| blob | d01333bf048de8c21fe4a0c2d005d71738d3c6d2 |
10 </head>
11 <body>
13 <hr>
23 smb.conf - The configuration file for the Samba suite
31 program. The complete description of the file format and possible
32 parameters held within are here for reference purposes.
36 <p>The file consists of sections and parameters. A section begins with
37 the name of the section in square brackets and continues until the
38 next section begins. Sections contain parameters of the form
40 <p>The file is line-based - that is, each newline-terminated line
41 represents either a comment, a section name or a parameter.
42 <p>Section and parameter names are not case sensitive.
43 <p>Only the first equals sign in a parameter is significant. Whitespace
44 before or after the first equals sign is discarded. Leading, trailing
45 and internal whitespace in section and parameter names is
46 irrelevant. Leading and trailing whitespace in a parameter value is
47 discarded. Internal whitespace within a parameter value is retained
48 verbatim.
49 <p>Any line beginning with a semicolon (';') or a hash ('#') character is
50 ignored, as are lines containing only whitespace.
52 customary UNIX fashion.
53 <p>The values following the equals sign in parameters are all either a
54 string (no quotes needed) or a boolean, which may be given as yes/no,
56 preserved in string values. Some items such as create modes are
57 numeric.
61 <p>Each section in the configuration file (except for the
62 <a href="smb.conf.5.html#global"><strong>[global]</strong></a> section) describes a shared resource (known
64 and the parameters within the section define the shares attributes.
65 <p>There are three special sections, <a href="smb.conf.5.html#global"><strong>[global]</strong></a>,
66 <a href="smb.conf.5.html#homes"><strong>[homes]</strong></a> and <a href="smb.conf.5.html#printers"><strong>[printers]</strong></a>, which are
67 described under <a href="smb.conf.5.html#SPECIALSECTIONS"><strong>'special sections'</strong></a>. The
68 following notes apply to ordinary section descriptions.
69 <p>A share consists of a directory to which access is being given plus
70 a description of the access rights which are granted to the user of
71 the service. Some housekeeping options are also specifiable.
72 <p>Sections are either filespace services (used by the client as an
73 extension of their native file systems) or printable services (used by
74 the client to access print services on the host running the server).
75 <p>Sections may be designated <a href="smb.conf.5.html#guestok"><strong>guest</strong></a> services, in which
76 case no password is required to access them. A specified UNIX
77 <a href="smb.conf.5.html#guestaccount"><strong>guest account</strong></a> is used to define access
78 privileges in this case.
79 <p>Sections other than guest services will require a password to access
80 them. The client provides the username. As older clients only provide
81 passwords and not usernames, you may specify a list of usernames to
82 check against the password using the <a href="smb.conf.5.html#user"><strong>"user="</strong></a> option in
84 Windows NT, this should not be necessary.
85 <p>Note that the access rights granted by the server are masked by the
86 access rights granted to the specified or guest UNIX user by the host
87 system. The server does not grant more access than the host system
88 grants.
89 <p>The following sample section defines a file space share. The user has
91 the share name "foo":
92 <p><pre>
95 [foo]
96 path = /home/bar
97 writeable = true
100 </pre>
102 <p>The following sample section defines a printable share. The share
103 is readonly, but printable. That is, the only write access permitted
104 is via calls to open, write to and close a spool file. The
105 <a href="smb.conf.5.html#guestok"><strong>'guest ok'</strong></a> parameter means access will be permitted
106 as the default guest user (specified elsewhere):
107 <p><pre>
109 [aprinter]
110 path = /usr/spool/public
111 writeable = false
112 printable = true
113 guest ok = true
115 </pre>
120 <p><dl>
123 <p>Parameters in this section apply to the server as a whole, or are
124 defaults for sections which do not specifically define certain
125 items. See the notes under <a href="smb.conf.5.html#PARAMETERS"><strong>'PARAMETERS'</strong></a> for more
126 information.
130 services connecting clients to their home directories can be created
131 on the fly by the server.
132 <p>When the connection request is made, the existing sections are
133 scanned. If a match is found, it is used. If no match is found, the
134 requested section name is treated as a user name and looked up in the
135 local password file. If the name exists and the correct password has
136 been given, a share is created by cloning the [homes] section.
137 <p>Some modifications are then made to the newly created share:
138 <p><dl>
140 username
141 <p><li > If no path was given, the path is set to the user's home
142 directory.
143 <p></dl>
144 <p>If you decide to use a <a href="smb.conf.5.html#path"><strong>path=</strong></a> line in your [homes]
145 section then you may find it useful to use the <a href="smb.conf.5.html#percentS"><strong>%S</strong></a>
146 macro. For example :
148 <p>would be useful if you have different home directories for your PCs
149 than for UNIX access.
150 <p>This is a fast and simple way to give a large number of clients access
151 to their home directories with a minimum of fuss.
153 except that the share name is not changed to that of the requesting
154 user. This method of using the [homes] section works well if different
155 users share a client PC.
156 <p>The [homes] section can specify all the parameters a normal service
157 section can specify, though some make more sense than others. The
158 following is a typical and suitable [homes] section:
159 <p><pre>
161 [homes]
162 writeable = yes
164 </pre>
166 <p>An important point is that if guest access is specified in the [homes]
167 section, all home directories will be visible to all clients
169 actually desirable, it would be wise to also specify <a href="smb.conf.5.html#readonly"><strong>read only
170 access</strong></a>.
171 <p>Note that the <a href="smb.conf.5.html#browseable"><strong>browseable</strong></a> flag for auto home
172 directories will be inherited from the global browseable flag, not the
173 [homes] browseable flag. This is useful as it means setting
174 browseable=no in the [homes] section will hide the [homes] share but
175 make any auto home directories visible.
178 <p>This section works like <a href="smb.conf.5.html#homes"><strong>[homes]</strong></a>, but for printers.
180 able to connect to any printer specified in the local host's printcap
181 file.
182 <p>When a connection request is made, the existing sections are
183 scanned. If a match is found, it is used. If no match is found, but a
184 <a href="smb.conf.5.html#homes"><strong>[homes]</strong></a> section exists, it is used as described
185 above. Otherwise, the requested section name is treated as a printer
186 name and the appropriate printcap file is scanned to see if the
187 requested section name is a valid printer share name. If a match is
189 section.
190 <p>A few modifications are then made to the newly created share:
191 <p><dl>
192 <p><li > The share name is set to the located printer name
193 <p><li > If no printer name was given, the printer name is set to the
194 located printer name
195 <p><li > If the share does not permit guest access and no username was
196 given, the username is set to the located printer name.
197 <p></dl>
199 otherwise, the server will refuse to load the configuration file.
200 <p>Typically the path specified would be that of a world-writeable spool
202 would look like this:
203 <p><pre>
205 [printers]
206 path = /usr/spool/public
207 guest ok = yes
208 printable = yes
210 </pre>
212 <p>All aliases given for a printer in the printcap file are legitimate
213 printer names as far as the server is concerned. If your printing
214 subsystem doesn't work like that, you will have to set up a
215 pseudo-printcap. This is a file consisting of one or more lines like
216 this:
217 <p><pre>
218 alias|alias|alias|alias...
219 </pre>
221 <p>Each alias should be an acceptable printer name for your printing
222 subsystem. In the <a href="smb.conf.5.html#global"><strong>[global]</strong></a> section, specify the new
223 file as your printcap. The server will then only recognize names
224 found in your pseudo-printcap, which of course can contain whatever
225 aliases you like. The same technique could be used simply to limit
226 access to a subset of your local printers.
227 <p>An alias, by the way, is defined as any component of the first entry
228 of a printcap record. Records are separated by newlines, components
229 (if there are more than one) are separated by vertical bar symbols
230 ("|").
231 <p>NOTE: On SYSV systems which use lpstat to determine what printers are
232 defined on the system you may be able to use <a href="smb.conf.5.html#printcapname"><strong>"printcap name =
234 printers. See the <a href="smb.conf.5.html#printcapname"><strong>"printcap name"</strong></a> option for
235 more details.
236 <p></dl>
240 <p>Parameters define the specific attributes of sections.
241 <p>Some parameters are specific to the <a href="smb.conf.5.html#global"><strong>[global]</strong></a> section
242 (e.g., <a href="smb.conf.5.html#security"><strong>security</strong></a>). Some parameters are usable in
243 all sections (e.g., <a href="smb.conf.5.html#createmode"><strong>create mode</strong></a>). All others are
244 permissible only in normal sections. For the purposes of the following
246 <a href="smb.conf.5.html#printers"><strong>[printers]</strong></a> sections will be considered normal.
248 specific to the <a href="smb.conf.5.html#global"><strong>[global]</strong></a> section. The letter <code>'S'</code>
249 indicates that a parameter can be specified in a service specific
251 <a href="smb.conf.5.html#global"><strong>[global]</strong></a> section - in which case they will define
252 the default behavior for all services.
253 <p>Parameters are arranged here in alphabetical order - this may not
254 create best bedfellows, but at least you can find them! Where there
255 are synonyms, the preferred synonym is described, others refer to the
256 preferred synonym.
260 <p>Many of the strings that are settable in the config file can take
263 the user connected with the username john.
264 <p>These substitutions are mostly noted in the descriptions below, but
265 there are some general substitutions which apply whenever they might
266 be relevant. These are:
267 <p><dl>
275 <li > <strong>%g</strong> = primary group name of <a href="smb.conf.5.html#percentu"><strong>%u</strong></a>.
278 the client wanted, not necessarily the same as the one they got).
280 <li > <strong>%G</strong> = primary group name of <a href="smb.conf.5.html#percentU"><strong>%U</strong></a>.
282 <li > <strong>%H</strong> = the home directory of the user given by <a href="smb.conf.5.html#percentu"><strong>%u</strong></a>.
291 config based on what the client calls you. Your server can have a "dual
292 personality".
297 obtained from your NIS auto.map entry. If you have not compiled Samba
302 auto.map entry. The NIS auto.map entry is split up as "%N:%p".
305 negotiation. It can be one of CORE, COREPLUS, LANMAN1, LANMAN2 or NT1.
310 machine. Only some are recognized, and those may not be 100%
311 reliable. It currently recognizes Samba, WfWg, WinNT and
312 Win95. Anything else will be known as "UNKNOWN". If it gets it wrong
314 should allow it to be fixed.
319 <p></dl>
320 <p>There are some quite creative things that can be done with these
321 substitutions and other smb.conf options.
326 use files that don't conform to the 8.3 format. It can also be set to
327 adjust the case of 8.3 format filenames.
328 <p>There are several options that control the way mangling is performed,
329 and they are grouped here rather than listed separately. For the
330 defaults look at the output of the testparm program.
331 <p>All of these options can be set separately for each service (or
332 globally, of course).
333 <p>The options are:
336 aren't of the "default" case are mangled. For example, if this is yes
340 sensitive. If they aren't then Samba must do a filename search and
351 to 8.3 syntax, that is all in upper case and of suitable length, are
353 case. This option can be use with <a href="smb.conf.5.html#preservecaseoption"><strong>"preserve case =
357 server, in that it is case insensitive but case preserving.
361 <p>There are a number of ways in which a user can connect to a
362 service. The server follows the following steps in determining if it
363 will allow a connection to a specified service. If all the steps fail
364 then the connection request is rejected. If one of the steps pass then
365 the following steps are not checked.
366 <p>If the service is marked <a href="smb.conf.5.html#guestonly"><strong>"guest only = yes"</strong></a> then
368 <p><ol>
370 that username/password pair is validated by the UNIX system's password
371 programs then the connection is made as that username. Note that this
373 username.
375 the system and now supplies a correct password for that username then
376 the connection is allowed.
378 names are checked against the supplied password, if they match then
379 the connection is allowed as the corresponding user.
381 username/password pair with the server and the client has passed the
382 validation token then that username is used. This step is skipped if
384 <p><li> Step 5: If a <a href="smb.conf.5.html#user"><strong>"user = "</strong></a> field is given in the
385 smb.conf file for the service and the client has supplied a password,
386 and that password matches (according to the UNIX system's password
387 checking) with one of the usernames from the <a href="smb.conf.5.html#user"><strong>user=</strong></a>
388 field then the connection is made as the username in the
390 <a href="smb.conf.5.html#user"><strong>user=</strong></a> list begins with a <code>'@'</code> then that name
391 expands to a list of names in the group of the same name.
395 password.
396 <p></ol>
400 <p>Here is a list of all global parameters. See the section of each
401 parameter for details. Note that some are synonyms.
402 <p><dl>
404 <p><li > <a href="smb.conf.5.html#allowtrusteddomains"><strong>allow trusted domains</strong></a>
410 <p><li > <a href="smb.conf.5.html#changenotifytimeout"><strong>change notify timeout</strong></a>
416 <p><li > <a href="smb.conf.5.html#debughirestimestamp"><strong>debug hires timestamp</strong></a>
459 <p><li > <a href="smb.conf.5.html#machinepasswordtimeout"><strong>machine password timeout</strong></a>
483 <p><li > <a href="smb.conf.5.html#olelockingcompatibility"><strong>ole locking compatibility</strong></a>
484 <p><li > <a href="smb.conf.5.html#oplockbreakwaittime"><strong>oplock break wait time</strong></a>
527 <p><li > <a href="smb.conf.5.html#sslrequireclientcert"><strong>ssl require clientcert</strong></a>
528 <p><li > <a href="smb.conf.5.html#sslrequireservercert"><strong>ssl require servercert</strong></a>
559 <p></dl>
563 <p>Here is a list of all service parameters. See the section of each
564 parameter for details. Note that some are synonyms.
565 <p><dl>
568 <p><li > <a href="smb.conf.5.html#alternatepermissions"><strong>alternate permissions</strong></a>
586 <p><li > <a href="smb.conf.5.html#directorysecuritymask"><strong>directory security mask</strong></a>
588 <p><li > <a href="smb.conf.5.html#dosfiletimeresolution"><strong>dos filetime resolution</strong></a>
591 <p><li > <a href="smb.conf.5.html#fakedirectorycreatetimes"><strong>fake directory create times</strong></a>
596 <p><li > <a href="smb.conf.5.html#forcedirectorysecuritymode"><strong>force directory security mode</strong></a>
632 <p><li > <a href="smb.conf.5.html#oplockcontentionlimit"><strong>oplock contention limit</strong></a>
645 <p><li > <a href="smb.conf.5.html#printerdriverlocation"><strong>printer driver location</strong></a>
679 <p></dl>
683 <p><dl>
688 below.
689 <p>Normally, a Samba server requires that UNIX users are created for all
690 users accessing files on this server. For sites that use Windows NT
691 account databases as their primary user database creating these users
692 and keeping the user list in sync with the Windows NT PDC is an
695 server.
698 <a href="smb.conf.5.html#securityequaldomain"><strong>security=domain</strong></a> and <strong>"add user script"</strong>
699 must be set to a full pathname for a script that will create a UNIX user
701 create.
702 <p>When the Windows user attempts to access the Samba server, at
704 <a href="smbd.8.html"><strong>smbd</strong></a> contacts the <a href="smb.conf.5.html#passwordserver"><strong>password
705 server</strong></a> and attempts to authenticate the given user
706 with the given password. If the authentication succeeds then
708 password database to map the Windows user into. If this lookup fails,
709 and <strong>"add user script"</strong> is set then <a href="smbd.8.html"><strong>smbd</strong></a> will
711 to be the user name to create.
712 <p>If this script successfully creates the user then
714 already existed. In this way, UNIX users are dynamically created to
715 match existing Windows NT accounts.
717 <a href="smb.conf.5.html#securityequaldomain"><strong>security=domain</strong></a>, <a href="smb.conf.5.html#passwordserver"><strong>password
719 script</strong></a>.
726 <p>This is a list of users who will be granted administrative privileges
727 on the share. This means that they will do all file operations as the
728 super-user (root).
729 <p>You should use this option very carefully, as any user in this list
730 will be able to do anything they like on the share, irrespective of
731 file permissions.
741 <p>This option only takes effect when the <a href="smb.conf.5.html#security"><strong>security</strong></a>
743 then attempts to connect to a resource from a domain or workgroup other than
744 the one which smbd is running in will fail, even if that domain
745 is trusted by the remote server doing the authentication.
746 <p>This is useful if you only want your Samba server to serve resources
747 to users in the domain it is a member of. As an example, suppose that there are
748 two domains DOMA and DOMB. DOMB is trusted by DOMA, which contains
749 the Samba server. Under normal circumstances, a user with an account
750 in DOMB can then access the resources of a UNIX account with the same
751 account name on the Samba server even if they do not have an account
752 in DOMA. This can make implementing a security boundary difficult.
759 <p>This is a deprecated parameter. It no longer has any effect in Samba2.0.
760 In previous versions of Samba it affected the way the DOS "read only"
761 attribute was mapped for a file. In Samba2.0 a file is marked "read only"
762 if the UNIX file does not have the 'w' bit set for the owner of the file,
763 regardless if the owner of the file is the currently logged on user or not.
767 announce itself as, to a network neighborhood browse list. By default
768 this is set to Windows NT. The valid options are : "NT", which is a
771 and Windows for Workgroups respectively. Do not change this parameter
772 unless you have a specific need to stop Samba appearing as an NT server
773 as this may prevent Samba servers from participating as browser servers correctly.
780 <p>This specifies the major and minor version numbers that nmbd will use
781 when announcing itself as a server. The default is 4.2. Do not change
782 this parameter unless you have a specific need to set a Samba server
783 to be a downlevel server.
790 <p>This is a list of services that you want to be automatically added to
791 the browse lists. This is most useful for homes and printers services
792 that would otherwise not be visible.
793 <p>Note that if you just want all printers in your printcap file loaded
794 then the <a href="smb.conf.5.html#loadprinters"><strong>"load printers"</strong></a> option is easier.
803 are logged.
810 <p>This global parameter allows the Samba admin to limit what interfaces
811 on a machine will serve smb requests. If affects file service
812 <a href="smbd.8.html"><strong>smbd</strong></a> and name service <a href="nmbd.8.html"><strong>nmbd</strong></a>
813 in slightly different ways.
819 of reading broadcast messages. If this option is not set then
823 packets coming in on the broadcast sockets and discard any that don't
824 match the broadcast addresses of the interfaces in the
825 <a href="smb.conf.5.html#interfaces"><strong>'interfaces'</strong></a> parameter list. As unicast packets
827 to refuse to serve names to machines that send packets that arrive
828 through any interfaces not listed in the
829 <a href="smb.conf.5.html#interfaces"><strong>"interfaces"</strong></a> list. IP Source address spoofing
830 does defeat this simple check, however so it must not be used
833 the interface list given in the <a href="smb.conf.5.html#interfaces"><strong>'interfaces'</strong></a>
835 will serve to packets coming in those interfaces. Note that you
836 should not use this parameter for machines that are serving PPP or
837 other intermittent or non-broadcast network interfaces as it will not
838 cope with non-permanent interfaces.
840 <em>127.0.0.1</em> is added to the <a href="smb.conf.5.html#interfaces"><strong>'interfaces'</strong></a> parameter
843 reasons covered below.
844 <p>To change a users SMB password, the <a href="smbpasswd.8.html"><strong>smbpasswd</strong></a>
851 use the primary IP interface of the local host by using its
854 of the local host.
856 <a href="smbd.8.html"><strong>smbd</strong></a> and <a href="nmbd.8.html"><strong>nmbd</strong></a> at the address
858 <a href="smbd.8.html"><strong>smbd</strong></a> and <a href="nmbd.8.html"><strong>nmbd</strong></a> to always show
859 "not running" even if they really are. This can prevent
861 <a href="smbd.8.html"><strong>smbd</strong></a> and <a href="nmbd.8.html"><strong>nmbd</strong></a>.
869 given a request by a client to obtain a byte range lock on a region
870 of an open file, and the request has a time limit associated with it.
871 <p>If this parameter is set and the lock range requested cannot be
872 immediately satisfied, Samba 2.0 will internally queue the lock
873 request, and periodically attempt to obtain the lock until the
874 timeout period expires.
876 as previous versions of Samba would and will fail the lock
877 request immediately if the lock range cannot be obtained.
878 <p>This parameter can be set per share.
889 list to a client doing a NetServerEnum call. Normally set to true. You
890 should never need to change this.
895 <p>This controls whether this share is seen in the list of available
896 shares in a net view and in the browse list.
903 <p>See the discussion in the section <a href="smb.conf.5.html#NAMEMANGLING"><strong>NAME MANGLING</strong></a>.
910 "ChangeNotify" requests. This SMB allows a client to tell a server to
912 the SMB request when a change has occurred. Such constant scanning of
913 a directory is expensive under UNIX, hence an
924 <p>This allows a smbd to map incoming filenames from a DOS Code page (see
925 the <a href="smb.conf.5.html#clientcodepage"><strong>client code page</strong></a> parameter) to several
926 built in UNIX character sets. The built in code page translations are:
927 <p><dl>
929 <a href="smb.conf.5.html#clientcodepage"><strong>client code page</strong></a> <em>MUST</em> be set to code
931 in order for the conversion to the UNIX character set to be done
932 correctly.
934 <a href="smb.conf.5.html#clientcodepage"><strong>client code page</strong></a> <em>MUST</em> be set to code
936 in order for the conversion to the UNIX character set to be done
937 correctly.
939 <a href="smb.conf.5.html#clientcodepage"><strong>client code page</strong></a> <em>MUST</em> be set to code
941 in order for the conversion to the UNIX character set to be done
942 correctly.
944 <a href="smb.conf.5.html#clientcodepage"><strong>client code page</strong></a> <em>MUST</em> be set to code
946 in order for the conversion to the UNIX character set to be done
947 correctly.
952 conversion to the UNIX character set to be done correctly.
953 <p></dl>
955 be dynamic, like the loading of MS DOS code pages, not static.
956 <p>See also <a href="smb.conf.5.html#clientcodepage"><strong>client code page</strong></a>. Normally this
957 parameter is not set, meaning no filename translation is done.
964 <p>This parameter specifies the DOS code page that the clients accessing
965 Samba are using. To determine what code page a Windows or DOS client
966 is using, open a DOS command prompt and type the command "chcp". This
967 will output the code page. The default for USA MS-DOS, Windows 95, and
968 Windows NT releases is code page 437. The default for western european
969 releases of the above operating systems is code page 850.
972 described more fully in the manual page <a href="make_smbcodepage.1.html"><strong>make_smbcodepage
974 to map lower to upper case characters to provide the case insensitivity
975 of filenames that Windows clients expect.
976 <p>Samba currently ships with the following code page files :
977 <p><dl>
988 <p></dl>
991 read the comments in one of the other codepage files and the
993 write one. Please remember to donate it back to the Samba user
994 community.
997 valid in filenames and how capitalization is done. If you set both
998 this parameter and the <a href="smb.conf.5.html#validchars"><strong>"valid chars"</strong></a> parameter
1000 <a href="smb.conf.5.html#validchars"><strong>"valid chars"</strong></a> parameter in the <strong>smb.conf</strong>
1001 file. The <a href="smb.conf.5.html#validchars"><strong>"valid chars"</strong></a> string will then augment
1002 the character settings in the "client code page" parameter.
1011 <p>This parameter is used to determine how incoming Shift-JIS Japanese
1012 characters are mapped from the incoming <a href="smb.conf.5.html#clientcodepage"><strong>"client code
1016 <p>The options are :
1017 <p><dl>
1020 Shift-JIS to eight bit JIS code with different shift-in, shift out
1021 codes.
1023 Shift-JIS to seven bit JIS code with different shift-in, shift out
1024 codes.
1026 Shift-JIS to JUNET code with different shift-in, shift out codes.
1031 representation used by the Columbia AppleTalk Program (CAP),
1033 <p></dl>
1036 <p>This is a text field that is seen next to a share when a client does a
1037 queries the server, either via the network neighborhood or via "net
1038 view" to list what shares are available.
1039 <p>If you want to set the string that is displayed next to the machine
1040 name then see the server string command.
1047 <p>This allows you to override the config file to use, instead of the
1049 here as this option is set in the config file!
1050 <p>For this reason, if the name of the config file has changed when the
1051 parameters are loaded then it will reload them from the new config
1052 file.
1053 <p>This option takes the usual substitutions, which can be very useful.
1054 <p>If the config file doesn't exist then it won't be loaded (allowing you
1055 to special case the config files of just a few clients).
1061 service is simply duplicated under the current service's name. Any
1062 parameters specified in the current section will override those in the
1063 section being copied.
1064 <p>This feature lets you set up a 'template' service and create similar
1065 services easily. Note that the service being copied must occur earlier
1066 in the configuration file than the service doing the copying.
1073 <p>A synonym for this parameter is <a href="smb.conf.5.html#createmode"><strong>'create mode'</strong></a>.
1074 <p>When a file is created, the necessary permissions are calculated
1075 according to the mapping from DOS modes to UNIX permissions, and the
1076 resulting UNIX mode is then bit-wise 'AND'ed with this parameter.
1077 This parameter may be thought of as a bit-wise MASK for the UNIX modes
1079 on a file when it is created.
1080 <p>The default value of this parameter removes the 'group' and 'other'
1081 write and execute bits from the UNIX modes.
1082 <p>Following this Samba will bit-wise 'OR' the UNIX mode created from
1083 this parameter with the value of the "force create mode" parameter
1084 which is set to 000 by default.
1085 <p>This parameter does not affect directory modes. See the parameter
1087 <p>See also the <a href="smb.conf.5.html#forcecreatemode"><strong>"force create mode"</strong></a> parameter
1088 for forcing particular mode bits to be set on created files. See also
1089 the <a href="smb.conf.5.html#directorymode"><strong>"directory mode"</strong></a> parameter for masking
1090 mode bits on created directories.
1091 See also the <a href="smb.conf.5.html#inheritpermissions"><strong>"inherit permissions"</strong></a> parameter.
1098 <p>This is a synonym for <a href="smb.conf.5.html#createmask"><strong>create mask</strong></a>.
1101 <p>The value of the parameter (a decimal integer) represents the number
1102 of minutes of inactivity before a connection is considered dead, and
1103 it is disconnected. The deadtime only takes effect if the number of
1104 open files is zero.
1105 <p>This is useful to stop a server's resources being exhausted by a large
1106 number of inactive connections.
1107 <p>Most clients have an auto-reconnect feature when a connection is
1108 broken so in most cases this parameter should be transparent to users.
1109 <p>Using this parameter with a timeout of a few minutes is recommended
1110 for most systems.
1111 <p>A deadtime of zero indicates that no auto-disconnection should be
1112 performed.
1119 <p>Sometimes the timestamps in the log messages are needed with a
1120 resolution of higher that seconds, this boolean parameter adds
1121 microsecond resolution to the timestamp message header when turned on.
1122 <p>Note that the parameter <a href="smb.conf.5.html#debugtimestamp"><strong>debug timestamp</strong></a>
1123 must be on for this to have an effect.
1130 <p>Samba2.0 debug log messages are timestamped by default. If you are
1131 running at a high <a href="smb.conf.5.html#debuglevel"><strong>"debug level"</strong></a> these timestamps
1132 can be distracting. This boolean parameter allows timestamping to be turned
1133 off.
1140 <p>When using only one log file for more then one forked smbd-process
1141 there may be hard to follow which process outputs which message.
1142 This boolean parameter is adds the process-id to the timestamp message
1143 headers in the logfile when turned on.
1144 <p>Note that the parameter <a href="smb.conf.5.html#debugtimestamp"><strong>debug timestamp</strong></a>
1145 must be on for this to have an effect.
1152 <p>Samba is sometimes run as root and sometime run as the connected
1153 user, this boolean parameter inserts the current euid, egid, uid
1154 and gid to the timestamp message headers in the log file if turned on.
1155 <p>Note that the parameter <a href="smb.conf.5.html#debugtimestamp"><strong>debug timestamp</strong></a>
1156 must be on for this to have an effect.
1163 <p>The value of the parameter (an integer) allows the debug level
1165 give greater flexibility in the configuration of the system.
1166 <p>The default will be the debug level specified on the command line
1167 or level zero if none was specified.
1172 <p>A synonym for <a href="smb.conf.5.html#defaultservice"><strong>default service</strong></a>.
1175 <p>See the section on <a href="smb.conf.5.html#NAMEMANGLING"><strong>"NAME MANGLING"</strong></a>. Also note
1176 the <a href="smb.conf.5.html#shortpreservecase"><strong>"short preserve case"</strong></a> parameter.
1179 <p>This parameter specifies the name of a service which will be connected
1180 to if the service actually requested cannot be found. Note that the
1182 below).
1183 <p>There is no default value for this parameter. If this parameter is not
1184 given, attempting to connect to a nonexistent service results in an
1185 error.
1186 <p>Typically the default service would be a <a href="smb.conf.5.html#guestok"><strong>guest ok</strong></a>,
1188 <p>Also note that the apparent service name will be changed to equal that
1189 of the requested service, this is very useful as it allows you to use
1190 macros like <a href="smb.conf.5.html#percentS"><strong>%S</strong></a> to make a wildcard service.
1193 interesting things.
1195 <pre>
1197 default service = pub
1199 [pub]
1200 path = /%S
1202 </pre>
1208 below.
1209 <p>Normally, a Samba server requires that UNIX users are created for all
1210 users accessing files on this server. For sites that use Windows NT
1211 account databases as their primary user database creating these users
1212 and keeping the user list in sync with the Windows NT PDC is an
1215 server and the Windows NT user no longer exists.
1217 <a href="smb.conf.5.html#securityequaldomain"><strong>security=domain</strong></a> and <strong>"delete user
1221 <a href="smb.conf.5.html#adduserscript"><strong>add user script</strong></a> which will work with the
1222 <a href="smb.conf.5.html#securityequalserver"><strong>security=server</strong></a> option as well as
1223 <a href="smb.conf.5.html#securityequaldomain"><strong>security=domain</strong></a>. The reason for this
1224 is only when Samba is a domain member does it get the information
1225 on an attempted user logon that a user no longer exists. In the
1226 <a href="smb.conf.5.html#securityequalserver"><strong>security=server</strong></a> mode a missing user
1227 is treated the same as an invalid password logon attempt. Deleting
1228 the user in this circumstance would not be a good idea.
1229 <p>When the Windows user attempts to access the Samba server, at
1231 <a href="smbd.8.html"><strong>smbd</strong></a> contacts the <a href="smb.conf.5.html#passwordserver"><strong>password
1232 server</strong></a> and attempts to authenticate the given user
1233 with the given password. If the authentication fails with the specific
1234 Domain error code meaning that the user no longer exists then
1236 password database that matches the Windows user account. If this lookup succeeds,
1237 and <strong>"delete user script"</strong> is set then <a href="smbd.8.html"><strong>smbd</strong></a> will
1239 to be the user name to delete.
1240 <p>This script should delete the given UNIX username. In this way, UNIX
1241 users are dynamically deleted to match existing Windows NT accounts.
1242 <p>See also <a href="smb.conf.5.html#securityequaldomain"><strong>security=domain</strong></a>,
1243 <a href="smb.conf.5.html#passwordserver"><strong>password server</strong></a>, <a href="smb.conf.5.html#adduserscript"><strong>add user
1244 script</strong></a>.
1251 <p>This parameter allows readonly files to be deleted. This is not
1252 normal DOS semantics, but is allowed by UNIX.
1253 <p>This option may be useful for running applications such as rcs, where
1254 UNIX file ownership prevents changing file permissions, and DOS
1255 semantics prevent deletion of a read only file.
1262 <p>This option is used when Samba is attempting to delete a directory
1263 that contains one or more vetoed directories (see the <a href="smb.conf.5.html#vetofiles"><strong>'veto
1264 files'</strong></a> option). If this option is set to False (the
1265 default) then if a vetoed directory contains any non-vetoed files or
1266 directories then the directory delete will fail. This is usually what
1267 you want.
1268 <p>If this option is set to True, then Samba will attempt to recursively
1269 delete any files and directories within the vetoed directory. This can
1271 which create meta-files within directories you might normally veto
1274 transparently deleted when the parent directory is deleted (so long
1275 as the user has permissions to do so).
1286 <p>The dfree command setting should only be used on systems where a
1287 problem occurs with the internal disk space calculations. This has
1288 been known to happen with Ultrix, but may occur with other operating
1289 systems. The symptom that was seen was an error of "Abort Retry
1290 Ignore" at the end of each directory listing.
1291 <p>This setting allows the replacement of the internal routines to
1292 calculate the total disk space and amount available with an external
1293 routine. The example below gives a possible script that might fulfill
1294 this function.
1295 <p>The external program will be passed a single parameter indicating a
1296 directory in the filesystem being queried. This will typically consist
1298 ascii. The first should be the total disk space in blocks, and the
1299 second should be the number of available blocks. An optional third
1300 return value can give the block size in bytes. The default blocksize
1301 is 1024 bytes.
1303 owned by (and writeable only by) root!
1305 <code> By default internal routines for determining the disk capacity
1306 and remaining space will be used.</code>
1309 <p>Where the script dfree (which must be made executable) could be:
1310 <p><pre>
1312 #!/bin/sh
1315 </pre>
1317 <p>or perhaps (on Sys V based systems):
1318 <p><pre>
1320 #!/bin/sh
1323 </pre>
1325 <p>Note that you may have to replace the command names with full
1326 path names on some systems.
1332 <p>This parameter is the octal modes which are used when converting DOS
1333 modes to UNIX modes when creating UNIX directories.
1334 <p>When a directory is created, the necessary permissions are calculated
1335 according to the mapping from DOS modes to UNIX permissions, and the
1336 resulting UNIX mode is then bit-wise 'AND'ed with this parameter.
1337 This parameter may be thought of as a bit-wise MASK for the UNIX modes
1339 modes set on a directory when it is created.
1340 <p>The default value of this parameter removes the 'group' and 'other'
1341 write bits from the UNIX mode, allowing only the user who owns the
1342 directory to modify it.
1343 <p>Following this Samba will bit-wise 'OR' the UNIX mode created from
1344 this parameter with the value of the "force directory mode"
1345 parameter. This parameter is set to 000 by default (i.e. no extra mode
1346 bits are added).
1347 <p>See the <a href="smb.conf.5.html#forcedirectorymode"><strong>"force directory mode"</strong></a> parameter
1348 to cause particular mode bits to always be set on created directories.
1349 <p>See also the <a href="smb.conf.5.html#createmode"><strong>"create mode"</strong></a> parameter for masking
1350 mode bits on created files, and the <a href="smb.conf.5.html#directorysecuritymask"><strong>"directory security mask"</strong></a>
1351 parameter.
1352 <p>See also the <a href="smb.conf.5.html#inheritpermissions"><strong>"inherit permissions"</strong></a> parameter.
1362 <p>This parameter controls what UNIX permission bits can be modified
1363 when a Windows NT client is manipulating the UNIX permission on a
1364 directory using the native NT security dialog box.
1365 <p>This parameter is applied as a mask (AND'ed with) to the changed
1366 permission bits, thus preventing any bits not in this mask from
1367 being modified. Essentially, zero bits in this mask may be treated
1368 as a set of bits the user is not allowed to change.
1369 <p>If not set explicitly this parameter is set to the same value as the
1370 <a href="smb.conf.5.html#directorymask"><strong>directory mask</strong></a> parameter. To allow a user to
1371 modify all the user/group/world permissions on a directory, set this
1372 parameter to 0777.
1374 means can easily bypass this restriction, so it is primarily
1375 useful for standalone "appliance" systems. Administrators of
1376 most normal systems will probably want to set it to 0777.
1377 <p>See also the <a href="smb.conf.5.html#forcedirectorysecuritymode"><strong>force directory security
1379 mask</strong></a>, <a href="smb.conf.5.html#forcesecuritymode"><strong>force security mode</strong></a>
1380 parameters.
1388 server and finding that a NetBIOS name has not been registered, should
1389 treat the NetBIOS name word-for-word as a DNS name and do a lookup
1390 with the DNS server for that name on behalf of the name-querying
1391 client.
1393 the DNS name (or DNS alias) can likewise only be 15 characters,
1394 maximum.
1396 DNS name lookup requests, as doing a name lookup is a blocking action.
1397 <p>See also the parameter <a href="smb.conf.5.html#winssupport"><strong>wins support</strong></a>.
1403 Samba NT Domain Controller Code. It may be removed in a later release.
1404 To work with the latest code builds that may have more support for
1405 Samba NT Domain Controller functionality please subscribe to the
1411 Samba NT Domain Controller Code. It may be removed in a later release.
1412 To work with the latest code builds that may have more support for
1413 Samba NT Domain Controller functionality please subscribe to the
1419 Samba NT Domain Controller Code. It may be removed in a later release.
1420 To work with the latest code builds that may have more support for
1421 Samba NT Domain Controller functionality please subscribe to the
1427 Samba NT Domain Controller Code. It may be removed in a later release.
1428 To work with the latest code builds that may have more support for
1429 Samba NT Domain Controller functionality please subscribe to the
1435 Samba NT Domain Controller Code. It may be removed in a later release.
1436 To work with the latest code builds that may have more support for
1437 Samba NT Domain Controller functionality please subscribe to the
1443 logons for the <a href="smb.conf.5.html#workgroup"><strong>workgroup</strong></a> it is in. For more
1444 details on setting up this feature see the file DOMAINS.txt in the
1447 NT Domain logons. NT Domain logons require a Primary Domain Controller
1448 (PDC) for the Domain. It is intended that in a future release Samba
1449 will be able to provide this functionality for Windows NT clients
1450 also.
1457 claim a special domain specific NetBIOS name that identifies it as a
1458 domain master browser for its given
1459 <a href="smb.conf.5.html#workgroup"><strong>workgroup</strong></a>. Local master browsers in the same
1460 <a href="smb.conf.5.html#workgroup"><strong>workgroup</strong></a> on broadcast-isolated subnets will give
1463 for the whole wide area network. Browser clients will then contact
1464 their local master browser, and will receive the domain-wide browse
1465 list, instead of just the list for their broadcast-isolated subnet.
1466 <p>Note that Windows NT Primary Domain Controllers expect to be able to
1467 claim this <a href="smb.conf.5.html#workgroup"><strong>workgroup</strong></a> specific special NetBIOS
1468 name that identifies them as domain master browsers for that
1469 <a href="smb.conf.5.html#workgroup"><strong>workgroup</strong></a> by default (i.e. there is no way to
1470 prevent a Windows NT PDC from attempting to do this). This means that
1472 special name for a <a href="smb.conf.5.html#workgroup"><strong>workgroup</strong></a> before a Windows NT
1473 PDC is able to do so then cross subnet browsing will behave strangely
1474 and may fail.
1480 under Linux) that are either not of interest to clients or are
1481 infinitely deep (recursive). This parameter allows you to specify a
1482 comma-delimited list of directories that the server should always show
1483 as empty.
1493 <p>Under the DOS and Windows FAT filesystem, the finest granularity on
1494 time resolution is two seconds. Setting this parameter for a share
1495 causes Samba to round the reported time down to the nearest two second
1496 boundary when a query call that requires one second resolution is made
1498 <p>This option is mainly used as a compatibility option for Visual C++
1499 when used against Samba shares. If oplocks are enabled on a share,
1500 Visual C++ uses two different time reading calls to check if a file
1501 has changed since it was last read. One of these calls uses a
1502 one-second granularity, the other uses a two second granularity. As
1503 the two second call rounds any odd second down, then if the file has a
1504 timestamp of an odd number of seconds then the two timestamps will not
1505 match and Visual C++ will keep reporting the file has changed. Setting
1506 this option causes the two timestamps to match, and Visual C++ is
1507 happy.
1514 <p>Under DOS and Windows, if a user can write to a file they can change
1515 the timestamp on it. Under POSIX semantics, only the owner of the file
1516 or root may change the timestamp. By default, Samba runs with POSIX
1517 semantics and refuses to change the timestamp on a file if the user
1518 smbd is acting on behalf of is not the file owner. Setting this option
1519 to True allows DOS semantics and smbd will change the file timestamp as
1520 DOS requires.
1527 <p>This boolean controls whether encrypted passwords will be negotiated
1528 with the client. Note that Windows NT 4.0 SP3 and above and also
1529 Windows 98 will by default expect encrypted passwords unless a
1530 registry entry is changed. To use encrypted passwords in Samba see the
1532 shipped with the source code.
1533 <p>In order for encrypted passwords to work correctly
1537 how to set up and maintain this file), or set the
1547 <p>NTFS and Windows VFAT file systems keep a create time for all files
1548 and directories. This is not the same as the ctime - status change
1549 time - that Unix keeps, so Samba by default reports the earliest of
1550 the various times Unix does keep. Setting this parameter for a share
1552 directories.
1553 <p>This option is mainly used as a compatibility option for Visual C++
1554 when used against Samba shares. Visual C++ generated makefiles have
1555 the object directory as a dependency for each object file, and a make
1556 rule to create the directory. Also, when NMAKE compares timestamps it
1557 uses the creation time when examining a directory. Thus the object
1558 directory will be created if it does not exist, but once it does exist
1559 it will always have an earlier timestamp than the object files it
1560 contains.
1561 <p>However, Unix time semantics mean that the create time reported by
1562 Samba will be updated whenever a file is created or deleted in the
1563 directory. NMAKE therefore finds all object files in the object
1564 directory bar the last one built are out of date compared to the
1565 directory and rebuilds them. Enabling this option ensures directories
1566 always predate their contents and an NMAKE build will proceed as
1567 expected.
1574 <p>Oplocks are the way that SMB clients get permission from a server to
1575 locally cache file operations. If a server grants an oplock
1576 (opportunistic lock) then the client is free to assume that it is the
1577 only one accessing the file and it will aggressively cache file
1578 data. With some oplock types the client may even cache file open/close
1579 operations. This can give enormous performance benefits.
1580 <p>When you set <code>"fake oplocks = yes"</code> <a href="smbd.8.html"><strong>smbd</strong></a> will
1581 always grant oplock requests no matter how many clients are using the
1582 file.
1583 <p>It is generally much better to use the real <a href="smb.conf.5.html#oplocks"><strong>oplocks</strong></a>
1584 support rather than this parameter.
1585 <p>If you enable this option on all read-only shares or shares that you
1586 know will only be accessed from one client at a time such as
1587 physically read-only media like CDROMs, you will see a big performance
1588 improvement on many operations. If you enable this option on shares
1589 where multiple clients may be accessing the files read-write at the
1590 same time you can get data corruption. Use this option carefully!
1591 <p>This option is disabled by default.
1594 <p>This parameter allows the Samba administrator to stop
1597 or directory that is a symbolic link from being followed (the user
1598 will get an error). This option is very useful to stop users from
1600 instance. However it will slow filename lookups down slightly.
1602 symbolic links) by default.
1605 <p>This parameter specifies a set of UNIX mode bit permissions that will
1607 'OR'ing these bits onto the mode bits of a file that is being created
1608 or having its permissions changed. The default for this parameter is
1609 (in octal) 000. The modes in this parameter are bitwise 'OR'ed onto
1612 <p>See also the parameter <a href="smb.conf.5.html#createmask"><strong>"create mask"</strong></a> for details
1613 on masking mode bits on files.
1614 <p>See also the <a href="smb.conf.5.html#inheritpermissions"><strong>"inherit permissions"</strong></a> parameter.
1619 <p>would force all created files to have read and execute permissions set
1620 for 'group' and 'other' as well as the read/write/execute bits set for
1621 the 'user'.
1624 <p>This parameter specifies a set of UNIX mode bit permissions that will
1626 bitwise 'OR'ing these bits onto the mode bits of a directory that is
1627 being created. The default for this parameter is (in octal) 0000 which
1628 will not add any extra permission bits to a created directory. This
1629 operation is done after the mode mask in the parameter
1631 <p>See also the parameter <a href="smb.conf.5.html#directorymask"><strong>"directory mask"</strong></a> for
1632 details on masking mode bits on created directories.
1633 <p>See also the <a href="smb.conf.5.html#inheritpermissions"><strong>"inherit permissions"</strong></a> parameter.
1638 <p>would force all created directories to have read and execute
1639 permissions set for 'group' and 'other' as well as the
1640 read/write/execute bits set for the 'user'.
1643 <p>This parameter controls what UNIX permission bits can be modified when
1644 a Windows NT client is manipulating the UNIX permission on a directory
1645 using the native NT security dialog box.
1646 <p>This parameter is applied as a mask (OR'ed with) to the changed
1647 permission bits, thus forcing any bits in this mask that the user may
1648 have modified to be on. Essentially, one bits in this mask may be
1649 treated as a set of bits that, when modifying security on a directory,
1650 the user has always set to be 'on'.
1651 <p>If not set explicitly this parameter is set to the same value as the
1652 <a href="smb.conf.5.html#forcedirectorymode"><strong>force directory mode</strong></a> parameter. To allow
1653 a user to modify all the user/group/world permissions on a directory,
1654 with restrictions set this parameter to 000.
1656 means can easily bypass this restriction, so it is primarily
1657 useful for standalone "appliance" systems. Administrators of
1658 most normal systems will probably want to set it to 0000.
1659 <p>See also the <a href="smb.conf.5.html#directorysecuritymask"><strong>directory security mask</strong></a>,
1660 <a href="smb.conf.5.html#securitymask"><strong>security mask</strong></a>, <a href="smb.conf.5.html#forcesecuritymode"><strong>force security
1661 mode</strong></a> parameters.
1668 <p>This specifies a UNIX group name that will be assigned as the default
1669 primary group for all users connecting to this service. This is useful
1670 for sharing files by ensuring that all access to files on service will
1671 use the named group for their permissions checking. Thus, by assigning
1672 permissions for this group to the files and directories within this
1673 service the Samba administrator can restrict or allow sharing of these
1674 files.
1676 way. If the group name listed here has a '+' character prepended to it
1677 then the current user accessing the share only has the primary group
1678 default assigned to this group if they are already assigned as a member
1679 of that group. This allows an administrator to decide that only users
1680 who are already in a particular group will create files with group
1681 ownership set to that group. This gives a finer granularity of ownership
1683 that only users who are already in group sys will have their default
1684 primary group assigned to sys when accessing this Samba share. All
1685 other users will retain their ordinary primary group.
1686 <p>If the <a href="smb.conf.5.html#forceuser"><strong>"force user"</strong></a> parameter is also set the
1696 <p>This parameter controls what UNIX permission bits can be modified when
1697 a Windows NT client is manipulating the UNIX permission on a file
1698 using the native NT security dialog box.
1699 <p>This parameter is applied as a mask (OR'ed with) to the changed
1700 permission bits, thus forcing any bits in this mask that the user may
1701 have modified to be on. Essentially, one bits in this mask may be
1702 treated as a set of bits that, when modifying security on a file, the
1703 user has always set to be 'on'.
1704 <p>If not set explicitly this parameter is set to the same value as the
1705 <a href="smb.conf.5.html#forcecreatemode"><strong>force create mode</strong></a> parameter. To allow
1706 a user to modify all the user/group/world permissions on a file,
1707 with no restrictions set this parameter to 000.
1709 means can easily bypass this restriction, so it is primarily
1710 useful for standalone "appliance" systems. Administrators of
1711 most normal systems will probably want to set it to 0000.
1712 <p>See also the <a href="smb.conf.5.html#forcedirectorysecuritymode"><strong>force directory security
1715 parameters.
1722 <p>This specifies a UNIX user name that will be assigned as the default
1723 user for all users connecting to this service. This is useful for
1724 sharing files. You should also use it carefully as using it
1725 incorrectly can cause security problems.
1726 <p>This user name only gets used once a connection is established. Thus
1727 clients still need to connect as a valid user and supply a valid
1728 password. Once connected, all file operations will be performed as the
1730 <p>This can be very useful.
1732 group of the forced user to be used as the primary group for all
1733 file activity. Prior to 2.0.5 the primary group was left as the
1734 primary group of the connecting user (this was a bug).
1742 <p>This parameter allows the administrator to configure the string that
1743 specifies the type of filesystem a share is using that is reported by
1746 Windows NT but this can be changed to other strings such as "Samba" or
1747 "FAT" if required.
1754 <p>This is a tuning option. When this is enabled a caching algorithm
1755 will be used to reduce the time taken for getwd() calls. This can have
1756 a significant impact on performance, especially when the
1767 <p>This is a username which will be used for access to services which are
1768 specified as <a href="smb.conf.5.html#guestok"><strong>'guest ok'</strong></a> (see below). Whatever
1769 privileges this user has will be available to any client connecting to
1770 the guest service. Typically this user will exist in the password
1772 often a good choice for this parameter. If a username is specified in
1773 a given service, the specified username overrides this one.
1775 print. Use another account in this case. You should test this by
1777 command) and trying to print using the system print command such as
1786 required to connect to the service. Privileges will be those of the
1788 <p>See the section below on <a href="smb.conf.5.html#security"><strong>security</strong></a> for more
1789 information about this option.
1797 connections to the service are permitted. This parameter will have no
1798 affect if <a href="smb.conf.5.html#guestok"><strong>"guest ok"</strong></a> or <a href="smb.conf.5.html#public"><strong>"public"</strong></a>
1799 is not set for the service.
1800 <p>See the section below on <a href="smb.conf.5.html#security"><strong>security</strong></a> for more
1801 information about this option.
1808 <p>This is a boolean parameter that controls whether files starting with
1809 a dot appear as hidden files.
1816 <p>This is a list of files or directories that are not visible but are
1817 accessible. The DOS 'hidden' attribute is applied to any files or
1818 directories that match.
1821 to specify multiple files or directories as in DOS wildcards.
1822 <p>Each entry must be a Unix path, not a DOS path and must not include the
1824 <p>Note that the case sensitivity option is applicable in hiding files.
1825 <p>Setting this parameter will affect the performance of Samba, as it
1826 will be forced to check all files and directories for a match as they
1827 are scanned.
1828 <p>See also <a href="smb.conf.5.html#hidedotfiles"><strong>"hide dot files"</strong></a>, <a href="smb.conf.5.html#vetofiles"><strong>"veto
1829 files"</strong></a> and <a href="smb.conf.5.html#casesensitive"><strong>"case sensitive"</strong></a>.
1831 <pre>
1833 No files or directories are hidden by this option (dot files are
1834 hidden by default because of the "hide dot files" option).
1836 </pre>
1840 <p>The above example is based on files that the Macintosh SMB client
1841 (DAVE) available from <a href="http://www.thursby.com"><strong>Thursby</strong></a> creates for
1842 internal use, and also still hides all files beginning with a dot.
1846 <a href="smbd.8.html"><strong>smbd</strong></a> is also acting as a Win95/98 <a href="smb.conf.5.html#domainlogons"><strong>logon
1847 server</strong></a> then this parameter specifies the NIS (or YP)
1848 map from which the server for the user's home directory should be
1849 extracted. At present, only the Sun auto.home map format is
1850 understood. The form of the map is:
1852 <p>and the program will extract the servername from before the first
1854 with different map formats and also Amd (another automounter) maps.
1855 <p>NB: A working NIS is required on the system for this option to work.
1856 <p>See also <a href="smb.conf.5.html#nishomedir"><strong>"nis homedir"</strong></a>, <a href="smb.conf.5.html#domainlogons"><strong>domain
1857 logons</strong></a>.
1864 <p>A synonym for this parameter is <a href="smb.conf.5.html#allowhosts"><strong>'allow hosts'</strong></a>
1865 <p>This parameter is a comma, space, or tab delimited set of hosts which
1866 are permitted to access a service.
1867 <p>If specified in the <a href="smb.conf.5.html#global"><strong>[global]</strong></a> section then it will
1868 apply to all services, regardless of whether the individual service
1869 has a different setting.
1870 <p>You can specify the hosts by name or IP number. For example, you could
1871 restrict access to only the hosts on a Class C subnet with something
1874 page may not be present on your system, so a brief description will
1875 be given here also.
1877 access unless specifically denied by a "hosts deny" option.
1878 <p>You can also specify hosts by network/netmask pairs and by netgroup
1880 be used to limit a wildcard list. The following examples may provide
1881 some help:
1889 deny access from one particular host
1892 <p>Note that access still requires suitable user-level passwords.
1894 host access to see if it does what you expect.
1901 <p>The opposite of <a href="smb.conf.5.html#hostsallow"><strong>'hosts allow'</strong></a> - hosts listed
1903 services have their own lists to override this one. Where the lists
1904 conflict, the <a href="smb.conf.5.html#hostsallow"><strong>'allow'</strong></a> list takes precedence.
1911 <p>If this global parameter is a non-null string, it specifies the name
1912 of a file to read for the names of hosts and users who will be allowed
1913 access without specifying a password.
1914 <p>This is not be confused with <a href="smb.conf.5.html#hostsallow"><strong>hosts allow</strong></a> which
1915 is about hosts access to services and is more useful for guest
1917 supply passwords to samba.
1919 because you are trusting the PC to supply the correct username. It is
1920 very easy to get a PC to supply a false username. I recommend that the
1922 doing, or perhaps on a home network where you trust your spouse and
1930 <p>This allows you to include one config file inside another. The file
1931 is included literally, as though typed in place.
1932 <p>It takes the standard substitutions, except <a href="smb.conf.5.html#percentu"><strong>%u</strong></a>,
1933 <a href="smb.conf.5.html#percentP"><strong>%P</strong></a> and <a href="smb.conf.5.html#percentS"><strong>%S</strong></a>.
1936 <p>The permissions on new files and directories are normally governed by
1941 but the boolean inherit permissions parameter overrides this.
1942 <p>New directories inherit the mode of the parent directory,
1943 including bits such as setgid.
1944 <p>New files inherit their read/write bits from the parent directory.
1945 Their execute bits continue to be determined by
1949 <p>Note that the setuid bit is *never* set via inheritance
1950 (the code explicitly prohibits this).
1951 <p>This can be particularly useful on large systems with many users,
1952 perhaps several thousand,
1954 <p>See also <a href="smb.conf.5.html#createmask"><strong>"create mask"</strong></a>, <a href="smb.conf.5.html#directorymask"><strong>"directory mask"</strong></a>,
1963 <p>This option allows you to override the default network interfaces list
1964 that Samba will use for browsing, name registration and other NBT
1965 traffic. By default Samba will query the kernel for the list of all
1966 active interfaces and use any interfaces except 127.0.0.1 that are
1967 broadcast capable.
1968 <p>The option takes a list of interface strings. Each string can be in
1969 any of the following forms:
1970 <p><dl>
1971 <li > a network interface name (such as eth0). This may include
1972 shell-like wildcards so eth* will match any interface starting
1973 with the substring "eth"
1974 <li > an IP address. In this case the netmask is determined
1975 from the list of interfaces obtained from the kernel
1976 <li > an IP/mask pair.
1977 <li > a broadcast/mask pair.
1978 </dl>
1980 class network) or a full netmask in dotted decmal form.
1982 address or a hostname which will be looked up via the OSes normal
1983 hostname resolution mechanisms.
1984 <p>For example, the following line:
1986 <p>would configure three network interfaces corresponding to the eth0
1988 the latter two interfaces would be set to 255.255.255.0.
1989 <p>See also <a href="smb.conf.5.html#bindinterfacesonly"><strong>"bind interfaces only"</strong></a>.
1992 <p>This is a list of users that should not be allowed to login to this
1994 improper setting does not breach your security.
1996 (if your system supports NIS), and then as a UNIX group if the name
1997 was not found in the NIS netgroup database.
2000 by looking in the NIS netgroup database (this requires NIS to be
2002 used at the start of the name in either order so the value
2005 netgroup database, followed by the UNIX group database (the same as
2007 <p>The current servicename is substituted for
2008 <a href="smb.conf.5.html#percentS"><strong>%S</strong></a>. This is useful in the <a href="smb.conf.5.html#homes"><strong>[homes]</strong></a>
2009 section.
2017 <p>The value of the parameter (an integer) represents the number of
2019 keepalive packets will be sent. Keepalive packets, if sent, allow the
2020 server to tell whether a client is still present and responding.
2021 <p>Keepalives should, in general, not be needed if the socket being used
2022 has the SO_KEEPALIVE attribute set on it (see <a href="smb.conf.5.html#socketoptions"><strong>"socket
2024 if you strike difficulties.
2031 <p>For UNIXs that support kernel based <a href="smb.conf.5.html#oplocks"><strong>oplocks</strong></a>
2032 (currently only IRIX but hopefully also Linux and FreeBSD soon) this
2033 parameter allows the use of them to be turned on or off.
2034 <p>Kernel oplocks support allows Samba <a href="smb.conf.5.html#oplocks"><strong>oplocks</strong></a> to be
2035 broken whenever a local UNIX process or NFS operation accesses a file
2037 data consistency between SMB/CIFS, NFS and local file access (and is a
2041 this parameter.
2042 <p>See also the <a href="smb.conf.5.html#oplocks"><strong>"oplocks"</strong></a> and <a href="smb.conf.5.html#level2oplocks"><strong>"level2 oplocks"</strong></a>
2043 parameters.
2047 password database stored on an LDAP server back-end. These options
2048 are only available if your version of Samba was configured with
2050 <p>This parameter specifies an LDAP search filter used to search for a
2051 user name in the LDAP database. It must contain the string
2052 <a href="smb.conf.5.html#percentU"><strong>%u</strong></a> which will be replaced with the user being
2053 searched for.
2059 password database stored on an LDAP server back-end. These options
2060 are only available if your version of Samba was configured with
2062 <p>This parameter specifies the TCP port number to use to contact
2063 the LDAP server on.
2069 password database stored on an LDAP server back-end. These options
2070 are only available if your version of Samba was configured with
2072 <p>This parameter specifies the entity to bind to the LDAP server
2073 as (essentially the LDAP username) in order to be able to perform
2074 queries and modifications on the LDAP database.
2081 password database stored on an LDAP server back-end. These options
2082 are only available if your version of Samba was configured with
2084 <p>This parameter specifies the password for the entity to bind to the
2085 LDAP server as (the password for this LDAP username) in order to be
2086 able to perform queries and modifications on the LDAP database.
2089 storage place is found.
2096 password database stored on an LDAP server back-end. These options
2097 are only available if your version of Samba was configured with
2099 <p>This parameter specifies the DNS name of the LDAP server to use
2100 for SMB/CIFS authentication purposes.
2106 password database stored on an LDAP server back-end. These options
2107 are only available if your version of Samba was configured with
2111 for an entry in the LDAP password database.
2117 level2 (read-only) oplocks on a share. In Samba 2.0.5 this parameter
2119 in a later release.
2120 <p>Level2, or read-only oplocks allow Windows NT clients that have an
2121 oplock on a file to downgrade from a read-write oplock to a read-only
2122 oplock once a second client opens the file (instead of releasing all
2123 oplocks on a second open, as in traditional, exclusive oplocks). This
2124 allows all openers of the file that support level2 oplocks to cache
2125 the file for read-ahead only (ie. they may not cache writes or lock
2126 requests) and increases performance for many acesses of files that
2127 are not commonly written (such as application .EXE files).
2128 <p>Once one of the clients which have a read-only oplock writes to
2129 the file all clients are notified (no reply is needed or waited
2130 for) and told to break their oplocks to "none" and delete any
2131 read-ahead caches.
2132 <p>It is recommended that this parameter be turned on to speed access
2133 to shared executables (and also to test the code :-).
2134 <p>For more discussions on level2 oplocks see the CIFS spec.
2135 <p>Currently, if <a href="smb.conf.5.html#kerneloplocks"><strong>"kernel oplocks"</strong></a> are supported
2136 then level2 oplocks are not granted (even if this parameter is set
2137 to <code>"true"</code>). Note also, the <a href="smb.conf.5.html#oplocks"><strong>"oplocks"</strong></a> parameter must
2138 be set to "true" on this share in order for this parameter to have any
2139 effect.
2140 <p>See also the <a href="smb.conf.5.html#oplocks"><strong>"oplocks"</strong></a> and <a href="smb.conf.5.html#kerneloplocks"><strong>"kernel oplocks"</strong></a> parameters.
2149 for them to see the Samba server in their browse list. This parameter
2153 announce broadcasts at a frequency set by the parameter <a href="smb.conf.5.html#lminterval"><strong>"lm
2155 announce broadcasts by default but will listen for them. If it hears
2156 such a broadcast on the wire it will then start sending them at a
2157 frequency set by the parameter <a href="smb.conf.5.html#lminterval"><strong>"lm interval"</strong></a>.
2165 <p>If Samba is set to produce Lanman announce broadcasts needed by
2166 <strong>OS/2</strong> clients (see the <a href="smb.conf.5.html#lmannounce"><strong>"lm announce"</strong></a>
2167 parameter) then this parameter defines the frequency in seconds with
2168 which they will be made. If this is set to zero then no Lanman
2169 announcements will be made despite the setting of the <a href="smb.conf.5.html#lmannounce"><strong>"lm
2178 <p>A boolean variable that controls whether all printers in the printcap
2179 will be loaded for browsing by default. See the
2188 local master browser on a subnet. If set to False then
2190 browser on a subnet and will also lose in all browsing elections. By
2191 default this value is set to true. Setting this value to true doesn't
2194 elections for local master browser.
2204 <p>This option specifies the directory where lock files will be placed.
2213 <p>This controls whether or not locking will be performed by the server
2214 in response to lock requests from the client.
2216 succeed and all lock queries will indicate that the queried lock is
2217 clear.
2220 not need locking (such as cdrom drives), although setting this
2222 <p>Be careful about disabling locking either globally or in a specific
2223 service, as lack of locking may result in data corruption. You should
2224 never need to set this parameter.
2231 <p>This options allows you to override the name of the Samba log file
2232 (also known as the debug file).
2233 <p>This option takes the standard substitutions, allowing you to have
2234 separate log files for each user or machine.
2242 <p>This parameter specifies the local path to which the home directory
2243 will be connected (see <a href="smb.conf.5.html#logonhome"><strong>"logon home"</strong></a>) and is only
2244 used by NT Workstations.
2245 <p>Note that this option is only useful if Samba is set up as a
2252 NT Workstation logs into a Samba PDC. It allows you to do
2254 <p>from a command prompt, for example.
2255 <p>This option takes the standard substitutions, allowing you to have
2256 separate logon scripts for each user or machine.
2257 <p>This parameter can be used with Win9X workstations to ensure that
2258 roaming profiles are stored in a subdirectory of the user's home
2259 directory. This is done in the following way:
2261 <p>This tells Samba to return the above string, with substitutions made
2262 when a client requests the info, generally in a NetUserGetInfo request.
2263 Win9X clients truncate the info to \\server\share when a user does <code>"net use /home"</code>,
2264 but use the whole string when dealing with profiles.
2265 <p>Note that in prior versions of Samba, the <code>"logon path"</code> was returned rather than
2266 <code>"logon home"</code>. This broke <code>"net use /home"</code> but allowed profiles outside the
2267 home directory. The current implementation is correct, and can be used for profiles
2268 if you use the above trick.
2269 <p>Note that this option is only useful if Samba is set up as a
2277 <p>This parameter specifies the home directory where roaming profiles
2278 (NTuser.dat etc files for Windows NT) are stored. Contrary to previous
2279 versions of these manual pages, it has nothing to do with Win 9X roaming
2280 profiles. To find out how to handle roaming profiles for Win 9X system, see
2282 <p>This option takes the standard substitutions, allowing you to have
2283 separate logon scripts for each user or machine. It also specifies
2284 the directory from which the <code>"application data"</code>, (<code>"desktop"</code>, <code>"start menu"</code>,
2286 contents, are loaded and displayed on your Windows NT client.
2287 <p>The share and the path must be readable by the user for the
2288 preferences and directories to be loaded onto the Windows NT
2289 client. The share must be writeable when the logs in for the first
2290 time, in order that the Windows NT client can create the NTuser.dat
2291 and other directories.
2292 <p>Thereafter, the directories and any of the contents can, if required, be
2293 made read-only. It is not advisable that the NTuser.dat file be made
2294 read-only - rename it to NTuser.man to achieve the desired effect (a
2296 <p>Windows clients can sometimes maintain a connection to the [homes]
2297 share, even though there is no user logged in. Therefore, it is vital
2298 that the logon path does not include a reference to the homes share
2300 problems).
2301 <p>This option takes the standard substitutions, allowing you to have
2302 separate logon scripts for each user or machine.
2303 <p>Note that this option is only useful if Samba is set up as a
2311 <p>This parameter specifies the batch file (.bat) or NT command file
2312 (.cmd) to be downloaded and run on a machine when a user successfully
2313 logs in. The file must contain the DOS style cr/lf line endings.
2314 Using a DOS-style editor to create the file is recommended.
2316 the <code>[netlogon]</code> service specifies a <a href="smb.conf.5.html#path"><strong>path</strong></a> of
2317 /usr/local/samba/netlogon, and logon script = STARTUP.BAT, then the
2318 file that will be downloaded is:
2320 <p>The contents of the batch file is entirely your choice. A suggested
2322 machine to synchronize clocks with the same time server. Another use
2325 <p>Note that it is particularly important not to allow write access to
2327 batch files in a secure environment, as this would allow the batch
2328 files to be arbitrarily modified and security to be breached.
2329 <p>This option takes the standard substitutions, allowing you to have
2330 separate logon scripts for each user or machine.
2331 <p>Note that this option is only useful if Samba is set up as a
2337 <p>This parameter specifies the command to be executed on the server host
2338 in order to stop printing or spooling a specific print job.
2339 <p>This command should be a program or script which takes a printer name
2340 and job number to pause the print job. One way of implementing this is
2341 by using job priorities, where jobs having a too low priority won't be
2342 sent to the printer.
2345 <a href="smb.conf.5.html#printing"><strong>printing=hpux</strong></a>), if the <code>"-p%p"</code> option is added
2346 to the lpq command, the job will show up with the correct status,
2347 i.e. if the job priority is lower than the set fence priority it will
2348 have the PAUSED status, whereas if the priority is equal or higher it
2349 will have the SPOOLED or PRINTING status.
2350 <p>Note that it is good practice to include the absolute path in the
2351 lppause command as the PATH may not be available to the server.
2354 Currently no default value is given to this string, unless the
2355 value of the <a href="smb.conf.5.html#printing"><strong>"printing"</strong></a> parameter is <code>SYSV</code>, in
2356 which case the default is :
2358 <p>or if the value of the <a href="smb.conf.5.html#printing"><strong>"printing"</strong></a> parameter is <code>softq</code>,
2359 then the default is:
2362 lppause command = /usr/bin/lpalt %p-%j -p0
2365 <p>This controls how long lpq info will be cached for to prevent the
2369 share cache information.
2374 less than 10 seconds old. A large value may be advisable if your
2384 <p>This parameter specifies the command to be executed on the server host
2386 <p>This command should be a program or script which takes a printer name
2387 as its only parameter and outputs printer status information.
2388 <p>Currently eight styles of printer status information are supported;
2389 BSD, AIX, LPRNG, PLP, SYSV, HPUX, QNX and SOFTQ. This covers most UNIX
2390 systems. You control which type is expected using the
2392 <p>Some clients (notably Windows for Workgroups) may not correctly send
2393 the connection number for the printer they are requesting status
2394 information about. To get around this, the server reports on the first
2395 printer service connected to by the client. This only happens if the
2396 connection number sent is invalid.
2398 it is placed at the end of the command.
2400 command</strong> as the PATH may not be available to the server.
2408 <p>This parameter specifies the command to be executed on the server host
2409 in order to restart or continue printing or spooling a specific print
2410 job.
2411 <p>This command should be a program or script which takes a printer name
2412 and job number to resume the print job. See also the <a href="smb.conf.5.html#lppausecommand"><strong>"lppause
2417 command</strong> as the PATH may not be available to the server.
2420 <p>Currently no default value is given to this string, unless the
2421 value of the <a href="smb.conf.5.html#printing"><strong>"printing"</strong></a> parameter is <code>SYSV</code>, in
2422 which case the default is :
2424 <p>or if the value of the <a href="smb.conf.5.html#printing"><strong>"printing"</strong></a> parameter is <code>softq</code>,
2425 then the default is:
2431 <p>This parameter specifies the command to be executed on the server host
2432 in order to delete a print job.
2433 <p>This command should be a program or script which takes a printer name
2434 and job number, and deletes the print job.
2437 <p>Note that it is good practice to include the absolute path in the
2448 <p>If a Samba server is a member of an Windows NT Domain (see the
2449 <a href="smb.conf.5.html#securityequaldomain"><strong>"security=domain"</strong></a>) parameter) then
2452 <code><Domain>.<Machine>.mac</code> where <code><Domain></code> is the name of the
2456 often this password will be changed, in seconds. The default is one
2457 week (expressed in seconds), the same as a Windows NT Domain member
2458 server.
2460 <a href="smb.conf.5.html#securityequaldomain"><strong>"security=domain"</strong></a>) parameter.
2465 <p>This parameter specifies the name of a file which will contain output
2470 is undefined.
2477 <p>This parameter specifies the name of a file which, if opened, will be
2478 executed by the server when the file is closed. This allows a UNIX
2479 script to be sent to the Samba host and executed on behalf of the
2480 connected user.
2481 <p>Scripts executed in this way will be deleted upon completion,
2482 permissions permitting.
2483 <p>If the script generates output, output will be sent to the file
2484 specified by the <a href="smb.conf.5.html#magicoutput"><strong>"magic output"</strong></a> parameter (see
2485 above).
2486 <p>Note that some shells are unable to interpret scripts containing
2487 carriage-return-linefeed instead of linefeed as the end-of-line
2489 which for some hosts and some shells will require filtering at the DOS
2490 end.
2498 <p>See the section on <a href="smb.conf.5.html#NAMEMANGLING"><strong>"NAME MANGLING"</strong></a>.
2502 removed in Samba 2.0.6 as Samba now dynamically configures such things
2503 on 32 bit systems.
2506 <p>This is for those who want to directly map UNIX file names which can
2507 not be represented on Windows/DOS. The mangling of names is not always
2508 what is needed. In particular you may have documents with file
2509 extensions that differ between DOS and UNIX. For example, under UNIX
2515 of filenames on some CDROMS (only visible under some UNIXs). To do
2516 this use a map of (*;1 *).
2523 <p>This controls whether non-DOS names under UNIX should be mapped to
2524 DOS-compatible names ("mangled") and made visible, or whether non-DOS
2525 names should simply be ignored.
2526 <p>See the section on <a href="smb.conf.5.html#NAMEMANGLING"><strong>"NAME MANGLING"</strong></a> for details
2527 on how to control the mangling process.
2528 <p>If mangling is used then the mangling algorithm is as follows:
2529 <p><dl>
2530 <p><li > The first (up to) five alphanumeric characters before the
2531 rightmost dot of the filename are preserved, forced to upper case, and
2532 appear as the first (up to) five characters of the mangled name.
2534 name, followed by a two-character unique sequence, based on the
2535 original root name (i.e., the original filename minus its final
2536 extension). The final extension is included in the hash calculation
2537 only if it contains any upper case characters or is longer than three
2538 characters.
2539 <p>Note that the character to use may be specified using the
2540 <a href="smb.conf.5.html#manglingchar"><strong>"mangling char"</strong></a> option, if you don't like
2542 <p><li > The first three alphanumeric characters of the final extension
2543 are preserved, forced to upper case and appear as the extension of the
2544 mangled name. The final extension is defined as that part of the
2545 original filename after the rightmost dot. If there are no dots in the
2546 filename, the mangled name will have no extension (except in the case
2548 <p><li > Files whose UNIX name begins with a dot will be presented as DOS
2549 hidden files. The mangled name will be created as for other filenames,
2551 of actual original extension (that's three underscores).
2552 <p></dl>
2553 <p>The two-digit hash value consists of upper case alphanumeric
2554 characters.
2555 <p>This algorithm can cause name collisions only if files in a directory
2556 share the same first five alphanumeric characters. The probability of
2558 <p>The name mangling (if enabled) allows a file to be copied between UNIX
2559 directories from Windows/DOS while retaining the long UNIX
2560 filename. UNIX files can be renamed to a new extension from
2561 Windows/DOS and will retain the same basename. Mangled names do not
2562 change between sessions.
2570 <a href="smb.conf.5.html#manglednames"><strong>name mangling</strong></a>. The default is a <code>'~'</code> but
2571 this may interfere with some software. Use this option to set it to
2572 whatever you prefer.
2579 <p>This parameter controls the number of mangled names that should be
2581 <p>This stack is a list of recently mangled base names (extensions are
2582 only maintained if they are longer than 3 characters or contains upper
2583 case characters).
2584 <p>The larger this value, the more likely it is that mangled names can be
2585 successfully converted to correct long UNIX names. However, large
2586 stack sizes will slow most directory access. Smaller stacks save
2587 memory in the server (each stack element costs 256 bytes).
2588 <p>It is not possible to absolutely guarantee correct long file names, so
2589 be prepared for some surprises!
2596 <p>This controls whether the DOS archive attribute should be mapped to
2597 the UNIX owner execute bit. The DOS archive bit is set when a file
2598 has been modified since its last backup. One motivation for this
2599 option it to keep Samba/your PC from making any file it touches from
2600 becoming executable under UNIX. This can be quite annoying for shared
2601 source code, documents, etc...
2602 <p>Note that this requires the <a href="smb.conf.5.html#createmask"><strong>"create mask"</strong></a>
2603 parameter to be set such that owner execute bit is not masked out
2604 (i.e. it must include 100). See the parameter <a href="smb.conf.5.html#createmask"><strong>"create
2612 <p>This controls whether DOS style hidden files should be mapped to the
2613 UNIX world execute bit.
2614 <p>Note that this requires the <a href="smb.conf.5.html#createmask"><strong>"create mask"</strong></a> to be
2615 set such that the world execute bit is not masked out (i.e. it must
2616 include 001). See the parameter <a href="smb.conf.5.html#createmask"><strong>"create mask"</strong></a>
2617 for details.
2624 <p>This controls whether DOS style system files should be mapped to the
2625 UNIX group execute bit.
2626 <p>Note that this requires the <a href="smb.conf.5.html#createmask"><strong>"create mask"</strong></a> to be
2627 set such that the group execute bit is not masked out (i.e. it must
2628 include 010). See the parameter <a href="smb.conf.5.html#createmask"><strong>"create mask"</strong></a>
2629 for details.
2636 <p>This parameter is only useful in <a href="smb.conf.5.html#security"><strong>security</strong></a> modes
2637 other than <a href="smb.conf.5.html#securityequalshare"><strong>"security=share"</strong></a> - i.e. user,
2638 server, and domain.
2639 <p>This parameter can take three different values, which tell
2641 don't match a valid UNIX user in some way.
2642 <p>The three settings are :
2643 <p><dl>
2645 are rejected. This is the default.
2647 rejected, unless the username does not exist, in which case it is
2648 treated as a guest login and mapped into the <a href="smb.conf.5.html#guestaccount"><strong>"guest
2651 password are treated as a guest login and mapped into the
2652 <a href="smb.conf.5.html#guestaccount"><strong>"guest account"</strong></a>. Note that this can
2653 cause problems as it means that any user incorrectly typing their
2655 will not know the reason they cannot access files they think
2656 they should - there will have been no message given to them
2657 that they got their password wrong. Helpdesk services will
2659 this way :-).
2660 <p></dl>
2662 services when using <a href="smb.conf.5.html#security"><strong>security</strong></a> modes other than
2663 share. This is because in these modes the name of the resource being
2665 successfully authenticated the client so the server cannot make
2666 authentication decisions at the correct time (connection to the
2668 <p>For people familiar with the older Samba releases, this parameter
2669 maps to the old compile-time setting of the GUEST_SESSSETUP value
2670 in local.h.
2677 <p>This option allows the number of simultaneous connections to a service
2679 connections will be refused if this number of connections to the
2680 service are already open. A value of zero mean an unlimited number of
2681 connections may be made.
2682 <p>Record lock files are used to implement this feature. The lock files
2683 will be stored in the directory specified by the <a href="smb.conf.5.html#lockdirectory"><strong>"lock
2691 <p>This option allows you to put an upper limit on the apparent size of
2692 disks. If you set this option to 100 then all shares will appear to be
2693 not larger than 100 MB in size.
2694 <p>Note that this option does not limit the amount of data you can put on
2695 the disk. In the above case you could still store much more than 100
2696 MB on the disk, but if a client ever asks for the amount of free disk
2697 space or the total disk size then the result will be bounded by the
2699 <p>This option is primarily useful to work around bugs in some pieces of
2700 software that can't handle very large disks, particularly disks over
2701 1GB in size.
2709 <p>This option (an integer in kilobytes) specifies the max size the log
2710 file should grow to. Samba periodically checks the size and if it is
2719 <p>This option controls the maximum number of outstanding simultaneous
2720 SMB operations that samba tells the client it will allow. You should
2721 never need to set this parameter.
2726 <p>This parameter limits the maximum number of open files that one
2728 a client at any one time. The default for this parameter is set
2730 <p>The limit of the number of open files is usually set by the
2731 UNIX per-process file descriptor limit rather than this parameter
2732 so you should never need to touch this parameter.
2741 to live' of NetBIOS names should be (in seconds) when
2743 broadcast packet or from a WINS server. You should never need to
2744 change this parameter. The default is 3 days.
2750 server <a href="smb.conf.5.html#winssupport"><strong>(wins support =true)</strong></a> what the maximum
2752 grant will be (in seconds). You should never need to change this
2754 <p>See also the <a href="smb.conf.5.html#minwinsttl"><strong>"min wins ttl"</strong></a> parameter.
2759 <p>This option controls the maximum packet size that will be negotiated
2760 by Samba. The default is 65535, which is the maximum. In some cases
2761 you may find you get better performance with a smaller value. A value
2762 below 2048 is likely to cause problems.
2769 <p>This specifies what command to run when the server receives a WinPopup
2770 style message.
2771 <p>This would normally be a command that would deliver the message
2772 somehow. How this is to be done is up to your imagination.
2773 <p>An example is:
2776 afterwards. <em>NOTE THAT IT IS VERY IMPORTANT THAT THIS COMMAND RETURN
2778 return immediately then your PCs may freeze when sending messages
2779 (they should recover after 30secs, hopefully).
2780 <p>All messages are delivered as the global guest user. The command takes
2781 the standard substitutions, although <a href="smb.conf.5.html#percentu"><strong>%u</strong></a> won't work
2783 <p>Apart from the standard substitutions, some additional ones apply. In
2784 particular:
2785 <p><dl>
2788 name).
2790 <p></dl>
2791 <p>You could make this command send mail, or whatever else takes your
2792 fancy. Please let us know of any really interesting ideas you have.
2793 <p>Here's a way of sending the messages as mail to root:
2795 <p>If you don't have a message command then the message won't be
2796 delivered and Samba will tell the sender there was an
2797 error. Unfortunately WfWg totally ignores the error code and carries
2798 on regardless, saying that the message was delivered.
2799 <p>If you want to silently delete it then try:
2807 <p>This sets the minimum amount of free disk space that must be available
2808 before a user will be able to spool a print job. It is specified in
2809 kilobytes. The default is 0, which means a user can always spool a print
2810 job.
2818 <p>Synonym for <a href="smb.conf.5.html#minpasswordlength"><strong>"min password length"</strong></a>.
2821 <p>This option sets the minimum length in characters of a plaintext password
2822 than smbd will accept when performing UNIX password changing.
2823 <p>See also <a href="smb.conf.5.html#unixpasswordsync"><strong>"unix password sync"</strong></a>,
2824 <a href="smb.conf.5.html#passwdprogram"><strong>"passwd program"</strong></a> and <a href="smb.conf.5.html#passwdchatdebug"><strong>"passwd chat
2831 server <a href="smb.conf.5.html#winssupport"><strong>(wins support = true)</strong></a> what the minimum
2833 grant will be (in seconds). You should never need to change this
2839 <p>This option is used by the programs in the Samba suite to determine
2840 what naming services and in what order to resolve host names to IP
2841 addresses. The option takes a space separated string of different name
2842 resolution options.
2844 names to be resolved as follows :
2845 <p><dl>
2847 If the line in lmhosts has no name type attached to the NetBIOS
2849 any name type matches for lookup.
2851 using the system /etc/hosts, NIS, or DNS lookups. This method of name
2852 resolution is operating system depended for instance on IRIX or
2854 Note that this method is only used if the NetBIOS name type being
2855 queried is the 0x20 (server) name type, otherwise it is ignored.
2857 <a href="smb.conf.5.html#winsserver"><strong>wins server</strong></a> parameter. If no WINS server has
2858 been specified this method will be ignored.
2860 listed in the <a href="smb.conf.5.html#interfaces"><strong>interfaces</strong></a> parameter. This is the
2861 least reliable of the name resolution methods as it depends on the
2862 target host being on a locally connected subnet.
2863 <p></dl>
2868 <p>This will cause the local lmhosts file to be examined first, followed
2869 by a broadcast attempt, followed by a normal system hostname lookup.
2873 advertise as additional names by which the Samba server is known. This
2874 allows one machine to appear in browse lists under multiple names. If
2875 a machine is acting as a <a href="smb.conf.5.html#localmaster"><strong>browse server</strong></a> or
2876 <a href="smb.conf.5.html#domainlogons"><strong>logon server</strong></a> none of these names will be
2877 advertised as either browse server or logon servers, only the primary
2878 name of the machine will be advertised with these capabilities.
2886 <p>This sets the NetBIOS name by which a Samba server is known. By
2887 default it is the same as the first component of the host's DNS name.
2889 <a href="smb.conf.5.html#domainlogons"><strong>logon server</strong></a> this name (or the first component
2890 of the hosts DNS name) will be the name that these services are
2891 advertised under.
2899 <p>This sets the NetBIOS scope that Samba will operate under. This should
2900 not be set unless every machine on your LAN also sets this value.
2903 <p>Get the home share server from a NIS map. For UNIX systems that use an
2904 automounter, the user's home directory will often be mounted on a
2905 workstation on demand from a remote server.
2906 <p>When the Samba logon server is not the actual home directory server,
2907 but is mounting the home directories via NFS then two network hops
2908 would be required to access the users home directory if the logon
2909 server told the client to use itself as the SMB server for home
2910 directories (one over SMB and one over NFS). This can be very
2911 slow.
2912 <p>This option allows Samba to return the home share as being on a
2913 different server to the logon server and as long as a Samba daemon is
2914 running on the home directory server, it will be mounted on the Samba
2915 client directly from the directory server. When Samba is returning the
2916 home share to the client, it will consult the NIS map specified in
2917 <a href="smb.conf.5.html#homedirmap"><strong>"homedir map"</strong></a> and return the server listed
2918 there.
2919 <p>Note that for this option to work there must be a working NIS
2920 system and the Samba server with this option must also be a
2929 will attempt to map UNIX permissions into Windows NT access control lists.
2937 will allow Windows NT clients to connect to the NT SMB specific
2939 alone.
2945 will negotiate NT specific SMB support with Windows NT
2946 clients. Although this is a developer debugging option and should be
2947 left alone, benchmarking has discovered that Windows NT clients give
2950 offers exactly the same SMB calls that versions prior to Samba2.0
2951 offered. This information may be of use if any users are having
2952 problems with NT SMB support.
2957 <p>Allow or disallow client access to accounts that have null passwords.
2965 <p>This parameter allows an administrator to turn off the byte range lock
2966 manipulation that is done within Samba to give compatibility for OLE
2967 applications. Windows OLE applications use byte range locking as a
2968 form of inter-process communication, by locking ranges of bytes around
2970 managers to crash or otherwise cause problems. Setting this parameter
2972 correctly.
2982 <p>This is a boolean option that controls whether connections with
2983 usernames not in the <a href="smb.conf.5.html#user"><strong>user=</strong></a> list will be allowed. By
2984 default this option is disabled so a client can supply a username to
2985 be used by the server.
2986 <p>Note that this also means Samba won't try to deduce usernames from the
2987 service name. This can be annoying for the <a href="smb.conf.5.html#homes"><strong>[homes]</strong></a>
2988 section. To get around this you could use "<a href="smb.conf.5.html#user"><strong>user</strong></a> =
2989 <a href="smb.conf.5.html#percentS"><strong>%S</strong></a>" which means your <a href="smb.conf.5.html#user"><strong>"user"</strong></a> list
2990 will be just the service name, which for home directories is the name
2991 of the user.
2999 <p>This boolean option tells smbd whether to issue oplocks (opportunistic
3000 locks) to file open requests on this share. The oplock code can
3001 dramatically (approx. 30% or more) improve the speed of access to files
3002 on Samba servers. It allows the clients to aggressively cache files
3003 locally and you may want to disable this option for unreliable network
3004 environments (it is turned on by default in Windows NT Servers). For
3005 more information see the file Speed.txt in the Samba docs/ directory.
3006 <p>Oplocks may be selectively turned off on certain files on a per share basis.
3007 See the 'veto oplock files' parameter. On some systems oplocks are recognized
3008 by the underlying operating system. This allows data synchronization between
3009 all access to oplocked files, whether it be via Samba or NFS or a local
3010 UNIX process. See the <a href="smb.conf.5.html#kerneloplocks"><strong>kernel oplocks</strong></a> parameter
3011 for details.
3012 <p>See also the <a href="smb.conf.5.html#kerneloplocks"><strong>"kernel oplocks"</strong></a> and
3021 If Samba responds to a client too quickly when that client issues an SMB that
3022 can cause an oplock break request, then the client redirector can fail and
3023 not respond to the break request. This tuning parameter (which is set in
3024 milliseconds) is the amount of time Samba will wait before sending an
3025 oplock break request to such (broken) clients.
3026 <p><em>DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA
3027 OPLOCK CODE</em>.
3032 <p>This is a <em>very</em> advanced <a href="smbd.8.html"><strong>smbd</strong></a> tuning option to improve
3033 the efficiency of the granting of oplocks under multiple client contention for the same file.
3034 <p>In brief it specifies a number, which causes smbd not to grant an oplock even
3035 when requested if the approximate number of clients contending for an oplock on
3036 the same file goes over this limit. This causes <a href="smbd.8.html"><strong>smbd</strong></a> to
3037 behave in a similar way to Windows NT.
3038 <p><em>DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA
3039 OPLOCK CODE</em>.
3044 <p>This integer value controls what level Samba advertises itself as for
3045 browse elections. The value of this parameter determines whether
3047 browser for the <a href="smb.conf.5.html#workgroup"><strong>WORKGROUP</strong></a> in the local broadcast
3049 lose elections to Windows machines. See BROWSING.txt in the Samba
3050 docs/ directory for details.
3057 <p>This is a deprecated parameter that has no effect on the current
3058 Samba code. It is left in the parameter list to prevent breaking
3062 <p>This is a Samba developer option that allows a system command to be
3065 attention to the fact that a problem occurred.
3072 program to change the users password. The string describes a sequence
3074 determine what to send to the <a href="smb.conf.5.html#passwdprogram"><strong>passwd</strong></a> program
3075 and what to expect back. If the expected output is not received then
3076 the password is not changed.
3077 <p>This chat sequence is often quite site specific, depending on what
3078 local methods are used for password control (such as NIS etc).
3080 substituted for the old and new passwords respectively. It can also
3081 contain the standard macros <code>"\n"</code>, <code>"\r"</code>, <code>"\t"</code> and <code>"\s"</code>
3082 to give line-feed, carriage-return, tab and space.
3084 characters.
3085 <p>Double quotes can be used to collect strings with spaces in them into
3086 a single string.
3087 <p>If the send string in any part of the chat sequence is a fullstop
3089 fullstop then no string is expected.
3090 <p>Note that if the <a href="smb.conf.5.html#unixpasswordsync"><strong>"unix password sync"</strong></a>
3092 when the SMB password in the smbpasswd file is being changed, without
3093 access to the old password cleartext. In this case the old password
3095 <p>See also <a href="smb.conf.5.html#unixpasswordsync"><strong>"unix password sync"</strong></a>,
3096 <a href="smb.conf.5.html#passwdprogram"><strong>"passwd program"</strong></a> and <a href="smb.conf.5.html#passwdchatdebug"><strong>"passwd chat
3099 <pre>
3100 passwd chat = "*Enter OLD password*" %o\n "*Enter NEW password*" %n\n "*Reenter NEW password*" %n\n "*Password changed*"
3102 </pre>
3105 <pre>
3106 passwd chat = *old*password* %o\n *new*password* %n\n *new*password* %n\n *changed*
3107 </pre>
3111 <p>This boolean specifies if the passwd chat script parameter is run in
3114 a <a href="smb.conf.5.html#debuglevel"><strong>"debug level"</strong></a> of 100. This is a dangerous
3115 option as it will allow plaintext passwords to be seen in the
3117 debug their <a href="smb.conf.5.html#passwdchat"><strong>"passwd chat"</strong></a> scripts when calling
3118 the <a href="smb.conf.5.html#passwdprogram"><strong>"passwd program"</strong></a> and should be turned off
3119 after this has been done. This parameter is off by default.
3120 <p>See also <a href="smb.conf.5.html#passwdchat"><strong>"passwd chat"</strong></a>, <a href="smb.conf.5.html#passwdprogram"><strong>"passwd
3128 <p>The name of a program that can be used to set UNIX user passwords.
3129 Any occurrences of <a href="smb.conf.5.html#percentu"><strong>%u</strong></a> will be replaced with the
3130 user name. The user name is checked for existence before calling the
3131 password changing program.
3133 passwords, such as a minimum length, or the inclusion of mixed case
3134 chars and digits. This can pose a problem as some clients (such as
3135 Windows for Workgroups) uppercase the password before sending it.
3136 <p><em>Note</em> that if the <a href="smb.conf.5.html#unixpasswordsync"><strong>"unix password sync"</strong></a>
3138 ROOT*</em> before the SMB password in the
3141 change the SMB password also (this is by design).
3142 <p>If the <a href="smb.conf.5.html#unixpasswordsync"><strong>"unix password sync"</strong></a> parameter is
3144 called, and must be examined for security implications. Note that by
3145 default <a href="smb.conf.5.html#unixpasswordsync"><strong>"unix password sync"</strong></a> is set to
3147 <p>See also <a href="smb.conf.5.html#unixpasswordsync"><strong>"unix password sync"</strong></a>.
3154 <p>Some client/server combinations have difficulty with mixed-case
3155 passwords. One offending client is Windows for Workgroups, which for
3156 some reason forces passwords to upper case when using the LANMAN1
3157 protocol, but leaves them alone when using COREPLUS!
3158 <p>This parameter defines the maximum number of characters that may be
3159 upper case in passwords.
3163 <p><code>"Fred"</code>, <code>"fred"</code>, <code>"fRed"</code>, <code>"frEd"</code>, <code>"freD"</code>
3165 also be tried:
3166 <p><code>"FRed"</code>, <code>"FrEd"</code>, <code>"FreD"</code>, <code>"fREd"</code>, <code>"fReD"</code>,
3168 <p>And so on.
3169 <p>The higher value this parameter is set to the more likely it is that a
3170 mixed case password will be matched against a single case
3171 password. However, you should be aware that use of this parameter
3172 reduces security and increases the time taken to process a new
3173 connection.
3174 <p>A value of zero will cause only two attempts to be made - the password
3175 as is and the password in all-lower case.
3182 <p>By specifying the name of another SMB server (such as a WinNT box)
3183 with this option, and using <a href="smb.conf.5.html#security"><strong>"security = domain"</strong></a> or
3184 <a href="smb.conf.5.html#security"><strong>"security = server"</strong></a> you can get Samba to do all
3185 its username/password validation via a remote server.
3186 <p>This options sets the name of the password server to use. It must be a
3187 NetBIOS name, so if the machine's NetBIOS name is different from its
3188 internet name then you may have to add its NetBIOS name to the lmhosts
3190 <p>The name of the password server is looked up using the parameter
3191 <a href="smb.conf.5.html#nameresolveorder"><strong>"name resolve order="</strong></a> and so may resolved
3192 by any method and order described in that parameter.
3194 or the "LM NT 0.12" protocol, and it must be in user level security
3195 mode.
3196 <p>NOTE: Using a password server means your UNIX box (running Samba) is
3197 only as secure as your password server. <em>DO NOT CHOOSE A PASSWORD
3198 SERVER THAT YOU DON'T COMPLETELY TRUST</em>.
3199 <p>Never point a Samba server at itself for password serving. This will
3200 cause a loop and could lock up your Samba server!
3201 <p>The name of the password server takes the standard substitutions, but
3202 probably the only useful one is <a href="smb.conf.5.html#percentm"><strong>%m</strong></a>, which means
3203 the Samba server will use the incoming client as the password
3204 server. If you use this then you better trust your clients, and you
3205 better restrict them with hosts allow!
3206 <p>If the <a href="smb.conf.5.html#security"><strong>"security"</strong></a> parameter is set to
3208 of Primary or Backup Domain controllers for the
3209 <a href="smb.conf.5.html#workgroup"><strong>Domain</strong></a> or the character <code>*</code>, as the Samba server is cryptographicly
3210 in that domain, and will use cryptographicly authenticated RPC calls
3211 to authenticate the user logging on. The advantage of using
3212 <a href="smb.conf.5.html#securityequaldomain"><strong>"security=domain"</strong></a> is that if you list
3215 that responds. This is useful in case your primary server goes down.
3217 then Samba will attempt to auto-locate the Primary or Backup Domain controllers
3219 and then contacting each server returned in the list of IP addresses
3220 from the <a href="smb.conf.5.html#nameresolveorder"><strong>name resolution</strong></a> source.
3221 <p>If the <a href="smb.conf.5.html#security"><strong>"security"</strong></a> parameter is set to
3222 <a href="smb.conf.5.html#securityequalserver"><strong>"server"</strong></a>, then there are different
3223 restrictions that <a href="smb.conf.5.html#securityequaldomain"><strong>"security=domain"</strong></a>
3224 doesn't suffer from:
3225 <p><dl>
3228 to a password server, and then the password server fails, no more
3229 users will be able to be authenticated from this
3231 protocol when in <a href="smb.conf.5.html#securityequalserver"><strong>"security=server"</strong></a> mode
3232 and cannot be fixed in Samba.
3233 <p><li > If you are using a Windows NT server as your password server then
3234 you will have to ensure that your users are able to login from the
3235 Samba server, as when in
3236 <a href="smb.conf.5.html#securityequalserver"><strong>"security=server"</strong></a> mode the network
3237 logon will appear to come from there rather than from the users
3238 workstation.
3239 <p></dl>
3249 <p>This parameter specifies a directory to which the user of the service
3250 is to be given access. In the case of printable services, this is
3251 where print data will spool prior to being submitted to the host for
3252 printing.
3253 <p>For a printable service offering guest access, the service should be
3254 readonly and the path should be world-writeable and have the sticky bit
3255 set. This is not mandatory of course, but you probably won't get the
3256 results you expect if you do otherwise.
3257 <p>Any occurrences of <a href="smb.conf.5.html#percentu"><strong>%u</strong></a> in the path will be replaced
3258 with the UNIX username that the client is using on this
3259 connection. Any occurrences of <a href="smb.conf.5.html#percentm"><strong>%m</strong></a> will be replaced
3260 by the NetBIOS name of the machine they are connecting from. These
3261 replacements are very useful for setting up pseudo home directories
3262 for users.
3263 <p>Note that this path will be based on <a href="smb.conf.5.html#rootdir"><strong>"root dir"</strong></a> if
3264 one was specified.
3271 <p>This option specifies a command to be run whenever the service is
3272 disconnected. It takes the usual substitutions. The command may be run
3273 as the root on some systems.
3274 <p>An interesting example may be do unmount server resources:
3283 <p>This parameter forces a printer to interpret the print files as
3285 <p>This is most useful when you have lots of PCs that persist in putting
3286 a control-D at the start of print jobs, which then confuses your
3287 printer.
3294 <p>This option specifies a command to be run whenever the service is
3295 connected to. It takes the usual substitutions.
3296 <p>An interesting example is to send the users a welcome message every
3297 time they log in. Maybe a message of the day? Here is an example:
3298 <p><pre>
3302 </pre>
3304 <p>Of course, this could get annoying after a while :-)
3305 <p>See also <a href="smb.conf.5.html#preexecclose"><strong>preexec close</strong></a> and <a href="smb.conf.5.html#postexec"><strong>postexec</strong></a>.
3312 <p>This boolean option controls whether a non-zero return code from
3313 <a href="smb.conf.5.html#preexec"><strong>"preexec"</strong></a> should close the service being connected to.
3321 preferred master browser for its workgroup.
3323 force an election, and it will have a slight advantage in winning the
3324 election. It is recommended that this parameter is used in
3325 conjunction with <a href="smb.conf.5.html#domainmaster"><strong>"domain master = yes"</strong></a>, so
3327 master.
3328 <p>Use this option with caution, because if there are several hosts
3329 (whether Samba servers, Windows 95 or NT) that are preferred master
3330 browsers on the same subnet, they will each periodically and
3331 continuously attempt to become the local master browser. This will
3332 result in unnecessary broadcast traffic and reduced browsing
3333 capabilities.
3341 <p>Synonym for <a href="smb.conf.5.html#preferredmaster"><strong>"preferred master"</strong></a> for people
3342 who cannot spell :-).
3348 <p>This controls if new filenames are created with the case that the
3352 <p>See the section on <a href="smb.conf.5.html#NAMEMANGLING"><strong>"NAME MANGLING"</strong></a> for a
3353 fuller discussion.
3356 <p>After a print job has finished spooling to a service, this command
3358 file. Typically the command specified will submit the spool file to
3359 the host's printing subsystem, but there is no requirement that this
3360 be the case. The server will not remove the spool file, so whatever
3361 command you specify should remove the spool file when it has been
3362 processed, otherwise you will need to manually remove old spool files.
3363 <p>The print command is simply a text string. It will be used verbatim,
3365 replaced by the appropriate spool file name, and all occurrences of
3367 file name is generated automatically by the server, the printer name
3368 is discussed below.
3372 silently removed from the printer command.
3373 <p>If specified in the <a href="smb.conf.5.html#global"><strong>"[global]"</strong></a> section, the print
3374 command given will be used for any printable service that does not
3375 have its own print command specified.
3376 <p>If there is neither a specified print command for a printable service
3377 nor a global print command, spool files will be created but not
3378 processed and (most importantly) not removed.
3380 account. If this happens then create an alternative guest account that
3381 can print and set the <a href="smb.conf.5.html#guestaccount"><strong>"guest account"</strong></a> in the
3383 <p>You can form quite complex print commands by realizing that they are
3384 just passed to a shell. For example the following will log a print
3386 separator for command in shell scripts.
3388 <p>You may have to vary this command considerably depending on how you
3389 normally print files on your system. The default for the parameter
3390 varies depending on the setting of the <a href="smb.conf.5.html#printing"><strong>"printing="</strong></a>
3391 parameter.
3393 For <a href="smb.conf.5.html#printing"><strong>"printing="</strong></a> BSD, AIX, QNX, LPRNG or PLP :
3407 submit spool files on the directory specified for the service.
3408 <p>Note that a printable service will ALWAYS allow writing to the service
3409 path (user privileges permitting) via the spooling of print data. The
3410 <a href="smb.conf.5.html#writeable"><strong>"writeable"</strong></a> parameter controls only non-printing
3411 access to the resource.
3421 <p>This parameter may be used to override the compiled-in default
3422 printcap name used by the server (usually /etc/printcap). See the
3423 discussion of the <a href="smb.conf.5.html#printers"><strong>[printers]</strong></a> section above for
3424 reasons why you might want to do this.
3427 available printers. This is the default for systems that define SYSV
3428 at configure time in Samba (this includes most System V based
3429 systems). If <strong>"printcap name"</strong> is set to <strong>lpstat</strong> on these systems
3431 to obtain a printer list.
3432 <p>A minimal printcap file would look something like this:
3433 <p><pre>
3435 print1|My Printer 1
3436 print2|My Printer 2
3437 print3|My Printer 3
3438 print4|My Printer 4
3439 print5|My Printer 5
3441 </pre>
3444 second alias has a space in it gives a hint to Samba that it's a
3445 comment.
3455 <p>This parameter specifies the name of the printer to which print jobs
3456 spooled through a printable service will be sent.
3457 <p>If specified in the <a href="smb.conf.5.html#global"><strong>[global]</strong></a> section, the printer
3458 name given will be used for any printable service that does not have
3459 its own printer name specified.
3463 printer name = laserwriter
3466 <p>This option allows you to control the string that clients receive when
3467 they ask the server for the printer driver associated with a
3468 printer. If you are using Windows95 or WindowsNT then you can use this
3469 to automate the setup of printers on your system.
3470 <p>You need to set this parameter to the exact string (case sensitive)
3471 that describes the appropriate printer driver for your system. If you
3472 don't know the exact string to use then you should first try with no
3474 printer drivers. The appropriate strings are shown in a scrollbox
3475 after you have chosen the printer manufacturer.
3476 <p>See also <a href="smb.conf.5.html#printerdriverfile"><strong>"printer driver file"</strong></a>.
3478 printer driver = HP LaserJet 4L
3481 <p>This parameter tells Samba where the printer driver definition file,
3482 used when serving drivers to Windows 95 clients, is to be found. If
3483 this is not set, the default is :
3486 the Windows 95 client system. For more details on setting up serving
3487 of printer drivers to Windows 95 clients, see the documentation file
3488 in the docs/ directory, PRINTER_DRIVER.txt.
3493 <p>See also <a href="smb.conf.5.html#printerdriverlocation"><strong>"printer driver location"</strong></a>.
3496 <p>This parameter tells clients of a particular printer share where to
3497 find the printer driver files for the automatic installation of
3498 drivers for Windows 95 machines. If Samba is set up to serve printer
3499 drivers to Windows 95 machines, this should be set to
3501 <p>Where MACHINE is the NetBIOS name of your Samba server, and PRINTER$
3502 is a share you set up for serving printer driver files. For more
3503 details on setting this up see the documentation file in the docs/
3504 directory, PRINTER_DRIVER.txt.
3509 <p>See also <a href="smb.conf.5.html#printerdriverfile"><strong>"printer driver file"</strong></a>.
3515 <p>This parameters controls how printer status information is interpreted
3516 on your system. It also affects the default values for the
3517 <a href="smb.conf.5.html#printcommand"><strong>"print command"</strong></a>, <a href="smb.conf.5.html#lpqcommand"><strong>"lpq
3518 command"</strong></a> <a href="smb.conf.5.html#lppausecommand"><strong>"lppause command"</strong></a>,
3519 <a href="smb.conf.5.html#lpresumecommand"><strong>"lpresume command"</strong></a>, and <a href="smb.conf.5.html#lprmcommand"><strong>"lprm
3520 command"</strong></a> if specified in the <a href="smb.conf.5.html#global"><strong>[global]</strong></a>
3521 section.
3522 <p>Currently eight printing styles are supported. They are
3524 <strong>"printing=LPRNG"</strong>, <strong>"printing=PLP"</strong>, <strong>"printing=SYSV"</strong>,
3525 <strong>"printing="HPUX"</strong>, <strong>"printing=QNX"</strong>, <strong>"printing=SOFTQ"</strong>,
3527 <p>To see what the defaults are for the other print commands when using
3529 <p>This option can be set on a per printer basis
3530 <p>See also the discussion in the <a href="smb.conf.5.html#printers"><strong>[printers]</strong></a> section.
3532 <p></p><dt><strong><strong>protocol (G)</strong></strong><dd>
3533 <p>The value of the parameter (a string) is the highest protocol level
3534 that will be supported by the server.
3535 <p>Possible values are :
3536 <p><dl>
3537 <p><li > CORE: Earliest version. No concept of user names.
3538 <p><li > COREPLUS: Slight improvements on CORE for efficiency.
3540 filename support.
3541 <p><li > LANMAN2: Updates to Lanman1 protocol.
3542 <p><li > NT1: Current up to date version of the protocol. Used by Windows
3543 NT. Known as CIFS.
3544 <p></dl>
3545 <p>Normally this option should not be set as the automatic negotiation
3546 phase in the SMB protocol takes care of choosing the appropriate
3547 protocol.
3548 <p><strong>Default:</strong>
3549 <code> protocol = NT1</code>
3550 <p><strong>Example:</strong>
3551 <code> protocol = LANMAN1</code>
3553 <p></p><dt><strong><strong>public (S)</strong></strong><dd>
3556 <p></p><dt><strong><strong>queuepause command (S)</strong></strong><dd>
3557 <p>This parameter specifies the command to be executed on the server host
3558 in order to pause the printerqueue.
3559 <p>This command should be a program or script which takes a printer name
3560 as its only parameter and stops the printerqueue, such that no longer
3561 jobs are submitted to the printer.
3562 <p>This command is not supported by Windows for Workgroups, but can be
3563 issued from the Printer's window under Windows 95 & NT.
3565 place. Otherwise it is placed at the end of the command.
3566 <p>Note that it is good practice to include the absolute path in the
3567 command as the PATH may not be available to the server.
3568 <p><strong>Default:</strong>
3570 <p><strong>Example:</strong>
3571 <code> queuepause command = disable %p</code>
3573 <p></p><dt><strong><strong>queueresume command (S)</strong></strong><dd>
3574 <p>This parameter specifies the command to be executed on the server host
3575 in order to resume the printerqueue. It is the command to undo the
3576 behavior that is caused by the previous parameter
3578 <p>This command should be a program or script which takes a printer name
3579 as its only parameter and resumes the printerqueue, such that queued
3580 jobs are resubmitted to the printer.
3581 <p>This command is not supported by Windows for Workgroups, but can be
3584 place. Otherwise it is placed at the end of the command.
3585 <p>Note that it is good practice to include the absolute path in the
3586 command as the PATH may not be available to the server.
3594 will support the "Read Block Multiplex" SMB. This is now rarely used
3595 and defaults to off. You should never need to set this parameter.
3597 read bmpx = No
3600 <p>This is a list of users that are given read-only access to a
3601 service. If the connecting user is in this list then they will not be
3602 given write access, no matter what the <a href="smb.conf.5.html#writeable"><strong>"writeable"</strong></a>
3603 option is set to. The list can include group names using the syntax
3604 described in the <a href="smb.conf.5.html#invalidusers"><strong>"invalid users"</strong></a> parameter.
3605 <p>See also the <a href="smb.conf.5.html#writelist"><strong>"write list"</strong></a> parameter and
3613 <p>Note that this is an inverted synonym for
3618 may be removed at a later date. Hence this parameter has
3619 no effect.
3620 <p>This options enables or disables the read prediction code used to
3621 speed up reads from the server. When enabled the server will try to
3622 pre-read data from the last accessed file that was opened read-only
3623 while waiting for packets.
3628 <p>This parameter controls whether or not the server will support the raw
3629 read SMB requests when transferring data to clients.
3631 typically provides a major performance benefit.
3632 <p>However, some clients either negotiate the allowable block size
3633 incorrectly or are incapable of supporting larger block sizes, and for
3634 these clients you may need to disable raw reads.
3635 <p>In general this parameter should be viewed as a system tuning tool and left
3642 with network reads/writes. If the amount of data being transferred in
3643 several of the SMB commands (currently SMBwrite, SMBwriteX and
3644 SMBreadbraw) is larger than this value then the server begins writing
3645 the data before it has received the whole packet from the network, or
3646 in the case of SMBreadbraw, it begins writing to the network before
3647 all the data has been read from disk.
3648 <p>This overlapping works best when the speeds of disk and network access
3649 are similar, having very little effect when the speed of one is much
3650 greater than the other.
3652 done yet to determine the optimal value, and it is likely that the
3653 best value will vary greatly between systems anyway. A value over
3654 65536 is pointless and will cause you to allocate memory
3655 unnecessarily.
3663 periodically announce itself to arbitrary IP addresses with an
3664 arbitrary workgroup name.
3665 <p>This is useful if you want your Samba server to appear in a remote
3666 workgroup for which the normal browse propagation rules don't
3667 work. The remote workgroup can be anywhere that you can send IP
3668 packets to.
3669 <p>For example:
3671 <p>the above line would cause nmbd to announce itself to the two given IP
3672 addresses using the given workgroup names. If you leave out the
3673 workgroup name then the one given in the
3674 <a href="smb.conf.5.html#workgroup"><strong>"workgroup"</strong></a> parameter is used instead.
3675 <p>The IP addresses you choose would normally be the broadcast addresses
3676 of the remote networks, but can also be the IP addresses of known
3677 browse masters if your network config is that stable.
3678 <p>See the documentation file BROWSING.txt in the docs/ directory.
3686 periodically request synchronization of browse lists with the master
3687 browser of a samba server that is on a remote segment. This option
3688 will allow you to gain browse lists for multiple workgroups across
3689 routed networks. This is done in a manner that does not work with any
3690 non-samba servers.
3691 <p>This is useful if you want your Samba server and all local clients to
3692 appear in a remote workgroup for which the normal browse propagation
3693 rules don't work. The remote workgroup can be anywhere that you can
3694 send IP packets to.
3695 <p>For example:
3698 master browser on the specified subnets or addresses to synchronize
3699 their browse lists with the local server.
3700 <p>The IP addresses you choose would normally be the broadcast addresses
3701 of the remote networks, but can also be the IP addresses of known
3702 browse masters if your network config is that stable. If a machine IP
3703 address is given Samba makes NO attempt to validate that the remote
3704 machine is available, is listening, nor that it is in fact the browse
3705 master on it's segment.
3712 <p>This is a boolean parameter. If it is true, then anonymous access
3713 to the server will be restricted, namely in the case where the server
3714 is expecting the client to send a username, but it doesn't. Setting
3715 it to true will force these anonymous connections to be denied, and
3716 the client will be required to always supply a username and password
3717 when connecting. Use of this parameter is only recommened for homogenous
3718 NT client environments.
3719 <p>This parameter makes the use of macro expansions that rely
3720 on the username (%U, %G, etc) consistant. NT 4.0 likes to use
3721 anonymous connections when refreshing the share list, and this
3722 is a way to work around that.
3723 <p>When restrict anonymous is true, all anonymous connections are denied
3724 no matter what they are for. This can effect the ability of a machine
3725 to access the samba Primary Domain Controller to revalidate it's machine
3726 account after someone else has logged on the client interactively. The
3727 NT client will display a message saying that the machine's account in
3728 the domain doesn't exist or the password is bad. The best way to deal
3729 with this is to reboot NT client machines between interactive logons,
3731 as a different user".
3738 <p>Note that this option only works with
3739 <a href="smb.conf.5.html#securityequalshare"><strong>"security=share"</strong></a> and will be ignored if
3740 this is not the case.
3741 <p>This option controls whether Samba will allow a previously validated
3742 username/password pair to be used to attach to a share. Thus if you
3744 automatically allow the client to request connection to the second
3745 share as the same username as the first without a password.
3747 automatic access as the same username.
3761 this directory on startup. This is not strictly necessary for secure
3762 operation. Even without it the server will deny access to files not in
3763 one of the service entries. It may also check for, and deny access to,
3764 soft links to other parts of the filesystem, or attempts to use
3766 setting of the <a href="smb.conf.5.html#widelinks"><strong>"wide links"</strong></a> parameter).
3768 level of security, but at a price. It absolutely ensures that no
3771 operation of the server. To maintain full operability of the server
3774 (or a subset of it), and any binaries or configuration files needed
3775 for printing (if required). The set of files that must be mirrored is
3776 operating system dependent.
3783 <p>This is the same as the <a href="smb.conf.5.html#postexec"><strong>"postexec"</strong></a> parameter
3784 except that the command is run as root. This is useful for unmounting
3785 filesystems (such as cdroms) after a connection is closed.
3789 <p>This is the same as the <a href="smb.conf.5.html#preexec"><strong>"preexec"</strong></a> parameter except
3790 that the command is run as root. This is useful for mounting
3791 filesystems (such as cdroms) before a connection is finalized.
3796 <p>This is the same as the <a href="smb.conf.5.html#preexecclose"><strong>"preexec close"</strong></a> parameter
3797 except that the command is run as root.
3798 <p>See also <a href="smb.conf.5.html#preexec"><strong>"preexec"</strong></a>, <a href="smb.conf.5.html#preexecclose"><strong>"preexec close"</strong></a>.
3801 <p>This option affects how clients respond to Samba and is one of the most
3805 security on or off. Clients decide based on this bit whether (and how)
3806 to transfer user and password information to the server.
3808 the most common setting needed when talking to Windows 98 and Windows
3809 NT.
3810 <p>The alternatives are <a href="smb.conf.5.html#securityequalshare"><strong>"security = share"</strong></a>,
3813 <p><em>*****NOTE THAT THIS DEFAULT IS DIFFERENT IN SAMBA2.0 THAN FOR
3814 PREVIOUS VERSIONS OF SAMBA *******</em>.
3815 <p>In previous versions of Samba the default was
3816 <a href="smb.conf.5.html#securityequalshare"><strong>"security=share"</strong></a> mainly because that was
3817 the only option at one stage.
3818 <p>There is a bug in WfWg that has relevance to this setting. When in
3819 user or server level security a WfWg client will totally ignore the
3820 password you type in the "connect drive" dialog box. This makes it
3821 very difficult (if not impossible) to connect to a Samba service as
3822 anyone except the user that you are logged into WfWg as.
3823 <p>If your PCs use usernames that are the same as their usernames on the
3825 mostly use usernames that don't exist on the UNIX box then use
3827 <p>You should also use <a href="smb.conf.5.html#securityequalshare"><strong>security=share</strong></a> if
3828 you want to mainly setup shares without a password (guest
3829 shares). This is commonly used for a shared printer server. It is more
3830 difficult to setup guest shares with
3831 <a href="smb.conf.5.html#securityequaluser"><strong>security=user</strong></a>, see the <a href="smb.conf.5.html#maptoguest"><strong>"map to
3835 different <a href="smb.conf.5.html#netbiosaliases"><strong>NetBIOS aliases</strong></a>. See the
3837 <a href="smb.conf.5.html#include"><strong>include</strong></a> parameters for more information.
3838 <p>The different settings will now be explained.
3839 <p><dl>
3841 <p></p><dt><strong><strong>"security=share"</strong></strong><dd> When clients connect to a share level
3842 security server then need not log onto the server with a valid
3843 username and password before attempting to connect to a shared
3845 will send a logon request with a username but no password when talking
3847 authentication information (passwords) on a per-share basis, at the
3848 time they attempt to connect to that share.
3849 <p>Note that <a href="smbd.8.html"><strong>smbd</strong></a> <em>*ALWAYS*</em> uses a valid UNIX
3851 level security.
3852 <p>As clients are not required to send a username to the server
3854 techniques to determine the correct UNIX user to use on behalf
3855 of the client.
3856 <p>A list of possible UNIX usernames to match with the given
3857 client password is constructed using the following methods :
3858 <p><dl>
3859 <p><li > If the <a href="smb.conf.5.html#guestonly"><strong>"guest only"</strong></a> parameter is set, then
3860 all the other stages are missed and only the <a href="smb.conf.5.html#guestaccount"><strong>"guest
3862 <p><li > Is a username is sent with the share connection request, then
3866 SessionSetup SMB call) then the username sent in this SMB
3867 will be added as a potential username.
3868 <p><li > The name of the service the client requested is added
3869 as a potential username.
3870 <p><li > The NetBIOS name of the client is added to the list as a
3871 potential username.
3872 <p><li > Any users on the <a href="smb.conf.5.html#user"><strong>"user"</strong></a> list are added
3873 as potential usernames.
3874 <p></dl>
3875 <p>If the <a href="smb.conf.5.html#guestonly"><strong>"guest only"</strong></a> parameter is not set, then
3876 this list is then tried with the supplied password. The first user for
3877 whom the password matches will be used as the UNIX user.
3878 <p>If the <a href="smb.conf.5.html#guestonly"><strong>"guest only"</strong></a> parameter is set, or no
3879 username can be determined then if the share is marked as available to
3880 the <a href="smb.conf.5.html#guestaccount"><strong>"guest account"</strong></a>, then this guest user will
3881 be used, otherwise access is denied.
3883 which UNIX username will eventually be used in granting access.
3884 <p>See also the section <a href="smb.conf.5.html#NOTEABOUTUSERNAMEPASSWORDVALIDATION"><strong>"NOTE ABOUT USERNAME/PASSWORD
3888 <p>This is the default security setting in Samba2.0. With user-level
3890 password (which can be mapped using the <a href="smb.conf.5.html#usernamemap"><strong>"username
3892 <a href="smb.conf.5.html#encryptpasswords"><strong>"encrypted passwords"</strong></a> parameter) can also
3893 be used in this security mode. Parameters such as
3894 <a href="smb.conf.5.html#user"><strong>"user"</strong></a> and <a href="smb.conf.5.html#guestonly"><strong>"guest only"</strong></a>, if set
3895 are then applied and may change the UNIX user to use on this
3896 connection, but only after the user has been successfully
3897 authenticated.
3900 authenticated the client. This is why guest shares don't work in user
3901 level security without allowing the server to automatically map unknown
3902 users into the <a href="smb.conf.5.html#guestaccount"><strong>"guest account"</strong></a>. See the
3903 <a href="smb.conf.5.html#maptoguest"><strong>"map to guest"</strong></a> parameter for details on
3904 doing this.
3905 <p>See also the section <a href="smb.conf.5.html#NOTEABOUTUSERNAMEPASSWORDVALIDATION"><strong>"NOTE ABOUT USERNAME/PASSWORD
3909 <p>In this mode Samba will try to validate the username/password by
3910 passing it to another SMB server, such as an NT box. If this fails it
3912 passwords have been negotiated then Samba cannot revert back to
3913 checking the UNIX password file, it must have a valid smbpasswd file
3914 to check users against. See the documentation file in the docs/
3915 directory ENCRYPTION.txt for details on how to set this up.
3917 the same as <a href="smb.conf.5.html#securityequaluser"><strong>"security=user"</strong></a>. It only
3918 affects how the server deals with the authentication, it does not in
3919 any way affect what the client sees.
3922 authenticated the client. This is why guest shares don't work in server
3923 level security without allowing the server to automatically map unknown
3924 users into the <a href="smb.conf.5.html#guestaccount"><strong>"guest account"</strong></a>. See the
3925 <a href="smb.conf.5.html#maptoguest"><strong>"map to guest"</strong></a> parameter for details on
3926 doing this.
3927 <p>See also the section <a href="smb.conf.5.html#NOTEABOUTUSERNAMEPASSWORDVALIDATION"><strong>"NOTE ABOUT USERNAME/PASSWORD
3929 <p>See also the <a href="smb.conf.5.html#passwordserver"><strong>"password server"</strong></a> parameter.
3930 and the <a href="smb.conf.5.html#encryptpasswords"><strong>"encrypted passwords"</strong></a> parameter.
3933 <p>This mode will only work correctly if
3935 into a Windows NT Domain. It expects the <a href="smb.conf.5.html#encryptpasswords"><strong>"encrypted
3937 this mode Samba will try to validate the username/password by passing
3938 it to a Windows NT Primary or Backup Domain Controller, in exactly the
3939 same way that a Windows NT Server would do.
3941 account on the Domain Controller to allow Samba to have a valid
3942 UNIX account to map file access to.
3944 the same as <a href="smb.conf.5.html#securityequaluser"><strong>"security=user"</strong></a>. It only
3945 affects how the server deals with the authentication, it does not in
3946 any way affect what the client sees.
3949 authenticated the client. This is why guest shares don't work in domain
3950 level security without allowing the server to automatically map unknown
3951 users into the <a href="smb.conf.5.html#guestaccount"><strong>"guest account"</strong></a>. See the
3952 <a href="smb.conf.5.html#maptoguest"><strong>"map to guest"</strong></a> parameter for details on
3953 doing this.
3956 set usernames. The communication with a Domain Controller
3957 must be done in UNICODE and Samba currently does not widen
3958 multi-byte user names to UNICODE correctly, thus a multi-byte
3959 username will not be recognized correctly at the Domain Controller.
3960 This issue will be addressed in a future release.
3961 <p>See also the section <a href="smb.conf.5.html#NOTEABOUTUSERNAMEPASSWORDVALIDATION"><strong>"NOTE ABOUT USERNAME/PASSWORD
3962 VALIDATION"</strong></a>.
3963 <p>See also the <a href="smb.conf.5.html#passwordserver"><strong>"password server"</strong></a> parameter.
3964 and the <a href="smb.conf.5.html#encryptpasswords"><strong>"encrypted passwords"</strong></a> parameter.
3965 <p></dl>
3966 <p><strong>Default:</strong>
3967 <code> security = USER</code>
3968 <p><strong>Example:</strong>
3969 <code> security = DOMAIN</code>
3971 <p></p><dt><strong><strong>security mask (S)</strong></strong><dd>
3972 <p>This parameter controls what UNIX permission bits can be modified
3973 when a Windows NT client is manipulating the UNIX permission on a
3974 file using the native NT security dialog box.
3975 <p>This parameter is applied as a mask (AND'ed with) to the changed
3976 permission bits, thus preventing any bits not in this mask from
3977 being modified. Essentially, zero bits in this mask may be treated
3978 as a set of bits the user is not allowed to change.
3979 <p>If not set explicitly this parameter is set to the same value as the
3980 <a href="smb.conf.5.html#createmask"><strong>create mask</strong></a> parameter. To allow a user to
3981 modify all the user/group/world permissions on a file, set this
3982 parameter to 0777.
3983 <p><em>Note</em> that users who can access the Samba server through other
3984 means can easily bypass this restriction, so it is primarily
3986 most normal systems will probably want to set it to 0777.
3987 <p>See also the <a href="smb.conf.5.html#forcedirectorysecuritymode"><strong>force directory security
3990 mode</strong></a> parameters.
3991 <p><strong>Default:</strong>
3992 <code> security mask = <same as create mask></code>
3993 <p><strong>Example:</strong>
3994 <code> security mask = 0777</code>
3996 <p></p><dt><strong><strong>server string (G)</strong></strong><dd>
3997 <p>This controls what string will show up in the printer comment box in
3999 any string that you wish to show to your users.
4000 <p>It also sets what will appear in browse lists next to the machine
4001 name.
4004 <p><strong>Default:</strong>
4005 <code> server string = Samba %v</code>
4006 <p><strong>Example:</strong>
4007 <code> server string = University of GNUs Samba Server</code>
4009 <p></p><dt><strong><strong>set directory (S)</strong></strong><dd>
4011 setdir command to change directory.
4012 <p>The setdir command is only implemented in the Digital Pathworks
4013 client. See the Pathworks documentation for details.
4014 <p><strong>Default:</strong>
4015 <code> set directory = no</code>
4016 <p><strong>Example:</strong>
4017 <code> set directory = yes</code>
4019 <p></p><dt><strong><strong>share modes (S)</strong></strong><dd>
4021 file open. These modes are used by clients to gain exclusive read or
4022 write access to a file.
4023 <p>These open modes are not directly supported by UNIX, so they are
4024 simulated using shared memory, or lock files if your UNIX doesn't
4025 support shared memory (almost all do).
4026 <p>The share modes that are enabled by this option are DENY_DOS,
4027 DENY_ALL, DENY_READ, DENY_WRITE, DENY_NONE and DENY_FCB.
4028 <p>This option gives full share compatibility and enabled by default.
4029 <p>You should <em>*NEVER*</em> turn this parameter off as many Windows
4030 applications will break if you do so.
4031 <p><strong>Default:</strong>
4032 <code> share modes = yes</code>
4034 <p></p><dt><strong><strong>shared mem size (G)</strong></strong><dd>
4035 <p>It specifies the size of the shared memory (in bytes) to use between
4037 megabyte of shared memory. It is possible that if you have a large
4038 server with many files open simultaneously that you may need to
4039 increase this parameter. Signs that this parameter is set too low are
4040 users reporting strange problems trying to save files (locking errors)
4041 and error messages in the smbd log looking like <code>"ERROR
4042 smb_shm_alloc : alloc of XX bytes failed"</code>.
4043 <p>If your OS refuses the size that Samba asks for then Samba will try a
4044 smaller size, reducing by a factor of 0.8 until the OS accepts it.
4045 <p><strong>Default:</strong>
4046 <code> shared mem size = 1048576</code>
4047 <p><strong>Example:</strong>
4048 <code> shared mem size = 5242880 ; Set to 5mb for a large number of files.</code>
4050 <p></p><dt><strong><strong>short preserve case (S)</strong></strong><dd>
4051 <p>This boolean parameter controls if new files which conform to 8.3
4052 syntax, that is all in upper case and of suitable length, are created
4055 =yes"</strong></a> to permit long filenames to retain their
4056 case, while short names are lowered. Default <em>Yes</em>.
4057 <p>See the section on <a href="smb.conf.5.html#NAMEMANGLING"><strong>NAME MANGLING</strong></a>.
4058 <p><strong>Default:</strong>
4059 <code> short preserve case = yes</code>
4061 <p></p><dt><strong><strong>smb passwd file (G)</strong></strong><dd>
4062 <p>This option sets the path to the encrypted smbpasswd file. By default
4063 the path to the smbpasswd file is compiled into Samba.
4064 <p><strong>Default:</strong>
4065 <code> smb passwd file= <compiled default></code>
4066 <p><strong>Example:</strong>
4067 <code> smb passwd file = /usr/samba/private/smbpasswd</code>
4069 <p></p><dt><strong><strong>smbrun (G)</strong></strong><dd>
4070 <p>This sets the full path to the <strong>smbrun</strong> binary. This defaults to the
4071 value in the Makefile.
4072 <p>You must get this path right for many services to work correctly.
4073 <p>You should not need to change this parameter so long as Samba
4074 is installed correctly.
4075 <p><strong>Default:</strong>
4076 <code> smbrun=<compiled default></code>
4077 <p><strong>Example:</strong>
4078 <code> smbrun = /usr/local/samba/bin/smbrun</code>
4080 <p></p><dt><strong><strong>socket address (G)</strong></strong><dd>
4081 <p>This option allows you to control what address Samba will listen for
4082 connections on. This is used to support multiple virtual interfaces on
4083 the one server, each with a different configuration.
4084 <p>By default samba will accept connections on any address.
4085 <p><strong>Example:</strong>
4086 <code> socket address = 192.168.2.20</code>
4088 <p></p><dt><strong><strong>socket options (G)</strong></strong><dd>
4089 <p>This option allows you to set socket options to be used when talking
4090 with the client.
4091 <p>Socket options are controls on the networking layer of the operating
4092 systems which allow the connection to be tuned.
4093 <p>This option will typically be used to tune your Samba server for
4094 optimal performance for your local network. There is no way that Samba
4095 can know what the optimal parameters are for your net, so you must
4096 experiment and choose them yourself. We strongly suggest you read the
4097 appropriate documentation for your operating system first (perhaps
4099 <p>You may find that on some systems Samba will say "Unknown socket
4100 option" when you supply an option. This means you either incorrectly
4101 typed it or you need to add an include file to includes.h for your OS.
4102 If the latter is the case please send the patch to
4104 <p>Any of the supported socket options may be combined in any way you
4105 like, as long as your OS allows it.
4106 <p>This is the list of socket options currently settable using this
4107 option:
4108 <p><dl>
4109 <p><li > SO_KEEPALIVE
4110 <p><li > SO_REUSEADDR
4111 <p><li > SO_BROADCAST
4112 <p><li > TCP_NODELAY
4113 <p><li > IPTOS_LOWDELAY
4114 <p><li > IPTOS_THROUGHPUT
4115 <p><li > SO_SNDBUF *
4116 <p><li > SO_RCVBUF *
4117 <p><li > SO_SNDLOWAT *
4118 <p><li > SO_RCVLOWAT *
4119 <p></dl>
4120 <p>Those marked with a <code>*</code> take an integer argument. The others can
4121 optionally take a 1 or 0 argument to enable or disable the option, by
4122 default they will be enabled if you don't specify 1 or 0.
4123 <p>To specify an argument use the syntax SOME_OPTION=VALUE for example
4124 <code>SO_SNDBUF=8192</code>. Note that you must not have any spaces before or after
4125 the = sign.
4126 <p>If you are on a local network then a sensible option might be
4127 <p><code>socket options = IPTOS_LOWDELAY</code>
4128 <p>If you have a local network then you could try:
4129 <p><code>socket options = IPTOS_LOWDELAY TCP_NODELAY</code>
4130 <p>If you are on a wide area network then perhaps try setting
4131 IPTOS_THROUGHPUT.
4132 <p>Note that several of the options may cause your Samba server to fail
4133 completely. Use these options with caution!
4134 <p><strong>Default:</strong>
4135 <code> socket options = TCP_NODELAY</code>
4136 <p><strong>Example:</strong>
4137 <code> socket options = IPTOS_LOWDELAY</code>
4139 <p></p><dt><strong><strong>source environment (G)</strong></strong><dd>
4140 <p>This parameter causes Samba to set environment variables as per the
4141 content of the file named.
4142 <p>The file <strong>must</strong> be owned by root and not world writable in order
4143 to be read (this is a security check).
4145 treat that value as a pipe command to open and will set the environment
4146 variables from the oput of the pipe. This command must not be world writable
4147 and must reside in a directory that is not world writable.
4148 <p>The contents of the file or the output of the pipe should be formatted
4149 as the output of the standard Unix env(1) command. This is of the form :
4150 <p>Example environment entry:
4151 <code> SAMBA_NETBIOS_NAME=myhostname </code>
4152 <p><strong>Default:</strong>
4153 <code>No default value</code>
4154 <p><strong>Examples:</strong>
4155 <p><code> source environment = |/etc/smb.conf.sh</code>
4156 <p><code> source environment = /usr/local/smb_env_vars</code>
4158 <p></p><dt><strong><strong>ssl (G)</strong></strong><dd>
4159 <p>This variable is part of SSL-enabled Samba. This is only available if
4160 the SSL libraries have been compiled on your system and the configure
4162 <p><em>Note</em> that for export control reasons this code is <em>**NOT**</em>
4163 enabled by default in any current binary version of Samba.
4164 <p>This variable enables or disables the entire SSL mode. If it is set to
4167 hosts"</strong></a> and <a href="smb.conf.5.html#sslhostsresign"><strong>"ssl hosts resign"</strong></a>
4168 whether an SSL connection will be required.
4169 <p><strong>Default:</strong>
4170 <code> ssl=no</code>
4171 <strong>Example:</strong>
4172 <code> ssl=yes</code>
4174 <p></p><dt><strong><strong>ssl CA certDir (G)</strong></strong><dd>
4175 <p>This variable is part of SSL-enabled Samba. This is only available if
4176 the SSL libraries have been compiled on your system and the configure
4178 <p><em>Note</em> that for export control reasons this code is <em>**NOT**</em>
4179 enabled by default in any current binary version of Samba.
4180 <p>This variable defines where to look up the Certification
4181 Authorities. The given directory should contain one file for each CA
4182 that samba will trust. The file name must be the hash value over the
4184 explained later in this document. All files within the directory that
4185 don't fit into this naming scheme are ignored. You don't need this
4186 variable if you don't verify client certificates.
4187 <p><strong>Default:</strong>
4188 <code> ssl CA certDir = /usr/local/ssl/certs</code>
4190 <p></p><dt><strong><strong>ssl CA certFile (G)</strong></strong><dd>
4191 <p>This variable is part of SSL-enabled Samba. This is only available if
4192 the SSL libraries have been compiled on your system and the configure
4194 <p><em>Note</em> that for export control reasons this code is <em>**NOT**</em>
4195 enabled by default in any current binary version of Samba.
4196 <p>This variable is a second way to define the trusted CAs. The
4197 certificates of the trusted CAs are collected in one big file and this
4198 variable points to the file. You will probably only use one of the two
4199 ways to define your CAs. The first choice is preferable if you have
4200 many CAs or want to be flexible, the second is preferable if you only
4201 have one CA and want to keep things simple (you won't need to create
4202 the hashed file names). You don't need this variable if you don't
4203 verify client certificates.
4204 <p><strong>Default:</strong>
4205 <code> ssl CA certFile = /usr/local/ssl/certs/trustedCAs.pem</code>
4207 <p></p><dt><strong><strong>ssl ciphers (G)</strong></strong><dd>
4208 <p>This variable is part of SSL-enabled Samba. This is only available if
4209 the SSL libraries have been compiled on your system and the configure
4211 <p><em>Note</em> that for export control reasons this code is <em>**NOT**</em>
4212 enabled by default in any current binary version of Samba.
4213 <p>This variable defines the ciphers that should be offered during SSL
4214 negotiation. You should not set this variable unless you know what you
4215 are doing.
4217 <p></p><dt><strong><strong>ssl client cert (G)</strong></strong><dd>
4218 <p>This variable is part of SSL-enabled Samba. This is only available if
4219 the SSL libraries have been compiled on your system and the configure
4221 <p><em>Note</em> that for export control reasons this code is <em>**NOT**</em>
4222 enabled by default in any current binary version of Samba.
4223 <p>The certificate in this file is used by
4225 server requires a client certificate.
4226 <p><strong>Default:</strong>
4227 <code> ssl client cert = /usr/local/ssl/certs/smbclient.pem</code>
4229 <p></p><dt><strong><strong>ssl client key (G)</strong></strong><dd>
4230 <p>This variable is part of SSL-enabled Samba. This is only available if
4231 the SSL libraries have been compiled on your system and the configure
4233 <p><em>Note</em> that for export control reasons this code is <em>**NOT**</em>
4234 enabled by default in any current binary version of Samba.
4236 only needed if the client should have a certificate.
4237 <p><strong>Default:</strong>
4238 <code> ssl client key = /usr/local/ssl/private/smbclient.pem</code>
4240 <p></p><dt><strong><strong>ssl compatibility (G)</strong></strong><dd>
4241 <p>This variable is part of SSL-enabled Samba. This is only available if
4242 the SSL libraries have been compiled on your system and the configure
4244 <p><em>Note</em> that for export control reasons this code is <em>**NOT**</em>
4245 enabled by default in any current binary version of Samba.
4246 <p>This variable defines whether SSLeay should be configured for bug
4247 compatibility with other SSL implementations. This is probably not
4248 desirable because currently no clients with SSL implementations other
4249 than SSLeay exist.
4250 <p><strong>Default:</strong>
4251 <code> ssl compatibility = no</code>
4253 <p></p><dt><strong><strong>ssl hosts (G)</strong></strong><dd>
4256 <p></p><dt><strong><strong>ssl hosts resign (G)</strong></strong><dd>
4257 <p>This variable is part of SSL-enabled Samba. This is only available if
4258 the SSL libraries have been compiled on your system and the configure
4260 <p><em>Note</em> that for export control reasons this code is <em>**NOT**</em>
4261 enabled by default in any current binary version of Samba.
4262 <p>These two variables define whether samba will go into SSL mode or
4263 not. If none of them is defined, samba will allow only SSL
4264 connections. If the <a href="smb.conf.5.html#sslhosts"><strong>"ssl hosts"</strong></a> variable lists
4265 hosts (by IP-address, IP-address range, net group or name), only these
4267 variable lists hosts, only these hosts will NOT be forced into SSL
4268 mode. The syntax for these two variables is the same as for the
4269 <a href="smb.conf.5.html#hostsallow"><strong>"hosts allow"</strong></a> and <a href="smb.conf.5.html#hostsdeny"><strong>"hosts
4270 deny"</strong></a> pair of variables, only that the subject of the
4271 decision is different: It's not the access right but whether SSL is
4272 used or not. See the <a href="smb.conf.5.html#allowhosts"><strong>"allow hosts"</strong></a> parameter for
4273 details. The example below requires SSL connections from all hosts
4274 outside the local net (which is 192.168.*.*).
4275 <p><strong>Default:</strong>
4276 <code> ssl hosts = <empty string></code>
4277 <code> ssl hosts resign = <empty string></code>
4278 <p><strong>Example:</strong>
4279 <code> ssl hosts resign = 192.168.</code>
4281 <p></p><dt><strong><strong>ssl require clientcert (G)</strong></strong><dd>
4282 <p>This variable is part of SSL-enabled Samba. This is only available if
4283 the SSL libraries have been compiled on your system and the configure
4285 <p><em>Note</em> that for export control reasons this code is <em>**NOT**</em>
4286 enabled by default in any current binary version of Samba.
4288 connections from clients that don't have a valid certificate. The
4289 directory/file given in <a href="smb.conf.5.html#sslCAcertDir"><strong>"ssl CA certDir"</strong></a> and
4290 <a href="smb.conf.5.html#sslCAcertFile"><strong>"ssl CA certFile"</strong></a> will be used to look up the
4291 CAs that issued the client's certificate. If the certificate can't be
4292 verified positively, the connection will be terminated. If this
4294 to web applications you really <em>*should*</em> require client
4295 certificates. In the web environment the client's data is sensitive
4296 (credit card numbers) and the server must prove to be trustworthy. In
4297 a file server environment the server's data will be sensitive and the
4298 clients must prove to be trustworthy.
4299 <p><strong>Default:</strong>
4300 <code> ssl require clientcert = no</code>
4302 <p></p><dt><strong><strong>ssl require servercert (G)</strong></strong><dd>
4303 <p>This variable is part of SSL-enabled Samba. This is only available if
4304 the SSL libraries have been compiled on your system and the configure
4306 <p><em>Note</em> that for export control reasons this code is <em>**NOT**</em>
4307 enabled by default in any current binary version of Samba.
4311 clientcert"</strong></a> for the server.
4312 <p><strong>Default:</strong>
4313 <code> ssl require servercert = no</code>
4315 <p></p><dt><strong><strong>ssl server cert (G)</strong></strong><dd>
4316 <p>This variable is part of SSL-enabled Samba. This is only available if
4317 the SSL libraries have been compiled on your system and the configure
4319 <p><em>Note</em> that for export control reasons this code is <em>**NOT**</em>
4320 enabled by default in any current binary version of Samba.
4321 <p>This is the file containing the server's certificate. The server _must_
4322 have a certificate. The file may also contain the server's private key.
4323 See later for how certificates and private keys are created.
4324 <p><strong>Default:</strong>
4325 <code> ssl server cert = <empty string></code>
4327 <p></p><dt><strong><strong>ssl server key (G)</strong></strong><dd>
4328 <p>This variable is part of SSL-enabled Samba. This is only available if
4329 the SSL libraries have been compiled on your system and the configure
4331 <p><em>Note</em> that for export control reasons this code is <em>**NOT**</em>
4332 enabled by default in any current binary version of Samba.
4333 <p>This file contains the private key of the server. If this variable is
4334 not defined, the key is looked up in the certificate file (it may be
4335 appended to the certificate). The server <em>*must*</em> have a private key
4336 and the certificate <em>*must*</em> match this private key.
4337 <p><strong>Default:</strong>
4338 <code> ssl server key = <empty string></code>
4340 <p></p><dt><strong><strong>ssl version (G)</strong></strong><dd>
4341 <p>This variable is part of SSL-enabled Samba. This is only available if
4342 the SSL libraries have been compiled on your system and the configure
4344 <p><em>Note</em> that for export control reasons this code is <em>**NOT**</em>
4345 enabled by default in any current binary version of Samba.
4346 <p>This enumeration variable defines the versions of the SSL protocol
4350 (proposed?) new standard for SSL.
4351 <p><strong>Default:</strong>
4354 <p></p><dt><strong><strong>stat cache (G)</strong></strong><dd>
4356 cache in order to speed up case insensitive name mappings. You should
4357 never need to change this parameter.
4358 <p><strong>Default:</strong>
4359 <code> stat cache = yes</code>
4361 <p></p><dt><strong><strong>stat cache size (G)</strong></strong><dd>
4362 <p>This parameter determines the number of entries in the <a href="smb.conf.5.html#statcache"><strong>stat
4363 cache</strong></a>. You should never need to change this parameter.
4364 <p><strong>Default:</strong>
4365 <code> stat cache size = 50</code>
4367 <p></p><dt><strong><strong>status (G)</strong></strong><dd>
4368 <p>This enables or disables logging of connections to a status file that
4371 to tell you what connections are active. You should never need to
4372 change this parameter.
4373 <p><strong>Default:</strong>
4374 status = yes
4376 <p></p><dt><strong><strong>strict locking (S)</strong></strong><dd>
4377 <p>This is a boolean that controls the handling of file locking in the
4379 write access for file locks, and deny access if locks exist. This can
4380 be slow on some systems.
4382 when the client explicitly asks for them.
4383 <p>Well behaved clients always ask for lock checks when it is important,
4385 preferable.
4386 <p><strong>Default:</strong>
4387 <code> strict locking = no</code>
4388 <p><strong>Example:</strong>
4389 <code> strict locking = yes</code>
4391 <p></p><dt><strong><strong>strict sync (S)</strong></strong><dd>
4392 <p>Many Windows applications (including the Windows 98 explorer shell)
4393 seem to confuse flushing buffer contents to disk with doing a sync to
4394 disk. Under UNIX, a sync call forces the process to be suspended until
4395 the kernel has ensured that all outstanding data in kernel disk
4396 buffers has been safely stored onto stable storage. This is very slow
4398 default) means that smbd ignores the Windows applications requests for
4399 a sync call. There is only a possibility of losing data if the
4400 operating system itself that Samba is running on crashes, so there is
4401 little danger in this default setting. In addition, this fixes many
4402 performance problems that people have reported with the new Windows98
4403 explorer shell file copies.
4404 <p>See also the <a href="smb.conf.5.html#syncalways"><strong>"sync always"</strong></a> parameter.
4405 <p><strong>Default:</strong>
4406 <code> strict sync = no</code>
4407 <p><strong>Example:</strong>
4408 <code> strict sync = yes</code>
4410 <p></p><dt><strong><strong>strip dot (G)</strong></strong><dd>
4411 <p>This is a boolean that controls whether to strip trailing dots off
4412 UNIX filenames. This helps with some CDROMs that have filenames ending
4413 in a single dot.
4414 <p><strong>Default:</strong>
4415 <code> strip dot = no</code>
4416 <p><strong>Example:</strong>
4417 <code> strip dot = yes</code>
4419 <p></p><dt><strong><strong>sync always (S)</strong></strong><dd>
4420 <p>This is a boolean parameter that controls whether writes will always
4421 be written to stable storage before the write call returns. If this is
4422 false then the server will be guided by the client's request in each
4423 write call (clients can set a bit indicating that a particular write
4424 should be synchronous). If this is true then every write will be
4425 followed by a fsync() call to ensure the data is written to disk.
4426 Note that the <a href="smb.conf.5.html#strictsync"><strong>"strict sync"</strong></a> parameter must be
4428 <p>See also the <a href="smb.conf.5.html#strictsync"><strong>"strict sync"</strong></a> parameter.
4429 <p><strong>Default:</strong>
4430 <code> sync always = no</code>
4431 <p><strong>Example:</strong>
4432 <code> sync always = yes</code>
4434 <p></p><dt><strong><strong>syslog (G)</strong></strong><dd>
4435 <p>This parameter maps how Samba debug messages are logged onto the
4436 system syslog logging levels. Samba debug level zero maps onto syslog
4437 LOG_ERR, debug level one maps onto LOG_WARNING, debug level two maps
4438 onto LOG_NOTICE, debug level three maps onto LOG_INFO. All higher
4439 levels are mapped to LOG_DEBUG.
4440 <p>This paramter sets the threshold for sending messages to syslog.
4441 Only messages with debug level less than this value will be sent
4442 to syslog.
4443 <p><strong>Default:</strong>
4444 <code> syslog = 1</code>
4446 <p></p><dt><strong><strong>syslog only (G)</strong></strong><dd>
4447 <p>If this parameter is set then Samba debug messages are logged into the
4448 system syslog only, and not to the debug log files.
4449 <p><strong>Default:</strong>
4450 <code> syslog only = no</code>
4452 <p></p><dt><strong><strong>template homedir (G)</strong></strong><dd>
4453 <p>NOTE: this parameter is only available in Samba 3.0.
4454 <p>When filling out the user information for a Windows NT user, the
4456 the home directory for that user. If the string <code>%D</code> is present it is
4457 substituted with the user's Windows NT domain name. If the string <code>%U</code>
4458 is present it is substituted with the user's Windows NT user name.
4459 <p><strong>Default:</strong>
4460 <code> template homedir = /home/%D/%U</code>
4462 <p></p><dt><strong><strong>template shell (G)</strong></strong><dd>
4463 <p>NOTE: this parameter is only available in Samba 3.0.
4464 <p>When filling out the user information for a Windows NT user, the
4466 the login shell for that user.
4467 <p><strong>Default:</strong>
4468 <code> template shell = /bin/false</code>
4470 <p></p><dt><strong><strong>time offset (G)</strong></strong><dd>
4471 <p>This parameter is a setting in minutes to add to the normal GMT to
4472 local time conversion. This is useful if you are serving a lot of PCs
4473 that have incorrect daylight saving time handling.
4474 <p><strong>Default:</strong>
4475 <code> time offset = 0</code>
4476 <p><strong>Example:</strong>
4477 <code> time offset = 60</code>
4479 <p><p></p><dt><strong><strong>time server (G)</strong></strong><dd>
4481 itself as a time server to Windows clients. The default is False.
4482 <p><strong>Default:</strong>
4483 <code> time server = False</code>
4484 <p><strong>Example:</strong>
4485 <code> time server = True</code>
4487 <p></p><dt><strong><strong>timestamp logs (G)</strong></strong><dd>
4490 <p></p><dt><strong><strong>unix password sync (G)</strong></strong><dd>
4491 <p>This boolean parameter controls whether Samba attempts to synchronize
4492 the UNIX password with the SMB password when the encrypted SMB
4493 password in the smbpasswd file is changed. If this is set to true the
4494 program specified in the <a href="smb.conf.5.html#passwdprogram"><strong>"passwd program"</strong></a>
4495 parameter is called <em>*AS ROOT*</em> - to allow the new UNIX password to be
4496 set without access to the old UNIX password (as the SMB password has
4497 change code has no access to the old password cleartext, only the
4499 <p>See also <a href="smb.conf.5.html#passwdprogram"><strong>"passwd program"</strong></a>, <a href="smb.conf.5.html#passwdchat"><strong>"passwd
4500 chat"</strong></a>.
4501 <p><strong>Default:</strong>
4502 <code> unix password sync = False</code>
4503 <p><strong>Example:</strong>
4504 <code> unix password sync = True</code>
4506 <p></p><dt><strong><strong>unix realname (G)</strong></strong><dd>
4507 <p>This boolean parameter when set causes samba to supply the real name
4508 field from the unix password file to the client. This is useful for
4509 setting up mail clients and WWW browsers on systems used by more than
4510 one person.
4511 <p><strong>Default:</strong>
4512 <code> unix realname = no</code>
4513 <p><strong>Example:</strong>
4514 <code> unix realname = yes</code>
4516 <p></p><dt><strong><strong>update encrypted (G)</strong></strong><dd>
4517 <p>This boolean parameter allows a user logging on with a plaintext
4518 password to have their encrypted (hashed) password in the smbpasswd
4519 file to be updated automatically as they log on. This option allows a
4520 site to migrate from plaintext password authentication (users
4521 authenticate with plaintext password over the wire, and are checked
4522 against a UNIX account database) to encrypted password authentication
4523 (the SMB challenge/response authentication mechanism) without forcing
4524 all users to re-enter their passwords via smbpasswd at the time the
4525 change is made. This is a convenience option to allow the change over
4526 to encrypted passwords to be made over a longer period. Once all users
4527 have encrypted representations of their passwords in the smbpasswd
4529 <p>In order for this parameter to work correctly the <a href="smb.conf.5.html#encryptpasswords"><strong>"encrypt
4532 <p>Note that even when this parameter is set a user authenticating to
4533 smbd must still enter a valid password in order to connect correctly,
4534 and to update their hashed (smbpasswd) passwords.
4535 <p><strong>Default:</strong>
4536 <code> update encrypted = no</code>
4537 <p><strong>Example:</strong>
4538 <code> update encrypted = yes</code>
4540 <p></p><dt><strong><strong>use rhosts (G)</strong></strong><dd>
4541 <p>If this global parameter is a true, it specifies that the UNIX users
4543 names of hosts and users who will be allowed access without specifying
4544 a password.
4545 <p>NOTE: The use of <strong>use rhosts</strong> can be a major security hole. This is
4546 because you are trusting the PC to supply the correct username. It is
4547 very easy to get a PC to supply a false username. I recommend that the
4548 <strong>use rhosts</strong> option be only used if you really know what you are
4549 doing.
4550 <p><strong>Default:</strong>
4551 <code> use rhosts = no</code>
4552 <p><strong>Example:</strong>
4553 <code> use rhosts = yes</code>
4555 <p></p><dt><strong><strong>user (S)</strong></strong><dd>
4558 <p></p><dt><strong><strong>users (S)</strong></strong><dd>
4561 <p></p><dt><strong><strong>username (S)</strong></strong><dd>
4562 <p>Multiple users may be specified in a comma-delimited list, in which
4563 case the supplied password will be tested against each username in
4564 turn (left to right).
4565 <p>The <strong>username=</strong> line is needed only when the PC is unable to supply
4566 its own username. This is the case for the COREPLUS protocol or where
4567 your users have different WfWg usernames to UNIX usernames. In both
4568 these cases you may also be better using the <code>\\server\share%user</code>
4569 syntax instead.
4570 <p>The <strong>username=</strong> line is not a great solution in many cases as it
4571 means Samba will try to validate the supplied password against each of
4572 the usernames in the username= line in turn. This is slow and a bad
4573 idea for lots of users in case of duplicate passwords. You may get
4574 timeouts or security breaches using this parameter unwisely.
4575 <p>Samba relies on the underlying UNIX security. This parameter does not
4576 restrict who can login, it just offers hints to the Samba server as to
4577 what usernames might correspond to the supplied password. Users can
4578 login as whoever they please and they will be able to do no more
4579 damage than if they started a telnet session. The daemon runs as the
4580 user that they log in as, so they cannot do anything that user cannot
4581 do.
4582 <p>To restrict a service to a particular set of users you can use the
4584 <p>If any of the usernames begin with a <code>'@'</code> then the name will be
4585 looked up first in the yp netgroups list (if Samba is compiled with
4586 netgroup support), followed by a lookup in the UNIX groups database
4587 and will expand to a list of all users in the group of that name.
4588 <p>If any of the usernames begin with a <code>'+'</code> then the name will be
4589 looked up only in the UNIX groups database and will expand to a list
4590 of all users in the group of that name.
4591 <p>If any of the usernames begin with a <code>'&'</code> then the name will be
4592 looked up only in the yp netgroups database (if Samba is compiled with
4593 netgroup support) and will expand to a list of all users in the
4594 netgroup group of that name.
4595 <p>Note that searching though a groups database can take quite some time,
4596 and some clients may time out during the search.
4597 <p>See the section <a href="smb.conf.5.html#NOTEABOUTUSERNAMEPASSWORDVALIDATION"><strong>"NOTE ABOUT USERNAME/PASSWORD
4598 VALIDATION"</strong></a> for more
4599 information on how this parameter determines access to the services.
4600 <p><strong>Default:</strong>
4601 <code> The guest account if a guest service, else the name of the service.</code>
4602 <p><strong>Examples:</strong>
4603 <pre>
4605 username = fred
4606 username = fred, mary, jack, jane, @users, @pcgroup
4608 </pre>
4611 <p></p><dt><strong><strong>username level (G)</strong></strong><dd>
4612 <p>This option helps Samba to try and 'guess' at the real UNIX username,
4613 as many DOS clients send an all-uppercase username. By default Samba
4614 tries all lowercase, followed by the username with the first letter
4615 capitalized, and fails if the username is not found on the UNIX
4616 machine.
4617 <p>If this parameter is set to non-zero the behavior changes. This
4618 parameter is a number that specifies the number of uppercase
4619 combinations to try whilst trying to determine the UNIX user name. The
4620 higher the number the more combinations will be tried, but the slower
4621 the discovery of usernames will be. Use this parameter when you have
4623 <p><strong>Default:</strong>
4624 <code> username level = 0</code>
4625 <p><strong>Example:</strong>
4626 <code> username level = 5</code>
4628 <p></p><dt><strong><strong>username map (G)</strong></strong><dd>
4629 <p>This option allows you to specify a file containing a mapping of
4630 usernames from the clients to the server. This can be used for several
4631 purposes. The most common is to map usernames that users use on DOS or
4632 Windows machines to those that the UNIX box uses. The other is to map
4633 multiple users to a single username so that they can more easily share
4634 files.
4635 <p>The map file is parsed line by line. Each line should contain a single
4636 UNIX username on the left then a <code>'='</code> followed by a list of
4637 usernames on the right. The list of usernames on the right may contain
4638 names of the form @group in which case they will match any UNIX
4639 username in that group. The special client name <code>'*'</code> is a wildcard
4640 and matches any name. Each line of the map file may be up to 1023
4641 characters long.
4642 <p>The file is processed on each line by taking the supplied username and
4643 comparing it with each username on the right hand side of the <code>'='</code>
4644 signs. If the supplied name matches any of the names on the right hand
4645 side then it is replaced with the name on the left. Processing then
4646 continues with the next line.
4647 <p>If any line begins with a <code>'#'</code> or a <code>';'</code> then it is ignored
4648 <p>If any line begins with an <code>'!'</code> then the processing will stop after
4649 that line if a mapping was done by the line. Otherwise mapping
4650 continues with every line being processed. Using <code>'!'</code> is most
4651 useful when you have a wildcard mapping line later in the file.
4654 <p><code> root = admin administrator</code>
4657 <p><code> sys = @system</code>
4658 <p>You can have as many mappings as you like in a username map file.
4659 <p>If your system supports the NIS NETGROUP option then the netgroup
4660 database is checked before the <code>/etc/group</code> database for matching
4661 groups.
4662 <p>You can map Windows usernames that have spaces in them by using double
4663 quotes around the name. For example:
4666 username tridge.
4667 <p>The following example would map mary and fred to the unix user sys,
4668 and map the rest to guest. Note the use of the <code>'!'</code> to tell Samba
4669 to stop processing if it gets a match on that line.
4670 <p><pre>
4672 !sys = mary fred
4673 guest = *
4675 </pre>
4677 <p>Note that the remapping is applied to all occurrences of
4682 passed to the <a href="smb.conf.5.html#passwordserver"><strong>"password server"</strong></a> (if you have
4683 one). The password server will receive whatever username the client
4684 supplies without modification.
4685 <p>Also note that no reverse mapping is done. The main effect this has is
4686 with printing. Users who have been mapped may have trouble deleting
4687 print jobs as PrintManager under WfWg will think they don't own the
4688 print job.
4689 <p><strong>Default:</strong>
4690 <code> no username map</code>
4691 <p><strong>Example:</strong>
4692 <code> username map = /usr/local/samba/lib/users.map</code>
4694 <p></p><dt><strong><strong>utmp (S)</strong></strong><dd>
4695 <p>This boolean parameter is only available if Samba has been configured and compiled
4696 with the option <code>--with-utmp</code>. If set to True then Samba will attempt
4697 to add utmp or utmpx records (depending on the UNIX system) whenever a
4698 connection is made to a Samba server. Sites may use this to record the
4699 user connecting to a Samba share.
4700 <p>See also the <a href="smb.conf.5.html#utmpdirectory"><strong>"utmp directory"</strong></a> parameter.
4701 <p><strong>Default:</strong>
4702 <code>utmp = False</code>
4703 <p><strong>Example:</strong>
4704 <code>utmp = True</code>
4706 <p></p><dt><strong><strong>utmp directory(G)</strong></strong><dd>
4707 <p>This parameter is only available if Samba has been configured and compiled
4708 with the option <code>--with-utmp</code>. It specifies a directory pathname that is
4709 used to store the utmp or utmpx files (depending on the UNIX system) that
4710 record user connections to a Samba server. See also the <a href="smb.conf.5.html#utmp"><strong>"utmp"</strong></a>
4711 parameter. By default this is not set, meaning the system will use whatever
4712 utmp file the native system is set to use (usually /var/run/utmp on Linux).
4713 <p><strong>Default:</strong>
4714 <code>no utmp directory</code>
4715 <p><strong>Example:</strong>
4716 <code>utmp directory = /var/adm/</code>
4718 <p></p><dt><strong>winbind cache time</strong><dd>
4719 <p>NOTE: this parameter is only available in Samba 3.0.
4720 <p>This parameter specifies the number of seconds the
4722 information before querying a Windows NT server again.
4723 <p><strong>Default:</strong>
4724 <code> winbind cache type = 15</code>
4726 <p></p><dt><strong>winbind gid</strong><dd>
4727 <p>NOTE: this parameter is only available in Samba 3.0.
4728 <p>The winbind gid parameter specifies the range of group ids that are
4730 group ids should have no existing local or nis groups within it as strange
4731 conflicts can occur otherwise.
4732 <p><strong>Default:</strong>
4733 <code> winbind gid = <empty string></code>
4734 <p><strong>Example:</strong>
4735 <code> winbind gid = 10000-20000</code>
4737 <p></p><dt><strong>winbind uid</strong><dd>
4738 <p>NOTE: this parameter is only available in Samba 3.0.
4739 <p>The winbind uid parameter specifies the range of user ids that are
4741 ids should have no existing local or nis users within it as strange
4742 conflicts can occur otherwise.
4743 <p><strong>Default:</strong>
4744 <code> winbind uid = <empty string></code>
4745 <p><strong>Example:</strong>
4746 <code> winbind uid = 10000-20000</code>
4748 <p></p><dt><strong><strong>valid chars (G)</strong></strong><dd>
4749 <p>The option allows you to specify additional characters that should be
4750 considered valid by the server in filenames. This is particularly
4751 useful for national character sets, such as adding u-umlaut or a-ring.
4752 <p>The option takes a list of characters in either integer or character
4753 form with spaces between them. If you give two characters with a colon
4754 between them then it will be taken as an lowercase:uppercase pair.
4755 <p>If you have an editor capable of entering the characters into the
4756 config file then it is probably easiest to use this method. Otherwise
4757 you can specify the characters in octal, decimal or hexadecimal form
4758 using the usual C notation.
4759 <p>For example to add the single character <code>'Z'</code> to the charset (which
4760 is a pointless thing to do as it's already there) you could do one of
4761 the following
4762 <p><pre>
4764 valid chars = Z
4765 valid chars = z:Z
4766 valid chars = 0132:0172
4768 </pre>
4770 <p>The last two examples above actually add two characters, and alter the
4771 uppercase and lowercase mappings appropriately.
4772 <p>Note that you MUST specify this parameter after the <a href="smb.conf.5.html#clientcodepage"><strong>"client
4773 code page"</strong></a> parameter if you have both set. If
4774 <a href="smb.conf.5.html#clientcodepage"><strong>"client code page"</strong></a> is set after the
4776 overwritten.
4777 <p>See also the <a href="smb.conf.5.html#clientcodepage"><strong>"client code page"</strong></a> parameter.
4778 <p><strong>Default:</strong>
4779 <pre>
4781 Samba defaults to using a reasonable set of valid characters
4782 for English systems
4784 </pre>
4786 <p><strong>Example</strong>
4787 <code> valid chars = 0345:0305 0366:0326 0344:0304</code>
4788 <p>The above example allows filenames to have the Swedish characters in
4789 them.
4790 <p>NOTE: It is actually quite difficult to correctly produce a <strong>"valid
4791 chars"</strong> line for a particular system. To automate the process
4792 <a href="mailto:tino@augsburg.net"><em>tino@augsburg.net</em></a> has written a package called <strong>"validchars"</strong>
4794 a given client system. Look in the examples/validchars/ subdirectory
4795 of your Samba source code distribution for this package.
4797 <p></p><dt><strong><strong>valid users (S)</strong></strong><dd>
4798 <p>This is a list of users that should be allowed to login to this
4799 service. Names starting with <code>'@'</code>, <code>'+'</code> and <code>'&'</code> are
4800 interpreted using the same rules as described in the <a href="smb.conf.5.html#invalidusers"><strong>"invalid
4801 users"</strong></a> parameter.
4802 <p>If this is empty (the default) then any user can login. If a username
4803 is in both this list and the <a href="smb.conf.5.html#invalidusers"><strong>"invalid users"</strong></a>
4804 list then access is denied for that user.
4805 <p>The current servicename is substituted for
4809 <p><strong>Default:</strong>
4810 <code> No valid users list. (anyone can login)</code>
4811 <p><strong>Example:</strong>
4812 <code> valid users = greg, @pcusers</code>
4814 <p></p><dt><strong><strong>veto files(S)</strong></strong><dd>
4815 <p>This is a list of files and directories that are neither visible nor
4816 accessible. Each entry in the list must be separated by a <code>'/'</code>,
4817 which allows spaces to be included in the entry. <code>'*'</code> and <code>'?'</code>
4818 can be used to specify multiple files or directories as in DOS
4819 wildcards.
4820 <p>Each entry must be a unix path, not a DOS path and must <em>*not*</em> include the
4821 unix directory separator <code>'/'</code>.
4822 <p>Note that the <a href="smb.conf.5.html#casesensitive"><strong>"case sensitive"</strong></a> option is
4823 applicable in vetoing files.
4824 <p>One feature of the veto files parameter that it is important to be
4825 aware of, is that if a directory contains nothing but files that match
4826 the veto files parameter (which means that Windows/DOS clients cannot
4827 ever see them) is deleted, the veto files within that directory *are
4828 automatically deleted* along with it, if the user has UNIX permissions
4829 to do so.
4830 <p>Setting this parameter will affect the performance of Samba, as it
4831 will be forced to check all files and directories for a match as they
4832 are scanned.
4833 <p>See also <a href="smb.conf.5.html#hidefiles"><strong>"hide files"</strong></a> and <a href="smb.conf.5.html#casesensitive"><strong>"case
4834 sensitive"</strong></a>.
4835 <p><strong>Default:</strong>
4836 <code> No files or directories are vetoed.</code>
4837 <p><strong>Examples:</strong>
4838 <p>Example 1.
4839 <p><pre>
4842 Veto any files containing the word Security,
4843 any ending in .tmp, and any directory containing the
4844 word root.
4846 veto files = /*Security*/*.tmp/*root*/
4848 </pre>
4850 <p>Example 2.
4851 <p><pre>
4853 Veto the Apple specific files that a NetAtalk server
4854 creates.
4856 veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/
4858 </pre>
4861 <p></p><dt><strong><strong>veto oplock files (S)</strong></strong><dd>
4862 <p>This parameter is only valid when the <a href="smb.conf.5.html#oplocks"><strong>"oplocks"</strong></a>
4863 parameter is turned on for a share. It allows the Samba administrator
4864 to selectively turn off the granting of oplocks on selected files that
4865 match a wildcarded list, similar to the wildcarded list used in the
4867 <p><strong>Default:</strong>
4868 <code> No files are vetoed for oplock grants.</code>
4869 <p><strong>Examples:</strong>
4870 <p>You might want to do this on files that you know will be heavily
4871 contended for by clients. A good example of this is in the NetBench
4872 SMB benchmark program, which causes heavy client contention for files
4874 files you would use the line (either in the <a href="smb.conf.5.html#global"><strong>[global]</strong></a>
4875 section or in the section for the particular NetBench share :
4876 <p><code> veto oplock files = /*.SEM/</code>
4878 <p></p><dt><strong><strong>volume (S)</strong></strong><dd>
4879 <p>This allows you to override the volume label returned for a
4880 share. Useful for CDROMs with installation programs that insist on a
4881 particular volume label.
4882 <p>The default is the name of the share.
4884 <p></p><dt><strong><strong>wide links (S)</strong></strong><dd>
4885 <p>This parameter controls whether or not links in the UNIX file system
4886 may be followed by the server. Links that point to areas within the
4887 directory tree exported by the server are always allowed; this
4888 parameter controls access only to areas that are outside the directory
4889 tree being exported.
4890 <p>Note that setting this parameter can have a negative effect on your
4891 server performance due to the extra system calls that Samba has to
4892 do in order to perform the link checks.
4893 <p><strong>Default:</strong>
4894 <code> wide links = yes</code>
4895 <p><strong>Example:</strong>
4896 <code> wide links = no</code>
4898 <p></p><dt><strong><strong>wins proxy (G)</strong></strong><dd>
4900 respond to broadcast name queries on behalf of other hosts. You may
4902 <p><strong>Default:</strong>
4903 <code> wins proxy = no</code>
4905 <p></p><dt><strong><strong>wins server (G)</strong></strong><dd>
4906 <p>This specifies the IP address (or DNS name: IP address for preference)
4908 If you have a WINS server on your network then you should set this to
4909 the WINS server's IP.
4910 <p>You should point this at your WINS server if you have a
4911 multi-subnetted network.
4912 <p><em>NOTE</em>. You need to set up Samba to point to a WINS server if you
4913 have multiple subnets and wish cross-subnet browsing to work correctly.
4914 <p>See the documentation file BROWSING.txt in the docs/ directory of your
4915 Samba source distribution.
4916 <p><strong>Default:</strong>
4917 <code> wins server = </code>
4918 <p><strong>Example:</strong>
4919 <code> wins server = 192.9.200.1</code>
4921 <p></p><dt><strong><strong>wins hook (G)</strong></strong><dd>
4922 <p>When Samba is running as a WINS server this allows you to call an
4923 external program for all changes to the WINS database. The primary use
4924 for this option is to allow the dynamic update of external name
4925 resolution databases such as dynamic DNS.
4926 <p>The wins hook parameter specifies the name of a script or executable
4927 that will be called as follows:
4928 <p>wins_hook operation name nametype ttl IP_list
4932 may sometimes be called when the name has not previously been added,
4933 in that case it should be treated as an add.
4934 <p>The second argument is the netbios name. If the name is not a legal
4935 name then the wins hook is not called. Legal names contain only
4936 letters, digits, hyphens, underscores and periods.
4937 <p>The third argument is the netbios name type as a 2 digit hexadecimal
4938 number.
4939 <p>The fourth argument is the TTL (time to live) for the name in seconds.
4940 <p>The fifth and subsequent arguments are the IP addresses currently
4941 registered for that name. If this list is empty then the name should
4942 be deleted.
4943 <p>An example script that calls the BIND dynamic DNS update program
4945 code.
4947 <p></p><dt><strong><strong>wins support (G)</strong></strong><dd>
4949 Samba will act as a WINS server. You should not set this to true
4950 unless you have a multi-subnetted network and you wish a particular
4952 should <em>*NEVER*</em> set this to true on more than one machine in your
4953 network.
4954 <p><strong>Default:</strong>
4955 <code> wins support = no</code>
4957 <p></p><dt><strong><strong>workgroup (G)</strong></strong><dd>
4958 <p>This controls what workgroup your server will appear to be in when
4959 queried by clients. Note that this parameter also controls the Domain
4960 name used with the <a href="smb.conf.5.html#securityequaldomain"><strong>"security=domain"</strong></a>
4961 setting.
4962 <p><strong>Default:</strong>
4963 <code> set at compile time to WORKGROUP</code>
4964 <p><strong>Example:</strong>
4965 workgroup = MYGROUP
4967 <p></p><dt><strong><strong>writable (S)</strong></strong><dd>
4968 <p>Synonym for <a href="smb.conf.5.html#writeable"><strong>"writeable"</strong></a> for people who can't spell :-).
4970 <p></p><dt><strong><strong>write list (S)</strong></strong><dd>
4971 <p>This is a list of users that are given read-write access to a
4972 service. If the connecting user is in this list then they will be
4973 given write access, no matter what the <a href="smb.conf.5.html#writeable"><strong>"writeable"</strong></a>
4974 option is set to. The list can include group names using the @group
4975 syntax.
4976 <p>Note that if a user is in both the read list and the write list then
4977 they will be given write access.
4979 <p><strong>Default:</strong>
4980 <code> write list = <empty string></code>
4981 <p><strong>Example:</strong>
4982 <code> write list = admin, root, @staff</code>
4984 <p></p><dt><strong><strong>write cache size (S)</strong></strong><dd>
4985 <p>This integer parameter (new with Samba 2.0.7) if set to non-zero causes Samba to create an in-memory
4986 cache for each oplocked file (it does <strong>not</strong> do this for non-oplocked files). All
4987 writes that the client does not request to be flushed directly to disk will be
4988 stored in this cache if possible. The cache is flushed onto disk when a write
4989 comes in whose offset would not fit into the cache or when the file is closed
4990 by the client. Reads for the file are also served from this cache if the data
4991 is stored within it.
4992 <p>This cache allows Samba to batch client writes into a more efficient write
4993 size for RAID disks (ie. writes may be tuned to be the RAID stripe size) and
4994 can improve performance on systems where the disk subsystem is a bottleneck
4995 but there is free memory for userspace programs.
4996 <p>The integer parameter specifies the size of this cache (per oplocked file)
4997 in bytes.
4998 <p><strong>Default:</strong>
4999 <code> write cache size = 0</code>
5000 <p><strong>Example:</strong>
5001 <code> write cache size = 262144</code>
5002 for a 256k cache size per file.
5004 <p></p><dt><strong><strong>write ok (S)</strong></strong><dd>
5007 <p></p><dt><strong><strong>write raw (G)</strong></strong><dd>
5008 <p>This parameter controls whether or not the server will support raw
5009 writes SMB's when transferring data from clients. You should never
5010 need to change this parameter.
5011 <p><strong>Default:</strong>
5012 <code> write raw = yes</code>
5014 <p></p><dt><strong><strong>writeable</strong></strong><dd>
5017 or modify files in the service's directory.
5018 <p>Note that a printable service <a href="smb.conf.5.html#printable"><strong>("printable = yes")</strong></a>
5019 will <em>*ALWAYS*</em> allow writing to the directory (user privileges
5020 permitting), but only via spooling operations.
5021 <p><strong>Default:</strong>
5022 <code> writeable = no</code>
5023 <p><strong>Examples:</strong>
5024 <pre>
5026 read only = no
5027 writeable = yes
5028 write ok = yes
5030 </pre>
5032 <p></dl>
5034 <h2>WARNINGS</h2>
5036 <p>Although the configuration file permits service names to contain
5037 spaces, your client software may not. Spaces will be ignored in
5038 comparisons anyway, so it shouldn't be a problem - but be aware of the
5039 possibility.
5040 <p>On a similar note, many clients - especially DOS clients - limit
5042 such limitation, but attempts to connect from such clients will fail
5043 if they truncate the service names. For this reason you should
5044 probably keep your service names down to eight characters in length.
5045 <p>Use of the <a href="smb.conf.5.html#homes"><strong>[homes]</strong></a> and <a href="smb.conf.5.html#printers"><strong>[printers]</strong></a>
5046 special sections make life for an administrator easy, but the various
5047 combinations of default attributes can be tricky. Take extreme care
5048 when designing these sections. In particular, ensure that the
5049 permissions on spool directories are correct.
5051 <h2>VERSION</h2>
5053 <p>This man page is correct for version 2.0 of the Samba suite.
5055 <h2>SEE ALSO</h2>
5057 <p><a href="smbd.8.html"><strong>smbd (8)</strong></a>, <a href="smbclient.1.html"><strong>smbclient (1)</strong></a>,
5058 <a href="nmbd.8.html"><strong>nmbd (8)</strong></a>, <a href="testparm.1.html"><strong>testparm (1)</strong></a>,
5059 <a href="testprns.1.html"><strong>testprns (1)</strong></a>, <a href="samba.7.html"><strong>Samba</strong></a>,
5060 <a href="nmblookup.1.html"><strong>nmblookup (1)</strong></a>, <a href="smbpasswd.5.html"><strong>smbpasswd (5)</strong></a>,
5063 <h2>AUTHOR</h2>
5065 <p>The original Samba software and related utilities were created by
5066 Andrew Tridgell <a href="mailto:samba@samba.org"><em>samba@samba.org</em></a>. Samba is now developed
5067 by the Samba Team as an Open Source project similar to the way the
5068 Linux kernel is developed.
5069 <p>The original Samba man pages were written by Karl Auer. The man page
5070 sources were converted to YODL format (another excellent piece of Open
5071 Source software, available at
5072 <a href="ftp://ftp.icce.rug.nl/pub/unix/"><strong>ftp://ftp.icce.rug.nl/pub/unix/</strong></a>)
5073 and updated for the Samba2.0 release by Jeremy Allison.
5076 list of contributors and details on how to submit bug reports,
5077 comments etc.
5078 </body>
5079 </html>