lm interval (G)</DT
9665 ><DD
9666 ><P
9667 >If Samba is set to produce Lanman announce
9668                 broadcasts needed by OS/2 clients (see the <A
9669 HREF="#LMANNOUNCE"
9670 >               <TT
9671 CLASS="PARAMETER"
9672 ><I
9673 >lm announce</I
9674 ></TT
9675 ></A
9676 > parameter) then this
9677                 parameter defines the frequency in seconds with which they will be
9678                 made.  If this is set to zero then no Lanman announcements will be
9679                 made despite the setting of the <TT
9680 CLASS="PARAMETER"
9681 ><I
9682 >lm announce</I
9683 ></TT
9684 >
9685                 parameter.</P
9686 ><P
9687 >See also <A
9688 HREF="#LMANNOUNCE"
9689 ><TT
9690 CLASS="PARAMETER"
9691 ><I
9692 >lm
9693                 announce</I
9694 ></TT
9695 ></A
9696 >.</P
9697 ><P
9698 >Default: <B
9699 CLASS="COMMAND"
9700 >lm interval = 60</B
9701 ></P
9702 ><P
9703 >Example: <B
9704 CLASS="COMMAND"
9705 >lm interval = 120</B
9706 ></P
9707 ></DD
9708 ><DT
9709 ><A
9710 NAME="LOADPRINTERS"
9711 ></A
9712 >load printers (G)</DT
9713 ><DD
9714 ><P
9715 >A boolean variable that controls whether all
9716                 printers in the printcap will be loaded for browsing by default.
9717                 See the <A
9718 HREF="#AEN79"
9719 >printers</A
9720 > section for
9721                 more details.</P
9722 ><P
9723 >Default: <B
9724 CLASS="COMMAND"
9725 >load printers = yes</B
9726 ></P
9727 ></DD
9728 ><DT
9729 ><A
9730 NAME="LOCALMASTER"
9731 ></A
9732 >local master (G)</DT
9733 ><DD
9734 ><P
9735 >This option allows <A
9736 HREF="nmbd.8.html"
9737 TARGET="_top"
9738 ><B
9739 CLASS="COMMAND"
9740 >               nmbd(8)</B
9741 ></A
9742 > to try and become a local master browser
9743                 on a subnet. If set to <TT
9744 CLASS="CONSTANT"
9745 >false</TT
9746 > then <B
9747 CLASS="COMMAND"
9748 >               nmbd</B
9749 > will not attempt to become a local master browser
9750                 on a subnet and will also lose in all browsing elections. By
9751                 default this value is set to <TT
9752 CLASS="CONSTANT"
9753 >true</TT
9754 >. Setting this value to <TT
9755 CLASS="CONSTANT"
9756 >true</TT
9757 > doesn't
9758                 mean that Samba will <EM
9759 >become</EM
9760 > the local master
9761                 browser on a subnet, just that <B
9762 CLASS="COMMAND"
9763 >nmbd</B
9764 > will <EM
9765 >               participate</EM
9766 > in elections for local master browser.</P
9767 ><P
9768 >Setting this value to <TT
9769 CLASS="CONSTANT"
9770 >false</TT
9771 > will cause <B
9772 CLASS="COMMAND"
9773 >nmbd</B
9774 >
9775                 <EM
9776 >never</EM
9777 > to become a local master browser.</P
9778 ><P
9779 >Default: <B
9780 CLASS="COMMAND"
9781 >local master = yes</B
9782 ></P
9783 ></DD
9784 ><DT
9785 ><A
9786 NAME="LOCKDIR"
9787 ></A
9788 >lock dir (G)</DT
9789 ><DD
9790 ><P
9791 >Synonym for <A
9792 HREF="#LOCKDIRECTORY"
9793 ><TT
9794 CLASS="PARAMETER"
9795 ><I
9796 >               lock directory</I
9797 ></TT
9798 ></A
9799 >.</P
9800 ></DD
9801 ><DT
9802 ><A
9803 NAME="LOCKDIRECTORY"
9804 ></A
9805 >lock directory (G)</DT
9806 ><DD
9807 ><P
9808 >This option specifies the directory where lock
9809                 files will be placed.  The lock files are used to implement the
9810                 <A
9811 HREF="#MAXCONNECTIONS"
9812 ><TT
9813 CLASS="PARAMETER"
9814 ><I
9815 >max connections</I
9816 ></TT
9817 >
9818                 </A
9819 > option.</P
9820 ><P
9821 >Default: <B
9822 CLASS="COMMAND"
9823 >lock directory = ${prefix}/var/locks</B
9824 ></P
9825 ><P
9826 >Example: <B
9827 CLASS="COMMAND"
9828 >lock directory = /var/run/samba/locks</B
9829 >
9830                 </P
9831 ></DD
9832 ><DT
9833 ><A
9834 NAME="LOCKING"
9835 ></A
9836 >locking (S)</DT
9837 ><DD
9838 ><P
9839 >This controls whether or not locking will be
9840                 performed by the server in response to lock requests from the
9841                 client.</P
9842 ><P
9843 >If <B
9844 CLASS="COMMAND"
9845 >locking = no</B
9846 >, all lock and unlock
9847                 requests will appear to succeed and all lock queries will report
9848                 that the file in question is available for locking.</P
9849 ><P
9850 >If <B
9851 CLASS="COMMAND"
9852 >locking = yes</B
9853 >, real locking will be performed
9854                 by the server.</P
9855 ><P
9856 >This option <EM
9857 >may</EM
9858 > be useful for read-only
9859                 filesystems which <EM
9860 >may</EM
9861 > not need locking (such as
9862                 CDROM drives), although setting this parameter of <TT
9863 CLASS="CONSTANT"
9864 >no</TT
9865 >
9866                 is not really recommended even in this case.</P
9867 ><P
9868 >Be careful about disabling locking either globally or in a
9869                 specific service, as lack of locking may result in data corruption.
9870                 You should never need to set this parameter.</P
9871 ><P
9872 >Default: <B
9873 CLASS="COMMAND"
9874 >locking = yes</B
9875 ></P
9876 ></DD
9877 ><DT
9878 ><A
9879 NAME="LOGFILE"
9880 ></A
9881 >log file (G)</DT
9882 ><DD
9883 ><P
9884 >This option allows you to override the name
9885                 of the Samba log file (also known as the debug file).</P
9886 ><P
9887 >This option takes the standard substitutions, allowing
9888                 you to have separate log files for each user or machine.</P
9889 ><P
9890 >Example: <B
9891 CLASS="COMMAND"
9892 >log file = /usr/local/samba/var/log.%m
9893                 </B
9894 ></P
9895 ></DD
9896 ><DT
9897 ><A
9898 NAME="LOGLEVEL"
9899 ></A
9900 >log level (G)</DT
9901 ><DD
9902 ><P
9903 >The value of the parameter (an integer) allows
9904                 the debug level (logging level) to be specified in the
9905                 <TT
9906 CLASS="FILENAME"
9907 >smb.conf</TT
9908 > file. This is to give greater
9909                 flexibility in the configuration of the system.</P
9910 ><P
9911 >The default will be the log level specified on
9912                 the command line or level zero if none was specified.</P
9913 ><P
9914 >Example: <B
9915 CLASS="COMMAND"
9916 >log level = 3</B
9917 ></P
9918 ></DD
9919 ><DT
9920 ><A
9921 NAME="LOGONDRIVE"
9922 ></A
9923 >logon drive (G)</DT
9924 ><DD
9925 ><P
9926 >This parameter specifies the local path to
9927                 which the home directory will be connected (see <A
9928 HREF="#LOGONHOME"
9929 ><TT
9930 CLASS="PARAMETER"
9931 ><I
9932 >logon home</I
9933 ></TT
9934 ></A
9935 >)
9936                 and is only used by NT Workstations. </P
9937 ><P
9938 >Note that this option is only useful if Samba is set up as a
9939                 logon server.</P
9940 ><P
9941 >Default: <B
9942 CLASS="COMMAND"
9943 >logon drive = z:</B
9944 ></P
9945 ><P
9946 >Example: <B
9947 CLASS="COMMAND"
9948 >logon drive = h:</B
9949 ></P
9950 ></DD
9951 ><DT
9952 ><A
9953 NAME="LOGONHOME"
9954 ></A
9955 >logon home (G)</DT
9956 ><DD
9957 ><P
9958 >This parameter specifies the home directory
9959                 location when a Win95/98 or NT Workstation logs into a Samba PDC.
9960                 It allows you to do </P
9961 ><P
9962 ><TT
9963 CLASS="PROMPT"
9964 >C:\&#62; </TT
9965 ><TT
9966 CLASS="USERINPUT"
9967 ><B
9968 >NET USE H: /HOME</B
9969 ></TT
9970 >
9971                 </P
9972 ><P
9973 >from a command prompt, for example.</P
9974 ><P
9975 >This option takes the standard substitutions, allowing
9976                 you to have separate logon scripts for each user or machine.</P
9977 ><P
9978 >This parameter can be used with Win9X workstations to ensure
9979                 that roaming profiles are stored in a subdirectory of the user's
9980                 home directory.  This is done in the following way:</P
9981 ><P
9982 ><B
9983 CLASS="COMMAND"
9984 >logon home = \\%N\%U\profile</B
9985 ></P
9986 ><P
9987 >This tells Samba to return the above string, with
9988                 substitutions made when a client requests the info, generally
9989                 in a NetUserGetInfo request.  Win9X clients truncate the info to
9990                 \\server\share when a user does <B
9991 CLASS="COMMAND"
9992 >net use /home</B
9993 >
9994                 but use the whole string when dealing with profiles.</P
9995 ><P
9996 >Note that in prior versions of Samba, the <A
9997 HREF="#LOGONPATH"
9998 >               <TT
9999 CLASS="PARAMETER"
10000 ><I
10001 >logon path</I
10002 ></TT
10003 ></A
10004 > was returned rather than
10005                 <TT
10006 CLASS="PARAMETER"
10007 ><I
10008 >logon home</I
10009 ></TT
10010 >.  This broke <B
10011 CLASS="COMMAND"
10012 >net use
10013                 /home</B
10014 > but allowed profiles outside the home directory.
10015                 The current implementation is correct, and can be used for
10016                 profiles if you use the above trick.</P
10017 ><P
10018 >This option is only useful if Samba is set up as a logon
10019                 server.</P
10020 ><P
10021 >Default: <B
10022 CLASS="COMMAND"
10023 >logon home = "\\%N\%U"</B
10024 ></P
10025 ><P
10026 >Example: <B
10027 CLASS="COMMAND"
10028 >logon home = "\\remote_smb_server\%U"</B
10029 >
10030                 </P
10031 ></DD
10032 ><DT
10033 ><A
10034 NAME="LOGONPATH"
10035 ></A
10036 >logon path (G)</DT
10037 ><DD
10038 ><P
10039 >This parameter specifies the home directory
10040                 where roaming profiles (NTuser.dat etc files for Windows NT) are
10041                 stored.  Contrary to previous versions of these manual pages, it has
10042                 nothing to do with Win 9X roaming profiles.  To find out how to
10043                 handle roaming profiles for Win 9X system, see the <A
10044 HREF="#LOGONHOME"
10045 >               <TT
10046 CLASS="PARAMETER"
10047 ><I
10048 >logon home</I
10049 ></TT
10050 ></A
10051 > parameter.</P
10052 ><P
10053 >This option takes the standard substitutions, allowing you
10054                 to have separate logon scripts for each user or machine.  It also
10055                 specifies the directory from which the "Application Data",
10056                 (<TT
10057 CLASS="FILENAME"
10058 >desktop</TT
10059 >, <TT
10060 CLASS="FILENAME"
10061 >start menu</TT
10062 >,
10063                 <TT
10064 CLASS="FILENAME"
10065 >network neighborhood</TT
10066 >, <TT
10067 CLASS="FILENAME"
10068 >programs</TT
10069 >
10070                 and other folders, and their contents, are loaded and displayed on
10071                 your Windows NT client.</P
10072 ><P
10073 >The share and the path must be readable by the user for
10074                 the preferences and directories to be loaded onto the Windows NT
10075                 client.  The share must be writeable when the user logs in for the first
10076                 time, in order that the Windows NT client can create the NTuser.dat
10077                 and other directories.</P
10078 ><P
10079 >Thereafter, the directories and any of the contents can,
10080                 if required, be made read-only.  It is not advisable that the
10081                 NTuser.dat file be made read-only - rename it to NTuser.man to
10082                 achieve the desired effect (a <EM
10083 >MAN</EM
10084 >datory
10085                 profile). </P
10086 ><P
10087 >Windows clients can sometimes maintain a connection to
10088                 the [homes] share, even though there is no user logged in.
10089                 Therefore, it is vital that the logon path does not include a
10090                 reference to the homes share (i.e. setting this parameter to
10091                 \%N\%U\profile_path will cause problems).</P
10092 ><P
10093 >This option takes the standard substitutions, allowing
10094                 you to have separate logon scripts for each user or machine.</P
10095 ><P
10096 >Note that this option is only useful if Samba is set up
10097                 as a logon server.</P
10098 ><P
10099 >Default: <B
10100 CLASS="COMMAND"
10101 >logon path = \\%N\%U\profile</B
10102 ></P
10103 ><P
10104 >Example: <B
10105 CLASS="COMMAND"
10106 >logon path = \\PROFILESERVER\PROFILE\%U</B
10107 ></P
10108 ></DD
10109 ><DT
10110 ><A
10111 NAME="LOGONSCRIPT"
10112 ></A
10113 >logon script (G)</DT
10114 ><DD
10115 ><P
10116 >This parameter specifies the batch file (.bat) or
10117                 NT command file (.cmd) to be downloaded and run on a machine when
10118                 a user successfully logs in.  The file must contain the DOS
10119                 style CR/LF line endings. Using a DOS-style editor to create the
10120                 file is recommended.</P
10121 ><P
10122 >The script must be a relative path to the [netlogon]
10123                 service.  If the [netlogon] service specifies a <A
10124 HREF="#PATH"
10125 >               <TT
10126 CLASS="PARAMETER"
10127 ><I
10128 >path</I
10129 ></TT
10130 ></A
10131 > of <TT
10132 CLASS="FILENAME"
10133 >/usr/local/samba/netlogon
10134                 </TT
10135 >, and <B
10136 CLASS="COMMAND"
10137 >logon script = STARTUP.BAT</B
10138 >, then
10139                 the file that will be downloaded is:</P
10140 ><P
10141 ><TT
10142 CLASS="FILENAME"
10143 >/usr/local/samba/netlogon/STARTUP.BAT</TT
10144 ></P
10145 ><P
10146 >The contents of the batch file are entirely your choice.  A
10147                 suggested command would be to add <B
10148 CLASS="COMMAND"
10149 >NET TIME \\SERVER /SET
10150                 /YES</B
10151 >, to force every machine to synchronize clocks with
10152                 the same time server.  Another use would be to add <B
10153 CLASS="COMMAND"
10154 >NET USE
10155                 U: \\SERVER\UTILS</B
10156 > for commonly used utilities, or <B
10157 CLASS="COMMAND"
10158 >               NET USE Q: \\SERVER\ISO9001_QA</B
10159 > for example.</P
10160 ><P
10161 >Note that it is particularly important not to allow write
10162                 access to the [netlogon] share, or to grant users write permission
10163                 on the batch files in a secure environment, as this would allow
10164                 the batch files to be arbitrarily modified and security to be
10165                 breached.</P
10166 ><P
10167 >This option takes the standard substitutions, allowing you
10168                 to have separate logon scripts for each user or machine.</P
10169 ><P
10170 >This option is only useful if Samba is set up as a logon
10171                 server.</P
10172 ><P
10173 >Default: <EM
10174 >no logon script defined</EM
10175 ></P
10176 ><P
10177 >Example: <B
10178 CLASS="COMMAND"
10179 >logon script = scripts\%U.bat</B
10180 ></P
10181 ></DD
10182 ><DT
10183 ><A
10184 NAME="LPPAUSECOMMAND"
10185 ></A
10186 >lppause command (S)</DT
10187 ><DD
10188 ><P
10189 >This parameter specifies the command to be
10190                 executed on the server host in order to stop printing or spooling
10191                 a specific print job.</P
10192 ><P
10193 >This command should be a program or script which takes
10194                 a printer name and job number to pause the print job. One way
10195                 of implementing this is by using job priorities, where jobs
10196                 having a too low priority won't be sent to the printer.</P
10197 ><P
10198 >If a <TT
10199 CLASS="PARAMETER"
10200 ><I
10201 >%p</I
10202 ></TT
10203 > is given then the printer name
10204                 is put in its place. A <TT
10205 CLASS="PARAMETER"
10206 ><I
10207 >%j</I
10208 ></TT
10209 > is replaced with
10210                 the job number (an integer).  On HPUX (see <TT
10211 CLASS="PARAMETER"
10212 ><I
10213 >printing=hpux
10214                 </I
10215 ></TT
10216 >), if the <TT
10217 CLASS="PARAMETER"
10218 ><I
10219 >-p%p</I
10220 ></TT
10221 > option is added
10222                 to the lpq command, the job will show up with the correct status, i.e.
10223                 if the job priority is lower than the set fence priority it will
10224                 have the PAUSED status, whereas if  the priority is equal or higher it
10225                 will have the SPOOLED or PRINTING status.</P
10226 ><P
10227 >Note that it is good practice to include the absolute path
10228                 in the lppause command as the PATH may not be available to the server.</P
10229 ><P
10230 >See also the <A
10231 HREF="#PRINTING"
10232 ><TT
10233 CLASS="PARAMETER"
10234 ><I
10235 >printing
10236                 </I
10237 ></TT
10238 ></A
10239 > parameter.</P
10240 ><P
10241 >Default: Currently no default value is given to
10242                 this string, unless the value of the <TT
10243 CLASS="PARAMETER"
10244 ><I
10245 >printing</I
10246 ></TT
10247 >
10248                 parameter is <TT
10249 CLASS="CONSTANT"
10250 >SYSV</TT
10251 >, in which case the default is :</P
10252 ><P
10253 ><B
10254 CLASS="COMMAND"
10255 >lp -i %p-%j -H hold</B
10256 ></P
10257 ><P
10258 >or if the value of the <TT
10259 CLASS="PARAMETER"
10260 ><I
10261 >printing</I
10262 ></TT
10263 > parameter
10264                 is <TT
10265 CLASS="CONSTANT"
10266 >SOFTQ</TT
10267 >, then the default is:</P
10268 ><P
10269 ><B
10270 CLASS="COMMAND"
10271 >qstat -s -j%j -h</B
10272 ></P
10273 ><P
10274 >Example for HPUX: <B
10275 CLASS="COMMAND"
10276 >lppause command = /usr/bin/lpalt
10277                 %p-%j -p0</B
10278 ></P
10279 ></DD
10280 ><DT
10281 ><A
10282 NAME="LPQCACHETIME"
10283 ></A
10284 >lpq cache time (G)</DT
10285 ><DD
10286 ><P
10287 >This controls how long lpq info will be cached
10288                 for to prevent the <B
10289 CLASS="COMMAND"
10290 >lpq</B
10291 > command being called too
10292                 often. A separate cache is kept for each variation of the <B
10293 CLASS="COMMAND"
10294 >               lpq</B
10295 > command used by the system, so if you use different
10296                 <B
10297 CLASS="COMMAND"
10298 >lpq</B
10299 > commands for different users then they won't
10300                 share cache information.</P
10301 ><P
10302 >The cache files are stored in <TT
10303 CLASS="FILENAME"
10304 >/tmp/lpq.xxxx</TT
10305 >
10306                 where xxxx is a hash of the <B
10307 CLASS="COMMAND"
10308 >lpq</B
10309 > command in use.</P
10310 ><P
10311 >The default is 10 seconds, meaning that the cached results
10312                 of a previous identical <B
10313 CLASS="COMMAND"
10314 >lpq</B
10315 > command will be used
10316                 if the cached data is less than 10 seconds old. A large value may
10317                 be advisable if your <B
10318 CLASS="COMMAND"
10319 >lpq</B
10320 > command is very slow.</P
10321 ><P
10322 >A value of 0 will disable caching completely.</P
10323 ><P
10324 >See also the <A
10325 HREF="#PRINTING"
10326 ><TT
10327 CLASS="PARAMETER"
10328 ><I
10329 >printing
10330                 </I
10331 ></TT
10332 ></A
10333 > parameter.</P
10334 ><P
10335 >Default: <B
10336 CLASS="COMMAND"
10337 >lpq cache time = 10</B
10338 ></P
10339 ><P
10340 >Example: <B
10341 CLASS="COMMAND"
10342 >lpq cache time = 30</B
10343 ></P
10344 ></DD
10345 ><DT
10346 ><A
10347 NAME="LPQCOMMAND"
10348 ></A
10349 >lpq command (S)</DT
10350 ><DD
10351 ><P
10352 >This parameter specifies the command to be
10353                 executed on the server host in order to obtain <B
10354 CLASS="COMMAND"
10355 >lpq
10356                 </B
10357 >-style printer status information.</P
10358 ><P
10359 >This command should be a program or script which
10360                 takes a printer name as its only parameter and outputs printer
10361                 status information.</P
10362 ><P
10363 >Currently eight styles of printer status information
10364                 are supported; BSD, AIX, LPRNG, PLP, SYSV, HPUX, QNX and SOFTQ.
10365                 This covers most UNIX systems. You control which type is expected
10366                 using the <TT
10367 CLASS="PARAMETER"
10368 ><I
10369 >printing =</I
10370 ></TT
10371 > option.</P
10372 ><P
10373 >Some clients (notably Windows for Workgroups) may not
10374                 correctly send the connection number for the printer they are
10375                 requesting status information about. To get around this, the
10376                 server reports on the first printer service connected to by the
10377                 client. This only happens if the connection number sent is invalid.</P
10378 ><P
10379 >If a <TT
10380 CLASS="PARAMETER"
10381 ><I
10382 >%p</I
10383 ></TT
10384 > is given then the printer name
10385                 is put in its place. Otherwise it is placed at the end of the
10386                 command.</P
10387 ><P
10388 >Note that it is good practice to include the absolute path
10389                 in the <TT
10390 CLASS="PARAMETER"
10391 ><I
10392 >lpq command</I
10393 ></TT
10394 > as the <TT
10395 CLASS="ENVAR"
10396 >$PATH
10397                 </TT
10398 > may not be available to the server.</P
10399 ><P
10400 >See also the <A
10401 HREF="#PRINTING"
10402 ><TT
10403 CLASS="PARAMETER"
10404 ><I
10405 >printing
10406                 </I
10407 ></TT
10408 ></A
10409 > parameter.</P
10410 ><P
10411 >Default: <EM
10412 >depends on the setting of <TT
10413 CLASS="PARAMETER"
10414 ><I
10415 >               printing</I
10416 ></TT
10417 ></EM
10418 ></P
10419 ><P
10420 >Example: <B
10421 CLASS="COMMAND"
10422 >lpq command = /usr/bin/lpq -P%p</B
10423 ></P
10424 ></DD
10425 ><DT
10426 ><A
10427 NAME="LPRESUMECOMMAND"
10428 ></A
10429 >lpresume command (S)</DT
10430 ><DD
10431 ><P
10432 >This parameter specifies the command to be
10433                 executed on the server host in order to restart or continue
10434                 printing or spooling a specific print job.</P
10435 ><P
10436 >This command should be a program or script which takes
10437                 a printer name and job number to resume the print job. See
10438                 also the <A
10439 HREF="#LPPAUSECOMMAND"
10440 ><TT
10441 CLASS="PARAMETER"
10442 ><I
10443 >lppause command
10444                 </I
10445 ></TT
10446 ></A
10447 > parameter.</P
10448 ><P
10449 >If a <TT
10450 CLASS="PARAMETER"
10451 ><I
10452 >%p</I
10453 ></TT
10454 > is given then the printer name
10455                 is put in its place. A <TT
10456 CLASS="PARAMETER"
10457 ><I
10458 >%j</I
10459 ></TT
10460 > is replaced with
10461                 the job number (an integer).</P
10462 ><P
10463 >Note that it is good practice to include the absolute path
10464                 in the <TT
10465 CLASS="PARAMETER"
10466 ><I
10467 >lpresume command</I
10468 ></TT
10469 > as the PATH may not
10470                 be available to the server.</P
10471 ><P
10472 >See also the <A
10473 HREF="#PRINTING"
10474 ><TT
10475 CLASS="PARAMETER"
10476 ><I
10477 >printing
10478                 </I
10479 ></TT
10480 ></A
10481 > parameter.</P
10482 ><P
10483 >Default: Currently no default value is given
10484                 to this string, unless the value of the <TT
10485 CLASS="PARAMETER"
10486 ><I
10487 >printing</I
10488 ></TT
10489 >
10490                 parameter is <TT
10491 CLASS="CONSTANT"
10492 >SYSV</TT
10493 >, in which case the default is :</P
10494 ><P
10495 ><B
10496 CLASS="COMMAND"
10497 >lp -i %p-%j -H resume</B
10498 ></P
10499 ><P
10500 >or if the value of the <TT
10501 CLASS="PARAMETER"
10502 ><I
10503 >printing</I
10504 ></TT
10505 > parameter
10506                 is <TT
10507 CLASS="CONSTANT"
10508 >SOFTQ</TT
10509 >, then the default is:</P
10510 ><P
10511 ><B
10512 CLASS="COMMAND"
10513 >qstat -s -j%j -r</B
10514 ></P
10515 ><P
10516 >Example for HPUX: <B
10517 CLASS="COMMAND"
10518 >lpresume command = /usr/bin/lpalt
10519                 %p-%j -p2</B
10520 ></P
10521 ></DD
10522 ><DT
10523 ><A
10524 NAME="LPRMCOMMAND"
10525 ></A
10526 >lprm command (S)</DT
10527 ><DD
10528 ><P
10529 >This parameter specifies the command to be
10530                 executed on the server host in order to delete a print job.</P
10531 ><P
10532 >This command should be a program or script which takes
10533                 a printer name and job number, and deletes the print job.</P
10534 ><P
10535 >If a <TT
10536 CLASS="PARAMETER"
10537 ><I
10538 >%p</I
10539 ></TT
10540 > is given then the printer name
10541                 is put in its place. A <TT
10542 CLASS="PARAMETER"
10543 ><I
10544 >%j</I
10545 ></TT
10546 > is replaced with
10547                 the job number (an integer).</P
10548 ><P
10549 >Note that it is good practice to include the absolute
10550                 path in the <TT
10551 CLASS="PARAMETER"
10552 ><I
10553 >lprm command</I
10554 ></TT
10555 > as the PATH may not be
10556                 available to the server.</P
10557 ><P
10558 >See also the <A
10559 HREF="#PRINTING"
10560 ><TT
10561 CLASS="PARAMETER"
10562 ><I
10563 >printing
10564                 </I
10565 ></TT
10566 ></A
10567 > parameter.</P
10568 ><P
10569 >Default: <EM
10570 >depends on the setting of <TT
10571 CLASS="PARAMETER"
10572 ><I
10573 >printing
10574                 </I
10575 ></TT
10576 ></EM
10577 ></P
10578 ><P
10579 >Example 1: <B
10580 CLASS="COMMAND"
10581 >lprm command = /usr/bin/lprm -P%p %j
10582                 </B
10583 ></P
10584 ><P
10585 >Example 2: <B
10586 CLASS="COMMAND"
10587 >lprm command = /usr/bin/cancel %p-%j
10588                 </B
10589 ></P
10590 ></DD
10591 ><DT
10592 ><A
10593 NAME="MACHINEPASSWORDTIMEOUT"
10594 ></A
10595 >machine password timeout (G)</DT
10596 ><DD
10597 ><P
10598 >If a Samba server is a member of a Windows
10599                 NT Domain (see the <A
10600 HREF="#SECURITYEQUALSDOMAIN"
10601 >security = domain</A
10602 >)
10603                 parameter) then periodically a running <A
10604 HREF="smbd.8.html"
10605 TARGET="_top"
10606 >               smbd(8)</A
10607 > process will try and change the MACHINE ACCOUNT
10608                 PASSWORD stored in the TDB called <TT
10609 CLASS="FILENAME"
10610 >private/secrets.tdb
10611                 </TT
10612 >.  This parameter specifies how often this password
10613                 will be changed, in seconds. The default is one week (expressed in
10614                 seconds), the same as a Windows NT Domain member server.</P
10615 ><P
10616 >See also <A
10617 HREF="smbpasswd.8.html"
10618 TARGET="_top"
10619 ><B
10620 CLASS="COMMAND"
10621 >smbpasswd(8)
10622                 </B
10623 ></A
10624 >, and the <A
10625 HREF="#SECURITYEQUALSDOMAIN"
10626 >               security = domain</A
10627 >) parameter.</P
10628 ><P
10629 >Default: <B
10630 CLASS="COMMAND"
10631 >machine password timeout = 604800</B
10632 ></P
10633 ></DD
10634 ><DT
10635 ><A
10636 NAME="MAGICOUTPUT"
10637 ></A
10638 >magic output (S)</DT
10639 ><DD
10640 ><P
10641 >This parameter specifies the name of a file
10642                 which will contain output created by a magic script (see the
10643                 <A
10644 HREF="#MAGICSCRIPT"
10645 ><TT
10646 CLASS="PARAMETER"
10647 ><I
10648 >magic script</I
10649 ></TT
10650 ></A
10651 >
10652                 parameter below).</P
10653 ><P
10654 >Warning: If two clients use the same <TT
10655 CLASS="PARAMETER"
10656 ><I
10657 >magic script
10658                 </I
10659 ></TT
10660 > in the same directory the output file content
10661                 is undefined.</P
10662 ><P
10663 >Default: <B
10664 CLASS="COMMAND"
10665 >magic output = &#60;magic script name&#62;.out
10666                 </B
10667 ></P
10668 ><P
10669 >Example: <B
10670 CLASS="COMMAND"
10671 >magic output = myfile.txt</B
10672 ></P
10673 ></DD
10674 ><DT
10675 ><A
10676 NAME="MAGICSCRIPT"
10677 ></A
10678 >magic script (S)</DT
10679 ><DD
10680 ><P
10681 >This parameter specifies the name of a file which,
10682                 if opened, will be executed by the server when the file is closed.
10683                 This allows a UNIX script to be sent to the Samba host and
10684                 executed on behalf of the connected user.</P
10685 ><P
10686 >Scripts executed in this way will be deleted upon
10687                 completion assuming that the user has the appropriate level
10688                 of privilege and the file permissions allow the deletion.</P
10689 ><P
10690 >If the script generates output, output will be sent to
10691                 the file specified by the <A
10692 HREF="#MAGICOUTPUT"
10693 ><TT
10694 CLASS="PARAMETER"
10695 ><I
10696 >               magic output</I
10697 ></TT
10698 ></A
10699 > parameter (see above).</P
10700 ><P
10701 >Note that some shells are unable to interpret scripts
10702                 containing CR/LF instead of CR as
10703                 the end-of-line marker. Magic scripts must be executable
10704                 <EM
10705 >as is</EM
10706 > on the host, which for some hosts and
10707                 some shells will require filtering at the DOS end.</P
10708 ><P
10709 >Magic scripts are <EM
10710 >EXPERIMENTAL</EM
10711 > and
10712                 should <EM
10713 >NOT</EM
10714 > be relied upon.</P
10715 ><P
10716 >Default: <EM
10717 >None. Magic scripts disabled.</EM
10718 ></P
10719 ><P
10720 >Example: <B
10721 CLASS="COMMAND"
10722 >magic script = user.csh</B
10723 ></P
10724 ></DD
10725 ><DT
10726 ><A
10727 NAME="MANGLECASE"
10728 ></A
10729 >mangle case (S)</DT
10730 ><DD
10731 ><P
10732 >See the section on <A
10733 HREF="#AEN203"
10734 >               NAME MANGLING</A
10735 ></P
10736 ><P
10737 >Default: <B
10738 CLASS="COMMAND"
10739 >mangle case = no</B
10740 ></P
10741 ></DD
10742 ><DT
10743 ><A
10744 NAME="MANGLEDMAP"
10745 ></A
10746 >mangled map (S)</DT
10747 ><DD
10748 ><P
10749 >This is for those who want to directly map UNIX
10750                 file names which cannot be represented on Windows/DOS.  The mangling
10751                 of names is not always what is needed.  In particular you may have
10752                 documents with file extensions that differ between DOS and UNIX.
10753                 For example, under UNIX it is common to use <TT
10754 CLASS="FILENAME"
10755 >.html</TT
10756 >
10757                 for HTML files, whereas under Windows/DOS <TT
10758 CLASS="FILENAME"
10759 >.htm</TT
10760 >
10761                 is more commonly used.</P
10762 ><P
10763 >So to map <TT
10764 CLASS="FILENAME"
10765 >html</TT
10766 > to <TT
10767 CLASS="FILENAME"
10768 >htm</TT
10769 >
10770                 you would use:</P
10771 ><P
10772 ><B
10773 CLASS="COMMAND"
10774 >mangled map = (*.html *.htm)</B
10775 ></P
10776 ><P
10777 >One very useful case is to remove the annoying <TT
10778 CLASS="FILENAME"
10779 >;1
10780                 </TT
10781 > off the ends of filenames on some CDROMs (only visible
10782                 under some UNIXes). To do this use a map of (*;1 *;).</P
10783 ><P
10784 >Default: <EM
10785 >no mangled map</EM
10786 ></P
10787 ><P
10788 >Example: <B
10789 CLASS="COMMAND"
10790 >mangled map = (*;1 *;)</B
10791 ></P
10792 ></DD
10793 ><DT
10794 ><A
10795 NAME="MANGLEDNAMES"
10796 ></A
10797 >mangled names (S)</DT
10798 ><DD
10799 ><P
10800 >This controls whether non-DOS names under UNIX
10801                 should be mapped to DOS-compatible names ("mangled") and made visible,
10802                 or whether non-DOS names should simply be ignored.</P
10803 ><P
10804 >See the section on <A
10805 HREF="#AEN203"
10806 >               NAME MANGLING</A
10807 > for details on how to control the mangling process.</P
10808 ><P
10809 >If mangling is used then the mangling algorithm is as follows:</P
10810 ><P
10811 ></P
10812 ><UL
10813 ><LI
10814 ><P
10815 >The first (up to) five alphanumeric characters
10816                         before the rightmost dot of the filename are preserved, forced
10817                         to upper case, and appear as the first (up to) five characters
10818                         of the mangled name.</P
10819 ></LI
10820 ><LI
10821 ><P
10822 >A tilde "~" is appended to the first part of the mangled
10823                         name, followed by a two-character unique sequence, based on the
10824                         original root name (i.e., the original filename minus its final
10825                         extension). The final extension is included in the hash calculation
10826                         only if it contains any upper case characters or is longer than three
10827                         characters.</P
10828 ><P
10829 >Note that the character to use may be specified using
10830                         the <A
10831 HREF="#MANGLINGCHAR"
10832 ><TT
10833 CLASS="PARAMETER"
10834 ><I
10835 >mangling char</I
10836 ></TT
10837 >
10838                         </A
10839 > option, if you don't like '~'.</P
10840 ></LI
10841 ><LI
10842 ><P
10843 >The first three alphanumeric characters of the final
10844                         extension are preserved, forced to upper case and appear as the
10845                         extension of the mangled name. The final extension is defined as that
10846                         part of the original filename after the rightmost dot. If there are no
10847                         dots in the filename, the mangled name will have no extension (except
10848                         in the case of "hidden files" - see below).</P
10849 ></LI
10850 ><LI
10851 ><P
10852 >Files whose UNIX name begins with a dot will be
10853                         presented as DOS hidden files. The mangled name will be created as
10854                         for other filenames, but with the leading dot removed and "___" as
10855                         its extension regardless of actual original extension (that's three
10856                         underscores).</P
10857 ></LI
10858 ></UL
10859 ><P
10860 >The two-digit hash value consists of upper case
10861                 alphanumeric characters.</P
10862 ><P
10863 >This algorithm can cause name collisions only if files
10864                 in a directory share the same first five alphanumeric characters.
10865                 The probability of such a clash is 1/1300.</P
10866 ><P
10867 >The name mangling (if enabled) allows a file to be
10868                 copied between UNIX directories from Windows/DOS while retaining
10869                 the long UNIX filename. UNIX files can be renamed to a new extension
10870                 from Windows/DOS and will retain the same basename. Mangled names
10871                 do not change between sessions.</P
10872 ><P
10873 >Default: <B
10874 CLASS="COMMAND"
10875 >mangled names = yes</B
10876 ></P
10877 ></DD
10878 ><DT
10879 ><A
10880 NAME="MANGLEDSTACK"
10881 ></A
10882 >mangled stack (G)</DT
10883 ><DD
10884 ><P
10885 >This parameter controls the number of mangled names
10886                 that should be cached in the Samba server <A
10887 HREF="smbd.8.html"
10888 TARGET="_top"
10889 >               smbd(8)</A
10890 >.</P
10891 ><P
10892 >This stack is a list of recently mangled base names
10893                 (extensions are only maintained if they are longer than 3 characters
10894                 or contains upper case characters).</P
10895 ><P
10896 >The larger this value, the more likely it is that mangled
10897                 names can be successfully converted to correct long UNIX names.
10898                 However, large stack sizes will slow most directory accesses. Smaller
10899                 stacks save memory in the server (each stack element costs 256 bytes).
10900                 </P
10901 ><P
10902 >It is not possible to absolutely guarantee correct long
10903                 filenames, so be prepared for some surprises!</P
10904 ><P
10905 >Default: <B
10906 CLASS="COMMAND"
10907 >mangled stack = 50</B
10908 ></P
10909 ><P
10910 >Example: <B
10911 CLASS="COMMAND"
10912 >mangled stack = 100</B
10913 ></P
10914 ></DD
10915 ><DT
10916 ><A
10917 NAME="MANGLINGCHAR"
10918 ></A
10919 >mangling char (S)</DT
10920 ><DD
10921 ><P
10922 >This controls what character is used as
10923                 the <EM
10924 >magic</EM
10925 > character in <A
10926 HREF="#AEN203"
10927 >name mangling</A
10928 >. The default is a '~'
10929                 but this may interfere with some software. Use this option to set
10930                 it to whatever you prefer.</P
10931 ><P
10932 >Default: <B
10933 CLASS="COMMAND"
10934 >mangling char = ~</B
10935 ></P
10936 ><P
10937 >Example: <B
10938 CLASS="COMMAND"
10939 >mangling char = ^</B
10940 ></P
10941 ></DD
10942 ><DT
10943 ><A
10944 NAME="MAPARCHIVE"
10945 ></A
10946 >map archive (S)</DT
10947 ><DD
10948 ><P
10949 >This controls whether the DOS archive attribute
10950                 should be mapped to the UNIX owner execute bit.  The DOS archive bit
10951                 is set when a file has been modified since its last backup.  One
10952                 motivation for this option it to keep Samba/your PC from making
10953                 any file it touches from becoming executable under UNIX.  This can
10954                 be quite annoying for shared source code, documents, etc...</P
10955 ><P
10956 >Note that this requires the <TT
10957 CLASS="PARAMETER"
10958 ><I
10959 >create mask</I
10960 ></TT
10961 >
10962                 parameter to be set such that owner execute bit is not masked out
10963                 (i.e. it must include 100). See the parameter <A
10964 HREF="#CREATEMASK"
10965 >               <TT
10966 CLASS="PARAMETER"
10967 ><I
10968 >create mask</I
10969 ></TT
10970 ></A
10971 > for details.</P
10972 ><P
10973 >Default: <B
10974 CLASS="COMMAND"
10975 >map archive = yes</B
10976 ></P
10977 ></DD
10978 ><DT
10979 ><A
10980 NAME="MAPHIDDEN"
10981 ></A
10982 >map hidden (S)</DT
10983 ><DD
10984 ><P
10985 >This controls whether DOS style hidden files
10986                 should be mapped to the UNIX world execute bit.</P
10987 ><P
10988 >Note that this requires the <TT
10989 CLASS="PARAMETER"
10990 ><I
10991 >create mask</I
10992 ></TT
10993 >
10994                 to be set such that the world execute bit is not masked out (i.e.
10995                 it must include 001). See the parameter <A
10996 HREF="#CREATEMASK"
10997 >               <TT
10998 CLASS="PARAMETER"
10999 ><I
11000 >create mask</I
11001 ></TT
11002 ></A
11003 > for details.</P
11004 ><P
11005 >Default: <B
11006 CLASS="COMMAND"
11007 >map hidden = no</B
11008 ></P
11009 ></DD
11010 ><DT
11011 ><A
11012 NAME="MAPSYSTEM"
11013 ></A
11014 >map system (S)</DT
11015 ><DD
11016 ><P
11017 >This controls whether DOS style system files
11018                 should be mapped to the UNIX group execute bit.</P
11019 ><P
11020 >Note that this requires the <TT
11021 CLASS="PARAMETER"
11022 ><I
11023 >create mask</I
11024 ></TT
11025 >
11026                 to be set such that the group execute bit is not masked out (i.e.
11027                 it must include 010). See the parameter <A
11028 HREF="#CREATEMASK"
11029 >               <TT
11030 CLASS="PARAMETER"
11031 ><I
11032 >create mask</I
11033 ></TT
11034 ></A
11035 > for details.</P
11036 ><P
11037 >Default: <B
11038 CLASS="COMMAND"
11039 >map system = no</B
11040 ></P
11041 ></DD
11042 ><DT
11043 ><A
11044 NAME="MAPTOGUEST"
11045 ></A
11046 >map to guest (G)</DT
11047 ><DD
11048 ><P
11049 >This parameter is only useful in <A
11050 HREF="#SECURITY"
11051 >               security</A
11052 > modes other than <TT
11053 CLASS="PARAMETER"
11054 ><I
11055 >security = share</I
11056 ></TT
11057 >
11058                 - i.e. <TT
11059 CLASS="CONSTANT"
11060 >user</TT
11061 >, <TT
11062 CLASS="CONSTANT"
11063 >server</TT
11064 >,
11065                 and <TT
11066 CLASS="CONSTANT"
11067 >domain</TT
11068 >.</P
11069 ><P
11070 >This parameter can take three different values, which tell
11071                 <A
11072 HREF="smbd.8.html"
11073 TARGET="_top"
11074 >smbd(8)</A
11075 > what to do with user
11076                 login requests that don't match a valid UNIX user in some way.</P
11077 ><P
11078 >The three settings are :</P
11079 ><P
11080 ></P
11081 ><UL
11082 ><LI
11083 ><P
11084 ><TT
11085 CLASS="CONSTANT"
11086 >Never</TT
11087 > - Means user login
11088                         requests with an invalid password are rejected. This is the
11089                         default.</P
11090 ></LI
11091 ><LI
11092 ><P
11093 ><TT
11094 CLASS="CONSTANT"
11095 >Bad User</TT
11096 > - Means user
11097                         logins with an invalid password are rejected, unless the username
11098                         does not exist, in which case it is treated as a guest login and
11099                         mapped into the <A
11100 HREF="#GUESTACCOUNT"
11101 ><TT
11102 CLASS="PARAMETER"
11103 ><I
11104 >                       guest account</I
11105 ></TT
11106 ></A
11107 >.</P
11108 ></LI
11109 ><LI
11110 ><P
11111 ><TT
11112 CLASS="CONSTANT"
11113 >Bad Password</TT
11114 > - Means user logins
11115                         with an invalid password are treated as a guest login and mapped
11116                         into the <A
11117 HREF="#GUESTACCOUNT"
11118 >guest account</A
11119 >. Note that
11120                         this can cause problems as it means that any user incorrectly typing
11121                         their password will be silently logged on as "guest" - and
11122                         will not know the reason they cannot access files they think
11123                         they should - there will have been no message given to them
11124                         that they got their password wrong. Helpdesk services will
11125                         <EM
11126 >hate</EM
11127 > you if you set the <TT
11128 CLASS="PARAMETER"
11129 ><I
11130 >map to
11131                         guest</I
11132 ></TT
11133 > parameter this way :-).</P
11134 ></LI
11135 ></UL
11136 ><P
11137 >Note that this parameter is needed to set up "Guest"
11138                 share services when using <TT
11139 CLASS="PARAMETER"
11140 ><I
11141 >security</I
11142 ></TT
11143 > modes other than
11144                 share. This is because in these modes the name of the resource being
11145                 requested is <EM
11146 >not</EM
11147 > sent to the server until after
11148                 the server has successfully authenticated the client so the server
11149                 cannot make authentication decisions at the correct time (connection
11150                 to the share) for "Guest" shares.</P
11151 ><P
11152 >For people familiar with the older Samba releases, this
11153                 parameter maps to the old compile-time setting of the <TT
11154 CLASS="CONSTANT"
11155 >               GUEST_SESSSETUP</TT
11156 > value in local.h.</P
11157 ><P
11158 >Default: <B
11159 CLASS="COMMAND"
11160 >map to guest = Never</B
11161 ></P
11162 ><P
11163 >Example: <B
11164 CLASS="COMMAND"
11165 >map to guest = Bad User</B
11166 ></P
11167 ></DD
11168 ><DT
11169 ><A
11170 NAME="MAXCONNECTIONS"
11171 ></A
11172 >max connections (S)</DT
11173 ><DD
11174 ><P
11175 >This option allows the number of simultaneous
11176                 connections to a service to be limited. If <TT
11177 CLASS="PARAMETER"
11178 ><I
11179 >max connections
11180                 </I
11181 ></TT
11182 > is greater than 0 then connections will be refused if
11183                 this number of connections to the service are already open. A value
11184                 of zero mean an unlimited number of connections may be made.</P
11185 ><P
11186 >Record lock files are used to implement this feature. The
11187                 lock files will be stored in the directory specified by the <A
11188 HREF="#LOCKDIRECTORY"
11189 ><TT
11190 CLASS="PARAMETER"
11191 ><I
11192 >lock directory</I
11193 ></TT
11194 ></A
11195 >
11196                 option.</P
11197 ><P
11198 >Default: <B
11199 CLASS="COMMAND"
11200 >max connections = 0</B
11201 ></P
11202 ><P
11203 >Example: <B
11204 CLASS="COMMAND"
11205 >max connections = 10</B
11206 ></P
11207 ></DD
11208 ><DT
11209 ><A
11210 NAME="MAXDISKSIZE"
11211 ></A
11212 >max disk size (G)</DT
11213 ><DD
11214 ><P
11215 >This option allows you to put an upper limit
11216                 on the apparent size of disks. If you set this option to 100
11217                 then all shares will appear to be not larger than 100 MB in
11218                 size.</P
11219 ><P
11220 >Note that this option does not limit the amount of
11221                 data you can put on the disk. In the above case you could still
11222                 store much more than 100 MB on the disk, but if a client ever asks
11223                 for the amount of free disk space or the total disk size then the
11224                 result will be bounded by the amount specified in <TT
11225 CLASS="PARAMETER"
11226 ><I
11227 >max
11228                 disk size</I
11229 ></TT
11230 >.</P
11231 ><P
11232 >This option is primarily useful to work around bugs
11233                 in some pieces of software that can't handle very large disks,
11234                 particularly disks over 1GB in size.</P
11235 ><P
11236 >A <TT
11237 CLASS="PARAMETER"
11238 ><I
11239 >max disk size</I
11240 ></TT
11241 > of 0 means no limit.</P
11242 ><P
11243 >Default: <B
11244 CLASS="COMMAND"
11245 >max disk size = 0</B
11246 ></P
11247 ><P
11248 >Example: <B
11249 CLASS="COMMAND"
11250 >max disk size = 1000</B
11251 ></P
11252 ></DD
11253 ><DT
11254 ><A
11255 NAME="MAXLOGSIZE"
11256 ></A
11257 >max log size (G)</DT
11258 ><DD
11259 ><P
11260 >This option (an integer in kilobytes) specifies
11261                 the max size the log file should grow to. Samba periodically checks
11262                 the size and if it is exceeded it will rename the file, adding
11263                 a <TT
11264 CLASS="FILENAME"
11265 >.old</TT
11266 > extension.</P
11267 ><P
11268 >A size of 0 means no limit.</P
11269 ><P
11270 >Default: <B
11271 CLASS="COMMAND"
11272 >max log size = 5000</B
11273 ></P
11274 ><P
11275 >Example: <B
11276 CLASS="COMMAND"
11277 >max log size = 1000</B
11278 ></P
11279 ></DD
11280 ><DT
11281 ><A
11282 NAME="MAXMUX"
11283 ></A
11284 >max mux (G)</DT
11285 ><DD
11286 ><P
11287 >This option controls the maximum number of
11288                 outstanding simultaneous SMB operations that Samba tells the client
11289                 it will allow. You should never need to set this parameter.</P
11290 ><P
11291 >Default: <B
11292 CLASS="COMMAND"
11293 >max mux = 50</B
11294 ></P
11295 ></DD
11296 ><DT
11297 ><A
11298 NAME="MAXOPENFILES"
11299 ></A
11300 >max open files (G)</DT
11301 ><DD
11302 ><P
11303 >This parameter limits the maximum number of
11304                 open files that one <A
11305 HREF="smbd.8.html"
11306 TARGET="_top"
11307 >smbd(8)</A
11308 > file
11309                 serving process may have open for a client at any one time. The
11310                 default for this parameter is set very high (10,000) as Samba uses
11311                 only one bit per unopened file.</P
11312 ><P
11313 >The limit of the number of open files is usually set
11314                 by the UNIX per-process file descriptor limit rather than
11315                 this parameter so you should never need to touch this parameter.</P
11316 ><P
11317 >Default: <B
11318 CLASS="COMMAND"
11319 >max open files = 10000</B
11320 ></P
11321 ></DD
11322 ><DT
11323 ><A
11324 NAME="MAXPRINTJOBS"
11325 ></A
11326 >max print jobs (S)</DT
11327 ><DD
11328 ><P
11329 >This parameter limits the maximum number of
11330                 jobs allowable in a Samba printer queue at any given moment.
11331                 If this number is exceeded, <A
11332 HREF="smbd.8.html"
11333 TARGET="_top"
11334 ><B
11335 CLASS="COMMAND"
11336 >               smbd(8)</B
11337 ></A
11338 > will remote "Out of Space" to the client.
11339                 See all <A
11340 HREF="#TOTALPRINTJOBS"
11341 ><TT
11342 CLASS="PARAMETER"
11343 ><I
11344 >total
11345                 print jobs</I
11346 ></TT
11347 ></A
11348 >.
11349                 </P
11350 ><P
11351 >Default: <B
11352 CLASS="COMMAND"
11353 >max print jobs = 1000</B
11354 ></P
11355 ><P
11356 >Example: <B
11357 CLASS="COMMAND"
11358 >max print jobs = 5000</B
11359 ></P
11360 ></DD
11361 ><DT
11362 ><A
11363 NAME="MAXPROTOCOL"
11364 ></A
11365 >max protocol (G)</DT
11366 ><DD
11367 ><P
11368 >The value of the parameter (a string) is the highest
11369                 protocol level that will be supported by the server.</P
11370 ><P
11371 >Possible values are :</P
11372 ><P
11373 ></P
11374 ><UL
11375 ><LI
11376 ><P
11377 ><TT
11378 CLASS="CONSTANT"
11379 >CORE</TT
11380 >: Earliest version. No
11381                         concept of user names.</P
11382 ></LI
11383 ><LI
11384 ><P
11385 ><TT
11386 CLASS="CONSTANT"
11387 >COREPLUS</TT
11388 >: Slight improvements on
11389                         CORE for efficiency.</P
11390 ></LI
11391 ><LI
11392 ><P
11393 ><TT
11394 CLASS="CONSTANT"
11395 >LANMAN1</TT
11396 >: First <EM
11397 >                       modern</EM
11398 > version of the protocol. Long filename
11399                         support.</P
11400 ></LI
11401 ><LI
11402 ><P
11403 ><TT
11404 CLASS="CONSTANT"
11405 >LANMAN2</TT
11406 >: Updates to Lanman1 protocol.
11407                         </P
11408 ></LI
11409 ><LI
11410 ><P
11411 ><TT
11412 CLASS="CONSTANT"
11413 >NT1</TT
11414 >: Current up to date version of
11415                         the protocol. Used by Windows NT. Known as CIFS.</P
11416 ></LI
11417 ></UL
11418 ><P
11419 >Normally this option should not be set as the automatic
11420                 negotiation phase in the SMB protocol takes care of choosing
11421                 the appropriate protocol.</P
11422 ><P
11423 >See also <A
11424 HREF="#MINPROTOCOL"
11425 ><TT
11426 CLASS="PARAMETER"
11427 ><I
11428 >min
11429                 protocol</I
11430 ></TT
11431 ></A
11432 ></P
11433 ><P
11434 >Default: <B
11435 CLASS="COMMAND"
11436 >max protocol = NT1</B
11437 ></P
11438 ><P
11439 >Example: <B
11440 CLASS="COMMAND"
11441 >max protocol = LANMAN1</B
11442 ></P
11443 ></DD
11444 ><DT
11445 ><A
11446 NAME="MAXSMBDPROCESSES"
11447 ></A
11448 >max smbd processes (G)</DT
11449 ><DD
11450 ><P
11451 >This parameter limits the maximum number of
11452                 <A
11453 HREF="smbd.8.html"
11454 TARGET="_top"
11455 ><B
11456 CLASS="COMMAND"
11457 >smbd(8)</B
11458 ></A
11459 >
11460                 processes concurrently running on a system and is intended
11461                 as a stopgap to prevent degrading service to clients in the event
11462                 that the server has insufficient resources to handle more than this
11463                 number of connections.  Remember that under normal operating
11464                 conditions, each user will have an <A
11465 HREF="smbd.8.html"
11466 TARGET="_top"
11467 >smbd</A
11468 > associated with him or her
11469                 to handle connections to all shares from a given host.
11470                 </P
11471 ><P
11472 >Default: <B
11473 CLASS="COMMAND"
11474 >max smbd processes = 0</B
11475 >   ## no limit</P
11476 ><P
11477 >Example: <B
11478 CLASS="COMMAND"
11479 >max smbd processes = 1000</B
11480 ></P
11481 ></DD
11482 ><DT
11483 ><A
11484 NAME="MAXTTL"
11485 ></A
11486 >max ttl (G)</DT
11487 ><DD
11488 ><P
11489 >This option tells <A
11490 HREF="nmbd.8.html"
11491 TARGET="_top"
11492 >nmbd(8)</A
11493 >
11494                 what the default 'time to live' of NetBIOS names should be (in seconds)
11495                 when <B
11496 CLASS="COMMAND"
11497 >nmbd</B
11498 > is requesting a name using either a
11499                 broadcast packet or from a WINS server. You should never need to
11500                 change this parameter. The default is 3 days.</P
11501 ><P
11502 >Default: <B
11503 CLASS="COMMAND"
11504 >max ttl = 259200</B
11505 ></P
11506 ></DD
11507 ><DT
11508 ><A
11509 NAME="MAXWINSTTL"
11510 ></A
11511 >max wins ttl (G)</DT
11512 ><DD
11513 ><P
11514 >This option tells <A
11515 HREF="nmbd.8.html"
11516 TARGET="_top"
11517 >nmbd(8)
11518                 </A
11519 > when acting as a WINS server (<A
11520 HREF="#WINSSUPPORT"
11521 >               <TT
11522 CLASS="PARAMETER"
11523 ><I
11524 >wins support = yes</I
11525 ></TT
11526 ></A
11527 >) what the maximum
11528                 'time to live' of NetBIOS names that <B
11529 CLASS="COMMAND"
11530 >nmbd</B
11531 >
11532                 will grant will be (in seconds). You should never need to change this
11533                 parameter.  The default is 6 days (518400 seconds).</P
11534 ><P
11535 >See also the <A
11536 HREF="#MINWINSTTL"
11537 ><TT
11538 CLASS="PARAMETER"
11539 ><I
11540 >min
11541                 wins ttl</I
11542 ></TT
11543 ></A
11544 > parameter.</P
11545 ><P
11546 >Default: <B
11547 CLASS="COMMAND"
11548 >max wins ttl = 518400</B
11549 ></P
11550 ></DD
11551 ><DT
11552 ><A
11553 NAME="MAXXMIT"
11554 ></A
11555 >max xmit (G)</DT
11556 ><DD
11557 ><P
11558 >This option controls the maximum packet size
11559                 that will be negotiated by Samba. The default is 65535, which
11560                 is the maximum. In some cases you may find you get better performance
11561                 with a smaller value. A value below 2048 is likely to cause problems.
11562                 </P
11563 ><P
11564 >Default: <B
11565 CLASS="COMMAND"
11566 >max xmit = 65535</B
11567 ></P
11568 ><P
11569 >Example: <B
11570 CLASS="COMMAND"
11571 >max xmit = 8192</B
11572 ></P
11573 ></DD
11574 ><DT
11575 ><A
11576 NAME="MESSAGECOMMAND"
11577 ></A
11578 >message command (G)</DT
11579 ><DD
11580 ><P
11581 >This specifies what command to run when the
11582                 server receives a WinPopup style message.</P
11583 ><P
11584 >This would normally be a command that would
11585                 deliver the message somehow. How this is to be done is
11586                 up to your imagination.</P
11587 ><P
11588 >An example is:</P
11589 ><P
11590 ><B
11591 CLASS="COMMAND"
11592 >message command = csh -c 'xedit %s;rm %s' &#38;</B
11593 >
11594                 </P
11595 ><P
11596 >This delivers the message using <B
11597 CLASS="COMMAND"
11598 >xedit</B
11599 >, then
11600                 removes it afterwards. <EM
11601 >NOTE THAT IT IS VERY IMPORTANT
11602                 THAT THIS COMMAND RETURN IMMEDIATELY</EM
11603 >. That's why I
11604                 have the '&#38;' on the end. If it doesn't return immediately then
11605                 your PCs may freeze when sending messages (they should recover
11606                 after 30 seconds, hopefully).</P
11607 ><P
11608 >All messages are delivered as the global guest user.
11609                 The command takes the standard substitutions, although <TT
11610 CLASS="PARAMETER"
11611 ><I
11612 >               %u</I
11613 ></TT
11614 > won't work (<TT
11615 CLASS="PARAMETER"
11616 ><I
11617 >%U</I
11618 ></TT
11619 > may be better
11620                 in this case).</P
11621 ><P
11622 >Apart from the standard substitutions, some additional
11623                 ones apply. In particular:</P
11624 ><P
11625 ></P
11626 ><UL
11627 ><LI
11628 ><P
11629 ><TT
11630 CLASS="PARAMETER"
11631 ><I
11632 >%s</I
11633 ></TT
11634 > = the filename containing
11635                         the message.</P
11636 ></LI
11637 ><LI
11638 ><P
11639 ><TT
11640 CLASS="PARAMETER"
11641 ><I
11642 >%t</I
11643 ></TT
11644 > = the destination that
11645                         the message was sent to (probably the server name).</P
11646 ></LI
11647 ><LI
11648 ><P
11649 ><TT
11650 CLASS="PARAMETER"
11651 ><I
11652 >%f</I
11653 ></TT
11654 > = who the message
11655                         is from.</P
11656 ></LI
11657 ></UL
11658 ><P
11659 >You could make this command send mail, or whatever else
11660                 takes your fancy. Please let us know of any really interesting
11661                 ideas you have.</P
11662 ><P
11663 >Here's a way of sending the messages as mail to root:</P
11664 ><P
11665 ><B
11666 CLASS="COMMAND"
11667 >message command = /bin/mail -s 'message from %f on
11668                 %m' root &#60; %s; rm %s</B
11669 ></P
11670 ><P
11671 >If you don't have a message command then the message
11672                 won't be delivered and Samba will tell the sender there was
11673                 an error. Unfortunately WfWg totally ignores the error code
11674                 and carries on regardless, saying that the message was delivered.
11675                 </P
11676 ><P
11677 >If you want to silently delete it then try:</P
11678 ><P
11679 ><B
11680 CLASS="COMMAND"
11681 >message command = rm %s</B
11682 ></P
11683 ><P
11684 >Default: <EM
11685 >no message command</EM
11686 ></P
11687 ><P
11688 >Example: <B
11689 CLASS="COMMAND"
11690 >message command = csh -c 'xedit %s;
11691                 rm %s' &#38;</B
11692 ></P
11693 ></DD
11694 ><DT
11695 ><A
11696 NAME="MINPASSWDLENGTH"
11697 ></A
11698 >min passwd length (G)</DT
11699 ><DD
11700 ><P
11701 >Synonym for <A
11702 HREF="#MINPASSWORDLENGTH"
11703 >               <TT
11704 CLASS="PARAMETER"
11705 ><I
11706 >min password length</I
11707 ></TT
11708 ></A
11709 >.</P
11710 ></DD
11711 ><DT
11712 ><A
11713 NAME="MINPASSWORDLENGTH"
11714 ></A
11715 >min password length (G)</DT
11716 ><DD
11717 ><P
11718 >This option sets the minimum length in characters
11719                 of a plaintext password that <B
11720 CLASS="COMMAND"
11721 >smbd</B
11722 > will accept when performing
11723                 UNIX password changing.</P
11724 ><P
11725 >See also <A
11726 HREF="#UNIXPASSWORDSYNC"
11727 ><TT
11728 CLASS="PARAMETER"
11729 ><I
11730 >unix
11731                 password sync</I
11732 ></TT
11733 ></A
11734 >, <A
11735 HREF="#PASSWDPROGRAM"
11736 >               <TT
11737 CLASS="PARAMETER"
11738 ><I
11739 >passwd program</I
11740 ></TT
11741 ></A
11742 > and <A
11743 HREF="#PASSWDCHATDEBUG"
11744 ><TT
11745 CLASS="PARAMETER"
11746 ><I
11747 >passwd chat debug</I
11748 ></TT
11749 >
11750                 </A
11751 >.</P
11752 ><P
11753 >Default: <B
11754 CLASS="COMMAND"
11755 >min password length = 5</B
11756 ></P
11757 ></DD
11758 ><DT
11759 ><A
11760 NAME="MINPRINTSPACE"
11761 ></A
11762 >min print space (S)</DT
11763 ><DD
11764 ><P
11765 >This sets the minimum amount of free disk
11766                 space that must be available before a user will be able to spool
11767                 a print job. It is specified in kilobytes. The default is 0, which
11768                 means a user can always spool a print job.</P
11769 ><P
11770 >See also the <A
11771 HREF="#PRINTING"
11772 ><TT
11773 CLASS="PARAMETER"
11774 ><I
11775 >printing
11776                 </I
11777 ></TT
11778 ></A
11779 > parameter.</P
11780 ><P
11781 >Default: <B
11782 CLASS="COMMAND"
11783 >min print space = 0</B
11784 ></P
11785 ><P
11786 >Example: <B
11787 CLASS="COMMAND"
11788 >min print space = 2000</B
11789 ></P
11790 ></DD
11791 ><DT
11792 ><A
11793 NAME="MINPROTOCOL"
11794 ></A
11795 >min protocol (G)</DT
11796 ><DD
11797 ><P
11798 >The value of the parameter (a string) is the
11799                 lowest SMB protocol dialect than Samba will support.  Please refer
11800                 to the <A
11801 HREF="#MAXPROTOCOL"
11802 ><TT
11803 CLASS="PARAMETER"
11804 ><I
11805 >max protocol</I
11806 ></TT
11807 ></A
11808 >
11809                 parameter for a list of valid protocol names and a brief description
11810                 of each.  You may also wish to refer to the C source code in
11811                 <TT
11812 CLASS="FILENAME"
11813 >source/smbd/negprot.c</TT
11814 > for a listing of known protocol
11815                 dialects supported by clients.</P
11816 ><P
11817 >If you are viewing this parameter as a security measure, you should
11818                 also refer to the <A
11819 HREF="#LANMANAUTH"
11820 ><TT
11821 CLASS="PARAMETER"
11822 ><I
11823 >lanman
11824                 auth</I
11825 ></TT
11826 ></A
11827 > parameter.  Otherwise, you should never need
11828                 to change this parameter.</P
11829 ><P
11830 >Default : <B
11831 CLASS="COMMAND"
11832 >min protocol = CORE</B
11833 ></P
11834 ><P
11835 >Example : <B
11836 CLASS="COMMAND"
11837 >min protocol = NT1</B
11838 >  # disable DOS
11839                 clients</P
11840 ></DD
11841 ><DT
11842 ><A
11843 NAME="MINWINSTTL"
11844 ></A
11845 >min wins ttl (G)</DT
11846 ><DD
11847 ><P
11848 >This option tells <A
11849 HREF="nmbd.8.html"
11850 TARGET="_top"
11851 >nmbd(8)</A
11852 >
11853                 when acting as a WINS server (<A
11854 HREF="#WINSSUPPORT"
11855 ><TT
11856 CLASS="PARAMETER"
11857 ><I
11858 >               wins support = yes</I
11859 ></TT
11860 ></A
11861 >) what the minimum 'time to live'
11862                 of NetBIOS names that <B
11863 CLASS="COMMAND"
11864 >nmbd</B
11865 > will grant will be (in
11866                 seconds). You should never need to change this parameter.  The default
11867                 is 6 hours (21600 seconds).</P
11868 ><P
11869 >Default: <B
11870 CLASS="COMMAND"
11871 >min wins ttl = 21600</B
11872 ></P
11873 ></DD
11874 ><DT
11875 ><A
11876 NAME="MSDFSROOT"
11877 ></A
11878 >msdfs root (S)</DT
11879 ><DD
11880 ><P
11881 >This boolean parameter is only available if
11882                 Samba is configured  and  compiled with the <B
11883 CLASS="COMMAND"
11884 >               --with-msdfs</B
11885 > option.  If set to <TT
11886 CLASS="CONSTANT"
11887 >yes</TT
11888 >,
11889                 Samba treats the share as a Dfs root and  allows clients to browse
11890                 the distributed file system tree rooted at the share directory.
11891                 Dfs links are specified  in  the share directory by symbolic
11892                 links of the form <TT
11893 CLASS="FILENAME"
11894 >msdfs:serverA\shareA,serverB\shareB
11895                 </TT
11896 > and so on.  For more information on setting up a Dfs tree
11897                 on Samba,  refer to <A
11898 HREF="msdfs_setup.html"
11899 TARGET="_top"
11900 >msdfs_setup.html
11901                 </A
11902 >.</P
11903 ><P
11904 >See also <A
11905 HREF="#HOSTMSDFS"
11906 ><TT
11907 CLASS="PARAMETER"
11908 ><I
11909 >host msdfs
11910                 </I
11911 ></TT
11912 ></A
11913 ></P
11914 ><P
11915 >Default: <B
11916 CLASS="COMMAND"
11917 >msdfs root = no</B
11918 ></P
11919 ></DD
11920 ><DT
11921 ><A
11922 NAME="NAMERESOLVEORDER"
11923 ></A
11924 >name resolve order (G)</DT
11925 ><DD
11926 ><P
11927 >This option is used by the programs in the Samba
11928                 suite to determine what naming services to use and in what order
11929                 to resolve host names to IP addresses. The option takes a space
11930                 separated string of name resolution options.</P
11931 ><P
11932 >The options are :"lmhosts", "host", "wins" and "bcast". They
11933                 cause names to be resolved as follows :</P
11934 ><P
11935 ></P
11936 ><UL
11937 ><LI
11938 ><P
11939 ><TT
11940 CLASS="CONSTANT"
11941 >lmhosts</TT
11942 > : Lookup an IP
11943                         address in the Samba lmhosts file. If the line in lmhosts has
11944                         no name type attached to the NetBIOS name (see the <A
11945 HREF="lmhosts.5.html"
11946 TARGET="_top"
11947 >lmhosts(5)</A
11948 > for details) then
11949                         any name type matches for lookup.</P
11950 ></LI
11951 ><LI
11952 ><P
11953 ><TT
11954 CLASS="CONSTANT"
11955 >host</TT
11956 > : Do a standard host
11957                         name to IP address resolution, using the system <TT
11958 CLASS="FILENAME"
11959 >/etc/hosts
11960                         </TT
11961 >, NIS, or DNS lookups. This method of name resolution
11962                         is operating system depended for instance on IRIX or Solaris this
11963                         may be controlled by the <TT
11964 CLASS="FILENAME"
11965 >/etc/nsswitch.conf</TT
11966 >
11967                         file.  Note that this method is only used if the NetBIOS name
11968                         type being queried is the 0x20 (server) name type, otherwise
11969                         it is ignored.</P
11970 ></LI
11971 ><LI
11972 ><P
11973 ><TT
11974 CLASS="CONSTANT"
11975 >wins</TT
11976 > : Query a name with
11977                         the IP address listed in the <A
11978 HREF="#WINSSERVER"
11979 ><TT
11980 CLASS="PARAMETER"
11981 ><I
11982 >                       wins server</I
11983 ></TT
11984 ></A
11985 > parameter.  If no WINS server has
11986                         been specified this method will be ignored.</P
11987 ></LI
11988 ><LI
11989 ><P
11990 ><TT
11991 CLASS="CONSTANT"
11992 >bcast</TT
11993 > : Do a broadcast on
11994                         each of the known local interfaces listed in the <A
11995 HREF="#INTERFACES"
11996 ><TT
11997 CLASS="PARAMETER"
11998 ><I
11999 >interfaces</I
12000 ></TT
12001 ></A
12002 >
12003                         parameter. This is the least reliable of the name resolution
12004                         methods as it depends on the target host being on a locally
12005                         connected subnet.</P
12006 ></LI
12007 ></UL
12008 ><P
12009 >Default: <B
12010 CLASS="COMMAND"
12011 >name resolve order = lmhosts host wins bcast
12012                 </B
12013 ></P
12014 ><P
12015 >Example: <B
12016 CLASS="COMMAND"
12017 >name resolve order = lmhosts bcast host
12018                 </B
12019 ></P
12020 ><P
12021 >This will cause the local lmhosts file to be examined
12022                 first, followed by a broadcast attempt, followed by a normal
12023                 system hostname lookup.</P
12024 ></DD
12025 ><DT
12026 ><A
12027 NAME="NETBIOSALIASES"
12028 ></A
12029 >netbios aliases (G)</DT
12030 ><DD
12031 ><P
12032 >This is a list of NetBIOS names that <A
12033 HREF="nmbd.8.html"
12034 TARGET="_top"
12035 >nmbd(8)</A
12036 > will advertise as additional
12037                 names by which the Samba server is known. This allows one machine
12038                 to appear in browse lists under multiple names. If a machine is
12039                 acting as a browse server or logon server none
12040                 of these names will be advertised as either browse server or logon
12041                 servers, only the primary name of the machine will be advertised
12042                 with these capabilities.</P
12043 ><P
12044 >See also <A
12045 HREF="#NETBIOSNAME"
12046 ><TT
12047 CLASS="PARAMETER"
12048 ><I
12049 >netbios
12050                 name</I
12051 ></TT
12052 ></A
12053 >.</P
12054 ><P
12055 >Default: <EM
12056 >empty string (no additional names)</EM
12057 ></P
12058 ><P
12059 >Example: <B
12060 CLASS="COMMAND"
12061 >netbios aliases = TEST TEST1 TEST2</B
12062 ></P
12063 ></DD
12064 ><DT
12065 ><A
12066 NAME="NETBIOSNAME"
12067 ></A
12068 >netbios name (G)</DT
12069 ><DD
12070 ><P
12071 >This sets the NetBIOS name by which a Samba
12072                 server is known. By default it is the same as the first component
12073                 of the host's DNS name. If a machine is a browse server or
12074                 logon server this name (or the first component
12075                 of the hosts DNS name) will be the name that these services are
12076                 advertised under.</P
12077 ><P
12078 >See also <A
12079 HREF="#NETBIOSALIASES"
12080 ><TT
12081 CLASS="PARAMETER"
12082 ><I
12083 >netbios
12084                 aliases</I
12085 ></TT
12086 ></A
12087 >.</P
12088 ><P
12089 >Default: <EM
12090 >machine DNS name</EM
12091 ></P
12092 ><P
12093 >Example: <B
12094 CLASS="COMMAND"
12095 >netbios name = MYNAME</B
12096 ></P
12097 ></DD
12098 ><DT
12099 ><A
12100 NAME="NETBIOSSCOPE"
12101 ></A
12102 >netbios scope (G)</DT
12103 ><DD
12104 ><P
12105 >This sets the NetBIOS scope that Samba will
12106                 operate under. This should not be set unless every machine
12107                 on your LAN also sets this value.</P
12108 ></DD
12109 ><DT
12110 ><A
12111 NAME="NISHOMEDIR"
12112 ></A
12113 >nis homedir (G)</DT
12114 ><DD
12115 ><P
12116 >Get the home share server from a NIS map. For
12117                 UNIX systems that use an automounter, the user's home directory
12118                 will often be mounted on a workstation on demand from a remote
12119                 server. </P
12120 ><P
12121 >When the Samba logon server is not the actual home directory
12122                 server, but is mounting the home directories via NFS then two
12123                 network hops would be required to access the users home directory
12124                 if the logon server told the client to use itself as the SMB server
12125                 for home directories (one over SMB and one over NFS). This can
12126                 be very slow.</P
12127 ><P
12128 >This option allows Samba to return the home share as
12129                 being on a different server to the logon server and as
12130                 long as a Samba daemon is running on the home directory server,
12131                 it will be mounted on the Samba client directly from the directory
12132                 server. When Samba is returning the home share to the client, it
12133                 will consult the NIS map specified in <A
12134 HREF="#HOMEDIRMAP"
12135 >               <TT
12136 CLASS="PARAMETER"
12137 ><I
12138 >homedir map</I
12139 ></TT
12140 ></A
12141 > and return the server
12142                 listed there.</P
12143 ><P
12144 >Note that for this option to work there must be a working
12145                 NIS system and the Samba server with this option must also
12146                 be a logon server.</P
12147 ><P
12148 >Default: <B
12149 CLASS="COMMAND"
12150 >nis homedir = no</B
12151 ></P
12152 ></DD
12153 ><DT
12154 ><A
12155 NAME="NONUNIXACCOUNTRANGE"
12156 ></A
12157 >non unix account range (G)</DT
12158 ><DD
12159 ><P
12160 >The non unix account range parameter specifies
12161                 the range of 'user ids' that are allocated by the various 'non unix
12162                 account' passdb backends.  These backends allow
12163                 the storage of passwords for users who don't exist in /etc/passwd.
12164                 This is most often used for machine account creation.
12165                 This range of ids should have no existing local or NIS users within
12166                 it as strange conflicts can occur otherwise.</P
12167 ><P
12168 >NOTE: These userids never appear on the system and Samba will never
12169                 'become' these users. They are used only to ensure that the algorithmic
12170                 RID mapping does not conflict with normal users.
12171                 </P
12172 ><P
12173 >Default: <B
12174 CLASS="COMMAND"
12175 >non unix account range = &#60;empty string&#62;
12176                 </B
12177 ></P
12178 ><P
12179 >Example: <B
12180 CLASS="COMMAND"
12181 >non unix account range = 10000-20000</B
12182 ></P
12183 ></DD
12184 ><DT
12185 ><A
12186 NAME="NTACLSUPPORT"
12187 ></A
12188 >nt acl support (S)</DT
12189 ><DD
12190 ><P
12191 >This boolean parameter controls whether
12192                 <A
12193 HREF="smbd.8.html"
12194 TARGET="_top"
12195 >smbd(8)</A
12196 > will attempt to map
12197                 UNIX permissions into Windows NT access control lists.
12198                 This parameter was formally a global parameter in releases
12199                 prior to 2.2.2.</P
12200 ><P
12201 >Default: <B
12202 CLASS="COMMAND"
12203 >nt acl support = yes</B
12204 ></P
12205 ></DD
12206 ><DT
12207 ><A
12208 NAME="NTPIPESUPPORT"
12209 ></A
12210 >nt pipe support (G)</DT
12211 ><DD
12212 ><P
12213 >This boolean parameter controls whether
12214                 <A
12215 HREF="smbd.8.html"
12216 TARGET="_top"
12217 >smbd(8)</A
12218 > will allow Windows NT
12219                 clients to connect to the NT SMB specific <TT
12220 CLASS="CONSTANT"
12221 >IPC$</TT
12222 >
12223                 pipes. This is a developer debugging option and can be left
12224                 alone.</P
12225 ><P
12226 >Default: <B
12227 CLASS="COMMAND"
12228 >nt pipe support = yes</B
12229 ></P
12230 ></DD
12231 ><DT
12232 ><A
12233 NAME="NULLPASSWORDS"
12234 ></A
12235 >null passwords (G)</DT
12236 ><DD
12237 ><P
12238 >Allow or disallow client access to accounts
12239                 that have null passwords. </P
12240 ><P
12241 >See also <A
12242 HREF="smbpasswd.5.html"
12243 TARGET="_top"
12244 >smbpasswd (5)</A
12245 >.</P
12246 ><P
12247 >Default: <B
12248 CLASS="COMMAND"
12249 >null passwords = no</B
12250 ></P
12251 ></DD
12252 ><DT
12253 ><A
12254 NAME="OBEYPAMRESTRICTIONS"
12255 ></A
12256 >obey pam restrictions (G)</DT
12257 ><DD
12258 ><P
12259 >When Samba 2.2 is configured to enable PAM support
12260                 (i.e. --with-pam), this parameter will control whether or not Samba
12261                 should obey PAM's account and session management directives.  The
12262                 default behavior is to use PAM for clear text authentication only
12263                 and to ignore any account or session management.  Note that Samba
12264                 always ignores PAM for authentication in the case of <A
12265 HREF="#ENCRYPTPASSWORDS"
12266 ><TT
12267 CLASS="PARAMETER"
12268 ><I
12269 >encrypt passwords = yes</I
12270 ></TT
12271 >
12272                 </A
12273 >.  The reason is that PAM modules cannot support the challenge/response
12274                 authentication mechanism needed in the presence of SMB password encryption.
12275                 </P
12276 ><P
12277 >Default: <B
12278 CLASS="COMMAND"
12279 >obey pam restrictions = no</B
12280 ></P
12281 ></DD
12282 ><DT
12283 ><A
12284 NAME="ONLYUSER"
12285 ></A
12286 >only user (S)</DT
12287 ><DD
12288 ><P
12289 >This is a boolean option that controls whether
12290                 connections with usernames not in the <TT
12291 CLASS="PARAMETER"
12292 ><I
12293 >user</I
12294 ></TT
12295 >
12296                 list will be allowed. By default this option is disabled so that a
12297                 client can supply a username to be used by the server.  Enabling
12298                 this parameter will force the server to only user the login
12299                 names from the <TT
12300 CLASS="PARAMETER"
12301 ><I
12302 >user</I
12303 ></TT
12304 > list and is only really
12305                 useful in <A
12306 HREF="#SECURITYEQUALSSHARE"
12307 >shave level</A
12308 >
12309                 security.</P
12310 ><P
12311 >Note that this also means Samba won't try to deduce
12312                 usernames from the service name. This can be annoying for
12313                 the [homes] section. To get around this you could use <B
12314 CLASS="COMMAND"
12315 >user =
12316                 %S</B
12317 > which means your <TT
12318 CLASS="PARAMETER"
12319 ><I
12320 >user</I
12321 ></TT
12322 > list
12323                 will be just the service name, which for home directories is the
12324                 name of the user.</P
12325 ><P
12326 >See also the <A
12327 HREF="#USER"
12328 ><TT
12329 CLASS="PARAMETER"
12330 ><I
12331 >user</I
12332 ></TT
12333 >
12334                 </A
12335 > parameter.</P
12336 ><P
12337 >Default: <B
12338 CLASS="COMMAND"
12339 >only user = no</B
12340 ></P
12341 ></DD
12342 ><DT
12343 ><A
12344 NAME="ONLYGUEST"
12345 ></A
12346 >only guest (S)</DT
12347 ><DD
12348 ><P
12349 >A synonym for <A
12350 HREF="#GUESTONLY"
12351 ><TT
12352 CLASS="PARAMETER"
12353 ><I
12354 >               guest only</I
12355 ></TT
12356 ></A
12357 >.</P
12358 ></DD
12359 ><DT
12360 ><A
12361 NAME="OPLOCKBREAKWAITTIME"
12362 ></A
12363 >oplock break wait time (G)</DT
12364 ><DD
12365 ><P
12366 >This is a tuning parameter added due to bugs in
12367                 both Windows 9x and WinNT. If Samba responds to a client too
12368                 quickly when that client issues an SMB that can cause an oplock
12369                 break request, then the network client can fail and not respond
12370                 to the break request. This tuning parameter (which is set in milliseconds)
12371                 is the amount of time Samba will wait before sending an oplock break
12372                 request to such (broken) clients.</P
12373 ><P
12374 ><EM
12375 >DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ
12376                 AND UNDERSTOOD THE SAMBA OPLOCK CODE</EM
12377 >.</P
12378 ><P
12379 >Default: <B
12380 CLASS="COMMAND"
12381 >oplock break wait time = 0</B
12382 ></P
12383 ></DD
12384 ><DT
12385 ><A
12386 NAME="OPLOCKCONTENTIONLIMIT"
12387 ></A
12388 >oplock contention limit (S)</DT
12389 ><DD
12390 ><P
12391 >This is a <EM
12392 >very</EM
12393 > advanced
12394                 <A
12395 HREF="smbd.8.html"
12396 TARGET="_top"
12397 >smbd(8)</A
12398 > tuning option to
12399                 improve the efficiency of the granting of oplocks under multiple
12400                 client contention for the same file.</P
12401 ><P
12402 >In brief it specifies a number, which causes <A
12403 HREF="smbd.8.html"
12404 TARGET="_top"
12405 >smbd</A
12406 > not to
12407                 grant an oplock even when requested if the approximate number of
12408                 clients contending for an oplock on the same file goes over this
12409                 limit. This causes <B
12410 CLASS="COMMAND"
12411 >smbd</B
12412 > to behave in a similar
12413                 way to Windows NT.</P
12414 ><P
12415 ><EM
12416 >DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ
12417                 AND UNDERSTOOD THE SAMBA OPLOCK CODE</EM
12418 >.</P
12419 ><P
12420 >Default: <B
12421 CLASS="COMMAND"
12422 >oplock contention limit = 2</B
12423 ></P
12424 ></DD
12425 ><DT
12426 ><A
12427 NAME="OPLOCKS"
12428 ></A
12429 >oplocks (S)</DT
12430 ><DD
12431 ><P
12432 >This boolean option tells <B
12433 CLASS="COMMAND"
12434 >smbd</B
12435 > whether to
12436                 issue oplocks (opportunistic locks) to file open requests on this
12437                 share. The oplock code can dramatically (approx. 30% or more) improve
12438                 the speed of access to files on Samba servers. It allows the clients
12439                 to aggressively cache files locally and you may want to disable this
12440                 option for unreliable network environments (it is turned on by
12441                 default in Windows NT Servers).  For more information see the file
12442                 <TT
12443 CLASS="FILENAME"
12444 >Speed.txt</TT
12445 > in the Samba <TT
12446 CLASS="FILENAME"
12447 >docs/</TT
12448 >
12449                 directory.</P
12450 ><P
12451 >Oplocks may be selectively turned off on certain files with a
12452                 share. See the <A
12453 HREF="#VETOOPLOCKFILES"
12454 ><TT
12455 CLASS="PARAMETER"
12456 ><I
12457 >               veto oplock files</I
12458 ></TT
12459 ></A
12460 > parameter. On some systems
12461                 oplocks are recognized by the underlying operating system. This
12462                 allows data synchronization between all access to oplocked files,
12463                 whether it be via Samba or NFS or a local UNIX process. See the
12464                 <TT
12465 CLASS="PARAMETER"
12466 ><I
12467 >kernel oplocks</I
12468 ></TT
12469 > parameter for details.</P
12470 ><P
12471 >See also the <A
12472 HREF="#KERNELOPLOCKS"
12473 ><TT
12474 CLASS="PARAMETER"
12475 ><I
12476 >kernel
12477                 oplocks</I
12478 ></TT
12479 ></A
12480 > and <A
12481 HREF="#LEVEL2OPLOCKS"
12482 ><TT
12483 CLASS="PARAMETER"
12484 ><I
12485 >               level2 oplocks</I
12486 ></TT
12487 ></A
12488 > parameters.</P
12489 ><P
12490 >Default: <B
12491 CLASS="COMMAND"
12492 >oplocks = yes</B
12493 ></P
12494 ></DD
12495 ><DT
12496 ><A
12497 NAME="OSLEVEL"
12498 ></A
12499 >os level (G)</DT
12500 ><DD
12501 ><P
12502 >This integer value controls what level Samba
12503                 advertises itself as for browse elections. The value of this
12504                 parameter determines whether <A
12505 HREF="nmbd.8.html"
12506 TARGET="_top"
12507 >nmbd(8)</A
12508 >
12509                 has a chance of becoming a local master browser for the <TT
12510 CLASS="PARAMETER"
12511 ><I
12512 >               WORKGROUP</I
12513 ></TT
12514 > in the local broadcast area.</P
12515 ><P
12516 ><EM
12517 >Note :</EM
12518 >By default, Samba will win
12519                 a local master browsing election over all Microsoft operating
12520                 systems except a Windows NT 4.0/2000 Domain Controller.  This
12521                 means that a misconfigured Samba host can effectively isolate
12522                 a subnet for browsing purposes.  See <TT
12523 CLASS="FILENAME"
12524 >BROWSING.txt
12525                 </TT
12526 > in the Samba <TT
12527 CLASS="FILENAME"
12528 >docs/</TT
12529 > directory
12530                 for details.</P
12531 ><P
12532 >Default: <B
12533 CLASS="COMMAND"
12534 >os level = 20</B
12535 ></P
12536 ><P
12537 >Example: <B
12538 CLASS="COMMAND"
12539 >os level = 65 </B
12540 ></P
12541 ></DD
12542 ><DT
12543 ><A
12544 NAME="OS2DRIVERMAP"
12545 ></A
12546 >os2 driver map (G)</DT
12547 ><DD
12548 ><P
12549 >The parameter is used to define the absolute
12550                 path to a file containing a mapping of Windows NT printer driver
12551                 names to OS/2 printer driver names.  The format is:</P
12552 ><P
12553 >&#60;nt driver name&#62; = &#60;os2 driver
12554                 name&#62;.&#60;device name&#62;</P
12555 ><P
12556 >For example, a valid entry using the HP LaserJet 5
12557                 printer driver would appear as <B
12558 CLASS="COMMAND"
12559 >HP LaserJet 5L = LASERJET.HP
12560                 LaserJet 5L</B
12561 >.</P
12562 ><P
12563 >The need for the file is due to the printer driver namespace
12564                 problem described in the <A
12565 HREF="printer_driver2.html"
12566 TARGET="_top"
12567 >Samba
12568                 Printing HOWTO</A
12569 >.  For more details on OS/2 clients, please
12570                 refer to the <A
12571 HREF="OS2-Client-HOWTO.html"
12572 TARGET="_top"
12573 >OS2-Client-HOWTO
12574                 </A
12575 > containing in the Samba documentation.</P
12576 ><P
12577 >Default: <B
12578 CLASS="COMMAND"
12579 >os2 driver map = &#60;empty string&#62;
12580                 </B
12581 ></P
12582 ></DD
12583 ><DT
12584 ><A
12585 NAME="PAMPASSWORDCHANGE"
12586 ></A
12587 >pam password change (G)</DT
12588 ><DD
12589 ><P
12590 >With the addition of better PAM support in Samba 2.2,
12591                 this parameter, it is possible to use PAM's password change control
12592                 flag for Samba.  If enabled, then PAM will be used for password
12593                 changes when requested by an SMB client instead of the program listed in
12594                 <A
12595 HREF="#PASSWDPROGRAM"
12596 ><TT
12597 CLASS="PARAMETER"
12598 ><I
12599 >passwd program</I
12600 ></TT
12601 ></A
12602 >.
12603                 It should be possible to enable this without changing your
12604                 <A
12605 HREF="#PASSWDCHAT"
12606 ><TT
12607 CLASS="PARAMETER"
12608 ><I
12609 >passwd chat</I
12610 ></TT
12611 ></A
12612 >
12613                 parameter for most setups.
12614                 </P
12615 ><P
12616 >Default: <B
12617 CLASS="COMMAND"
12618 >pam password change = no</B
12619 ></P
12620 ></DD
12621 ><DT
12622 ><A
12623 NAME="PANICACTION"
12624 ></A
12625 >panic action (G)</DT
12626 ><DD
12627 ><P
12628 >This is a Samba developer option that allows a
12629                 system command to be called when either <A
12630 HREF="smbd.8.html"
12631 TARGET="_top"
12632 >               smbd(8)</A
12633 > or <A
12634 HREF="nmbd.8.html"
12635 TARGET="_top"
12636 >nmbd(8)</A
12637 >
12638                 crashes. This is usually used to draw attention to the fact that
12639                 a problem occurred.</P
12640 ><P
12641 >Default: <B
12642 CLASS="COMMAND"
12643 >panic action = &#60;empty string&#62;</B
12644 ></P
12645 ><P
12646 >Example: <B
12647 CLASS="COMMAND"
12648 >panic action = "/bin/sleep 90000"</B
12649 ></P
12650 ></DD
12651 ><DT
12652 ><A
12653 NAME="PASSDBBACKEND"
12654 ></A
12655 >passdb backend (G)</DT
12656 ><DD
12657 ><P
12658 >This option allows the administrator to chose what
12659                 backend in which to store passwords.  This allows (for example) both
12660                 smbpasswd and tdbsam to be used without a recompile.  Only one can
12661                 be used at a time however, and experimental backends must still be selected
12662                 (eg --with-tdbsam) at configure time.
12663                 </P
12664 ><P
12665 >This paramater is in two parts, the backend's name, and a 'location'
12666                 string that has meaning only to that particular backed.  These are separated
12667                 by a : character.</P
12668 ><P
12669 >Available backends can include:
12670                 <P
12671 ></P
12672 ><UL
12673 ><LI
12674 ><P
12675 ><B
12676 CLASS="COMMAND"
12677 >smbpasswd</B
12678 > - The default smbpasswd
12679                         backend.  Takes a path to the smbpasswd file as an optional argument.</P
12680 ></LI
12681 ><LI
12682 ><P
12683 ><B
12684 CLASS="COMMAND"
12685 >smbpasswd_nua</B
12686 > - The smbpasswd
12687                         backend, but with support for 'not unix accounts'.
12688                         Takes a path to the smbpasswd file as an optional argument.</P
12689 ><P
12690 >See also <A
12691 HREF="#NONUNIXACCOUNTRANGE"
12692 >                        <TT
12693 CLASS="PARAMETER"
12694 ><I
12695 >non unix account range</I
12696 ></TT
12697 ></A
12698 ></P
12699 ></LI
12700 ><LI
12701 ><P
12702 ><B
12703 CLASS="COMMAND"
12704 >tdbsam</B
12705 > - The TDB based password storage
12706                         backend.  Takes a path to the TDB as an optional argument (defaults to passdb.tdb
12707                         in the <A
12708 HREF="#PRIVATEDIR"
12709 >                        <TT
12710 CLASS="PARAMETER"
12711 ><I
12712 >private dir</I
12713 ></TT
12714 ></A
12715 > directory.</P
12716 ></LI
12717 ><LI
12718 ><P
12719 ><B
12720 CLASS="COMMAND"
12721 >tdbsam_nua</B
12722 > - The TDB based password storage
12723                         backend, with non unix account support.  Takes a path to the TDB as an optional argument (defaults to passdb.tdb
12724                         in the <A
12725 HREF="#PRIVATEDIR"
12726 >                        <TT
12727 CLASS="PARAMETER"
12728 ><I
12729 >private dir</I
12730 ></TT
12731 ></A
12732 > directory.</P
12733 ><P
12734 >See also <A
12735 HREF="#NONUNIXACCOUNTRANGE"
12736 >                        <TT
12737 CLASS="PARAMETER"
12738 ><I
12739 >non unix account range</I
12740 ></TT
12741 ></A
12742 ></P
12743 ></LI
12744 ><LI
12745 ><P
12746 ><B
12747 CLASS="COMMAND"
12748 >ldapsam</B
12749 > - The LDAP based passdb
12750                         backend.  Takes an LDAP URL as an optional argument (defaults to
12751                         <B
12752 CLASS="COMMAND"
12753 >ldap://localhost</B
12754 >)</P
12755 ></LI
12756 ><LI
12757 ><P
12758 ><B
12759 CLASS="COMMAND"
12760 >ldapsam_nua</B
12761 > - The LDAP based passdb
12762                         backend, with non unix account support.  Takes an LDAP URL as an optional argument (defaults to
12763                         <B
12764 CLASS="COMMAND"
12765 >ldap://localhost</B
12766 >)</P
12767 ><P
12768 >See also <A
12769 HREF="#NONUNIXACCOUNTRANGE"
12770 >                        <TT
12771 CLASS="PARAMETER"
12772 ><I
12773 >non unix account range</I
12774 ></TT
12775 ></A
12776 ></P
12777 ></LI
12778 ><LI
12779 ><P
12780 ><B
12781 CLASS="COMMAND"
12782 >plugin</B
12783 > - Allows Samba to load an
12784                         arbitary passdb backend from the .so specified as a compulsary argument.
12785                         </P
12786 ><P
12787 >Any characters after the (optional) second : are passed to the plugin
12788                         for its own processing</P
12789 ></LI
12790 ></UL
12791 >
12792                 </P
12793 ><P
12794 >Default: <B
12795 CLASS="COMMAND"
12796 >passdb backend = smbpasswd</B
12797 ></P
12798 ><P
12799 >Example: <B
12800 CLASS="COMMAND"
12801 >passdb backend = tdbsam:/etc/samba/private/passdb.tdb</B
12802 ></P
12803 ><P
12804 >Example: <B
12805 CLASS="COMMAND"
12806 >passdb backend = ldapsam_nua:ldaps://ldap.example.com</B
12807 ></P
12808 ><P
12809 >Example: <B
12810 CLASS="COMMAND"
12811 >passdb backend = plugin:/usr/local/samba/lib/my_passdb.so:my_plugin_args</B
12812 ></P
12813 ></DD
12814 ><DT
12815 ><A
12816 NAME="PASSWDCHAT"
12817 ></A
12818 >passwd chat (G)</DT
12819 ><DD
12820 ><P
12821 >This string controls the <EM
12822 >"chat"</EM
12823 >
12824                 conversation that takes places between <A
12825 HREF="smbd.8.html"
12826 TARGET="_top"
12827 >smbd</A
12828 > and the local password changing
12829                 program to change the user's password. The string describes a
12830                 sequence of response-receive pairs that <A
12831 HREF="smbd.8.html"
12832 TARGET="_top"
12833 >               smbd(8)</A
12834 > uses to determine what to send to the
12835                 <A
12836 HREF="#PASSWDPROGRAM"
12837 ><TT
12838 CLASS="PARAMETER"
12839 ><I
12840 >passwd program</I
12841 ></TT
12842 >
12843                 </A
12844 > and what to expect back. If the expected output is not
12845                 received then the password is not changed.</P
12846 ><P
12847 >This chat sequence is often quite site specific, depending
12848                 on what local methods are used for password control (such as NIS
12849                 etc).</P
12850 ><P
12851 >Note that this parameter only is only used if the <A
12852 HREF="#UNIXPASSWORDSYNC"
12853 ><TT
12854 CLASS="PARAMETER"
12855 ><I
12856 >unix
12857                 password sync</I
12858 ></TT
12859 ></A
12860 > parameter is set to <TT
12861 CLASS="CONSTANT"
12862 >yes</TT
12863 >. This
12864                 sequence is then called <EM
12865 >AS ROOT</EM
12866 > when the SMB password
12867                 in the smbpasswd file is being changed, without access to the old
12868                 password cleartext. This means that root must be able to reset the user's password
12869                 without knowing the text of the previous password. In the presence of NIS/YP,
12870                 this means that the <A
12871 HREF="#PASSWDPROGRAM"
12872 >passwd program</A
12873 > must be
12874                 executed on the NIS master.
12875                 </P
12876 ><P
12877 >The string can contain the macro <TT
12878 CLASS="PARAMETER"
12879 ><I
12880 >%n</I
12881 ></TT
12882 > which is substituted
12883                 for the new password.  The chat sequence can also contain the standard
12884                 macros <TT
12885 CLASS="CONSTANT"
12886 >\n</TT
12887 >, <TT
12888 CLASS="CONSTANT"
12889 >\r</TT
12890 >, <TT
12891 CLASS="CONSTANT"
12892 >               \t</TT
12893 > and <TT
12894 CLASS="CONSTANT"
12895 >\s</TT
12896 > to give line-feed,
12897                 carriage-return, tab and space.  The chat sequence string can also contain
12898                 a '*' which matches any sequence of characters.
12899                 Double quotes can be used to collect strings with spaces
12900                 in them into a single string.</P
12901 ><P
12902 >If the send string in any part of the chat sequence
12903                 is a full stop ".",  then no string is sent. Similarly,
12904                 if the expect string is a full stop then no string is expected.</P
12905 ><P
12906 >If the <A
12907 HREF="#PAMPASSWORDCHANGE"
12908 ><TT
12909 CLASS="PARAMETER"
12910 ><I
12911 >pam
12912                 password change</I
12913 ></TT
12914 ></A
12915 > parameter is set to true, the chat pairs
12916                 may be matched in any order, and success is determined by the PAM result,
12917                 not any particular output. The \n macro is ignored for PAM conversions.
12918                 </P
12919 ><P
12920 >See also <A
12921 HREF="#UNIXPASSWORDSYNC"
12922 ><TT
12923 CLASS="PARAMETER"
12924 ><I
12925 >unix password
12926                 sync</I
12927 ></TT
12928 ></A
12929 >, <A
12930 HREF="#PASSWDPROGRAM"
12931 ><TT
12932 CLASS="PARAMETER"
12933 ><I
12934 >               passwd program</I
12935 ></TT
12936 ></A
12937 > ,<A
12938 HREF="#PASSWDCHATDEBUG"
12939 >               <TT
12940 CLASS="PARAMETER"
12941 ><I
12942 >passwd chat debug</I
12943 ></TT
12944 ></A
12945 > and <A
12946 HREF="#PAMPASSWORDCHANGE"
12947 >               <TT
12948 CLASS="PARAMETER"
12949 ><I
12950 >pam password change</I
12951 ></TT
12952 ></A
12953 >.</P
12954 ><P
12955 >Default: <B
12956 CLASS="COMMAND"
12957 >passwd chat = *new*password* %n\n
12958                 *new*password* %n\n *changed*</B
12959 ></P
12960 ><P
12961 >Example: <B
12962 CLASS="COMMAND"
12963 >passwd chat = "*Enter OLD password*" %o\n
12964                 "*Enter NEW password*" %n\n "*Reenter NEW password*" %n\n "*Password
12965                 changed*"</B
12966 ></P
12967 ></DD
12968 ><DT
12969 ><A
12970 NAME="PASSWDCHATDEBUG"
12971 ></A
12972 >passwd chat debug (G)</DT
12973 ><DD
12974 ><P
12975 >This boolean specifies if the passwd chat script
12976                 parameter is run in <EM
12977 >debug</EM
12978 > mode. In this mode the
12979                 strings passed to and received from the passwd chat are printed
12980                 in the <A
12981 HREF="smbd.8.html"
12982 TARGET="_top"
12983 >smbd(8)</A
12984 > log with a
12985                 <A
12986 HREF="#DEBUGLEVEL"
12987 ><TT
12988 CLASS="PARAMETER"
12989 ><I
12990 >debug level</I
12991 ></TT
12992 ></A
12993 >
12994                 of 100. This is a dangerous option as it will allow plaintext passwords
12995                 to be seen in the <B
12996 CLASS="COMMAND"
12997 >smbd</B
12998 > log. It is available to help
12999                 Samba admins debug their <TT
13000 CLASS="PARAMETER"
13001 ><I
13002 >passwd chat</I
13003 ></TT
13004 > scripts
13005                 when calling the <TT
13006 CLASS="PARAMETER"
13007 ><I
13008 >passwd program</I
13009 ></TT
13010 > and should
13011                 be turned off after this has been done. This option has no effect if the
13012                 <A
13013 HREF="#PAMPASSWORDCHANGE"
13014 ><TT
13015 CLASS="PARAMETER"
13016 ><I
13017 >pam password change</I
13018 ></TT
13019 ></A
13020 >
13021                 paramter is set. This parameter is off by default.</P
13022 ><P
13023 >See also <A
13024 HREF="#PASSWDCHAT"
13025 ><TT
13026 CLASS="PARAMETER"
13027 ><I
13028 >passwd chat</I
13029 ></TT
13030 >
13031                 </A
13032 >, <A
13033 HREF="#PAMPASSWORDCHANGE"
13034 ><TT
13035 CLASS="PARAMETER"
13036 ><I
13037 >pam password change</I
13038 ></TT
13039 >
13040                 </A
13041 >, <A
13042 HREF="#PASSWDPROGRAM"
13043 ><TT
13044 CLASS="PARAMETER"
13045 ><I
13046 >passwd program</I
13047 ></TT
13048 >
13049                 </A
13050 >.</P
13051 ><P
13052 >Default: <B
13053 CLASS="COMMAND"
13054 >passwd chat debug = no</B
13055 ></P
13056 ></DD
13057 ><DT
13058 ><A
13059 NAME="PASSWDPROGRAM"
13060 ></A
13061 >passwd program (G)</DT
13062 ><DD
13063 ><P
13064 >The name of a program that can be used to set
13065                 UNIX user passwords.  Any occurrences of <TT
13066 CLASS="PARAMETER"
13067 ><I
13068 >%u</I
13069 ></TT
13070 >
13071                 will be replaced with the user name. The user name is checked for
13072                 existence before calling the password changing program.</P
13073 ><P
13074 >Also note that many passwd programs insist in <EM
13075 >reasonable
13076                 </EM
13077 > passwords, such as a minimum length, or the inclusion
13078                 of mixed case chars and digits. This can pose a problem as some clients
13079                 (such as Windows for Workgroups) uppercase the password before sending
13080                 it.</P
13081 ><P
13082 ><EM
13083 >Note</EM
13084 > that if the <TT
13085 CLASS="PARAMETER"
13086 ><I
13087 >unix
13088                 password sync</I
13089 ></TT
13090 > parameter is set to <TT
13091 CLASS="CONSTANT"
13092 >true
13093                 </TT
13094 > then this program is called <EM
13095 >AS ROOT</EM
13096 >
13097                 before the SMB password in the <A
13098 HREF="smbpasswd.5.html"
13099 TARGET="_top"
13100 >smbpasswd(5)
13101                 </A
13102 > file is changed. If this UNIX password change fails, then
13103                 <B
13104 CLASS="COMMAND"
13105 >smbd</B
13106 > will fail to change the SMB password also
13107                 (this is by design).</P
13108 ><P
13109 >If the <TT
13110 CLASS="PARAMETER"
13111 ><I
13112 >unix password sync</I
13113 ></TT
13114 > parameter
13115                 is set this parameter <EM
13116 >MUST USE ABSOLUTE PATHS</EM
13117 >
13118                 for <EM
13119 >ALL</EM
13120 > programs called, and must be examined
13121                 for security implications. Note that by default <TT
13122 CLASS="PARAMETER"
13123 ><I
13124 >unix
13125                 password sync</I
13126 ></TT
13127 > is set to <TT
13128 CLASS="CONSTANT"
13129 >false</TT
13130 >.</P
13131 ><P
13132 >See also <A
13133 HREF="#UNIXPASSWORDSYNC"
13134 ><TT
13135 CLASS="PARAMETER"
13136 ><I
13137 >unix
13138                 password sync</I
13139 ></TT
13140 ></A
13141 >.</P
13142 ><P
13143 >Default: <B
13144 CLASS="COMMAND"
13145 >passwd program = /bin/passwd</B
13146 ></P
13147 ><P
13148 >Example: <B
13149 CLASS="COMMAND"
13150 >passwd program = /sbin/npasswd %u</B
13151 >
13152                 </P
13153 ></DD
13154 ><DT
13155 ><A
13156 NAME="PASSWORDLEVEL"
13157 ></A
13158 >password level (G)</DT
13159 ><DD
13160 ><P
13161 >Some client/server combinations have difficulty
13162                 with mixed-case passwords.  One offending client is Windows for
13163                 Workgroups, which for some reason forces passwords to upper
13164                 case when using the LANMAN1 protocol, but leaves them alone when
13165                 using COREPLUS!  Another problem child is the Windows 95/98
13166                 family of operating systems.  These clients upper case clear
13167                 text passwords even when NT LM 0.12 selected by the protocol
13168                 negotiation request/response.</P
13169 ><P
13170 >This parameter defines the maximum number of characters
13171                 that may be upper case in passwords.</P
13172 ><P
13173 >For example, say the password given was "FRED". If <TT
13174 CLASS="PARAMETER"
13175 ><I
13176 >               password level</I
13177 ></TT
13178 > is set to 1, the following combinations
13179                 would be tried if "FRED" failed:</P
13180 ><P
13181 >"Fred", "fred", "fRed", "frEd","freD"</P
13182 ><P
13183 >If <TT
13184 CLASS="PARAMETER"
13185 ><I
13186 >password level</I
13187 ></TT
13188 > was set to 2,
13189                 the following combinations would also be tried: </P
13190 ><P
13191 >"FRed", "FrEd", "FreD", "fREd", "fReD", "frED", ..</P
13192 ><P
13193 >And so on.</P
13194 ><P
13195 >The higher value this parameter is set to the more likely
13196                 it is that a mixed case password will be matched against a single
13197                 case password. However, you should be aware that use of this
13198                 parameter reduces security and increases the time taken to
13199                 process a new connection.</P
13200 ><P
13201 >A value of zero will cause only two attempts to be
13202                 made - the password as is and the password in all-lower case.</P
13203 ><P
13204 >Default: <B
13205 CLASS="COMMAND"
13206 >password level = 0</B
13207 ></P
13208 ><P
13209 >Example: <B
13210 CLASS="COMMAND"
13211 >password level = 4</B
13212 ></P
13213 ></DD
13214 ><DT
13215 ><A
13216 NAME="PASSWORDSERVER"
13217 ></A
13218 >password server (G)</DT
13219 ><DD
13220 ><P
13221 >By specifying the name of another SMB server (such
13222                 as a WinNT box) with this option, and using <B
13223 CLASS="COMMAND"
13224 >security = domain
13225                 </B
13226 > or <B
13227 CLASS="COMMAND"
13228 >security = server</B
13229 > you can get Samba
13230                 to do all its username/password validation via a remote server.</P
13231 ><P
13232 >This option sets the name of the password server to use.
13233                 It must be a NetBIOS name, so if the machine's NetBIOS name is
13234                 different from its Internet name then you may have to add its NetBIOS
13235                 name to the lmhosts  file which is stored in the same directory
13236                 as the <TT
13237 CLASS="FILENAME"
13238 >smb.conf</TT
13239 > file.</P
13240 ><P
13241 >The name of the password server is looked up using the
13242                 parameter <A
13243 HREF="#NAMERESOLVEORDER"
13244 ><TT
13245 CLASS="PARAMETER"
13246 ><I
13247 >name
13248                 resolve order</I
13249 ></TT
13250 ></A
13251 > and so may resolved
13252                 by any method and order described in that parameter.</P
13253 ><P
13254 >The password server much be a machine capable of using
13255                 the "LM1.2X002" or the "NT LM 0.12" protocol, and it must be in
13256                 user level security mode.</P
13257 ><P
13258 ><EM
13259 >NOTE:</EM
13260 > Using a password server
13261                 means your UNIX box (running Samba) is only as secure as your
13262                 password server. <EM
13263 >DO NOT CHOOSE A PASSWORD SERVER THAT
13264                 YOU DON'T COMPLETELY TRUST</EM
13265 >.</P
13266 ><P
13267 >Never point a Samba server at itself for password
13268                 serving. This will cause a loop and could lock up your Samba
13269                 server!</P
13270 ><P
13271 >The name of the password server takes the standard
13272                 substitutions, but probably the only useful one is <TT
13273 CLASS="PARAMETER"
13274 ><I
13275 >%m
13276                 </I
13277 ></TT
13278 >, which means the Samba server will use the incoming
13279                 client as the password server. If you use this then you better
13280                 trust your clients, and you had better restrict them with hosts allow!</P
13281 ><P
13282 >If the <TT
13283 CLASS="PARAMETER"
13284 ><I
13285 >security</I
13286 ></TT
13287 > parameter is set to
13288                 <TT
13289 CLASS="CONSTANT"
13290 >domain</TT
13291 >, then the list of machines in this
13292                 option must be a list of Primary or Backup Domain controllers for the
13293                 Domain or the character '*', as the Samba server is effectively
13294                 in that domain, and will use cryptographically authenticated RPC calls
13295                 to authenticate the user logging on. The advantage of using <B
13296 CLASS="COMMAND"
13297 >               security = domain</B
13298 > is that if you list several hosts in the
13299                 <TT
13300 CLASS="PARAMETER"
13301 ><I
13302 >password server</I
13303 ></TT
13304 > option then <B
13305 CLASS="COMMAND"
13306 >smbd
13307                 </B
13308 > will try each in turn till it finds one that responds. This
13309                 is useful in case your primary server goes down.</P
13310 ><P
13311 >If the <TT
13312 CLASS="PARAMETER"
13313 ><I
13314 >password server</I
13315 ></TT
13316 > option is set
13317                 to the character '*', then Samba will attempt to auto-locate the
13318                 Primary or Backup Domain controllers to authenticate against by
13319                 doing a query for the name <TT
13320 CLASS="CONSTANT"
13321 >WORKGROUP&#60;1C&#62;</TT
13322 >
13323                 and then contacting each server returned in the list of IP
13324                 addresses from the name resolution source. </P
13325 ><P
13326 >If the <TT
13327 CLASS="PARAMETER"
13328 ><I
13329 >security</I
13330 ></TT
13331 > parameter is
13332                 set to <TT
13333 CLASS="CONSTANT"
13334 >server</TT
13335 >, then there are different
13336                 restrictions that <B
13337 CLASS="COMMAND"
13338 >security = domain</B
13339 > doesn't
13340                 suffer from:</P
13341 ><P
13342 ></P
13343 ><UL
13344 ><LI
13345 ><P
13346 >You may list several password servers in
13347                         the <TT
13348 CLASS="PARAMETER"
13349 ><I
13350 >password server</I
13351 ></TT
13352 > parameter, however if an
13353                         <B
13354 CLASS="COMMAND"
13355 >smbd</B
13356 > makes a connection to a password server,
13357                         and then the password server fails, no more users will be able
13358                         to be authenticated from this <B
13359 CLASS="COMMAND"
13360 >smbd</B
13361 >.  This is a
13362                         restriction of the SMB/CIFS protocol when in <B
13363 CLASS="COMMAND"
13364 >security = server
13365                         </B
13366 > mode and cannot be fixed in Samba.</P
13367 ></LI
13368 ><LI
13369 ><P
13370 >If you are using a Windows NT server as your
13371                         password server then you will have to ensure that your users
13372                         are able to login from the Samba server, as when in <B
13373 CLASS="COMMAND"
13374 >                       security = server</B
13375 >  mode the network logon will appear to
13376                         come from there rather than from the users workstation.</P
13377 ></LI
13378 ></UL
13379 ><P
13380 >See also the <A
13381 HREF="#SECURITY"
13382 ><TT
13383 CLASS="PARAMETER"
13384 ><I
13385 >security
13386                 </I
13387 ></TT
13388 ></A
13389 > parameter.</P
13390 ><P
13391 >Default: <B
13392 CLASS="COMMAND"
13393 >password server = &#60;empty string&#62;</B
13394 >
13395                 </P
13396 ><P
13397 >Example: <B
13398 CLASS="COMMAND"
13399 >password server = NT-PDC, NT-BDC1, NT-BDC2
13400                 </B
13401 ></P
13402 ><P
13403 >Example: <B
13404 CLASS="COMMAND"
13405 >password server = *</B
13406 ></P
13407 ></DD
13408 ><DT
13409 ><A
13410 NAME="PATH"
13411 ></A
13412 >path (S)</DT
13413 ><DD
13414 ><P
13415 >This parameter specifies a directory to which
13416                 the user of the service is to be given access. In the case of
13417                 printable services, this is where print data will spool prior to
13418                 being submitted to the host for printing.</P
13419 ><P
13420 >For a printable service offering guest access, the service
13421                 should be readonly and the path should be world-writeable and
13422                 have the sticky bit set. This is not mandatory of course, but
13423                 you probably won't get the results you expect if you do
13424                 otherwise.</P
13425 ><P
13426 >Any occurrences of <TT
13427 CLASS="PARAMETER"
13428 ><I
13429 >%u</I
13430 ></TT
13431 > in the path
13432                 will be replaced with the UNIX username that the client is using
13433                 on this connection. Any occurrences of <TT
13434 CLASS="PARAMETER"
13435 ><I
13436 >%m</I
13437 ></TT
13438 >
13439                 will be replaced by the NetBIOS name of the machine they are
13440                 connecting from. These replacements are very useful for setting
13441                 up pseudo home directories for users.</P
13442 ><P
13443 >Note that this path will be based on <A
13444 HREF="#ROOTDIR"
13445 >               <TT
13446 CLASS="PARAMETER"
13447 ><I
13448 >root dir</I
13449 ></TT
13450 ></A
13451 > if one was specified.</P
13452 ><P
13453 >Default: <EM
13454 >none</EM
13455 ></P
13456 ><P
13457 >Example: <B
13458 CLASS="COMMAND"
13459 >path = /home/fred</B
13460 ></P
13461 ></DD
13462 ><DT
13463 ><A
13464 NAME="POSIXLOCKING"
13465 ></A
13466 >posix locking (S)</DT
13467 ><DD
13468 ><P
13469 >The <A
13470 HREF="smbd.8.html"
13471 TARGET="_top"
13472 ><B
13473 CLASS="COMMAND"
13474 >smbd(8)</B
13475 ></A
13476 >
13477                 daemon maintains an database of file locks obtained by SMB clients.
13478                 The default behavior is to map this internal database to POSIX
13479                 locks.  This means that file locks obtained by SMB clients are
13480                 consistent with those seen by POSIX compliant applications accessing
13481                 the files via a non-SMB method (e.g. NFS or local file access).
13482                 You should never need to disable this parameter.</P
13483 ><P
13484 >Default: <B
13485 CLASS="COMMAND"
13486 >posix locking = yes</B
13487 ></P
13488 ></DD
13489 ><DT
13490 ><A
13491 NAME="POSTEXEC"
13492 ></A
13493 >postexec (S)</DT
13494 ><DD
13495 ><P
13496 >This option specifies a command to be run
13497                 whenever the service is disconnected. It takes the usual
13498                 substitutions. The command may be run as the root on some
13499                 systems.</P
13500 ><P
13501 >An interesting example may be to unmount server
13502                 resources:</P
13503 ><P
13504 ><B
13505 CLASS="COMMAND"
13506 >postexec = /etc/umount /cdrom</B
13507 ></P
13508 ><P
13509 >See also <A
13510 HREF="#PREEXEC"
13511 ><TT
13512 CLASS="PARAMETER"
13513 ><I
13514 >preexec</I
13515 ></TT
13516 >
13517                 </A
13518 >.</P
13519 ><P
13520 >Default: <EM
13521 >none (no command executed)</EM
13522 >
13523                 </P
13524 ><P
13525 >Example: <B
13526 CLASS="COMMAND"
13527 >postexec = echo \"%u disconnected from %S
13528                 from %m (%I)\" &#62;&#62; /tmp/log</B
13529 ></P
13530 ></DD
13531 ><DT
13532 ><A
13533 NAME="POSTSCRIPT"
13534 ></A
13535 >postscript (S)</DT
13536 ><DD
13537 ><P
13538 >This parameter forces a printer to interpret
13539                 the print files as PostScript. This is done by adding a <TT
13540 CLASS="CONSTANT"
13541 >%!
13542                 </TT
13543 > to the start of print output.</P
13544 ><P
13545 >This is most useful when you have lots of PCs that persist
13546                 in putting a control-D at the start of print jobs, which then
13547                 confuses your printer.</P
13548 ><P
13549 >Default: <B
13550 CLASS="COMMAND"
13551 >postscript = no</B
13552 ></P
13553 ></DD
13554 ><DT
13555 ><A
13556 NAME="PREEXEC"
13557 ></A
13558 >preexec (S)</DT
13559 ><DD
13560 ><P
13561 >This option specifies a command to be run whenever
13562                 the service is connected to. It takes the usual substitutions.</P
13563 ><P
13564 >An interesting example is to send the users a welcome
13565                 message every time they log in. Maybe a message of the day? Here
13566                 is an example:</P
13567 ><P
13568 ><B
13569 CLASS="COMMAND"
13570 >preexec = csh -c 'echo \"Welcome to %S!\" |
13571                  /usr/local/samba/bin/smbclient -M %m -I %I' &#38; </B
13572 ></P
13573 ><P
13574 >Of course, this could get annoying after a while :-)</P
13575 ><P
13576 >See also <A
13577 HREF="#PREEXECCLOSE"
13578 ><TT
13579 CLASS="PARAMETER"
13580 ><I
13581 >preexec close
13582                 </I
13583 ></TT
13584 ></A
13585 > and <A
13586 HREF="#POSTEXEC"
13587 ><TT
13588 CLASS="PARAMETER"
13589 ><I
13590 >postexec
13591                 </I
13592 ></TT
13593 ></A
13594 >.</P
13595 ><P
13596 >Default: <EM
13597 >none (no command executed)</EM
13598 ></P
13599 ><P
13600 >Example: <B
13601 CLASS="COMMAND"
13602 >preexec = echo \"%u connected to %S from %m
13603                 (%I)\" &#62;&#62; /tmp/log</B
13604 ></P
13605 ></DD
13606 ><DT
13607 ><A
13608 NAME="PREEXECCLOSE"
13609 ></A
13610 >preexec close (S)</DT
13611 ><DD
13612 ><P
13613 >This boolean option controls whether a non-zero
13614                 return code from <A
13615 HREF="#PREEXEC"
13616 ><TT
13617 CLASS="PARAMETER"
13618 ><I
13619 >preexec
13620                 </I
13621 ></TT
13622 ></A
13623 > should close the service being connected to.</P
13624 ><P
13625 >Default: <B
13626 CLASS="COMMAND"
13627 >preexec close = no</B
13628 ></P
13629 ></DD
13630 ><DT
13631 ><A
13632 NAME="PREFERREDMASTER"
13633 ></A
13634 >preferred master (G)</DT
13635 ><DD
13636 ><P
13637 >This boolean parameter controls if <A
13638 HREF="nmbd.8.html"
13639 TARGET="_top"
13640 >nmbd(8)</A
13641 > is a preferred master browser
13642                 for its workgroup.</P
13643 ><P
13644 >If this is set to <TT
13645 CLASS="CONSTANT"
13646 >true</TT
13647 >, on startup, <B
13648 CLASS="COMMAND"
13649 >nmbd</B
13650 >
13651                 will force an election, and it will have a slight advantage in
13652                 winning the election.  It is recommended that this parameter is
13653                 used in conjunction with <B
13654 CLASS="COMMAND"
13655 ><A
13656 HREF="#DOMAINMASTER"
13657 ><TT
13658 CLASS="PARAMETER"
13659 ><I
13660 >               domain master</I
13661 ></TT
13662 ></A
13663 > = yes</B
13664 >, so that <B
13665 CLASS="COMMAND"
13666 >               nmbd</B
13667 > can guarantee becoming a domain master.</P
13668 ><P
13669 >Use this option with caution, because if there are several
13670                 hosts (whether Samba servers, Windows 95 or NT) that are preferred
13671                 master browsers on the same subnet, they will each periodically
13672                 and continuously attempt to become the local master browser.
13673                 This will result in unnecessary broadcast traffic and reduced browsing
13674                 capabilities.</P
13675 ><P
13676 >See also <A
13677 HREF="#OSLEVEL"
13678 ><TT
13679 CLASS="PARAMETER"
13680 ><I
13681 >os level</I
13682 ></TT
13683 >
13684                 </A
13685 >.</P
13686 ><P
13687 >Default: <B
13688 CLASS="COMMAND"
13689 >preferred master = auto</B
13690 ></P
13691 ></DD
13692 ><DT
13693 ><A
13694 NAME="PREFEREDMASTER"
13695 ></A
13696 >prefered master (G)</DT
13697 ><DD
13698 ><P
13699 >Synonym for <A
13700 HREF="#PREFERREDMASTER"
13701 ><TT
13702 CLASS="PARAMETER"
13703 ><I
13704 >               preferred master</I
13705 ></TT
13706 ></A
13707 > for people who cannot spell :-).</P
13708 ></DD
13709 ><DT
13710 ><A
13711 NAME="PRELOAD"
13712 ></A
13713 >preload</DT
13714 ><DD
13715 ><P
13716 >This is a list of services that you want to be
13717                 automatically added to the browse lists. This is most useful
13718                 for homes and printers services that would otherwise not be
13719                 visible.</P
13720 ><P
13721 >Note that if you just want all printers in your
13722                 printcap file loaded then the <A
13723 HREF="#LOADPRINTERS"
13724 >               <TT
13725 CLASS="PARAMETER"
13726 ><I
13727 >load printers</I
13728 ></TT
13729 ></A
13730 > option is easier.</P
13731 ><P
13732 >Default: <EM
13733 >no preloaded services</EM
13734 ></P
13735 ><P
13736 >Example: <B
13737 CLASS="COMMAND"
13738 >preload = fred lp colorlp</B
13739 ></P
13740 ></DD
13741 ><DT
13742 ><A
13743 NAME="PRESERVECASE"
13744 ></A
13745 >preserve case (S)</DT
13746 ><DD
13747 ><P
13748 > This controls if new filenames are created
13749                 with the case that the client passes, or if they are forced to
13750                 be the <A
13751 HREF="#DEFAULTCASE"
13752 ><TT
13753 CLASS="PARAMETER"
13754 ><I
13755 >default case
13756                 </I
13757 ></TT
13758 ></A
13759 >.</P
13760 ><P
13761 >Default: <B
13762 CLASS="COMMAND"
13763 >preserve case = yes</B
13764 ></P
13765 ><P
13766 >See the section on <A
13767 HREF="#AEN203"
13768 >NAME
13769                 MANGLING</A
13770 > for a fuller discussion.</P
13771 ></DD
13772 ><DT
13773 ><A
13774 NAME="PRINTCOMMAND"
13775 ></A
13776 >print command (S)</DT
13777 ><DD
13778 ><P
13779 >After a print job has finished spooling to
13780                 a service, this command will be used via a <B
13781 CLASS="COMMAND"
13782 >system()</B
13783 >
13784                 call to process the spool file. Typically the command specified will
13785                 submit the spool file to the host's printing subsystem, but there
13786                 is no requirement that this be the case. The server will not remove
13787                 the spool file, so whatever command you specify should remove the
13788                 spool file when it has been processed, otherwise you will need to
13789                 manually remove old spool files.</P
13790 ><P
13791 >The print command is simply a text string. It will be used
13792                 verbatim, with two exceptions: All occurrences of <TT
13793 CLASS="PARAMETER"
13794 ><I
13795 >%s
13796                 </I
13797 ></TT
13798 > and <TT
13799 CLASS="PARAMETER"
13800 ><I
13801 >%f</I
13802 ></TT
13803 > will be replaced by the
13804                 appropriate spool file name, and all occurrences of <TT
13805 CLASS="PARAMETER"
13806 ><I
13807 >%p
13808                 </I
13809 ></TT
13810 > will be replaced by the appropriate printer name. The
13811                 spool file name is generated automatically by the server.  The
13812                 <TT
13813 CLASS="PARAMETER"
13814 ><I
13815 >%J</I
13816 ></TT
13817 > macro can be used to access the job
13818                 name as transmitted by the client.</P
13819 ><P
13820 >The print command <EM
13821 >MUST</EM
13822 > contain at least
13823                 one occurrence of <TT
13824 CLASS="PARAMETER"
13825 ><I
13826 >%s</I
13827 ></TT
13828 > or <TT
13829 CLASS="PARAMETER"
13830 ><I
13831 >%f
13832                 </I
13833 ></TT
13834 > - the <TT
13835 CLASS="PARAMETER"
13836 ><I
13837 >%p</I
13838 ></TT
13839 > is optional. At the time
13840                 a job is submitted, if no printer name is supplied the <TT
13841 CLASS="PARAMETER"
13842 ><I
13843 >%p
13844                 </I
13845 ></TT
13846 > will be silently removed from the printer command.</P
13847 ><P
13848 >If specified in the [global] section, the print command given
13849                 will be used for any printable service that does not have its own
13850                 print command specified.</P
13851 ><P
13852 >If there is neither a specified print command for a
13853                 printable service nor a global print command, spool files will
13854                 be created but not processed and (most importantly) not removed.</P
13855 ><P
13856 >Note that printing may fail on some UNIXes from the
13857                 <TT
13858 CLASS="CONSTANT"
13859 >nobody</TT
13860 > account. If this happens then create
13861                 an alternative guest account that can print and set the <A
13862 HREF="#GUESTACCOUNT"
13863 ><TT
13864 CLASS="PARAMETER"
13865 ><I
13866 >guest account</I
13867 ></TT
13868 ></A
13869 >
13870                 in the [global] section.</P
13871 ><P
13872 >You can form quite complex print commands by realizing
13873                 that they are just passed to a shell. For example the following
13874                 will log a print job, print the file, then remove it. Note that
13875                 ';' is the usual separator for command in shell scripts.</P
13876 ><P
13877 ><B
13878 CLASS="COMMAND"
13879 >print command = echo Printing %s &#62;&#62;
13880                 /tmp/print.log; lpr -P %p %s; rm %s</B
13881 ></P
13882 ><P
13883 >You may have to vary this command considerably depending
13884                 on how you normally print files on your system. The default for
13885                 the parameter varies depending on the setting of the <A
13886 HREF="#PRINTING"
13887 >               <TT
13888 CLASS="PARAMETER"
13889 ><I
13890 >printing</I
13891 ></TT
13892 ></A
13893 > parameter.</P
13894 ><P
13895 >Default: For <B
13896 CLASS="COMMAND"
13897 >printing = BSD, AIX, QNX, LPRNG
13898                 or PLP :</B
13899 ></P
13900 ><P
13901 ><B
13902 CLASS="COMMAND"
13903 >print command = lpr -r -P%p %s</B
13904 ></P
13905 ><P
13906 >For <B
13907 CLASS="COMMAND"
13908 >printing = SYSV or HPUX :</B
13909 ></P
13910 ><P
13911 ><B
13912 CLASS="COMMAND"
13913 >print command = lp -c -d%p %s; rm %s</B
13914 ></P
13915 ><P
13916 >For <B
13917 CLASS="COMMAND"
13918 >printing = SOFTQ :</B
13919 ></P
13920 ><P
13921 ><B
13922 CLASS="COMMAND"
13923 >print command = lp -d%p -s %s; rm %s</B
13924 ></P
13925 ><P
13926 >Example: <B
13927 CLASS="COMMAND"
13928 >print command = /usr/local/samba/bin/myprintscript
13929                 %p %s</B
13930 ></P
13931 ></DD
13932 ><DT
13933 ><A
13934 NAME="PRINTOK"
13935 ></A
13936 >print ok (S)</DT
13937 ><DD
13938 ><P
13939 >Synonym for <A
13940 HREF="#PRINTABLE"
13941 >               <TT
13942 CLASS="PARAMETER"
13943 ><I
13944 >printable</I
13945 ></TT
13946 ></A
13947 >.</P
13948 ></DD
13949 ><DT
13950 ><A
13951 NAME="PRINTABLE"
13952 ></A
13953 >printable (S)</DT
13954 ><DD
13955 ><P
13956 >If this parameter is <TT
13957 CLASS="CONSTANT"
13958 >yes</TT
13959 >, then
13960                 clients may open, write to and submit spool files on the directory
13961                 specified for the service. </P
13962 ><P
13963 >Note that a printable service will ALWAYS allow writing
13964                 to the service path (user privileges permitting) via the spooling
13965                 of print data. The <A
13966 HREF="#WRITEABLE"
13967 ><TT
13968 CLASS="PARAMETER"
13969 ><I
13970 >writeable
13971                 </I
13972 ></TT
13973 ></A
13974 > parameter controls only non-printing access to
13975                 the resource.</P
13976 ><P
13977 >Default: <B
13978 CLASS="COMMAND"
13979 >printable = no</B
13980 ></P
13981 ></DD
13982 ><DT
13983 ><A
13984 NAME="PRINTCAP"
13985 ></A
13986 >printcap (G)</DT
13987 ><DD
13988 ><P
13989 >Synonym for    <A
13990 HREF="#PRINTCAPNAME"
13991 ><TT
13992 CLASS="PARAMETER"
13993 ><I
13994 >               printcap name</I
13995 ></TT
13996 ></A
13997 >.</P
13998 ></DD
13999 ><DT
14000 ><A
14001 NAME="PRINTCAPNAME"
14002 ></A
14003 >printcap name (G)</DT
14004 ><DD
14005 ><P
14006 >This parameter may be used to override the
14007                 compiled-in default printcap name used by the server (usually <TT
14008 CLASS="FILENAME"
14009 >               /etc/printcap</TT
14010 >). See the discussion of the <A
14011 HREF="#AEN79"
14012 >[printers]</A
14013 > section above for reasons
14014                 why you might want to do this.</P
14015 ><P
14016 >On System V systems that use <B
14017 CLASS="COMMAND"
14018 >lpstat</B
14019 > to
14020                 list available printers you can use <B
14021 CLASS="COMMAND"
14022 >printcap name = lpstat
14023                 </B
14024 > to automatically obtain lists of available printers. This
14025                 is the default for systems that define SYSV at configure time in
14026                 Samba (this includes most System V based systems). If <TT
14027 CLASS="PARAMETER"
14028 ><I
14029 >               printcap name</I
14030 ></TT
14031 > is set to <B
14032 CLASS="COMMAND"
14033 >lpstat</B
14034 > on
14035                 these systems then Samba will launch <B
14036 CLASS="COMMAND"
14037 >lpstat -v</B
14038 > and
14039                 attempt to parse the output to obtain a printer list.</P
14040 ><P
14041 >A minimal printcap file would look something like this:</P
14042 ><P
14043 ><TABLE
14044 BORDER="0"
14045 BGCOLOR="#E0E0E0"
14046 WIDTH="90%"
14047 ><TR
14048 ><TD
14049 ><PRE
14050 CLASS="PROGRAMLISTING"
14051 >               print1|My Printer 1
14052                 print2|My Printer 2
14053                 print3|My Printer 3
14054                 print4|My Printer 4
14055                 print5|My Printer 5
14056                 </PRE
14057 ></TD
14058 ></TR
14059 ></TABLE
14060 ></P
14061 ><P
14062 >where the '|' separates aliases of a printer. The fact
14063                 that the second alias has a space in it gives a hint to Samba
14064                 that it's a comment.</P
14065 ><P
14066 ><EM
14067 >NOTE</EM
14068 >: Under AIX the default printcap
14069                 name is <TT
14070 CLASS="FILENAME"
14071 >/etc/qconfig</TT
14072 >. Samba will assume the
14073                 file is in AIX <TT
14074 CLASS="FILENAME"
14075 >qconfig</TT
14076 > format if the string
14077                 <TT
14078 CLASS="FILENAME"
14079 >qconfig</TT
14080 > appears in the printcap filename.</P
14081 ><P
14082 >Default: <B
14083 CLASS="COMMAND"
14084 >printcap name = /etc/printcap</B
14085 ></P
14086 ><P
14087 >Example: <B
14088 CLASS="COMMAND"
14089 >printcap name = /etc/myprintcap</B
14090 ></P
14091 ></DD
14092 ><DT
14093 ><A
14094 NAME="PRINTERADMIN"
14095 ></A
14096 >printer admin (S)</DT
14097 ><DD
14098 ><P
14099 >This is a list of users that can do anything to
14100                 printers via the remote administration interfaces offered by MS-RPC
14101                 (usually using a NT workstation). Note that the root user always
14102                 has admin rights.</P
14103 ><P
14104 >Default: <B
14105 CLASS="COMMAND"
14106 >printer admin = &#60;empty string&#62;</B
14107 >
14108                 </P
14109 ><P
14110 >Example: <B
14111 CLASS="COMMAND"
14112 >printer admin = admin, @staff</B
14113 ></P
14114 ></DD
14115 ><DT
14116 ><A
14117 NAME="PRINTERDRIVER"
14118 ></A
14119 >printer driver (S)</DT
14120 ><DD
14121 ><P
14122 ><EM
14123 >Note :</EM
14124 >This is a deprecated
14125                 parameter and will be removed in the next major release
14126                 following version 2.2.  Please see the instructions in
14127                 the <A
14128 HREF="printer_driver2.html"
14129 TARGET="_top"
14130 >Samba 2.2. Printing
14131                 HOWTO</A
14132 > for more information
14133                 on the new method of loading printer drivers onto a Samba server.
14134                 </P
14135 ><P
14136 >This option allows you to control the string
14137                 that clients receive when they ask the server for the printer driver
14138                 associated with a printer. If you are using Windows95 or Windows NT
14139                 then you can use this to automate the setup of printers on your
14140                 system.</P
14141 ><P
14142 >You need to set this parameter to the exact string (case
14143                 sensitive) that describes the appropriate printer driver for your
14144                 system. If you don't know the exact string to use then you should
14145                 first try with no <A
14146 HREF="#PRINTERDRIVER"
14147 ><TT
14148 CLASS="PARAMETER"
14149 ><I
14150 >               printer driver</I
14151 ></TT
14152 ></A
14153 > option set and the client will
14154                 give you a list of printer drivers. The appropriate strings are
14155                 shown in a scroll box after you have chosen the printer manufacturer.</P
14156 ><P
14157 >See also <A
14158 HREF="#PRINTERDRIVERFILE"
14159 ><TT
14160 CLASS="PARAMETER"
14161 ><I
14162 >printer
14163                 driver file</I
14164 ></TT
14165 ></A
14166 >.</P
14167 ><P
14168 >Example: <B
14169 CLASS="COMMAND"
14170 >printer driver = HP LaserJet 4L</B
14171 ></P
14172 ></DD
14173 ><DT
14174 ><A
14175 NAME="PRINTERDRIVERFILE"
14176 ></A
14177 >printer driver file (G)</DT
14178 ><DD
14179 ><P
14180 ><EM
14181 >Note :</EM
14182 >This is a deprecated
14183                 parameter and will be removed in the next major release
14184                 following version 2.2.  Please see the instructions in
14185                 the <A
14186 HREF="printer_driver2.html"
14187 TARGET="_top"
14188 >Samba 2.2. Printing
14189                 HOWTO</A
14190 > for more information
14191                 on the new method of loading printer drivers onto a Samba server.
14192                 </P
14193 ><P
14194 >This parameter tells Samba where the printer driver
14195                 definition file, used when serving drivers to Windows 95 clients, is
14196                 to be found. If this is not set, the default is :</P
14197 ><P
14198 ><TT
14199 CLASS="FILENAME"
14200 ><TT
14201 CLASS="REPLACEABLE"
14202 ><I
14203 >SAMBA_INSTALL_DIRECTORY</I
14204 ></TT
14205 >
14206                 /lib/printers.def</TT
14207 ></P
14208 ><P
14209 >This file is created from Windows 95 <TT
14210 CLASS="FILENAME"
14211 >msprint.inf
14212                 </TT
14213 > files found on the Windows 95 client system. For more
14214                 details on setting up serving of printer drivers to Windows 95
14215                 clients, see the outdated documentation file in the <TT
14216 CLASS="FILENAME"
14217 >docs/</TT
14218 >
14219                 directory, <TT
14220 CLASS="FILENAME"
14221 >PRINTER_DRIVER.txt</TT
14222 >.</P
14223 ><P
14224 >See also <A
14225 HREF="#PRINTERDRIVERLOCATION"
14226 ><TT
14227 CLASS="PARAMETER"
14228 ><I
14229 >               printer driver location</I
14230 ></TT
14231 ></A
14232 >.</P
14233 ><P
14234 >Default: <EM
14235 >None (set in compile).</EM
14236 ></P
14237 ><P
14238 >Example: <B
14239 CLASS="COMMAND"
14240 >printer driver file =
14241                 /usr/local/samba/printers/drivers.def</B
14242 ></P
14243 ></DD
14244 ><DT
14245 ><A
14246 NAME="PRINTERDRIVERLOCATION"
14247 ></A
14248 >printer driver location (S)</DT
14249 ><DD
14250 ><P
14251 ><EM
14252 >Note :</EM
14253 >This is a deprecated
14254                 parameter and will be removed in the next major release
14255                 following version 2.2.  Please see the instructions in
14256                 the <A
14257 HREF="printer_driver2.html"
14258 TARGET="_top"
14259 >Samba 2.2. Printing
14260                 HOWTO</A
14261 > for more information
14262                 on the new method of loading printer drivers onto a Samba server.
14263                 </P
14264 ><P
14265 >This parameter tells clients of a particular printer
14266                 share where to find the printer driver files for the automatic
14267                 installation of drivers for Windows 95 machines. If Samba is set up
14268                 to serve printer drivers to Windows 95 machines, this should be set to</P
14269 ><P
14270 ><B
14271 CLASS="COMMAND"
14272 >\\MACHINE\PRINTER$</B
14273 ></P
14274 ><P
14275 >Where MACHINE is the NetBIOS name of your Samba server,
14276                 and PRINTER$ is a share you set up for serving printer driver
14277                 files. For more details on setting this up see the outdated documentation
14278                 file in the <TT
14279 CLASS="FILENAME"
14280 >docs/</TT
14281 > directory, <TT
14282 CLASS="FILENAME"
14283 >               PRINTER_DRIVER.txt</TT
14284 >.</P
14285 ><P
14286 >See also <A
14287 HREF="#PRINTERDRIVERFILE"
14288 ><TT
14289 CLASS="PARAMETER"
14290 ><I
14291 >               printer driver file</I
14292 ></TT
14293 ></A
14294 >.</P
14295 ><P
14296 >Default: <B
14297 CLASS="COMMAND"
14298 >none</B
14299 ></P
14300 ><P
14301 >Example: <B
14302 CLASS="COMMAND"
14303 >printer driver location = \\MACHINE\PRINTER$
14304                 </B
14305 ></P
14306 ></DD
14307 ><DT
14308 ><A
14309 NAME="PRINTERNAME"
14310 ></A
14311 >printer name (S)</DT
14312 ><DD
14313 ><P
14314 >This parameter specifies the name of the printer
14315                 to which print jobs spooled through a printable service will be sent.</P
14316 ><P
14317 >If specified in the [global] section, the printer
14318                 name given will be used for any printable service that does
14319                 not have its own printer name specified.</P
14320 ><P
14321 >Default: <EM
14322 >none (but may be <TT
14323 CLASS="CONSTANT"
14324 >lp</TT
14325 >
14326                 on many systems)</EM
14327 ></P
14328 ><P
14329 >Example: <B
14330 CLASS="COMMAND"
14331 >printer name = laserwriter</B
14332 ></P
14333 ></DD
14334 ><DT
14335 ><A
14336 NAME="PRINTER"
14337 ></A
14338 >printer (S)</DT
14339 ><DD
14340 ><P
14341 >Synonym for <A
14342 HREF="#PRINTERNAME"
14343 ><TT
14344 CLASS="PARAMETER"
14345 ><I
14346 >               printer name</I
14347 ></TT
14348 ></A
14349 >.</P
14350 ></DD
14351 ><DT
14352 ><A
14353 NAME="PRINTING"
14354 ></A
14355 >printing (S)</DT
14356 ><DD
14357 ><P
14358 >This parameters controls how printer status
14359                 information is interpreted on your system. It also affects the
14360                 default values for the <TT
14361 CLASS="PARAMETER"
14362 ><I
14363 >print command</I
14364 ></TT
14365 >,
14366                 <TT
14367 CLASS="PARAMETER"
14368 ><I
14369 >lpq command</I
14370 ></TT
14371 >, <TT
14372 CLASS="PARAMETER"
14373 ><I
14374 >lppause command
14375                 </I
14376 ></TT
14377 >, <TT
14378 CLASS="PARAMETER"
14379 ><I
14380 >lpresume command</I
14381 ></TT
14382 >, and
14383                 <TT
14384 CLASS="PARAMETER"
14385 ><I
14386 >lprm command</I
14387 ></TT
14388 > if specified in the
14389                 [global] section.</P
14390 ><P
14391 >Currently nine printing styles are supported. They are
14392                 <TT
14393 CLASS="CONSTANT"
14394 >BSD</TT
14395 >, <TT
14396 CLASS="CONSTANT"
14397 >AIX</TT
14398 >,
14399                 <TT
14400 CLASS="CONSTANT"
14401 >LPRNG</TT
14402 >, <TT
14403 CLASS="CONSTANT"
14404 >PLP</TT
14405 >,
14406                 <TT
14407 CLASS="CONSTANT"
14408 >SYSV</TT
14409 >, <TT
14410 CLASS="CONSTANT"
14411 >HPUX</TT
14412 >,
14413                 <TT
14414 CLASS="CONSTANT"
14415 >QNX</TT
14416 >, <TT
14417 CLASS="CONSTANT"
14418 >SOFTQ</TT
14419 >,
14420                 and <TT
14421 CLASS="CONSTANT"
14422 >CUPS</TT
14423 >.</P
14424 ><P
14425 >To see what the defaults are for the other print
14426                 commands when using the various options use the <A
14427 HREF="testparm.1.html"
14428 TARGET="_top"
14429 >testparm(1)</A
14430 > program.</P
14431 ><P
14432 >This option can be set on a per printer basis</P
14433 ><P
14434 >See also the discussion in the <A
14435 HREF="#AEN79"
14436 >               [printers]</A
14437 > section.</P
14438 ></DD
14439 ><DT
14440 ><A
14441 NAME="PRIVATEDIR"
14442 ></A
14443 >private dir (G)</DT
14444 ><DD
14445 ><P
14446 >This parameters defines the directory
14447                 smbd will use for storing such files as <TT
14448 CLASS="FILENAME"
14449 >smbpasswd</TT
14450 >
14451                 and <TT
14452 CLASS="FILENAME"
14453 >secrets.tdb</TT
14454 >.
14455                 </P
14456 ><P
14457 >Default :<B
14458 CLASS="COMMAND"
14459 >private dir = ${prefix}/private</B
14460 ></P
14461 ></DD
14462 ><DT
14463 ><A
14464 NAME="PROTOCOL"
14465 ></A
14466 >protocol (G)</DT
14467 ><DD
14468 ><P
14469 >Synonym for <A
14470 HREF="#MAXPROTOCOL"
14471 >               <TT
14472 CLASS="PARAMETER"
14473 ><I
14474 >max protocol</I
14475 ></TT
14476 ></A
14477 >.</P
14478 ></DD
14479 ><DT
14480 ><A
14481 NAME="PUBLIC"
14482 ></A
14483 >public (S)</DT
14484 ><DD
14485 ><P
14486 >Synonym for <A
14487 HREF="#GUESTOK"
14488 ><TT
14489 CLASS="PARAMETER"
14490 ><I
14491 >guest
14492                 ok</I
14493 ></TT
14494 ></A
14495 >.</P
14496 ></DD
14497 ><DT
14498 ><A
14499 NAME="QUEUEPAUSECOMMAND"
14500 ></A
14501 >queuepause command (S)</DT
14502 ><DD
14503 ><P
14504 >This parameter specifies the command to be
14505                 executed on the server host in order to pause the printer queue.</P
14506 ><P
14507 >This command should be a program or script which takes
14508                 a printer name as its only parameter and stops the printer queue,
14509                 such that no longer jobs are submitted to the printer.</P
14510 ><P
14511 >This command is not supported by Windows for Workgroups,
14512                 but can be issued from the Printers window under Windows 95
14513                 and NT.</P
14514 ><P
14515 >If a <TT
14516 CLASS="PARAMETER"
14517 ><I
14518 >%p</I
14519 ></TT
14520 > is given then the printer name
14521                 is put in its place. Otherwise it is placed at the end of the command.
14522                 </P
14523 ><P
14524 >Note that it is good practice to include the absolute
14525                 path in the command as the PATH may not be available to the
14526                 server.</P
14527 ><P
14528 >Default: <EM
14529 >depends on the setting of <TT
14530 CLASS="PARAMETER"
14531 ><I
14532 >printing
14533                 </I
14534 ></TT
14535 ></EM
14536 ></P
14537 ><P
14538 >Example: <B
14539 CLASS="COMMAND"
14540 >queuepause command = disable %p</B
14541 ></P
14542 ></DD
14543 ><DT
14544 ><A
14545 NAME="QUEUERESUMECOMMAND"
14546 ></A
14547 >queueresume command (S)</DT
14548 ><DD
14549 ><P
14550 >This parameter specifies the command to be
14551                 executed on the server host in order to resume the printer queue. It
14552                 is the command to undo the behavior that is caused by the
14553                 previous parameter (<A
14554 HREF="#QUEUEPAUSECOMMAND"
14555 ><TT
14556 CLASS="PARAMETER"
14557 ><I
14558 >               queuepause command</I
14559 ></TT
14560 ></A
14561 >).</P
14562 ><P
14563 >This command should be a program or script which takes
14564                 a printer name as its only parameter and resumes the printer queue,
14565                 such that queued jobs are resubmitted to the printer.</P
14566 ><P
14567 >This command is not supported by Windows for Workgroups,
14568                 but can be issued from the Printers window under Windows 95
14569                 and NT.</P
14570 ><P
14571 >If a <TT
14572 CLASS="PARAMETER"
14573 ><I
14574 >%p</I
14575 ></TT
14576 > is given then the printer name
14577                 is put in its place. Otherwise it is placed at the end of the
14578                 command.</P
14579 ><P
14580 >Note that it is good practice to include the absolute
14581                 path in the command as the PATH may not be available to the
14582                 server.</P
14583 ><P
14584 >Default: <EM
14585 >depends on the setting of <A
14586 HREF="#PRINTING"
14587 ><TT
14588 CLASS="PARAMETER"
14589 ><I
14590 >printing</I
14591 ></TT
14592 ></A
14593 ></EM
14594 >
14595                 </P
14596 ><P
14597 >Example: <B
14598 CLASS="COMMAND"
14599 >queuepause command = enable %p
14600                 </B
14601 ></P
14602 ></DD
14603 ><DT
14604 ><A
14605 NAME="READBMPX"
14606 ></A
14607 >read bmpx (G)</DT
14608 ><DD
14609 ><P
14610 >This boolean parameter controls whether <A
14611 HREF="smbd.8.html"
14612 TARGET="_top"
14613 >smbd(8)</A
14614 > will support the "Read
14615                 Block Multiplex" SMB. This is now rarely used and defaults to
14616                 <TT
14617 CLASS="CONSTANT"
14618 >no</TT
14619 >. You should never need to set this
14620                 parameter.</P
14621 ><P
14622 >Default: <B
14623 CLASS="COMMAND"
14624 >read bmpx = no</B
14625 ></P
14626 ></DD
14627 ><DT
14628 ><A
14629 NAME="READLIST"
14630 ></A
14631 >read list (S)</DT
14632 ><DD
14633 ><P
14634 >This is a list of users that are given read-only
14635                 access to a service. If the connecting user is in this list then
14636                 they will not be given write access, no matter what the <A
14637 HREF="#WRITEABLE"
14638 ><TT
14639 CLASS="PARAMETER"
14640 ><I
14641 >writeable</I
14642 ></TT
14643 ></A
14644 >
14645                 option is set to. The list can include group names using the
14646                 syntax described in the <A
14647 HREF="#INVALIDUSERS"
14648 ><TT
14649 CLASS="PARAMETER"
14650 ><I
14651 >               invalid users</I
14652 ></TT
14653 ></A
14654 > parameter.</P
14655 ><P
14656 >See also the <A
14657 HREF="#WRITELIST"
14658 ><TT
14659 CLASS="PARAMETER"
14660 ><I
14661 >               write list</I
14662 ></TT
14663 ></A
14664 > parameter and the <A
14665 HREF="#INVALIDUSERS"
14666 ><TT
14667 CLASS="PARAMETER"
14668 ><I
14669 >invalid users</I
14670 ></TT
14671 >
14672                 </A
14673 > parameter.</P
14674 ><P
14675 >Default: <B
14676 CLASS="COMMAND"
14677 >read list = &#60;empty string&#62;</B
14678 ></P
14679 ><P
14680 >Example: <B
14681 CLASS="COMMAND"
14682 >read list = mary, @students</B
14683 ></P
14684 ></DD
14685 ><DT
14686 ><A
14687 NAME="READONLY"
14688 ></A
14689 >read only (S)</DT
14690 ><DD
14691 ><P
14692 >Note that this is an inverted synonym for <A
14693 HREF="#WRITEABLE"
14694 ><TT
14695 CLASS="PARAMETER"
14696 ><I
14697 >writeable</I
14698 ></TT
14699 ></A
14700 >.</P
14701 ></DD
14702 ><DT
14703 ><A
14704 NAME="READRAW"
14705 ></A
14706 >read raw (G)</DT
14707 ><DD
14708 ><P
14709 >This parameter controls whether or not the server
14710                 will support the raw read SMB requests when transferring data
14711                 to clients.</P
14712 ><P
14713 >If enabled, raw reads allow reads of 65535 bytes in
14714                 one packet. This typically provides a major performance benefit.
14715                 </P
14716 ><P
14717 >However, some clients either negotiate the allowable
14718                 block size incorrectly or are incapable of supporting larger block
14719                 sizes, and for these clients you may need to disable raw reads.</P
14720 ><P
14721 >In general this parameter should be viewed as a system tuning
14722                 tool and left severely alone. See also <A
14723 HREF="#WRITERAW"
14724 >               <TT
14725 CLASS="PARAMETER"
14726 ><I
14727 >write raw</I
14728 ></TT
14729 ></A
14730 >.</P
14731 ><P
14732 >Default: <B
14733 CLASS="COMMAND"
14734 >read raw = yes</B
14735 ></P
14736 ></DD
14737 ><DT
14738 ><A
14739 NAME="READSIZE"
14740 ></A
14741 >read size (G)</DT
14742 ><DD
14743 ><P
14744 >The option <TT
14745 CLASS="PARAMETER"
14746 ><I
14747 >read size</I
14748 ></TT
14749 >
14750                 affects the overlap of disk reads/writes with network reads/writes.
14751                 If the amount of data being transferred in several of the SMB
14752                 commands (currently SMBwrite, SMBwriteX and SMBreadbraw) is larger
14753                 than this value then the server begins writing the data before it
14754                 has received the whole packet from the network, or in the case of
14755                 SMBreadbraw, it begins writing to the network before all the data
14756                 has been read from disk.</P
14757 ><P
14758 >This overlapping works best when the speeds of disk and
14759                 network access are similar, having very little effect when the
14760                 speed of one is much greater than the other.</P
14761 ><P
14762 >The default value is 16384, but very little experimentation
14763                 has been done yet to determine the optimal value, and it is likely
14764                 that the best value will vary greatly between systems anyway.
14765                 A value over 65536 is pointless and will cause you to allocate
14766                 memory unnecessarily.</P
14767 ><P
14768 >Default: <B
14769 CLASS="COMMAND"
14770 >read size = 16384</B
14771 ></P
14772 ><P
14773 >Example: <B
14774 CLASS="COMMAND"
14775 >read size = 8192</B
14776 ></P
14777 ></DD
14778 ><DT
14779 ><A
14780 NAME="REMOTEANNOUNCE"
14781 ></A
14782 >remote announce (G)</DT
14783 ><DD
14784 ><P
14785 >This option allows you to setup <A
14786 HREF="nmbd.8.html"
14787 TARGET="_top"
14788 >nmbd(8)</A
14789 > to periodically announce itself
14790                 to arbitrary IP addresses with an arbitrary workgroup name.</P
14791 ><P
14792 >This is useful if you want your Samba server to appear
14793                 in a remote workgroup for which the normal browse propagation
14794                 rules don't work. The remote workgroup can be anywhere that you
14795                 can send IP packets to.</P
14796 ><P
14797 >For example:</P
14798 ><P
14799 ><B
14800 CLASS="COMMAND"
14801 >remote announce = 192.168.2.255/SERVERS
14802                 192.168.4.255/STAFF</B
14803 ></P
14804 ><P
14805 >the above line would cause <B
14806 CLASS="COMMAND"
14807 >nmbd</B
14808 > to announce itself
14809                 to the two given IP addresses using the given workgroup names.
14810                 If you leave out the workgroup name then the one given in
14811                 the <A
14812 HREF="#WORKGROUP"
14813 ><TT
14814 CLASS="PARAMETER"
14815 ><I
14816 >workgroup</I
14817 ></TT
14818 ></A
14819 >
14820                 parameter is used instead.</P
14821 ><P
14822 >The IP addresses you choose would normally be the broadcast
14823                 addresses of the remote networks, but can also be the IP addresses
14824                 of known browse masters if your network config is that stable.</P
14825 ><P
14826 >See the documentation file <TT
14827 CLASS="FILENAME"
14828 >BROWSING.txt</TT
14829 >
14830                 in the <TT
14831 CLASS="FILENAME"
14832 >docs/</TT
14833 > directory.</P
14834 ><P
14835 >Default: <B
14836 CLASS="COMMAND"
14837 >remote announce = &#60;empty string&#62;
14838                 </B
14839 ></P
14840 ></DD
14841 ><DT
14842 ><A
14843 NAME="REMOTEBROWSESYNC"
14844 ></A
14845 >remote browse sync (G)</DT
14846 ><DD
14847 ><P
14848 >This option allows you to setup <A
14849 HREF="nmbd.8.html"
14850 TARGET="_top"
14851 >nmbd(8)</A
14852 > to periodically request
14853                 synchronization of browse lists with the master browser of a Samba
14854                 server that is on a remote segment. This option will allow you to
14855                 gain browse lists for multiple workgroups across routed networks. This
14856                 is done in a manner that does not work with any non-Samba servers.</P
14857 ><P
14858 >This is useful if you want your Samba server and all local
14859                 clients to appear in a remote workgroup for which the normal browse
14860                 propagation rules don't work. The remote workgroup can be anywhere
14861                 that you can send IP packets to.</P
14862 ><P
14863 >For example:</P
14864 ><P
14865 ><B
14866 CLASS="COMMAND"
14867 >remote browse sync = 192.168.2.255 192.168.4.255
14868                 </B
14869 ></P
14870 ><P
14871 >the above line would cause <B
14872 CLASS="COMMAND"
14873 >nmbd</B
14874 > to request
14875                 the master browser on the specified subnets or addresses to
14876                 synchronize their browse lists with the local server.</P
14877 ><P
14878 >The IP addresses you choose would normally be the broadcast
14879                 addresses of the remote networks, but can also be the IP addresses
14880                 of known browse masters if your network config is that stable. If
14881                 a machine IP address is given Samba makes NO attempt to validate
14882                 that the remote machine is available, is listening, nor that it
14883                 is in fact the browse master on its segment.</P
14884 ><P
14885 >Default: <B
14886 CLASS="COMMAND"
14887 >remote browse sync = &#60;empty string&#62;
14888                 </B
14889 ></P
14890 ></DD
14891 ><DT
14892 ><A
14893 NAME="RESTRICTANONYMOUS"
14894 ></A
14895 >restrict anonymous (G)</DT
14896 ><DD
14897 ><P
14898 >This is a boolean parameter.  If it is <TT
14899 CLASS="CONSTANT"
14900 >true</TT
14901 >, then
14902                 anonymous access to the server will be restricted, namely in the
14903                 case where the server is expecting the client to send a username,
14904                 but it doesn't.  Setting it to <TT
14905 CLASS="CONSTANT"
14906 >true</TT
14907 > will force these anonymous
14908                 connections to be denied, and the client will be required to always
14909                 supply a username and password when connecting. Use of this parameter
14910                 is only recommended for homogeneous NT client environments.</P
14911 ><P
14912 >This parameter makes the use of macro expansions that rely
14913                 on the username (%U, %G, etc) consistent.  NT 4.0
14914                 likes to use anonymous connections when refreshing the share list,
14915                 and this is a way to work around that.</P
14916 ><P
14917 >When restrict anonymous is <TT
14918 CLASS="CONSTANT"
14919 >true</TT
14920 >, all anonymous connections
14921                 are denied no matter what they are for.  This can effect the ability
14922                 of a machine to access the Samba Primary Domain Controller to revalidate
14923                 its machine account after someone else has logged on the client
14924                 interactively.  The NT client will display a message saying that
14925                 the machine's account in  the domain doesn't exist or the password is
14926                 bad.  The best way to deal  with this is to reboot NT client machines
14927                 between interactive logons,  using "Shutdown and Restart", rather
14928                 than "Close all programs and logon as a different user".</P
14929 ><P
14930 >Default: <B
14931 CLASS="COMMAND"
14932 >restrict anonymous = no</B
14933 ></P
14934 ></DD
14935 ><DT
14936 ><A
14937 NAME="ROOT"
14938 ></A
14939 >root (G)</DT
14940 ><DD
14941 ><P
14942 >Synonym for <A
14943 HREF="#ROOTDIRECTORY"
14944 >               <TT
14945 CLASS="PARAMETER"
14946 ><I
14947 >root directory"</I
14948 ></TT
14949 ></A
14950 >.</P
14951 ></DD
14952 ><DT
14953 ><A
14954 NAME="ROOTDIR"
14955 ></A
14956 >root dir (G)</DT
14957 ><DD
14958 ><P
14959 >Synonym for <A
14960 HREF="#ROOTDIRECTORY"
14961 >               <TT
14962 CLASS="PARAMETER"
14963 ><I
14964 >root directory"</I
14965 ></TT
14966 ></A
14967 >.</P
14968 ></DD
14969 ><DT
14970 ><A
14971 NAME="ROOTDIRECTORY"
14972 ></A
14973 >root directory (G)</DT
14974 ><DD
14975 ><P
14976 >The server will <B
14977 CLASS="COMMAND"
14978 >chroot()</B
14979 > (i.e.
14980                 Change its root directory) to this directory on startup. This is
14981                 not strictly necessary for secure operation. Even without it the
14982                 server will deny access to files not in one of the service entries.
14983                 It may also check for, and deny access to, soft links to other
14984                 parts of the filesystem, or attempts to use ".." in file names
14985                 to access other directories (depending on the setting of the <A
14986 HREF="#WIDELINKS"
14987 ><TT
14988 CLASS="PARAMETER"
14989 ><I
14990 >wide links</I
14991 ></TT
14992 ></A
14993 >
14994                 parameter).</P
14995 ><P
14996 >Adding a <TT
14997 CLASS="PARAMETER"
14998 ><I
14999 >root directory</I
15000 ></TT
15001 > entry other
15002                 than "/" adds an extra level of security, but at a price. It
15003                 absolutely ensures that no access is given to files not in the
15004                 sub-tree specified in the <TT
15005 CLASS="PARAMETER"
15006 ><I
15007 >root directory</I
15008 ></TT
15009 >
15010                 option, <EM
15011 >including</EM
15012 > some files needed for
15013                 complete operation of the server. To maintain full operability
15014                 of the server you will need to mirror some system files
15015                 into the <TT
15016 CLASS="PARAMETER"
15017 ><I
15018 >root directory</I
15019 ></TT
15020 > tree. In particular
15021                 you will need to mirror <TT
15022 CLASS="FILENAME"
15023 >/etc/passwd</TT
15024 > (or a
15025                 subset of it), and any binaries or configuration files needed for
15026                 printing (if required). The set of files that must be mirrored is
15027                 operating system dependent.</P
15028 ><P
15029 >Default: <B
15030 CLASS="COMMAND"
15031 >root directory = /</B
15032 ></P
15033 ><P
15034 >Example: <B
15035 CLASS="COMMAND"
15036 >root directory = /homes/smb</B
15037 ></P
15038 ></DD
15039 ><DT
15040 ><A
15041 NAME="ROOTPOSTEXEC"
15042 ></A
15043 >root postexec (S)</DT
15044 ><DD
15045 ><P
15046 >This is the same as the <TT
15047 CLASS="PARAMETER"
15048 ><I
15049 >postexec</I
15050 ></TT
15051 >
15052                 parameter except that the command is run as root. This
15053                 is useful for unmounting filesystems
15054                 (such as CDROMs) after a connection is closed.</P
15055 ><P
15056 >See also <A
15057 HREF="#POSTEXEC"
15058 ><TT
15059 CLASS="PARAMETER"
15060 ><I
15061 >               postexec</I
15062 ></TT
15063 ></A
15064 >.</P
15065 ><P
15066 >Default: <B
15067 CLASS="COMMAND"
15068 >root postexec = &#60;empty string&#62;
15069                 </B
15070 ></P
15071 ></DD
15072 ><DT
15073 ><A
15074 NAME="ROOTPREEXEC"
15075 ></A
15076 >root preexec (S)</DT
15077 ><DD
15078 ><P
15079 >This is the same as the <TT
15080 CLASS="PARAMETER"
15081 ><I
15082 >preexec</I
15083 ></TT
15084 >
15085                 parameter except that the command is run as root. This
15086                 is useful for mounting filesystems (such as CDROMs) when a
15087                 connection is opened.</P
15088 ><P
15089 >See also <A
15090 HREF="#PREEXEC"
15091 ><TT
15092 CLASS="PARAMETER"
15093 ><I
15094 >               preexec</I
15095 ></TT
15096 ></A
15097 > and <A
15098 HREF="#PREEXECCLOSE"
15099 >               <TT
15100 CLASS="PARAMETER"
15101 ><I
15102 >preexec close</I
15103 ></TT
15104 ></A
15105 >.</P
15106 ><P
15107 >Default: <B
15108 CLASS="COMMAND"
15109 >root preexec = &#60;empty string&#62;
15110                 </B
15111 ></P
15112 ></DD
15113 ><DT
15114 ><A
15115 NAME="ROOTPREEXECCLOSE"
15116 ></A
15117 >root preexec close (S)</DT
15118 ><DD
15119 ><P
15120 >This is the same as the <TT
15121 CLASS="PARAMETER"
15122 ><I
15123 >preexec close
15124                 </I
15125 ></TT
15126 > parameter except that the command is run as root.</P
15127 ><P
15128 >See also <A
15129 HREF="#PREEXEC"
15130 ><TT
15131 CLASS="PARAMETER"
15132 ><I
15133 >               preexec</I
15134 ></TT
15135 ></A
15136 > and <A
15137 HREF="#PREEXECCLOSE"
15138 >               <TT
15139 CLASS="PARAMETER"
15140 ><I
15141 >preexec close</I
15142 ></TT
15143 ></A
15144 >.</P
15145 ><P
15146 >Default: <B
15147 CLASS="COMMAND"
15148 >root preexec close = no</B
15149 ></P
15150 ></DD
15151 ><DT
15152 ><A
15153 NAME="SECURITY"
15154 ></A
15155 >security (G)</DT
15156 ><DD
15157 ><P
15158 >This option affects how clients respond to
15159                 Samba and is one of the most important settings in the <TT
15160 CLASS="FILENAME"
15161 >               smb.conf</TT
15162 > file.</P
15163 ><P
15164 >The option sets the "security mode bit" in replies to
15165                 protocol negotiations with <A
15166 HREF="smbd.8.html"
15167 TARGET="_top"
15168 >smbd(8)
15169                 </A
15170 > to turn share level security on or off. Clients decide
15171                 based on this bit whether (and how) to transfer user and password
15172                 information to the server.</P
15173 ><P
15174 >The default is <B
15175 CLASS="COMMAND"
15176 >security = user</B
15177 >, as this is
15178                 the most common setting needed when talking to Windows 98 and
15179                 Windows NT.</P
15180 ><P
15181 >The alternatives are <B
15182 CLASS="COMMAND"
15183 >security = share</B
15184 >,
15185                 <B
15186 CLASS="COMMAND"
15187 >security = server</B
15188 > or <B
15189 CLASS="COMMAND"
15190 >security = domain
15191                 </B
15192 >.</P
15193 ><P
15194 >In versions of Samba prior to 2.0.0, the default was
15195                 <B
15196 CLASS="COMMAND"
15197 >security = share</B
15198 > mainly because that was
15199                 the only option at one stage.</P
15200 ><P
15201 >There is a bug in WfWg that has relevance to this
15202                 setting. When in user or server level security a WfWg client
15203                 will totally ignore the password you type in the "connect
15204                 drive" dialog box. This makes it very difficult (if not impossible)
15205                 to connect to a Samba service as anyone except the user that
15206                 you are logged into WfWg as.</P
15207 ><P
15208 >If your PCs use usernames that are the same as their
15209                 usernames on the UNIX machine then you will want to use
15210                 <B
15211 CLASS="COMMAND"
15212 >security = user</B
15213 >. If you mostly use usernames
15214                 that don't exist on the UNIX box then use <B
15215 CLASS="COMMAND"
15216 >security =
15217                 share</B
15218 >.</P
15219 ><P
15220 >You should also use <B
15221 CLASS="COMMAND"
15222 >security = share</B
15223 > if you
15224                 want to mainly setup shares without a password (guest shares). This
15225                 is commonly used for a shared printer server. It is more difficult
15226                 to setup guest shares with <B
15227 CLASS="COMMAND"
15228 >security = user</B
15229 >, see
15230                 the <A
15231 HREF="#MAPTOGUEST"
15232 ><TT
15233 CLASS="PARAMETER"
15234 ><I
15235 >map to guest</I
15236 ></TT
15237 >
15238                 </A
15239 >parameter for details.</P
15240 ><P
15241 >It is possible to use <B
15242 CLASS="COMMAND"
15243 >smbd</B
15244 > in a <EM
15245 >               hybrid mode</EM
15246 > where it is offers both user and share
15247                 level security under different <A
15248 HREF="#NETBIOSALIASES"
15249 >               <TT
15250 CLASS="PARAMETER"
15251 ><I
15252 >NetBIOS aliases</I
15253 ></TT
15254 ></A
15255 >. </P
15256 ><P
15257 >The different settings will now be explained.</P
15258 ><P
15259 ><A
15260 NAME="SECURITYEQUALSSHARE"
15261 ></A
15262 ><EM
15263 >SECURITY = SHARE
15264                 </EM
15265 ></P
15266 ><P
15267 >When clients connect to a share level security server they
15268                 need not log onto the server with a valid username and password before
15269                 attempting to connect to a shared resource (although modern clients
15270                 such as Windows 95/98 and Windows NT will send a logon request with
15271                 a username but no password when talking to a <B
15272 CLASS="COMMAND"
15273 >security = share
15274                 </B
15275 > server). Instead, the clients send authentication information
15276                 (passwords) on a per-share basis, at the time they attempt to connect
15277                 to that share.</P
15278 ><P
15279 >Note that <B
15280 CLASS="COMMAND"
15281 >smbd</B
15282 > <EM
15283 >ALWAYS</EM
15284 >
15285                 uses a valid UNIX user to act on behalf of the client, even in
15286                 <B
15287 CLASS="COMMAND"
15288 >security = share</B
15289 > level security.</P
15290 ><P
15291 >As clients are not required to send a username to the server
15292                 in share level security, <B
15293 CLASS="COMMAND"
15294 >smbd</B
15295 > uses several
15296                 techniques to determine the correct UNIX user to use on behalf
15297                 of the client.</P
15298 ><P
15299 >A list of possible UNIX usernames to match with the given
15300                 client password is constructed using the following methods :</P
15301 ><P
15302 ></P
15303 ><UL
15304 ><LI
15305 ><P
15306 >If the <A
15307 HREF="#GUESTONLY"
15308 ><TT
15309 CLASS="PARAMETER"
15310 ><I
15311 >guest
15312                         only</I
15313 ></TT
15314 ></A
15315 > parameter is set, then all the other
15316                         stages are missed and only the <A
15317 HREF="#GUESTACCOUNT"
15318 >                       <TT
15319 CLASS="PARAMETER"
15320 ><I
15321 >guest account</I
15322 ></TT
15323 ></A
15324 > username is checked.
15325                         </P
15326 ></LI
15327 ><LI
15328 ><P
15329 >Is a username is sent with the share connection
15330                         request, then this username (after mapping - see <A
15331 HREF="#USERNAMEMAP"
15332 ><TT
15333 CLASS="PARAMETER"
15334 ><I
15335 >username map</I
15336 ></TT
15337 ></A
15338 >),
15339                         is added as a potential username.</P
15340 ></LI
15341 ><LI
15342 ><P
15343 >If the client did a previous <EM
15344 >logon
15345                         </EM
15346 > request (the SessionSetup SMB call) then the
15347                         username sent in this SMB will be added as a potential username.
15348                         </P
15349 ></LI
15350 ><LI
15351 ><P
15352 >The name of the service the client requested is
15353                         added as a potential username.</P
15354 ></LI
15355 ><LI
15356 ><P
15357 >The NetBIOS name of the client is added to
15358                         the list as a potential username.</P
15359 ></LI
15360 ><LI
15361 ><P
15362 >Any users on the <A
15363 HREF="#USER"
15364 ><TT
15365 CLASS="PARAMETER"
15366 ><I
15367 >                       user</I
15368 ></TT
15369 ></A
15370 > list are added as potential usernames.
15371                         </P
15372 ></LI
15373 ></UL
15374 ><P
15375 >If the <TT
15376 CLASS="PARAMETER"
15377 ><I
15378 >guest only</I
15379 ></TT
15380 > parameter is
15381                 not set, then this list is then tried with the supplied password.
15382                 The first user for whom the password matches will be used as the
15383                 UNIX user.</P
15384 ><P
15385 >If the <TT
15386 CLASS="PARAMETER"
15387 ><I
15388 >guest only</I
15389 ></TT
15390 > parameter is
15391                 set, or no username can be determined then if the share is marked
15392                 as available to the <TT
15393 CLASS="PARAMETER"
15394 ><I
15395 >guest account</I
15396 ></TT
15397 >, then this
15398                 guest user will be used, otherwise access is denied.</P
15399 ><P
15400 >Note that it can be <EM
15401 >very</EM
15402 > confusing
15403                 in share-level security as to which UNIX username will eventually
15404                 be used in granting access.</P
15405 ><P
15406 >See also the section <A
15407 HREF="#AEN236"
15408 >               NOTE ABOUT USERNAME/PASSWORD VALIDATION</A
15409 >.</P
15410 ><P
15411 ><A
15412 NAME="SECURITYEQUALSUSER"
15413 ></A
15414 ><EM
15415 >SECURITY = USER
15416                 </EM
15417 ></P
15418 ><P
15419 >This is the default security setting in Samba 2.2.
15420                 With user-level security a client must first "log-on" with a
15421                 valid username and password (which can be mapped using the <A
15422 HREF="#USERNAMEMAP"
15423 ><TT
15424 CLASS="PARAMETER"
15425 ><I
15426 >username map</I
15427 ></TT
15428 ></A
15429 >
15430                 parameter). Encrypted passwords (see the <A
15431 HREF="#ENCRYPTPASSWORDS"
15432 >               <TT
15433 CLASS="PARAMETER"
15434 ><I
15435 >encrypted passwords</I
15436 ></TT
15437 ></A
15438 > parameter) can also
15439                 be used in this security mode. Parameters such as <A
15440 HREF="#USER"
15441 >               <TT
15442 CLASS="PARAMETER"
15443 ><I
15444 >user</I
15445 ></TT
15446 ></A
15447 > and <A
15448 HREF="#GUESTONLY"
15449 >               <TT
15450 CLASS="PARAMETER"
15451 ><I
15452 >guest only</I
15453 ></TT
15454 ></A
15455 > if set        are then applied and
15456                 may change the UNIX user to use on this connection, but only after
15457                 the user has been successfully authenticated.</P
15458 ><P
15459 ><EM
15460 >Note</EM
15461 > that the name of the resource being
15462                 requested is <EM
15463 >not</EM
15464 > sent to the server until after
15465                 the server has successfully authenticated the client. This is why
15466                 guest shares don't work in user level security without allowing
15467                 the server to automatically map unknown users into the <A
15468 HREF="#GUESTACCOUNT"
15469 ><TT
15470 CLASS="PARAMETER"
15471 ><I
15472 >guest account</I
15473 ></TT
15474 ></A
15475 >.
15476                 See the <A
15477 HREF="#MAPTOGUEST"
15478 ><TT
15479 CLASS="PARAMETER"
15480 ><I
15481 >map to guest</I
15482 ></TT
15483 >
15484                 </A
15485 > parameter for details on doing this.</P
15486 ><P
15487 >See also the section <A
15488 HREF="#AEN236"
15489 >               NOTE ABOUT USERNAME/PASSWORD VALIDATION</A
15490 >.</P
15491 ><P
15492 ><A
15493 NAME="SECURITYEQUALSSERVER"
15494 ></A
15495 ><EM
15496 >SECURITY = SERVER
15497                 </EM
15498 ></P
15499 ><P
15500 >In this mode Samba will try to validate the username/password
15501                 by passing it to another SMB server, such as an NT box. If this
15502                 fails it will revert to <B
15503 CLASS="COMMAND"
15504 >security = user</B
15505 >, but note
15506                 that if encrypted passwords have been negotiated then Samba cannot
15507                 revert back to checking the UNIX password file, it must have a valid
15508                 <TT
15509 CLASS="FILENAME"
15510 >smbpasswd</TT
15511 > file to check users against. See the
15512                 documentation file in the <TT
15513 CLASS="FILENAME"
15514 >docs/</TT
15515 > directory
15516                 <TT
15517 CLASS="FILENAME"
15518 >ENCRYPTION.txt</TT
15519 > for details on how to set this
15520                 up.</P
15521 ><P
15522 ><EM
15523 >Note</EM
15524 > that from the client's point of
15525                 view <B
15526 CLASS="COMMAND"
15527 >security = server</B
15528 > is the same as <B
15529 CLASS="COMMAND"
15530 >               security = user</B
15531 >.  It only affects how the server deals
15532                 with the authentication, it does not in any way affect what the
15533                 client sees.</P
15534 ><P
15535 ><EM
15536 >Note</EM
15537 > that the name of the resource being
15538                 requested is <EM
15539 >not</EM
15540 > sent to the server until after
15541                 the server has successfully authenticated the client. This is why
15542                 guest shares don't work in user level security without allowing
15543                 the server to automatically map unknown users into the <A
15544 HREF="#GUESTACCOUNT"
15545 ><TT
15546 CLASS="PARAMETER"
15547 ><I
15548 >guest account</I
15549 ></TT
15550 ></A
15551 >.
15552                 See the <A
15553 HREF="#MAPTOGUEST"
15554 ><TT
15555 CLASS="PARAMETER"
15556 ><I
15557 >map to guest</I
15558 ></TT
15559 >
15560                 </A
15561 > parameter for details on doing this.</P
15562 ><P
15563 >See also the section <A
15564 HREF="#AEN236"
15565 >               NOTE ABOUT USERNAME/PASSWORD VALIDATION</A
15566 >.</P
15567 ><P
15568 >See also the <A
15569 HREF="#PASSWORDSERVER"
15570 ><TT
15571 CLASS="PARAMETER"
15572 ><I
15573 >password
15574                 server</I
15575 ></TT
15576 ></A
15577 > parameter and the <A
15578 HREF="#ENCRYPTPASSWORDS"
15579 ><TT
15580 CLASS="PARAMETER"
15581 ><I
15582 >encrypted passwords</I
15583 ></TT
15584 >
15585                 </A
15586 > parameter.</P
15587 ><P
15588 ><A
15589 NAME="SECURITYEQUALSDOMAIN"
15590 ></A
15591 ><EM
15592 >SECURITY = DOMAIN
15593                 </EM
15594 ></P
15595 ><P
15596 >This mode will only work correctly if <A
15597 HREF="smbpasswd.8.html"
15598 TARGET="_top"
15599 >smbpasswd(8)</A
15600 > has been used to add this
15601                 machine into a Windows NT Domain. It expects the <A
15602 HREF="#ENCRYPTPASSWORDS"
15603 ><TT
15604 CLASS="PARAMETER"
15605 ><I
15606 >encrypted passwords</I
15607 ></TT
15608 >
15609                 </A
15610 > parameter to be set to <TT
15611 CLASS="CONSTANT"
15612 >true</TT
15613 >. In this
15614                 mode Samba will try to validate the username/password by passing
15615                 it to a Windows NT Primary or Backup Domain Controller, in exactly
15616                 the same way that a Windows NT Server would do.</P
15617 ><P
15618 ><EM
15619 >Note</EM
15620 > that a valid UNIX user must still
15621                 exist as well as the account on the Domain Controller to allow
15622                 Samba to have a valid UNIX account to map file access to.</P
15623 ><P
15624 ><EM
15625 >Note</EM
15626 > that from the client's point
15627                 of view <B
15628 CLASS="COMMAND"
15629 >security = domain</B
15630 > is the same as <B
15631 CLASS="COMMAND"
15632 >security = user
15633                 </B
15634 >. It only affects how the server deals with the authentication,
15635                 it does not in any way affect what the client sees.</P
15636 ><P
15637 ><EM
15638 >Note</EM
15639 > that the name of the resource being
15640                 requested is <EM
15641 >not</EM
15642 > sent to the server until after
15643                 the server has successfully authenticated the client. This is why
15644                 guest shares don't work in user level security without allowing
15645                 the server to automatically map unknown users into the <A
15646 HREF="#GUESTACCOUNT"
15647 ><TT
15648 CLASS="PARAMETER"
15649 ><I
15650 >guest account</I
15651 ></TT
15652 ></A
15653 >.
15654                 See the <A
15655 HREF="#MAPTOGUEST"
15656 ><TT
15657 CLASS="PARAMETER"
15658 ><I
15659 >map to guest</I
15660 ></TT
15661 >
15662                 </A
15663 > parameter for details on doing this.</P
15664 ><P
15665 ><EM
15666 >BUG:</EM
15667 > There is currently a bug in the
15668                 implementation of <B
15669 CLASS="COMMAND"
15670 >security = domain</B
15671 > with respect
15672                 to multi-byte character set usernames. The communication with a
15673                 Domain Controller must be done in UNICODE and Samba currently
15674                 does not widen multi-byte user names to UNICODE correctly, thus
15675                 a multi-byte username will not be recognized correctly at the
15676                 Domain Controller. This issue will be addressed in a future release.</P
15677 ><P
15678 >See also the section <A
15679 HREF="#AEN236"
15680 >               NOTE ABOUT USERNAME/PASSWORD VALIDATION</A
15681 >.</P
15682 ><P
15683 >See also the <A
15684 HREF="#PASSWORDSERVER"
15685 ><TT
15686 CLASS="PARAMETER"
15687 ><I
15688 >password
15689                 server</I
15690 ></TT
15691 ></A
15692 > parameter and the <A
15693 HREF="#ENCRYPTPASSWORDS"
15694 ><TT
15695 CLASS="PARAMETER"
15696 ><I
15697 >encrypted passwords</I
15698 ></TT
15699 >
15700                 </A
15701 > parameter.</P
15702 ><P
15703 >Default: <B
15704 CLASS="COMMAND"
15705 >security = USER</B
15706 ></P
15707 ><P
15708 >Example: <B
15709 CLASS="COMMAND"
15710 >security = DOMAIN</B
15711 ></P
15712 ></DD
15713 ><DT
15714 ><A
15715 NAME="SECURITYMASK"
15716 ></A
15717 >security mask (S)</DT
15718 ><DD
15719 ><P
15720 >This parameter controls what UNIX permission
15721                 bits can be modified when a Windows NT client is manipulating
15722                 the UNIX permission on a file using the native NT security
15723                 dialog box.</P
15724 ><P
15725 >This parameter is applied as a mask (AND'ed with) to
15726                 the changed permission bits, thus preventing any bits not in
15727                 this mask from being modified. Essentially, zero bits in this
15728                 mask may be treated as a set of bits the user is not allowed
15729                 to change.</P
15730 ><P
15731 >If not set explicitly this parameter is 0777, allowing
15732                 a user to modify all the user/group/world permissions on a file.
15733                 </P
15734 ><P
15735 ><EM
15736 >Note</EM
15737 > that users who can access the
15738                 Samba server through other means can easily bypass this
15739                 restriction, so it is primarily useful for standalone
15740                 "appliance" systems.  Administrators of most normal systems will
15741                 probably want to leave it set to <TT
15742 CLASS="CONSTANT"
15743 >0777</TT
15744 >.</P
15745 ><P
15746 >See also the <A
15747 HREF="#FORCEDIRECTORYSECURITYMODE"
15748 >               <TT
15749 CLASS="PARAMETER"
15750 ><I
15751 >force directory security mode</I
15752 ></TT
15753 ></A
15754 >,
15755                 <A
15756 HREF="#DIRECTORYSECURITYMASK"
15757 ><TT
15758 CLASS="PARAMETER"
15759 ><I
15760 >directory
15761                 security mask</I
15762 ></TT
15763 ></A
15764 >, <A
15765 HREF="#FORCESECURITYMODE"
15766 >               <TT
15767 CLASS="PARAMETER"
15768 ><I
15769 >force security mode</I
15770 ></TT
15771 ></A
15772 > parameters.</P
15773 ><P
15774 >Default: <B
15775 CLASS="COMMAND"
15776 >security mask = 0777</B
15777 ></P
15778 ><P
15779 >Example: <B
15780 CLASS="COMMAND"
15781 >security mask = 0770</B
15782 ></P
15783 ></DD
15784 ><DT
15785 ><A
15786 NAME="SERVERSTRING"
15787 ></A
15788 >server string (G)</DT
15789 ><DD
15790 ><P
15791 >This controls what string will show up in the
15792                 printer comment box in print manager and next to the IPC connection
15793                 in <B
15794 CLASS="COMMAND"
15795 >net view</B
15796 >. It can be any string that you wish
15797                 to show to your users.</P
15798 ><P
15799 >It also sets what will appear in browse lists next
15800                 to the machine name.</P
15801 ><P
15802 >A <TT
15803 CLASS="PARAMETER"
15804 ><I
15805 >%v</I
15806 ></TT
15807 > will be replaced with the Samba
15808                 version number.</P
15809 ><P
15810 >A <TT
15811 CLASS="PARAMETER"
15812 ><I
15813 >%h</I
15814 ></TT
15815 > will be replaced with the
15816                 hostname.</P
15817 ><P
15818 >Default: <B
15819 CLASS="COMMAND"
15820 >server string = Samba %v</B
15821 ></P
15822 ><P
15823 >Example: <B
15824 CLASS="COMMAND"
15825 >server string = University of GNUs Samba
15826                 Server</B
15827 ></P
15828 ></DD
15829 ><DT
15830 ><A
15831 NAME="SETDIRECTORY"
15832 ></A
15833 >set directory (S)</DT
15834 ><DD
15835 ><P
15836 >If <B
15837 CLASS="COMMAND"
15838 >set directory = no</B
15839 >, then
15840                 users of the service may not use the setdir command to change
15841                 directory.</P
15842 ><P
15843 >The <B
15844 CLASS="COMMAND"
15845 >setdir</B
15846 > command is only implemented
15847                 in the Digital Pathworks client. See the Pathworks documentation
15848                 for details.</P
15849 ><P
15850 >Default: <B
15851 CLASS="COMMAND"
15852 >set directory = no</B
15853 ></P
15854 ></DD
15855 ><DT
15856 ><A
15857 NAME="SHORTPRESERVECASE"
15858 ></A
15859 >short preserve case (S)</DT
15860 ><DD
15861 ><P
15862 >This boolean parameter controls if new files
15863                 which conform to 8.3 syntax, that is all in upper case and of
15864                 suitable length, are created upper case, or if they are forced
15865                 to be the <A
15866 HREF="#DEFAULTCASE"
15867 ><TT
15868 CLASS="PARAMETER"
15869 ><I
15870 >default case
15871                 </I
15872 ></TT
15873 ></A
15874 >. This  option can be use with <A
15875 HREF="#PRESERVECASE"
15876 ><B
15877 CLASS="COMMAND"
15878 >preserve case = yes</B
15879 >
15880                 </A
15881 > to permit long filenames to retain their case, while short
15882                 names are lowered. </P
15883 ><P
15884 >See the section on <A
15885 HREF="#AEN203"
15886 >               NAME MANGLING</A
15887 >.</P
15888 ><P
15889 >Default: <B
15890 CLASS="COMMAND"
15891 >short preserve case = yes</B
15892 ></P
15893 ></DD
15894 ><DT
15895 ><A
15896 NAME="SHOWADDPRINTERWIZARD"
15897 ></A
15898 >show add printer wizard (G)</DT
15899 ><DD
15900 ><P
15901 >With the introduction of MS-RPC based printing support
15902                 for Windows NT/2000 client in Samba 2.2, a "Printers..." folder will
15903                 appear on Samba hosts in the share listing.  Normally this folder will
15904                 contain an icon for the MS Add Printer Wizard (APW).  However, it is
15905                 possible to disable this feature regardless of the level of privilege
15906                 of the connected user.</P
15907 ><P
15908 >Under normal circumstances, the Windows NT/2000 client will
15909                 open a handle on the printer server with OpenPrinterEx() asking for
15910                 Administrator privileges.  If the user does not have administrative
15911                 access on the print server (i.e is not root or a member of the
15912                 <TT
15913 CLASS="PARAMETER"
15914 ><I
15915 >printer admin</I
15916 ></TT
15917 > group), the OpenPrinterEx()
15918                 call fails and the client makes another open call with a request for
15919                 a lower privilege level.  This should succeed, however the APW
15920                 icon will not be displayed.</P
15921 ><P
15922 >Disabling the <TT
15923 CLASS="PARAMETER"
15924 ><I
15925 >show add printer wizard</I
15926 ></TT
15927 >
15928                 parameter will always cause the OpenPrinterEx() on the server
15929                 to fail.  Thus the APW icon will never be displayed. <EM
15930 >               Note :</EM
15931 >This does not prevent the same user from having
15932                 administrative privilege on an individual printer.</P
15933 ><P
15934 >See also <A
15935 HREF="#ADDPRINTERCOMMAND"
15936 ><TT
15937 CLASS="PARAMETER"
15938 ><I
15939 >addprinter
15940                 command</I
15941 ></TT
15942 ></A
15943 >, <A
15944 HREF="#DELETEPRINTERCOMMAND"
15945 >               <TT
15946 CLASS="PARAMETER"
15947 ><I
15948 >deleteprinter command</I
15949 ></TT
15950 ></A
15951 >, <A
15952 HREF="#PRINTERADMIN"
15953 ><TT
15954 CLASS="PARAMETER"
15955 ><I
15956 >printer admin</I
15957 ></TT
15958 ></A
15959 ></P
15960 ><P
15961 >Default :<B
15962 CLASS="COMMAND"
15963 >show add printer wizard = yes</B
15964 ></P
15965 ></DD
15966 ><DT
15967 ><A
15968 NAME="SHUTDOWNSCRIPT"
15969 ></A
15970 >shutdown script (G)</DT
15971 ><DD
15972 ><P
15973 ><EM
15974 >This parameter only exists in the HEAD cvs branch</EM
15975 >
15976                 This a full path name to a script called by
15977                 <A
15978 HREF="smbd.8.html"
15979 TARGET="_top"
15980 ><B
15981 CLASS="COMMAND"
15982 >smbd(8)</B
15983 ></A
15984 > that
15985                 should start a shutdown procedure.</P
15986 ><P
15987 >This command will be run as the user connected to the
15988                 server.</P
15989 ><P
15990 >%m %t %r %f parameters are expanded</P
15991 ><P
15992 ><TT
15993 CLASS="PARAMETER"
15994 ><I
15995 >%m</I
15996 ></TT
15997 > will be substituted with the
15998                 shutdown message sent to the server.</P
15999 ><P
16000 ><TT
16001 CLASS="PARAMETER"
16002 ><I
16003 >%t</I
16004 ></TT
16005 > will be substituted with the
16006                 number of seconds to wait before effectively starting the
16007                 shutdown procedure.</P
16008 ><P
16009 ><TT
16010 CLASS="PARAMETER"
16011 ><I
16012 >%r</I
16013 ></TT
16014 > will be substituted with the
16015                 switch <EM
16016 >-r</EM
16017 >. It means reboot after shutdown
16018                 for NT.
16019                 </P
16020 ><P
16021 ><TT
16022 CLASS="PARAMETER"
16023 ><I
16024 >%f</I
16025 ></TT
16026 > will be substituted with the
16027                 switch <EM
16028 >-f</EM
16029 >. It means force the shutdown
16030                 even if applications do not respond for NT.</P
16031 ><P
16032 >Default: <EM
16033 >None</EM
16034 >.</P
16035 ><P
16036 >Example: <B
16037 CLASS="COMMAND"
16038 >abort shutdown script = /usr/local/samba/sbin/shutdown %m %t %r %f</B
16039 ></P
16040 ><P
16041 >Shutdown script example:
16042                 <TABLE
16043 BORDER="0"
16044 BGCOLOR="#E0E0E0"
16045 WIDTH="90%"
16046 ><TR
16047 ><TD
16048 ><PRE
16049 CLASS="PROGRAMLISTING"
16050 >               #!/bin/bash
16051
16052                 $time=0
16053                 let "time/60"
16054                 let "time++"
16055
16056                 /sbin/shutdown $3 $4 +$time $1 &#38;
16057                 </PRE
16058 ></TD
16059 ></TR
16060 ></TABLE
16061 >
16062                 Shutdown does not return so we need to launch it in background.
16063                 </P
16064 ><P
16065 >See also <A
16066 HREF="#ABORTSHUTDOWNSCRIPT"
16067 ><TT
16068 CLASS="PARAMETER"
16069 ><I
16070 >abort shutdown script</I
16071 ></TT
16072 ></A
16073 >.</P
16074 ></DD
16075 ><DT
16076 ><A
16077 NAME="SMBPASSWDFILE"
16078 ></A
16079 >smb passwd file (G)</DT
16080 ><DD
16081 ><P
16082 >This option sets the path to the encrypted
16083                 smbpasswd file.  By default the path to the smbpasswd file
16084                 is compiled into Samba.</P
16085 ><P
16086 >Default: <B
16087 CLASS="COMMAND"
16088 >smb passwd file = ${prefix}/private/smbpasswd
16089                 </B
16090 ></P
16091 ><P
16092 >Example: <B
16093 CLASS="COMMAND"
16094 >smb passwd file = /etc/samba/smbpasswd
16095                 </B
16096 ></P
16097 ></DD
16098 ><DT
16099 ><A
16100 NAME="SOCKETADDRESS"
16101 ></A
16102 >socket address (G)</DT
16103 ><DD
16104 ><P
16105 >This option allows you to control what
16106                 address Samba will listen for connections on. This is used to
16107                 support multiple virtual interfaces on the one server, each
16108                 with a different configuration.</P
16109 ><P
16110 >By default Samba will accept connections on any
16111                 address.</P
16112 ><P
16113 >Example: <B
16114 CLASS="COMMAND"
16115 >socket address = 192.168.2.20</B
16116 >
16117                 </P
16118 ></DD
16119 ><DT
16120 ><A
16121 NAME="SOCKETOPTIONS"
16122 ></A
16123 >socket options (G)</DT
16124 ><DD
16125 ><P
16126 >This option allows you to set socket options
16127                 to be used when talking with the client.</P
16128 ><P
16129 >Socket options are controls on the networking layer
16130                 of the operating systems which allow the connection to be
16131                 tuned.</P
16132 ><P
16133 >This option will typically be used to tune your Samba
16134                 server for optimal performance for your local network. There is
16135                 no way that Samba can know what the optimal parameters are for
16136                 your net, so you must experiment and choose them yourself. We
16137                 strongly suggest you read the appropriate documentation for your
16138                 operating system first (perhaps <B
16139 CLASS="COMMAND"
16140 >man setsockopt</B
16141 >
16142                 will help).</P
16143 ><P
16144 >You may find that on some systems Samba will say
16145                 "Unknown socket option" when you supply an option. This means you
16146                 either incorrectly  typed it or you need to add an include file
16147                 to includes.h for your OS.  If the latter is the case please
16148                 send the patch to <A
16149 HREF="mailto:samba@samba.org"
16150 TARGET="_top"
16151 >               samba@samba.org</A
16152 >.</P
16153 ><P
16154 >Any of the supported socket options may be combined
16155                 in any way you like, as long as your OS allows it.</P
16156 ><P
16157 >This is the list of socket options currently settable
16158                 using this option:</P
16159 ><P
16160 ></P
16161 ><UL
16162 ><LI
16163 ><P
16164 >SO_KEEPALIVE</P
16165 ></LI
16166 ><LI
16167 ><P
16168 >SO_REUSEADDR</P
16169 ></LI
16170 ><LI
16171 ><P
16172 >SO_BROADCAST</P
16173 ></LI
16174 ><LI
16175 ><P
16176 >TCP_NODELAY</P
16177 ></LI
16178 ><LI
16179 ><P
16180 >IPTOS_LOWDELAY</P
16181 ></LI
16182 ><LI
16183 ><P
16184 >IPTOS_THROUGHPUT</P
16185 ></LI
16186 ><LI
16187 ><P
16188 >SO_SNDBUF *</P
16189 ></LI
16190 ><LI
16191 ><P
16192 >SO_RCVBUF *</P
16193 ></LI
16194 ><LI
16195 ><P
16196 >SO_SNDLOWAT *</P
16197 ></LI
16198 ><LI
16199 ><P
16200 >SO_RCVLOWAT *</P
16201 ></LI
16202 ></UL
16203 ><P
16204 >Those marked with a <EM
16205 >'*'</EM
16206 > take an integer
16207                 argument. The others can optionally take a 1 or 0 argument to enable
16208                 or disable the option, by default they will be enabled if you
16209                 don't specify 1 or 0.</P
16210 ><P
16211 >To specify an argument use the syntax SOME_OPTION = VALUE
16212                 for example <B
16213 CLASS="COMMAND"
16214 >SO_SNDBUF = 8192</B
16215 >. Note that you must
16216                 not have any spaces before or after the = sign.</P
16217 ><P
16218 >If you are on a local network then a sensible option
16219                 might be</P
16220 ><P
16221 ><B
16222 CLASS="COMMAND"
16223 >socket options = IPTOS_LOWDELAY</B
16224 ></P
16225 ><P
16226 >If you have a local network then you could try:</P
16227 ><P
16228 ><B
16229 CLASS="COMMAND"
16230 >socket options = IPTOS_LOWDELAY TCP_NODELAY</B
16231 ></P
16232 ><P
16233 >If you are on a wide area network then perhaps try
16234                 setting IPTOS_THROUGHPUT. </P
16235 ><P
16236 >Note that several of the options may cause your Samba
16237                 server to fail completely. Use these options with caution!</P
16238 ><P
16239 >Default: <B
16240 CLASS="COMMAND"
16241 >socket options = TCP_NODELAY</B
16242 ></P
16243 ><P
16244 >Example: <B
16245 CLASS="COMMAND"
16246 >socket options = IPTOS_LOWDELAY</B
16247 ></P
16248 ></DD
16249 ><DT
16250 ><A
16251 NAME="SOURCEENVIRONMENT"
16252 ></A
16253 >source environment (G)</DT
16254 ><DD
16255 ><P
16256 >This parameter causes Samba to set environment
16257                 variables as per the content of the file named.</P
16258 ><P
16259 >If the value of this parameter starts with a "|" character
16260                 then Samba will treat that value as a pipe command to open and
16261                 will set the environment variables from the output of the pipe.</P
16262 ><P
16263 >The contents of the file or the output of the pipe should
16264                 be formatted as the output of the standard Unix <B
16265 CLASS="COMMAND"
16266 >env(1)
16267                 </B
16268 > command. This is of the form :</P
16269 ><P
16270 >Example environment entry:</P
16271 ><P
16272 ><B
16273 CLASS="COMMAND"
16274 >SAMBA_NETBIOS_NAME = myhostname</B
16275 ></P
16276 ><P
16277 >Default: <EM
16278 >No default value</EM
16279 ></P
16280 ><P
16281 >Examples: <B
16282 CLASS="COMMAND"
16283 >source environment = |/etc/smb.conf.sh
16284                 </B
16285 ></P
16286 ><P
16287 >Example: <B
16288 CLASS="COMMAND"
16289 >source environment =
16290                 /usr/local/smb_env_vars</B
16291 ></P
16292 ></DD
16293 ><DT
16294 ><A
16295 NAME="SSL"
16296 ></A
16297 >ssl (G)</DT
16298 ><DD
16299 ><P
16300 >This variable is part of SSL-enabled Samba. This
16301                 is only available if the SSL libraries have been compiled on your
16302                 system and the configure option <B
16303 CLASS="COMMAND"
16304 >--with-ssl</B
16305 > was
16306                 given at configure time.</P
16307 ><P
16308 >This variable enables or disables the entire SSL mode. If
16309                 it is set to <TT
16310 CLASS="CONSTANT"
16311 >no</TT
16312 >, the SSL-enabled Samba behaves
16313                 exactly like the non-SSL Samba. If set to <TT
16314 CLASS="CONSTANT"
16315 >yes</TT
16316 >,
16317                 it depends on the variables <A
16318 HREF="#SSLHOSTS"
16319 ><TT
16320 CLASS="PARAMETER"
16321 ><I
16322 >               ssl hosts</I
16323 ></TT
16324 ></A
16325 > and <A
16326 HREF="#SSLHOSTSRESIGN"
16327 >               <TT
16328 CLASS="PARAMETER"
16329 ><I
16330 >ssl hosts resign</I
16331 ></TT
16332 ></A
16333 > whether an SSL
16334                 connection will be required.</P
16335 ><P
16336 >Default: <B
16337 CLASS="COMMAND"
16338 >ssl = no</B
16339 ></P
16340 ></DD
16341 ><DT
16342 ><A
16343 NAME="SSLCACERTDIR"
16344 ></A
16345 >ssl CA certDir (G)</DT
16346 ><DD
16347 ><P
16348 >This variable is part of SSL-enabled Samba. This
16349                 is only available if the SSL libraries have been compiled on your
16350                 system and the configure option <B
16351 CLASS="COMMAND"
16352 >--with-ssl</B
16353 > was
16354                 given at configure time.</P
16355 ><P
16356 >This variable defines where to look up the Certification
16357                 Authorities. The given directory should contain one file for
16358                 each CA that Samba will trust.  The file name must be the hash
16359                 value over the "Distinguished Name" of the CA. How this directory
16360                 is set up is explained later in this document. All files within the
16361                 directory that don't fit into this naming scheme are ignored. You
16362                 don't need this variable if you don't verify client certificates.</P
16363 ><P
16364 >Default: <B
16365 CLASS="COMMAND"
16366 >ssl CA certDir = /usr/local/ssl/certs
16367                 </B
16368 ></P
16369 ></DD
16370 ><DT
16371 ><A
16372 NAME="SSLCACERTFILE"
16373 ></A
16374 >ssl CA certFile (G)</DT
16375 ><DD
16376 ><P
16377 >This variable is part of SSL-enabled Samba. This
16378                 is only available if the SSL libraries have been compiled on your
16379                 system and the configure option <B
16380 CLASS="COMMAND"
16381 >--with-ssl</B
16382 > was
16383                 given at configure time.</P
16384 ><P
16385 >This variable is a second way to define the trusted CAs.
16386                 The certificates of the trusted CAs are collected in one big
16387                 file and this variable points to the file. You will probably
16388                 only use one of the two ways to define your CAs. The first choice is
16389                 preferable if you have many CAs or want to be flexible, the second
16390                 is preferable if you only have one CA and want to keep things
16391                 simple (you won't need to create the hashed file names). You
16392                 don't need this variable if you don't verify client certificates.</P
16393 ><P
16394 >Default: <B
16395 CLASS="COMMAND"
16396 >ssl CA certFile = /usr/local/ssl/certs/trustedCAs.pem
16397                 </B
16398 ></P
16399 ></DD
16400 ><DT
16401 ><A
16402 NAME="SSLCIPHERS"
16403 ></A
16404 >ssl ciphers (G)</DT
16405 ><DD
16406 ><P
16407 >This variable is part of SSL-enabled Samba. This
16408                 is only available if the SSL libraries have been compiled on your
16409                 system and the configure option <B
16410 CLASS="COMMAND"
16411 >--with-ssl</B
16412 > was
16413                 given at configure time.</P
16414 ><P
16415 >This variable defines the ciphers that should be offered
16416                 during SSL negotiation. You should not set this variable unless
16417                 you know what you are doing.</P
16418 ></DD
16419 ><DT
16420 ><A
16421 NAME="SSLCLIENTCERT"
16422 ></A
16423 >ssl client cert (G)</DT
16424 ><DD
16425 ><P
16426 >This variable is part of SSL-enabled Samba. This
16427                 is only available if the SSL libraries have been compiled on your
16428                 system and the configure option <B
16429 CLASS="COMMAND"
16430 >--with-ssl</B
16431 > was
16432                 given at configure time.</P
16433 ><P
16434 >The certificate in this file is used by <A
16435 HREF="smbclient.1.html"
16436 TARGET="_top"
16437 >               <B
16438 CLASS="COMMAND"
16439 >smbclient(1)</B
16440 ></A
16441 > if it exists. It's needed
16442                 if the server requires a client certificate.</P
16443 ><P
16444 >Default: <B
16445 CLASS="COMMAND"
16446 >ssl client cert = /usr/local/ssl/certs/smbclient.pem
16447                 </B
16448 ></P
16449 ></DD
16450 ><DT
16451 ><A
16452 NAME="SSLCLIENTKEY"
16453 ></A
16454 >ssl client key (G)</DT
16455 ><DD
16456 ><P
16457 >This variable is part of SSL-enabled Samba. This
16458                 is only available if the SSL libraries have been compiled on your
16459                 system and the configure option <B
16460 CLASS="COMMAND"
16461 >--with-ssl</B
16462 > was
16463                 given at configure time.</P
16464 ><P
16465 >This is the private key for <A
16466 HREF="smbclient.1.html"
16467 TARGET="_top"
16468 >               <B
16469 CLASS="COMMAND"
16470 >smbclient(1)</B
16471 ></A
16472 >. It's only needed if the
16473                 client should have a certificate. </P
16474 ><P
16475 >Default: <B
16476 CLASS="COMMAND"
16477 >ssl client key = /usr/local/ssl/private/smbclient.pem
16478                 </B
16479 ></P
16480 ></DD
16481 ><DT
16482 ><A
16483 NAME="SSLCOMPATIBILITY"
16484 ></A
16485 >ssl compatibility (G)</DT
16486 ><DD
16487 ><P
16488 >This variable is part of SSL-enabled Samba. This
16489                 is only available if the SSL libraries have been compiled on your
16490                 system and the configure option <B
16491 CLASS="COMMAND"
16492 >--with-ssl</B
16493 > was
16494                 given at configure time.</P
16495 ><P
16496 >This variable defines whether OpenSSL should be configured
16497                 for bug compatibility with other SSL implementations. This is
16498                 probably not desirable because currently no clients with SSL
16499                 implementations other than OpenSSL exist.</P
16500 ><P
16501 >Default: <B
16502 CLASS="COMMAND"
16503 >ssl compatibility = no</B
16504 ></P
16505 ></DD
16506 ><DT
16507 ><A
16508 NAME="SSLEGDSOCKET"
16509 ></A
16510 >ssl egd socket (G)</DT
16511 ><DD
16512 ><P
16513 >This variable is part of SSL-enabled Samba. This
16514                 is only available if the SSL libraries have been compiled on your
16515                 system and the configure option <B
16516 CLASS="COMMAND"
16517 >--with-ssl</B
16518 > was
16519                 given at configure time.</P
16520 ><P
16521 >               This option is used to define the location of the communiation socket of
16522                 an EGD or PRNGD daemon, from which entropy can be retrieved. This option
16523                 can be used instead of or together with the <A
16524 HREF="#SSLENTROPYFILE"
16525 ><TT
16526 CLASS="PARAMETER"
16527 ><I
16528 >ssl entropy file</I
16529 ></TT
16530 ></A
16531 >
16532                 directive. 255 bytes of entropy will be retrieved from the daemon.
16533                 </P
16534 ><P
16535 >Default: <EM
16536 >none</EM
16537 ></P
16538 ></DD
16539 ><DT
16540 ><A
16541 NAME="SSLENTROPYBYTES"
16542 ></A
16543 >ssl entropy bytes (G)</DT
16544 ><DD
16545 ><P
16546 >This variable is part of SSL-enabled Samba. This
16547                 is only available if the SSL libraries have been compiled on your
16548                 system and the configure option <B
16549 CLASS="COMMAND"
16550 >--with-ssl</B
16551 > was
16552                 given at configure time.</P
16553 ><P
16554 >               This parameter is used to define the number of bytes which should
16555                 be read from the <A
16556 HREF="#SSLENTROPYFILE"
16557 ><TT
16558 CLASS="PARAMETER"
16559 ><I
16560 >ssl entropy
16561                 file</I
16562 ></TT
16563 ></A
16564 > If a -1 is specified, the entire file will
16565                 be read.
16566                 </P
16567 ><P
16568 >Default: <B
16569 CLASS="COMMAND"
16570 >ssl entropy bytes = 255</B
16571 ></P
16572 ></DD
16573 ><DT
16574 ><A
16575 NAME="SSLENTROPYFILE"
16576 ></A
16577 >ssl entropy file (G)</DT
16578 ><DD
16579 ><P
16580 >This variable is part of SSL-enabled Samba. This
16581                 is only available if the SSL libraries have been compiled on your
16582                 system and the configure option <B
16583 CLASS="COMMAND"
16584 >--with-ssl</B
16585 > was
16586                 given at configure time.</P
16587 ><P
16588 >               This parameter is used to specify a file from which processes will
16589                 read "random bytes" on startup.  In order to seed the internal pseudo
16590                 random number generator, entropy must be provided. On system with a
16591                 <TT
16592 CLASS="FILENAME"
16593 >/dev/urandom</TT
16594 > device file, the processes
16595                 will retrieve its entropy from the kernel. On systems without kernel
16596                 entropy support, a file can be supplied that will be read on startup
16597                 and that will be used to seed the PRNG.
16598                 </P
16599 ><P
16600 >Default: <EM
16601 >none</EM
16602 ></P
16603 ></DD
16604 ><DT
16605 ><A
16606 NAME="SSLHOSTS"
16607 ></A
16608 >ssl hosts (G)</DT
16609 ><DD
16610 ><P
16611 >See <A
16612 HREF="#SSLHOSTSRESIGN"
16613 ><TT
16614 CLASS="PARAMETER"
16615 ><I
16616 >               ssl hosts resign</I
16617 ></TT
16618 ></A
16619 >.</P
16620 ></DD
16621 ><DT
16622 ><A
16623 NAME="SSLHOSTSRESIGN"
16624 ></A
16625 >ssl hosts resign (G)</DT
16626 ><DD
16627 ><P
16628 >This variable is part of SSL-enabled Samba. This
16629                 is only available if the SSL libraries have been compiled on your
16630                 system and the configure option <B
16631 CLASS="COMMAND"
16632 >--with-ssl</B
16633 > was
16634                 given at configure time.</P
16635 ><P
16636 >These two variables define whether Samba will go
16637                 into SSL mode or not. If none of them is defined, Samba will
16638                 allow only SSL connections. If the <A
16639 HREF="#SSLHOSTS"
16640 >               <TT
16641 CLASS="PARAMETER"
16642 ><I
16643 >ssl hosts</I
16644 ></TT
16645 ></A
16646 > variable lists
16647                 hosts (by IP-address, IP-address range, net group or name),
16648                 only these hosts will be forced into SSL mode. If the <TT
16649 CLASS="PARAMETER"
16650 ><I
16651 >               ssl hosts resign</I
16652 ></TT
16653 > variable lists hosts, only these
16654                 hosts will <EM
16655 >NOT</EM
16656 > be forced into SSL mode. The syntax for these two
16657                 variables is the same as for the <A
16658 HREF="#HOSTSALLOW"
16659 ><TT
16660 CLASS="PARAMETER"
16661 ><I
16662 >               hosts allow</I
16663 ></TT
16664 ></A
16665 > and <A
16666 HREF="#HOSTSDENY"
16667 >               <TT
16668 CLASS="PARAMETER"
16669 ><I
16670 >hosts deny</I
16671 ></TT
16672 ></A
16673 > pair of variables, only
16674                 that the subject of the decision is different: It's not the access
16675                 right but whether SSL is used or not. </P
16676 ><P
16677 >The example below requires SSL connections from all hosts
16678                 outside the local net (which is 192.168.*.*).</P
16679 ><P
16680 >Default: <B
16681 CLASS="COMMAND"
16682 >ssl hosts = &#60;empty string&#62;</B
16683 ></P
16684 ><P
16685 ><B
16686 CLASS="COMMAND"
16687 >ssl hosts resign = &#60;empty string&#62;</B
16688 ></P
16689 ><P
16690 >Example: <B
16691 CLASS="COMMAND"
16692 >ssl hosts resign = 192.168.</B
16693 ></P
16694 ></DD
16695 ><DT
16696 ><A
16697 NAME="SSLREQUIRECLIENTCERT"
16698 ></A
16699 >ssl require clientcert (G)</DT
16700 ><DD
16701 ><P
16702 >This variable is part of SSL-enabled Samba. This
16703                 is only available if the SSL libraries have been compiled on your
16704                 system and the configure option <B
16705 CLASS="COMMAND"
16706 >--with-ssl</B
16707 > was
16708                 given at configure time.</P
16709 ><P
16710 >If this variable is set to <TT
16711 CLASS="CONSTANT"
16712 >yes</TT
16713 >, the
16714                 server will not tolerate connections from clients that don't
16715                 have a valid certificate. The directory/file given in <A
16716 HREF="#SSLCACERTDIR"
16717 ><TT
16718 CLASS="PARAMETER"
16719 ><I
16720 >ssl CA certDir</I
16721 ></TT
16722 >
16723                 </A
16724 > and <A
16725 HREF="#SSLCACERTFILE"
16726 ><TT
16727 CLASS="PARAMETER"
16728 ><I
16729 >ssl CA certFile
16730                 </I
16731 ></TT
16732 ></A
16733 > will be used to look up the CAs that issued
16734                 the client's certificate. If the certificate can't be verified
16735                 positively, the connection will be terminated.  If this variable
16736                 is set to <TT
16737 CLASS="CONSTANT"
16738 >no</TT
16739 >, clients don't need certificates.
16740                 Contrary to web applications you really <EM
16741 >should</EM
16742 >
16743                 require client certificates. In the web environment the client's
16744                 data is sensitive (credit card numbers) and the server must prove
16745                 to be trustworthy. In a file server environment the server's data
16746                 will be sensitive and the clients must prove to be trustworthy.</P
16747 ><P
16748 >Default: <B
16749 CLASS="COMMAND"
16750 >ssl require clientcert = no</B
16751 ></P
16752 ></DD
16753 ><DT
16754 ><A
16755 NAME="SSLREQUIRESERVERCERT"
16756 ></A
16757 >ssl require servercert (G)</DT
16758 ><DD
16759 ><P
16760 >This variable is part of SSL-enabled Samba. This
16761                 is only available if the SSL libraries have been compiled on your
16762                 system and the configure option <B
16763 CLASS="COMMAND"
16764 >--with-ssl</B
16765 > was
16766                 given at configure time.</P
16767 ><P
16768 >If this variable is set to <TT
16769 CLASS="CONSTANT"
16770 >yes</TT
16771 >, the
16772                 <A
16773 HREF="smbclient.1.html"
16774 TARGET="_top"
16775 ><B
16776 CLASS="COMMAND"
16777 >smbclient(1)</B
16778 >
16779                 </A
16780 > will request a certificate from the server. Same as
16781                 <A
16782 HREF="#SSLREQUIRECLIENTCERT"
16783 ><TT
16784 CLASS="PARAMETER"
16785 ><I
16786 >ssl require
16787                 clientcert</I
16788 ></TT
16789 ></A
16790 > for the server.</P
16791 ><P
16792 >Default: <B
16793 CLASS="COMMAND"
16794 >ssl require servercert = no</B
16795 >
16796                 </P
16797 ></DD
16798 ><DT
16799 ><A
16800 NAME="SSLSERVERCERT"
16801 ></A
16802 >ssl server cert (G)</DT
16803 ><DD
16804 ><P
16805 >This variable is part of SSL-enabled Samba. This
16806                 is only available if the SSL libraries have been compiled on your
16807                 system and the configure option <B
16808 CLASS="COMMAND"
16809 >--with-ssl</B
16810 > was
16811                 given at configure time.</P
16812 ><P
16813 >This is the file containing the server's certificate.
16814                 The server <EM
16815 >must</EM
16816 > have a certificate. The
16817                 file may also contain the server's private key. See later for
16818                 how certificates and private keys are created.</P
16819 ><P
16820 >Default: <B
16821 CLASS="COMMAND"
16822 >ssl server cert = &#60;empty string&#62;
16823                 </B
16824 ></P
16825 ></DD
16826 ><DT
16827 ><A
16828 NAME="SSLSERVERKEY"
16829 ></A
16830 >ssl server key (G)</DT
16831 ><DD
16832 ><P
16833 >This variable is part of SSL-enabled Samba. This
16834                 is only available if the SSL libraries have been compiled on your
16835                 system and the configure option <B
16836 CLASS="COMMAND"
16837 >--with-ssl</B
16838 > was
16839                 given at configure time.</P
16840 ><P
16841 >This file contains the private key of the server. If
16842                 this variable is not defined, the key is looked up in the
16843                 certificate file (it may be appended to the certificate).
16844                 The server <EM
16845 >must</EM
16846 > have a private key
16847                 and the certificate <EM
16848 >must</EM
16849 >
16850                 match this private key.</P
16851 ><P
16852 >Default: <B
16853 CLASS="COMMAND"
16854 >ssl server key = &#60;empty string&#62;
16855                 </B
16856 ></P
16857 ></DD
16858 ><DT
16859 ><A
16860 NAME="SSLVERSION"
16861 ></A
16862 >ssl version (G)</DT
16863 ><DD
16864 ><P
16865 >This variable is part of SSL-enabled Samba. This
16866                 is only available if the SSL libraries have been compiled on your
16867                 system and the configure option <B
16868 CLASS="COMMAND"
16869 >--with-ssl</B
16870 > was
16871                 given at configure time.</P
16872 ><P
16873 >This enumeration variable defines the versions of the
16874                 SSL protocol that will be used. <TT
16875 CLASS="CONSTANT"
16876 >ssl2or3</TT
16877 > allows
16878                 dynamic negotiation of SSL v2 or v3, <TT
16879 CLASS="CONSTANT"
16880 >ssl2</TT
16881 > results
16882                 in SSL v2, <TT
16883 CLASS="CONSTANT"
16884 >ssl3</TT
16885 > results in SSL v3 and
16886                 <TT
16887 CLASS="CONSTANT"
16888 >tls1</TT
16889 > results in TLS v1. TLS (Transport Layer
16890                 Security) is the new standard for SSL.</P
16891 ><P
16892 >Default: <B
16893 CLASS="COMMAND"
16894 >ssl version = "ssl2or3"</B
16895 ></P
16896 ></DD
16897 ><DT
16898 ><A
16899 NAME="STATCACHE"
16900 ></A
16901 >stat cache (G)</DT
16902 ><DD
16903 ><P
16904 >This parameter determines if <A
16905 HREF="smbd.8.html"
16906 TARGET="_top"
16907 >smbd(8)</A
16908 > will use a cache in order to
16909                 speed up case insensitive name mappings. You should never need
16910                 to change this parameter.</P
16911 ><P
16912 >Default: <B
16913 CLASS="COMMAND"
16914 >stat cache = yes</B
16915 ></P
16916 ></DD
16917 ><DT
16918 ><A
16919 NAME="STATCACHESIZE"
16920 ></A
16921 >stat cache size (G)</DT
16922 ><DD
16923 ><P
16924 >This parameter determines the number of
16925                 entries in the <TT
16926 CLASS="PARAMETER"
16927 ><I
16928 >stat cache</I
16929 ></TT
16930 >.  You should
16931                 never need to change this parameter.</P
16932 ><P
16933 >Default: <B
16934 CLASS="COMMAND"
16935 >stat cache size = 50</B
16936 ></P
16937 ></DD
16938 ><DT
16939 ><A
16940 NAME="STATUS"
16941 ></A
16942 >status (G)</DT
16943 ><DD
16944 ><P
16945 >This enables or disables logging of connections
16946                 to a status file that <A
16947 HREF="smbstatus.1.html"
16948 TARGET="_top"
16949 >smbstatus(1)</A
16950 >
16951                 can read.</P
16952 ><P
16953 >With this disabled <B
16954 CLASS="COMMAND"
16955 >smbstatus</B
16956 > won't be able
16957                 to tell you what connections are active. You should never need to
16958                 change this parameter.</P
16959 ><P
16960 >Default: <B
16961 CLASS="COMMAND"
16962 >status = yes</B
16963 ></P
16964 ></DD
16965 ><DT
16966 ><A
16967 NAME="STRICTALLOCATE"
16968 ></A
16969 >strict allocate (S)</DT
16970 ><DD
16971 ><P
16972 >This is a boolean that controls the handling of
16973                 disk space allocation in the server. When this is set to <TT
16974 CLASS="CONSTANT"
16975 >yes</TT
16976 >
16977                 the server will change from UNIX behaviour of not committing real
16978                 disk storage blocks when a file is extended to the Windows behaviour
16979                 of actually forcing the disk system to allocate real storage blocks
16980                 when a file is created or extended to be a given size. In UNIX
16981                 terminology this means that Samba will stop creating sparse files.
16982                 This can be slow on some systems.</P
16983 ><P
16984 >When strict allocate is <TT
16985 CLASS="CONSTANT"
16986 >no</TT
16987 > the server does sparse
16988                 disk block allocation when a file is extended.</P
16989 ><P
16990 >Setting this to <TT
16991 CLASS="CONSTANT"
16992 >yes</TT
16993 > can help Samba return
16994                 out of quota messages on systems that are restricting the disk quota
16995                 of users.</P
16996 ><P
16997 >Default: <B
16998 CLASS="COMMAND"
16999 >strict allocate = no</B
17000 ></P
17001 ></DD
17002 ><DT
17003 ><A
17004 NAME="STRICTLOCKING"
17005 ></A
17006 >strict locking (S)</DT
17007 ><DD
17008 ><P
17009 >This is a boolean that controls the handling of
17010                 file locking in the server. When this is set to <TT
17011 CLASS="CONSTANT"
17012 >yes</TT
17013 >
17014                 the server will check every read and write access for file locks, and
17015                 deny access if locks exist. This can be slow on some systems.</P
17016 ><P
17017 >When strict locking is <TT
17018 CLASS="CONSTANT"
17019 >no</TT
17020 > the server does file
17021                 lock checks only when the client explicitly asks for them.</P
17022 ><P
17023 >Well-behaved clients always ask for lock checks when it
17024                 is important, so in the vast majority of cases <B
17025 CLASS="COMMAND"
17026 >strict
17027                 locking = no</B
17028 > is preferable.</P
17029 ><P
17030 >Default: <B
17031 CLASS="COMMAND"
17032 >strict locking = no</B
17033 ></P
17034 ></DD
17035 ><DT
17036 ><A
17037 NAME="STRICTSYNC"
17038 ></A
17039 >strict sync (S)</DT
17040 ><DD
17041 ><P
17042 >Many Windows applications (including the Windows
17043                 98 explorer shell) seem to confuse flushing buffer contents to
17044                 disk with doing a sync to disk. Under UNIX, a sync call forces
17045                 the process to be suspended until the kernel has ensured that
17046                 all outstanding data in kernel disk buffers has been safely stored
17047                 onto stable storage. This is very slow and should only be done
17048                 rarely. Setting this parameter to <TT
17049 CLASS="CONSTANT"
17050 >no</TT
17051 > (the
17052                 default) means that <A
17053 HREF="smbd.8.html"
17054 TARGET="_top"
17055 >smbd</A
17056 > ignores the Windows applications requests for
17057                 a sync call. There is only a possibility of losing data if the
17058                 operating system itself that Samba is running on crashes, so there is
17059                 little danger in this default setting. In addition, this fixes many
17060                 performance problems that people have reported with the new Windows98
17061                 explorer shell file copies.</P
17062 ><P
17063 >See also the <A
17064 HREF="#SYNCALWAYS"
17065 ><TT
17066 CLASS="PARAMETER"
17067 ><I
17068 >sync
17069                 always&#62;</I
17070 ></TT
17071 ></A
17072 > parameter.</P
17073 ><P
17074 >Default: <B
17075 CLASS="COMMAND"
17076 >strict sync = no</B
17077 ></P
17078 ></DD
17079 ><DT
17080 ><A
17081 NAME="STRIPDOT"
17082 ></A
17083 >strip dot (G)</DT
17084 ><DD
17085 ><P
17086 >This is a boolean that controls whether to
17087                 strip trailing dots off UNIX filenames. This helps with some
17088                 CDROMs that have filenames ending in a single dot.</P
17089 ><P
17090 >Default: <B
17091 CLASS="COMMAND"
17092 >strip dot = no</B
17093 ></P
17094 ></DD
17095 ><DT
17096 ><A
17097 NAME="SYNCALWAYS"
17098 ></A
17099 >sync always (S)</DT
17100 ><DD
17101 ><P
17102 >This is a boolean parameter that controls
17103                 whether writes will always be written to stable storage before
17104                 the write call returns. If this is <TT
17105 CLASS="CONSTANT"
17106 >false</TT
17107 > then the server will be
17108                 guided by the client's request in each write call (clients can
17109                 set a bit indicating that a particular write should be synchronous).
17110                 If this is <TT
17111 CLASS="CONSTANT"
17112 >true</TT
17113 > then every write will be followed by a <B
17114 CLASS="COMMAND"
17115 >fsync()
17116                 </B
17117 > call to ensure the data is written to disk. Note that
17118                 the <TT
17119 CLASS="PARAMETER"
17120 ><I
17121 >strict sync</I
17122 ></TT
17123 > parameter must be set to
17124                 <TT
17125 CLASS="CONSTANT"
17126 >yes</TT
17127 > in order for this parameter to have
17128                 any affect.</P
17129 ><P
17130 >See also the <A
17131 HREF="#STRICTSYNC"
17132 ><TT
17133 CLASS="PARAMETER"
17134 ><I
17135 >strict
17136                 sync</I
17137 ></TT
17138 ></A
17139 > parameter.</P
17140 ><P
17141 >Default: <B
17142 CLASS="COMMAND"
17143 >sync always = no</B
17144 ></P
17145 ></DD
17146 ><DT
17147 ><A
17148 NAME="SYSLOG"
17149 ></A
17150 >syslog (G)</DT
17151 ><DD
17152 ><P
17153 >This parameter maps how Samba debug messages
17154                 are logged onto the system syslog logging levels. Samba debug
17155                 level zero maps onto syslog <TT
17156 CLASS="CONSTANT"
17157 >LOG_ERR</TT
17158 >, debug
17159                 level one maps onto <TT
17160 CLASS="CONSTANT"
17161 >LOG_WARNING</TT
17162 >, debug level
17163                 two maps onto <TT
17164 CLASS="CONSTANT"
17165 >LOG_NOTICE</TT
17166 >, debug level three
17167                 maps onto LOG_INFO. All higher levels are mapped to <TT
17168 CLASS="CONSTANT"
17169 >               LOG_DEBUG</TT
17170 >.</P
17171 ><P
17172 >This parameter sets the threshold for sending messages
17173                 to syslog.  Only messages with debug level less than this value
17174                 will be sent to syslog.</P
17175 ><P
17176 >Default: <B
17177 CLASS="COMMAND"
17178 >syslog = 1</B
17179 ></P
17180 ></DD
17181 ><DT
17182 ><A
17183 NAME="SYSLOGONLY"
17184 ></A
17185 >syslog only (G)</DT
17186 ><DD
17187 ><P
17188 >If this parameter is set then Samba debug
17189                 messages are logged into the system syslog only, and not to
17190                 the debug log files.</P
17191 ><P
17192 >Default: <B
17193 CLASS="COMMAND"
17194 >syslog only = no</B
17195 ></P
17196 ></DD
17197 ><DT
17198 ><A
17199 NAME="TEMPLATEHOMEDIR"
17200 ></A
17201 >template homedir (G)</DT
17202 ><DD
17203 ><P
17204 >When filling out the user information for a Windows NT
17205                 user, the <A
17206 HREF="winbindd.8.html"
17207 TARGET="_top"
17208 >winbindd(8)</A
17209 > daemon
17210                 uses this parameter to fill in the home directory for that user.
17211                 If the string <TT
17212 CLASS="PARAMETER"
17213 ><I
17214 >%D</I
17215 ></TT
17216 > is present it is substituted
17217                 with the user's Windows NT domain name.  If the string <TT
17218 CLASS="PARAMETER"
17219 ><I
17220 >%U
17221                 </I
17222 ></TT
17223 > is present it is substituted with the user's Windows
17224                 NT user name.</P
17225 ><P
17226 >Default: <B
17227 CLASS="COMMAND"
17228 >template homedir = /home/%D/%U</B
17229 ></P
17230 ></DD
17231 ><DT
17232 ><A
17233 NAME="TEMPLATESHELL"
17234 ></A
17235 >template shell (G)</DT
17236 ><DD
17237 ><P
17238 >When filling out the user information for a Windows NT
17239                 user, the <A
17240 HREF="winbindd.8.html"
17241 TARGET="_top"
17242 >winbindd(8)</A
17243 > daemon
17244                 uses this parameter to fill in the login shell for that user.</P
17245 ><P
17246 >Default: <B
17247 CLASS="COMMAND"
17248 >template shell = /bin/false</B
17249 ></P
17250 ></DD
17251 ><DT
17252 ><A
17253 NAME="TIMEOFFSET"
17254 ></A
17255 >time offset (G)</DT
17256 ><DD
17257 ><P
17258 >This parameter is a setting in minutes to add
17259                 to the normal GMT to local time conversion. This is useful if
17260                 you are serving a lot of PCs that have incorrect daylight
17261                 saving time handling.</P
17262 ><P
17263 >Default: <B
17264 CLASS="COMMAND"
17265 >time offset = 0</B
17266 ></P
17267 ><P
17268 >Example: <B
17269 CLASS="COMMAND"
17270 >time offset = 60</B
17271 ></P
17272 ></DD
17273 ><DT
17274 ><A
17275 NAME="TIMESERVER"
17276 ></A
17277 >time server (G)</DT
17278 ><DD
17279 ><P
17280 >This parameter determines if <A
17281 HREF="nmbd.8.html"
17282 TARGET="_top"
17283 >
17284                 nmbd(8)</A
17285 > advertises itself as a time server to Windows
17286                 clients.</P
17287 ><P
17288 >Default: <B
17289 CLASS="COMMAND"
17290 >time server = no</B
17291 ></P
17292 ></DD
17293 ><DT
17294 ><A
17295 NAME="TIMESTAMPLOGS"
17296 ></A
17297 >timestamp logs (G)</DT
17298 ><DD
17299 ><P
17300 >Synonym for <A
17301 HREF="#DEBUGTIMESTAMP"
17302 ><TT
17303 CLASS="PARAMETER"
17304 ><I
17305 >               debug timestamp</I
17306 ></TT
17307 ></A
17308 >.</P
17309 ></DD
17310 ><DT
17311 ><A
17312 NAME="TOTALPRINTJOBS"
17313 ></A
17314 >total print jobs (G)</DT
17315 ><DD
17316 ><P
17317 >This parameter accepts an integer value which defines
17318                 a limit on the maximum number of print jobs that will be accepted
17319                 system wide at any given time.  If a print job is submitted
17320                 by a client which will exceed this number, then <A
17321 HREF="smbd.8.html"
17322 TARGET="_top"
17323 >smbd</A
17324 > will return an
17325                 error indicating that no space is available on the server.  The
17326                 default value of 0 means that no such limit exists.  This parameter
17327                 can be used to prevent a server from exceeding its capacity and is
17328                 designed as a printing throttle.  See also
17329                 <A
17330 HREF="#MAXPRINTJOBS"
17331 ><TT
17332 CLASS="PARAMETER"
17333 ><I
17334 >max print jobs</I
17335 ></TT
17336 ></A
17337 >.
17338                 </P
17339 ><P
17340 >Default: <B
17341 CLASS="COMMAND"
17342 >total print jobs = 0</B
17343 ></P
17344 ><P
17345 >Example: <B
17346 CLASS="COMMAND"
17347 >total print jobs = 5000</B
17348 ></P
17349 ></DD
17350 ><DT
17351 ><A
17352 NAME="UNIXEXTENSIONS"
17353 ></A
17354 >unix extensions(G)</DT
17355 ><DD
17356 ><P
17357 >This boolean parameter controls whether Samba
17358                 implments the CIFS UNIX extensions, as defined by HP. These
17359                 extensions enable CIFS to server UNIX clients to UNIX servers
17360                 better, and allow such things as symbolic links, hard links etc.
17361                 These extensions require a similarly enabled client, and are of
17362                 no current use to Windows clients.</P
17363 ><P
17364 >Default: <B
17365 CLASS="COMMAND"
17366 >unix extensions = no</B
17367 ></P
17368 ></DD
17369 ><DT
17370 ><A
17371 NAME="UNIXPASSWORDSYNC"
17372 ></A
17373 >unix password sync (G)</DT
17374 ><DD
17375 ><P
17376 >This boolean parameter controls whether Samba
17377                 attempts to synchronize the UNIX password with the SMB password
17378                 when the encrypted SMB password in the smbpasswd file is changed.
17379                 If this is set to <TT
17380 CLASS="CONSTANT"
17381 >true</TT
17382 > the program specified in the <TT
17383 CLASS="PARAMETER"
17384 ><I
17385 >passwd
17386                 program</I
17387 ></TT
17388 >parameter is called <EM
17389 >AS ROOT</EM
17390 > -
17391                 to allow the new UNIX password to be set without access to the
17392                 old UNIX password (as the SMB password change code has no
17393                 access to the old password cleartext, only the new).</P
17394 ><P
17395 >See also <A
17396 HREF="#PASSWDPROGRAM"
17397 ><TT
17398 CLASS="PARAMETER"
17399 ><I
17400 >passwd
17401                 program</I
17402 ></TT
17403 ></A
17404 >, <A
17405 HREF="#PASSWDCHAT"
17406 ><TT
17407 CLASS="PARAMETER"
17408 ><I
17409 >               passwd chat</I
17410 ></TT
17411 ></A
17412 >.</P
17413 ><P
17414 >Default: <B
17415 CLASS="COMMAND"
17416 >unix password sync = no</B
17417 ></P
17418 ></DD
17419 ><DT
17420 ><A
17421 NAME="UPDATEENCRYPTED"
17422 ></A
17423 >update encrypted (G)</DT
17424 ><DD
17425 ><P
17426 >This boolean parameter allows a user logging
17427                 on with a plaintext password to have their encrypted (hashed)
17428                 password in the smbpasswd file to be updated automatically as
17429                 they log on. This option allows a site to migrate from plaintext
17430                 password authentication (users authenticate with plaintext
17431                 password over the wire, and are checked against a UNIX account
17432                 database) to encrypted password authentication (the SMB
17433                 challenge/response authentication mechanism) without forcing
17434                 all users to re-enter their passwords via smbpasswd at the time the
17435                 change is made. This is a convenience option to allow the change over
17436                 to encrypted passwords to be made over a longer period. Once all users
17437                 have encrypted representations of their passwords in the smbpasswd
17438                 file this parameter should be set to <TT
17439 CLASS="CONSTANT"
17440 >no</TT
17441 >.</P
17442 ><P
17443 >In order for this parameter to work correctly the <A
17444 HREF="#ENCRYPTPASSWORDS"
17445 ><TT
17446 CLASS="PARAMETER"
17447 ><I
17448 >encrypt passwords</I
17449 ></TT
17450 >
17451                 </A
17452 > parameter must be set to <TT
17453 CLASS="CONSTANT"
17454 >no</TT
17455 > when
17456                 this parameter is set to <TT
17457 CLASS="CONSTANT"
17458 >yes</TT
17459 >.</P
17460 ><P
17461 >Note that even when this parameter is set a user
17462                 authenticating to <B
17463 CLASS="COMMAND"
17464 >smbd</B
17465 > must still enter a valid
17466                 password in order to connect correctly, and to update their hashed
17467                 (smbpasswd) passwords.</P
17468 ><P
17469 >Default: <B
17470 CLASS="COMMAND"
17471 >update encrypted = no</B
17472 ></P
17473 ></DD
17474 ><DT
17475 ><A
17476 NAME="USECLIENTDRIVER"
17477 ></A
17478 >use client driver (S)</DT
17479 ><DD
17480 ><P
17481 >This parameter applies only to Windows NT/2000
17482                 clients.  It has no affect on Windows 95/98/ME clients.  When
17483                 serving a printer to Windows NT/2000 clients without first installing
17484                 a valid printer driver on the Samba host, the client will be required
17485                 to install a local printer driver.  From this point on, the client
17486                 will treat the print as a local printer and not a network printer
17487                 connection.  This is much the same behavior that will occur
17488                 when <B
17489 CLASS="COMMAND"
17490 >disable spoolss = yes</B
17491 >.  </P
17492 ><P
17493 >The differentiating
17494                 factor is that under normal circumstances, the NT/2000 client will
17495                 attempt to open the network printer using MS-RPC.  The problem is that
17496                 because the client considers the printer to be local, it will attempt
17497                 to issue the OpenPrinterEx() call requesting access rights associated
17498                 with the logged on user. If the user possesses local administator rights
17499                 but not root privilegde on the Samba host (often the case), the OpenPrinterEx()
17500                 call will fail.  The result is that the client will now display an "Access
17501                 Denied; Unable to connect" message in the printer queue window (even though
17502                 jobs may successfully be printed).  </P
17503 ><P
17504 >If this parameter is enabled for a printer, then any attempt
17505                 to open the printer with the PRINTER_ACCESS_ADMINISTER right is mapped
17506                 to PRINTER_ACCESS_USE instead.  Thus allowing the OpenPrinterEx()
17507                 call to succeed.  <EM
17508 >This parameter MUST not be able enabled
17509                 on a print share which has valid print driver installed on the Samba
17510                 server.</EM
17511 ></P
17512 ><P
17513 >See also <A
17514 HREF="#DISABLESPOOLSS"
17515 >disable spoolss</A
17516 >
17517                 </P
17518 ><P
17519 >Default: <B
17520 CLASS="COMMAND"
17521 >use client driver = no</B
17522 ></P
17523 ></DD
17524 ><DT
17525 ><A
17526 NAME="USEMMAP"
17527 ></A
17528 >use mmap (G)</DT
17529 ><DD
17530 ><P
17531 >This global parameter determines if the tdb internals of Samba can
17532                 depend on mmap working correctly on the running system. Samba requires a coherent
17533                 mmap/read-write system memory cache. Currently only HPUX does not have such a
17534                 coherent cache, and so this parameter is set to <TT
17535 CLASS="CONSTANT"
17536 >false</TT
17537 > by
17538                 default on HPUX. On all other systems this parameter should be left alone. This
17539                 parameter is provided to help the Samba developers track down problems with
17540                 the tdb internal code.
17541                 </P
17542 ><P
17543 >Default: <B
17544 CLASS="COMMAND"
17545 >use mmap = yes</B
17546 ></P
17547 ></DD
17548 ><DT
17549 ><A
17550 NAME="USERHOSTS"
17551 ></A
17552 >use rhosts (G)</DT
17553 ><DD
17554 ><P
17555 >If this global parameter is <TT
17556 CLASS="CONSTANT"
17557 >true</TT
17558 >, it specifies
17559                 that the UNIX user's <TT
17560 CLASS="FILENAME"
17561 >.rhosts</TT
17562 > file in their home directory
17563                 will be read to find the names of hosts and users who will be allowed
17564                 access without specifying a password.</P
17565 ><P
17566 ><EM
17567 >NOTE:</EM
17568 > The use of <TT
17569 CLASS="PARAMETER"
17570 ><I
17571 >use rhosts
17572                 </I
17573 ></TT
17574 > can be a major security hole. This is because you are
17575                 trusting the PC to supply the correct username. It is very easy to
17576                 get a PC to supply a false username. I recommend that the <TT
17577 CLASS="PARAMETER"
17578 ><I
17579 >               use rhosts</I
17580 ></TT
17581 > option be only used if you really know what
17582                 you are doing.</P
17583 ><P
17584 >Default: <B
17585 CLASS="COMMAND"
17586 >use rhosts = no</B
17587 ></P
17588 ></DD
17589 ><DT
17590 ><A
17591 NAME="USER"
17592 ></A
17593 >user (S)</DT
17594 ><DD
17595 ><P
17596 >Synonym for <A
17597 HREF="#USERNAME"
17598 ><TT
17599 CLASS="PARAMETER"
17600 ><I
17601 >               username</I
17602 ></TT
17603 ></A
17604 >.</P
17605 ></DD
17606 ><DT
17607 ><A
17608 NAME="USERS"
17609 ></A
17610 >users (S)</DT
17611 ><DD
17612 ><P
17613 >Synonym for <A
17614 HREF="#USERNAME"
17615 ><TT
17616 CLASS="PARAMETER"
17617 ><I
17618 >               username</I
17619 ></TT
17620 ></A
17621 >.</P
17622 ></DD
17623 ><DT
17624 ><A
17625 NAME="USERNAME"
17626 ></A
17627 >username (S)</DT
17628 ><DD
17629 ><P
17630 >Multiple users may be specified in a comma-delimited
17631                 list, in which case the supplied password will be tested against
17632                 each username in turn (left to right).</P
17633 ><P
17634 >The <TT
17635 CLASS="PARAMETER"
17636 ><I
17637 >username</I
17638 ></TT
17639 > line is needed only when
17640                 the PC is unable to supply its own username. This is the case
17641                 for the COREPLUS protocol or where your users have different WfWg
17642                 usernames to UNIX usernames. In both these cases you may also be
17643                 better using the \\server\share%user syntax instead.</P
17644 ><P
17645 >The <TT
17646 CLASS="PARAMETER"
17647 ><I
17648 >username</I
17649 ></TT
17650 > line is not a great
17651                 solution in many cases as it means Samba will try to validate
17652                 the supplied password against each of the usernames in the
17653                 <TT
17654 CLASS="PARAMETER"
17655 ><I
17656 >username</I
17657 ></TT
17658 > line in turn. This is slow and
17659                 a bad idea for lots of users in case of duplicate passwords.
17660                 You may get timeouts or security breaches using this parameter
17661                 unwisely.</P
17662 ><P
17663 >Samba relies on the underlying UNIX security. This
17664                 parameter does not restrict who can login, it just offers hints
17665                 to the Samba server as to what usernames might correspond to the
17666                 supplied password. Users can login as whoever they please and
17667                 they will be able to do no more damage than if they started a
17668                 telnet session. The daemon runs as the user that they log in as,
17669                 so they cannot do anything that user cannot do.</P
17670 ><P
17671 >To restrict a service to a particular set of users you
17672                 can use the <A
17673 HREF="#VALIDUSERS"
17674 ><TT
17675 CLASS="PARAMETER"
17676 ><I
17677 >valid users
17678                 </I
17679 ></TT
17680 ></A
17681 > parameter.</P
17682 ><P
17683 >If any of the usernames begin with a '@' then the name
17684                 will be looked up first in the NIS netgroups list (if Samba
17685                 is compiled with netgroup support), followed by a lookup in
17686                 the UNIX groups database and will expand to a list of all users
17687                 in the group of that name.</P
17688 ><P
17689 >If any of the usernames begin with a '+' then the name
17690                 will be looked up only in the UNIX groups database and will
17691                 expand to a list of all users in the group of that name.</P
17692 ><P
17693 >If any of the usernames begin with a '&#38;'then the name
17694                 will be looked up only in the NIS netgroups database (if Samba
17695                 is compiled with netgroup support) and will expand to a list
17696                 of all users in the netgroup group of that name.</P
17697 ><P
17698 >Note that searching though a groups database can take
17699                 quite some time, and some clients may time out during the
17700                 search.</P
17701 ><P
17702 >See the section <A
17703 HREF="#AEN236"
17704 >NOTE ABOUT
17705                 USERNAME/PASSWORD VALIDATION</A
17706 > for more information on how
17707                 this parameter determines access to the services.</P
17708 ><P
17709 >Default: <B
17710 CLASS="COMMAND"
17711 >The guest account if a guest service,
17712                 else &#60;empty string&#62;.</B
17713 ></P
17714 ><P
17715 >Examples:<B
17716 CLASS="COMMAND"
17717 >username = fred, mary, jack, jane,
17718                 @users, @pcgroup</B
17719 ></P
17720 ></DD
17721 ><DT
17722 ><A
17723 NAME="USERNAMELEVEL"
17724 ></A
17725 >username level (G)</DT
17726 ><DD
17727 ><P
17728 >This option helps Samba to try and 'guess' at
17729                 the real UNIX username, as many DOS clients send an all-uppercase
17730                 username. By default Samba tries all lowercase, followed by the
17731                 username with the first letter capitalized, and fails if the
17732                 username is not found on the UNIX machine.</P
17733 ><P
17734 >If this parameter is set to non-zero the behavior changes.
17735                 This parameter is a number that specifies the number of uppercase
17736                 combinations to try while trying to determine the UNIX user name. The
17737                 higher the number the more combinations will be tried, but the slower
17738                 the discovery of usernames will be. Use this parameter when you have
17739                 strange usernames on your UNIX machine, such as <TT
17740 CLASS="CONSTANT"
17741 >AstrangeUser
17742                 </TT
17743 >.</P
17744 ><P
17745 >Default: <B
17746 CLASS="COMMAND"
17747 >username level = 0</B
17748 ></P
17749 ><P
17750 >Example: <B
17751 CLASS="COMMAND"
17752 >username level = 5</B
17753 ></P
17754 ></DD
17755 ><DT
17756 ><A
17757 NAME="USERNAMEMAP"
17758 ></A
17759 >username map (G)</DT
17760 ><DD
17761 ><P
17762 >This option allows you to specify a file containing
17763                 a mapping of usernames from the clients to the server. This can be
17764                 used for several purposes. The most common is to map usernames
17765                 that users use on DOS or Windows machines to those that the UNIX
17766                 box uses. The other is to map multiple users to a single username
17767                 so that they can more easily share files.</P
17768 ><P
17769 >The map file is parsed line by line. Each line should
17770                 contain a single UNIX username on the left then a '=' followed
17771                 by a list of usernames on the right. The list of usernames on the
17772                 right may contain names of the form @group in which case they
17773                 will match any UNIX username in that group. The special client
17774                 name '*' is a wildcard and matches any name. Each line of the
17775                 map file may be up to 1023 characters long.</P
17776 ><P
17777 >The file is processed on each line by taking the
17778                 supplied username and comparing it with each username on the right
17779                 hand side of the '=' signs. If the supplied name matches any of
17780                 the names on the right hand side then it is replaced with the name
17781                 on the left. Processing then continues with the next line.</P
17782 ><P
17783 >If any line begins with a '#' or a ';' then it is
17784                 ignored</P
17785 ><P
17786 >If any line begins with an '!' then the processing
17787                 will stop after that line if a mapping was done by the line.
17788                 Otherwise mapping continues with every line being processed.
17789                 Using '!' is most useful when you have a wildcard mapping line
17790                 later in the file.</P
17791 ><P
17792 >For example to map from the name <TT
17793 CLASS="CONSTANT"
17794 >admin</TT
17795 >
17796                 or <TT
17797 CLASS="CONSTANT"
17798 >administrator</TT
17799 > to the UNIX name <TT
17800 CLASS="CONSTANT"
17801 >               root</TT
17802 > you would use:</P
17803 ><P
17804 ><B
17805 CLASS="COMMAND"
17806 >root = admin administrator</B
17807 ></P
17808 ><P
17809 >Or to map anyone in the UNIX group <TT
17810 CLASS="CONSTANT"
17811 >system</TT
17812 >
17813                 to the UNIX name <TT
17814 CLASS="CONSTANT"
17815 >sys</TT
17816 > you would use:</P
17817 ><P
17818 ><B
17819 CLASS="COMMAND"
17820 >sys = @system</B
17821 ></P
17822 ><P
17823 >You can have as many mappings as you like in a username
17824                 map file.</P
17825 ><P
17826 >If your system supports the NIS NETGROUP option then
17827                 the netgroup database is checked before the <TT
17828 CLASS="FILENAME"
17829 >/etc/group
17830                 </TT
17831 > database for matching groups.</P
17832 ><P
17833 >You can map Windows usernames that have spaces in them
17834                  by using double quotes around the name. For example:</P
17835 ><P
17836 ><B
17837 CLASS="COMMAND"
17838 >tridge = "Andrew Tridgell"</B
17839 ></P
17840 ><P
17841 >would map the windows username "Andrew Tridgell" to the
17842                 unix username "tridge".</P
17843 ><P
17844 >The following example would map mary and fred to the
17845                 unix user sys, and map the rest to guest. Note the use of the
17846                 '!' to tell Samba to stop processing if it gets a match on
17847                 that line.</P
17848 ><P
17849 ><TABLE
17850 BORDER="0"
17851 BGCOLOR="#E0E0E0"
17852 WIDTH="90%"
17853 ><TR
17854 ><TD
17855 ><PRE
17856 CLASS="PROGRAMLISTING"
17857 >               !sys = mary fred
17858                 guest = *
17859                 </PRE
17860 ></TD
17861 ></TR
17862 ></TABLE
17863 ></P
17864 ><P
17865 >Note that the remapping is applied to all occurrences
17866                 of usernames. Thus if you connect to \\server\fred and <TT
17867 CLASS="CONSTANT"
17868 >               fred</TT
17869 > is remapped to <TT
17870 CLASS="CONSTANT"
17871 >mary</TT
17872 > then you
17873                 will actually be connecting to \\server\mary and will need to
17874                 supply a password suitable for <TT
17875 CLASS="CONSTANT"
17876 >mary</TT
17877 > not
17878                 <TT
17879 CLASS="CONSTANT"
17880 >fred</TT
17881 >. The only exception to this is the
17882                 username passed to the <A
17883 HREF="#PASSWORDSERVER"
17884 ><TT
17885 CLASS="PARAMETER"
17886 ><I
17887 >               password server</I
17888 ></TT
17889 ></A
17890 > (if you have one). The password
17891                 server will receive whatever username the client supplies without
17892                 modification.</P
17893 ><P
17894 >Also note that no reverse mapping is done. The main effect
17895                 this has is with printing. Users who have been mapped may have
17896                 trouble deleting print jobs as PrintManager under WfWg will think
17897                 they don't own the print job.</P
17898 ><P
17899 >Default: <EM
17900 >no username map</EM
17901 ></P
17902 ><P
17903 >Example: <B
17904 CLASS="COMMAND"
17905 >username map = /usr/local/samba/lib/users.map
17906                 </B
17907 ></P
17908 ></DD
17909 ><DT
17910 ><A
17911 NAME="UTMP"
17912 ></A
17913 >utmp (G)</DT
17914 ><DD
17915 ><P
17916 >This boolean parameter is only available if
17917                 Samba has been configured and compiled  with the option <B
17918 CLASS="COMMAND"
17919 >               --with-utmp</B
17920 >. If set to <TT
17921 CLASS="CONSTANT"
17922 >true</TT
17923 > then Samba will attempt
17924                 to add utmp or utmpx records (depending on the UNIX system) whenever a
17925                 connection is made to a Samba server. Sites may use this to record the
17926                 user connecting to a Samba share.</P
17927 ><P
17928 >See also the <A
17929 HREF="#UTMPDIRECTORY"
17930 ><TT
17931 CLASS="PARAMETER"
17932 ><I
17933 >               utmp directory</I
17934 ></TT
17935 ></A
17936 > parameter.</P
17937 ><P
17938 >Default: <B
17939 CLASS="COMMAND"
17940 >utmp = no</B
17941 ></P
17942 ></DD
17943 ><DT
17944 ><A
17945 NAME="UTMPDIRECTORY"
17946 ></A
17947 >utmp directory(G)</DT
17948 ><DD
17949 ><P
17950 >This parameter is only available if Samba has
17951                 been configured and compiled with the option <B
17952 CLASS="COMMAND"
17953 >               --with-utmp</B
17954 >. It specifies a directory pathname that is
17955                 used to store the utmp or utmpx files (depending on the UNIX system) that
17956                 record user connections to a Samba server. See also the <A
17957 HREF="#UTMP"
17958 >               <TT
17959 CLASS="PARAMETER"
17960 ><I
17961 >utmp</I
17962 ></TT
17963 ></A
17964 > parameter. By default this is
17965                 not set, meaning the system will use whatever utmp file the
17966                 native system is set to use (usually
17967                 <TT
17968 CLASS="FILENAME"
17969 >/var/run/utmp</TT
17970 > on Linux).</P
17971 ><P
17972 >Default: <EM
17973 >no utmp directory</EM
17974 ></P
17975 ></DD
17976 ><DT
17977 ><A
17978 NAME="VALIDUSERS"
17979 ></A
17980 >valid users (S)</DT
17981 ><DD
17982 ><P
17983 >This is a list of users that should be allowed
17984                 to login to this service. Names starting with '@', '+' and  '&#38;'
17985                 are interpreted using the same rules as described in the
17986                 <TT
17987 CLASS="PARAMETER"
17988 ><I
17989 >invalid users</I
17990 ></TT
17991 > parameter.</P
17992 ><P
17993 >If this is empty (the default) then any user can login.
17994                 If a username is in both this list and the <TT
17995 CLASS="PARAMETER"
17996 ><I
17997 >invalid
17998                 users</I
17999 ></TT
18000 > list then access is denied for that user.</P
18001 ><P
18002 >The current servicename is substituted for <TT
18003 CLASS="PARAMETER"
18004 ><I
18005 >%S
18006                 </I
18007 ></TT
18008 >. This is useful in the [homes] section.</P
18009 ><P
18010 >See also <A
18011 HREF="#INVALIDUSERS"
18012 ><TT
18013 CLASS="PARAMETER"
18014 ><I
18015 >invalid users
18016                 </I
18017 ></TT
18018 ></A
18019 ></P
18020 ><P
18021 >Default: <EM
18022 >No valid users list (anyone can login)
18023                 </EM
18024 ></P
18025 ><P
18026 >Example: <B
18027 CLASS="COMMAND"
18028 >valid users = greg, @pcusers</B
18029 ></P
18030 ></DD
18031 ><DT
18032 ><A
18033 NAME="VETOFILES"
18034 ></A
18035 >veto files(S)</DT
18036 ><DD
18037 ><P
18038 >This is a list of files and directories that
18039                 are neither visible nor accessible.  Each entry in the list must
18040                 be separated by a '/', which allows spaces to be included
18041                 in the entry. '*' and '?' can be used to specify multiple files
18042                 or directories as in DOS wildcards.</P
18043 ><P
18044 >Each entry must be a unix path, not a DOS path and
18045                 must <EM
18046 >not</EM
18047 > include the  unix directory
18048                 separator '/'.</P
18049 ><P
18050 >Note that the <TT
18051 CLASS="PARAMETER"
18052 ><I
18053 >case sensitive</I
18054 ></TT
18055 > option
18056                 is applicable in vetoing files.</P
18057 ><P
18058 >One feature of the veto files parameter that it
18059                 is important to be aware of is Samba's behaviour when
18060                 trying to delete a directory. If a directory that is
18061                 to be deleted contains nothing but veto files this
18062                 deletion will <EM
18063 >fail</EM
18064 > unless you also set
18065                 the <TT
18066 CLASS="PARAMETER"
18067 ><I
18068 >delete veto files</I
18069 ></TT
18070 > parameter to
18071                 <TT
18072 CLASS="PARAMETER"
18073 ><I
18074 >yes</I
18075 ></TT
18076 >.</P
18077 ><P
18078 >Setting this parameter will affect the performance
18079                 of Samba, as it will be forced to check all files and directories
18080                 for a match as they are scanned.</P
18081 ><P
18082 >See also <A
18083 HREF="#HIDEFILES"
18084 ><TT
18085 CLASS="PARAMETER"
18086 ><I
18087 >hide files
18088                 </I
18089 ></TT
18090 ></A
18091 > and <A
18092 HREF="#CASESENSITIVE"
18093 ><TT
18094 CLASS="PARAMETER"
18095 ><I
18096 >               case sensitive</I
18097 ></TT
18098 ></A
18099 >.</P
18100 ><P
18101 >Default: <EM
18102 >No files or directories are vetoed.
18103                 </EM
18104 ></P
18105 ><P
18106 >Examples:<TABLE
18107 BORDER="0"
18108 BGCOLOR="#E0E0E0"
18109 WIDTH="90%"
18110 ><TR
18111 ><TD
18112 ><PRE
18113 CLASS="PROGRAMLISTING"
18114 >; Veto any files containing the word Security,
18115 ; any ending in .tmp, and any directory containing the
18116 ; word root.
18117 veto files = /*Security*/*.tmp/*root*/
18118
18119 ; Veto the Apple specific files that a NetAtalk server
18120 ; creates.
18121 veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/</PRE
18122 ></TD
18123 ></TR
18124 ></TABLE
18125 ></P
18126 ></DD
18127 ><DT
18128 ><A
18129 NAME="VETOOPLOCKFILES"
18130 ></A
18131 >veto oplock files (S)</DT
18132 ><DD
18133 ><P
18134 >This parameter is only valid when the <A
18135 HREF="#OPLOCKS"
18136 ><TT
18137 CLASS="PARAMETER"
18138 ><I
18139 >oplocks</I
18140 ></TT
18141 ></A
18142 >
18143                 parameter is turned on for a share. It allows the Samba administrator
18144                 to selectively turn off the granting of oplocks on selected files that
18145                 match a wildcarded list, similar to the wildcarded list used in the
18146                 <A
18147 HREF="#VETOFILES"
18148 ><TT
18149 CLASS="PARAMETER"
18150 ><I
18151 >veto files</I
18152 ></TT
18153 ></A
18154 >
18155                 parameter.</P
18156 ><P
18157 >Default: <EM
18158 >No files are vetoed for oplock
18159                 grants</EM
18160 ></P
18161 ><P
18162 >You might want to do this on files that you know will
18163                 be heavily contended for by clients. A good example of this
18164                 is in the NetBench SMB benchmark program, which causes heavy
18165                 client contention for files ending in <TT
18166 CLASS="FILENAME"
18167 >.SEM</TT
18168 >.
18169                 To cause Samba not to grant oplocks on these files you would use
18170                 the line (either in the [global] section or in the section for
18171                 the particular NetBench share :</P
18172 ><P
18173 >Example: <B
18174 CLASS="COMMAND"
18175 >veto oplock files = /*.SEM/
18176                 </B
18177 ></P
18178 ></DD
18179 ><DT
18180 ><A
18181 NAME="VFSOBJECT"
18182 ></A
18183 >vfs object (S)</DT
18184 ><DD
18185 ><P
18186 >This parameter specifies a shared object file that
18187                 is used for Samba VFS I/O operations.  By default, normal
18188                 disk I/O operations are used but these can be overloaded
18189                 with a VFS object.  The Samba VFS layer is new to Samba 2.2 and
18190                 must be enabled at compile time with --with-vfs.</P
18191 ><P
18192 >Default : <EM
18193 >no value</EM
18194 ></P
18195 ></DD
18196 ><DT
18197 ><A
18198 NAME="VFSOPTIONS"
18199 ></A
18200 >vfs options (S)</DT
18201 ><DD
18202 ><P
18203 >This parameter allows parameters to be passed
18204                 to the vfs layer at initialization time.  The Samba VFS layer
18205                 is new to Samba 2.2 and must be enabled at compile time
18206                 with --with-vfs.  See also <A
18207 HREF="#VFSOBJECT"
18208 ><TT
18209 CLASS="PARAMETER"
18210 ><I
18211 >               vfs object</I
18212 ></TT
18213 ></A
18214 >.</P
18215 ><P
18216 >Default : <EM
18217 >no value</EM
18218 ></P
18219 ></DD
18220 ><DT
18221 ><A
18222 NAME="VOLUME"
18223 ></A
18224 >volume (S)</DT
18225 ><DD
18226 ><P
18227 > This allows you to override the volume label
18228                 returned for a share. Useful for CDROMs with installation programs
18229                 that insist on a particular volume label.</P
18230 ><P
18231 >Default: <EM
18232 >the name of the share</EM
18233 ></P
18234 ></DD
18235 ><DT
18236 ><A
18237 NAME="WIDELINKS"
18238 ></A
18239 >wide links (S)</DT
18240 ><DD
18241 ><P
18242 >This parameter controls whether or not links
18243                 in the UNIX file system may be followed by the server. Links
18244                 that point to areas within the directory tree exported by the
18245                 server are always allowed; this parameter controls access only
18246                 to areas that are outside the directory tree being exported.</P
18247 ><P
18248 >Note that setting this parameter can have a negative
18249                 effect on your server performance due to the extra system calls
18250                 that Samba has to  do in order to perform the link checks.</P
18251 ><P
18252 >Default: <B
18253 CLASS="COMMAND"
18254 >wide links = yes</B
18255 ></P
18256 ></DD
18257 ><DT
18258 ><A
18259 NAME="WINBINDCACHETIME"
18260 ></A
18261 >winbind cache time</DT
18262 ><DD
18263 ><P
18264 >This parameter specifies the number of seconds the
18265                 <A
18266 HREF="winbindd.8.html"
18267 TARGET="_top"
18268 >winbindd(8)</A
18269 > daemon will cache
18270                 user and group information before querying a Windows NT server
18271                 again.</P
18272 ><P
18273 >Default: <B
18274 CLASS="COMMAND"
18275 >winbind cache type = 15</B
18276 ></P
18277 ></DD
18278 ><DT
18279 ><A
18280 NAME="WINBINDENUMUSERS"
18281 ></A
18282 >winbind enum
18283                 users</DT
18284 ><DD
18285 ><P
18286 >On large installations using
18287                 <A
18288 HREF="winbindd.8.html"
18289 TARGET="_top"
18290 >winbindd(8)</A
18291 > it may be
18292                 necessary to suppress the enumeration of users through the
18293                 <B
18294 CLASS="COMMAND"
18295 > setpwent()</B
18296 >,
18297                 <B
18298 CLASS="COMMAND"
18299 >getpwent()</B
18300 > and
18301                 <B
18302 CLASS="COMMAND"
18303 >endpwent()</B
18304 > group of system calls.  If
18305                 the <TT
18306 CLASS="PARAMETER"
18307 ><I
18308 >winbind enum users</I
18309 ></TT
18310 > parameter is
18311                 false, calls to the <B
18312 CLASS="COMMAND"
18313 >getpwent</B
18314 > system call
18315                 will not return any data. </P
18316 ><P
18317 ><EM
18318 >Warning:</EM
18319 > Turning off user
18320                 enumeration may cause some programs to behave oddly.  For
18321                 example, the finger program relies on having access to the
18322                 full user list when searching for matching
18323                 usernames. </P
18324 ><P
18325 >Default: <B
18326 CLASS="COMMAND"
18327 >winbind enum users = yes </B
18328 ></P
18329 ></DD
18330 ><DT
18331 ><A
18332 NAME="WINBINDENUMGROUPS"
18333 ></A
18334 >winbind enum
18335                 groups</DT
18336 ><DD
18337 ><P
18338 >On large installations using
18339                 <A
18340 HREF="winbindd.8.html"
18341 TARGET="_top"
18342 >winbindd(8)</A
18343 > it may be
18344                 necessary to suppress the enumeration of groups through the
18345                 <B
18346 CLASS="COMMAND"
18347 > setgrent()</B
18348 >,
18349                 <B
18350 CLASS="COMMAND"
18351 >getgrent()</B
18352 > and
18353                 <B
18354 CLASS="COMMAND"
18355 >endgrent()</B
18356 > group of system calls.  If
18357                 the <TT
18358 CLASS="PARAMETER"
18359 ><I
18360 >winbind enum groups</I
18361 ></TT
18362 > parameter is
18363                 false, calls to the <B
18364 CLASS="COMMAND"
18365 >getgrent()</B
18366 > system
18367                 call will not return any data. </P
18368 ><P
18369 ><EM
18370 >Warning:</EM
18371 > Turning off group
18372                 enumeration may cause some programs to behave oddly.
18373                 </P
18374 ><P
18375 >Default: <B
18376 CLASS="COMMAND"
18377 >winbind enum groups = yes </B
18378 >
18379                 </P
18380 ></DD
18381 ><DT
18382 ><A
18383 NAME="WINBINDGID"
18384 ></A
18385 >winbind gid</DT
18386 ><DD
18387 ><P
18388 >The winbind gid parameter specifies the range of group
18389                 ids that are allocated by the <A
18390 HREF="winbindd.8.html"
18391 TARGET="_top"
18392 >               winbindd(8)</A
18393 > daemon.  This range of group ids should have no
18394                 existing local or NIS groups within it as strange conflicts can
18395                 occur otherwise.</P
18396 ><P
18397 >Default: <B
18398 CLASS="COMMAND"
18399 >winbind gid = &#60;empty string&#62;
18400                 </B
18401 ></P
18402 ><P
18403 >Example: <B
18404 CLASS="COMMAND"
18405 >winbind gid = 10000-20000</B
18406 ></P
18407 ></DD
18408 ><DT
18409 ><A
18410 NAME="WINBINDSEPARATOR"
18411 ></A
18412 >winbind separator</DT
18413 ><DD
18414 ><P
18415 >This parameter allows an admin to define the character
18416                 used when listing a username of the form of <TT
18417 CLASS="REPLACEABLE"
18418 ><I
18419 >DOMAIN
18420                 </I
18421 ></TT
18422 >\<TT
18423 CLASS="REPLACEABLE"
18424 ><I
18425 >user</I
18426 ></TT
18427 >.  This parameter
18428                 is only applicable when using the <TT
18429 CLASS="FILENAME"
18430 >pam_winbind.so</TT
18431 >
18432                 and <TT
18433 CLASS="FILENAME"
18434 >nss_winbind.so</TT
18435 > modules for UNIX services.
18436                 </P
18437 ><P
18438 >Example: <B
18439 CLASS="COMMAND"
18440 >winbind separator = \</B
18441 ></P
18442 ><P
18443 >Example: <B
18444 CLASS="COMMAND"
18445 >winbind separator = +</B
18446 ></P
18447 ></DD
18448 ><DT
18449 ><A
18450 NAME="WINBINDUID"
18451 ></A
18452 >winbind uid</DT
18453 ><DD
18454 ><P
18455 >The winbind gid parameter specifies the range of group
18456                 ids that are allocated by the <A
18457 HREF="winbindd.8.html"
18458 TARGET="_top"
18459 >               winbindd(8)</A
18460 > daemon.  This range of ids should have no
18461                 existing local or NIS users within it as strange conflicts can
18462                 occur otherwise.</P
18463 ><P
18464 >Default: <B
18465 CLASS="COMMAND"
18466 >winbind uid = &#60;empty string&#62;
18467                 </B
18468 ></P
18469 ><P
18470 >Example: <B
18471 CLASS="COMMAND"
18472 >winbind uid = 10000-20000</B
18473 ></P
18474 ></DD
18475 ><DT
18476 >winbind use default domain, <A
18477 NAME="WINBINDUSEDEFAULTDOMAIN"
18478 ></A
18479 >winbind use default domain</DT
18480 ><DD
18481 ><P
18482 >This parameter specifies whether the <A
18483 HREF="winbindd.8.html"
18484 TARGET="_top"
18485 >               winbindd(8)</A
18486 >
18487                 daemon should operate on users without domain component in their username.
18488                 Users without a domain component are treated as is part of the winbindd server's
18489                 own domain.  While this does not benifit Windows users, it makes SSH, FTP and e-mail
18490                 function in a way much closer to the way they would in a native unix system.</P
18491 ><P
18492 >Default: <B
18493 CLASS="COMMAND"
18494 >winbind use default domain = &#60;falseg&#62;
18495                 </B
18496 ></P
18497 ><P
18498 >Example: <B
18499 CLASS="COMMAND"
18500 >winbind use default domain = true</B
18501 ></P
18502 ></DD
18503 ><DT
18504 ><A
18505 NAME="WINSHOOK"
18506 ></A
18507 >wins hook (G)</DT
18508 ><DD
18509 ><P
18510 >When Samba is running as a WINS server this
18511                 allows you to call an external program for all changes to the
18512                 WINS database. The primary use for this option is to allow the
18513                 dynamic update of external name resolution databases such as
18514                 dynamic DNS.</P
18515 ><P
18516 >The wins hook parameter specifies the name of a script
18517                 or executable that will be called as follows:</P
18518 ><P
18519 ><B
18520 CLASS="COMMAND"
18521 >wins_hook operation name nametype ttl IP_list
18522                 </B
18523 ></P
18524 ><P
18525 ></P
18526 ><UL
18527 ><LI
18528 ><P
18529 >The first argument is the operation and is one
18530                         of "add", "delete", or "refresh". In most cases the operation can
18531                         be ignored as the rest of the parameters provide sufficient
18532                         information. Note that "refresh" may sometimes be called when the
18533                         name has not previously been added, in that case it should be treated
18534                         as an add.</P
18535 ></LI
18536 ><LI
18537 ><P
18538 >The second argument is the NetBIOS name. If the
18539                         name is not a legal name then the wins hook is not called.
18540                         Legal names contain only  letters, digits, hyphens, underscores
18541                         and periods.</P
18542 ></LI
18543 ><LI
18544 ><P
18545 >The third argument is the NetBIOS name
18546                         type as a 2 digit hexadecimal number. </P
18547 ></LI
18548 ><LI
18549 ><P
18550 >The fourth argument is the TTL (time to live)
18551                         for the name in seconds.</P
18552 ></LI
18553 ><LI
18554 ><P
18555 >The fifth and subsequent arguments are the IP
18556                         addresses currently registered for that name. If this list is
18557                         empty then the name should be deleted.</P
18558 ></LI
18559 ></UL
18560 ><P
18561 >An example script that calls the BIND dynamic DNS update
18562                 program <B
18563 CLASS="COMMAND"
18564 >nsupdate</B
18565 > is provided in the examples
18566                 directory of the Samba source code. </P
18567 ></DD
18568 ><DT
18569 ><A
18570 NAME="WINSPROXY"
18571 ></A
18572 >wins proxy (G)</DT
18573 ><DD
18574 ><P
18575 >This is a boolean that controls if <A
18576 HREF="nmbd.8.html"
18577 TARGET="_top"
18578 >nmbd(8)</A
18579 > will respond to broadcast name
18580                 queries on behalf of  other hosts. You may need to set this
18581                 to <TT
18582 CLASS="CONSTANT"
18583 >yes</TT
18584 > for some older clients.</P
18585 ><P
18586 >Default: <B
18587 CLASS="COMMAND"
18588 >wins proxy = no</B
18589 ></P
18590 ></DD
18591 ><DT
18592 ><A
18593 NAME="WINSSERVER"
18594 ></A
18595 >wins server (G)</DT
18596 ><DD
18597 ><P
18598 >This specifies the IP address (or DNS name: IP
18599                 address for preference) of the WINS server that <A
18600 HREF="nmbd.8.html"
18601 TARGET="_top"
18602 >               nmbd(8)</A
18603 > should register with. If you have a WINS server on
18604                 your network then you should set this to the WINS server's IP.</P
18605 ><P
18606 >You should point this at your WINS server if you have a
18607                 multi-subnetted network.</P
18608 ><P
18609 ><EM
18610 >NOTE</EM
18611 >. You need to set up Samba to point
18612                 to a WINS server if you have multiple subnets and wish cross-subnet
18613                 browsing to work correctly.</P
18614 ><P
18615 >See the documentation file <TT
18616 CLASS="FILENAME"
18617 >BROWSING.txt</TT
18618 >
18619                 in the docs/ directory of your Samba source distribution.</P
18620 ><P
18621 >Default: <EM
18622 >not enabled</EM
18623 ></P
18624 ><P
18625 >Example: <B
18626 CLASS="COMMAND"
18627 >wins server = 192.9.200.1</B
18628 ></P
18629 ></DD
18630 ><DT
18631 ><A
18632 NAME="WINSSUPPORT"
18633 ></A
18634 >wins support (G)</DT
18635 ><DD
18636 ><P
18637 >This boolean controls if the <A
18638 HREF="nmbd.8.html"
18639 TARGET="_top"
18640 >
18641                 nmbd(8)</A
18642 > process in Samba will act as a WINS server. You should
18643                 not set this to <TT
18644 CLASS="CONSTANT"
18645 >true</TT
18646 > unless you have a multi-subnetted network and
18647                 you wish a particular <B
18648 CLASS="COMMAND"
18649 >nmbd</B
18650 > to be your WINS server.
18651                 Note that you should <EM
18652 >NEVER</EM
18653 > set this to <TT
18654 CLASS="CONSTANT"
18655 >true</TT
18656 >
18657                 on more than one machine in your network.</P
18658 ><P
18659 >Default: <B
18660 CLASS="COMMAND"
18661 >wins support = no</B
18662 ></P
18663 ></DD
18664 ><DT
18665 ><A
18666 NAME="WORKGROUP"
18667 ></A
18668 >workgroup (G)</DT
18669 ><DD
18670 ><P
18671 >This controls what workgroup your server will
18672                 appear to be in when queried by clients. Note that this parameter
18673                 also controls the Domain name used with the <A
18674 HREF="#SECURITYEQUALSDOMAIN"
18675 ><B
18676 CLASS="COMMAND"
18677 >security = domain</B
18678 ></A
18679 >
18680                 setting.</P
18681 ><P
18682 >Default: <EM
18683 >set at compile time to WORKGROUP</EM
18684 ></P
18685 ><P
18686 >Example: <B
18687 CLASS="COMMAND"
18688 >workgroup = MYGROUP</B
18689 ></P
18690 ></DD
18691 ><DT
18692 ><A
18693 NAME="WRITABLE"
18694 ></A
18695 >writable (S)</DT
18696 ><DD
18697 ><P
18698 >Synonym for <A
18699 HREF="#WRITEABLE"
18700 ><TT
18701 CLASS="PARAMETER"
18702 ><I
18703 >               writeable</I
18704 ></TT
18705 ></A
18706 > for people who can't spell :-).</P
18707 ></DD
18708 ><DT
18709 ><A
18710 NAME="WRITECACHESIZE"
18711 ></A
18712 >write cache size (S)</DT
18713 ><DD
18714 ><P
18715 >If this integer parameter is set to non-zero value,
18716                 Samba will create an in-memory cache for each oplocked file
18717                 (it does <EM
18718 >not</EM
18719 > do this for
18720                 non-oplocked files). All writes that the client does not request
18721                 to be flushed directly to disk will be stored in this cache if possible.
18722                 The cache is flushed onto disk when a write comes in whose offset
18723                 would not fit into the cache or when the file is closed by the client.
18724                 Reads for the file are also served from this cache if the data is stored
18725                 within it.</P
18726 ><P
18727 >This cache allows Samba to batch client writes into a more
18728                 efficient write size for RAID disks (i.e. writes may be tuned to
18729                 be the RAID stripe size) and can improve performance on systems
18730                 where the disk subsystem is a bottleneck but there is free
18731                 memory for userspace programs.</P
18732 ><P
18733 >The integer parameter specifies the size of this cache
18734                 (per oplocked file) in bytes.</P
18735 ><P
18736 >Default: <B
18737 CLASS="COMMAND"
18738 >write cache size = 0</B
18739 ></P
18740 ><P
18741 >Example: <B
18742 CLASS="COMMAND"
18743 >write cache size = 262144</B
18744 ></P
18745 ><P
18746 >for a 256k cache size per file.</P
18747 ></DD
18748 ><DT
18749 ><A
18750 NAME="WRITELIST"
18751 ></A
18752 >write list (S)</DT
18753 ><DD
18754 ><P
18755 >This is a list of users that are given read-write
18756                 access to a service. If the connecting user is in this list then
18757                 they will be given write access, no matter what the <A
18758 HREF="#WRITEABLE"
18759 ><TT
18760 CLASS="PARAMETER"
18761 ><I
18762 >writeable</I
18763 ></TT
18764 ></A
18765 >
18766                 option is set to. The list can include group names using the
18767                 @group syntax.</P
18768 ><P
18769 >Note that if a user is in both the read list and the
18770                 write list then they will be given write access.</P
18771 ><P
18772 >See also the <A
18773 HREF="#READLIST"
18774 ><TT
18775 CLASS="PARAMETER"
18776 ><I
18777 >read list
18778                 </I
18779 ></TT
18780 ></A
18781 > option.</P
18782 ><P
18783 >Default: <B
18784 CLASS="COMMAND"
18785 >write list = &#60;empty string&#62;
18786                 </B
18787 ></P
18788 ><P
18789 >Example: <B
18790 CLASS="COMMAND"
18791 >write list = admin, root, @staff
18792                 </B
18793 ></P
18794 ></DD
18795 ><DT
18796 ><A
18797 NAME="WRITEOK"
18798 ></A
18799 >write ok (S)</DT
18800 ><DD
18801 ><P
18802 >Synonym for <A
18803 HREF="#WRITEABLE"
18804 ><TT
18805 CLASS="PARAMETER"
18806 ><I
18807 >               writeable</I
18808 ></TT
18809 ></A
18810 >.</P
18811 ></DD
18812 ><DT
18813 ><A
18814 NAME="WRITERAW"
18815 ></A
18816 >write raw (G)</DT
18817 ><DD
18818 ><P
18819 >This parameter controls whether or not the server
18820                 will support raw write SMB's when transferring data from clients.
18821                 You should never need to change this parameter.</P
18822 ><P
18823 >Default: <B
18824 CLASS="COMMAND"
18825 >write raw = yes</B
18826 ></P
18827 ></DD
18828 ><DT
18829 ><A
18830 NAME="WRITEABLE"
18831 ></A
18832 >writeable (S)</DT
18833 ><DD
18834 ><P
18835 >An inverted synonym is <A
18836 HREF="#READONLY"
18837 >               <TT
18838 CLASS="PARAMETER"
18839 ><I
18840 >read only</I
18841 ></TT
18842 ></A
18843 >.</P
18844 ><P
18845 >If this parameter is <TT
18846 CLASS="CONSTANT"
18847 >no</TT
18848 >, then users
18849                 of a service may not create or modify files in the service's
18850                 directory.</P
18851 ><P
18852 >Note that a printable service (<B
18853 CLASS="COMMAND"
18854 >printable = yes</B
18855 >)
18856                 will <EM
18857 >ALWAYS</EM
18858 > allow writing to the directory
18859                 (user privileges permitting), but only via spooling operations.</P
18860 ><P
18861 >Default: <B
18862 CLASS="COMMAND"
18863 >writeable = no</B
18864 ></P
18865 ></DD
18866 ></DL
18867 ></DIV
18868 ></DIV
18869 ><DIV
18870 CLASS="REFSECT1"
18871 ><A
18872 NAME="AEN5973"
18873 ></A
18874 ><H2
18875 >WARNINGS</H2
18876 ><P
18877 >Although the configuration file permits service names
18878         to contain spaces, your client software may not. Spaces will
18879         be ignored in comparisons anyway, so it shouldn't be a
18880         problem - but be aware of the possibility.</P
18881 ><P
18882 >On a similar note, many clients - especially DOS clients -
18883         limit service names to eight characters. <A
18884 HREF="smbd.8.html"
18885 TARGET="_top"
18886 >smbd(8)
18887         </A
18888 > has no such limitation, but attempts to connect from such
18889         clients will fail if they truncate the service names.  For this reason
18890         you should probably keep your service names down to eight characters
18891         in length.</P
18892 ><P
18893 >Use of the [homes] and [printers] special sections make life
18894         for an administrator easy, but the various combinations of default
18895         attributes can be tricky. Take extreme care when designing these
18896         sections. In particular, ensure that the permissions on spool
18897         directories are correct.</P
18898 ></DIV
18899 ><DIV
18900 CLASS="REFSECT1"
18901 ><A
18902 NAME="AEN5979"
18903 ></A
18904 ><H2
18905 >VERSION</H2
18906 ><P
18907 >This man page is correct for version 2.2 of
18908         the Samba suite.</P
18909 ></DIV
18910 ><DIV
18911 CLASS="REFSECT1"
18912 ><A
18913 NAME="AEN5982"
18914 ></A
18915 ><H2
18916 >SEE ALSO</H2
18917 ><P
18918 ><A
18919 HREF="samba.7.html"
18920 TARGET="_top"
18921 >samba(7)</A
18922 >,
18923         <A
18924 HREF="smbpasswd.8.html"
18925 TARGET="_top"
18926 ><B
18927 CLASS="COMMAND"
18928 >smbpasswd(8)</B
18929 ></A
18930 >,
18931         <A
18932 HREF="swat.8.html"
18933 TARGET="_top"
18934 ><B
18935 CLASS="COMMAND"
18936 >swat(8)</B
18937 ></A
18938 >,
18939         <A
18940 HREF="smbd.8.html"
18941 TARGET="_top"
18942 ><B
18943 CLASS="COMMAND"
18944 >smbd(8)</B
18945 ></A
18946 >,
18947         <A
18948 HREF="nmbd.8.html"
18949 TARGET="_top"
18950 ><B
18951 CLASS="COMMAND"
18952 >nmbd(8)</B
18953 ></A
18954 >,
18955         <A
18956 HREF="smbclient.1.html"
18957 TARGET="_top"
18958 ><B
18959 CLASS="COMMAND"
18960 >smbclient(1)</B
18961 ></A
18962 >,
18963         <A
18964 HREF="nmblookup.1.html"
18965 TARGET="_top"
18966 ><B
18967 CLASS="COMMAND"
18968 >nmblookup(1)</B
18969 ></A
18970 >,
18971         <A
18972 HREF="testparm.1.html"
18973 TARGET="_top"
18974 ><B
18975 CLASS="COMMAND"
18976 >testparm(1)</B
18977 ></A
18978 >,
18979         <A
18980 HREF="testprns.1.html"
18981 TARGET="_top"
18982 ><B
18983 CLASS="COMMAND"
18984 >testprns(1)</B
18985 ></A
18986 >
18987         </P
18988 ></DIV
18989 ><DIV
18990 CLASS="REFSECT1"
18991 ><A
18992 NAME="AEN6002"
18993 ></A
18994 ><H2
18995 >AUTHOR</H2
18996 ><P
18997 >The original Samba software and related utilities
18998         were created by Andrew Tridgell. Samba is now developed
18999         by the Samba Team as an Open Source project similar
19000         to the way the Linux kernel is developed.</P
19001 ><P
19002 >The original Samba man pages were written by Karl Auer.
19003         The man page sources were converted to YODL format (another
19004         excellent piece of Open Source software, available at
19005         <A
19006 HREF="ftp://ftp.icce.rug.nl/pub/unix/"
19007 TARGET="_top"
19008 >       ftp://ftp.icce.rug.nl/pub/unix/</A
19009 >) and updated for the Samba 2.0
19010         release by Jeremy Allison.  The conversion to DocBook for
19011         Samba 2.2 was done by Gerald Carter</P
19012 ></DIV
19013 ></BODY
19014 ></HTML
19015 >