docs/htmldocs/smb.conf.5.html

   1 <HTML
   2 ><HEAD
   3 ><TITLE
   4 >smb.conf</TITLE
   5 ><META
   6 NAME="GENERATOR"
   7 CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD
   8 ><BODY
   9 CLASS="REFENTRY"
  10 BGCOLOR="#FFFFFF"
  11 TEXT="#000000"
  12 LINK="#0000FF"
  13 VLINK="#840084"
  14 ALINK="#0000FF"
  15 ><H1
  16 ><A
  17 NAME="SMB.CONF"
  18 >smb.conf</A
  19 ></H1
  20 ><DIV
  21 CLASS="REFNAMEDIV"
  22 ><A
  23 NAME="AEN5"
  24 ></A
  25 ><H2
  26 >Name</H2
  27 >smb.conf&nbsp;--&nbsp;The configuration file for the Samba suite</DIV
  28 ><DIV
  29 CLASS="REFSECT1"
  30 ><A
  31 NAME="AEN8"
  32 ></A
  33 ><H2
  34 >SYNOPSIS</H2
  35 ><P
  36 >The <TT
  37 CLASS="FILENAME"
  38 >smb.conf</TT
  39 > file is a configuration
  40         file for the Samba suite. <TT
  41 CLASS="FILENAME"
  42 >smb.conf</TT
  43 > contains
  44         runtime configuration information for the Samba programs. The
  45         <TT
  46 CLASS="FILENAME"
  47 >smb.conf</TT
  48 > file is designed to be configured and
  49         administered by the <A
  50 HREF="swat.8.html"
  51 TARGET="_top"
  52 ><B
  53 CLASS="COMMAND"
  54 >swat(8)</B
  55 >
  56         </A
  57 > program. The complete description of the file format and
  58         possible parameters held within are here for reference purposes.</P
  59 ></DIV
  60 ><DIV
  61 CLASS="REFSECT1"
  62 ><A
  63 NAME="AEN16"
  64 ></A
  65 ><H2
  66 >FILE FORMAT</H2
  67 ><P
  68 >The file consists of sections and parameters. A section
  69         begins with the name of the section in square brackets and continues
  70         until the next section begins. Sections contain parameters of the
  71         form</P
  72 ><P
  73 ><TT
  74 CLASS="REPLACEABLE"
  75 ><I
  76 >name</I
  77 ></TT
  78 > = <TT
  79 CLASS="REPLACEABLE"
  80 ><I
  81 >value
  82         </I
  83 ></TT
  84 ></P
  85 ><P
  86 >The file is line-based - that is, each newline-terminated
  87         line represents either a comment, a section name or a parameter.</P
  88 ><P
  89 >Section and parameter names are not case sensitive.</P
  90 ><P
  91 >Only the first equals sign in a parameter is significant.
  92         Whitespace before or after the first equals sign is discarded.
  93         Leading, trailing and internal whitespace in section and parameter
  94         names is irrelevant. Leading and trailing whitespace in a parameter
  95         value is discarded. Internal whitespace within a parameter value
  96         is retained verbatim.</P
  97 ><P
  98 >Any line beginning with a semicolon (';') or a hash ('#')
  99         character is ignored, as are lines containing only whitespace.</P
 100 ><P
 101 >Any line ending in a '\' is continued
 102         on the next line in the customary UNIX fashion.</P
 103 ><P
 104 >The values following the equals sign in parameters are all
 105         either a string (no quotes needed) or a boolean, which may be given
 106         as yes/no, 0/1 or true/false. Case is not significant in boolean
 107         values, but is preserved in string values. Some items such as
 108         create modes are numeric.</P
 109 ></DIV
 110 ><DIV
 111 CLASS="REFSECT1"
 112 ><A
 113 NAME="AEN28"
 114 ></A
 115 ><H2
 116 >SECTION DESCRIPTIONS</H2
 117 ><P
 118 >Each section in the configuration file (except for the
 119         [global] section) describes a shared resource (known
 120         as a "share"). The section name is the name of the
 121         shared resource and the parameters within the section define
 122         the shares attributes.</P
 123 ><P
 124 >There are three special sections, [global],
 125         [homes] and [printers], which are
 126         described under <EM
 127 >special sections</EM
 128 >. The
 129         following notes apply to ordinary section descriptions.</P
 130 ><P
 131 >A share consists of a directory to which access is being
 132         given plus a description of the access rights which are granted
 133         to the user of the service. Some housekeeping options are
 134         also specifiable.</P
 135 ><P
 136 >Sections are either file share services (used by the
 137         client as an extension of their native file systems) or
 138         printable services (used by the client to access print services
 139         on the host running the server).</P
 140 ><P
 141 >Sections may be designated <EM
 142 >guest</EM
 143 > services,
 144         in which case no password is required to access them. A specified
 145         UNIX <EM
 146 >guest account</EM
 147 > is used to define access
 148         privileges in this case.</P
 149 ><P
 150 >Sections other than guest services will require a password
 151         to access them. The client provides the username. As older clients
 152         only provide passwords and not usernames, you may specify a list
 153         of usernames to check against the password using the "user="
 154         option in the share definition. For modern clients such as
 155         Windows 95/98/ME/NT/2000, this should not be necessary.</P
 156 ><P
 157 >Note that the access rights granted by the server are
 158         masked by the access rights granted to the specified or guest
 159         UNIX user by the host system. The server does not grant more
 160         access than the host system grants.</P
 161 ><P
 162 >The following sample section defines a file space share.
 163         The user has write access to the path <TT
 164 CLASS="FILENAME"
 165 >/home/bar</TT
 166 >.
 167         The share is accessed via the share name "foo":</P
 168 ><TABLE
 169 BORDER="0"
 170 BGCOLOR="#E0E0E0"
 171 WIDTH="100%"
 172 ><TR
 173 ><TD
 174 ><PRE
 175 CLASS="SCREEN"
 176 >       <TT
 177 CLASS="COMPUTEROUTPUT"
 178 >       [foo]
 179                 path = /home/bar
 180                 writeable = true
 181         </TT
 182 >
 183         </PRE
 184 ></TD
 185 ></TR
 186 ></TABLE
 187 ><P
 188 >The following sample section defines a printable share.
 189         The share is readonly, but printable. That is, the only write
 190         access permitted is via calls to open, write to and close a
 191         spool file. The <EM
 192 >guest ok</EM
 193 > parameter means
 194         access will be permitted as the default guest user (specified
 195         elsewhere):</P
 196 ><TABLE
 197 BORDER="0"
 198 BGCOLOR="#E0E0E0"
 199 WIDTH="100%"
 200 ><TR
 201 ><TD
 202 ><PRE
 203 CLASS="SCREEN"
 204 >       <TT
 205 CLASS="COMPUTEROUTPUT"
 206 >       [aprinter]
 207                 path = /usr/spool/public
 208                 writeable = false
 209                 printable = true
 210                 guest ok = true
 211         </TT
 212 >
 213         </PRE
 214 ></TD
 215 ></TR
 216 ></TABLE
 217 ></DIV
 218 ><DIV
 219 CLASS="REFSECT1"
 220 ><A
 221 NAME="AEN48"
 222 ></A
 223 ><H2
 224 >SPECIAL SECTIONS</H2
 225 ><DIV
 226 CLASS="REFSECT2"
 227 ><A
 228 NAME="AEN50"
 229 ></A
 230 ><H3
 231 >The [global] section</H3
 232 ><P
 233 >parameters in this section apply to the server
 234                 as a whole, or are defaults for sections which do not
 235                 specifically define certain items. See the notes
 236                 under PARAMETERS for more information.</P
 237 ></DIV
 238 ><DIV
 239 CLASS="REFSECT2"
 240 ><A
 241 NAME="AEN53"
 242 ></A
 243 ><H3
 244 >The [homes] section</H3
 245 ><P
 246 >If a section called homes is included in the
 247                 configuration file, services connecting clients to their
 248                 home directories can be created on the fly by the server.</P
 249 ><P
 250 >When the connection request is made, the existing
 251                 sections are scanned. If a match is found, it is used. If no
 252                 match is found, the requested section name is treated as a
 253                 user name and looked up in the local password file. If the
 254                 name exists and the correct password has been given, a share is
 255                 created by cloning the [homes] section.</P
 256 ><P
 257 >Some modifications are then made to the newly
 258                 created share:</P
 259 ><P
 260 ></P
 261 ><UL
 262 ><LI
 263 ><P
 264 >The share name is changed from homes to
 265                 the located username.</P
 266 ></LI
 267 ><LI
 268 ><P
 269 >If no path was given, the path is set to
 270                 the user's home directory.</P
 271 ></LI
 272 ></UL
 273 ><P
 274 >If you decide to use a <EM
 275 >path=</EM
 276 > line
 277                 in your [homes] section then you may find it useful
 278                 to use the %S macro. For example :</P
 279 ><P
 280 ><TT
 281 CLASS="USERINPUT"
 282 ><B
 283 >path=/data/pchome/%S</B
 284 ></TT
 285 ></P
 286 ><P
 287 >would be useful if you have different home directories
 288                 for your PCs than for UNIX access.</P
 289 ><P
 290 >This is a fast and simple way to give a large number
 291                 of clients access to their home directories with a minimum
 292                 of fuss.</P
 293 ><P
 294 >A similar process occurs if the requested section
 295                 name is "homes", except that the share name is not
 296                 changed to that of the requesting user. This method of using
 297                 the [homes] section works well if different users share
 298                 a client PC.</P
 299 ><P
 300 >The [homes] section can specify all the parameters
 301                 a normal service section can specify, though some make more sense
 302                 than others. The following is a typical and suitable [homes]
 303                 section:</P
 304 ><TABLE
 305 BORDER="0"
 306 BGCOLOR="#E0E0E0"
 307 WIDTH="100%"
 308 ><TR
 309 ><TD
 310 ><PRE
 311 CLASS="SCREEN"
 312 >               <TT
 313 CLASS="COMPUTEROUTPUT"
 314 >               [homes]
 315                         writeable = yes
 316                 </TT
 317 >
 318                 </PRE
 319 ></TD
 320 ></TR
 321 ></TABLE
 322 ><P
 323 >An important point is that if guest access is specified
 324                 in the [homes] section, all home directories will be
 325                 visible to all clients <EM
 326 >without a password</EM
 327 >.
 328                 In the very unlikely event that this is actually desirable, it
 329                 would be wise to also specify <EM
 330 >read only
 331                 access</EM
 332 >.</P
 333 ><P
 334 >Note that the <EM
 335 >browseable</EM
 336 > flag for
 337                 auto home directories will be inherited from the global browseable
 338                 flag, not the [homes] browseable flag. This is useful as
 339                 it means setting browseable=no in the [homes] section
 340                 will hide the [homes] share but make any auto home
 341                 directories visible.</P
 342 ></DIV
 343 ><DIV
 344 CLASS="REFSECT2"
 345 ><A
 346 NAME="AEN78"
 347 ></A
 348 ><H3
 349 >The [printers] section</H3
 350 ><P
 351 >This section works like [homes],
 352                 but for printers.</P
 353 ><P
 354 >If a [printers] section occurs in the
 355                 configuration file, users are able to connect to any printer
 356                 specified in the local host's printcap file.</P
 357 ><P
 358 >When a connection request is made, the existing sections
 359                 are scanned. If a match is found, it is used. If no match is found,
 360                 but a [homes] section exists, it is used as described
 361                 above. Otherwise, the requested section name is treated as a
 362                 printer name and the appropriate printcap file is scanned to see
 363                 if the requested section name is a valid printer share name. If
 364                 a match is found, a new printer share is created by cloning
 365                 the [printers] section.</P
 366 ><P
 367 >A few modifications are then made to the newly created
 368                 share:</P
 369 ><P
 370 ></P
 371 ><UL
 372 ><LI
 373 ><P
 374 >The share name is set to the located printer
 375                 name</P
 376 ></LI
 377 ><LI
 378 ><P
 379 >If no printer name was given, the printer name
 380                 is set to the located printer name</P
 381 ></LI
 382 ><LI
 383 ><P
 384 >If the share does not permit guest access and
 385                 no username was given, the username is set to the located
 386                 printer name.</P
 387 ></LI
 388 ></UL
 389 ><P
 390 >Note that the [printers] service MUST be
 391                 printable - if you specify otherwise, the server will refuse
 392                 to load the configuration file.</P
 393 ><P
 394 >Typically the path specified would be that of a
 395                 world-writeable spool directory with the sticky bit set on
 396                 it. A typical [printers] entry would look like
 397                 this:</P
 398 ><TABLE
 399 BORDER="0"
 400 BGCOLOR="#E0E0E0"
 401 WIDTH="100%"
 402 ><TR
 403 ><TD
 404 ><PRE
 405 CLASS="SCREEN"
 406 ><TT
 407 CLASS="COMPUTEROUTPUT"
 408 >               [printers]
 409                         path = /usr/spool/public
 410                         guest ok = yes
 411                         printable = yes
 412                 </TT
 413 ></PRE
 414 ></TD
 415 ></TR
 416 ></TABLE
 417 ><P
 418 >All aliases given for a printer in the printcap file
 419                 are legitimate printer names as far as the server is concerned.
 420                 If your printing subsystem doesn't work like that, you will have
 421                 to set up a pseudo-printcap. This is a file consisting of one or
 422                 more lines like this:</P
 423 ><TABLE
 424 BORDER="0"
 425 BGCOLOR="#E0E0E0"
 426 WIDTH="100%"
 427 ><TR
 428 ><TD
 429 ><PRE
 430 CLASS="SCREEN"
 431 >               <TT
 432 CLASS="COMPUTEROUTPUT"
 433 >               alias|alias|alias|alias...
 434                 </TT
 435 >
 436                 </PRE
 437 ></TD
 438 ></TR
 439 ></TABLE
 440 ><P
 441 >Each alias should be an acceptable printer name for
 442                 your printing subsystem. In the [global] section, specify
 443                 the new file as your printcap.  The server will then only recognize
 444                 names found in your pseudo-printcap, which of course can contain
 445                 whatever aliases you like. The same technique could be used
 446                 simply to limit access to a subset of your local printers.</P
 447 ><P
 448 >An alias, by the way, is defined as any component of the
 449                 first entry of a printcap record. Records are separated by newlines,
 450                 components (if there are more than one) are separated by vertical
 451                 bar symbols ('|').</P
 452 ><P
 453 >NOTE: On SYSV systems which use lpstat to determine what
 454                 printers are defined on the system you may be able to use
 455                 "printcap name = lpstat" to automatically obtain a list
 456                 of printers. See the "printcap name" option
 457                 for more details.</P
 458 ></DIV
 459 ></DIV
 460 ><DIV
 461 CLASS="REFSECT1"
 462 ><A
 463 NAME="AEN101"
 464 ></A
 465 ><H2
 466 >PARAMETERS</H2
 467 ><P
 468 >parameters define the specific attributes of sections.</P
 469 ><P
 470 >Some parameters are specific to the [global] section
 471         (e.g., <EM
 472 >security</EM
 473 >).  Some parameters are usable
 474         in all sections (e.g., <EM
 475 >create mode</EM
 476 >). All others
 477         are permissible only in normal sections. For the purposes of the
 478         following descriptions the [homes] and [printers]
 479         sections will be considered normal.  The letter <EM
 480 >G</EM
 481 >
 482         in parentheses indicates that a parameter is specific to the
 483         [global] section. The letter <EM
 484 >S</EM
 485 >
 486         indicates that a parameter can be specified in a service specific
 487         section. Note that all <EM
 488 >S</EM
 489 > parameters can also be specified in
 490         the [global] section - in which case they will define
 491         the default behavior for all services.</P
 492 ><P
 493 >parameters are arranged here in alphabetical order - this may
 494         not create best bedfellows, but at least you can find them! Where
 495         there are synonyms, the preferred synonym is described, others refer
 496         to the preferred synonym.</P
 497 ></DIV
 498 ><DIV
 499 CLASS="REFSECT1"
 500 ><A
 501 NAME="AEN111"
 502 ></A
 503 ><H2
 504 >VARIABLE SUBSTITUTIONS</H2
 505 ><P
 506 >Many of the strings that are settable in the config file
 507         can take substitutions. For example the option "path =
 508         /tmp/%u" would be interpreted as "path =
 509         /tmp/john" if the user connected with the username john.</P
 510 ><P
 511 >These substitutions are mostly noted in the descriptions below,
 512         but there are some general substitutions which apply whenever they
 513         might be relevant. These are:</P
 514 ><P
 515 ></P
 516 ><DIV
 517 CLASS="VARIABLELIST"
 518 ><DL
 519 ><DT
 520 >%S</DT
 521 ><DD
 522 ><P
 523 >the name of the current service, if any.</P
 524 ></DD
 525 ><DT
 526 >%P</DT
 527 ><DD
 528 ><P
 529 >the root directory of the current service,
 530                 if any.</P
 531 ></DD
 532 ><DT
 533 >%u</DT
 534 ><DD
 535 ><P
 536 >user name of the current service, if any.</P
 537 ></DD
 538 ><DT
 539 >%g</DT
 540 ><DD
 541 ><P
 542 >primary group name of %u.</P
 543 ></DD
 544 ><DT
 545 >%U</DT
 546 ><DD
 547 ><P
 548 >session user name (the user name that the client
 549                 wanted, not necessarily the same as the one they got).</P
 550 ></DD
 551 ><DT
 552 >%G</DT
 553 ><DD
 554 ><P
 555 >primary group name of %U.</P
 556 ></DD
 557 ><DT
 558 >%H</DT
 559 ><DD
 560 ><P
 561 >the home directory of the user given
 562                 by %u.</P
 563 ></DD
 564 ><DT
 565 >%v</DT
 566 ><DD
 567 ><P
 568 >the Samba version.</P
 569 ></DD
 570 ><DT
 571 >%h</DT
 572 ><DD
 573 ><P
 574 >the Internet hostname that Samba is running
 575                 on.</P
 576 ></DD
 577 ><DT
 578 >%m</DT
 579 ><DD
 580 ><P
 581 >the NetBIOS name of the client machine
 582                 (very useful).</P
 583 ></DD
 584 ><DT
 585 >%L</DT
 586 ><DD
 587 ><P
 588 >the NetBIOS name of the server. This allows you
 589                 to change your config based on what the client calls you. Your
 590                 server can have a "dual personality".</P
 591 ></DD
 592 ><DT
 593 >%M</DT
 594 ><DD
 595 ><P
 596 >the Internet name of the client machine.
 597                 </P
 598 ></DD
 599 ><DT
 600 >%N</DT
 601 ><DD
 602 ><P
 603 >the name of your NIS home directory server.
 604                 This is obtained from your NIS auto.map entry.  If you have
 605                 not compiled Samba with the <EM
 606 >--with-automount</EM
 607 >
 608                 option then this value will be the same as %.</P
 609 ></DD
 610 ><DT
 611 >%p</DT
 612 ><DD
 613 ><P
 614 >the path of the service's home directory,
 615                 obtained from your NIS auto.map entry. The NIS auto.map entry
 616                 is split up as "%N:%p".</P
 617 ></DD
 618 ><DT
 619 >%R</DT
 620 ><DD
 621 ><P
 622 >the selected protocol level after
 623                 protocol negotiation. It can be one of CORE, COREPLUS,
 624                 LANMAN1, LANMAN2 or NT1.</P
 625 ></DD
 626 ><DT
 627 >%d</DT
 628 ><DD
 629 ><P
 630 >The process id of the current server
 631                 process.</P
 632 ></DD
 633 ><DT
 634 >%a</DT
 635 ><DD
 636 ><P
 637 >the architecture of the remote
 638                 machine. Only some are recognized, and those may not be
 639                 100% reliable. It currently recognizes Samba, WfWg,
 640                 WinNT and Win95. Anything else will be known as
 641                 "UNKNOWN". If it gets it wrong then sending a level
 642                 3 log to <A
 643 HREF="mailto:samba@samba.org"
 644 TARGET="_top"
 645 >samba@samba.org
 646                 </A
 647 > should allow it to be fixed.</P
 648 ></DD
 649 ><DT
 650 >%I</DT
 651 ><DD
 652 ><P
 653 >The IP address of the client machine.</P
 654 ></DD
 655 ><DT
 656 >%T</DT
 657 ><DD
 658 ><P
 659 >the current date and time.</P
 660 ></DD
 661 ><DT
 662 >%$(<TT
 663 CLASS="REPLACEABLE"
 664 ><I
 665 >envvar</I
 666 ></TT
 667 >)</DT
 668 ><DD
 669 ><P
 670 >The value of the environment variable
 671                 <TT
 672 CLASS="REPLACEABLE"
 673 ><I
 674 >envar</I
 675 ></TT
 676 >.</P
 677 ></DD
 678 ></DL
 679 ></DIV
 680 ><P
 681 >There are some quite creative things that can be done
 682         with these substitutions and other smb.conf options.</P
 683 ></DIV
 684 ><DIV
 685 CLASS="REFSECT1"
 686 ><A
 687 NAME="AEN201"
 688 ></A
 689 ><H2
 690 >NAME MANGLING</H2
 691 ><P
 692 >Samba supports "name mangling" so that DOS and
 693         Windows clients can use files that don't conform to the 8.3 format.
 694         It can also be set to adjust the case of 8.3 format filenames.</P
 695 ><P
 696 >There are several options that control the way mangling is
 697         performed, and they are grouped here rather than listed separately.
 698         For the defaults look at the output of the testparm program. </P
 699 ><P
 700 >All of these options can be set separately for each service
 701         (or globally, of course). </P
 702 ><P
 703 >The options are: </P
 704 ><P
 705 ></P
 706 ><DIV
 707 CLASS="VARIABLELIST"
 708 ><DL
 709 ><DT
 710 >mangle case= yes/no</DT
 711 ><DD
 712 ><P
 713 > controls if names that have characters that
 714                 aren't of the "default" case are mangled. For example,
 715                 if this is yes then a name like "Mail" would be mangled.
 716                 Default <EM
 717 >no</EM
 718 >.</P
 719 ></DD
 720 ><DT
 721 >case sensitive = yes/no</DT
 722 ><DD
 723 ><P
 724 >controls whether filenames are case sensitive. If
 725                 they aren't then Samba must do a filename search and match on passed
 726                 names. Default <EM
 727 >no</EM
 728 >.</P
 729 ></DD
 730 ><DT
 731 >default case = upper/lower</DT
 732 ><DD
 733 ><P
 734 >controls what the default case is for new
 735                 filenames. Default <EM
 736 >lower</EM
 737 >.</P
 738 ></DD
 739 ><DT
 740 >preserve case = yes/no</DT
 741 ><DD
 742 ><P
 743 >controls if new files are created with the
 744                 case that the client passes, or if they are forced to be the
 745                 "default" case. Default <EM
 746 >yes</EM
 747 >.
 748                 </P
 749 ></DD
 750 ><DT
 751 >short preserve case = yes/no</DT
 752 ><DD
 753 ><P
 754 >controls if new files which conform to 8.3 syntax,
 755                 that is all in upper case and of suitable length, are created
 756                 upper case, or if they are forced to be the "default"
 757                 case. This option can be use with "preserve case = yes"
 758                 to permit long filenames to retain their case, while short names
 759                 are lowered. Default <EM
 760 >yes</EM
 761 >.</P
 762 ></DD
 763 ></DL
 764 ></DIV
 765 ><P
 766 >By default, Samba 2.2 has the same semantics as a Windows
 767         NT server, in that it is case insensitive but case preserving.</P
 768 ></DIV
 769 ><DIV
 770 CLASS="REFSECT1"
 771 ><A
 772 NAME="AEN234"
 773 ></A
 774 ><H2
 775 >NOTE ABOUT USERNAME/PASSWORD VALIDATION</H2
 776 ><P
 777 >There are a number of ways in which a user can connect
 778         to a service. The server uses the following steps in determining
 779         if it will allow a connection to a specified service. If all the
 780         steps fail, then the connection request is rejected.  However, if one of the
 781         steps succeeds, then the following steps are not checked.</P
 782 ><P
 783 >If the service is marked "guest only = yes" then
 784         steps 1 to 5 are skipped.</P
 785 ><P
 786 ></P
 787 ><OL
 788 TYPE="1"
 789 ><LI
 790 ><P
 791 >If the client has passed a username/password
 792                 pair and that username/password pair is validated by the UNIX
 793                 system's password programs then the connection is made as that
 794                 username. Note that this includes the
 795                 \\server\service%<TT
 796 CLASS="REPLACEABLE"
 797 ><I
 798 >username</I
 799 ></TT
 800 > method of passing
 801                 a username.</P
 802 ></LI
 803 ><LI
 804 ><P
 805 >If the client has previously registered a username
 806                 with the system and now supplies a correct password for that
 807                 username then the connection is allowed.</P
 808 ></LI
 809 ><LI
 810 ><P
 811 >The client's netbios name and any previously
 812                 used user names are checked against the supplied password, if
 813                 they match then the connection is allowed as the corresponding
 814                 user.</P
 815 ></LI
 816 ><LI
 817 ><P
 818 >If the client has previously validated a
 819                 username/password pair with the server and the client has passed
 820                 the validation token then that username is used. </P
 821 ></LI
 822 ><LI
 823 ><P
 824 >If a "user = " field is given in the
 825                 <TT
 826 CLASS="FILENAME"
 827 >smb.conf</TT
 828 > file for the service and the client
 829                 has supplied a password, and that password matches (according to
 830                 the UNIX system's password checking) with one of the usernames
 831                 from the "user=" field then the connection is made as
 832                 the username in the "user=" line. If one
 833                 of the username in the "user=" list begins with a
 834                 '@' then that name expands to a list of names in
 835                 the group of the same name.</P
 836 ></LI
 837 ><LI
 838 ><P
 839 >If the service is a guest service then a
 840                 connection is made as the username given in the "guest
 841                 account =" for the service, irrespective of the
 842                 supplied password.</P
 843 ></LI
 844 ></OL
 845 ></DIV
 846 ><DIV
 847 CLASS="REFSECT1"
 848 ><A
 849 NAME="AEN253"
 850 ></A
 851 ><H2
 852 >COMPLETE LIST OF GLOBAL PARAMETERS</H2
 853 ><P
 854 >Here is a list of all global parameters. See the section of
 855         each parameter for details.  Note that some are synonyms.</P
 856 ><P
 857 ></P
 858 ><UL
 859 ><LI
 860 ><P
 861 ><A
 862 HREF="#ADDPRINTERCOMMAND"
 863 ><TT
 864 CLASS="PARAMETER"
 865 ><I
 866 >add printer command</I
 867 ></TT
 868 ></A
 869 ></P
 870 ></LI
 871 ><LI
 872 ><P
 873 ><A
 874 HREF="#ADDSHARECOMMAND"
 875 ><TT
 876 CLASS="PARAMETER"
 877 ><I
 878 >add share command</I
 879 ></TT
 880 ></A
 881 ></P
 882 ></LI
 883 ><LI
 884 ><P
 885 ><A
 886 HREF="#ADDUSERSCRIPT"
 887 ><TT
 888 CLASS="PARAMETER"
 889 ><I
 890 >add user script</I
 891 ></TT
 892 ></A
 893 ></P
 894 ></LI
 895 ><LI
 896 ><P
 897 ><A
 898 HREF="#ALLOWTRUSTEDDOMAINS"
 899 ><TT
 900 CLASS="PARAMETER"
 901 ><I
 902 >allow trusted domains</I
 903 ></TT
 904 ></A
 905 ></P
 906 ></LI
 907 ><LI
 908 ><P
 909 ><A
 910 HREF="#ANNOUNCEAS"
 911 ><TT
 912 CLASS="PARAMETER"
 913 ><I
 914 >announce as</I
 915 ></TT
 916 ></A
 917 ></P
 918 ></LI
 919 ><LI
 920 ><P
 921 ><A
 922 HREF="#ANNOUNCEVERSION"
 923 ><TT
 924 CLASS="PARAMETER"
 925 ><I
 926 >announce version</I
 927 ></TT
 928 ></A
 929 ></P
 930 ></LI
 931 ><LI
 932 ><P
 933 ><A
 934 HREF="#AUTOSERVICES"
 935 ><TT
 936 CLASS="PARAMETER"
 937 ><I
 938 >auto services</I
 939 ></TT
 940 ></A
 941 ></P
 942 ></LI
 943 ><LI
 944 ><P
 945 ><A
 946 HREF="#BINDINTERFACESONLY"
 947 ><TT
 948 CLASS="PARAMETER"
 949 ><I
 950 >bind interfaces only</I
 951 ></TT
 952 ></A
 953 ></P
 954 ></LI
 955 ><LI
 956 ><P
 957 ><A
 958 HREF="#BROWSELIST"
 959 ><TT
 960 CLASS="PARAMETER"
 961 ><I
 962 >browse list</I
 963 ></TT
 964 ></A
 965 ></P
 966 ></LI
 967 ><LI
 968 ><P
 969 ><A
 970 HREF="#CHANGENOTIFYTIMEOUT"
 971 ><TT
 972 CLASS="PARAMETER"
 973 ><I
 974 >change notify timeout</I
 975 ></TT
 976 ></A
 977 ></P
 978 ></LI
 979 ><LI
 980 ><P
 981 ><A
 982 HREF="#CHANGESHARECOMMAND"
 983 ><TT
 984 CLASS="PARAMETER"
 985 ><I
 986 >change share command</I
 987 ></TT
 988 ></A
 989 ></P
 990 ></LI
 991 ><LI
 992 ><P
 993 ><A
 994 HREF="#CHARACTERSET"
 995 ><TT
 996 CLASS="PARAMETER"
 997 ><I
 998 >character set</I
 999 ></TT
1000 ></A
1001 ></P
1002 ></LI
1003 ><LI
1004 ><P
1005 ><A
1006 HREF="#CLIENTCODEPAGE"
1007 ><TT
1008 CLASS="PARAMETER"
1009 ><I
1010 >client code page</I
1011 ></TT
1012 ></A
1013 ></P
1014 ></LI
1015 ><LI
1016 ><P
1017 ><A
1018 HREF="#CODEPAGEDIRECTORY"
1019 ><TT
1020 CLASS="PARAMETER"
1021 ><I
1022 >code page directory</I
1023 ></TT
1024 ></A
1025 ></P
1026 ></LI
1027 ><LI
1028 ><P
1029 ><A
1030 HREF="#CODINGSYSTEM"
1031 ><TT
1032 CLASS="PARAMETER"
1033 ><I
1034 >coding system</I
1035 ></TT
1036 ></A
1037 ></P
1038 ></LI
1039 ><LI
1040 ><P
1041 ><A
1042 HREF="#CONFIGFILE"
1043 ><TT
1044 CLASS="PARAMETER"
1045 ><I
1046 >config file</I
1047 ></TT
1048 ></A
1049 ></P
1050 ></LI
1051 ><LI
1052 ><P
1053 ><A
1054 HREF="#DEADTIME"
1055 ><TT
1056 CLASS="PARAMETER"
1057 ><I
1058 >deadtime</I
1059 ></TT
1060 ></A
1061 ></P
1062 ></LI
1063 ><LI
1064 ><P
1065 ><A
1066 HREF="#DEBUGHIRESTIMESTAMP"
1067 ><TT
1068 CLASS="PARAMETER"
1069 ><I
1070 >debug hires timestamp</I
1071 ></TT
1072 ></A
1073 ></P
1074 ></LI
1075 ><LI
1076 ><P
1077 ><A
1078 HREF="#DEBUGPID"
1079 ><TT
1080 CLASS="PARAMETER"
1081 ><I
1082 >debug pid</I
1083 ></TT
1084 ></A
1085 ></P
1086 ></LI
1087 ><LI
1088 ><P
1089 ><A
1090 HREF="#DEBUGTIMESTAMP"
1091 ><TT
1092 CLASS="PARAMETER"
1093 ><I
1094 >debug timestamp</I
1095 ></TT
1096 ></A
1097 ></P
1098 ></LI
1099 ><LI
1100 ><P
1101 ><A
1102 HREF="#DEBUGUID"
1103 ><TT
1104 CLASS="PARAMETER"
1105 ><I
1106 >debug uid</I
1107 ></TT
1108 ></A
1109 ></P
1110 ></LI
1111 ><LI
1112 ><P
1113 ><A
1114 HREF="#DEBUGLEVEL"
1115 ><TT
1116 CLASS="PARAMETER"
1117 ><I
1118 >debuglevel</I
1119 ></TT
1120 ></A
1121 ></P
1122 ></LI
1123 ><LI
1124 ><P
1125 ><A
1126 HREF="#DEFAULT"
1127 ><TT
1128 CLASS="PARAMETER"
1129 ><I
1130 >default</I
1131 ></TT
1132 ></A
1133 ></P
1134 ></LI
1135 ><LI
1136 ><P
1137 ><A
1138 HREF="#DEFAULTSERVICE"
1139 ><TT
1140 CLASS="PARAMETER"
1141 ><I
1142 >default service</I
1143 ></TT
1144 ></A
1145 ></P
1146 ></LI
1147 ><LI
1148 ><P
1149 ><A
1150 HREF="#DELETEPRINTERCOMMAND"
1151 ><TT
1152 CLASS="PARAMETER"
1153 ><I
1154 >delete printer command</I
1155 ></TT
1156 ></A
1157 ></P
1158 ></LI
1159 ><LI
1160 ><P
1161 ><A
1162 HREF="#DELETESHARECOMMAND"
1163 ><TT
1164 CLASS="PARAMETER"
1165 ><I
1166 >delete share command</I
1167 ></TT
1168 ></A
1169 ></P
1170 ></LI
1171 ><LI
1172 ><P
1173 ><A
1174 HREF="#DELETEUSERSCRIPT"
1175 ><TT
1176 CLASS="PARAMETER"
1177 ><I
1178 >delete user script</I
1179 ></TT
1180 ></A
1181 ></P
1182 ></LI
1183 ><LI
1184 ><P
1185 ><A
1186 HREF="#DFREECOMMAND"
1187 ><TT
1188 CLASS="PARAMETER"
1189 ><I
1190 >dfree command</I
1191 ></TT
1192 ></A
1193 ></P
1194 ></LI
1195 ><LI
1196 ><P
1197 ><A
1198 HREF="#DNSPROXY"
1199 ><TT
1200 CLASS="PARAMETER"
1201 ><I
1202 >dns proxy</I
1203 ></TT
1204 ></A
1205 ></P
1206 ></LI
1207 ><LI
1208 ><P
1209 ><A
1210 HREF="#DOMAINADMINGROUP"
1211 ><TT
1212 CLASS="PARAMETER"
1213 ><I
1214 >domain admin group</I
1215 ></TT
1216 ></A
1217 ></P
1218 ></LI
1219 ><LI
1220 ><P
1221 ><A
1222 HREF="#DOMAINGUESTGROUP"
1223 ><TT
1224 CLASS="PARAMETER"
1225 ><I
1226 >domain guest group</I
1227 ></TT
1228 ></A
1229 ></P
1230 ></LI
1231 ><LI
1232 ><P
1233 ><A
1234 HREF="#DOMAINLOGONS"
1235 ><TT
1236 CLASS="PARAMETER"
1237 ><I
1238 >domain logons</I
1239 ></TT
1240 ></A
1241 ></P
1242 ></LI
1243 ><LI
1244 ><P
1245 ><A
1246 HREF="#DOMAINMASTER"
1247 ><TT
1248 CLASS="PARAMETER"
1249 ><I
1250 >domain master</I
1251 ></TT
1252 ></A
1253 ></P
1254 ></LI
1255 ><LI
1256 ><P
1257 ><A
1258 HREF="#ENCRYPTPASSWORDS"
1259 ><TT
1260 CLASS="PARAMETER"
1261 ><I
1262 >encrypt passwords</I
1263 ></TT
1264 ></A
1265 ></P
1266 ></LI
1267 ><LI
1268 ><P
1269 ><A
1270 HREF="#ENHANCEDBROWSING"
1271 ><TT
1272 CLASS="PARAMETER"
1273 ><I
1274 >enhanced browsing</I
1275 ></TT
1276 ></A
1277 ></P
1278 ></LI
1279 ><LI
1280 ><P
1281 ><A
1282 HREF="#ENUMPORTSCOMMAND"
1283 ><TT
1284 CLASS="PARAMETER"
1285 ><I
1286 >enumports command</I
1287 ></TT
1288 ></A
1289 ></P
1290 ></LI
1291 ><LI
1292 ><P
1293 ><A
1294 HREF="#GETWDCACHE"
1295 ><TT
1296 CLASS="PARAMETER"
1297 ><I
1298 >getwd cache</I
1299 ></TT
1300 ></A
1301 ></P
1302 ></LI
1303 ><LI
1304 ><P
1305 ><A
1306 HREF="#HIDELOCALUSERS"
1307 ><TT
1308 CLASS="PARAMETER"
1309 ><I
1310 >hide local users</I
1311 ></TT
1312 ></A
1313 ></P
1314 ></LI
1315 ><LI
1316 ><P
1317 ><A
1318 HREF="#HOMEDIRMAP"
1319 ><TT
1320 CLASS="PARAMETER"
1321 ><I
1322 >homedir map</I
1323 ></TT
1324 ></A
1325 ></P
1326 ></LI
1327 ><LI
1328 ><P
1329 ><A
1330 HREF="#HOSTMSDFS"
1331 ><TT
1332 CLASS="PARAMETER"
1333 ><I
1334 >host msdfs</I
1335 ></TT
1336 ></A
1337 ></P
1338 ></LI
1339 ><LI
1340 ><P
1341 ><A
1342 HREF="#HOSTSEQUIV"
1343 ><TT
1344 CLASS="PARAMETER"
1345 ><I
1346 >hosts equiv</I
1347 ></TT
1348 ></A
1349 ></P
1350 ></LI
1351 ><LI
1352 ><P
1353 ><A
1354 HREF="#INTERFACES"
1355 ><TT
1356 CLASS="PARAMETER"
1357 ><I
1358 >interfaces</I
1359 ></TT
1360 ></A
1361 ></P
1362 ></LI
1363 ><LI
1364 ><P
1365 ><A
1366 HREF="#KEEPALIVE"
1367 ><TT
1368 CLASS="PARAMETER"
1369 ><I
1370 >keepalive</I
1371 ></TT
1372 ></A
1373 ></P
1374 ></LI
1375 ><LI
1376 ><P
1377 ><A
1378 HREF="#KERNELOPLOCKS"
1379 ><TT
1380 CLASS="PARAMETER"
1381 ><I
1382 >kernel oplocks</I
1383 ></TT
1384 ></A
1385 ></P
1386 ></LI
1387 ><LI
1388 ><P
1389 ><A
1390 HREF="#LANMANAUTH"
1391 ><TT
1392 CLASS="PARAMETER"
1393 ><I
1394 >lanman auth</I
1395 ></TT
1396 ></A
1397 ></P
1398 ></LI
1399 ><LI
1400 ><P
1401 ><A
1402 HREF="#LMANNOUNCE"
1403 ><TT
1404 CLASS="PARAMETER"
1405 ><I
1406 >lm announce</I
1407 ></TT
1408 ></A
1409 ></P
1410 ></LI
1411 ><LI
1412 ><P
1413 ><A
1414 HREF="#LMINTERVAL"
1415 ><TT
1416 CLASS="PARAMETER"
1417 ><I
1418 >lm interval</I
1419 ></TT
1420 ></A
1421 ></P
1422 ></LI
1423 ><LI
1424 ><P
1425 ><A
1426 HREF="#LOADPRINTERS"
1427 ><TT
1428 CLASS="PARAMETER"
1429 ><I
1430 >load printers</I
1431 ></TT
1432 ></A
1433 ></P
1434 ></LI
1435 ><LI
1436 ><P
1437 ><A
1438 HREF="#LOCALMASTER"
1439 ><TT
1440 CLASS="PARAMETER"
1441 ><I
1442 >local master</I
1443 ></TT
1444 ></A
1445 ></P
1446 ></LI
1447 ><LI
1448 ><P
1449 ><A
1450 HREF="#LOCKDIR"
1451 ><TT
1452 CLASS="PARAMETER"
1453 ><I
1454 >lock dir</I
1455 ></TT
1456 ></A
1457 ></P
1458 ></LI
1459 ><LI
1460 ><P
1461 ><A
1462 HREF="#LOCKDIRECTORY"
1463 ><TT
1464 CLASS="PARAMETER"
1465 ><I
1466 >lock directory</I
1467 ></TT
1468 ></A
1469 ></P
1470 ></LI
1471 ><LI
1472 ><P
1473 ><A
1474 HREF="#LOGFILE"
1475 ><TT
1476 CLASS="PARAMETER"
1477 ><I
1478 >log file</I
1479 ></TT
1480 ></A
1481 ></P
1482 ></LI
1483 ><LI
1484 ><P
1485 ><A
1486 HREF="#LOGLEVEL"
1487 ><TT
1488 CLASS="PARAMETER"
1489 ><I
1490 >log level</I
1491 ></TT
1492 ></A
1493 ></P
1494 ></LI
1495 ><LI
1496 ><P
1497 ><A
1498 HREF="#LOGONDRIVE"
1499 ><TT
1500 CLASS="PARAMETER"
1501 ><I
1502 >logon drive</I
1503 ></TT
1504 ></A
1505 ></P
1506 ></LI
1507 ><LI
1508 ><P
1509 ><A
1510 HREF="#LOGONHOME"
1511 ><TT
1512 CLASS="PARAMETER"
1513 ><I
1514 >logon home</I
1515 ></TT
1516 ></A
1517 ></P
1518 ></LI
1519 ><LI
1520 ><P
1521 ><A
1522 HREF="#LOGONPATH"
1523 ><TT
1524 CLASS="PARAMETER"
1525 ><I
1526 >logon path</I
1527 ></TT
1528 ></A
1529 ></P
1530 ></LI
1531 ><LI
1532 ><P
1533 ><A
1534 HREF="#LOGONSCRIPT"
1535 ><TT
1536 CLASS="PARAMETER"
1537 ><I
1538 >logon script</I
1539 ></TT
1540 ></A
1541 ></P
1542 ></LI
1543 ><LI
1544 ><P
1545 ><A
1546 HREF="#LPQCACHETIME"
1547 ><TT
1548 CLASS="PARAMETER"
1549 ><I
1550 >lpq cache time</I
1551 ></TT
1552 ></A
1553 ></P
1554 ></LI
1555 ><LI
1556 ><P
1557 ><A
1558 HREF="#MACHINEPASSWORDTIMEOUT"
1559 ><TT
1560 CLASS="PARAMETER"
1561 ><I
1562 >machine password timeout</I
1563 ></TT
1564 ></A
1565 ></P
1566 ></LI
1567 ><LI
1568 ><P
1569 ><A
1570 HREF="#MANGLEDSTACK"
1571 ><TT
1572 CLASS="PARAMETER"
1573 ><I
1574 >mangled stack</I
1575 ></TT
1576 ></A
1577 ></P
1578 ></LI
1579 ><LI
1580 ><P
1581 ><A
1582 HREF="#MAPTOGUEST"
1583 ><TT
1584 CLASS="PARAMETER"
1585 ><I
1586 >map to guest</I
1587 ></TT
1588 ></A
1589 ></P
1590 ></LI
1591 ><LI
1592 ><P
1593 ><A
1594 HREF="#MAXDISKSIZE"
1595 ><TT
1596 CLASS="PARAMETER"
1597 ><I
1598 >max disk size</I
1599 ></TT
1600 ></A
1601 ></P
1602 ></LI
1603 ><LI
1604 ><P
1605 ><A
1606 HREF="#MAXLOGSIZE"
1607 ><TT
1608 CLASS="PARAMETER"
1609 ><I
1610 >max log size</I
1611 ></TT
1612 ></A
1613 ></P
1614 ></LI
1615 ><LI
1616 ><P
1617 ><A
1618 HREF="#MAXMUX"
1619 ><TT
1620 CLASS="PARAMETER"
1621 ><I
1622 >max mux</I
1623 ></TT
1624 ></A
1625 ></P
1626 ></LI
1627 ><LI
1628 ><P
1629 ><A
1630 HREF="#MAXOPENFILES"
1631 ><TT
1632 CLASS="PARAMETER"
1633 ><I
1634 >max open files</I
1635 ></TT
1636 ></A
1637 ></P
1638 ></LI
1639 ><LI
1640 ><P
1641 ><A
1642 HREF="#MAXPROTOCOL"
1643 ><TT
1644 CLASS="PARAMETER"
1645 ><I
1646 >max protocol</I
1647 ></TT
1648 ></A
1649 ></P
1650 ></LI
1651 ><LI
1652 ><P
1653 ><A
1654 HREF="#MAXSMBDPROCESSES"
1655 ><TT
1656 CLASS="PARAMETER"
1657 ><I
1658 >max smbd processes</I
1659 ></TT
1660 ></A
1661 ></P
1662 ></LI
1663 ><LI
1664 ><P
1665 ><A
1666 HREF="#MAXTTL"
1667 ><TT
1668 CLASS="PARAMETER"
1669 ><I
1670 >max ttl</I
1671 ></TT
1672 ></A
1673 ></P
1674 ></LI
1675 ><LI
1676 ><P
1677 ><A
1678 HREF="#MAXWINSTTL"
1679 ><TT
1680 CLASS="PARAMETER"
1681 ><I
1682 >max wins ttl</I
1683 ></TT
1684 ></A
1685 ></P
1686 ></LI
1687 ><LI
1688 ><P
1689 ><A
1690 HREF="#MAXXMIT"
1691 ><TT
1692 CLASS="PARAMETER"
1693 ><I
1694 >max xmit</I
1695 ></TT
1696 ></A
1697 ></P
1698 ></LI
1699 ><LI
1700 ><P
1701 ><A
1702 HREF="#MESSAGECOMMAND"
1703 ><TT
1704 CLASS="PARAMETER"
1705 ><I
1706 >message command</I
1707 ></TT
1708 ></A
1709 ></P
1710 ></LI
1711 ><LI
1712 ><P
1713 ><A
1714 HREF="#MINPASSWDLENGTH"
1715 ><TT
1716 CLASS="PARAMETER"
1717 ><I
1718 >min passwd length</I
1719 ></TT
1720 ></A
1721 ></P
1722 ></LI
1723 ><LI
1724 ><P
1725 ><A
1726 HREF="#MINPASSWORDLENGTH"
1727 ><TT
1728 CLASS="PARAMETER"
1729 ><I
1730 >min password length</I
1731 ></TT
1732 ></A
1733 ></P
1734 ></LI
1735 ><LI
1736 ><P
1737 ><A
1738 HREF="#MINPROTOCOL"
1739 ><TT
1740 CLASS="PARAMETER"
1741 ><I
1742 >min protocol</I
1743 ></TT
1744 ></A
1745 ></P
1746 ></LI
1747 ><LI
1748 ><P
1749 ><A
1750 HREF="#MINWINSTTL"
1751 ><TT
1752 CLASS="PARAMETER"
1753 ><I
1754 >min wins ttl</I
1755 ></TT
1756 ></A
1757 ></P
1758 ></LI
1759 ><LI
1760 ><P
1761 ><A
1762 HREF="#NAMERESOLVEORDER"
1763 ><TT
1764 CLASS="PARAMETER"
1765 ><I
1766 >name resolve order</I
1767 ></TT
1768 ></A
1769 ></P
1770 ></LI
1771 ><LI
1772 ><P
1773 ><A
1774 HREF="#NETBIOSALIASES"
1775 ><TT
1776 CLASS="PARAMETER"
1777 ><I
1778 >netbios aliases</I
1779 ></TT
1780 ></A
1781 ></P
1782 ></LI
1783 ><LI
1784 ><P
1785 ><A
1786 HREF="#NETBIOSNAME"
1787 ><TT
1788 CLASS="PARAMETER"
1789 ><I
1790 >netbios name</I
1791 ></TT
1792 ></A
1793 ></P
1794 ></LI
1795 ><LI
1796 ><P
1797 ><A
1798 HREF="#NETBIOSSCOPE"
1799 ><TT
1800 CLASS="PARAMETER"
1801 ><I
1802 >netbios scope</I
1803 ></TT
1804 ></A
1805 ></P
1806 ></LI
1807 ><LI
1808 ><P
1809 ><A
1810 HREF="#NISHOMEDIR"
1811 ><TT
1812 CLASS="PARAMETER"
1813 ><I
1814 >nis homedir</I
1815 ></TT
1816 ></A
1817 ></P
1818 ></LI
1819 ><LI
1820 ><P
1821 ><A
1822 HREF="#NTACLSUPPORT"
1823 ><TT
1824 CLASS="PARAMETER"
1825 ><I
1826 >nt acl support</I
1827 ></TT
1828 ></A
1829 ></P
1830 ></LI
1831 ><LI
1832 ><P
1833 ><A
1834 HREF="#NTPIPESUPPORT"
1835 ><TT
1836 CLASS="PARAMETER"
1837 ><I
1838 >nt pipe support</I
1839 ></TT
1840 ></A
1841 ></P
1842 ></LI
1843 ><LI
1844 ><P
1845 ><A
1846 HREF="#NTSMBSUPPORT"
1847 ><TT
1848 CLASS="PARAMETER"
1849 ><I
1850 >nt smb support</I
1851 ></TT
1852 ></A
1853 ></P
1854 ></LI
1855 ><LI
1856 ><P
1857 ><A
1858 HREF="#NULLPASSWORDS"
1859 ><TT
1860 CLASS="PARAMETER"
1861 ><I
1862 >null passwords</I
1863 ></TT
1864 ></A
1865 ></P
1866 ></LI
1867 ><LI
1868 ><P
1869 ><A
1870 HREF="#OBEYPAMRESTRICTIONS"
1871 ><TT
1872 CLASS="PARAMETER"
1873 ><I
1874 >obey pam restrictions</I
1875 ></TT
1876 ></A
1877 ></P
1878 ></LI
1879 ><LI
1880 ><P
1881 ><A
1882 HREF="#OPLOCKBREAKWAITTIME"
1883 ><TT
1884 CLASS="PARAMETER"
1885 ><I
1886 >oplock break wait time</I
1887 ></TT
1888 ></A
1889 ></P
1890 ></LI
1891 ><LI
1892 ><P
1893 ><A
1894 HREF="#OSLEVEL"
1895 ><TT
1896 CLASS="PARAMETER"
1897 ><I
1898 >os level</I
1899 ></TT
1900 ></A
1901 ></P
1902 ></LI
1903 ><LI
1904 ><P
1905 ><A
1906 HREF="#OS2DRIVERMAP"
1907 ><TT
1908 CLASS="PARAMETER"
1909 ><I
1910 >os2 driver map</I
1911 ></TT
1912 ></A
1913 ></P
1914 ></LI
1915 ><LI
1916 ><P
1917 ><A
1918 HREF="#PAMPASSWORDCHANGE"
1919 ><TT
1920 CLASS="PARAMETER"
1921 ><I
1922 >pam password change</I
1923 ></TT
1924 ></A
1925 ></P
1926 ></LI
1927 ><LI
1928 ><P
1929 ><A
1930 HREF="#PANICACTION"
1931 ><TT
1932 CLASS="PARAMETER"
1933 ><I
1934 >panic action</I
1935 ></TT
1936 ></A
1937 ></P
1938 ></LI
1939 ><LI
1940 ><P
1941 ><A
1942 HREF="#PASSWDCHAT"
1943 ><TT
1944 CLASS="PARAMETER"
1945 ><I
1946 >passwd chat</I
1947 ></TT
1948 ></A
1949 ></P
1950 ></LI
1951 ><LI
1952 ><P
1953 ><A
1954 HREF="#PASSWDCHATDEBUG"
1955 ><TT
1956 CLASS="PARAMETER"
1957 ><I
1958 >passwd chat debug</I
1959 ></TT
1960 ></A
1961 ></P
1962 ></LI
1963 ><LI
1964 ><P
1965 ><A
1966 HREF="#PASSWDPROGRAM"
1967 ><TT
1968 CLASS="PARAMETER"
1969 ><I
1970 >passwd program</I
1971 ></TT
1972 ></A
1973 ></P
1974 ></LI
1975 ><LI
1976 ><P
1977 ><A
1978 HREF="#PASSWORDLEVEL"
1979 ><TT
1980 CLASS="PARAMETER"
1981 ><I
1982 >password level</I
1983 ></TT
1984 ></A
1985 ></P
1986 ></LI
1987 ><LI
1988 ><P
1989 ><A
1990 HREF="#PASSWORDSERVER"
1991 ><TT
1992 CLASS="PARAMETER"
1993 ><I
1994 >password server</I
1995 ></TT
1996 ></A
1997 ></P
1998 ></LI
1999 ><LI
2000 ><P
2001 ><A
2002 HREF="#PREFEREDMASTER"
2003 ><TT
2004 CLASS="PARAMETER"
2005 ><I
2006 >prefered master</I
2007 ></TT
2008 ></A
2009 ></P
2010 ></LI
2011 ><LI
2012 ><P
2013 ><A
2014 HREF="#PREFERREDMASTER"
2015 ><TT
2016 CLASS="PARAMETER"
2017 ><I
2018 >preferred master</I
2019 ></TT
2020 ></A
2021 ></P
2022 ></LI
2023 ><LI
2024 ><P
2025 ><A
2026 HREF="#PRELOAD"
2027 ><TT
2028 CLASS="PARAMETER"
2029 ><I
2030 >preload</I
2031 ></TT
2032 ></A
2033 ></P
2034 ></LI
2035 ><LI
2036 ><P
2037 ><A
2038 HREF="#PRINTCAP"
2039 ><TT
2040 CLASS="PARAMETER"
2041 ><I
2042 >printcap</I
2043 ></TT
2044 ></A
2045 ></P
2046 ></LI
2047 ><LI
2048 ><P
2049 ><A
2050 HREF="#PRINTCAPNAME"
2051 ><TT
2052 CLASS="PARAMETER"
2053 ><I
2054 >printcap name</I
2055 ></TT
2056 ></A
2057 ></P
2058 ></LI
2059 ><LI
2060 ><P
2061 ><A
2062 HREF="#PRINTERDRIVERFILE"
2063 ><TT
2064 CLASS="PARAMETER"
2065 ><I
2066 >printer driver file</I
2067 ></TT
2068 ></A
2069 ></P
2070 ></LI
2071 ><LI
2072 ><P
2073 ><A
2074 HREF="#PROTOCOL"
2075 ><TT
2076 CLASS="PARAMETER"
2077 ><I
2078 >protocol</I
2079 ></TT
2080 ></A
2081 ></P
2082 ></LI
2083 ><LI
2084 ><P
2085 ><A
2086 HREF="#READBMPX"
2087 ><TT
2088 CLASS="PARAMETER"
2089 ><I
2090 >read bmpx</I
2091 ></TT
2092 ></A
2093 ></P
2094 ></LI
2095 ><LI
2096 ><P
2097 ><A
2098 HREF="#READRAW"
2099 ><TT
2100 CLASS="PARAMETER"
2101 ><I
2102 >read raw</I
2103 ></TT
2104 ></A
2105 ></P
2106 ></LI
2107 ><LI
2108 ><P
2109 ><A
2110 HREF="#READSIZE"
2111 ><TT
2112 CLASS="PARAMETER"
2113 ><I
2114 >read size</I
2115 ></TT
2116 ></A
2117 ></P
2118 ></LI
2119 ><LI
2120 ><P
2121 ><A
2122 HREF="#REMOTEANNOUNCE"
2123 ><TT
2124 CLASS="PARAMETER"
2125 ><I
2126 >remote announce</I
2127 ></TT
2128 ></A
2129 ></P
2130 ></LI
2131 ><LI
2132 ><P
2133 ><A
2134 HREF="#REMOTEBROWSESYNC"
2135 ><TT
2136 CLASS="PARAMETER"
2137 ><I
2138 >remote browse sync</I
2139 ></TT
2140 ></A
2141 ></P
2142 ></LI
2143 ><LI
2144 ><P
2145 ><A
2146 HREF="#RESTRICTANONYMOUS"
2147 ><TT
2148 CLASS="PARAMETER"
2149 ><I
2150 >restrict anonymous</I
2151 ></TT
2152 ></A
2153 ></P
2154 ></LI
2155 ><LI
2156 ><P
2157 ><A
2158 HREF="#ROOT"
2159 ><TT
2160 CLASS="PARAMETER"
2161 ><I
2162 >root</I
2163 ></TT
2164 ></A
2165 ></P
2166 ></LI
2167 ><LI
2168 ><P
2169 ><A
2170 HREF="#ROOTDIR"
2171 ><TT
2172 CLASS="PARAMETER"
2173 ><I
2174 >root dir</I
2175 ></TT
2176 ></A
2177 ></P
2178 ></LI
2179 ><LI
2180 ><P
2181 ><A
2182 HREF="#ROOTDIRECTORY"
2183 ><TT
2184 CLASS="PARAMETER"
2185 ><I
2186 >root directory</I
2187 ></TT
2188 ></A
2189 ></P
2190 ></LI
2191 ><LI
2192 ><P
2193 ><A
2194 HREF="#SECURITY"
2195 ><TT
2196 CLASS="PARAMETER"
2197 ><I
2198 >security</I
2199 ></TT
2200 ></A
2201 ></P
2202 ></LI
2203 ><LI
2204 ><P
2205 ><A
2206 HREF="#SERVERSTRING"
2207 ><TT
2208 CLASS="PARAMETER"
2209 ><I
2210 >server string</I
2211 ></TT
2212 ></A
2213 ></P
2214 ></LI
2215 ><LI
2216 ><P
2217 ><A
2218 HREF="#SHOWADDPRINTERWIZARD"
2219 ><TT
2220 CLASS="PARAMETER"
2221 ><I
2222 >show add printer wizard</I
2223 ></TT
2224 ></A
2225 ></P
2226 ></LI
2227 ><LI
2228 ><P
2229 ><A
2230 HREF="#SMBPASSWDFILE"
2231 ><TT
2232 CLASS="PARAMETER"
2233 ><I
2234 >smb passwd file</I
2235 ></TT
2236 ></A
2237 ></P
2238 ></LI
2239 ><LI
2240 ><P
2241 ><A
2242 HREF="#SOCKETADDRESS"
2243 ><TT
2244 CLASS="PARAMETER"
2245 ><I
2246 >socket address</I
2247 ></TT
2248 ></A
2249 ></P
2250 ></LI
2251 ><LI
2252 ><P
2253 ><A
2254 HREF="#SOCKETOPTIONS"
2255 ><TT
2256 CLASS="PARAMETER"
2257 ><I
2258 >socket options</I
2259 ></TT
2260 ></A
2261 ></P
2262 ></LI
2263 ><LI
2264 ><P
2265 ><A
2266 HREF="#SOURCEENVIRONMENT"
2267 ><TT
2268 CLASS="PARAMETER"
2269 ><I
2270 >source environment</I
2271 ></TT
2272 ></A
2273 ></P
2274 ></LI
2275 ><LI
2276 ><P
2277 ><A
2278 HREF="#SSL"
2279 ><TT
2280 CLASS="PARAMETER"
2281 ><I
2282 >ssl</I
2283 ></TT
2284 ></A
2285 ></P
2286 ></LI
2287 ><LI
2288 ><P
2289 ><A
2290 HREF="#SSLCACERTDIR"
2291 ><TT
2292 CLASS="PARAMETER"
2293 ><I
2294 >ssl CA certDir</I
2295 ></TT
2296 ></A
2297 ></P
2298 ></LI
2299 ><LI
2300 ><P
2301 ><A
2302 HREF="#SSLCACERTFILE"
2303 ><TT
2304 CLASS="PARAMETER"
2305 ><I
2306 >ssl CA certFile</I
2307 ></TT
2308 ></A
2309 ></P
2310 ></LI
2311 ><LI
2312 ><P
2313 ><A
2314 HREF="#SSLCIPHERS"
2315 ><TT
2316 CLASS="PARAMETER"
2317 ><I
2318 >ssl ciphers</I
2319 ></TT
2320 ></A
2321 ></P
2322 ></LI
2323 ><LI
2324 ><P
2325 ><A
2326 HREF="#SSLCLIENTCERT"
2327 ><TT
2328 CLASS="PARAMETER"
2329 ><I
2330 >ssl client cert</I
2331 ></TT
2332 ></A
2333 ></P
2334 ></LI
2335 ><LI
2336 ><P
2337 ><A
2338 HREF="#SSLCLIENTKEY"
2339 ><TT
2340 CLASS="PARAMETER"
2341 ><I
2342 >ssl client key</I
2343 ></TT
2344 ></A
2345 ></P
2346 ></LI
2347 ><LI
2348 ><P
2349 ><A
2350 HREF="#SSLCOMPATIBILITY"
2351 ><TT
2352 CLASS="PARAMETER"
2353 ><I
2354 >ssl compatibility</I
2355 ></TT
2356 ></A
2357 ></P
2358 ></LI
2359 ><LI
2360 ><P
2361 ><A
2362 HREF="#SSLHOSTS"
2363 ><TT
2364 CLASS="PARAMETER"
2365 ><I
2366 >ssl hosts</I
2367 ></TT
2368 ></A
2369 ></P
2370 ></LI
2371 ><LI
2372 ><P
2373 ><A
2374 HREF="#SSLHOSTSRESIGN"
2375 ><TT
2376 CLASS="PARAMETER"
2377 ><I
2378 >ssl hosts resign</I
2379 ></TT
2380 ></A
2381 ></P
2382 ></LI
2383 ><LI
2384 ><P
2385 ><A
2386 HREF="#SSLREQUIRECLIENTCERT"
2387 ><TT
2388 CLASS="PARAMETER"
2389 ><I
2390 >ssl require clientcert</I
2391 ></TT
2392 ></A
2393 ></P
2394 ></LI
2395 ><LI
2396 ><P
2397 ><A
2398 HREF="#SSLREQUIRESERVERCERT"
2399 ><TT
2400 CLASS="PARAMETER"
2401 ><I
2402 >ssl require servercert</I
2403 ></TT
2404 ></A
2405 ></P
2406 ></LI
2407 ><LI
2408 ><P
2409 ><A
2410 HREF="#SSLSERVERCERT"
2411 ><TT
2412 CLASS="PARAMETER"
2413 ><I
2414 >ssl server cert</I
2415 ></TT
2416 ></A
2417 ></P
2418 ></LI
2419 ><LI
2420 ><P
2421 ><A
2422 HREF="#SSLSERVERKEY"
2423 ><TT
2424 CLASS="PARAMETER"
2425 ><I
2426 >ssl server key</I
2427 ></TT
2428 ></A
2429 ></P
2430 ></LI
2431 ><LI
2432 ><P
2433 ><A
2434 HREF="#SSLVERSION"
2435 ><TT
2436 CLASS="PARAMETER"
2437 ><I
2438 >ssl version</I
2439 ></TT
2440 ></A
2441 ></P
2442 ></LI
2443 ><LI
2444 ><P
2445 ><A
2446 HREF="#STATCACHE"
2447 ><TT
2448 CLASS="PARAMETER"
2449 ><I
2450 >stat cache</I
2451 ></TT
2452 ></A
2453 ></P
2454 ></LI
2455 ><LI
2456 ><P
2457 ><A
2458 HREF="#STATCACHESIZE"
2459 ><TT
2460 CLASS="PARAMETER"
2461 ><I
2462 >stat cache size</I
2463 ></TT
2464 ></A
2465 ></P
2466 ></LI
2467 ><LI
2468 ><P
2469 ><A
2470 HREF="#STRIPDOT"
2471 ><TT
2472 CLASS="PARAMETER"
2473 ><I
2474 >strip dot</I
2475 ></TT
2476 ></A
2477 ></P
2478 ></LI
2479 ><LI
2480 ><P
2481 ><A
2482 HREF="#SYSLOG"
2483 ><TT
2484 CLASS="PARAMETER"
2485 ><I
2486 >syslog</I
2487 ></TT
2488 ></A
2489 ></P
2490 ></LI
2491 ><LI
2492 ><P
2493 ><A
2494 HREF="#SYSLOGONLY"
2495 ><TT
2496 CLASS="PARAMETER"
2497 ><I
2498 >syslog only</I
2499 ></TT
2500 ></A
2501 ></P
2502 ></LI
2503 ><LI
2504 ><P
2505 ><A
2506 HREF="#TEMPLATEHOMEDIR"
2507 ><TT
2508 CLASS="PARAMETER"
2509 ><I
2510 >template homedir</I
2511 ></TT
2512 ></A
2513 ></P
2514 ></LI
2515 ><LI
2516 ><P
2517 ><A
2518 HREF="#TEMPLATESHELL"
2519 ><TT
2520 CLASS="PARAMETER"
2521 ><I
2522 >template shell</I
2523 ></TT
2524 ></A
2525 ></P
2526 ></LI
2527 ><LI
2528 ><P
2529 ><A
2530 HREF="#TIMEOFFSET"
2531 ><TT
2532 CLASS="PARAMETER"
2533 ><I
2534 >time offset</I
2535 ></TT
2536 ></A
2537 ></P
2538 ></LI
2539 ><LI
2540 ><P
2541 ><A
2542 HREF="#TIMESERVER"
2543 ><TT
2544 CLASS="PARAMETER"
2545 ><I
2546 >time server</I
2547 ></TT
2548 ></A
2549 ></P
2550 ></LI
2551 ><LI
2552 ><P
2553 ><A
2554 HREF="#TIMESTAMPLOGS"
2555 ><TT
2556 CLASS="PARAMETER"
2557 ><I
2558 >timestamp logs</I
2559 ></TT
2560 ></A
2561 ></P
2562 ></LI
2563 ><LI
2564 ><P
2565 ><A
2566 HREF="#TOTALPRINTJOBS"
2567 ><TT
2568 CLASS="PARAMETER"
2569 ><I
2570 >total print jobs</I
2571 ></TT
2572 ></A
2573 ></P
2574 ></LI
2575 ><LI
2576 ><P
2577 ><A
2578 HREF="#UNIXPASSWORDSYNC"
2579 ><TT
2580 CLASS="PARAMETER"
2581 ><I
2582 >unix password sync</I
2583 ></TT
2584 ></A
2585 ></P
2586 ></LI
2587 ><LI
2588 ><P
2589 ><A
2590 HREF="#UPDATEENCRYPTED"
2591 ><TT
2592 CLASS="PARAMETER"
2593 ><I
2594 >update encrypted</I
2595 ></TT
2596 ></A
2597 ></P
2598 ></LI
2599 ><LI
2600 ><P
2601 ><A
2602 HREF="#USERHOSTS"
2603 ><TT
2604 CLASS="PARAMETER"
2605 ><I
2606 >use rhosts</I
2607 ></TT
2608 ></A
2609 ></P
2610 ></LI
2611 ><LI
2612 ><P
2613 ><A
2614 HREF="#USERNAMELEVEL"
2615 ><TT
2616 CLASS="PARAMETER"
2617 ><I
2618 >username level</I
2619 ></TT
2620 ></A
2621 ></P
2622 ></LI
2623 ><LI
2624 ><P
2625 ><A
2626 HREF="#USERNAMEMAP"
2627 ><TT
2628 CLASS="PARAMETER"
2629 ><I
2630 >username map</I
2631 ></TT
2632 ></A
2633 ></P
2634 ></LI
2635 ><LI
2636 ><P
2637 ><A
2638 HREF="#UTMPDIRECTORY"
2639 ><TT
2640 CLASS="PARAMETER"
2641 ><I
2642 >utmp directory</I
2643 ></TT
2644 ></A
2645 ></P
2646 ></LI
2647 ><LI
2648 ><P
2649 ><A
2650 HREF="#VALIDCHARS"
2651 ><TT
2652 CLASS="PARAMETER"
2653 ><I
2654 >valid chars</I
2655 ></TT
2656 ></A
2657 ></P
2658 ></LI
2659 ><LI
2660 ><P
2661 ><A
2662 HREF="#WINBINDCACHETIME"
2663 ><TT
2664 CLASS="PARAMETER"
2665 ><I
2666 >winbind cache time</I
2667 ></TT
2668 ></A
2669 ></P
2670 ></LI
2671 ><LI
2672 ><P
2673 ><A
2674 HREF="#WINBINDGID"
2675 ><TT
2676 CLASS="PARAMETER"
2677 ><I
2678 >winbind gid</I
2679 ></TT
2680 ></A
2681 ></P
2682 ></LI
2683 ><LI
2684 ><P
2685 ><A
2686 HREF="#WINBINDSEPARATOR"
2687 ><TT
2688 CLASS="PARAMETER"
2689 ><I
2690 >winbind separator</I
2691 ></TT
2692 ></A
2693 ></P
2694 ></LI
2695 ><LI
2696 ><P
2697 ><A
2698 HREF="#WINBINDUID"
2699 ><TT
2700 CLASS="PARAMETER"
2701 ><I
2702 >winbind uid</I
2703 ></TT
2704 ></A
2705 ></P
2706 ></LI
2707 ><LI
2708 ><P
2709 ><A
2710 HREF="#WINSHOOK"
2711 ><TT
2712 CLASS="PARAMETER"
2713 ><I
2714 >wins hook</I
2715 ></TT
2716 ></A
2717 ></P
2718 ></LI
2719 ><LI
2720 ><P
2721 ><A
2722 HREF="#WINSPROXY"
2723 ><TT
2724 CLASS="PARAMETER"
2725 ><I
2726 >wins proxy</I
2727 ></TT
2728 ></A
2729 ></P
2730 ></LI
2731 ><LI
2732 ><P
2733 ><A
2734 HREF="#WINSSERVER"
2735 ><TT
2736 CLASS="PARAMETER"
2737 ><I
2738 >wins server</I
2739 ></TT
2740 ></A
2741 ></P
2742 ></LI
2743 ><LI
2744 ><P
2745 ><A
2746 HREF="#WINSSUPPORT"
2747 ><TT
2748 CLASS="PARAMETER"
2749 ><I
2750 >wins support</I
2751 ></TT
2752 ></A
2753 ></P
2754 ></LI
2755 ><LI
2756 ><P
2757 ><A
2758 HREF="#WORKGROUP"
2759 ><TT
2760 CLASS="PARAMETER"
2761 ><I
2762 >workgroup</I
2763 ></TT
2764 ></A
2765 ></P
2766 ></LI
2767 ><LI
2768 ><P
2769 ><A
2770 HREF="#WRITERAW"
2771 ><TT
2772 CLASS="PARAMETER"
2773 ><I
2774 >write raw</I
2775 ></TT
2776 ></A
2777 ></P
2778 ></LI
2779 ></UL
2780 ></DIV
2781 ><DIV
2782 CLASS="REFSECT1"
2783 ><A
2784 NAME="AEN897"
2785 ></A
2786 ><H2
2787 >COMPLETE LIST OF SERVICE PARAMETERS</H2
2788 ><P
2789 >Here is a list of all service parameters. See the section on
2790         each parameter for details. Note that some are synonyms.</P
2791 ><P
2792 ></P
2793 ><UL
2794 ><LI
2795 ><P
2796 ><A
2797 HREF="#ADMINUSERS"
2798 ><TT
2799 CLASS="PARAMETER"
2800 ><I
2801 >admin users</I
2802 ></TT
2803 ></A
2804 ></P
2805 ></LI
2806 ><LI
2807 ><P
2808 ><A
2809 HREF="#ALLOWHOSTS"
2810 ><TT
2811 CLASS="PARAMETER"
2812 ><I
2813 >allow hosts</I
2814 ></TT
2815 ></A
2816 ></P
2817 ></LI
2818 ><LI
2819 ><P
2820 ><A
2821 HREF="#AVAILABLE"
2822 ><TT
2823 CLASS="PARAMETER"
2824 ><I
2825 >available</I
2826 ></TT
2827 ></A
2828 ></P
2829 ></LI
2830 ><LI
2831 ><P
2832 ><A
2833 HREF="#BLOCKINGLOCKS"
2834 ><TT
2835 CLASS="PARAMETER"
2836 ><I
2837 >blocking locks</I
2838 ></TT
2839 ></A
2840 ></P
2841 ></LI
2842 ><LI
2843 ><P
2844 ><A
2845 HREF="#BROWSABLE"
2846 ><TT
2847 CLASS="PARAMETER"
2848 ><I
2849 >browsable</I
2850 ></TT
2851 ></A
2852 ></P
2853 ></LI
2854 ><LI
2855 ><P
2856 ><A
2857 HREF="#BROWSEABLE"
2858 ><TT
2859 CLASS="PARAMETER"
2860 ><I
2861 >browseable</I
2862 ></TT
2863 ></A
2864 ></P
2865 ></LI
2866 ><LI
2867 ><P
2868 ><A
2869 HREF="#CASESENSITIVE"
2870 ><TT
2871 CLASS="PARAMETER"
2872 ><I
2873 >case sensitive</I
2874 ></TT
2875 ></A
2876 ></P
2877 ></LI
2878 ><LI
2879 ><P
2880 ><A
2881 HREF="#CASESIGNAMES"
2882 ><TT
2883 CLASS="PARAMETER"
2884 ><I
2885 >casesignames</I
2886 ></TT
2887 ></A
2888 ></P
2889 ></LI
2890 ><LI
2891 ><P
2892 ><A
2893 HREF="#COMMENT"
2894 ><TT
2895 CLASS="PARAMETER"
2896 ><I
2897 >comment</I
2898 ></TT
2899 ></A
2900 ></P
2901 ></LI
2902 ><LI
2903 ><P
2904 ><A
2905 HREF="#COPY"
2906 ><TT
2907 CLASS="PARAMETER"
2908 ><I
2909 >copy</I
2910 ></TT
2911 ></A
2912 ></P
2913 ></LI
2914 ><LI
2915 ><P
2916 ><A
2917 HREF="#CREATEMASK"
2918 ><TT
2919 CLASS="PARAMETER"
2920 ><I
2921 >create mask</I
2922 ></TT
2923 ></A
2924 ></P
2925 ></LI
2926 ><LI
2927 ><P
2928 ><A
2929 HREF="#CREATEMODE"
2930 ><TT
2931 CLASS="PARAMETER"
2932 ><I
2933 >create mode</I
2934 ></TT
2935 ></A
2936 ></P
2937 ></LI
2938 ><LI
2939 ><P
2940 ><A
2941 HREF="#DEFAULTCASE"
2942 ><TT
2943 CLASS="PARAMETER"
2944 ><I
2945 >default case</I
2946 ></TT
2947 ></A
2948 ></P
2949 ></LI
2950 ><LI
2951 ><P
2952 ><A
2953 HREF="#DELETEREADONLY"
2954 ><TT
2955 CLASS="PARAMETER"
2956 ><I
2957 >delete readonly</I
2958 ></TT
2959 ></A
2960 ></P
2961 ></LI
2962 ><LI
2963 ><P
2964 ><A
2965 HREF="#DELETEVETOFILES"
2966 ><TT
2967 CLASS="PARAMETER"
2968 ><I
2969 >delete veto files</I
2970 ></TT
2971 ></A
2972 ></P
2973 ></LI
2974 ><LI
2975 ><P
2976 ><A
2977 HREF="#DENYHOSTS"
2978 ><TT
2979 CLASS="PARAMETER"
2980 ><I
2981 >deny hosts</I
2982 ></TT
2983 ></A
2984 ></P
2985 ></LI
2986 ><LI
2987 ><P
2988 ><A
2989 HREF="#DIRECTORY"
2990 ><TT
2991 CLASS="PARAMETER"
2992 ><I
2993 >directory</I
2994 ></TT
2995 ></A
2996 ></P
2997 ></LI
2998 ><LI
2999 ><P
3000 ><A
3001 HREF="#DIRECTORYMASK"
3002 ><TT
3003 CLASS="PARAMETER"
3004 ><I
3005 >directory mask</I
3006 ></TT
3007 ></A
3008 ></P
3009 ></LI
3010 ><LI
3011 ><P
3012 ><A
3013 HREF="#DIRECTORYMODE"
3014 ><TT
3015 CLASS="PARAMETER"
3016 ><I
3017 >directory mode</I
3018 ></TT
3019 ></A
3020 ></P
3021 ></LI
3022 ><LI
3023 ><P
3024 ><A
3025 HREF="#DIRECTORYSECURITYMASK"
3026 ><TT
3027 CLASS="PARAMETER"
3028 ><I
3029 >directory security mask</I
3030 ></TT
3031 ></A
3032 ></P
3033 ></LI
3034 ><LI
3035 ><P
3036 ><A
3037 HREF="#DONTDESCEND"
3038 ><TT
3039 CLASS="PARAMETER"
3040 ><I
3041 >dont descend</I
3042 ></TT
3043 ></A
3044 ></P
3045 ></LI
3046 ><LI
3047 ><P
3048 ><A
3049 HREF="#DOSFILEMODE"
3050 ><TT
3051 CLASS="PARAMETER"
3052 ><I
3053 >dos filemode</I
3054 ></TT
3055 ></A
3056 ></P
3057 ></LI
3058 ><LI
3059 ><P
3060 ><A
3061 HREF="#DOSFILETIMERESOLUTION"
3062 ><TT
3063 CLASS="PARAMETER"
3064 ><I
3065 >dos filetime resolution</I
3066 ></TT
3067 ></A
3068 ></P
3069 ></LI
3070 ><LI
3071 ><P
3072 ><A
3073 HREF="#DOSFILETIMES"
3074 ><TT
3075 CLASS="PARAMETER"
3076 ><I
3077 >dos filetimes</I
3078 ></TT
3079 ></A
3080 ></P
3081 ></LI
3082 ><LI
3083 ><P
3084 ><A
3085 HREF="#EXEC"
3086 ><TT
3087 CLASS="PARAMETER"
3088 ><I
3089 >exec</I
3090 ></TT
3091 ></A
3092 ></P
3093 ></LI
3094 ><LI
3095 ><P
3096 ><A
3097 HREF="#FAKEDIRECTORYCREATETIMES"
3098 ><TT
3099 CLASS="PARAMETER"
3100 ><I
3101 >fake directory create times</I
3102 ></TT
3103 ></A
3104 ></P
3105 ></LI
3106 ><LI
3107 ><P
3108 ><A
3109 HREF="#FAKEOPLOCKS"
3110 ><TT
3111 CLASS="PARAMETER"
3112 ><I
3113 >fake oplocks</I
3114 ></TT
3115 ></A
3116 ></P
3117 ></LI
3118 ><LI
3119 ><P
3120 ><A
3121 HREF="#FOLLOWSYMLINKS"
3122 ><TT
3123 CLASS="PARAMETER"
3124 ><I
3125 >follow symlinks</I
3126 ></TT
3127 ></A
3128 ></P
3129 ></LI
3130 ><LI
3131 ><P
3132 ><A
3133 HREF="#FORCECREATEMODE"
3134 ><TT
3135 CLASS="PARAMETER"
3136 ><I
3137 >force create mode</I
3138 ></TT
3139 ></A
3140 ></P
3141 ></LI
3142 ><LI
3143 ><P
3144 ><A
3145 HREF="#FORCEDIRECTORYMODE"
3146 ><TT
3147 CLASS="PARAMETER"
3148 ><I
3149 >force directory mode</I
3150 ></TT
3151 ></A
3152 ></P
3153 ></LI
3154 ><LI
3155 ><P
3156 ><A
3157 HREF="#FORCEDIRECTORYSECURITYMODE"
3158 ><TT
3159 CLASS="PARAMETER"
3160 ><I
3161 >force directory security mode</I
3162 ></TT
3163 ></A
3164 ></P
3165 ></LI
3166 ><LI
3167 ><P
3168 ><A
3169 HREF="#FORCEGROUP"
3170 ><TT
3171 CLASS="PARAMETER"
3172 ><I
3173 >force group</I
3174 ></TT
3175 ></A
3176 ></P
3177 ></LI
3178 ><LI
3179 ><P
3180 ><A
3181 HREF="#FORCESECURITYMODE"
3182 ><TT
3183 CLASS="PARAMETER"
3184 ><I
3185 >force security mode</I
3186 ></TT
3187 ></A
3188 ></P
3189 ></LI
3190 ><LI
3191 ><P
3192 ><A
3193 HREF="#FORCEUSER"
3194 ><TT
3195 CLASS="PARAMETER"
3196 ><I
3197 >force user</I
3198 ></TT
3199 ></A
3200 ></P
3201 ></LI
3202 ><LI
3203 ><P
3204 ><A
3205 HREF="#FSTYPE"
3206 ><TT
3207 CLASS="PARAMETER"
3208 ><I
3209 >fstype</I
3210 ></TT
3211 ></A
3212 ></P
3213 ></LI
3214 ><LI
3215 ><P
3216 ><A
3217 HREF="#GROUP"
3218 ><TT
3219 CLASS="PARAMETER"
3220 ><I
3221 >group</I
3222 ></TT
3223 ></A
3224 ></P
3225 ></LI
3226 ><LI
3227 ><P
3228 ><A
3229 HREF="#GUESTACCOUNT"
3230 ><TT
3231 CLASS="PARAMETER"
3232 ><I
3233 >guest account</I
3234 ></TT
3235 ></A
3236 ></P
3237 ></LI
3238 ><LI
3239 ><P
3240 ><A
3241 HREF="#GUESTOK"
3242 ><TT
3243 CLASS="PARAMETER"
3244 ><I
3245 >guest ok</I
3246 ></TT
3247 ></A
3248 ></P
3249 ></LI
3250 ><LI
3251 ><P
3252 ><A
3253 HREF="#GUESTONLY"
3254 ><TT
3255 CLASS="PARAMETER"
3256 ><I
3257 >guest only</I
3258 ></TT
3259 ></A
3260 ></P
3261 ></LI
3262 ><LI
3263 ><P
3264 ><A
3265 HREF="#HIDEDOTFILES"
3266 ><TT
3267 CLASS="PARAMETER"
3268 ><I
3269 >hide dot files</I
3270 ></TT
3271 ></A
3272 ></P
3273 ></LI
3274 ><LI
3275 ><P
3276 ><A
3277 HREF="#HIDEFILES"
3278 ><TT
3279 CLASS="PARAMETER"
3280 ><I
3281 >hide files</I
3282 ></TT
3283 ></A
3284 ></P
3285 ></LI
3286 ><LI
3287 ><P
3288 ><A
3289 HREF="#HOSTSALLOW"
3290 ><TT
3291 CLASS="PARAMETER"
3292 ><I
3293 >hosts allow</I
3294 ></TT
3295 ></A
3296 ></P
3297 ></LI
3298 ><LI
3299 ><P
3300 ><A
3301 HREF="#HOSTSDENY"
3302 ><TT
3303 CLASS="PARAMETER"
3304 ><I
3305 >hosts deny</I
3306 ></TT
3307 ></A
3308 ></P
3309 ></LI
3310 ><LI
3311 ><P
3312 ><A
3313 HREF="#INCLUDE"
3314 ><TT
3315 CLASS="PARAMETER"
3316 ><I
3317 >include</I
3318 ></TT
3319 ></A
3320 ></P
3321 ></LI
3322 ><LI
3323 ><P
3324 ><A
3325 HREF="#INHERITPERMISSIONS"
3326 ><TT
3327 CLASS="PARAMETER"
3328 ><I
3329 >inherit permissions</I
3330 ></TT
3331 ></A
3332 ></P
3333 ></LI
3334 ><LI
3335 ><P
3336 ><A
3337 HREF="#INVALIDUSERS"
3338 ><TT
3339 CLASS="PARAMETER"
3340 ><I
3341 >invalid users</I
3342 ></TT
3343 ></A
3344 ></P
3345 ></LI
3346 ><LI
3347 ><P
3348 ><A
3349 HREF="#LEVEL2OPLOCKS"
3350 ><TT
3351 CLASS="PARAMETER"
3352 ><I
3353 >level2 oplocks</I
3354 ></TT
3355 ></A
3356 ></P
3357 ></LI
3358 ><LI
3359 ><P
3360 ><A
3361 HREF="#LOCKING"
3362 ><TT
3363 CLASS="PARAMETER"
3364 ><I
3365 >locking</I
3366 ></TT
3367 ></A
3368 ></P
3369 ></LI
3370 ><LI
3371 ><P
3372 ><A
3373 HREF="#LPPAUSECOMMAND"
3374 ><TT
3375 CLASS="PARAMETER"
3376 ><I
3377 >lppause command</I
3378 ></TT
3379 ></A
3380 ></P
3381 ></LI
3382 ><LI
3383 ><P
3384 ><A
3385 HREF="#LPQCOMMAND"
3386 ><TT
3387 CLASS="PARAMETER"
3388 ><I
3389 >lpq command</I
3390 ></TT
3391 ></A
3392 ></P
3393 ></LI
3394 ><LI
3395 ><P
3396 ><A
3397 HREF="#LPRESUMECOMMAND"
3398 ><TT
3399 CLASS="PARAMETER"
3400 ><I
3401 >lpresume command</I
3402 ></TT
3403 ></A
3404 ></P
3405 ></LI
3406 ><LI
3407 ><P
3408 ><A
3409 HREF="#LPRMCOMMAND"
3410 ><TT
3411 CLASS="PARAMETER"
3412 ><I
3413 >lprm command</I
3414 ></TT
3415 ></A
3416 ></P
3417 ></LI
3418 ><LI
3419 ><P
3420 ><A
3421 HREF="#MAGICOUTPUT"
3422 ><TT
3423 CLASS="PARAMETER"
3424 ><I
3425 >magic output</I
3426 ></TT
3427 ></A
3428 ></P
3429 ></LI
3430 ><LI
3431 ><P
3432 ><A
3433 HREF="#MAGICSCRIPT"
3434 ><TT
3435 CLASS="PARAMETER"
3436 ><I
3437 >magic script</I
3438 ></TT
3439 ></A
3440 ></P
3441 ></LI
3442 ><LI
3443 ><P
3444 ><A
3445 HREF="#MANGLECASE"
3446 ><TT
3447 CLASS="PARAMETER"
3448 ><I
3449 >mangle case</I
3450 ></TT
3451 ></A
3452 ></P
3453 ></LI
3454 ><LI
3455 ><P
3456 ><A
3457 HREF="#MANGLEDMAP"
3458 ><TT
3459 CLASS="PARAMETER"
3460 ><I
3461 >mangled map</I
3462 ></TT
3463 ></A
3464 ></P
3465 ></LI
3466 ><LI
3467 ><P
3468 ><A
3469 HREF="#MANGLEDNAMES"
3470 ><TT
3471 CLASS="PARAMETER"
3472 ><I
3473 >mangled names</I
3474 ></TT
3475 ></A
3476 ></P
3477 ></LI
3478 ><LI
3479 ><P
3480 ><A
3481 HREF="#MANGLINGCHAR"
3482 ><TT
3483 CLASS="PARAMETER"
3484 ><I
3485 >mangling char</I
3486 ></TT
3487 ></A
3488 ></P
3489 ></LI
3490 ><LI
3491 ><P
3492 ><A
3493 HREF="#MAPARCHIVE"
3494 ><TT
3495 CLASS="PARAMETER"
3496 ><I
3497 >map archive</I
3498 ></TT
3499 ></A
3500 ></P
3501 ></LI
3502 ><LI
3503 ><P
3504 ><A
3505 HREF="#MAPHIDDEN"
3506 ><TT
3507 CLASS="PARAMETER"
3508 ><I
3509 >map hidden</I
3510 ></TT
3511 ></A
3512 ></P
3513 ></LI
3514 ><LI
3515 ><P
3516 ><A
3517 HREF="#MAPSYSTEM"
3518 ><TT
3519 CLASS="PARAMETER"
3520 ><I
3521 >map system</I
3522 ></TT
3523 ></A
3524 ></P
3525 ></LI
3526 ><LI
3527 ><P
3528 ><A
3529 HREF="#MAXCONNECTIONS"
3530 ><TT
3531 CLASS="PARAMETER"
3532 ><I
3533 >max connections</I
3534 ></TT
3535 ></A
3536 ></P
3537 ></LI
3538 ><LI
3539 ><P
3540 ><A
3541 HREF="#MAXPRINTJOBS"
3542 ><TT
3543 CLASS="PARAMETER"
3544 ><I
3545 >max print jobs</I
3546 ></TT
3547 ></A
3548 ></P
3549 ></LI
3550 ><LI
3551 ><P
3552 ><A
3553 HREF="#MINPRINTSPACE"
3554 ><TT
3555 CLASS="PARAMETER"
3556 ><I
3557 >min print space</I
3558 ></TT
3559 ></A
3560 ></P
3561 ></LI
3562 ><LI
3563 ><P
3564 ><A
3565 HREF="#MSDFSROOT"
3566 ><TT
3567 CLASS="PARAMETER"
3568 ><I
3569 >msdfs root</I
3570 ></TT
3571 ></A
3572 ></P
3573 ></LI
3574 ><LI
3575 ><P
3576 ><A
3577 HREF="#ONLYGUEST"
3578 ><TT
3579 CLASS="PARAMETER"
3580 ><I
3581 >only guest</I
3582 ></TT
3583 ></A
3584 ></P
3585 ></LI
3586 ><LI
3587 ><P
3588 ><A
3589 HREF="#ONLYUSER"
3590 ><TT
3591 CLASS="PARAMETER"
3592 ><I
3593 >only user</I
3594 ></TT
3595 ></A
3596 ></P
3597 ></LI
3598 ><LI
3599 ><P
3600 ><A
3601 HREF="#OPLOCKCONTENTIONLIMIT"
3602 ><TT
3603 CLASS="PARAMETER"
3604 ><I
3605 >oplock contention limit</I
3606 ></TT
3607 ></A
3608 ></P
3609 ></LI
3610 ><LI
3611 ><P
3612 ><A
3613 HREF="#OPLOCKS"
3614 ><TT
3615 CLASS="PARAMETER"
3616 ><I
3617 >oplocks</I
3618 ></TT
3619 ></A
3620 ></P
3621 ></LI
3622 ><LI
3623 ><P
3624 ><A
3625 HREF="#PATH"
3626 ><TT
3627 CLASS="PARAMETER"
3628 ><I
3629 >path</I
3630 ></TT
3631 ></A
3632 ></P
3633 ></LI
3634 ><LI
3635 ><P
3636 ><A
3637 HREF="#POSIXLOCKING"
3638 ><TT
3639 CLASS="PARAMETER"
3640 ><I
3641 >posix locking</I
3642 ></TT
3643 ></A
3644 ></P
3645 ></LI
3646 ><LI
3647 ><P
3648 ><A
3649 HREF="#POSTEXEC"
3650 ><TT
3651 CLASS="PARAMETER"
3652 ><I
3653 >postexec</I
3654 ></TT
3655 ></A
3656 ></P
3657 ></LI
3658 ><LI
3659 ><P
3660 ><A
3661 HREF="#POSTSCRIPT"
3662 ><TT
3663 CLASS="PARAMETER"
3664 ><I
3665 >postscript</I
3666 ></TT
3667 ></A
3668 ></P
3669 ></LI
3670 ><LI
3671 ><P
3672 ><A
3673 HREF="#PREEXEC"
3674 ><TT
3675 CLASS="PARAMETER"
3676 ><I
3677 >preexec</I
3678 ></TT
3679 ></A
3680 ></P
3681 ></LI
3682 ><LI
3683 ><P
3684 ><A
3685 HREF="#PREEXECCLOSE"
3686 ><TT
3687 CLASS="PARAMETER"
3688 ><I
3689 >preexec close</I
3690 ></TT
3691 ></A
3692 ></P
3693 ></LI
3694 ><LI
3695 ><P
3696 ><A
3697 HREF="#PRESERVECASE"
3698 ><TT
3699 CLASS="PARAMETER"
3700 ><I
3701 >preserve case</I
3702 ></TT
3703 ></A
3704 ></P
3705 ></LI
3706 ><LI
3707 ><P
3708 ><A
3709 HREF="#PRINTCOMMAND"
3710 ><TT
3711 CLASS="PARAMETER"
3712 ><I
3713 >print command</I
3714 ></TT
3715 ></A
3716 ></P
3717 ></LI
3718 ><LI
3719 ><P
3720 ><A
3721 HREF="#PRINTOK"
3722 ><TT
3723 CLASS="PARAMETER"
3724 ><I
3725 >print ok</I
3726 ></TT
3727 ></A
3728 ></P
3729 ></LI
3730 ><LI
3731 ><P
3732 ><A
3733 HREF="#PRINTABLE"
3734 ><TT
3735 CLASS="PARAMETER"
3736 ><I
3737 >printable</I
3738 ></TT
3739 ></A
3740 ></P
3741 ></LI
3742 ><LI
3743 ><P
3744 ><A
3745 HREF="#PRINTER"
3746 ><TT
3747 CLASS="PARAMETER"
3748 ><I
3749 >printer</I
3750 ></TT
3751 ></A
3752 ></P
3753 ></LI
3754 ><LI
3755 ><P
3756 ><A
3757 HREF="#PRINTERADMIN"
3758 ><TT
3759 CLASS="PARAMETER"
3760 ><I
3761 >printer admin</I
3762 ></TT
3763 ></A
3764 ></P
3765 ></LI
3766 ><LI
3767 ><P
3768 ><A
3769 HREF="#PRINTERDRIVER"
3770 ><TT
3771 CLASS="PARAMETER"
3772 ><I
3773 >printer driver</I
3774 ></TT
3775 ></A
3776 ></P
3777 ></LI
3778 ><LI
3779 ><P
3780 ><A
3781 HREF="#PRINTERDRIVERLOCATION"
3782 ><TT
3783 CLASS="PARAMETER"
3784 ><I
3785 >printer driver location</I
3786 ></TT
3787 ></A
3788 ></P
3789 ></LI
3790 ><LI
3791 ><P
3792 ><A
3793 HREF="#PRINTERNAME"
3794 ><TT
3795 CLASS="PARAMETER"
3796 ><I
3797 >printer name</I
3798 ></TT
3799 ></A
3800 ></P
3801 ></LI
3802 ><LI
3803 ><P
3804 ><A
3805 HREF="#PRINTING"
3806 ><TT
3807 CLASS="PARAMETER"
3808 ><I
3809 >printing</I
3810 ></TT
3811 ></A
3812 ></P
3813 ></LI
3814 ><LI
3815 ><P
3816 ><A
3817 HREF="#PUBLIC"
3818 ><TT
3819 CLASS="PARAMETER"
3820 ><I
3821 >public</I
3822 ></TT
3823 ></A
3824 ></P
3825 ></LI
3826 ><LI
3827 ><P
3828 ><A
3829 HREF="#QUEUEPAUSECOMMAND"
3830 ><TT
3831 CLASS="PARAMETER"
3832 ><I
3833 >queuepause command</I
3834 ></TT
3835 ></A
3836 ></P
3837 ></LI
3838 ><LI
3839 ><P
3840 ><A
3841 HREF="#QUEUERESUMECOMMAND"
3842 ><TT
3843 CLASS="PARAMETER"
3844 ><I
3845 >queueresume command</I
3846 ></TT
3847 ></A
3848 ></P
3849 ></LI
3850 ><LI
3851 ><P
3852 ><A
3853 HREF="#READLIST"
3854 ><TT
3855 CLASS="PARAMETER"
3856 ><I
3857 >read list</I
3858 ></TT
3859 ></A
3860 ></P
3861 ></LI
3862 ><LI
3863 ><P
3864 ><A
3865 HREF="#READONLY"
3866 ><TT
3867 CLASS="PARAMETER"
3868 ><I
3869 >read only</I
3870 ></TT
3871 ></A
3872 ></P
3873 ></LI
3874 ><LI
3875 ><P
3876 ><A
3877 HREF="#ROOTPOSTEXEC"
3878 ><TT
3879 CLASS="PARAMETER"
3880 ><I
3881 >root postexec</I
3882 ></TT
3883 ></A
3884 ></P
3885 ></LI
3886 ><LI
3887 ><P
3888 ><A
3889 HREF="#ROOTPREEXEC"
3890 ><TT
3891 CLASS="PARAMETER"
3892 ><I
3893 >root preexec</I
3894 ></TT
3895 ></A
3896 ></P
3897 ></LI
3898 ><LI
3899 ><P
3900 ><A
3901 HREF="#ROOTPREEXECCLOSE"
3902 ><TT
3903 CLASS="PARAMETER"
3904 ><I
3905 >root preexec close</I
3906 ></TT
3907 ></A
3908 ></P
3909 ></LI
3910 ><LI
3911 ><P
3912 ><A
3913 HREF="#SECURITYMASK"
3914 ><TT
3915 CLASS="PARAMETER"
3916 ><I
3917 >security mask</I
3918 ></TT
3919 ></A
3920 ></P
3921 ></LI
3922 ><LI
3923 ><P
3924 ><A
3925 HREF="#SETDIRECTORY"
3926 ><TT
3927 CLASS="PARAMETER"
3928 ><I
3929 >set directory</I
3930 ></TT
3931 ></A
3932 ></P
3933 ></LI
3934 ><LI
3935 ><P
3936 ><A
3937 HREF="#SHAREMODES"
3938 ><TT
3939 CLASS="PARAMETER"
3940 ><I
3941 >share modes</I
3942 ></TT
3943 ></A
3944 ></P
3945 ></LI
3946 ><LI
3947 ><P
3948 ><A
3949 HREF="#SHORTPRESERVECASE"
3950 ><TT
3951 CLASS="PARAMETER"
3952 ><I
3953 >short preserve case</I
3954 ></TT
3955 ></A
3956 ></P
3957 ></LI
3958 ><LI
3959 ><P
3960 ><A
3961 HREF="#STATUS"
3962 ><TT
3963 CLASS="PARAMETER"
3964 ><I
3965 >status</I
3966 ></TT
3967 ></A
3968 ></P
3969 ></LI
3970 ><LI
3971 ><P
3972 ><A
3973 HREF="#STRICTLOCKING"
3974 ><TT
3975 CLASS="PARAMETER"
3976 ><I
3977 >strict locking</I
3978 ></TT
3979 ></A
3980 ></P
3981 ></LI
3982 ><LI
3983 ><P
3984 ><A
3985 HREF="#STRICTSYNC"
3986 ><TT
3987 CLASS="PARAMETER"
3988 ><I
3989 >strict sync</I
3990 ></TT
3991 ></A
3992 ></P
3993 ></LI
3994 ><LI
3995 ><P
3996 ><A
3997 HREF="#SYNCALWAYS"
3998 ><TT
3999 CLASS="PARAMETER"
4000 ><I
4001 >sync always</I
4002 ></TT
4003 ></A
4004 ></P
4005 ></LI
4006 ><LI
4007 ><P
4008 ><A
4009 HREF="#USER"
4010 ><TT
4011 CLASS="PARAMETER"
4012 ><I
4013 >user</I
4014 ></TT
4015 ></A
4016 ></P
4017 ></LI
4018 ><LI
4019 ><P
4020 ><A
4021 HREF="#USERNAME"
4022 ><TT
4023 CLASS="PARAMETER"
4024 ><I
4025 >username</I
4026 ></TT
4027 ></A
4028 ></P
4029 ></LI
4030 ><LI
4031 ><P
4032 ><A
4033 HREF="#USERS"
4034 ><TT
4035 CLASS="PARAMETER"
4036 ><I
4037 >users</I
4038 ></TT
4039 ></A
4040 ></P
4041 ></LI
4042 ><LI
4043 ><P
4044 ><A
4045 HREF="#UTMP"
4046 ><TT
4047 CLASS="PARAMETER"
4048 ><I
4049 >utmp</I
4050 ></TT
4051 ></A
4052 ></P
4053 ></LI
4054 ><LI
4055 ><P
4056 ><A
4057 HREF="#VALIDUSERS"
4058 ><TT
4059 CLASS="PARAMETER"
4060 ><I
4061 >valid users</I
4062 ></TT
4063 ></A
4064 ></P
4065 ></LI
4066 ><LI
4067 ><P
4068 ><A
4069 HREF="#VETOFILES"
4070 ><TT
4071 CLASS="PARAMETER"
4072 ><I
4073 >veto files</I
4074 ></TT
4075 ></A
4076 ></P
4077 ></LI
4078 ><LI
4079 ><P
4080 ><A
4081 HREF="#VETOOPLOCKFILES"
4082 ><TT
4083 CLASS="PARAMETER"
4084 ><I
4085 >veto oplock files</I
4086 ></TT
4087 ></A
4088 ></P
4089 ></LI
4090 ><LI
4091 ><P
4092 ><A
4093 HREF="#VFSOBJECT"
4094 ><TT
4095 CLASS="PARAMETER"
4096 ><I
4097 >vfs object</I
4098 ></TT
4099 ></A
4100 ></P
4101 ></LI
4102 ><LI
4103 ><P
4104 ><A
4105 HREF="#VFSOPTIONS"
4106 ><TT
4107 CLASS="PARAMETER"
4108 ><I
4109 >vfs options</I
4110 ></TT
4111 ></A
4112 ></P
4113 ></LI
4114 ><LI
4115 ><P
4116 ><A
4117 HREF="#VOLUME"
4118 ><TT
4119 CLASS="PARAMETER"
4120 ><I
4121 >volume</I
4122 ></TT
4123 ></A
4124 ></P
4125 ></LI
4126 ><LI
4127 ><P
4128 ><A
4129 HREF="#WIDELINKS"
4130 ><TT
4131 CLASS="PARAMETER"
4132 ><I
4133 >wide links</I
4134 ></TT
4135 ></A
4136 ></P
4137 ></LI
4138 ><LI
4139 ><P
4140 ><A
4141 HREF="#WRITABLE"
4142 ><TT
4143 CLASS="PARAMETER"
4144 ><I
4145 >writable</I
4146 ></TT
4147 ></A
4148 ></P
4149 ></LI
4150 ><LI
4151 ><P
4152 ><A
4153 HREF="#WRITECACHESIZE"
4154 ><TT
4155 CLASS="PARAMETER"
4156 ><I
4157 >write cache size</I
4158 ></TT
4159 ></A
4160 ></P
4161 ></LI
4162 ><LI
4163 ><P
4164 ><A
4165 HREF="#WRITELIST"
4166 ><TT
4167 CLASS="PARAMETER"
4168 ><I
4169 >write list</I
4170 ></TT
4171 ></A
4172 ></P
4173 ></LI
4174 ><LI
4175 ><P
4176 ><A
4177 HREF="#WRITEOK"
4178 ><TT
4179 CLASS="PARAMETER"
4180 ><I
4181 >write ok</I
4182 ></TT
4183 ></A
4184 ></P
4185 ></LI
4186 ><LI
4187 ><P
4188 ><A
4189 HREF="#WRITEABLE"
4190 ><TT
4191 CLASS="PARAMETER"
4192 ><I
4193 >writeable</I
4194 ></TT
4195 ></A
4196 ></P
4197 ></LI
4198 ></UL
4199 ></DIV
4200 ><DIV
4201 CLASS="REFSECT1"
4202 ><A
4203 NAME="AEN1369"
4204 ></A
4205 ><H2
4206 >EXPLANATION OF EACH PARAMETER</H2
4207 ><P
4208 ></P
4209 ><DIV
4210 CLASS="VARIABLELIST"
4211 ><DL
4212 ><DT
4213 ><A
4214 NAME="ADDPRINTERCOMMAND"
4215 ></A
4216 >add printer command (G)</DT
4217 ><DD
4218 ><P
4219 >With the introduction of MS-RPC based printing
4220                 support for Windows NT/2000 clients in Samba 2.2, The MS Add
4221                 Printer Wizard (APW) icon is now also available in the
4222                 "Printers..." folder displayed a share listing.  The APW
4223                 allows for printers to be add remotely to a Samba or Windows
4224                 NT/2000 print server.</P
4225 ><P
4226 >For a Samba host this means that the printer must be
4227                 physically added to underlying printing system.  The <TT
4228 CLASS="PARAMETER"
4229 ><I
4230 >add
4231                 printer command</I
4232 ></TT
4233 > defines a script to be run which
4234                 will perform the necessary operations for adding the printer
4235                 to the print system and to add the appropriate service definition
4236                 to the  <TT
4237 CLASS="FILENAME"
4238 >smb.conf</TT
4239 > file in order that it can be
4240                 shared by <A
4241 HREF="smbd.8.html"
4242 TARGET="_top"
4243 ><B
4244 CLASS="COMMAND"
4245 >smbd(8)</B
4246 >
4247                 </A
4248 >.</P
4249 ><P
4250 >The <TT
4251 CLASS="PARAMETER"
4252 ><I
4253 >add printer command</I
4254 ></TT
4255 > is
4256                 automatically invoked with the following parameter (in
4257                 order:</P
4258 ><P
4259 ></P
4260 ><UL
4261 ><LI
4262 ><P
4263 ><TT
4264 CLASS="PARAMETER"
4265 ><I
4266 >printer name</I
4267 ></TT
4268 ></P
4269 ></LI
4270 ><LI
4271 ><P
4272 ><TT
4273 CLASS="PARAMETER"
4274 ><I
4275 >share name</I
4276 ></TT
4277 ></P
4278 ></LI
4279 ><LI
4280 ><P
4281 ><TT
4282 CLASS="PARAMETER"
4283 ><I
4284 >port name</I
4285 ></TT
4286 ></P
4287 ></LI
4288 ><LI
4289 ><P
4290 ><TT
4291 CLASS="PARAMETER"
4292 ><I
4293 >driver name</I
4294 ></TT
4295 ></P
4296 ></LI
4297 ><LI
4298 ><P
4299 ><TT
4300 CLASS="PARAMETER"
4301 ><I
4302 >location</I
4303 ></TT
4304 ></P
4305 ></LI
4306 ><LI
4307 ><P
4308 ><TT
4309 CLASS="PARAMETER"
4310 ><I
4311 >Windows 9x driver location</I
4312 ></TT
4313 >
4314                         </P
4315 ></LI
4316 ></UL
4317 ><P
4318 >All parameters are filled in from the PRINTER_INFO_2 structure sent
4319                 by the Windows NT/2000 client with one exception.  The "Windows 9x
4320                 driver location" parameter is included for backwards compatibility
4321                 only.  The remaining fields in the structure are generated from answers
4322                 to the APW questions.</P
4323 ><P
4324 >Once the <TT
4325 CLASS="PARAMETER"
4326 ><I
4327 >add printer command</I
4328 ></TT
4329 > has
4330                 been executed, <B
4331 CLASS="COMMAND"
4332 >smbd</B
4333 > will reparse the <TT
4334 CLASS="FILENAME"
4335 >               smb.conf</TT
4336 > to determine if the share defined by the APW
4337                 exists.  If the sharename is still invalid, then <B
4338 CLASS="COMMAND"
4339 >smbd
4340                 </B
4341 > will return an ACCESS_DENIED error to the client.</P
4342 ><P
4343 >See also <A
4344 HREF="#DELETEPRINTERCOMMAND"
4345 ><TT
4346 CLASS="PARAMETER"
4347 ><I
4348 >               delete printer command</I
4349 ></TT
4350 ></A
4351 >, <A
4352 HREF="#PRINTING"
4353 ><TT
4354 CLASS="PARAMETER"
4355 ><I
4356 >printing</I
4357 ></TT
4358 ></A
4359 >,
4360                 <A
4361 HREF="#SHOWADDPRINTERWIZARD"
4362 ><TT
4363 CLASS="PARAMETER"
4364 ><I
4365 >show add
4366                 printer wizard</I
4367 ></TT
4368 ></A
4369 ></P
4370 ><P
4371 >Default: <EM
4372 >none</EM
4373 ></P
4374 ><P
4375 >Example: <B
4376 CLASS="COMMAND"
4377 >addprinter command = /usr/bin/addprinter
4378                 </B
4379 ></P
4380 ></DD
4381 ><DT
4382 ><A
4383 NAME="ADDSHARECOMMAND"
4384 ></A
4385 >add share command (G)</DT
4386 ><DD
4387 ><P
4388 >Samba 2.2.0 introduced the ability to dynamically
4389                 add and delete shares via the Windows NT 4.0 Server Manager.  The
4390                 <TT
4391 CLASS="PARAMETER"
4392 ><I
4393 >add share command</I
4394 ></TT
4395 > is used to define an
4396                 external program or script which will add a new service definition
4397                 to <TT
4398 CLASS="FILENAME"
4399 >smb.conf</TT
4400 >.  In order to successfully
4401                 execute the <TT
4402 CLASS="PARAMETER"
4403 ><I
4404 >add share command</I
4405 ></TT
4406 >, <B
4407 CLASS="COMMAND"
4408 >smbd</B
4409 >
4410                 requires that the administrator be connected using a root account (i.e.
4411                 uid == 0).
4412                 </P
4413 ><P
4414 >               When executed, <B
4415 CLASS="COMMAND"
4416 >smbd</B
4417 > will automatically invoke the
4418                 <TT
4419 CLASS="PARAMETER"
4420 ><I
4421 >add share command</I
4422 ></TT
4423 > with four parameters.
4424                 </P
4425 ><P
4426 ></P
4427 ><UL
4428 ><LI
4429 ><P
4430 ><TT
4431 CLASS="PARAMETER"
4432 ><I
4433 >configFile</I
4434 ></TT
4435 > - the location
4436                         of the global <TT
4437 CLASS="FILENAME"
4438 >smb.conf</TT
4439 > file.
4440                         </P
4441 ></LI
4442 ><LI
4443 ><P
4444 ><TT
4445 CLASS="PARAMETER"
4446 ><I
4447 >shareName</I
4448 ></TT
4449 > - the name of the new
4450                         share.
4451                         </P
4452 ></LI
4453 ><LI
4454 ><P
4455 ><TT
4456 CLASS="PARAMETER"
4457 ><I
4458 >pathName</I
4459 ></TT
4460 > - path to an **existing**
4461                         directory on disk.
4462                         </P
4463 ></LI
4464 ><LI
4465 ><P
4466 ><TT
4467 CLASS="PARAMETER"
4468 ><I
4469 >comment</I
4470 ></TT
4471 > - comment string to associate
4472                         with the new share.
4473                         </P
4474 ></LI
4475 ></UL
4476 ><P
4477 >               This parameter is only used for add file shares.  To add printer shares,
4478                 see the <A
4479 HREF="#ADDPRINTERCOMMAND"
4480 ><TT
4481 CLASS="PARAMETER"
4482 ><I
4483 >add printer
4484                 command</I
4485 ></TT
4486 ></A
4487 >.
4488                 </P
4489 ><P
4490 >               See also <A
4491 HREF="#CHANGESHARECOMMAND"
4492 ><TT
4493 CLASS="PARAMETER"
4494 ><I
4495 >change share
4496                 command</I
4497 ></TT
4498 ></A
4499 >, <A
4500 HREF="#DELETESHARECOMMAND"
4501 ><TT
4502 CLASS="PARAMETER"
4503 ><I
4504 >delete share
4505                 command</I
4506 ></TT
4507 ></A
4508 >.
4509                 </P
4510 ><P
4511 >Default: <EM
4512 >none</EM
4513 ></P
4514 ><P
4515 >Example: <B
4516 CLASS="COMMAND"
4517 >add share command = /usr/local/bin/addshare</B
4518 ></P
4519 ></DD
4520 ><DT
4521 ><A
4522 NAME="ADDUSERSCRIPT"
4523 ></A
4524 >add user script (G)</DT
4525 ><DD
4526 ><P
4527 >This is the full pathname to a script that will
4528                 be run <EM
4529 >AS ROOT</EM
4530 > by <A
4531 HREF="smbd.8.html"
4532 TARGET="_top"
4533 >smbd(8)
4534                 </A
4535 > under special circumstances described below.</P
4536 ><P
4537 >Normally, a Samba server requires that UNIX users are
4538                 created for all users accessing files on this server. For sites
4539                 that use Windows NT account databases as their primary user database
4540                 creating these users and keeping the user list in sync with the
4541                 Windows NT PDC is an onerous task. This option allows <A
4542 HREF="smbd.8.html"
4543 TARGET="_top"
4544 >smbd</A
4545 > to create the required UNIX users
4546                 <EM
4547 >ON DEMAND</EM
4548 > when a user accesses the Samba server.</P
4549 ><P
4550 >In order to use this option, <A
4551 HREF="smbd.8.html"
4552 TARGET="_top"
4553 >smbd</A
4554 >
4555                 must be set to <TT
4556 CLASS="PARAMETER"
4557 ><I
4558 >security=server</I
4559 ></TT
4560 > or <TT
4561 CLASS="PARAMETER"
4562 ><I
4563 >               security=domain</I
4564 ></TT
4565 > and <TT
4566 CLASS="PARAMETER"
4567 ><I
4568 >add user script</I
4569 ></TT
4570 >
4571                 must be set to a full pathname for a script that will create a UNIX
4572                 user given one argument of <TT
4573 CLASS="PARAMETER"
4574 ><I
4575 >%u</I
4576 ></TT
4577 >, which expands into
4578                 the UNIX user name to create.</P
4579 ><P
4580 >When the Windows user attempts to access the Samba server,
4581                 at login (session setup in the SMB protocol) time, <A
4582 HREF="smbd.8.html"
4583 TARGET="_top"
4584 >               smbd</A
4585 > contacts the <TT
4586 CLASS="PARAMETER"
4587 ><I
4588 >password server</I
4589 ></TT
4590 > and
4591                 attempts to authenticate the given user with the given password. If the
4592                 authentication succeeds then <B
4593 CLASS="COMMAND"
4594 >smbd</B
4595 >
4596                 attempts to find a UNIX user in the UNIX password database to map the
4597                 Windows user into. If this lookup fails, and <TT
4598 CLASS="PARAMETER"
4599 ><I
4600 >add user script
4601                 </I
4602 ></TT
4603 > is set then <B
4604 CLASS="COMMAND"
4605 >smbd</B
4606 > will
4607                 call the specified script <EM
4608 >AS ROOT</EM
4609 >, expanding
4610                 any <TT
4611 CLASS="PARAMETER"
4612 ><I
4613 >%u</I
4614 ></TT
4615 > argument to be the user name to create.</P
4616 ><P
4617 >If this script successfully creates the user then <B
4618 CLASS="COMMAND"
4619 >smbd
4620                 </B
4621 > will continue on as though the UNIX user
4622                 already existed. In this way, UNIX users are dynamically created to
4623                 match existing Windows NT accounts.</P
4624 ><P
4625 >See also <A
4626 HREF="#SECURITY"
4627 ><TT
4628 CLASS="PARAMETER"
4629 ><I
4630 >               security</I
4631 ></TT
4632 ></A
4633 >, <A
4634 HREF="#PASSWORDSERVER"
4635 >               <TT
4636 CLASS="PARAMETER"
4637 ><I
4638 >password server</I
4639 ></TT
4640 ></A
4641 >,
4642                 <A
4643 HREF="#DELETEUSERSCRIPT"
4644 ><TT
4645 CLASS="PARAMETER"
4646 ><I
4647 >delete user
4648                 script</I
4649 ></TT
4650 ></A
4651 >.</P
4652 ><P
4653 >Default: <B
4654 CLASS="COMMAND"
4655 >add user script = &#60;empty string&#62;
4656                 </B
4657 ></P
4658 ><P
4659 >Example: <B
4660 CLASS="COMMAND"
4661 >add user script = /usr/local/samba/bin/add_user
4662                 %u</B
4663 ></P
4664 ></DD
4665 ><DT
4666 ><A
4667 NAME="ADMINUSERS"
4668 ></A
4669 >admin users (S)</DT
4670 ><DD
4671 ><P
4672 >This is a list of users who will be granted
4673                 administrative privileges on the share. This means that they
4674                 will do all file operations as the super-user (root).</P
4675 ><P
4676 >You should use this option very carefully, as any user in
4677                 this list will be able to do anything they like on the share,
4678                 irrespective of file permissions.</P
4679 ><P
4680 >Default: <EM
4681 >no admin users</EM
4682 ></P
4683 ><P
4684 >Example: <B
4685 CLASS="COMMAND"
4686 >admin users = jason</B
4687 ></P
4688 ></DD
4689 ><DT
4690 ><A
4691 NAME="ALLOWHOSTS"
4692 ></A
4693 >allow hosts (S)</DT
4694 ><DD
4695 ><P
4696 >Synonym for <A
4697 HREF="#HOSTSALLOW"
4698 >               <TT
4699 CLASS="PARAMETER"
4700 ><I
4701 >hosts allow</I
4702 ></TT
4703 ></A
4704 >.</P
4705 ></DD
4706 ><DT
4707 ><A
4708 NAME="ALLOWTRUSTEDDOMAINS"
4709 ></A
4710 >allow trusted domains (G)</DT
4711 ><DD
4712 ><P
4713 >This option only takes effect when the <A
4714 HREF="#SECURITY"
4715 ><TT
4716 CLASS="PARAMETER"
4717 ><I
4718 >security</I
4719 ></TT
4720 ></A
4721 > option is set to
4722                 <TT
4723 CLASS="CONSTANT"
4724 >server</TT
4725 > or <TT
4726 CLASS="CONSTANT"
4727 >domain</TT
4728 >.
4729                 If it is set to no, then attempts to connect to a resource from
4730                 a domain or workgroup other than the one which smbd is running
4731                 in will fail, even if that domain is trusted by the remote server
4732                 doing the authentication.</P
4733 ><P
4734 >This is useful if you only want your Samba server to
4735                 serve resources to users in the domain it is a member of. As
4736                 an example, suppose that there are two domains DOMA and DOMB.  DOMB
4737                 is trusted by DOMA, which contains the Samba server.  Under normal
4738                 circumstances, a user with an account in DOMB can then access the
4739                 resources of a UNIX account with the same account name on the
4740                 Samba server even if they do not have an account in DOMA.  This
4741                 can make implementing a security boundary difficult.</P
4742 ><P
4743 >Default: <B
4744 CLASS="COMMAND"
4745 >allow trusted domains = yes</B
4746 ></P
4747 ></DD
4748 ><DT
4749 ><A
4750 NAME="ANNOUNCEAS"
4751 ></A
4752 >announce as (G)</DT
4753 ><DD
4754 ><P
4755 >This specifies what type of server
4756                 <A
4757 HREF="nmbd.8.html"
4758 TARGET="_top"
4759 ><B
4760 CLASS="COMMAND"
4761 >nmbd</B
4762 ></A
4763 >
4764                 will announce itself as, to a network neighborhood browse
4765                 list. By default this is set to Windows NT. The valid options
4766                 are : "NT Server" (which can also be written as "NT"),
4767                 "NT Workstation", "Win95" or "WfW" meaning Windows NT Server,
4768                 Windows NT Workstation, Windows 95 and Windows for Workgroups
4769                 respectively. Do not change this parameter unless you have a
4770                 specific need to stop Samba appearing as an NT server as this
4771                 may prevent Samba servers from participating as browser servers
4772                 correctly.</P
4773 ><P
4774 >Default: <B
4775 CLASS="COMMAND"
4776 >announce as = NT Server</B
4777 ></P
4778 ><P
4779 >Example: <B
4780 CLASS="COMMAND"
4781 >announce as = Win95</B
4782 ></P
4783 ></DD
4784 ><DT
4785 ><A
4786 NAME="ANNOUNCEVERSION"
4787 ></A
4788 >annouce version (G)</DT
4789 ><DD
4790 ><P
4791 >This specifies the major and minor version numbers
4792                 that nmbd will use when announcing itself as a server. The default
4793                 is 4.2.  Do not change this parameter unless you have a specific
4794                 need to set a Samba server to be a downlevel server.</P
4795 ><P
4796 >Default: <B
4797 CLASS="COMMAND"
4798 >announce version = 4.2</B
4799 ></P
4800 ><P
4801 >Example: <B
4802 CLASS="COMMAND"
4803 >announce version = 2.0</B
4804 ></P
4805 ></DD
4806 ><DT
4807 ><A
4808 NAME="AUTOSERVICES"
4809 ></A
4810 >auto services (G)</DT
4811 ><DD
4812 ><P
4813 >This is a synonym for the <A
4814 HREF="#PRELOAD"
4815 >               <TT
4816 CLASS="PARAMETER"
4817 ><I
4818 >preload</I
4819 ></TT
4820 ></A
4821 >.</P
4822 ></DD
4823 ><DT
4824 ><A
4825 NAME="AVAILABLE"
4826 ></A
4827 >available (S)</DT
4828 ><DD
4829 ><P
4830 >This parameter lets you "turn off" a service. If
4831                 <TT
4832 CLASS="PARAMETER"
4833 ><I
4834 >available = no</I
4835 ></TT
4836 >, then <EM
4837 >ALL</EM
4838 >
4839                 attempts to connect to the service will fail. Such failures are
4840                 logged.</P
4841 ><P
4842 >Default: <B
4843 CLASS="COMMAND"
4844 >available = yes</B
4845 ></P
4846 ></DD
4847 ><DT
4848 ><A
4849 NAME="BINDINTERFACESONLY"
4850 ></A
4851 >bind interfaces only (G)</DT
4852 ><DD
4853 ><P
4854 >This global parameter allows the Samba admin
4855                 to limit what interfaces on a machine will serve smb requests. If
4856                 affects file service <A
4857 HREF="smbd.8.html"
4858 TARGET="_top"
4859 >smbd(8)</A
4860 > and
4861                 name service <A
4862 HREF="nmbd.8.html"
4863 TARGET="_top"
4864 >nmbd(8)</A
4865 > in slightly
4866                 different ways.</P
4867 ><P
4868 >For name service it causes <B
4869 CLASS="COMMAND"
4870 >nmbd</B
4871 > to bind
4872                 to ports 137 and 138 on the interfaces listed in the <A
4873 HREF="#INTERFACES"
4874 >interfaces</A
4875 > parameter. <B
4876 CLASS="COMMAND"
4877 >nmbd
4878                 </B
4879 > also binds to the "all addresses" interface (0.0.0.0)
4880                 on ports 137 and 138 for the purposes of reading broadcast messages.
4881                 If this option is not set then <B
4882 CLASS="COMMAND"
4883 >nmbd</B
4884 > will service
4885                 name requests on all of these sockets. If <TT
4886 CLASS="PARAMETER"
4887 ><I
4888 >bind interfaces
4889                 only</I
4890 ></TT
4891 > is set then <B
4892 CLASS="COMMAND"
4893 >nmbd</B
4894 > will check the
4895                 source address of any packets coming in on the broadcast sockets
4896                 and discard any that don't match the broadcast addresses of the
4897                 interfaces in the <TT
4898 CLASS="PARAMETER"
4899 ><I
4900 >interfaces</I
4901 ></TT
4902 > parameter list.
4903                 As unicast packets are received on the other sockets it allows
4904                 <B
4905 CLASS="COMMAND"
4906 >nmbd</B
4907 > to refuse to serve names to machines that
4908                 send packets that arrive through any interfaces not listed in the
4909                 <TT
4910 CLASS="PARAMETER"
4911 ><I
4912 >interfaces</I
4913 ></TT
4914 > list.  IP Source address spoofing
4915                 does defeat this simple check, however so it must not be used
4916                 seriously as a security feature for <B
4917 CLASS="COMMAND"
4918 >nmbd</B
4919 >.</P
4920 ><P
4921 >For file service it causes <A
4922 HREF="smbd.8.html"
4923 TARGET="_top"
4924 >smbd(8)</A
4925 >
4926                 to bind only to the interface list given in the <A
4927 HREF="#INTERFACES"
4928 >               interfaces</A
4929 > parameter. This restricts the networks that
4930                 <B
4931 CLASS="COMMAND"
4932 >smbd</B
4933 > will serve to packets coming in those
4934                 interfaces.  Note that you should not use this parameter for machines
4935                 that are serving PPP or other intermittent or non-broadcast network
4936                 interfaces as it will not cope with non-permanent interfaces.</P
4937 ><P
4938 >If <TT
4939 CLASS="PARAMETER"
4940 ><I
4941 >bind interfaces only</I
4942 ></TT
4943 > is set then
4944                 unless the network address <EM
4945 >127.0.0.1</EM
4946 > is added
4947                 to the <TT
4948 CLASS="PARAMETER"
4949 ><I
4950 >interfaces</I
4951 ></TT
4952 > parameter list <A
4953 HREF="smbpasswd.8.html"
4954 TARGET="_top"
4955 ><B
4956 CLASS="COMMAND"
4957 >smbpasswd(8)</B
4958 ></A
4959 >
4960                 and <A
4961 HREF="swat.8.html"
4962 TARGET="_top"
4963 ><B
4964 CLASS="COMMAND"
4965 >swat(8)</B
4966 ></A
4967 > may
4968                 not work as expected due to the reasons covered below.</P
4969 ><P
4970 >To change a users SMB password, the <B
4971 CLASS="COMMAND"
4972 >smbpasswd</B
4973 >
4974                 by default connects to the <EM
4975 >localhost - 127.0.0.1</EM
4976 >
4977                 address as an SMB client to issue the password change request. If
4978                 <TT
4979 CLASS="PARAMETER"
4980 ><I
4981 >bind interfaces only</I
4982 ></TT
4983 > is set then unless the
4984                 network address <EM
4985 >127.0.0.1</EM
4986 > is added to the
4987                 <TT
4988 CLASS="PARAMETER"
4989 ><I
4990 >interfaces</I
4991 ></TT
4992 > parameter list then <B
4993 CLASS="COMMAND"
4994 >               smbpasswd</B
4995 > will fail to connect in it's default mode.
4996                 <B
4997 CLASS="COMMAND"
4998 >smbpasswd</B
4999 > can be forced to use the primary IP interface
5000                 of the local host by using its <A
5001 HREF="smbpasswd.8.html#minusr"
5002 TARGET="_top"
5003 >               <TT
5004 CLASS="PARAMETER"
5005 ><I
5006 >-r <TT
5007 CLASS="REPLACEABLE"
5008 ><I
5009 >remote machine</I
5010 ></TT
5011 ></I
5012 ></TT
5013 >
5014                 </A
5015 > parameter, with <TT
5016 CLASS="REPLACEABLE"
5017 ><I
5018 >remote machine</I
5019 ></TT
5020 > set
5021                 to the IP name of the primary interface of the local host.</P
5022 ><P
5023 >The <B
5024 CLASS="COMMAND"
5025 >swat</B
5026 > status page tries to connect with
5027                 <B
5028 CLASS="COMMAND"
5029 >smbd</B
5030 > and <B
5031 CLASS="COMMAND"
5032 >nmbd</B
5033 > at the address
5034                 <EM
5035 >127.0.0.1</EM
5036 > to determine if they are running.
5037                 Not adding <EM
5038 >127.0.0.1</EM
5039 >  will cause <B
5040 CLASS="COMMAND"
5041 >               smbd</B
5042 > and <B
5043 CLASS="COMMAND"
5044 >nmbd</B
5045 > to always show
5046                 "not running" even if they really are.  This can prevent <B
5047 CLASS="COMMAND"
5048 >               swat</B
5049 > from starting/stopping/restarting <B
5050 CLASS="COMMAND"
5051 >smbd</B
5052 >
5053                 and <B
5054 CLASS="COMMAND"
5055 >nmbd</B
5056 >.</P
5057 ><P
5058 >Default: <B
5059 CLASS="COMMAND"
5060 >bind interfaces only = no</B
5061 ></P
5062 ></DD
5063 ><DT
5064 ><A
5065 NAME="BLOCKINGLOCKS"
5066 ></A
5067 >blocking locks (S)</DT
5068 ><DD
5069 ><P
5070 >This parameter controls the behavior of <A
5071 HREF="smbd.8.html"
5072 TARGET="_top"
5073 >smbd(8)</A
5074 > when given a request by a client
5075                 to obtain a byte range lock on a region of an open file, and the
5076                 request has a time limit associated with it.</P
5077 ><P
5078 >If this parameter is set and the lock range requested
5079                 cannot be immediately satisfied, Samba 2.2 will internally
5080                 queue the lock request, and periodically attempt to obtain
5081                 the lock until the timeout period expires.</P
5082 ><P
5083 >If this parameter is set to <TT
5084 CLASS="CONSTANT"
5085 >False</TT
5086 >, then
5087                 Samba 2.2 will behave as previous versions of Samba would and
5088                 will fail the lock request immediately if the lock range
5089                 cannot be obtained.</P
5090 ><P
5091 >Default: <B
5092 CLASS="COMMAND"
5093 >blocking locks = yes</B
5094 ></P
5095 ></DD
5096 ><DT
5097 ><A
5098 NAME="BROWSABLE"
5099 ></A
5100 >browsable (S)</DT
5101 ><DD
5102 ><P
5103 >See the <A
5104 HREF="#BROWSEABLE"
5105 ><TT
5106 CLASS="PARAMETER"
5107 ><I
5108 >               browseable</I
5109 ></TT
5110 ></A
5111 >.</P
5112 ></DD
5113 ><DT
5114 ><A
5115 NAME="BROWSELIST"
5116 ></A
5117 >browse list (G)</DT
5118 ><DD
5119 ><P
5120 >This controls whether <A
5121 HREF="smbd.8.html"
5122 TARGET="_top"
5123 >               <B
5124 CLASS="COMMAND"
5125 >smbd(8)</B
5126 ></A
5127 > will serve a browse list to
5128                 a client doing a <B
5129 CLASS="COMMAND"
5130 >NetServerEnum</B
5131 > call. Normally
5132                 set to <TT
5133 CLASS="CONSTANT"
5134 >true</TT
5135 >. You should never need to change
5136                 this.</P
5137 ><P
5138 >Default: <B
5139 CLASS="COMMAND"
5140 >browse list = yes</B
5141 ></P
5142 ></DD
5143 ><DT
5144 ><A
5145 NAME="BROWSEABLE"
5146 ></A
5147 >browseable (S)</DT
5148 ><DD
5149 ><P
5150 >This controls whether this share is seen in
5151                 the list of available shares in a net view and in the browse list.</P
5152 ><P
5153 >Default: <B
5154 CLASS="COMMAND"
5155 >browseable = yes</B
5156 ></P
5157 ></DD
5158 ><DT
5159 ><A
5160 NAME="CASESENSITIVE"
5161 ></A
5162 >case sensitive (S)</DT
5163 ><DD
5164 ><P
5165 >See the discussion in the section <A
5166 HREF="#AEN201"
5167 >NAME MANGLING</A
5168 >.</P
5169 ><P
5170 >Default: <B
5171 CLASS="COMMAND"
5172 >case sensitive = no</B
5173 ></P
5174 ></DD
5175 ><DT
5176 ><A
5177 NAME="CASESIGNAMES"
5178 ></A
5179 >casesignames (S)</DT
5180 ><DD
5181 ><P
5182 >Synonym for <A
5183 HREF="#CASESENSITIVE"
5184 >case
5185                 sensitive</A
5186 >.</P
5187 ></DD
5188 ><DT
5189 ><A
5190 NAME="CHANGENOTIFYTIMEOUT"
5191 ></A
5192 >change notify timeout (G)</DT
5193 ><DD
5194 ><P
5195 >This SMB allows a client to tell a server to
5196                 "watch" a particular directory for any changes and only reply to
5197                 the SMB request when a change has occurred. Such constant scanning of
5198                 a directory is expensive under UNIX, hence an <A
5199 HREF="smbd.8.html"
5200 TARGET="_top"
5201 >               <B
5202 CLASS="COMMAND"
5203 >smbd(8)</B
5204 ></A
5205 > daemon only performs such a scan
5206                 on each requested directory once every <TT
5207 CLASS="PARAMETER"
5208 ><I
5209 >change notify
5210                 timeout</I
5211 ></TT
5212 > seconds.</P
5213 ><P
5214 >Default: <B
5215 CLASS="COMMAND"
5216 >change notify timeout = 60</B
5217 ></P
5218 ><P
5219 >Example: <B
5220 CLASS="COMMAND"
5221 >change notify timeout = 300</B
5222 ></P
5223 ><P
5224 >Would change the scan time to every 5 minutes.</P
5225 ></DD
5226 ><DT
5227 ><A
5228 NAME="CHANGESHARECOMMAND"
5229 ></A
5230 >change share command (G)</DT
5231 ><DD
5232 ><P
5233 >Samba 2.2.0 introduced the ability to dynamically
5234                 add and delete shares via the Windows NT 4.0 Server Manager.  The
5235                 <TT
5236 CLASS="PARAMETER"
5237 ><I
5238 >change share command</I
5239 ></TT
5240 > is used to define an
5241                 external program or script which will modify an existing service definition
5242                 in <TT
5243 CLASS="FILENAME"
5244 >smb.conf</TT
5245 >.  In order to successfully
5246                 execute the <TT
5247 CLASS="PARAMETER"
5248 ><I
5249 >change share command</I
5250 ></TT
5251 >, <B
5252 CLASS="COMMAND"
5253 >smbd</B
5254 >
5255                 requires that the administrator be connected using a root account (i.e.
5256                 uid == 0).
5257                 </P
5258 ><P
5259 >               When executed, <B
5260 CLASS="COMMAND"
5261 >smbd</B
5262 > will automatically invoke the
5263                 <TT
5264 CLASS="PARAMETER"
5265 ><I
5266 >change share command</I
5267 ></TT
5268 > with four parameters.
5269                 </P
5270 ><P
5271 ></P
5272 ><UL
5273 ><LI
5274 ><P
5275 ><TT
5276 CLASS="PARAMETER"
5277 ><I
5278 >configFile</I
5279 ></TT
5280 > - the location
5281                         of the global <TT
5282 CLASS="FILENAME"
5283 >smb.conf</TT
5284 > file.
5285                         </P
5286 ></LI
5287 ><LI
5288 ><P
5289 ><TT
5290 CLASS="PARAMETER"
5291 ><I
5292 >shareName</I
5293 ></TT
5294 > - the name of the new
5295                         share.
5296                         </P
5297 ></LI
5298 ><LI
5299 ><P
5300 ><TT
5301 CLASS="PARAMETER"
5302 ><I
5303 >pathName</I
5304 ></TT
5305 > - path to an **existing**
5306                         directory on disk.
5307                         </P
5308 ></LI
5309 ><LI
5310 ><P
5311 ><TT
5312 CLASS="PARAMETER"
5313 ><I
5314 >comment</I
5315 ></TT
5316 > - comment string to associate
5317                         with the new share.
5318                         </P
5319 ></LI
5320 ></UL
5321 ><P
5322 >               This parameter is only used modify existing file shares definitions.  To modify
5323                 printer shares, use the "Printers..." folder as seen when browsing the Samba host.
5324                 </P
5325 ><P
5326 >               See also <A
5327 HREF="#ADDSHARECOMMAND"
5328 ><TT
5329 CLASS="PARAMETER"
5330 ><I
5331 >add share
5332                 command</I
5333 ></TT
5334 ></A
5335 >, <A
5336 HREF="#DELETESHARECOMMAND"
5337 ><TT
5338 CLASS="PARAMETER"
5339 ><I
5340 >delete
5341                 share command</I
5342 ></TT
5343 ></A
5344 >.
5345                 </P
5346 ><P
5347 >Default: <EM
5348 >none</EM
5349 ></P
5350 ><P
5351 >Example: <B
5352 CLASS="COMMAND"
5353 >change share command = /usr/local/bin/addshare</B
5354 ></P
5355 ></DD
5356 ><DT
5357 ><A
5358 NAME="CHARACTERSET"
5359 ></A
5360 >character set (G)</DT
5361 ><DD
5362 ><P
5363 >This allows a smbd to map incoming filenames
5364                 from a DOS Code page (see the <A
5365 HREF="#CLIENTCODEPAGE"
5366 >client
5367                 code page</A
5368 > parameter) to several built in UNIX character sets.
5369                 The built in code page translations are:</P
5370 ><P
5371 ></P
5372 ><UL
5373 ><LI
5374 ><P
5375 ><TT
5376 CLASS="CONSTANT"
5377 >ISO8859-1</TT
5378 > : Western European
5379                         UNIX character set. The parameter <TT
5380 CLASS="PARAMETER"
5381 ><I
5382 >client code page</I
5383 ></TT
5384 >
5385                         <EM
5386 >MUST</EM
5387 > be set to code page 850 if the
5388                         <TT
5389 CLASS="PARAMETER"
5390 ><I
5391 >character set</I
5392 ></TT
5393 > parameter is set to
5394                         <TT
5395 CLASS="CONSTANT"
5396 >ISO8859-1</TT
5397 > in order for the conversion to the
5398                         UNIX character set to be done correctly.</P
5399 ></LI
5400 ><LI
5401 ><P
5402 ><TT
5403 CLASS="CONSTANT"
5404 >ISO8859-2</TT
5405 > : Eastern European
5406                         UNIX character set. The parameter <TT
5407 CLASS="PARAMETER"
5408 ><I
5409 >client code page
5410                         </I
5411 ></TT
5412 > <EM
5413 >MUST</EM
5414 > be set to code page 852 if
5415                         the <TT
5416 CLASS="PARAMETER"
5417 ><I
5418 > character set</I
5419 ></TT
5420 > parameter is set
5421                         to <TT
5422 CLASS="CONSTANT"
5423 >ISO8859-2</TT
5424 > in order for the conversion
5425                         to the UNIX character set to be done correctly. </P
5426 ></LI
5427 ><LI
5428 ><P
5429 ><TT
5430 CLASS="CONSTANT"
5431 >ISO8859-5</TT
5432 > : Russian Cyrillic
5433                         UNIX character set. The parameter <TT
5434 CLASS="PARAMETER"
5435 ><I
5436 >client code page
5437                         </I
5438 ></TT
5439 > <EM
5440 >MUST</EM
5441 > be set to code page
5442                         866 if the <TT
5443 CLASS="PARAMETER"
5444 ><I
5445 >character set </I
5446 ></TT
5447 > parameter is
5448                         set to <TT
5449 CLASS="CONSTANT"
5450 >ISO8859-5</TT
5451 > in order for the conversion
5452                         to the UNIX character set to be done correctly. </P
5453 ></LI
5454 ><LI
5455 ><P
5456 ><TT
5457 CLASS="CONSTANT"
5458 >ISO8859-7</TT
5459 > : Greek UNIX
5460                         character set. The parameter <TT
5461 CLASS="PARAMETER"
5462 ><I
5463 >client code page
5464                         </I
5465 ></TT
5466 > <EM
5467 >MUST</EM
5468 > be set to code page
5469                         737 if the <TT
5470 CLASS="PARAMETER"
5471 ><I
5472 >character set</I
5473 ></TT
5474 > parameter is
5475                         set to <TT
5476 CLASS="CONSTANT"
5477 >ISO8859-7</TT
5478 > in order for the conversion
5479                         to the UNIX character set to be done correctly.</P
5480 ></LI
5481 ><LI
5482 ><P
5483 ><TT
5484 CLASS="CONSTANT"
5485 >KOI8-R</TT
5486 > : Alternate mapping
5487                         for Russian Cyrillic UNIX character set. The parameter
5488                         <TT
5489 CLASS="PARAMETER"
5490 ><I
5491 >client code page</I
5492 ></TT
5493 > <EM
5494 >MUST</EM
5495 >
5496                         be set to code page 866 if the <TT
5497 CLASS="PARAMETER"
5498 ><I
5499 >character set</I
5500 ></TT
5501 >
5502                         parameter is set to <TT
5503 CLASS="CONSTANT"
5504 >KOI8-R</TT
5505 > in order for the
5506                         conversion to the UNIX character set to be done correctly.</P
5507 ></LI
5508 ></UL
5509 ><P
5510 ><EM
5511 >BUG</EM
5512 >. These MSDOS code page to UNIX character
5513                 set mappings should be dynamic, like the loading of MS DOS code pages,
5514                 not static.</P
5515 ><P
5516 >Normally this parameter is not set, meaning no filename
5517                 translation is done.</P
5518 ><P
5519 >Default: <B
5520 CLASS="COMMAND"
5521 >character set = &#60;empty string&#62;</B
5522 ></P
5523 ><P
5524 >Example: <B
5525 CLASS="COMMAND"
5526 >character set = ISO8859-1</B
5527 ></P
5528 ></DD
5529 ><DT
5530 ><A
5531 NAME="CLIENTCODEPAGE"
5532 ></A
5533 >client code page (G)</DT
5534 ><DD
5535 ><P
5536 >This parameter specifies the DOS code page
5537                 that the clients accessing Samba are using. To determine what code
5538                 page a Windows or DOS client is using, open a DOS command prompt
5539                 and type the command <B
5540 CLASS="COMMAND"
5541 >chcp</B
5542 >. This will output
5543                 the code page. The default for USA MS-DOS, Windows 95, and
5544                 Windows NT releases is code page 437. The default for western
5545                 European releases of the above operating systems is code page 850.</P
5546 ><P
5547 >This parameter tells <A
5548 HREF="smbd.8.html"
5549 TARGET="_top"
5550 >smbd(8)</A
5551 >
5552                 which of the <TT
5553 CLASS="FILENAME"
5554 >codepage.<TT
5555 CLASS="REPLACEABLE"
5556 ><I
5557 >XXX</I
5558 ></TT
5559 >
5560                 </TT
5561 > files to dynamically load on startup. These files,
5562                 described more fully in the manual page <A
5563 HREF="make_smbcodepage.1.html"
5564 TARGET="_top"
5565 >               <B
5566 CLASS="COMMAND"
5567 >make_smbcodepage(1)</B
5568 ></A
5569 >, tell <B
5570 CLASS="COMMAND"
5571 >               smbd</B
5572 > how to map lower to upper case characters to provide
5573                 the case insensitivity of filenames that Windows clients expect.</P
5574 ><P
5575 >Samba currently ships with the following code page files :</P
5576 ><P
5577 ></P
5578 ><UL
5579 ><LI
5580 ><P
5581 >Code Page 437 - MS-DOS Latin US</P
5582 ></LI
5583 ><LI
5584 ><P
5585 >Code Page 737 - Windows '95 Greek</P
5586 ></LI
5587 ><LI
5588 ><P
5589 >Code Page 850 - MS-DOS Latin 1</P
5590 ></LI
5591 ><LI
5592 ><P
5593 >Code Page 852 - MS-DOS Latin 2</P
5594 ></LI
5595 ><LI
5596 ><P
5597 >Code Page 861 - MS-DOS Icelandic</P
5598 ></LI
5599 ><LI
5600 ><P
5601 >Code Page 866 - MS-DOS Cyrillic</P
5602 ></LI
5603 ><LI
5604 ><P
5605 >Code Page 932 - MS-DOS Japanese SJIS</P
5606 ></LI
5607 ><LI
5608 ><P
5609 >Code Page 936 - MS-DOS Simplified Chinese</P
5610 ></LI
5611 ><LI
5612 ><P
5613 >Code Page 949 - MS-DOS Korean Hangul</P
5614 ></LI
5615 ><LI
5616 ><P
5617 >Code Page 950 - MS-DOS Traditional Chinese</P
5618 ></LI
5619 ></UL
5620 ><P
5621 >Thus this parameter may have any of the values 437, 737, 850, 852,
5622                 861, 932, 936, 949, or 950.  If you don't find the codepage you need,
5623                 read the comments in one of the other codepage files and the
5624                 <B
5625 CLASS="COMMAND"
5626 >make_smbcodepage(1)</B
5627 > man page and write one. Please
5628                 remember to donate it back to the Samba user community.</P
5629 ><P
5630 >This parameter co-operates with the <TT
5631 CLASS="PARAMETER"
5632 ><I
5633 >valid
5634                 chars</I
5635 ></TT
5636 > parameter in determining what characters are
5637                 valid in filenames and how capitalization is done. If you set both
5638                 this parameter and the <TT
5639 CLASS="PARAMETER"
5640 ><I
5641 >valid chars</I
5642 ></TT
5643 > parameter
5644                 the <TT
5645 CLASS="PARAMETER"
5646 ><I
5647 >client code page</I
5648 ></TT
5649 > parameter
5650                 <EM
5651 >MUST</EM
5652 > be set before the <TT
5653 CLASS="PARAMETER"
5654 ><I
5655 >valid
5656                 chars</I
5657 ></TT
5658 > parameter in the <TT
5659 CLASS="FILENAME"
5660 >smb.conf</TT
5661 >
5662                 file. The <TT
5663 CLASS="PARAMETER"
5664 ><I
5665 >valid chars</I
5666 ></TT
5667 > string will then
5668                 augment the character settings in the <TT
5669 CLASS="PARAMETER"
5670 ><I
5671 >client code page</I
5672 ></TT
5673 >
5674                 parameter.</P
5675 ><P
5676 >If not set, <TT
5677 CLASS="PARAMETER"
5678 ><I
5679 >client code page</I
5680 ></TT
5681 > defaults
5682                 to 850.</P
5683 ><P
5684 >See also : <A
5685 HREF="#VALIDCHARS"
5686 ><TT
5687 CLASS="PARAMETER"
5688 ><I
5689 >valid
5690                 chars</I
5691 ></TT
5692 ></A
5693 >, <A
5694 HREF="#CODEPAGEDIRECTORY"
5695 >               <TT
5696 CLASS="PARAMETER"
5697 ><I
5698 >code page directory</I
5699 ></TT
5700 ></A
5701 ></P
5702 ><P
5703 >Default: <B
5704 CLASS="COMMAND"
5705 >client code page = 850</B
5706 ></P
5707 ><P
5708 >Example: <B
5709 CLASS="COMMAND"
5710 >client code page = 936</B
5711 ></P
5712 ></DD
5713 ><DT
5714 ><A
5715 NAME="CODEPAGEDIRECTORY"
5716 ></A
5717 >code page directory (G)</DT
5718 ><DD
5719 ><P
5720 >Define the location of the various client code page
5721                 files.</P
5722 ><P
5723 >See also <A
5724 HREF="#CLIENTCODEPAGE"
5725 ><TT
5726 CLASS="PARAMETER"
5727 ><I
5728 >client
5729                 code page</I
5730 ></TT
5731 ></A
5732 ></P
5733 ><P
5734 >Default: <B
5735 CLASS="COMMAND"
5736 >code page directory = ${prefix}/lib/codepages
5737                 </B
5738 ></P
5739 ><P
5740 >Example: <B
5741 CLASS="COMMAND"
5742 >code page directory = /usr/share/samba/codepages
5743                 </B
5744 ></P
5745 ></DD
5746 ><DT
5747 ><A
5748 NAME="CODINGSYSTEM"
5749 ></A
5750 >codingsystem (G)</DT
5751 ><DD
5752 ><P
5753 >This parameter is used to determine how incoming
5754                 Shift-JIS Japanese characters are mapped from the incoming <A
5755 HREF="#CLIENTCODEPAGE"
5756 ><TT
5757 CLASS="PARAMETER"
5758 ><I
5759 >client code page</I
5760 ></TT
5761 >
5762                 </A
5763 > used by the client, into file names in the UNIX filesystem.
5764                 Only useful if <TT
5765 CLASS="PARAMETER"
5766 ><I
5767 >client code page</I
5768 ></TT
5769 > is set to
5770                 932 (Japanese Shift-JIS).  The options are :</P
5771 ><P
5772 ></P
5773 ><UL
5774 ><LI
5775 ><P
5776 ><TT
5777 CLASS="CONSTANT"
5778 >SJIS</TT
5779 >  - Shift-JIS. Does no
5780                         conversion of the incoming filename.</P
5781 ></LI
5782 ><LI
5783 ><P
5784 ><TT
5785 CLASS="CONSTANT"
5786 >JIS8, J8BB, J8BH, J8@B,
5787                         J8@J, J8@H </TT
5788 > - Convert from incoming Shift-JIS to eight
5789                         bit JIS code with different shift-in, shift out codes.</P
5790 ></LI
5791 ><LI
5792 ><P
5793 ><TT
5794 CLASS="CONSTANT"
5795 >JIS7, J7BB, J7BH, J7@B, J7@J,
5796                         J7@H </TT
5797 > - Convert from incoming Shift-JIS to seven bit
5798                         JIS code with different shift-in, shift out codes.</P
5799 ></LI
5800 ><LI
5801 ><P
5802 ><TT
5803 CLASS="CONSTANT"
5804 >JUNET, JUBB, JUBH, JU@B, JU@J, JU@H </TT
5805 >
5806                         - Convert from incoming Shift-JIS to JUNET code with different shift-in,
5807                         shift out codes.</P
5808 ></LI
5809 ><LI
5810 ><P
5811 ><TT
5812 CLASS="CONSTANT"
5813 >EUC</TT
5814 > - Convert an incoming
5815                         Shift-JIS character to EUC code.</P
5816 ></LI
5817 ><LI
5818 ><P
5819 ><TT
5820 CLASS="CONSTANT"
5821 >HEX</TT
5822 > - Convert an incoming
5823                         Shift-JIS character to a 3 byte hex representation, i.e.
5824                         <TT
5825 CLASS="CONSTANT"
5826 >:AB</TT
5827 >.</P
5828 ></LI
5829 ><LI
5830 ><P
5831 ><TT
5832 CLASS="CONSTANT"
5833 >CAP</TT
5834 > - Convert an incoming
5835                         Shift-JIS character to the 3 byte hex representation used by
5836                         the Columbia AppleTalk Program (CAP), i.e. <TT
5837 CLASS="CONSTANT"
5838 >:AB</TT
5839 >.
5840                         This is used for compatibility between Samba and CAP.</P
5841 ></LI
5842 ></UL
5843 ><P
5844 >Default: <B
5845 CLASS="COMMAND"
5846 >coding system = &#60;empty value&#62;</B
5847 >
5848                 </P
5849 ></DD
5850 ><DT
5851 ><A
5852 NAME="COMMENT"
5853 ></A
5854 >comment (S)</DT
5855 ><DD
5856 ><P
5857 >This is a text field that is seen next to a share
5858                 when a client does a queries the server, either via the network
5859                 neighborhood or via <B
5860 CLASS="COMMAND"
5861 >net view</B
5862 > to list what shares
5863                 are available.</P
5864 ><P
5865 >If you want to set the string that is displayed next to the
5866                 machine name then see the <A
5867 HREF="#SERVERSTRING"
5868 ><TT
5869 CLASS="PARAMETER"
5870 ><I
5871 >               server string</I
5872 ></TT
5873 ></A
5874 > parameter.</P
5875 ><P
5876 >Default: <EM
5877 >No comment string</EM
5878 ></P
5879 ><P
5880 >Example: <B
5881 CLASS="COMMAND"
5882 >comment = Fred's Files</B
5883 ></P
5884 ></DD
5885 ><DT
5886 ><A
5887 NAME="CONFIGFILE"
5888 ></A
5889 >config file (G)</DT
5890 ><DD
5891 ><P
5892 >This allows you to override the config file
5893                 to use, instead of the default (usually <TT
5894 CLASS="FILENAME"
5895 >smb.conf</TT
5896 >).
5897                 There is a chicken and egg problem here as this option is set
5898                 in the config file!</P
5899 ><P
5900 >For this reason, if the name of the config file has changed
5901                 when the parameters are loaded then it will reload them from
5902                 the new config file.</P
5903 ><P
5904 >This option takes the usual substitutions, which can
5905                 be very useful.</P
5906 ><P
5907 >If the config file doesn't exist then it won't be loaded
5908                 (allowing you to special case the config files of just a few
5909                 clients).</P
5910 ><P
5911 >Example: <B
5912 CLASS="COMMAND"
5913 >config file = /usr/local/samba/lib/smb.conf.%m
5914                 </B
5915 ></P
5916 ></DD
5917 ><DT
5918 ><A
5919 NAME="COPY"
5920 ></A
5921 >copy (S)</DT
5922 ><DD
5923 ><P
5924 >This parameter allows you to "clone" service
5925                 entries. The specified service is simply duplicated under the
5926                 current service's name. Any parameters specified in the current
5927                 section will override those in the section being copied.</P
5928 ><P
5929 >This feature lets you set up a 'template' service and
5930                 create similar services easily. Note that the service being
5931                 copied must occur earlier in the configuration file than the
5932                 service doing the copying.</P
5933 ><P
5934 >Default: <EM
5935 >no value</EM
5936 ></P
5937 ><P
5938 >Example: <B
5939 CLASS="COMMAND"
5940 >copy = otherservice</B
5941 ></P
5942 ></DD
5943 ><DT
5944 ><A
5945 NAME="CREATEMASK"
5946 ></A
5947 >create mask (S)</DT
5948 ><DD
5949 ><P
5950 >A synonym for this parameter is
5951                 <A
5952 HREF="#CREATEMODE"
5953 ><TT
5954 CLASS="PARAMETER"
5955 ><I
5956 >create mode</I
5957 ></TT
5958 >
5959                 </A
5960 >.</P
5961 ><P
5962 >When a file is created, the necessary permissions are
5963                 calculated according to the mapping from DOS modes to UNIX
5964                 permissions, and the resulting UNIX mode is then bit-wise 'AND'ed
5965                 with this parameter. This parameter may be thought of as a bit-wise
5966                 MASK for the UNIX modes of a file. Any bit <EM
5967 >not</EM
5968 >
5969                 set here will be removed from the modes set on a file when it is
5970                 created.</P
5971 ><P
5972 >The default value of this parameter removes the
5973                 'group' and 'other' write and execute bits from the UNIX modes.</P
5974 ><P
5975 >Following this Samba will bit-wise 'OR' the UNIX mode created
5976                 from this parameter with the value of the <A
5977 HREF="#FORCECREATEMODE"
5978 ><TT
5979 CLASS="PARAMETER"
5980 ><I
5981 >force create mode</I
5982 ></TT
5983 ></A
5984 >
5985                 parameter which is set to 000 by default.</P
5986 ><P
5987 >This parameter does not affect directory modes. See the
5988                 parameter <A
5989 HREF="#DIRECTORYMODE"
5990 ><TT
5991 CLASS="PARAMETER"
5992 ><I
5993 >directory mode
5994                 </I
5995 ></TT
5996 ></A
5997 > for details.</P
5998 ><P
5999 >See also the <A
6000 HREF="#FORCECREATEMODE"
6001 ><TT
6002 CLASS="PARAMETER"
6003 ><I
6004 >force
6005                 create mode</I
6006 ></TT
6007 ></A
6008 > parameter for forcing particular mode
6009                 bits to be set on created files. See also the <A
6010 HREF="#DIRECTORYMODE"
6011 >               <TT
6012 CLASS="PARAMETER"
6013 ><I
6014 >directory mode"</I
6015 ></TT
6016 ></A
6017 > parameter for masking
6018                 mode bits on created directories.  See also the <A
6019 HREF="#INHERITPERMISSIONS"
6020 >               <TT
6021 CLASS="PARAMETER"
6022 ><I
6023 >inherit permissions</I
6024 ></TT
6025 ></A
6026 > parameter.</P
6027 ><P
6028 >Note that this parameter does not apply to permissions
6029                 set by Windows NT/2000 ACL editors. If the administrator wishes to enforce
6030                 a mask on access control lists also, they need to set the <A
6031 HREF="#SECURITYMASK"
6032 ><TT
6033 CLASS="PARAMETER"
6034 ><I
6035 >security mask</I
6036 ></TT
6037 ></A
6038 >.</P
6039 ><P
6040 >Default: <B
6041 CLASS="COMMAND"
6042 >create mask = 0744</B
6043 ></P
6044 ><P
6045 >Example: <B
6046 CLASS="COMMAND"
6047 >create mask = 0775</B
6048 ></P
6049 ></DD
6050 ><DT
6051 ><A
6052 NAME="CREATEMODE"
6053 ></A
6054 >create mode (S)</DT
6055 ><DD
6056 ><P
6057 >This is a synonym for <A
6058 HREF="#CREATEMASK"
6059 ><TT
6060 CLASS="PARAMETER"
6061 ><I
6062 >               create mask</I
6063 ></TT
6064 ></A
6065 >.</P
6066 ></DD
6067 ><DT
6068 ><A
6069 NAME="DEADTIME"
6070 ></A
6071 >deadtime (G)</DT
6072 ><DD
6073 ><P
6074 >The value of the parameter (a decimal integer)
6075                 represents the number of minutes of inactivity before a connection
6076                 is considered dead, and it is disconnected. The deadtime only takes
6077                 effect if the number of open files is zero.</P
6078 ><P
6079 >This is useful to stop a server's resources being
6080                 exhausted by a large number of inactive connections.</P
6081 ><P
6082 >Most clients have an auto-reconnect feature when a
6083                 connection is broken so in most cases this parameter should be
6084                 transparent to users.</P
6085 ><P
6086 >Using this parameter with a timeout of a few minutes
6087                 is recommended for most systems.</P
6088 ><P
6089 >A deadtime of zero indicates that no auto-disconnection
6090                 should be performed.</P
6091 ><P
6092 >Default: <B
6093 CLASS="COMMAND"
6094 >deadtime = 0</B
6095 ></P
6096 ><P
6097 >Example: <B
6098 CLASS="COMMAND"
6099 >deadtime = 15</B
6100 ></P
6101 ></DD
6102 ><DT
6103 ><A
6104 NAME="DEBUGHIRESTIMESTAMP"
6105 ></A
6106 >debug hires timestamp (G)</DT
6107 ><DD
6108 ><P
6109 >Sometimes the timestamps in the log messages
6110                 are needed with a resolution of higher that seconds, this
6111                 boolean parameter adds microsecond resolution to the timestamp
6112                 message header when turned on.</P
6113 ><P
6114 >Note that the parameter <A
6115 HREF="#DEBUGTIMESTAMP"
6116 ><TT
6117 CLASS="PARAMETER"
6118 ><I
6119 >               debug timestamp</I
6120 ></TT
6121 ></A
6122 > must be on for this to have an
6123                 effect.</P
6124 ><P
6125 >Default: <B
6126 CLASS="COMMAND"
6127 >debug hires timestamp = no</B
6128 ></P
6129 ></DD
6130 ><DT
6131 ><A
6132 NAME="DEBUGPID"
6133 ></A
6134 >debug pid (G)</DT
6135 ><DD
6136 ><P
6137 >When using only one log file for more then one
6138                 forked smbd-process there may be hard to follow which process
6139                 outputs which message. This boolean parameter is adds the process-id
6140                 to the timestamp message headers in the logfile when turned on.</P
6141 ><P
6142 >Note that the parameter <A
6143 HREF="#DEBUGTIMESTAMP"
6144 ><TT
6145 CLASS="PARAMETER"
6146 ><I
6147 >               debug timestamp</I
6148 ></TT
6149 ></A
6150 > must be on for this to have an
6151                 effect.</P
6152 ><P
6153 >Default: <B
6154 CLASS="COMMAND"
6155 >debug pid = no</B
6156 ></P
6157 ></DD
6158 ><DT
6159 ><A
6160 NAME="DEBUGTIMESTAMP"
6161 ></A
6162 >debug timestamp (G)</DT
6163 ><DD
6164 ><P
6165 >Samba 2.2 debug log messages are timestamped
6166                 by default. If you are running at a high <A
6167 HREF="#DEBUGLEVEL"
6168 >               <TT
6169 CLASS="PARAMETER"
6170 ><I
6171 >debug level</I
6172 ></TT
6173 ></A
6174 > these timestamps
6175                 can be distracting. This boolean parameter allows timestamping
6176                 to be turned off.</P
6177 ><P
6178 >Default: <B
6179 CLASS="COMMAND"
6180 >debug timestamp = yes</B
6181 ></P
6182 ></DD
6183 ><DT
6184 ><A
6185 NAME="DEBUGUID"
6186 ></A
6187 >debug uid (G)</DT
6188 ><DD
6189 ><P
6190 >Samba is sometimes run as root and sometime
6191                 run as the connected user, this boolean parameter inserts the
6192                 current euid, egid, uid and gid to the timestamp message headers
6193                 in the log file if turned on.</P
6194 ><P
6195 >Note that the parameter <A
6196 HREF="#DEBUGTIMESTAMP"
6197 ><TT
6198 CLASS="PARAMETER"
6199 ><I
6200 >               debug timestamp</I
6201 ></TT
6202 ></A
6203 > must be on for this to have an
6204                 effect.</P
6205 ><P
6206 >Default: <B
6207 CLASS="COMMAND"
6208 >debug uid = no</B
6209 ></P
6210 ></DD
6211 ><DT
6212 ><A
6213 NAME="DEBUGLEVEL"
6214 ></A
6215 >debuglevel (G)</DT
6216 ><DD
6217 ><P
6218 >Synonym for <A
6219 HREF="#LOGLEVEL"
6220 ><TT
6221 CLASS="PARAMETER"
6222 ><I
6223 >               log level</I
6224 ></TT
6225 ></A
6226 >.</P
6227 ></DD
6228 ><DT
6229 ><A
6230 NAME="DEFAULT"
6231 ></A
6232 >default (G)</DT
6233 ><DD
6234 ><P
6235 >A synonym for <A
6236 HREF="#DEFAULTSERVICE"
6237 ><TT
6238 CLASS="PARAMETER"
6239 ><I
6240 >               default service</I
6241 ></TT
6242 ></A
6243 >.</P
6244 ></DD
6245 ><DT
6246 ><A
6247 NAME="DEFAULTCASE"
6248 ></A
6249 >default case (S)</DT
6250 ><DD
6251 ><P
6252 >See the section on <A
6253 HREF="#AEN201"
6254 >               NAME MANGLING</A
6255 >. Also note the <A
6256 HREF="#SHORTPRESERVECASE"
6257 >               <TT
6258 CLASS="PARAMETER"
6259 ><I
6260 >short preserve case"</I
6261 ></TT
6262 ></A
6263 > parameter.</P
6264 ><P
6265 >Default: <B
6266 CLASS="COMMAND"
6267 >default case = lower</B
6268 ></P
6269 ></DD
6270 ><DT
6271 ><A
6272 NAME="DEFAULTSERVICE"
6273 ></A
6274 >default service (G)</DT
6275 ><DD
6276 ><P
6277 >This parameter specifies the name of a service
6278                 which will be connected to if the service actually requested cannot
6279                 be found. Note that the square brackets are <EM
6280 >NOT</EM
6281 >
6282                 given in the parameter value (see example below).</P
6283 ><P
6284 >There is no default value for this parameter. If this
6285                 parameter is not given, attempting to connect to a nonexistent
6286                 service results in an error.</P
6287 ><P
6288 >Typically the default service would be a <A
6289 HREF="#GUESTOK"
6290 >               <TT
6291 CLASS="PARAMETER"
6292 ><I
6293 >guest ok</I
6294 ></TT
6295 ></A
6296 >, <A
6297 HREF="#READONLY"
6298 >               <TT
6299 CLASS="PARAMETER"
6300 ><I
6301 >read-only</I
6302 ></TT
6303 ></A
6304 > service.</P
6305 ><P
6306 >Also note that the apparent service name will be changed
6307                 to equal that of the requested service, this is very useful as it
6308                 allows you to use macros like <TT
6309 CLASS="PARAMETER"
6310 ><I
6311 >%S</I
6312 ></TT
6313 > to make
6314                 a wildcard service.</P
6315 ><P
6316 >Note also that any "_" characters in the name of the service
6317                 used in the default service will get mapped to a "/". This allows for
6318                 interesting things.</P
6319 ><P
6320 >Example:</P
6321 ><P
6322 ><TABLE
6323 BORDER="0"
6324 BGCOLOR="#E0E0E0"
6325 WIDTH="90%"
6326 ><TR
6327 ><TD
6328 ><PRE
6329 CLASS="PROGRAMLISTING"
6330 >[global]
6331         default service = pub
6332
6333 [pub]
6334         path = /%S
6335                 </PRE
6336 ></TD
6337 ></TR
6338 ></TABLE
6339 ></P
6340 ></DD
6341 ><DT
6342 ><A
6343 NAME="DELETEPRINTERCOMMAND"
6344 ></A
6345 >delete printer command (G)</DT
6346 ><DD
6347 ><P
6348 >With the introduction of MS-RPC based printer
6349                 support for Windows NT/2000 clients in Samba 2.2, it is now
6350                 possible to delete printer at run time by issuing the
6351                 DeletePrinter() RPC call.</P
6352 ><P
6353 >For a Samba host this means that the printer must be
6354                 physically deleted from underlying printing system.  The <TT
6355 CLASS="PARAMETER"
6356 ><I
6357 >               deleteprinter command</I
6358 ></TT
6359 > defines a script to be run which
6360                 will perform the necessary operations for removing the printer
6361                 from the print system and from <TT
6362 CLASS="FILENAME"
6363 >smb.conf</TT
6364 >.
6365                 </P
6366 ><P
6367 >The <TT
6368 CLASS="PARAMETER"
6369 ><I
6370 >delete printer command</I
6371 ></TT
6372 > is
6373                 automatically called with only one parameter: <TT
6374 CLASS="PARAMETER"
6375 ><I
6376 >               "printer name"</I
6377 ></TT
6378 >.</P
6379 ><P
6380 >Once the <TT
6381 CLASS="PARAMETER"
6382 ><I
6383 >delete printer command</I
6384 ></TT
6385 > has
6386                 been executed, <B
6387 CLASS="COMMAND"
6388 >smbd</B
6389 > will reparse the <TT
6390 CLASS="FILENAME"
6391 >               smb.conf</TT
6392 > to associated printer no longer exists.
6393                 If the sharename is still valid, then <B
6394 CLASS="COMMAND"
6395 >smbd
6396                 </B
6397 > will return an ACCESS_DENIED error to the client.</P
6398 ><P
6399 >See also <A
6400 HREF="#ADDPRINTERCOMMAND"
6401 ><TT
6402 CLASS="PARAMETER"
6403 ><I
6404 >               add printer command</I
6405 ></TT
6406 ></A
6407 >, <A
6408 HREF="#PRINTING"
6409 ><TT
6410 CLASS="PARAMETER"
6411 ><I
6412 >printing</I
6413 ></TT
6414 ></A
6415 >,
6416                 <A
6417 HREF="#SHOWADDPRINTERWIZARD"
6418 ><TT
6419 CLASS="PARAMETER"
6420 ><I
6421 >show add
6422                 printer wizard</I
6423 ></TT
6424 ></A
6425 ></P
6426 ><P
6427 >Default: <EM
6428 >none</EM
6429 ></P
6430 ><P
6431 >Example: <B
6432 CLASS="COMMAND"
6433 >deleteprinter command = /usr/bin/removeprinter
6434                 </B
6435 ></P
6436 ></DD
6437 ><DT
6438 ><A
6439 NAME="DELETEREADONLY"
6440 ></A
6441 >delete readonly (S)</DT
6442 ><DD
6443 ><P
6444 >This parameter allows readonly files to be deleted.
6445                 This is not normal DOS semantics, but is allowed by UNIX.</P
6446 ><P
6447 >This option may be useful for running applications such
6448                 as rcs, where UNIX file ownership prevents changing file
6449                 permissions, and DOS semantics prevent deletion of a read only file.</P
6450 ><P
6451 >Default: <B
6452 CLASS="COMMAND"
6453 >delete readonly = no</B
6454 ></P
6455 ></DD
6456 ><DT
6457 ><A
6458 NAME="DELETESHARECOMMAND"
6459 ></A
6460 >delete share command (G)</DT
6461 ><DD
6462 ><P
6463 >Samba 2.2.0 introduced the ability to dynamically
6464                 add and delete shares via the Windows NT 4.0 Server Manager.  The
6465                 <TT
6466 CLASS="PARAMETER"
6467 ><I
6468 >delete share command</I
6469 ></TT
6470 > is used to define an
6471                 external program or script which will remove an existing service
6472                 definition from <TT
6473 CLASS="FILENAME"
6474 >smb.conf</TT
6475 >.  In order to successfully
6476                 execute the <TT
6477 CLASS="PARAMETER"
6478 ><I
6479 >delete share command</I
6480 ></TT
6481 >, <B
6482 CLASS="COMMAND"
6483 >smbd</B
6484 >
6485                 requires that the administrator be connected using a root account (i.e.
6486                 uid == 0).
6487                 </P
6488 ><P
6489 >               When executed, <B
6490 CLASS="COMMAND"
6491 >smbd</B
6492 > will automatically invoke the
6493                 <TT
6494 CLASS="PARAMETER"
6495 ><I
6496 >delete share command</I
6497 ></TT
6498 > with two parameters.
6499                 </P
6500 ><P
6501 ></P
6502 ><UL
6503 ><LI
6504 ><P
6505 ><TT
6506 CLASS="PARAMETER"
6507 ><I
6508 >configFile</I
6509 ></TT
6510 > - the location
6511                         of the global <TT
6512 CLASS="FILENAME"
6513 >smb.conf</TT
6514 > file.
6515                         </P
6516 ></LI
6517 ><LI
6518 ><P
6519 ><TT
6520 CLASS="PARAMETER"
6521 ><I
6522 >shareName</I
6523 ></TT
6524 > - the name of
6525                         the existing service.
6526                         </P
6527 ></LI
6528 ></UL
6529 ><P
6530 >               This parameter is only used to remove file shares.  To delete printer shares,
6531                 see the <A
6532 HREF="#DELETEPRINTERCOMMAND"
6533 ><TT
6534 CLASS="PARAMETER"
6535 ><I
6536 >delete printer
6537                 command</I
6538 ></TT
6539 ></A
6540 >.
6541                 </P
6542 ><P
6543 >               See also <A
6544 HREF="#ADDSHARECOMMAND"
6545 ><TT
6546 CLASS="PARAMETER"
6547 ><I
6548 >delete share
6549                 command</I
6550 ></TT
6551 ></A
6552 >, <A
6553 HREF="#CHANGESHARECOMMAND"
6554 ><TT
6555 CLASS="PARAMETER"
6556 ><I
6557 >change
6558                 share</I
6559 ></TT
6560 ></A
6561 >.
6562                 </P
6563 ><P
6564 >Default: <EM
6565 >none</EM
6566 ></P
6567 ><P
6568 >Example: <B
6569 CLASS="COMMAND"
6570 >delete share command = /usr/local/bin/delshare</B
6571 ></P
6572 ></DD
6573 ><DT
6574 ><A
6575 NAME="DELETEUSERSCRIPT"
6576 ></A
6577 >delete user script (G)</DT
6578 ><DD
6579 ><P
6580 >This is the full pathname to a script that will
6581                 be run <EM
6582 >AS ROOT</EM
6583 > by <A
6584 HREF="smbd.8.html"
6585 TARGET="_top"
6586 >               <B
6587 CLASS="COMMAND"
6588 >smbd(8)</B
6589 ></A
6590 > under special circumstances
6591                 described below.</P
6592 ><P
6593 >Normally, a Samba server requires that UNIX users are
6594                 created for all users accessing files on this server. For sites
6595                 that use Windows NT account databases as their primary user database
6596                 creating these users and keeping the user list in sync with the
6597                 Windows NT PDC is an onerous task. This option allows <B
6598 CLASS="COMMAND"
6599 >               smbd</B
6600 > to delete the required UNIX users <EM
6601 >ON
6602                 DEMAND</EM
6603 > when a user accesses the Samba server and the
6604                 Windows NT user no longer exists.</P
6605 ><P
6606 >In order to use this option, <B
6607 CLASS="COMMAND"
6608 >smbd</B
6609 > must be
6610                 set to <TT
6611 CLASS="PARAMETER"
6612 ><I
6613 >security=domain</I
6614 ></TT
6615 > and <TT
6616 CLASS="PARAMETER"
6617 ><I
6618 >delete
6619                 user script</I
6620 ></TT
6621 > must be set to a full pathname for a script
6622                 that will delete a UNIX user given one argument of <TT
6623 CLASS="PARAMETER"
6624 ><I
6625 >%u
6626                 </I
6627 ></TT
6628 >, which expands into the UNIX user name to delete.
6629                 <EM
6630 >NOTE</EM
6631 > that this is different to the <A
6632 HREF="#ADDUSERSCRIPT"
6633 ><TT
6634 CLASS="PARAMETER"
6635 ><I
6636 >add user script</I
6637 ></TT
6638 ></A
6639 >
6640                 which will work with the <TT
6641 CLASS="PARAMETER"
6642 ><I
6643 >security=server</I
6644 ></TT
6645 > option
6646                 as well as <TT
6647 CLASS="PARAMETER"
6648 ><I
6649 >security=domain</I
6650 ></TT
6651 >. The reason for this
6652                 is only when Samba is a domain member does it get the information
6653                 on an attempted user logon that a user no longer exists. In the
6654                 <TT
6655 CLASS="PARAMETER"
6656 ><I
6657 >security=server</I
6658 ></TT
6659 > mode a missing user
6660                 is treated the same as an invalid password logon attempt. Deleting
6661                 the user in this circumstance would not be a good idea.</P
6662 ><P
6663 >When the Windows user attempts to access the Samba server,
6664                 at <EM
6665 >login</EM
6666 > (session setup in the SMB protocol)
6667                 time, <B
6668 CLASS="COMMAND"
6669 >smbd</B
6670 > contacts the <A
6671 HREF="#PASSWORDSERVER"
6672 >               <TT
6673 CLASS="PARAMETER"
6674 ><I
6675 >password server</I
6676 ></TT
6677 ></A
6678 > and attempts to authenticate
6679                 the given user with the given password. If the authentication fails
6680                 with the specific Domain error code meaning that the user no longer
6681                 exists then <B
6682 CLASS="COMMAND"
6683 >smbd</B
6684 > attempts to find a UNIX user in
6685                 the UNIX password database that matches the Windows user account. If
6686                 this lookup succeeds, and <TT
6687 CLASS="PARAMETER"
6688 ><I
6689 >delete user script</I
6690 ></TT
6691 > is
6692                 set then <B
6693 CLASS="COMMAND"
6694 >smbd</B
6695 > will all the specified script
6696                 <EM
6697 >AS ROOT</EM
6698 >, expanding any <TT
6699 CLASS="PARAMETER"
6700 ><I
6701 >%u</I
6702 ></TT
6703 >
6704                 argument to be the user name to delete.</P
6705 ><P
6706 >This script should delete the given UNIX username. In this way,
6707                 UNIX users are dynamically deleted to match existing Windows NT
6708                 accounts.</P
6709 ><P
6710 >See also <A
6711 HREF="#SECURITYEQUALSDOMAIN"
6712 >security=domain</A
6713 >,
6714                 <A
6715 HREF="#PASSWORDSERVER"
6716 ><TT
6717 CLASS="PARAMETER"
6718 ><I
6719 >password server</I
6720 ></TT
6721 >
6722                 </A
6723 >, <A
6724 HREF="#ADDUSERSCRIPT"
6725 ><TT
6726 CLASS="PARAMETER"
6727 ><I
6728 >add user script</I
6729 ></TT
6730 >
6731                 </A
6732 >.</P
6733 ><P
6734 >Default: <B
6735 CLASS="COMMAND"
6736 >delete user script = &#60;empty string&#62;
6737                 </B
6738 ></P
6739 ><P
6740 >Example: <B
6741 CLASS="COMMAND"
6742 >delete user script = /usr/local/samba/bin/del_user
6743                 %u</B
6744 ></P
6745 ></DD
6746 ><DT
6747 ><A
6748 NAME="DELETEVETOFILES"
6749 ></A
6750 >delete veto files (S)</DT
6751 ><DD
6752 ><P
6753 >This option is used when Samba is attempting to
6754                 delete a directory that contains one or more vetoed directories
6755                 (see the <A
6756 HREF="#VETOFILES"
6757 ><TT
6758 CLASS="PARAMETER"
6759 ><I
6760 >veto files</I
6761 ></TT
6762 ></A
6763 >
6764                 option).  If this option is set to False (the default) then if a vetoed
6765                 directory contains any non-vetoed files or directories then the
6766                 directory delete will fail. This is usually what you want.</P
6767 ><P
6768 >If this option is set to <TT
6769 CLASS="CONSTANT"
6770 >True</TT
6771 >, then Samba
6772                 will attempt to recursively delete any files and directories within
6773                 the vetoed directory. This can be useful for integration with file
6774                 serving systems such as NetAtalk which create meta-files within
6775                 directories you might normally veto DOS/Windows users from seeing
6776                 (e.g. <TT
6777 CLASS="FILENAME"
6778 >.AppleDouble</TT
6779 >)</P
6780 ><P
6781 >Setting <B
6782 CLASS="COMMAND"
6783 >delete veto files = yes</B
6784 > allows these
6785                 directories to be  transparently deleted when the parent directory
6786                 is deleted (so long as the user has permissions to do so).</P
6787 ><P
6788 >See also the <A
6789 HREF="#VETOFILES"
6790 ><TT
6791 CLASS="PARAMETER"
6792 ><I
6793 >veto
6794                 files</I
6795 ></TT
6796 ></A
6797 > parameter.</P
6798 ><P
6799 >Default: <B
6800 CLASS="COMMAND"
6801 >delete veto files = no</B
6802 ></P
6803 ></DD
6804 ><DT
6805 ><A
6806 NAME="DENYHOSTS"
6807 ></A
6808 >deny hosts (S)</DT
6809 ><DD
6810 ><P
6811 >Synonym for <A
6812 HREF="#HOSTSDENY"
6813 ><TT
6814 CLASS="PARAMETER"
6815 ><I
6816 >hosts
6817                 deny</I
6818 ></TT
6819 ></A
6820 >.</P
6821 ></DD
6822 ><DT
6823 ><A
6824 NAME="DFREECOMMAND"
6825 ></A
6826 >dfree command (G)</DT
6827 ><DD
6828 ><P
6829 >The <TT
6830 CLASS="PARAMETER"
6831 ><I
6832 >dfree command</I
6833 ></TT
6834 > setting should
6835                 only be used on systems where a problem occurs with the internal
6836                 disk space calculations. This has been known to happen with Ultrix,
6837                 but may occur with other operating systems. The symptom that was
6838                 seen was an error of "Abort Retry Ignore" at the end of each
6839                 directory listing.</P
6840 ><P
6841 >This setting allows the replacement of the internal routines to
6842                 calculate the total disk space and amount available with an external
6843                 routine. The example below gives a possible script that might fulfill
6844                 this function.</P
6845 ><P
6846 >The external program will be passed a single parameter indicating
6847                 a directory in the filesystem being queried. This will typically consist
6848                 of the string <TT
6849 CLASS="FILENAME"
6850 >./</TT
6851 >. The script should return two
6852                 integers in ASCII. The first should be the total disk space in blocks,
6853                 and the second should be the number of available blocks. An optional
6854                 third return value can give the block size in bytes. The default
6855                 blocksize is 1024 bytes.</P
6856 ><P
6857 >Note: Your script should <EM
6858 >NOT</EM
6859 > be setuid or
6860                 setgid and should be owned by (and writeable only by) root!</P
6861 ><P
6862 >Default: <EM
6863 >By default internal routines for
6864                 determining the disk capacity and remaining space will be used.
6865                 </EM
6866 ></P
6867 ><P
6868 >Example: <B
6869 CLASS="COMMAND"
6870 >dfree command = /usr/local/samba/bin/dfree
6871                 </B
6872 ></P
6873 ><P
6874 >Where the script dfree (which must be made executable) could be:</P
6875 ><P
6876 ><TABLE
6877 BORDER="0"
6878 BGCOLOR="#E0E0E0"
6879 WIDTH="90%"
6880 ><TR
6881 ><TD
6882 ><PRE
6883 CLASS="PROGRAMLISTING"
6884 >
6885                 #!/bin/sh
6886                 df $1 | tail -1 | awk '{print $2" "$4}'
6887                 </PRE
6888 ></TD
6889 ></TR
6890 ></TABLE
6891 ></P
6892 ><P
6893 >or perhaps (on Sys V based systems):</P
6894 ><P
6895 ><TABLE
6896 BORDER="0"
6897 BGCOLOR="#E0E0E0"
6898 WIDTH="90%"
6899 ><TR
6900 ><TD
6901 ><PRE
6902 CLASS="PROGRAMLISTING"
6903 >
6904                 #!/bin/sh
6905                 /usr/bin/df -k $1 | tail -1 | awk '{print $3" "$5}'
6906                 </PRE
6907 ></TD
6908 ></TR
6909 ></TABLE
6910 ></P
6911 ><P
6912 >Note that you may have to replace the command names
6913                 with full path names on some systems.</P
6914 ></DD
6915 ><DT
6916 ><A
6917 NAME="DIRECTORY"
6918 ></A
6919 >directory (S)</DT
6920 ><DD
6921 ><P
6922 >Synonym for <A
6923 HREF="#PATH"
6924 ><TT
6925 CLASS="PARAMETER"
6926 ><I
6927 >path
6928                 </I
6929 ></TT
6930 ></A
6931 >.</P
6932 ></DD
6933 ><DT
6934 ><A
6935 NAME="DIRECTORYMASK"
6936 ></A
6937 >directory mask (S)</DT
6938 ><DD
6939 ><P
6940 >This parameter is the octal modes which are
6941                 used when converting DOS modes to UNIX modes when creating UNIX
6942                 directories.</P
6943 ><P
6944 >When a directory is created, the necessary permissions are
6945                 calculated according to the mapping from DOS modes to UNIX permissions,
6946                 and the resulting UNIX mode is then bit-wise 'AND'ed with this
6947                 parameter. This parameter may be thought of as a bit-wise MASK for
6948                 the UNIX modes of a directory. Any bit <EM
6949 >not</EM
6950 > set
6951                 here will be removed from the modes set on a directory when it is
6952                 created.</P
6953 ><P
6954 >The default value of this parameter removes the 'group'
6955                 and 'other' write bits from the UNIX mode, allowing only the
6956                 user who owns the directory to modify it.</P
6957 ><P
6958 >Following this Samba will bit-wise 'OR' the UNIX mode
6959                 created from this parameter with the value of the <A
6960 HREF="#FORCEDIRECTORYMODE"
6961 ><TT
6962 CLASS="PARAMETER"
6963 ><I
6964 >force directory mode
6965                 </I
6966 ></TT
6967 ></A
6968 > parameter. This parameter is set to 000 by
6969                 default (i.e. no extra mode bits are added).</P
6970 ><P
6971 >Note that this parameter does not apply to permissions
6972                 set by Windows NT/2000 ACL editors. If the administrator wishes to enforce
6973                 a mask on access control lists also, they need to set the <A
6974 HREF="#DIRECTORYSECURITYMASK"
6975 ><TT
6976 CLASS="PARAMETER"
6977 ><I
6978 >directory security mask</I
6979 ></TT
6980 ></A
6981 >.</P
6982 ><P
6983 >See the <A
6984 HREF="#FORCEDIRECTORYMODE"
6985 ><TT
6986 CLASS="PARAMETER"
6987 ><I
6988 >force
6989                 directory mode</I
6990 ></TT
6991 ></A
6992 > parameter to cause particular mode
6993                 bits to always be set on created directories.</P
6994 ><P
6995 >See also the <A
6996 HREF="#CREATEMODE"
6997 ><TT
6998 CLASS="PARAMETER"
6999 ><I
7000 >create mode
7001                 </I
7002 ></TT
7003 ></A
7004 > parameter for masking mode bits on created files,
7005                 and the <A
7006 HREF="#DIRECTORYSECURITYMASK"
7007 ><TT
7008 CLASS="PARAMETER"
7009 ><I
7010 >directory
7011                 security mask</I
7012 ></TT
7013 ></A
7014 > parameter.</P
7015 ><P
7016 >Also refer to the <A
7017 HREF="#INHERITPERMISSIONS"
7018 ><TT
7019 CLASS="PARAMETER"
7020 ><I
7021 >               inherit permissions</I
7022 ></TT
7023 ></A
7024 > parameter.</P
7025 ><P
7026 >Default: <B
7027 CLASS="COMMAND"
7028 >directory mask = 0755</B
7029 ></P
7030 ><P
7031 >Example: <B
7032 CLASS="COMMAND"
7033 >directory mask = 0775</B
7034 ></P
7035 ></DD
7036 ><DT
7037 ><A
7038 NAME="DIRECTORYMODE"
7039 ></A
7040 >directory mode (S)</DT
7041 ><DD
7042 ><P
7043 >Synonym for <A
7044 HREF="#DIRECTORYMASK"
7045 ><TT
7046 CLASS="PARAMETER"
7047 ><I
7048 >               directory mask</I
7049 ></TT
7050 ></A
7051 ></P
7052 ></DD
7053 ><DT
7054 ><A
7055 NAME="DIRECTORYSECURITYMASK"
7056 ></A
7057 >directory security mask (S)</DT
7058 ><DD
7059 ><P
7060 >This parameter controls what UNIX permission bits
7061                 can be modified when a Windows NT client is manipulating the UNIX
7062                 permission on a directory using the native NT security dialog
7063                 box.</P
7064 ><P
7065 >This parameter is applied as a mask (AND'ed with) to
7066                 the changed permission bits, thus preventing any bits not in
7067                 this mask from being modified. Essentially, zero bits in this
7068                 mask may be treated as a set of bits the user is not allowed
7069                 to change.</P
7070 ><P
7071 >If not set explicitly this parameter is set to 0777
7072                 meaning a user is allowed to modify all the user/group/world
7073                 permissions on a directory.</P
7074 ><P
7075 ><EM
7076 >Note</EM
7077 > that users who can access the
7078                 Samba server through other means can easily bypass this restriction,
7079                 so it is primarily useful for standalone "appliance" systems.
7080                 Administrators of most normal systems will probably want to leave
7081                 it as the default of 0777.</P
7082 ><P
7083 >See also the <A
7084 HREF="#FORCEDIRECTORYSECURITYMODE"
7085 ><TT
7086 CLASS="PARAMETER"
7087 ><I
7088 >               force directory security mode</I
7089 ></TT
7090 ></A
7091 >, <A
7092 HREF="#SECURITYMASK"
7093 ><TT
7094 CLASS="PARAMETER"
7095 ><I
7096 >security mask</I
7097 ></TT
7098 ></A
7099 >,
7100                 <A
7101 HREF="#FORCESECURITYMODE"
7102 ><TT
7103 CLASS="PARAMETER"
7104 ><I
7105 >force security mode
7106                 </I
7107 ></TT
7108 ></A
7109 > parameters.</P
7110 ><P
7111 >Default: <B
7112 CLASS="COMMAND"
7113 >directory security mask = 0777</B
7114 ></P
7115 ><P
7116 >Example: <B
7117 CLASS="COMMAND"
7118 >directory security mask = 0700</B
7119 ></P
7120 ></DD
7121 ><DT
7122 ><A
7123 NAME="DNSPROXY"
7124 ></A
7125 >dns proxy (G)</DT
7126 ><DD
7127 ><P
7128 >Specifies that <A
7129 HREF="nmbd.8.html"
7130 TARGET="_top"
7131 >nmbd(8)</A
7132 >
7133                 when acting as a WINS server and finding that a NetBIOS name has not
7134                 been registered, should treat the NetBIOS name word-for-word as a DNS
7135                 name and do a lookup with the DNS server for that name on behalf of
7136                 the name-querying client.</P
7137 ><P
7138 >Note that the maximum length for a NetBIOS name is 15
7139                 characters, so the DNS name (or DNS alias) can likewise only be
7140                 15 characters, maximum.</P
7141 ><P
7142 ><B
7143 CLASS="COMMAND"
7144 >nmbd</B
7145 > spawns a second copy of itself to do the
7146                 DNS name lookup requests, as doing a name lookup is a blocking
7147                 action.</P
7148 ><P
7149 >See also the parameter <A
7150 HREF="#WINSSUPPORT"
7151 ><TT
7152 CLASS="PARAMETER"
7153 ><I
7154 >               wins support</I
7155 ></TT
7156 ></A
7157 >.</P
7158 ><P
7159 >Default: <B
7160 CLASS="COMMAND"
7161 >dns proxy = yes</B
7162 ></P
7163 ></DD
7164 ><DT
7165 ><A
7166 NAME="DOMAINADMINGROUP"
7167 ></A
7168 >domain admin group (G)</DT
7169 ><DD
7170 ><P
7171 >This parameter is intended as a temporary solution
7172                 to enable users to be a member of the "Domain Admins" group when
7173                 a Samba host is acting as a PDC.  A complete solution will be provided
7174                 by a system for mapping Windows NT/2000 groups onto UNIX groups.
7175                 Please note that this parameter has a somewhat confusing name.  It
7176                 accepts a list of usernames and of group names in standard
7177                 <TT
7178 CLASS="FILENAME"
7179 >smb.conf</TT
7180 >       notation.
7181                 </P
7182 ><P
7183 >See also <A
7184 HREF="#DOMAINGUESTGROUP"
7185 ><TT
7186 CLASS="PARAMETER"
7187 ><I
7188 >domain
7189                 guest group</I
7190 ></TT
7191 ></A
7192 >, <A
7193 HREF="#DOMAINLOGONS"
7194 ><TT
7195 CLASS="PARAMETER"
7196 ><I
7197 >domain
7198                 logons</I
7199 ></TT
7200 ></A
7201 >
7202                 </P
7203 ><P
7204 >Default: <EM
7205 >no domain administrators</EM
7206 ></P
7207 ><P
7208 >Example: <B
7209 CLASS="COMMAND"
7210 >domain admin group = root @wheel</B
7211 ></P
7212 ></DD
7213 ><DT
7214 ><A
7215 NAME="DOMAINGUESTGROUP"
7216 ></A
7217 >domain guest group (G)</DT
7218 ><DD
7219 ><P
7220 >This parameter is intended as a temporary solution
7221                 to enable users to be a member of the "Domain Guests" group when
7222                 a Samba host is acting as a PDC.  A complete solution will be provided
7223                 by a system for mapping Windows NT/2000 groups onto UNIX groups.
7224                 Please note that this parameter has a somewhat confusing name.  It
7225                 accepts a list of usernames and of group names in standard
7226                 <TT
7227 CLASS="FILENAME"
7228 >smb.conf</TT
7229 >       notation.
7230                 </P
7231 ><P
7232 >See also <A
7233 HREF="#DOMAINADMINGROUP"
7234 ><TT
7235 CLASS="PARAMETER"
7236 ><I
7237 >domain
7238                 admin group</I
7239 ></TT
7240 ></A
7241 >, <A
7242 HREF="#DOMAINLOGONS"
7243 ><TT
7244 CLASS="PARAMETER"
7245 ><I
7246 >domain
7247                 logons</I
7248 ></TT
7249 ></A
7250 >
7251                 </P
7252 ><P
7253 >Default: <EM
7254 >no domain guests</EM
7255 ></P
7256 ><P
7257 >Example: <B
7258 CLASS="COMMAND"
7259 >domain guest group = nobody @guest</B
7260 ></P
7261 ></DD
7262 ><DT
7263 ><A
7264 NAME="DOMAINLOGONS"
7265 ></A
7266 >domain logons (G)</DT
7267 ><DD
7268 ><P
7269 >If set to true, the Samba server will serve
7270                 Windows 95/98 Domain logons for the <A
7271 HREF="#WORKGROUP"
7272 >               <TT
7273 CLASS="PARAMETER"
7274 ><I
7275 >workgroup</I
7276 ></TT
7277 ></A
7278 > it is in. Samba 2.2 also
7279                 has limited capability to act as a domain controller for Windows
7280                 NT 4 Domains.  For more details on setting up this feature see
7281                 the file DOMAINS.txt in the Samba documentation directory <TT
7282 CLASS="FILENAME"
7283 >docs/
7284                 </TT
7285 > shipped with the source code.</P
7286 ><P
7287 >Default: <B
7288 CLASS="COMMAND"
7289 >domain logons = no</B
7290 ></P
7291 ></DD
7292 ><DT
7293 ><A
7294 NAME="DOMAINMASTER"
7295 ></A
7296 >domain master (G)</DT
7297 ><DD
7298 ><P
7299 >Tell <A
7300 HREF="nmbd.8.html"
7301 TARGET="_top"
7302 ><B
7303 CLASS="COMMAND"
7304 >               nmbd(8)</B
7305 ></A
7306 > to enable WAN-wide browse list
7307                 collation. Setting this option causes <B
7308 CLASS="COMMAND"
7309 >nmbd</B
7310 > to
7311                 claim a special domain specific NetBIOS name that identifies
7312                 it as a domain master browser for its given <A
7313 HREF="#WORKGROUP"
7314 >               <TT
7315 CLASS="PARAMETER"
7316 ><I
7317 >workgroup</I
7318 ></TT
7319 ></A
7320 >. Local master browsers
7321                 in the same <TT
7322 CLASS="PARAMETER"
7323 ><I
7324 >workgroup</I
7325 ></TT
7326 > on broadcast-isolated
7327                 subnets will give this <B
7328 CLASS="COMMAND"
7329 >nmbd</B
7330 > their local browse lists,
7331                 and then ask <A
7332 HREF="smbd.8.html"
7333 TARGET="_top"
7334 ><B
7335 CLASS="COMMAND"
7336 >smbd(8)</B
7337 ></A
7338 >
7339                 for a complete copy of the browse list for the whole wide area
7340                 network.  Browser clients will then contact their local master browser,
7341                 and will receive the domain-wide browse list, instead of just the list
7342                 for their broadcast-isolated subnet.</P
7343 ><P
7344 >Note that Windows NT Primary Domain Controllers expect to be
7345                 able to claim this <TT
7346 CLASS="PARAMETER"
7347 ><I
7348 >workgroup</I
7349 ></TT
7350 > specific special
7351                 NetBIOS name that identifies them as domain master browsers for
7352                 that <TT
7353 CLASS="PARAMETER"
7354 ><I
7355 >workgroup</I
7356 ></TT
7357 > by default (i.e. there is no
7358                 way to prevent a Windows NT PDC from attempting to do this). This
7359                 means that if this parameter is set and <B
7360 CLASS="COMMAND"
7361 >nmbd</B
7362 > claims
7363                 the special name for a <TT
7364 CLASS="PARAMETER"
7365 ><I
7366 >workgroup</I
7367 ></TT
7368 > before a Windows
7369                 NT PDC is able to do so then cross subnet browsing will behave
7370                 strangely and may fail.</P
7371 ><P
7372 >If <A
7373 HREF="#DOMAINLOGONS"
7374 ><B
7375 CLASS="COMMAND"
7376 >domain logons = yes</B
7377 >
7378                 </A
7379 >, then the default behavior is to enable the <TT
7380 CLASS="PARAMETER"
7381 ><I
7382 >domain
7383                 master</I
7384 ></TT
7385 > parameter.  If <TT
7386 CLASS="PARAMETER"
7387 ><I
7388 >domain logons</I
7389 ></TT
7390 > is
7391                 not enabled (the default setting), then neither will <TT
7392 CLASS="PARAMETER"
7393 ><I
7394 >domain
7395                 master</I
7396 ></TT
7397 > be enabled by default.</P
7398 ><P
7399 >Default: <B
7400 CLASS="COMMAND"
7401 >domain master = auto</B
7402 ></P
7403 ></DD
7404 ><DT
7405 ><A
7406 NAME="DONTDESCEND"
7407 ></A
7408 >dont descend (S)</DT
7409 ><DD
7410 ><P
7411 >There are certain directories on some systems
7412                 (e.g., the <TT
7413 CLASS="FILENAME"
7414 >/proc</TT
7415 > tree under Linux) that are either not
7416                 of interest to clients or are infinitely deep (recursive). This
7417                 parameter allows you to specify a comma-delimited list of directories
7418                 that the server should always show as empty.</P
7419 ><P
7420 >Note that Samba can be very fussy about the exact format
7421                 of the "dont descend" entries. For example you may need <TT
7422 CLASS="FILENAME"
7423 >               ./proc</TT
7424 > instead of just <TT
7425 CLASS="FILENAME"
7426 >/proc</TT
7427 >.
7428                 Experimentation is the best policy :-)  </P
7429 ><P
7430 >Default: <EM
7431 >none (i.e., all directories are OK
7432                 to descend)</EM
7433 ></P
7434 ><P
7435 >Example: <B
7436 CLASS="COMMAND"
7437 >dont descend = /proc,/dev</B
7438 ></P
7439 ></DD
7440 ><DT
7441 ><A
7442 NAME="DOSFILEMODE"
7443 ></A
7444 >dos filemode (S)</DT
7445 ><DD
7446 ><P
7447 > The default behavior in Samba is to provide
7448                 UNIX-like behavor where only the owner of a file/directory is
7449                 able to change the permissions on it.  However, this behavior
7450                 is often confusing to  DOS/Windows users.  Enabling this parameter
7451                 allows a user who has write access to the file (by whatever
7452                 means) to modify the permissions on it.  Note that a user
7453                 belonging to the group owning the file will not be allowed to
7454                 change permissions if the group is only granted read access.
7455                 Ownership of the file/directory is not changed, only the permissions
7456                 are modified.</P
7457 ><P
7458 >Default: <B
7459 CLASS="COMMAND"
7460 >dos filemode = no</B
7461 ></P
7462 ></DD
7463 ><DT
7464 ><A
7465 NAME="DOSFILETIMERESOLUTION"
7466 ></A
7467 >dos filetime resolution (S)</DT
7468 ><DD
7469 ><P
7470 >Under the DOS and Windows FAT filesystem, the finest
7471                 granularity on time resolution is two seconds. Setting this parameter
7472                 for a share causes Samba to round the reported time down to the
7473                 nearest two second boundary when a query call that requires one second
7474                 resolution is made to <A
7475 HREF="smbd.8.html"
7476 TARGET="_top"
7477 ><B
7478 CLASS="COMMAND"
7479 >smbd(8)</B
7480 >
7481                 </A
7482 >.</P
7483 ><P
7484 >This option is mainly used as a compatibility option for Visual
7485                 C++ when used against Samba shares. If oplocks are enabled on a
7486                 share, Visual C++ uses two different time reading calls to check if a
7487                 file has changed since it was last read. One of these calls uses a
7488                 one-second granularity, the other uses a two second granularity. As
7489                 the two second call rounds any odd second down, then if the file has a
7490                 timestamp of an odd number of seconds then the two timestamps will not
7491                 match and Visual C++ will keep reporting the file has changed. Setting
7492                 this option causes the two timestamps to match, and Visual C++ is
7493                 happy.</P
7494 ><P
7495 >Default: <B
7496 CLASS="COMMAND"
7497 >dos filetime resolution = no</B
7498 ></P
7499 ></DD
7500 ><DT
7501 ><A
7502 NAME="DOSFILETIMES"
7503 ></A
7504 >dos filetimes (S)</DT
7505 ><DD
7506 ><P
7507 >Under DOS and Windows, if a user can write to a
7508                 file they can change the timestamp on it. Under POSIX semantics,
7509                 only the owner of the file or root may change the timestamp. By
7510                 default, Samba runs with POSIX semantics and refuses to change the
7511                 timestamp on a file if the user <B
7512 CLASS="COMMAND"
7513 >smbd</B
7514 > is acting
7515                 on behalf of is not the file owner. Setting this option to <TT
7516 CLASS="CONSTANT"
7517 >               True</TT
7518 > allows DOS semantics and smbd will change the file
7519                 timestamp as DOS requires.</P
7520 ><P
7521 >Default: <B
7522 CLASS="COMMAND"
7523 >dos filetimes = no</B
7524 ></P
7525 ></DD
7526 ><DT
7527 ><A
7528 NAME="ENCRYPTPASSWORDS"
7529 ></A
7530 >encrypt passwords (G)</DT
7531 ><DD
7532 ><P
7533 >This boolean controls whether encrypted passwords
7534                 will be negotiated with the client. Note that Windows NT 4.0 SP3 and
7535                 above and also Windows 98 will by default expect encrypted passwords
7536                 unless a registry entry is changed. To use encrypted passwords in
7537                 Samba see the file ENCRYPTION.txt in the Samba documentation
7538                 directory <TT
7539 CLASS="FILENAME"
7540 >docs/</TT
7541 > shipped with the source code.</P
7542 ><P
7543 >In order for encrypted passwords to work correctly
7544                 <A
7545 HREF="smbd.8.html"
7546 TARGET="_top"
7547 ><B
7548 CLASS="COMMAND"
7549 >smbd(8)</B
7550 ></A
7551 > must either
7552                 have access to a local <A
7553 HREF="smbpasswd.5.html"
7554 TARGET="_top"
7555 ><TT
7556 CLASS="FILENAME"
7557 >smbpasswd(5)
7558                 </TT
7559 ></A
7560 > file (see the <A
7561 HREF="smbpasswd.8.html"
7562 TARGET="_top"
7563 ><B
7564 CLASS="COMMAND"
7565 >               smbpasswd(8)</B
7566 ></A
7567 > program for information on how to set up
7568                 and maintain this file), or set the <A
7569 HREF="#SECURITY"
7570 >security=[serve|domain]</A
7571 > parameter which
7572                 causes <B
7573 CLASS="COMMAND"
7574 >smbd</B
7575 > to authenticate against another
7576                 server.</P
7577 ><P
7578 >Default: <B
7579 CLASS="COMMAND"
7580 >encrypt passwords = no</B
7581 ></P
7582 ></DD
7583 ><DT
7584 ><A
7585 NAME="ENHANCEDBROWSING"
7586 ></A
7587 >enhanced browsing (G)</DT
7588 ><DD
7589 ><P
7590 >This option enables a couple of enhancements to
7591                 cross-subnet browse propogation that have been added in Samba
7592                 but which are not standard in Microsoft implementations.
7593                 <EM
7594 >These enhancements are currently only available in
7595                 the HEAD Samba CVS tree (not Samba 2.2.x).</EM
7596 ></P
7597 ><P
7598 >The first enhancement to browse propogation consists of a regular
7599                 wildcard query to a Samba WINS server for all Domain Master Browsers,
7600                 followed by a browse synchronisation with each of the returned
7601                 DMBs. The second enhancement consists of a regular randomised browse
7602                 synchronisation with all currently known DMBs.</P
7603 ><P
7604 >You may wish to disable this option if you have a problem with empty
7605                 workgroups not disappearing from browse lists. Due to the restrictions
7606                 of the browse protocols these enhancements can cause a empty workgroup
7607                 to stay around forever which can be annoying.</P
7608 ><P
7609 >In general you should leave this option enabled as it makes
7610                 cross-subnet browse propogation much more reliable.</P
7611 ><P
7612 >Default: <B
7613 CLASS="COMMAND"
7614 >enhanced browsing = yes</B
7615 ></P
7616 ></DD
7617 ><DT
7618 ><A
7619 NAME="ENUMPORTSCOMMAND"
7620 ></A
7621 >enumports command (G)</DT
7622 ><DD
7623 ><P
7624 >The concept of a "port" is fairly foreign
7625                 to UNIX hosts.  Under Windows NT/2000 print servers, a port
7626                 is associated with a port monitor and generally takes the form of
7627                 a local port (i.e. LPT1:, COM1:, FILE:) or a remote port
7628                 (i.e. LPD Port Monitor, etc...).  By default, Samba has only one
7629                 port defined--<TT
7630 CLASS="CONSTANT"
7631 >"Samba Printer Port"</TT
7632 >.  Under
7633                 Windows NT/2000, all printers must have a valid port name.
7634                 If you wish to have a list of ports displayed (<B
7635 CLASS="COMMAND"
7636 >smbd
7637                 </B
7638 > does not use a port name for anything) other than
7639                 the default <TT
7640 CLASS="CONSTANT"
7641 >"Samba Printer Port"</TT
7642 >, you
7643                 can define <TT
7644 CLASS="PARAMETER"
7645 ><I
7646 >enumports command</I
7647 ></TT
7648 > to point to
7649                 a program which should generate a list of ports, one per line,
7650                 to standard output.  This listing will then be used in response
7651                 to the level 1 and 2 EnumPorts() RPC.</P
7652 ><P
7653 >Default: <EM
7654 >no enumports command</EM
7655 ></P
7656 ><P
7657 >Example: <B
7658 CLASS="COMMAND"
7659 >enumports command = /usr/bin/listports
7660                 </B
7661 ></P
7662 ></DD
7663 ><DT
7664 ><A
7665 NAME="EXEC"
7666 ></A
7667 >exec (S)</DT
7668 ><DD
7669 ><P
7670 >This is a synonym for <A
7671 HREF="#PREEXEC"
7672 >               <TT
7673 CLASS="PARAMETER"
7674 ><I
7675 >preexec</I
7676 ></TT
7677 ></A
7678 >.</P
7679 ></DD
7680 ><DT
7681 ><A
7682 NAME="FAKEDIRECTORYCREATETIMES"
7683 ></A
7684 >fake directory create times (S)</DT
7685 ><DD
7686 ><P
7687 >NTFS and Windows VFAT file systems keep a create
7688                 time for all files and directories. This is not the same as the
7689                 ctime - status change time - that Unix keeps, so Samba by default
7690                 reports the earliest of the various times Unix does keep. Setting
7691                 this parameter for a share causes Samba to always report midnight
7692                 1-1-1980 as the create time for directories.</P
7693 ><P
7694 >This option is mainly used as a compatibility option for
7695                 Visual C++ when used against Samba shares. Visual C++ generated
7696                 makefiles have the object directory as a dependency for each object
7697                 file, and a make rule to create the directory. Also, when NMAKE
7698                 compares timestamps it uses the creation time when examining a
7699                 directory. Thus the object directory will be created if it does not
7700                 exist, but once it does exist it will always have an earlier
7701                 timestamp than the object files it contains.</P
7702 ><P
7703 >However, Unix time semantics mean that the create time
7704                 reported by Samba will be updated whenever a file is created or
7705                 or deleted in the directory.  NMAKE finds all object files in
7706                 the object directory.  The timestamp of the last one built is then
7707                 compared to the timestamp of the object dircetory.  If the
7708                 directory's timestamp if newer, then all object files
7709                 will be rebuilt.  Enabling this option
7710                 ensures directories always predate their contents and an NMAKE build
7711                 will proceed as expected.</P
7712 ><P
7713 >Default: <B
7714 CLASS="COMMAND"
7715 >fake directory create times = no</B
7716 ></P
7717 ></DD
7718 ><DT
7719 ><A
7720 NAME="FAKEOPLOCKS"
7721 ></A
7722 >fake oplocks (S)</DT
7723 ><DD
7724 ><P
7725 >Oplocks are the way that SMB clients get permission
7726                 from a server to locally cache file operations. If a server grants
7727                 an oplock (opportunistic lock) then the client is free to assume
7728                 that it is the only one accessing the file and it will aggressively
7729                 cache file data. With some oplock types the client may even cache
7730                 file open/close operations. This can give enormous performance benefits.
7731                 </P
7732 ><P
7733 >When you set <B
7734 CLASS="COMMAND"
7735 >fake oplocks = yes</B
7736 >, <A
7737 HREF="smbd.8.html"
7738 TARGET="_top"
7739 ><B
7740 CLASS="COMMAND"
7741 >smbd(8)</B
7742 ></A
7743 > will
7744                 always grant oplock requests no matter how many clients are using
7745                 the file.</P
7746 ><P
7747 >It is generally much better to use the real <A
7748 HREF="#OPLOCKS"
7749 ><TT
7750 CLASS="PARAMETER"
7751 ><I
7752 >oplocks</I
7753 ></TT
7754 ></A
7755 > support rather
7756                 than this parameter.</P
7757 ><P
7758 >If you enable this option on all read-only shares or
7759                 shares that you know will only be accessed from one client at a
7760                 time such as physically read-only media like CDROMs, you will see
7761                 a big performance improvement on many operations. If you enable
7762                 this option on shares where multiple clients may be accessing the
7763                 files read-write at the same time you can get data corruption. Use
7764                 this option carefully!</P
7765 ><P
7766 >Default: <B
7767 CLASS="COMMAND"
7768 >fake oplocks = no</B
7769 ></P
7770 ></DD
7771 ><DT
7772 ><A
7773 NAME="FOLLOWSYMLINKS"
7774 ></A
7775 >follow symlinks (S)</DT
7776 ><DD
7777 ><P
7778 >This parameter allows the Samba administrator
7779                 to stop <A
7780 HREF="smbd.8.html"
7781 TARGET="_top"
7782 ><B
7783 CLASS="COMMAND"
7784 >smbd(8)</B
7785 ></A
7786 >
7787                 from following symbolic links in a particular share. Setting this
7788                 parameter to <TT
7789 CLASS="CONSTANT"
7790 >no</TT
7791 > prevents any file or directory
7792                 that is a symbolic link from being followed (the user will get an
7793                 error).  This option is very useful to stop users from adding a
7794                 symbolic link to <TT
7795 CLASS="FILENAME"
7796 >/etc/passwd</TT
7797 > in their home
7798                 directory for instance.  However it will slow filename lookups
7799                 down slightly.</P
7800 ><P
7801 >This option is enabled (i.e. <B
7802 CLASS="COMMAND"
7803 >smbd</B
7804 > will
7805                 follow symbolic links) by default.</P
7806 ><P
7807 >Default: <B
7808 CLASS="COMMAND"
7809 >follow symlinks = yes</B
7810 ></P
7811 ></DD
7812 ><DT
7813 ><A
7814 NAME="FORCECREATEMODE"
7815 ></A
7816 >force create mode (S)</DT
7817 ><DD
7818 ><P
7819 >This parameter specifies a set of UNIX mode bit
7820                 permissions that will <EM
7821 >always</EM
7822 > be set on a
7823                 file created by Samba. This is done by bitwise 'OR'ing these bits onto
7824                 the mode bits of a file that is being created or having its
7825                 permissions changed. The default for this parameter is (in octal)
7826                 000. The modes in this parameter are bitwise 'OR'ed onto the file
7827                 mode after the mask set in the <TT
7828 CLASS="PARAMETER"
7829 ><I
7830 >create mask</I
7831 ></TT
7832 >
7833                 parameter is applied.</P
7834 ><P
7835 >Note that by default this parameter does not apply to permissions
7836                 set by Windows NT/2000 ACL editors. If the administrator wishes to enforce
7837                 this mask on access control lists also, they need to set the <A
7838 HREF="#RESTRICTACLWITHMASK"
7839 ><TT
7840 CLASS="PARAMETER"
7841 ><I
7842 >restrict acl with
7843                 mask</I
7844 ></TT
7845 ></A
7846 > to true.</P
7847 ><P
7848 >See also the parameter <A
7849 HREF="#CREATEMASK"
7850 ><TT
7851 CLASS="PARAMETER"
7852 ><I
7853 >create
7854                 mask</I
7855 ></TT
7856 ></A
7857 > for details on masking mode bits on files.</P
7858 ><P
7859 >See also the <A
7860 HREF="#INHERITPERMISSIONS"
7861 ><TT
7862 CLASS="PARAMETER"
7863 ><I
7864 >inherit
7865                 permissions</I
7866 ></TT
7867 ></A
7868 > parameter.</P
7869 ><P
7870 >Default: <B
7871 CLASS="COMMAND"
7872 >force create mode = 000</B
7873 ></P
7874 ><P
7875 >Example: <B
7876 CLASS="COMMAND"
7877 >force create mode = 0755</B
7878 ></P
7879 ><P
7880 >would force all created files to have read and execute
7881                 permissions set for 'group' and 'other' as well as the
7882                 read/write/execute bits set for the 'user'.</P
7883 ></DD
7884 ><DT
7885 ><A
7886 NAME="FORCEDIRECTORYMODE"
7887 ></A
7888 >force directory mode (S)</DT
7889 ><DD
7890 ><P
7891 >This parameter specifies a set of UNIX mode bit
7892                 permissions that will <EM
7893 >always</EM
7894 > be set on a directory
7895                 created by Samba. This is done by bitwise 'OR'ing these bits onto the
7896                 mode bits of a directory that is being created. The default for this
7897                 parameter is (in octal) 0000 which will not add any extra permission
7898                 bits to a created directory. This operation is done after the mode
7899                 mask in the parameter <TT
7900 CLASS="PARAMETER"
7901 ><I
7902 >directory mask</I
7903 ></TT
7904 > is
7905                 applied.</P
7906 ><P
7907 >Note that by default this parameter does not apply to permissions
7908                 set by Windows NT/2000 ACL editors. If the administrator wishes to enforce
7909                 this mask on access control lists also, they need to set the <A
7910 HREF="#RESTRICTACLWITHMASK"
7911 ><TT
7912 CLASS="PARAMETER"
7913 ><I
7914 >restrict acl with
7915                 mask</I
7916 ></TT
7917 ></A
7918 > to true.</P
7919 ><P
7920 >See also the parameter <A
7921 HREF="#DIRECTORYMASK"
7922 ><TT
7923 CLASS="PARAMETER"
7924 ><I
7925 >               directory mask</I
7926 ></TT
7927 ></A
7928 > for details on masking mode bits
7929                 on created directories.</P
7930 ><P
7931 >See also the <A
7932 HREF="#INHERITPERMISSIONS"
7933 ><TT
7934 CLASS="PARAMETER"
7935 ><I
7936 >               inherit permissions</I
7937 ></TT
7938 ></A
7939 > parameter.</P
7940 ><P
7941 >Default: <B
7942 CLASS="COMMAND"
7943 >force directory mode = 000</B
7944 ></P
7945 ><P
7946 >Example: <B
7947 CLASS="COMMAND"
7948 >force directory mode = 0755</B
7949 ></P
7950 ><P
7951 >would force all created directories to have read and execute
7952                 permissions set for 'group' and 'other' as well as the
7953                 read/write/execute bits set for the 'user'.</P
7954 ></DD
7955 ><DT
7956 ><A
7957 NAME="FORCEDIRECTORYSECURITYMODE"
7958 ></A
7959 >force directory
7960                 security mode (S)</DT
7961 ><DD
7962 ><P
7963 >This parameter controls what UNIX permission bits
7964                 can be modified when a Windows NT client is manipulating the UNIX
7965                 permission on a directory using the native NT security dialog box.</P
7966 ><P
7967 >This parameter is applied as a mask (OR'ed with) to the
7968                 changed permission bits, thus forcing any bits in this mask that
7969                 the user may have modified to be on. Essentially, one bits in this
7970                 mask may be treated as a set of bits that, when modifying security
7971                 on a directory, the user has always set to be 'on'.</P
7972 ><P
7973 >If not set explicitly this parameter is 000, which
7974                 allows a user to modify all the user/group/world permissions on a
7975                 directory without restrictions.</P
7976 ><P
7977 ><EM
7978 >Note</EM
7979 > that users who can access the
7980                 Samba server through other means can easily bypass this restriction,
7981                 so it is primarily useful for standalone "appliance" systems.
7982                 Administrators of most normal systems will probably want to leave
7983                 it set as 0000.</P
7984 ><P
7985 >See also the <A
7986 HREF="#DIRECTORYSECURITYMASK"
7987 ><TT
7988 CLASS="PARAMETER"
7989 ><I
7990 >               directory security mask</I
7991 ></TT
7992 ></A
7993 >, <A
7994 HREF="#SECURITYMASK"
7995 >               <TT
7996 CLASS="PARAMETER"
7997 ><I
7998 >security mask</I
7999 ></TT
8000 ></A
8001 >,
8002                 <A
8003 HREF="#FORCESECURITYMODE"
8004 ><TT
8005 CLASS="PARAMETER"
8006 ><I
8007 >force security mode
8008                 </I
8009 ></TT
8010 ></A
8011 > parameters.</P
8012 ><P
8013 >Default: <B
8014 CLASS="COMMAND"
8015 >force directory security mode = 0</B
8016 ></P
8017 ><P
8018 >Example: <B
8019 CLASS="COMMAND"
8020 >force directory security mode = 700</B
8021 ></P
8022 ></DD
8023 ><DT
8024 ><A
8025 NAME="FORCEGROUP"
8026 ></A
8027 >force group (S)</DT
8028 ><DD
8029 ><P
8030 >This specifies a UNIX group name that will be
8031                 assigned as the default primary group for all users connecting
8032                 to this service. This is useful for sharing files by ensuring
8033                 that all access to files on service will use the named group for
8034                 their permissions checking. Thus, by assigning permissions for this
8035                 group to the files and directories within this service the Samba
8036                 administrator can restrict or allow sharing of these files.</P
8037 ><P
8038 >In Samba 2.0.5 and above this parameter has extended
8039                 functionality in the following way. If the group name listed here
8040                 has a '+' character prepended to it then the current user accessing
8041                 the share only has the primary group default assigned to this group
8042                 if they are already assigned as a member of that group. This allows
8043                 an administrator to decide that only users who are already in a
8044                 particular group will create files with group ownership set to that
8045                 group. This gives a finer granularity of ownership assignment. For
8046                 example, the setting <TT
8047 CLASS="FILENAME"
8048 >force group = +sys</TT
8049 > means
8050                 that only users who are already in group sys will have their default
8051                 primary group assigned to sys when accessing this Samba share. All
8052                 other users will retain their ordinary primary group.</P
8053 ><P
8054 >If the <A
8055 HREF="#FORCEUSER"
8056 ><TT
8057 CLASS="PARAMETER"
8058 ><I
8059 >force user
8060                 </I
8061 ></TT
8062 ></A
8063 > parameter is also set the group specified in
8064                 <TT
8065 CLASS="PARAMETER"
8066 ><I
8067 >force group</I
8068 ></TT
8069 > will override the primary group
8070                 set in <TT
8071 CLASS="PARAMETER"
8072 ><I
8073 >force user</I
8074 ></TT
8075 >.</P
8076 ><P
8077 >See also <A
8078 HREF="#FORCEUSER"
8079 ><TT
8080 CLASS="PARAMETER"
8081 ><I
8082 >force
8083                 user</I
8084 ></TT
8085 ></A
8086 >.</P
8087 ><P
8088 >Default: <EM
8089 >no forced group</EM
8090 ></P
8091 ><P
8092 >Example: <B
8093 CLASS="COMMAND"
8094 >force group = agroup</B
8095 ></P
8096 ></DD
8097 ><DT
8098 ><A
8099 NAME="FORCESECURITYMODE"
8100 ></A
8101 >force security mode (S)</DT
8102 ><DD
8103 ><P
8104 >This parameter controls what UNIX permission
8105                 bits can be modified when a Windows NT client is manipulating
8106                 the UNIX permission on a file using the native NT security dialog
8107                 box.</P
8108 ><P
8109 >This parameter is applied as a mask (OR'ed with) to the
8110                 changed permission bits, thus forcing any bits in this mask that
8111                 the user may have modified to be on. Essentially, one bits in this
8112                 mask may be treated as a set of bits that, when modifying security
8113                 on a file, the user has always set to be 'on'.</P
8114 ><P
8115 >If not set explicitly this parameter is set to 0,
8116                 and allows a user to modify all the user/group/world permissions on a file,
8117                 with no restrictions.</P
8118 ><P
8119 ><EM
8120 >Note</EM
8121 > that users who can access
8122                 the Samba server through other means can easily bypass this restriction,
8123                 so it is primarily useful for standalone "appliance" systems.
8124                 Administrators of most normal systems will probably want to leave
8125                 this set to 0000.</P
8126 ><P
8127 >See also the <A
8128 HREF="#FORCEDIRECTORYSECURITYMODE"
8129 ><TT
8130 CLASS="PARAMETER"
8131 ><I
8132 >               force directory security mode</I
8133 ></TT
8134 ></A
8135 >,
8136                 <A
8137 HREF="#DIRECTORYSECURITYMASK"
8138 ><TT
8139 CLASS="PARAMETER"
8140 ><I
8141 >directory security
8142                 mask</I
8143 ></TT
8144 ></A
8145 >, <A
8146 HREF="#SECURITYMASK"
8147 ><TT
8148 CLASS="PARAMETER"
8149 ><I
8150 >               security mask</I
8151 ></TT
8152 ></A
8153 > parameters.</P
8154 ><P
8155 >Default: <B
8156 CLASS="COMMAND"
8157 >force security mode = 0</B
8158 ></P
8159 ><P
8160 >Example: <B
8161 CLASS="COMMAND"
8162 >force security mode = 700</B
8163 ></P
8164 ></DD
8165 ><DT
8166 ><A
8167 NAME="FORCEUSER"
8168 ></A
8169 >force user (S)</DT
8170 ><DD
8171 ><P
8172 >This specifies a UNIX user name that will be
8173                 assigned as the default user for all users connecting to this service.
8174                 This is useful for sharing files. You should also use it carefully
8175                 as using it incorrectly can cause security problems.</P
8176 ><P
8177 >This user name only gets used once a connection is established.
8178                 Thus clients still need to connect as a valid user and supply a
8179                 valid password. Once connected, all file operations will be performed
8180                 as the "forced user", no matter what username the client connected
8181                 as.  This can be very useful.</P
8182 ><P
8183 >In Samba 2.0.5 and above this parameter also causes the
8184                 primary group of the forced user to be used as the primary group
8185                 for all file activity. Prior to 2.0.5 the primary group was left
8186                 as the primary group of the connecting user (this was a bug).</P
8187 ><P
8188 >See also <A
8189 HREF="#FORCEGROUP"
8190 ><TT
8191 CLASS="PARAMETER"
8192 ><I
8193 >force group
8194                 </I
8195 ></TT
8196 ></A
8197 ></P
8198 ><P
8199 >Default: <EM
8200 >no forced user</EM
8201 ></P
8202 ><P
8203 >Example: <B
8204 CLASS="COMMAND"
8205 >force user = auser</B
8206 ></P
8207 ></DD
8208 ><DT
8209 ><A
8210 NAME="FSTYPE"
8211 ></A
8212 >fstype (S)</DT
8213 ><DD
8214 ><P
8215 >This parameter allows the administrator to
8216                 configure the string that specifies the type of filesystem a share
8217                 is using that is reported by <A
8218 HREF="smbd.8.html"
8219 TARGET="_top"
8220 ><B
8221 CLASS="COMMAND"
8222 >smbd(8)
8223                 </B
8224 ></A
8225 > when a client queries the filesystem type
8226                 for a share. The default type is <TT
8227 CLASS="CONSTANT"
8228 >NTFS</TT
8229 > for
8230                 compatibility with Windows NT but this can be changed to other
8231                 strings such as <TT
8232 CLASS="CONSTANT"
8233 >Samba</TT
8234 > or <TT
8235 CLASS="CONSTANT"
8236 >FAT
8237                 </TT
8238 > if required.</P
8239 ><P
8240 >Default: <B
8241 CLASS="COMMAND"
8242 >fstype = NTFS</B
8243 ></P
8244 ><P
8245 >Example: <B
8246 CLASS="COMMAND"
8247 >fstype = Samba</B
8248 ></P
8249 ></DD
8250 ><DT
8251 ><A
8252 NAME="GETWDCACHE"
8253 ></A
8254 >getwd cache (G)</DT
8255 ><DD
8256 ><P
8257 >This is a tuning option. When this is enabled a
8258                 caching algorithm will be used to reduce the time taken for getwd()
8259                 calls. This can have a significant impact on performance, especially
8260                 when the <A
8261 HREF="#WIDELINKS"
8262 ><TT
8263 CLASS="PARAMETER"
8264 ><I
8265 >wide links</I
8266 ></TT
8267 >
8268                 </A
8269 >parameter is set to <TT
8270 CLASS="CONSTANT"
8271 >False</TT
8272 >.</P
8273 ><P
8274 >Default: <B
8275 CLASS="COMMAND"
8276 >getwd cache = yes</B
8277 ></P
8278 ></DD
8279 ><DT
8280 ><A
8281 NAME="GROUP"
8282 ></A
8283 >group (S)</DT
8284 ><DD
8285 ><P
8286 >Synonym for <A
8287 HREF="#FORCEGROUP"
8288 ><TT
8289 CLASS="PARAMETER"
8290 ><I
8291 >force
8292                 group</I
8293 ></TT
8294 ></A
8295 >.</P
8296 ></DD
8297 ><DT
8298 ><A
8299 NAME="GUESTACCOUNT"
8300 ></A
8301 >guest account (S)</DT
8302 ><DD
8303 ><P
8304 >This is a username which will be used for access
8305                 to services which are specified as <A
8306 HREF="#GUESTOK"
8307 ><TT
8308 CLASS="PARAMETER"
8309 ><I
8310 >               guest ok</I
8311 ></TT
8312 ></A
8313 > (see below). Whatever privileges this
8314                 user has will be available to any client connecting to the guest service.
8315                 Typically this user will exist in the password file, but will not
8316                 have a valid login. The user account "ftp" is often a good choice
8317                 for this parameter. If a username is specified in a given service,
8318                 the specified username overrides this one.</P
8319 ><P
8320 >One some systems the default guest account "nobody" may not
8321                 be able to print. Use another account in this case. You should test
8322                 this by trying to log in as your guest user (perhaps by using the
8323                 <B
8324 CLASS="COMMAND"
8325 >su -</B
8326 > command) and trying to print using the
8327                 system print command such as <B
8328 CLASS="COMMAND"
8329 >lpr(1)</B
8330 > or <B
8331 CLASS="COMMAND"
8332 >               lp(1)</B
8333 >.</P
8334 ><P
8335 >Default: <EM
8336 >specified at compile time, usually
8337                 "nobody"</EM
8338 ></P
8339 ><P
8340 >Example: <B
8341 CLASS="COMMAND"
8342 >guest account = ftp</B
8343 ></P
8344 ></DD
8345 ><DT
8346 ><A
8347 NAME="GUESTOK"
8348 ></A
8349 >guest ok (S)</DT
8350 ><DD
8351 ><P
8352 >If this parameter is <TT
8353 CLASS="CONSTANT"
8354 >yes</TT
8355 > for
8356                 a service, then no password is required to connect to the service.
8357                 Privileges will be those of the <A
8358 HREF="#GUESTACCOUNT"
8359 ><TT
8360 CLASS="PARAMETER"
8361 ><I
8362 >               guest account</I
8363 ></TT
8364 ></A
8365 >.</P
8366 ><P
8367 >See the section below on <A
8368 HREF="#SECURITY"
8369 ><TT
8370 CLASS="PARAMETER"
8371 ><I
8372 >               security</I
8373 ></TT
8374 ></A
8375 > for more information about this option.
8376                 </P
8377 ><P
8378 >Default: <B
8379 CLASS="COMMAND"
8380 >guest ok = no</B
8381 ></P
8382 ></DD
8383 ><DT
8384 ><A
8385 NAME="GUESTONLY"
8386 ></A
8387 >guest only (S)</DT
8388 ><DD
8389 ><P
8390 >If this parameter is <TT
8391 CLASS="CONSTANT"
8392 >yes</TT
8393 > for
8394                 a service, then only guest connections to the service are permitted.
8395                 This parameter will have no effect if <A
8396 HREF="#GUESTOK"
8397 >               <TT
8398 CLASS="PARAMETER"
8399 ><I
8400 >guest ok</I
8401 ></TT
8402 ></A
8403 > is not set for the service.</P
8404 ><P
8405 >See the section below on <A
8406 HREF="#SECURITY"
8407 ><TT
8408 CLASS="PARAMETER"
8409 ><I
8410 >               security</I
8411 ></TT
8412 ></A
8413 > for more information about this option.
8414                 </P
8415 ><P
8416 >Default: <B
8417 CLASS="COMMAND"
8418 >guest only = no</B
8419 ></P
8420 ></DD
8421 ><DT
8422 ><A
8423 NAME="HIDEDOTFILES"
8424 ></A
8425 >hide dot files (S)</DT
8426 ><DD
8427 ><P
8428 >This is a boolean parameter that controls whether
8429                 files starting with a dot appear as hidden files.</P
8430 ><P
8431 >Default: <B
8432 CLASS="COMMAND"
8433 >hide dot files = yes</B
8434 ></P
8435 ></DD
8436 ><DT
8437 ><A
8438 NAME="HIDEFILES"
8439 ></A
8440 >hide files(S)</DT
8441 ><DD
8442 ><P
8443 >This is a list of files or directories that are not
8444                 visible but are accessible.  The DOS 'hidden' attribute is applied
8445                 to any files or directories that match.</P
8446 ><P
8447 >Each entry in the list must be separated by a '/',
8448                 which allows spaces to be included in the entry.  '*'
8449                 and '?' can be used to specify multiple files or directories
8450                 as in DOS wildcards.</P
8451 ><P
8452 >Each entry must be a Unix path, not a DOS path and must
8453                 not include the Unix directory separator '/'.</P
8454 ><P
8455 >Note that the case sensitivity option is applicable
8456                 in hiding files.</P
8457 ><P
8458 >Setting this parameter will affect the performance of Samba,
8459                 as it will be forced to check all files and directories for a match
8460                 as they are scanned.</P
8461 ><P
8462 >See also <A
8463 HREF="#HIDEDOTFILES"
8464 ><TT
8465 CLASS="PARAMETER"
8466 ><I
8467 >hide
8468                 dot files</I
8469 ></TT
8470 ></A
8471 >, <A
8472 HREF="#VETOFILES"
8473 ><TT
8474 CLASS="PARAMETER"
8475 ><I
8476 >               veto files</I
8477 ></TT
8478 ></A
8479 > and <A
8480 HREF="#CASESENSITIVE"
8481 >               <TT
8482 CLASS="PARAMETER"
8483 ><I
8484 >case sensitive</I
8485 ></TT
8486 ></A
8487 >.</P
8488 ><P
8489 >Default: <EM
8490 >no file are hidden</EM
8491 ></P
8492 ><P
8493 >Example: <B
8494 CLASS="COMMAND"
8495 >hide files =
8496                 /.*/DesktopFolderDB/TrashFor%m/resource.frk/</B
8497 ></P
8498 ><P
8499 >The above example is based on files that the Macintosh
8500                 SMB client (DAVE) available from <A
8501 HREF="http://www.thursby.com"
8502 TARGET="_top"
8503 >
8504                 Thursby</A
8505 > creates for internal use, and also still hides
8506                 all files beginning with a dot.</P
8507 ></DD
8508 ><DT
8509 ><A
8510 NAME="HIDELOCALUSERS"
8511 ></A
8512 >hide local users(G)</DT
8513 ><DD
8514 ><P
8515 >This parameter toggles the hiding of local UNIX
8516                 users (root, wheel, floppy, etc) from remote clients.</P
8517 ><P
8518 >Default: <B
8519 CLASS="COMMAND"
8520 >hide local users = no</B
8521 ></P
8522 ></DD
8523 ><DT
8524 ><A
8525 NAME="HOMEDIRMAP"
8526 ></A
8527 >homedir map (G)</DT
8528 ><DD
8529 ><P
8530 >If<A
8531 HREF="#NISHOMEDIR"
8532 ><TT
8533 CLASS="PARAMETER"
8534 ><I
8535 >nis homedir
8536                 </I
8537 ></TT
8538 ></A
8539 > is <TT
8540 CLASS="CONSTANT"
8541 >True</TT
8542 >, and <A
8543 HREF="smbd.8.html"
8544 TARGET="_top"
8545 ><B
8546 CLASS="COMMAND"
8547 >smbd(8)</B
8548 ></A
8549 > is also acting
8550                 as a Win95/98 <TT
8551 CLASS="PARAMETER"
8552 ><I
8553 >logon server</I
8554 ></TT
8555 > then this parameter
8556                 specifies the NIS (or YP) map from which the server for the user's
8557                 home directory should be extracted.  At present, only the Sun
8558                 auto.home map format is understood. The form of the map is:</P
8559 ><P
8560 ><B
8561 CLASS="COMMAND"
8562 >username       server:/some/file/system</B
8563 ></P
8564 ><P
8565 >and the program will extract the servername from before
8566                 the first ':'.  There should probably be a better parsing system
8567                 that copes with different map formats and also Amd (another
8568                 automounter) maps.</P
8569 ><P
8570 ><EM
8571 >NOTE :</EM
8572 >A working NIS client is required on
8573                 the system for this option to work.</P
8574 ><P
8575 >See also <A
8576 HREF="#NISHOMEDIR"
8577 ><TT
8578 CLASS="PARAMETER"
8579 ><I
8580 >nis homedir</I
8581 ></TT
8582 >
8583                 </A
8584 >, <A
8585 HREF="#DOMAINLOGONS"
8586 ><TT
8587 CLASS="PARAMETER"
8588 ><I
8589 >domain logons</I
8590 ></TT
8591 >
8592                 </A
8593 >.</P
8594 ><P
8595 >Default: <B
8596 CLASS="COMMAND"
8597 >homedir map = &#60;empty string&#62;</B
8598 ></P
8599 ><P
8600 >Example: <B
8601 CLASS="COMMAND"
8602 >homedir map = amd.homedir</B
8603 ></P
8604 ></DD
8605 ><DT
8606 ><A
8607 NAME="HOSTMSDFS"
8608 ></A
8609 >host msdfs (G)</DT
8610 ><DD
8611 ><P
8612 >This boolean parameter is only available
8613                 if Samba has been configured and compiled with the <B
8614 CLASS="COMMAND"
8615 >               --with-msdfs</B
8616 > option. If set to <TT
8617 CLASS="CONSTANT"
8618 >yes</TT
8619 >,
8620                 Samba will act as a Dfs server, and  allow Dfs-aware clients
8621                 to browse Dfs trees hosted on the server.</P
8622 ><P
8623 >See also the <A
8624 HREF="#MSDFSROOT"
8625 ><TT
8626 CLASS="PARAMETER"
8627 ><I
8628 >               msdfs root</I
8629 ></TT
8630 ></A
8631 > share  level  parameter.  For
8632                 more  information  on  setting  up a Dfs tree on Samba,
8633                 refer to <A
8634 HREF="msdfs_setup.html"
8635 TARGET="_top"
8636 >msdfs_setup.html</A
8637 >.
8638                 </P
8639 ><P
8640 >Default: <B
8641 CLASS="COMMAND"
8642 >host msdfs = no</B
8643 ></P
8644 ></DD
8645 ><DT
8646 ><A
8647 NAME="HOSTSALLOW"
8648 ></A
8649 >hosts allow (S)</DT
8650 ><DD
8651 ><P
8652 >A synonym for this parameter is <TT
8653 CLASS="PARAMETER"
8654 ><I
8655 >allow
8656                 hosts</I
8657 ></TT
8658 >.</P
8659 ><P
8660 >This parameter is a comma, space, or tab delimited
8661                 set of hosts which are permitted to access a service.</P
8662 ><P
8663 >If specified in the [global] section then it will
8664                 apply to all services, regardless of whether the individual
8665                 service has a different setting.</P
8666 ><P
8667 >You can specify the hosts by name or IP number. For
8668                 example, you could restrict access to only the hosts on a
8669                 Class C subnet with something like <B
8670 CLASS="COMMAND"
8671 >allow hosts = 150.203.5.
8672                 </B
8673 >. The full syntax of the list is described in the man
8674                 page <TT
8675 CLASS="FILENAME"
8676 >hosts_access(5)</TT
8677 >. Note that this man
8678                 page may not be present on your system, so a brief description will
8679                 be given here also.</P
8680 ><P
8681 >Note that the localhost address 127.0.0.1 will always
8682                 be allowed access unless specifically denied by a <A
8683 HREF="#HOSTSDENY"
8684 ><TT
8685 CLASS="PARAMETER"
8686 ><I
8687 >hosts deny</I
8688 ></TT
8689 ></A
8690 > option.</P
8691 ><P
8692 >You can also specify hosts by network/netmask pairs and
8693                 by netgroup names if your system supports netgroups. The
8694                 <EM
8695 >EXCEPT</EM
8696 > keyword can also be used to limit a
8697                 wildcard list. The following examples may provide some help:</P
8698 ><P
8699 >Example 1: allow all IPs in 150.203.*.*; except one</P
8700 ><P
8701 ><B
8702 CLASS="COMMAND"
8703 >hosts allow = 150.203. EXCEPT 150.203.6.66</B
8704 ></P
8705 ><P
8706 >Example 2: allow hosts that match the given network/netmask</P
8707 ><P
8708 ><B
8709 CLASS="COMMAND"
8710 >hosts allow = 150.203.15.0/255.255.255.0</B
8711 ></P
8712 ><P
8713 >Example 3: allow a couple of hosts</P
8714 ><P
8715 ><B
8716 CLASS="COMMAND"
8717 >hosts allow = lapland, arvidsjaur</B
8718 ></P
8719 ><P
8720 >Example 4: allow only hosts in NIS netgroup "foonet", but
8721                 deny access from one particular host</P
8722 ><P
8723 ><B
8724 CLASS="COMMAND"
8725 >hosts allow = @foonet</B
8726 ></P
8727 ><P
8728 ><B
8729 CLASS="COMMAND"
8730 >hosts deny = pirate</B
8731 ></P
8732 ><P
8733 >Note that access still requires suitable user-level passwords.</P
8734 ><P
8735 >See <A
8736 HREF="testparm.1.html"
8737 TARGET="_top"
8738 ><B
8739 CLASS="COMMAND"
8740 >testparm(1)</B
8741 >
8742                 </A
8743 > for a way of testing your host access to see if it does
8744                 what you expect.</P
8745 ><P
8746 >Default: <EM
8747 >none (i.e., all hosts permitted access)
8748                 </EM
8749 ></P
8750 ><P
8751 >Example: <B
8752 CLASS="COMMAND"
8753 >allow hosts = 150.203.5. myhost.mynet.edu.au
8754                 </B
8755 ></P
8756 ></DD
8757 ><DT
8758 ><A
8759 NAME="HOSTSDENY"
8760 ></A
8761 >hosts deny (S)</DT
8762 ><DD
8763 ><P
8764 >The opposite of <TT
8765 CLASS="PARAMETER"
8766 ><I
8767 >hosts allow</I
8768 ></TT
8769 >
8770                 - hosts listed here are <EM
8771 >NOT</EM
8772 > permitted access to
8773                 services unless the specific services have their own lists to override
8774                 this one. Where the lists conflict, the <TT
8775 CLASS="PARAMETER"
8776 ><I
8777 >allow</I
8778 ></TT
8779 >
8780                 list takes precedence.</P
8781 ><P
8782 >Default: <EM
8783 >none (i.e., no hosts specifically excluded)
8784                 </EM
8785 ></P
8786 ><P
8787 >Example: <B
8788 CLASS="COMMAND"
8789 >hosts deny = 150.203.4. badhost.mynet.edu.au
8790                 </B
8791 ></P
8792 ></DD
8793 ><DT
8794 ><A
8795 NAME="HOSTSEQUIV"
8796 ></A
8797 >hosts equiv (G)</DT
8798 ><DD
8799 ><P
8800 >If this global parameter is a non-null string,
8801                 it specifies the name of a file to read for the names of hosts
8802                 and users who will be allowed access without specifying a password.
8803                 </P
8804 ><P
8805 >This is not be confused with <A
8806 HREF="#HOSTSALLOW"
8807 >               <TT
8808 CLASS="PARAMETER"
8809 ><I
8810 >hosts allow</I
8811 ></TT
8812 ></A
8813 > which is about hosts
8814                 access to services and is more useful for guest services. <TT
8815 CLASS="PARAMETER"
8816 ><I
8817 >               hosts equiv</I
8818 ></TT
8819 > may be useful for NT clients which will
8820                 not supply passwords to samba.</P
8821 ><P
8822 ><EM
8823 >NOTE :</EM
8824 > The use of <TT
8825 CLASS="PARAMETER"
8826 ><I
8827 >hosts equiv
8828                 </I
8829 ></TT
8830 > can be a major security hole. This is because you are
8831                 trusting the PC to supply the correct username. It is very easy to
8832                 get a PC to supply a false username. I recommend that the
8833                 <TT
8834 CLASS="PARAMETER"
8835 ><I
8836 >hosts equiv</I
8837 ></TT
8838 > option be only used if you really
8839                 know what you are doing, or perhaps on a home network where you trust
8840                 your spouse and kids. And only if you <EM
8841 >really</EM
8842 > trust
8843                 them :-).</P
8844 ><P
8845 >Default: <EM
8846 >no host equivalences</EM
8847 ></P
8848 ><P
8849 >Example: <B
8850 CLASS="COMMAND"
8851 >hosts equiv = /etc/hosts.equiv</B
8852 ></P
8853 ></DD
8854 ><DT
8855 ><A
8856 NAME="INCLUDE"
8857 ></A
8858 >include (G)</DT
8859 ><DD
8860 ><P
8861 >This allows you to include one config file
8862                 inside another.  The file is included literally, as though typed
8863                 in place.</P
8864 ><P
8865 >It takes the standard substitutions, except <TT
8866 CLASS="PARAMETER"
8867 ><I
8868 >%u
8869                 </I
8870 ></TT
8871 >, <TT
8872 CLASS="PARAMETER"
8873 ><I
8874 >%P</I
8875 ></TT
8876 > and <TT
8877 CLASS="PARAMETER"
8878 ><I
8879 >%S</I
8880 ></TT
8881 >.
8882                 </P
8883 ><P
8884 >Default: <EM
8885 >no file included</EM
8886 ></P
8887 ><P
8888 >Example: <B
8889 CLASS="COMMAND"
8890 >include = /usr/local/samba/lib/admin_smb.conf
8891                 </B
8892 ></P
8893 ></DD
8894 ><DT
8895 ><A
8896 NAME="INHERITPERMISSIONS"
8897 ></A
8898 >inherit permissions (S)</DT
8899 ><DD
8900 ><P
8901 >The permissions on new files and directories
8902                 are normally governed by <A
8903 HREF="#CREATEMASK"
8904 ><TT
8905 CLASS="PARAMETER"
8906 ><I
8907 >               create mask</I
8908 ></TT
8909 ></A
8910 >, <A
8911 HREF="#DIRECTORYMASK"
8912 >               <TT
8913 CLASS="PARAMETER"
8914 ><I
8915 >directory mask</I
8916 ></TT
8917 ></A
8918 >, <A
8919 HREF="#FORCECREATEMODE"
8920 ><TT
8921 CLASS="PARAMETER"
8922 ><I
8923 >force create mode</I
8924 ></TT
8925 >
8926                 </A
8927 > and <A
8928 HREF="#FORCEDIRECTORYMODE"
8929 ><TT
8930 CLASS="PARAMETER"
8931 ><I
8932 >force
8933                 directory mode</I
8934 ></TT
8935 ></A
8936 > but the boolean inherit
8937                 permissions parameter overrides this.</P
8938 ><P
8939 >New directories inherit the mode of the parent directory,
8940                 including bits such as setgid.</P
8941 ><P
8942 >New files inherit their read/write bits from the parent
8943                 directory.  Their execute bits continue to be determined by
8944                 <A
8945 HREF="#MAPARCHIVE"
8946 ><TT
8947 CLASS="PARAMETER"
8948 ><I
8949 >map archive</I
8950 ></TT
8951 >
8952                 </A
8953 >, <A
8954 HREF="#MAPHIDDEN"
8955 ><TT
8956 CLASS="PARAMETER"
8957 ><I
8958 >map hidden</I
8959 ></TT
8960 >
8961                 </A
8962 > and <A
8963 HREF="#MAPSYSTEM"
8964 ><TT
8965 CLASS="PARAMETER"
8966 ><I
8967 >map system</I
8968 ></TT
8969 >
8970                 </A
8971 > as usual.</P
8972 ><P
8973 >Note that the setuid bit is <EM
8974 >never</EM
8975 > set via
8976                 inheritance (the code explicitly prohibits this).</P
8977 ><P
8978 >This can be particularly useful on large systems with
8979                 many users, perhaps several thousand,to allow a single [homes]
8980                 share to be used flexibly by each user.</P
8981 ><P
8982 >See also <A
8983 HREF="#CREATEMASK"
8984 ><TT
8985 CLASS="PARAMETER"
8986 ><I
8987 >create mask
8988                 </I
8989 ></TT
8990 ></A
8991 >, <A
8992 HREF="#DIRECTORYMASK"
8993 ><TT
8994 CLASS="PARAMETER"
8995 ><I
8996 >               directory mask</I
8997 ></TT
8998 ></A
8999 >, <A
9000 HREF="#FORCECREATEMODE"
9001 >               <TT
9002 CLASS="PARAMETER"
9003 ><I
9004 >force create mode</I
9005 ></TT
9006 ></A
9007 > and <A
9008 HREF="#FORCEDIRECTORYMODE"
9009 ><TT
9010 CLASS="PARAMETER"
9011 ><I
9012 >force directory mode</I
9013 ></TT
9014 >
9015                 </A
9016 >.</P
9017 ><P
9018 >Default: <B
9019 CLASS="COMMAND"
9020 >inherit permissions = no</B
9021 ></P
9022 ></DD
9023 ><DT
9024 ><A
9025 NAME="INTERFACES"
9026 ></A
9027 >interfaces (G)</DT
9028 ><DD
9029 ><P
9030 >This option allows you to override the default
9031                 network interfaces list that Samba will use for browsing, name
9032                 registration and other NBT traffic. By default Samba will query
9033                 the kernel for the list of all active interfaces and use any
9034                 interfaces except 127.0.0.1 that are broadcast capable.</P
9035 ><P
9036 >The option takes a list of interface strings. Each string
9037                 can be in any of the following forms:</P
9038 ><P
9039 ></P
9040 ><UL
9041 ><LI
9042 ><P
9043 >a network interface name (such as eth0).
9044                         This may include shell-like wildcards so eth* will match
9045                         any interface starting with the substring "eth"</P
9046 ></LI
9047 ><LI
9048 ><P
9049 >an IP address. In this case the netmask is
9050                         determined from the list of interfaces obtained from the
9051                         kernel</P
9052 ></LI
9053 ><LI
9054 ><P
9055 >an IP/mask pair. </P
9056 ></LI
9057 ><LI
9058 ><P
9059 >a broadcast/mask pair.</P
9060 ></LI
9061 ></UL
9062 ><P
9063 >The "mask" parameters can either be a bit length (such
9064                 as 24 for a C class network) or a full netmask in dotted
9065                 decimal form.</P
9066 ><P
9067 >The "IP" parameters above can either be a full dotted
9068                 decimal IP address or a hostname which will be looked up via
9069                 the OS's normal hostname resolution mechanisms.</P
9070 ><P
9071 >For example, the following line:</P
9072 ><P
9073 ><B
9074 CLASS="COMMAND"
9075 >interfaces = eth0 192.168.2.10/24 192.168.3.10/255.255.255.0
9076                 </B
9077 ></P
9078 ><P
9079 >would configure three network interfaces corresponding
9080                 to the eth0 device and IP addresses 192.168.2.10 and 192.168.3.10.
9081                 The netmasks of the latter two interfaces would be set to 255.255.255.0.</P
9082 ><P
9083 >See also <A
9084 HREF="#BINDINTERFACESONLY"
9085 ><TT
9086 CLASS="PARAMETER"
9087 ><I
9088 >bind
9089                 interfaces only</I
9090 ></TT
9091 ></A
9092 >.</P
9093 ><P
9094 >Default: <EM
9095 >all active interfaces except 127.0.0.1
9096                 that are broadcast capable</EM
9097 ></P
9098 ></DD
9099 ><DT
9100 ><A
9101 NAME="INVALIDUSERS"
9102 ></A
9103 >invalid users (S)</DT
9104 ><DD
9105 ><P
9106 >This is a list of users that should not be allowed
9107                 to login to this service. This is really a <EM
9108 >paranoid</EM
9109 >
9110                 check to absolutely ensure an improper setting does not breach
9111                 your security.</P
9112 ><P
9113 >A name starting with a '@' is interpreted as an NIS
9114                 netgroup first (if your system supports NIS), and then as a UNIX
9115                 group if the name was not found in the NIS netgroup database.</P
9116 ><P
9117 >A name starting with '+' is interpreted only
9118                 by looking in the UNIX group database. A name starting with
9119                 '&#38;' is interpreted only by looking in the NIS netgroup database
9120                 (this requires NIS to be working on your system). The characters
9121                 '+' and '&#38;' may be used at the start of the name in either order
9122                 so the value <TT
9123 CLASS="PARAMETER"
9124 ><I
9125 >+&#38;group</I
9126 ></TT
9127 > means check the
9128                 UNIX group database, followed by the NIS netgroup database, and
9129                 the value <TT
9130 CLASS="PARAMETER"
9131 ><I
9132 >&#38;+group"</I
9133 ></TT
9134 > means check the NIS
9135                 netgroup database, followed by the UNIX group database (the
9136                 same as the '@' prefix).</P
9137 ><P
9138 >The current servicename is substituted for <TT
9139 CLASS="PARAMETER"
9140 ><I
9141 >%S</I
9142 ></TT
9143 >.
9144                 This is useful in the [homes] section.</P
9145 ><P
9146 >See also <A
9147 HREF="#VALIDUSERS"
9148 ><TT
9149 CLASS="PARAMETER"
9150 ><I
9151 >valid users
9152                 </I
9153 ></TT
9154 ></A
9155 >.</P
9156 ><P
9157 >Default: <EM
9158 >no invalid users</EM
9159 ></P
9160 ><P
9161 >Example: <B
9162 CLASS="COMMAND"
9163 >invalid users = root fred admin @wheel
9164                 </B
9165 ></P
9166 ></DD
9167 ><DT
9168 ><A
9169 NAME="KEEPALIVE"
9170 ></A
9171 >keepalive (G)</DT
9172 ><DD
9173 ><P
9174 >The value of the parameter (an integer) represents
9175                 the number of seconds between <TT
9176 CLASS="PARAMETER"
9177 ><I
9178 >keepalive</I
9179 ></TT
9180 >
9181                 packets. If this parameter is zero, no keepalive packets will be
9182                 sent. Keepalive packets, if sent, allow the server to tell whether
9183                 a client is still present and responding.</P
9184 ><P
9185 >Keepalives should, in general, not be needed if the socket
9186                 being used has the SO_KEEPALIVE attribute set on it (see <A
9187 HREF="#SOCKETOPTIONS"
9188 ><TT
9189 CLASS="PARAMETER"
9190 ><I
9191 >socket options</I
9192 ></TT
9193 ></A
9194 >).
9195                 Basically you should only use this option if you strike difficulties.</P
9196 ><P
9197 >Default: <B
9198 CLASS="COMMAND"
9199 >keepalive = 300</B
9200 ></P
9201 ><P
9202 >Example: <B
9203 CLASS="COMMAND"
9204 >keepalive = 600</B
9205 ></P
9206 ></DD
9207 ><DT
9208 ><A
9209 NAME="KERNELOPLOCKS"
9210 ></A
9211 >kernel oplocks (G)</DT
9212 ><DD
9213 ><P
9214 >For UNIXes that support kernel based <A
9215 HREF="#OPLOCKS"
9216 ><TT
9217 CLASS="PARAMETER"
9218 ><I
9219 >oplocks</I
9220 ></TT
9221 ></A
9222 >
9223                 (currently only IRIX and the Linux 2.4 kernel), this parameter
9224                 allows the use of them to be turned on or off.</P
9225 ><P
9226 >Kernel oplocks support allows Samba <TT
9227 CLASS="PARAMETER"
9228 ><I
9229 >oplocks
9230                 </I
9231 ></TT
9232 > to be broken whenever a local UNIX process or NFS operation
9233                 accesses a file that <A
9234 HREF="smbd.8.html"
9235 TARGET="_top"
9236 ><B
9237 CLASS="COMMAND"
9238 >smbd(8)</B
9239 >
9240                 </A
9241 > has oplocked. This allows complete data consistency between
9242                 SMB/CIFS, NFS and local file access (and is a <EM
9243 >very</EM
9244 >
9245                 cool feature :-).</P
9246 ><P
9247 >This parameter defaults to <TT
9248 CLASS="CONSTANT"
9249 >on</TT
9250 > on systems
9251                 that have the support, and <TT
9252 CLASS="CONSTANT"
9253 >off</TT
9254 > on systems that
9255                 don't. You should never need to touch this parameter.</P
9256 ><P
9257 >See also the <A
9258 HREF="#OPLOCKS"
9259 ><TT
9260 CLASS="PARAMETER"
9261 ><I
9262 >oplocks</I
9263 ></TT
9264 >
9265                 </A
9266 > and <A
9267 HREF="#LEVEL2OPLOCKS"
9268 ><TT
9269 CLASS="PARAMETER"
9270 ><I
9271 >level2 oplocks
9272                 </I
9273 ></TT
9274 ></A
9275 > parameters.</P
9276 ><P
9277 >Default: <B
9278 CLASS="COMMAND"
9279 >kernel oplocks = yes</B
9280 ></P
9281 ></DD
9282 ><DT
9283 ><A
9284 NAME="LANMANAUTH"
9285 ></A
9286 >lanman auth (G)</DT
9287 ><DD
9288 ><P
9289 >This parameter determines whether or not smbd will
9290                 attempt to authentication users using the LANMAN password hash.
9291                 If disabled, only clients which support NT password hashes (e.g. Windows
9292                 NT/2000 clients, smbclient, etc... but not Windows 95/98 or the MS DOS
9293                 network client) will be able to connect to the Samba host.</P
9294 ><P
9295 >Default : <B
9296 CLASS="COMMAND"
9297 >lanman auth = yes</B
9298 ></P
9299 ></DD
9300 ><DT
9301 ><A
9302 NAME="LEVEL2OPLOCKS"
9303 ></A
9304 >level2 oplocks (S)</DT
9305 ><DD
9306 ><P
9307 >This parameter controls whether Samba supports
9308                 level2 (read-only) oplocks on a share.</P
9309 ><P
9310 >Level2, or read-only oplocks allow Windows NT clients
9311                 that have an oplock on a file to downgrade from a read-write oplock
9312                 to a read-only oplock once a second client opens the file (instead
9313                 of releasing all oplocks on a second open, as in traditional,
9314                 exclusive oplocks). This allows all openers of the file that
9315                 support level2 oplocks to cache the file for read-ahead only (ie.
9316                 they may not cache writes or lock requests) and increases performance
9317                 for many accesses of files that are not commonly written (such as
9318                 application .EXE files).</P
9319 ><P
9320 >Once one of the clients which have a read-only oplock
9321                 writes to the file all clients are notified (no reply is needed
9322                 or waited for) and told to break their oplocks to "none" and
9323                 delete any read-ahead caches.</P
9324 ><P
9325 >It is recommended that this parameter be turned on
9326                 to speed access to shared executables.</P
9327 ><P
9328 >For more discussions on level2 oplocks see the CIFS spec.</P
9329 ><P
9330 >Currently, if <A
9331 HREF="#KERNELOPLOCKS"
9332 ><TT
9333 CLASS="PARAMETER"
9334 ><I
9335 >kernel
9336                 oplocks</I
9337 ></TT
9338 ></A
9339 > are supported then level2 oplocks are
9340                 not granted (even if this parameter is set to <TT
9341 CLASS="CONSTANT"
9342 >yes</TT
9343 >).
9344                 Note also, the <A
9345 HREF="#OPLOCKS"
9346 ><TT
9347 CLASS="PARAMETER"
9348 ><I
9349 >oplocks</I
9350 ></TT
9351 >
9352                 </A
9353 > parameter must be set to "true" on this share in order for
9354                 this parameter to have any effect.</P
9355 ><P
9356 >See also the <A
9357 HREF="#OPLOCKS"
9358 ><TT
9359 CLASS="PARAMETER"
9360 ><I
9361 >oplocks</I
9362 ></TT
9363 >
9364                 </A
9365 > and <A
9366 HREF="#OPLOCKS"
9367 ><TT
9368 CLASS="PARAMETER"
9369 ><I
9370 >kernel oplocks</I
9371 ></TT
9372 >
9373                 </A
9374 > parameters.</P
9375 ><P
9376 >Default: <B
9377 CLASS="COMMAND"
9378 >level2 oplocks = yes</B
9379 ></P
9380 ></DD
9381 ><DT
9382 ><A
9383 NAME="LMANNOUNCE"
9384 ></A
9385 >lm announce (G)</DT
9386 ><DD
9387 ><P
9388 >This parameter determines if <A
9389 HREF="nmbd.8.html"
9390 TARGET="_top"
9391 >               <B
9392 CLASS="COMMAND"
9393 >nmbd(8)</B
9394 ></A
9395 > will produce Lanman announce
9396                 broadcasts that are needed by OS/2 clients in order for them to see
9397                 the Samba server in their browse list. This parameter can have three
9398                 values, <TT
9399 CLASS="CONSTANT"
9400 >true</TT
9401 >, <TT
9402 CLASS="CONSTANT"
9403 >false</TT
9404 >, or
9405                 <TT
9406 CLASS="CONSTANT"
9407 >auto</TT
9408 >. The default is <TT
9409 CLASS="CONSTANT"
9410 >auto</TT
9411 >.
9412                 If set to <TT
9413 CLASS="CONSTANT"
9414 >false</TT
9415 > Samba will never produce these
9416                 broadcasts. If set to <TT
9417 CLASS="CONSTANT"
9418 >true</TT
9419 > Samba will produce
9420                 Lanman announce broadcasts at a frequency set by the parameter
9421                 <TT
9422 CLASS="PARAMETER"
9423 ><I
9424 >lm interval</I
9425 ></TT
9426 >. If set to <TT
9427 CLASS="CONSTANT"
9428 >auto</TT
9429 >
9430                 Samba will not send Lanman announce broadcasts by default but will
9431                 listen for them. If it hears such a broadcast on the wire it will
9432                 then start sending them at a frequency set by the parameter
9433                 <TT
9434 CLASS="PARAMETER"
9435 ><I
9436 >lm interval</I
9437 ></TT
9438 >.</P
9439 ><P
9440 >See also <A
9441 HREF="#LMINTERVAL"
9442 ><TT
9443 CLASS="PARAMETER"
9444 ><I
9445 >lm interval
9446                 </I
9447 ></TT
9448 ></A
9449 >.</P
9450 ><P
9451 >Default: <B
9452 CLASS="COMMAND"
9453 >lm announce = auto</B
9454 ></P
9455 ><P
9456 >Example: <B
9457 CLASS="COMMAND"
9458 >lm announce = yes</B
9459 ></P
9460 ></DD
9461 ><DT
9462 ><A
9463 NAME="LMINTERVAL"
9464 ></A
9465 >lm interval (G)</DT
9466 ><DD
9467 ><P
9468 >If Samba is set to produce Lanman announce
9469                 broadcasts needed by OS/2 clients (see the <A
9470 HREF="#LMANNOUNCE"
9471 >               <TT
9472 CLASS="PARAMETER"
9473 ><I
9474 >lm announce</I
9475 ></TT
9476 ></A
9477 > parameter) then this
9478                 parameter defines the frequency in seconds with which they will be
9479                 made.  If this is set to zero then no Lanman announcements will be
9480                 made despite the setting of the <TT
9481 CLASS="PARAMETER"
9482 ><I
9483 >lm announce</I
9484 ></TT
9485 >
9486                 parameter.</P
9487 ><P
9488 >See also <A
9489 HREF="#LMANNOUNCE"
9490 ><TT
9491 CLASS="PARAMETER"
9492 ><I
9493 >lm
9494                 announce</I
9495 ></TT
9496 ></A
9497 >.</P
9498 ><P
9499 >Default: <B
9500 CLASS="COMMAND"
9501 >lm interval = 60</B
9502 ></P
9503 ><P
9504 >Example: <B
9505 CLASS="COMMAND"
9506 >lm interval = 120</B
9507 ></P
9508 ></DD
9509 ><DT
9510 ><A
9511 NAME="LOADPRINTERS"
9512 ></A
9513 >load printers (G)</DT
9514 ><DD
9515 ><P
9516 >A boolean variable that controls whether all
9517                 printers in the printcap will be loaded for browsing by default.
9518                 See the <A
9519 HREF="#AEN78"
9520 >printers</A
9521 > section for
9522                 more details.</P
9523 ><P
9524 >Default: <B
9525 CLASS="COMMAND"
9526 >load printers = yes</B
9527 ></P
9528 ></DD
9529 ><DT
9530 ><A
9531 NAME="LOCALMASTER"
9532 ></A
9533 >local master (G)</DT
9534 ><DD
9535 ><P
9536 >This option allows <A
9537 HREF="nmbd.8.html"
9538 TARGET="_top"
9539 ><B
9540 CLASS="COMMAND"
9541 >               nmbd(8)</B
9542 ></A
9543 > to try and become a local master browser
9544                 on a subnet. If set to <TT
9545 CLASS="CONSTANT"
9546 >False</TT
9547 > then <B
9548 CLASS="COMMAND"
9549 >               nmbd</B
9550 > will not attempt to become a local master browser
9551                 on a subnet and will also lose in all browsing elections. By
9552                 default this value is set to true. Setting this value to true doesn't
9553                 mean that Samba will <EM
9554 >become</EM
9555 > the local master
9556                 browser on a subnet, just that <B
9557 CLASS="COMMAND"
9558 >nmbd</B
9559 > will <EM
9560 >               participate</EM
9561 > in elections for local master browser.</P
9562 ><P
9563 >Setting this value to False will cause <B
9564 CLASS="COMMAND"
9565 >nmbd</B
9566 >
9567                 <EM
9568 >never</EM
9569 > to become a local master browser.</P
9570 ><P
9571 >Default: <B
9572 CLASS="COMMAND"
9573 >local master = yes</B
9574 ></P
9575 ></DD
9576 ><DT
9577 ><A
9578 NAME="LOCKDIR"
9579 ></A
9580 >lock dir (G)</DT
9581 ><DD
9582 ><P
9583 >Synonym for <A
9584 HREF="#LOCKDIRECTORY"
9585 ><TT
9586 CLASS="PARAMETER"
9587 ><I
9588 >               lock directory</I
9589 ></TT
9590 ></A
9591 >.</P
9592 ></DD
9593 ><DT
9594 ><A
9595 NAME="LOCKDIRECTORY"
9596 ></A
9597 >lock directory (G)</DT
9598 ><DD
9599 ><P
9600 >This option specifies the directory where lock
9601                 files will be placed.  The lock files are used to implement the
9602                 <A
9603 HREF="#MAXCONNECTIONS"
9604 ><TT
9605 CLASS="PARAMETER"
9606 ><I
9607 >max connections</I
9608 ></TT
9609 >
9610                 </A
9611 > option.</P
9612 ><P
9613 >Default: <B
9614 CLASS="COMMAND"
9615 >lock directory = ${prefix}/var/locks</B
9616 ></P
9617 ><P
9618 >Example: <B
9619 CLASS="COMMAND"
9620 >lock directory = /var/run/samba/locks</B
9621 >
9622                 </P
9623 ></DD
9624 ><DT
9625 ><A
9626 NAME="LOCKING"
9627 ></A
9628 >locking (S)</DT
9629 ><DD
9630 ><P
9631 >This controls whether or not locking will be
9632                 performed by the server in response to lock requests from the
9633                 client.</P
9634 ><P
9635 >If <B
9636 CLASS="COMMAND"
9637 >locking = no</B
9638 >, all lock and unlock
9639                 requests will appear to succeed and all lock queries will report
9640                 that the file in question is available for locking.</P
9641 ><P
9642 >If <B
9643 CLASS="COMMAND"
9644 >locking = yes</B
9645 >, real locking will be performed
9646                 by the server.</P
9647 ><P
9648 >This option <EM
9649 >may</EM
9650 > be useful for read-only
9651                 filesystems which <EM
9652 >may</EM
9653 > not need locking (such as
9654                 cdrom drives), although setting this parameter of <TT
9655 CLASS="CONSTANT"
9656 >no</TT
9657 >
9658                 is not really recommended even in this case.</P
9659 ><P
9660 >Be careful about disabling locking either globally or in a
9661                 specific service, as lack of locking may result in data corruption.
9662                 You should never need to set this parameter.</P
9663 ><P
9664 >Default: <B
9665 CLASS="COMMAND"
9666 >locking = yes</B
9667 ></P
9668 ></DD
9669 ><DT
9670 ><A
9671 NAME="LOGFILE"
9672 ></A
9673 >log file (G)</DT
9674 ><DD
9675 ><P
9676 >This option allows you to override the name
9677                 of the Samba log file (also known as the debug file).</P
9678 ><P
9679 >This option takes the standard substitutions, allowing
9680                 you to have separate log files for each user or machine.</P
9681 ><P
9682 >Example: <B
9683 CLASS="COMMAND"
9684 >log file = /usr/local/samba/var/log.%m
9685                 </B
9686 ></P
9687 ></DD
9688 ><DT
9689 ><A
9690 NAME="LOGLEVEL"
9691 ></A
9692 >log level (G)</DT
9693 ><DD
9694 ><P
9695 >The value of the parameter (an integer) allows
9696                 the debug level (logging level) to be specified in the
9697                 <TT
9698 CLASS="FILENAME"
9699 >smb.conf</TT
9700 > file. This is to give greater
9701                 flexibility in the configuration of the system.</P
9702 ><P
9703 >The default will be the log level specified on
9704                 the command line or level zero if none was specified.</P
9705 ><P
9706 >Example: <B
9707 CLASS="COMMAND"
9708 >log level = 3</B
9709 ></P
9710 ></DD
9711 ><DT
9712 ><A
9713 NAME="LOGONDRIVE"
9714 ></A
9715 >logon drive (G)</DT
9716 ><DD
9717 ><P
9718 >This parameter specifies the local path to
9719                 which the home directory will be connected (see <A
9720 HREF="#LOGONHOME"
9721 ><TT
9722 CLASS="PARAMETER"
9723 ><I
9724 >logon home</I
9725 ></TT
9726 ></A
9727 >)
9728                 and is only used by NT Workstations. </P
9729 ><P
9730 >Note that this option is only useful if Samba is set up as a
9731                 logon server.</P
9732 ><P
9733 >Default: <B
9734 CLASS="COMMAND"
9735 >logon drive = z:</B
9736 ></P
9737 ><P
9738 >Example: <B
9739 CLASS="COMMAND"
9740 >logon drive = h:</B
9741 ></P
9742 ></DD
9743 ><DT
9744 ><A
9745 NAME="LOGONHOME"
9746 ></A
9747 >logon home (G)</DT
9748 ><DD
9749 ><P
9750 >This parameter specifies the home directory
9751                 location when a Win95/98 or NT Workstation logs into a Samba PDC.
9752                 It allows you to do </P
9753 ><P
9754 ><TT
9755 CLASS="PROMPT"
9756 >C:\&#62; </TT
9757 ><TT
9758 CLASS="USERINPUT"
9759 ><B
9760 >NET USE H: /HOME</B
9761 ></TT
9762 >
9763                 </P
9764 ><P
9765 >from a command prompt, for example.</P
9766 ><P
9767 >This option takes the standard substitutions, allowing
9768                 you to have separate logon scripts for each user or machine.</P
9769 ><P
9770 >This parameter can be used with Win9X workstations to ensure
9771                 that roaming profiles are stored in a subdirectory of the user's
9772                 home directory.  This is done in the following way:</P
9773 ><P
9774 ><B
9775 CLASS="COMMAND"
9776 >logon home = \\%N\%U\profile</B
9777 ></P
9778 ><P
9779 >This tells Samba to return the above string, with
9780                 substitutions made when a client requests the info, generally
9781                 in a NetUserGetInfo request.  Win9X clients truncate the info to
9782                 \\server\share when a user does <B
9783 CLASS="COMMAND"
9784 >net use /home"</B
9785 >
9786                 but use the whole string when dealing with profiles.</P
9787 ><P
9788 >Note that in prior versions of Samba, the <A
9789 HREF="#LOGONPATH"
9790 >               <TT
9791 CLASS="PARAMETER"
9792 ><I
9793 >logon path</I
9794 ></TT
9795 ></A
9796 > was returned rather than
9797                 <TT
9798 CLASS="PARAMETER"
9799 ><I
9800 >logon home</I
9801 ></TT
9802 >.  This broke <B
9803 CLASS="COMMAND"
9804 >net use
9805                 /home</B
9806 > but allowed profiles outside the home directory.
9807                 The current implementation is correct, and can be used for
9808                 profiles if you use the above trick.</P
9809 ><P
9810 >This option is only useful if Samba is set up as a logon
9811                 server.</P
9812 ><P
9813 >Default: <B
9814 CLASS="COMMAND"
9815 >logon home = "\\%N\%U"</B
9816 ></P
9817 ><P
9818 >Example: <B
9819 CLASS="COMMAND"
9820 >logon home = "\\remote_smb_server\%U"</B
9821 >
9822                 </P
9823 ></DD
9824 ><DT
9825 ><A
9826 NAME="LOGONPATH"
9827 ></A
9828 >logon path (G)</DT
9829 ><DD
9830 ><P
9831 >This parameter specifies the home directory
9832                 where roaming profiles (NTuser.dat etc files for Windows NT) are
9833                 stored.  Contrary to previous versions of these manual pages, it has
9834                 nothing to do with Win 9X roaming profiles.  To find out how to
9835                 handle roaming profiles for Win 9X system, see the <A
9836 HREF="#LOGONHOME"
9837 >               <TT
9838 CLASS="PARAMETER"
9839 ><I
9840 >logon home</I
9841 ></TT
9842 ></A
9843 > parameter.</P
9844 ><P
9845 >This option takes the standard substitutions, allowing you
9846                 to have separate logon scripts for each user or machine.  It also
9847                 specifies the directory from which the "Application Data",
9848                 (<TT
9849 CLASS="FILENAME"
9850 >desktop</TT
9851 >, <TT
9852 CLASS="FILENAME"
9853 >start menu</TT
9854 >,
9855                 <TT
9856 CLASS="FILENAME"
9857 >network neighborhood</TT
9858 >, <TT
9859 CLASS="FILENAME"
9860 >programs</TT
9861 >
9862                 and other folders, and their contents, are loaded and displayed on
9863                 your Windows NT client.</P
9864 ><P
9865 >The share and the path must be readable by the user for
9866                 the preferences and directories to be loaded onto the Windows NT
9867                 client.  The share must be writeable when the logs in for the first
9868                 time, in order that the Windows NT client can create the NTuser.dat
9869                 and other directories.</P
9870 ><P
9871 >Thereafter, the directories and any of the contents can,
9872                 if required, be made read-only.  It is not advisable that the
9873                 NTuser.dat file be made read-only - rename it to NTuser.man to
9874                 achieve the desired effect (a <EM
9875 >MAN</EM
9876 >datory
9877                 profile). </P
9878 ><P
9879 >Windows clients can sometimes maintain a connection to
9880                 the [homes] share, even though there is no user logged in.
9881                 Therefore, it is vital that the logon path does not include a
9882                 reference to the homes share (i.e. setting this parameter to
9883                 \%N\%U\profile_path will cause problems).</P
9884 ><P
9885 >This option takes the standard substitutions, allowing
9886                 you to have separate logon scripts for each user or machine.</P
9887 ><P
9888 >Note that this option is only useful if Samba is set up
9889                 as a logon server.</P
9890 ><P
9891 >Default: <B
9892 CLASS="COMMAND"
9893 >logon path = \\%N\%U\profile</B
9894 ></P
9895 ><P
9896 >Example: <B
9897 CLASS="COMMAND"
9898 >logon path = \\PROFILESERVER\PROFILE\%U</B
9899 ></P
9900 ></DD
9901 ><DT
9902 ><A
9903 NAME="LOGONSCRIPT"
9904 ></A
9905 >logon script (G)</DT
9906 ><DD
9907 ><P
9908 >This parameter specifies the batch file (.bat) or
9909                 NT command file (.cmd) to be downloaded and run on a machine when
9910                 a user successfully logs in.  The file must contain the DOS
9911                 style cr/lf line endings. Using a DOS-style editor to create the
9912                 file is recommended.</P
9913 ><P
9914 >The script must be a relative path to the [netlogon]
9915                 service.  If the [netlogon] service specifies a <A
9916 HREF="#PATH"
9917 >               <TT
9918 CLASS="PARAMETER"
9919 ><I
9920 >path</I
9921 ></TT
9922 ></A
9923 > of <TT
9924 CLASS="FILENAME"
9925 >/usr/local/samba/netlogon
9926                 </TT
9927 >, and <B
9928 CLASS="COMMAND"
9929 >logon script = STARTUP.BAT</B
9930 >, then
9931                 the file that will be downloaded is:</P
9932 ><P
9933 ><TT
9934 CLASS="FILENAME"
9935 >/usr/local/samba/netlogon/STARTUP.BAT</TT
9936 ></P
9937 ><P
9938 >The contents of the batch file is entirely your choice.  A
9939                 suggested command would be to add <B
9940 CLASS="COMMAND"
9941 >NET TIME \\SERVER /SET
9942                 /YES</B
9943 >, to force every machine to synchronize clocks with
9944                 the same time server.  Another use would be to add <B
9945 CLASS="COMMAND"
9946 >NET USE
9947                 U: \\SERVER\UTILS</B
9948 > for commonly used utilities, or <B
9949 CLASS="COMMAND"
9950 >               NET USE Q: \\SERVER\ISO9001_QA</B
9951 > for example.</P
9952 ><P
9953 >Note that it is particularly important not to allow write
9954                 access to the [netlogon] share, or to grant users write permission
9955                 on the batch files in a secure environment, as this would allow
9956                 the batch files to be arbitrarily modified and security to be
9957                 breached.</P
9958 ><P
9959 >This option takes the standard substitutions, allowing you
9960                 to have separate logon scripts for each user or machine.</P
9961 ><P
9962 >This option is only useful if Samba is set up as a logon
9963                 server.</P
9964 ><P
9965 >Default: <EM
9966 >no logon script defined</EM
9967 ></P
9968 ><P
9969 >Example: <B
9970 CLASS="COMMAND"
9971 >logon script = scripts\%U.bat</B
9972 ></P
9973 ></DD
9974 ><DT
9975 ><A
9976 NAME="LPPAUSECOMMAND"
9977 ></A
9978 >lppause command (S)</DT
9979 ><DD
9980 ><P
9981 >This parameter specifies the command to be
9982                 executed on the server host in order to stop printing or spooling
9983                 a specific print job.</P
9984 ><P
9985 >This command should be a program or script which takes
9986                 a printer name and job number to pause the print job. One way
9987                 of implementing this is by using job priorities, where jobs
9988                 having a too low priority won't be sent to the printer.</P
9989 ><P
9990 >If a <TT
9991 CLASS="PARAMETER"
9992 ><I
9993 >%p</I
9994 ></TT
9995 > is given then the printername
9996                 is put in its place. A <TT
9997 CLASS="PARAMETER"
9998 ><I
9999 >%j</I
10000 ></TT
10001 > is replaced with
10002                 the job number (an integer).  On HPUX (see <TT
10003 CLASS="PARAMETER"
10004 ><I
10005 >printing=hpux
10006                 </I
10007 ></TT
10008 >), if the <TT
10009 CLASS="PARAMETER"
10010 ><I
10011 >-p%p</I
10012 ></TT
10013 > option is added
10014                 to the lpq command, the job will show up with the correct status, i.e.
10015                 if the job priority is lower than the set fence priority it will
10016                 have the PAUSED status, whereas if  the priority is equal or higher it
10017                 will have the SPOOLED or PRINTING status.</P
10018 ><P
10019 >Note that it is good practice to include the absolute path
10020                 in the lppause command as the PATH may not be available to the server.</P
10021 ><P
10022 >See also the <A
10023 HREF="#PRINTING"
10024 ><TT
10025 CLASS="PARAMETER"
10026 ><I
10027 >printing
10028                 </I
10029 ></TT
10030 ></A
10031 > parameter.</P
10032 ><P
10033 >Default: Currently no default value is given to
10034                 this string, unless the value of the <TT
10035 CLASS="PARAMETER"
10036 ><I
10037 >printing</I
10038 ></TT
10039 >
10040                 parameter is <TT
10041 CLASS="CONSTANT"
10042 >SYSV</TT
10043 >, in which case the default is :</P
10044 ><P
10045 ><B
10046 CLASS="COMMAND"
10047 >lp -i %p-%j -H hold</B
10048 ></P
10049 ><P
10050 >or if the value of the <TT
10051 CLASS="PARAMETER"
10052 ><I
10053 >printing</I
10054 ></TT
10055 > parameter
10056                 is <TT
10057 CLASS="CONSTANT"
10058 >SOFTQ</TT
10059 >, then the default is:</P
10060 ><P
10061 ><B
10062 CLASS="COMMAND"
10063 >qstat -s -j%j -h</B
10064 ></P
10065 ><P
10066 >Example for HPUX: <B
10067 CLASS="COMMAND"
10068 >lppause command = /usr/bin/lpalt
10069                 %p-%j -p0</B
10070 ></P
10071 ></DD
10072 ><DT
10073 ><A
10074 NAME="LPQCACHETIME"
10075 ></A
10076 >lpq cache time (G)</DT
10077 ><DD
10078 ><P
10079 >This controls how long lpq info will be cached
10080                 for to prevent the <B
10081 CLASS="COMMAND"
10082 >lpq</B
10083 > command being called too
10084                 often. A separate cache is kept for each variation of the <B
10085 CLASS="COMMAND"
10086 >               lpq</B
10087 > command used by the system, so if you use different
10088                 <B
10089 CLASS="COMMAND"
10090 >lpq</B
10091 > commands for different users then they won't
10092                 share cache information.</P
10093 ><P
10094 >The cache files are stored in <TT
10095 CLASS="FILENAME"
10096 >/tmp/lpq.xxxx</TT
10097 >
10098                 where xxxx is a hash of the <B
10099 CLASS="COMMAND"
10100 >lpq</B
10101 > command in use.</P
10102 ><P
10103 >The default is 10 seconds, meaning that the cached results
10104                 of a previous identical <B
10105 CLASS="COMMAND"
10106 >lpq</B
10107 > command will be used
10108                 if the cached data is less than 10 seconds old. A large value may
10109                 be advisable if your <B
10110 CLASS="COMMAND"
10111 >lpq</B
10112 > command is very slow.</P
10113 ><P
10114 >A value of 0 will disable caching completely.</P
10115 ><P
10116 >See also the <A
10117 HREF="#PRINTING"
10118 ><TT
10119 CLASS="PARAMETER"
10120 ><I
10121 >printing
10122                 </I
10123 ></TT
10124 ></A
10125 > parameter.</P
10126 ><P
10127 >Default: <B
10128 CLASS="COMMAND"
10129 >lpq cache time = 10</B
10130 ></P
10131 ><P
10132 >Example: <B
10133 CLASS="COMMAND"
10134 >lpq cache time = 30</B
10135 ></P
10136 ></DD
10137 ><DT
10138 ><A
10139 NAME="LPQCOMMAND"
10140 ></A
10141 >lpq command (S)</DT
10142 ><DD
10143 ><P
10144 >This parameter specifies the command to be
10145                 executed on the server host in order to obtain <B
10146 CLASS="COMMAND"
10147 >lpq
10148                 </B
10149 >-style printer status information.</P
10150 ><P
10151 >This command should be a program or script which
10152                 takes a printer name as its only parameter and outputs printer
10153                 status information.</P
10154 ><P
10155 >Currently eight styles of printer status information
10156                 are supported; BSD, AIX, LPRNG, PLP, SYSV, HPUX, QNX and SOFTQ.
10157                 This covers most UNIX systems. You control which type is expected
10158                 using the <TT
10159 CLASS="PARAMETER"
10160 ><I
10161 >printing =</I
10162 ></TT
10163 > option.</P
10164 ><P
10165 >Some clients (notably Windows for Workgroups) may not
10166                 correctly send the connection number for the printer they are
10167                 requesting status information about. To get around this, the
10168                 server reports on the first printer service connected to by the
10169                 client. This only happens if the connection number sent is invalid.</P
10170 ><P
10171 >If a <TT
10172 CLASS="PARAMETER"
10173 ><I
10174 >%p</I
10175 ></TT
10176 > is given then the printername
10177                 is put in its place. Otherwise it is placed at the end of the
10178                 command.</P
10179 ><P
10180 >Note that it is good practice to include the absolute path
10181                 in the <TT
10182 CLASS="PARAMETER"
10183 ><I
10184 >lpq command</I
10185 ></TT
10186 > as the <TT
10187 CLASS="ENVAR"
10188 >$PATH
10189                 </TT
10190 > may not be available to the server.</P
10191 ><P
10192 >See also the <A
10193 HREF="#PRINTING"
10194 ><TT
10195 CLASS="PARAMETER"
10196 ><I
10197 >printing
10198                 </I
10199 ></TT
10200 ></A
10201 > parameter.</P
10202 ><P
10203 >Default: <EM
10204 >depends on the setting of <TT
10205 CLASS="PARAMETER"
10206 ><I
10207 >               printing</I
10208 ></TT
10209 ></EM
10210 ></P
10211 ><P
10212 >Example: <B
10213 CLASS="COMMAND"
10214 >lpq command = /usr/bin/lpq -P%p</B
10215 ></P
10216 ></DD
10217 ><DT
10218 ><A
10219 NAME="LPRESUMECOMMAND"
10220 ></A
10221 >lpresume command (S)</DT
10222 ><DD
10223 ><P
10224 >This parameter specifies the command to be
10225                 executed on the server host in order to restart or continue
10226                 printing or spooling a specific print job.</P
10227 ><P
10228 >This command should be a program or script which takes
10229                 a printer name and job number to resume the print job. See
10230                 also the <A
10231 HREF="#LPPAUSECOMMAND"
10232 ><TT
10233 CLASS="PARAMETER"
10234 ><I
10235 >lppause command
10236                 </I
10237 ></TT
10238 ></A
10239 > parameter.</P
10240 ><P
10241 >If a <TT
10242 CLASS="PARAMETER"
10243 ><I
10244 >%p</I
10245 ></TT
10246 > is given then the printername
10247                 is put in its place. A <TT
10248 CLASS="PARAMETER"
10249 ><I
10250 >%j</I
10251 ></TT
10252 > is replaced with
10253                 the job number (an integer).</P
10254 ><P
10255 >Note that it is good practice to include the absolute path
10256                 in the <TT
10257 CLASS="PARAMETER"
10258 ><I
10259 >lpresume command</I
10260 ></TT
10261 > as the PATH may not
10262                 be available to the server.</P
10263 ><P
10264 >See also the <A
10265 HREF="#PRINTING"
10266 ><TT
10267 CLASS="PARAMETER"
10268 ><I
10269 >printing
10270                 </I
10271 ></TT
10272 ></A
10273 > parameter.</P
10274 ><P
10275 >Default: Currently no default value is given
10276                 to this string, unless the value of the <TT
10277 CLASS="PARAMETER"
10278 ><I
10279 >printing</I
10280 ></TT
10281 >
10282                 parameter is <TT
10283 CLASS="CONSTANT"
10284 >SYSV</TT
10285 >, in which case the default is :</P
10286 ><P
10287 ><B
10288 CLASS="COMMAND"
10289 >lp -i %p-%j -H resume</B
10290 ></P
10291 ><P
10292 >or if the value of the <TT
10293 CLASS="PARAMETER"
10294 ><I
10295 >printing</I
10296 ></TT
10297 > parameter
10298                 is <TT
10299 CLASS="CONSTANT"
10300 >SOFTQ</TT
10301 >, then the default is:</P
10302 ><P
10303 ><B
10304 CLASS="COMMAND"
10305 >qstat -s -j%j -r</B
10306 ></P
10307 ><P
10308 >Example for HPUX: <B
10309 CLASS="COMMAND"
10310 >lpresume command = /usr/bin/lpalt
10311                 %p-%j -p2</B
10312 ></P
10313 ></DD
10314 ><DT
10315 ><A
10316 NAME="LPRMCOMMAND"
10317 ></A
10318 >lprm command (S)</DT
10319 ><DD
10320 ><P
10321 >This parameter specifies the command to be
10322                 executed on the server host in order to delete a print job.</P
10323 ><P
10324 >This command should be a program or script which takes
10325                 a printer name and job number, and deletes the print job.</P
10326 ><P
10327 >If a <TT
10328 CLASS="PARAMETER"
10329 ><I
10330 >%p</I
10331 ></TT
10332 > is given then the printername
10333                 is put in its place. A <TT
10334 CLASS="PARAMETER"
10335 ><I
10336 >%j</I
10337 ></TT
10338 > is replaced with
10339                 the job number (an integer).</P
10340 ><P
10341 >Note that it is good practice to include the absolute
10342                 path in the <TT
10343 CLASS="PARAMETER"
10344 ><I
10345 >lprm command</I
10346 ></TT
10347 > as the PATH may not be
10348                 available to the server.</P
10349 ><P
10350 >See also the <A
10351 HREF="#PRINTING"
10352 ><TT
10353 CLASS="PARAMETER"
10354 ><I
10355 >printing
10356                 </I
10357 ></TT
10358 ></A
10359 > parameter.</P
10360 ><P
10361 >Default: <EM
10362 >depends on the setting of <TT
10363 CLASS="PARAMETER"
10364 ><I
10365 >printing
10366                 </I
10367 ></TT
10368 ></EM
10369 ></P
10370 ><P
10371 >Example 1: <B
10372 CLASS="COMMAND"
10373 >lprm command = /usr/bin/lprm -P%p %j
10374                 </B
10375 ></P
10376 ><P
10377 >Example 2: <B
10378 CLASS="COMMAND"
10379 >lprm command = /usr/bin/cancel %p-%j
10380                 </B
10381 ></P
10382 ></DD
10383 ><DT
10384 ><A
10385 NAME="MACHINEPASSWORDTIMEOUT"
10386 ></A
10387 >machine password timeout (G)</DT
10388 ><DD
10389 ><P
10390 >If a Samba server is a member of an Windows
10391                 NT Domain (see the <A
10392 HREF="#SECURITYEQUALSDOMAIN"
10393 >security=domain</A
10394 >)
10395                 parameter) then periodically a running <A
10396 HREF="smbd.8.html"
10397 TARGET="_top"
10398 >               smbd(8)</A
10399 > process will try and change the MACHINE ACCOUNT
10400                 PASSWORD stored in the TDB called <TT
10401 CLASS="FILENAME"
10402 >private/secrets.tdb
10403                 </TT
10404 >.  This parameter specifies how often this password
10405                 will be changed, in seconds. The default is one week (expressed in
10406                 seconds), the same as a Windows NT Domain member server.</P
10407 ><P
10408 >See also <A
10409 HREF="smbpasswd.8.html"
10410 TARGET="_top"
10411 ><B
10412 CLASS="COMMAND"
10413 >smbpasswd(8)
10414                 </B
10415 ></A
10416 >, and the <A
10417 HREF="#SECURITYEQUALSDOMAIN"
10418 >               security=domain</A
10419 >) parameter.</P
10420 ><P
10421 >Default: <B
10422 CLASS="COMMAND"
10423 >machine password timeout = 604800</B
10424 ></P
10425 ></DD
10426 ><DT
10427 ><A
10428 NAME="MAGICOUTPUT"
10429 ></A
10430 >magic output (S)</DT
10431 ><DD
10432 ><P
10433 >This parameter specifies the name of a file
10434                 which will contain output created by a magic script (see the
10435                 <A
10436 HREF="#MAGICSCRIPT"
10437 ><TT
10438 CLASS="PARAMETER"
10439 ><I
10440 >magic script</I
10441 ></TT
10442 ></A
10443 >
10444                 parameter below).</P
10445 ><P
10446 >Warning: If two clients use the same <TT
10447 CLASS="PARAMETER"
10448 ><I
10449 >magic script
10450                 </I
10451 ></TT
10452 > in the same directory the output file content
10453                 is undefined.</P
10454 ><P
10455 >Default: <B
10456 CLASS="COMMAND"
10457 >magic output = &#60;magic script name&#62;.out
10458                 </B
10459 ></P
10460 ><P
10461 >Example: <B
10462 CLASS="COMMAND"
10463 >magic output = myfile.txt</B
10464 ></P
10465 ></DD
10466 ><DT
10467 ><A
10468 NAME="MAGICSCRIPT"
10469 ></A
10470 >magic script (S)</DT
10471 ><DD
10472 ><P
10473 >This parameter specifies the name of a file which,
10474                 if opened, will be executed by the server when the file is closed.
10475                 This allows a UNIX script to be sent to the Samba host and
10476                 executed on behalf of the connected user.</P
10477 ><P
10478 >Scripts executed in this way will be deleted upon
10479                 completion assuming that the user has the appripriate level
10480                 of priviledge and the ile permissions allow the deletion.</P
10481 ><P
10482 >If the script generates output, output will be sent to
10483                 the file specified by the <A
10484 HREF="#MAGICOUTPUT"
10485 ><TT
10486 CLASS="PARAMETER"
10487 ><I
10488 >               magic output</I
10489 ></TT
10490 ></A
10491 > parameter (see above).</P
10492 ><P
10493 >Note that some shells are unable to interpret scripts
10494                 containing CR/LF instead of CR as
10495                 the end-of-line marker. Magic scripts must be executable
10496                 <EM
10497 >as is</EM
10498 > on the host, which for some hosts and
10499                 some shells will require filtering at the DOS end.</P
10500 ><P
10501 >Magic scripts are <EM
10502 >EXPERIMENTAL</EM
10503 > and
10504                 should <EM
10505 >NOT</EM
10506 > be relied upon.</P
10507 ><P
10508 >Default: <EM
10509 >None. Magic scripts disabled.</EM
10510 ></P
10511 ><P
10512 >Example: <B
10513 CLASS="COMMAND"
10514 >magic script = user.csh</B
10515 ></P
10516 ></DD
10517 ><DT
10518 ><A
10519 NAME="MANGLECASE"
10520 ></A
10521 >mangle case (S)</DT
10522 ><DD
10523 ><P
10524 >See the section on <A
10525 HREF="#AEN201"
10526 >               NAME MANGLING</A
10527 ></P
10528 ><P
10529 >Default: <B
10530 CLASS="COMMAND"
10531 >mangle case = no</B
10532 ></P
10533 ></DD
10534 ><DT
10535 ><A
10536 NAME="MANGLEDMAP"
10537 ></A
10538 >mangled map (S)</DT
10539 ><DD
10540 ><P
10541 >This is for those who want to directly map UNIX
10542                 file names which can not be represented on Windows/DOS.  The mangling
10543                 of names is not always what is needed.  In particular you may have
10544                 documents with file extensions that differ between DOS and UNIX.
10545                 For example, under UNIX it is common to use <TT
10546 CLASS="FILENAME"
10547 >.html</TT
10548 >
10549                 for HTML files, whereas under Windows/DOS <TT
10550 CLASS="FILENAME"
10551 >.htm</TT
10552 >
10553                 is more commonly used.</P
10554 ><P
10555 >So to map <TT
10556 CLASS="FILENAME"
10557 >html</TT
10558 > to <TT
10559 CLASS="FILENAME"
10560 >htm</TT
10561 >
10562                 you would use:</P
10563 ><P
10564 ><B
10565 CLASS="COMMAND"
10566 >mangled map = (*.html *.htm)</B
10567 ></P
10568 ><P
10569 >One very useful case is to remove the annoying <TT
10570 CLASS="FILENAME"
10571 >;1
10572                 </TT
10573 > off the ends of filenames on some CDROMS (only visible
10574                 under some UNIXes). To do this use a map of (*;1 *;).</P
10575 ><P
10576 >Default: <EM
10577 >no mangled map</EM
10578 ></P
10579 ><P
10580 >Example: <B
10581 CLASS="COMMAND"
10582 >mangled map = (*;1 *;)</B
10583 ></P
10584 ></DD
10585 ><DT
10586 ><A
10587 NAME="MANGLEDNAMES"
10588 ></A
10589 >mangled names (S)</DT
10590 ><DD
10591 ><P
10592 >This controls whether non-DOS names under UNIX
10593                 should be mapped to DOS-compatible names ("mangled") and made visible,
10594                 or whether non-DOS names should simply be ignored.</P
10595 ><P
10596 >See the section on <A
10597 HREF="#AEN201"
10598 >               NAME MANGLING</A
10599 > for details on how to control the mangling process.</P
10600 ><P
10601 >If mangling is used then the mangling algorithm is as follows:</P
10602 ><P
10603 ></P
10604 ><UL
10605 ><LI
10606 ><P
10607 >The first (up to) five alphanumeric characters
10608                         before the rightmost dot of the filename are preserved, forced
10609                         to upper case, and appear as the first (up to) five characters
10610                         of the mangled name.</P
10611 ></LI
10612 ><LI
10613 ><P
10614 >A tilde "~" is appended to the first part of the mangled
10615                         name, followed by a two-character unique sequence, based on the
10616                         original root name (i.e., the original filename minus its final
10617                         extension). The final extension is included in the hash calculation
10618                         only if it contains any upper case characters or is longer than three
10619                         characters.</P
10620 ><P
10621 >Note that the character to use may be specified using
10622                         the <A
10623 HREF="#MANGLINGCHAR"
10624 ><TT
10625 CLASS="PARAMETER"
10626 ><I
10627 >mangling char</I
10628 ></TT
10629 >
10630                         </A
10631 > option, if you don't like '~'.</P
10632 ></LI
10633 ><LI
10634 ><P
10635 >The first three alphanumeric characters of the final
10636                         extension are preserved, forced to upper case and appear as the
10637                         extension of the mangled name. The final extension is defined as that
10638                         part of the original filename after the rightmost dot. If there are no
10639                         dots in the filename, the mangled name will have no extension (except
10640                         in the case of "hidden files" - see below).</P
10641 ></LI
10642 ><LI
10643 ><P
10644 >Files whose UNIX name begins with a dot will be
10645                         presented as DOS hidden files. The mangled name will be created as
10646                         for other filenames, but with the leading dot removed and "___" as
10647                         its extension regardless of actual original extension (that's three
10648                         underscores).</P
10649 ></LI
10650 ></UL
10651 ><P
10652 >The two-digit hash value consists of upper case
10653                 alphanumeric characters.</P
10654 ><P
10655 >This algorithm can cause name collisions only if files
10656                 in a directory share the same first five alphanumeric characters.
10657                 The probability of such a clash is 1/1300.</P
10658 ><P
10659 >The name mangling (if enabled) allows a file to be
10660                 copied between UNIX directories from Windows/DOS while retaining
10661                 the long UNIX filename. UNIX files can be renamed to a new extension
10662                 from Windows/DOS and will retain the same basename. Mangled names
10663                 do not change between sessions.</P
10664 ><P
10665 >Default: <B
10666 CLASS="COMMAND"
10667 >mangled names = yes</B
10668 ></P
10669 ></DD
10670 ><DT
10671 ><A
10672 NAME="MANGLEDSTACK"
10673 ></A
10674 >mangled stack (G)</DT
10675 ><DD
10676 ><P
10677 >This parameter controls the number of mangled names
10678                 that should be cached in the Samba server <A
10679 HREF="smbd.8.html"
10680 TARGET="_top"
10681 >               smbd(8)</A
10682 >.</P
10683 ><P
10684 >This stack is a list of recently mangled base names
10685                 (extensions are only maintained if they are longer than 3 characters
10686                 or contains upper case characters).</P
10687 ><P
10688 >The larger this value, the more likely it is that mangled
10689                 names can be successfully converted to correct long UNIX names.
10690                 However, large stack sizes will slow most directory access. Smaller
10691                 stacks save memory in the server (each stack element costs 256 bytes).
10692                 </P
10693 ><P
10694 >It is not possible to absolutely guarantee correct long
10695                 file names, so be prepared for some surprises!</P
10696 ><P
10697 >Default: <B
10698 CLASS="COMMAND"
10699 >mangled stack = 50</B
10700 ></P
10701 ><P
10702 >Example: <B
10703 CLASS="COMMAND"
10704 >mangled stack = 100</B
10705 ></P
10706 ></DD
10707 ><DT
10708 ><A
10709 NAME="MANGLINGCHAR"
10710 ></A
10711 >mangling char (S)</DT
10712 ><DD
10713 ><P
10714 >This controls what character is used as
10715                 the <EM
10716 >magic</EM
10717 > character in <A
10718 HREF="#AEN201"
10719 >name mangling</A
10720 >. The default is a '~'
10721                 but this may interfere with some software. Use this option to set
10722                 it to whatever you prefer.</P
10723 ><P
10724 >Default: <B
10725 CLASS="COMMAND"
10726 >mangling char = ~</B
10727 ></P
10728 ><P
10729 >Example: <B
10730 CLASS="COMMAND"
10731 >mangling char = ^</B
10732 ></P
10733 ></DD
10734 ><DT
10735 ><A
10736 NAME="MAPARCHIVE"
10737 ></A
10738 >map archive (S)</DT
10739 ><DD
10740 ><P
10741 >This controls whether the DOS archive attribute
10742                 should be mapped to the UNIX owner execute bit.  The DOS archive bit
10743                 is set when a file has been modified since its last backup.  One
10744                 motivation for this option it to keep Samba/your PC from making
10745                 any file it touches from becoming executable under UNIX.  This can
10746                 be quite annoying for shared source code, documents, etc...</P
10747 ><P
10748 >Note that this requires the <TT
10749 CLASS="PARAMETER"
10750 ><I
10751 >create mask</I
10752 ></TT
10753 >
10754                 parameter to be set such that owner execute bit is not masked out
10755                 (i.e. it must include 100). See the parameter <A
10756 HREF="#CREATEMASK"
10757 >               <TT
10758 CLASS="PARAMETER"
10759 ><I
10760 >create mask</I
10761 ></TT
10762 ></A
10763 > for details.</P
10764 ><P
10765 >Default: <B
10766 CLASS="COMMAND"
10767 >map archive = yes</B
10768 ></P
10769 ></DD
10770 ><DT
10771 ><A
10772 NAME="MAPHIDDEN"
10773 ></A
10774 >map hidden (S)</DT
10775 ><DD
10776 ><P
10777 >This controls whether DOS style hidden files
10778                 should be mapped to the UNIX world execute bit.</P
10779 ><P
10780 >Note that this requires the <TT
10781 CLASS="PARAMETER"
10782 ><I
10783 >create mask</I
10784 ></TT
10785 >
10786                 to be set such that the world execute bit is not masked out (i.e.
10787                 it must include 001). See the parameter <A
10788 HREF="#CREATEMASK"
10789 >               <TT
10790 CLASS="PARAMETER"
10791 ><I
10792 >create mask</I
10793 ></TT
10794 ></A
10795 > for details.</P
10796 ><P
10797 >Default: <B
10798 CLASS="COMMAND"
10799 >map hidden = no</B
10800 ></P
10801 ></DD
10802 ><DT
10803 ><A
10804 NAME="MAPSYSTEM"
10805 ></A
10806 >map system (S)</DT
10807 ><DD
10808 ><P
10809 >This controls whether DOS style system files
10810                 should be mapped to the UNIX group execute bit.</P
10811 ><P
10812 >Note that this requires the <TT
10813 CLASS="PARAMETER"
10814 ><I
10815 >create mask</I
10816 ></TT
10817 >
10818                 to be set such that the group execute bit is not masked out (i.e.
10819                 it must include 010). See the parameter <A
10820 HREF="#CREATEMASK"
10821 >               <TT
10822 CLASS="PARAMETER"
10823 ><I
10824 >create mask</I
10825 ></TT
10826 ></A
10827 > for details.</P
10828 ><P
10829 >Default: <B
10830 CLASS="COMMAND"
10831 >map system = no</B
10832 ></P
10833 ></DD
10834 ><DT
10835 ><A
10836 NAME="MAPTOGUEST"
10837 ></A
10838 >map to guest (G)</DT
10839 ><DD
10840 ><P
10841 >This parameter is only useful in <A
10842 HREF="#SECURITY"
10843 >               security</A
10844 > modes other than <TT
10845 CLASS="PARAMETER"
10846 ><I
10847 >security=share</I
10848 ></TT
10849 >
10850                 - i.e. <TT
10851 CLASS="CONSTANT"
10852 >user</TT
10853 >, <TT
10854 CLASS="CONSTANT"
10855 >server</TT
10856 >,
10857                 and <TT
10858 CLASS="CONSTANT"
10859 >domain</TT
10860 >.</P
10861 ><P
10862 >This parameter can take three different values, which tell
10863                 <A
10864 HREF="smbd.8.html"
10865 TARGET="_top"
10866 >smbd(8)</A
10867 > what to do with user
10868                 login requests that don't match a valid UNIX user in some way.</P
10869 ><P
10870 >The three settings are :</P
10871 ><P
10872 ></P
10873 ><UL
10874 ><LI
10875 ><P
10876 ><TT
10877 CLASS="CONSTANT"
10878 >Never</TT
10879 > - Means user login
10880                         requests with an invalid password are rejected. This is the
10881                         default.</P
10882 ></LI
10883 ><LI
10884 ><P
10885 ><TT
10886 CLASS="CONSTANT"
10887 >Bad User</TT
10888 > - Means user
10889                         logins with an invalid password are rejected, unless the username
10890                         does not exist, in which case it is treated as a guest login and
10891                         mapped into the <A
10892 HREF="#GUESTACCOUNT"
10893 ><TT
10894 CLASS="PARAMETER"
10895 ><I
10896 >                       guest account</I
10897 ></TT
10898 ></A
10899 >.</P
10900 ></LI
10901 ><LI
10902 ><P
10903 ><TT
10904 CLASS="CONSTANT"
10905 >Bad Password</TT
10906 > - Means user logins
10907                         with an invalid password are treated as a guest login and mapped
10908                         into the <A
10909 HREF="#GUESTACCOUNT"
10910 >guest account</A
10911 >. Note that
10912                         this can cause problems as it means that any user incorrectly typing
10913                         their password will be silently logged on as "guest" - and
10914                         will not know the reason they cannot access files they think
10915                         they should - there will have been no message given to them
10916                         that they got their password wrong. Helpdesk services will
10917                         <EM
10918 >hate</EM
10919 > you if you set the <TT
10920 CLASS="PARAMETER"
10921 ><I
10922 >map to
10923                         guest</I
10924 ></TT
10925 > parameter this way :-).</P
10926 ></LI
10927 ></UL
10928 ><P
10929 >Note that this parameter is needed to set up "Guest"
10930                 share services when using <TT
10931 CLASS="PARAMETER"
10932 ><I
10933 >security</I
10934 ></TT
10935 > modes other than
10936                 share. This is because in these modes the name of the resource being
10937                 requested is <EM
10938 >not</EM
10939 > sent to the server until after
10940                 the server has successfully authenticated the client so the server
10941                 cannot make authentication decisions at the correct time (connection
10942                 to the share) for "Guest" shares.</P
10943 ><P
10944 >For people familiar with the older Samba releases, this
10945                 parameter maps to the old compile-time setting of the <TT
10946 CLASS="CONSTANT"
10947 >               GUEST_SESSSETUP</TT
10948 > value in local.h.</P
10949 ><P
10950 >Default: <B
10951 CLASS="COMMAND"
10952 >map to guest = Never</B
10953 ></P
10954 ><P
10955 >Example: <B
10956 CLASS="COMMAND"
10957 >map to guest = Bad User</B
10958 ></P
10959 ></DD
10960 ><DT
10961 ><A
10962 NAME="MAXCONNECTIONS"
10963 ></A
10964 >max connections (S)</DT
10965 ><DD
10966 ><P
10967 >This option allows the number of simultaneous
10968                 connections to a service to be limited. If <TT
10969 CLASS="PARAMETER"
10970 ><I
10971 >max connections
10972                 </I
10973 ></TT
10974 > is greater than 0 then connections will be refused if
10975                 this number of connections to the service are already open. A value
10976                 of zero mean an unlimited number of connections may be made.</P
10977 ><P
10978 >Record lock files are used to implement this feature. The
10979                 lock files will be stored in the directory specified by the <A
10980 HREF="#LOCKDIRECTORY"
10981 ><TT
10982 CLASS="PARAMETER"
10983 ><I
10984 >lock directory</I
10985 ></TT
10986 ></A
10987 >
10988                 option.</P
10989 ><P
10990 >Default: <B
10991 CLASS="COMMAND"
10992 >max connections = 0</B
10993 ></P
10994 ><P
10995 >Example: <B
10996 CLASS="COMMAND"
10997 >max connections = 10</B
10998 ></P
10999 ></DD
11000 ><DT
11001 ><A
11002 NAME="MAXDISKSIZE"
11003 ></A
11004 >max disk size (G)</DT
11005 ><DD
11006 ><P
11007 >This option allows you to put an upper limit
11008                 on the apparent size of disks. If you set this option to 100
11009                 then all shares will appear to be not larger than 100 MB in
11010                 size.</P
11011 ><P
11012 >Note that this option does not limit the amount of
11013                 data you can put on the disk. In the above case you could still
11014                 store much more than 100 MB on the disk, but if a client ever asks
11015                 for the amount of free disk space or the total disk size then the
11016                 result will be bounded by the amount specified in <TT
11017 CLASS="PARAMETER"
11018 ><I
11019 >max
11020                 disk size</I
11021 ></TT
11022 >.</P
11023 ><P
11024 >This option is primarily useful to work around bugs
11025                 in some pieces of software that can't handle very large disks,
11026                 particularly disks over 1GB in size.</P
11027 ><P
11028 >A <TT
11029 CLASS="PARAMETER"
11030 ><I
11031 >max disk size</I
11032 ></TT
11033 > of 0 means no limit.</P
11034 ><P
11035 >Default: <B
11036 CLASS="COMMAND"
11037 >max disk size = 0</B
11038 ></P
11039 ><P
11040 >Example: <B
11041 CLASS="COMMAND"
11042 >max disk size = 1000</B
11043 ></P
11044 ></DD
11045 ><DT
11046 ><A
11047 NAME="MAXLOGSIZE"
11048 ></A
11049 >max log size (G)</DT
11050 ><DD
11051 ><P
11052 >This option (an integer in kilobytes) specifies
11053                 the max size the log file should grow to. Samba periodically checks
11054                 the size and if it is exceeded it will rename the file, adding
11055                 a <TT
11056 CLASS="FILENAME"
11057 >.old</TT
11058 > extension.</P
11059 ><P
11060 >A size of 0 means no limit.</P
11061 ><P
11062 >Default: <B
11063 CLASS="COMMAND"
11064 >max log size = 5000</B
11065 ></P
11066 ><P
11067 >Example: <B
11068 CLASS="COMMAND"
11069 >max log size = 1000</B
11070 ></P
11071 ></DD
11072 ><DT
11073 ><A
11074 NAME="MAXMUX"
11075 ></A
11076 >max mux (G)</DT
11077 ><DD
11078 ><P
11079 >This option controls the maximum number of
11080                 outstanding simultaneous SMB operations that samba tells the client
11081                 it will allow. You should never need to set this parameter.</P
11082 ><P
11083 >Default: <B
11084 CLASS="COMMAND"
11085 >max mux = 50</B
11086 ></P
11087 ></DD
11088 ><DT
11089 ><A
11090 NAME="MAXOPENFILES"
11091 ></A
11092 >max open files (G)</DT
11093 ><DD
11094 ><P
11095 >This parameter limits the maximum number of
11096                 open files that one <A
11097 HREF="smbd.8.html"
11098 TARGET="_top"
11099 >smbd(8)</A
11100 > file
11101                 serving process may have open for a client at any one time. The
11102                 default for this parameter is set very high (10,000) as Samba uses
11103                 only one bit per unopened file.</P
11104 ><P
11105 >The limit of the number of open files is usually set
11106                 by the UNIX per-process file descriptor limit rather than
11107                 this parameter so you should never need to touch this parameter.</P
11108 ><P
11109 >Default: <B
11110 CLASS="COMMAND"
11111 >max open files = 10000</B
11112 ></P
11113 ></DD
11114 ><DT
11115 ><A
11116 NAME="MAXPRINTJOBS"
11117 ></A
11118 >max print jobs (S)</DT
11119 ><DD
11120 ><P
11121 >This parameter limits the maximum number of
11122                 jobs allowable in a Samba printer queue at any given moment.
11123                 If this number is exceeded, <A
11124 HREF="smbd.8.html"
11125 TARGET="_top"
11126 ><B
11127 CLASS="COMMAND"
11128 >               smbd(8)</B
11129 ></A
11130 > will remote "Out of Space" to the client.
11131                 See all <A
11132 HREF="#TOTALPRINTJOBS"
11133 ><TT
11134 CLASS="PARAMETER"
11135 ><I
11136 >total
11137                 print jobs</I
11138 ></TT
11139 ></A
11140 >.
11141                 </P
11142 ><P
11143 >Default: <B
11144 CLASS="COMMAND"
11145 >max print jobs = 1000</B
11146 ></P
11147 ><P
11148 >Example: <B
11149 CLASS="COMMAND"
11150 >max print jobs = 5000</B
11151 ></P
11152 ></DD
11153 ><DT
11154 ><A
11155 NAME="MAXPROTOCOL"
11156 ></A
11157 >max protocol (G)</DT
11158 ><DD
11159 ><P
11160 >The value of the parameter (a string) is the highest
11161                 protocol level that will be supported by the server.</P
11162 ><P
11163 >Possible values are :</P
11164 ><P
11165 ></P
11166 ><UL
11167 ><LI
11168 ><P
11169 ><TT
11170 CLASS="CONSTANT"
11171 >CORE</TT
11172 >: Earliest version. No
11173                         concept of user names.</P
11174 ></LI
11175 ><LI
11176 ><P
11177 ><TT
11178 CLASS="CONSTANT"
11179 >COREPLUS</TT
11180 >: Slight improvements on
11181                         CORE for efficiency.</P
11182 ></LI
11183 ><LI
11184 ><P
11185 ><TT
11186 CLASS="CONSTANT"
11187 >LANMAN1</TT
11188 >: First <EM
11189 >                       modern</EM
11190 > version of the protocol. Long filename
11191                         support.</P
11192 ></LI
11193 ><LI
11194 ><P
11195 ><TT
11196 CLASS="CONSTANT"
11197 >LANMAN2</TT
11198 >: Updates to Lanman1 protocol.
11199                         </P
11200 ></LI
11201 ><LI
11202 ><P
11203 ><TT
11204 CLASS="CONSTANT"
11205 >NT1</TT
11206 >: Current up to date version of
11207                         the protocol. Used by Windows NT. Known as CIFS.</P
11208 ></LI
11209 ></UL
11210 ><P
11211 >Normally this option should not be set as the automatic
11212                 negotiation phase in the SMB protocol takes care of choosing
11213                 the appropriate protocol.</P
11214 ><P
11215 >See also <A
11216 HREF="#MINPROTOCOL"
11217 ><TT
11218 CLASS="PARAMETER"
11219 ><I
11220 >min
11221                 protocol</I
11222 ></TT
11223 ></A
11224 ></P
11225 ><P
11226 >Default: <B
11227 CLASS="COMMAND"
11228 >max protocol = NT1</B
11229 ></P
11230 ><P
11231 >Example: <B
11232 CLASS="COMMAND"
11233 >max protocol = LANMAN1</B
11234 ></P
11235 ></DD
11236 ><DT
11237 ><A
11238 NAME="MAXSMBDPROCESSES"
11239 ></A
11240 >max smbd processes (G)</DT
11241 ><DD
11242 ><P
11243 >This parameter limits the maximum number of
11244                 <A
11245 HREF="smbd.8.html"
11246 TARGET="_top"
11247 ><B
11248 CLASS="COMMAND"
11249 >smbd(8)</B
11250 ></A
11251 >
11252                 processes concurrently running on a system and is intended
11253                 as a stop gap to prevent degrading service to clients in the event
11254                 that the server has insufficient resources to handle more than this
11255                 number of connections.  Remember that under normal operating
11256                 conditions, each user will have an smbd associated with him or her
11257                 to handle connections to all shares from a given host.
11258                 </P
11259 ><P
11260 >Default: <B
11261 CLASS="COMMAND"
11262 >max smbd processes = 0</B
11263 >   ## no limit</P
11264 ><P
11265 >Example: <B
11266 CLASS="COMMAND"
11267 >max smbd processes = 1000</B
11268 ></P
11269 ></DD
11270 ><DT
11271 ><A
11272 NAME="MAXTTL"
11273 ></A
11274 >max ttl (G)</DT
11275 ><DD
11276 ><P
11277 >This option tells <A
11278 HREF="nmbd.8.html"
11279 TARGET="_top"
11280 >nmbd(8)</A
11281 >
11282                 what the default 'time to live' of NetBIOS names should be (in seconds)
11283                 when <B
11284 CLASS="COMMAND"
11285 >nmbd</B
11286 > is requesting a name using either a
11287                 broadcast packet or from a WINS server. You should never need to
11288                 change this parameter. The default is 3 days.</P
11289 ><P
11290 >Default: <B
11291 CLASS="COMMAND"
11292 >max ttl = 259200</B
11293 ></P
11294 ></DD
11295 ><DT
11296 ><A
11297 NAME="MAXWINSTTL"
11298 ></A
11299 >max wins ttl (G)</DT
11300 ><DD
11301 ><P
11302 >This option tells <A
11303 HREF="nmbd.8.html"
11304 TARGET="_top"
11305 >nmbd(8)
11306                 </A
11307 > when acting as a WINS server (<A
11308 HREF="#WINSSUPPORT"
11309 >               <TT
11310 CLASS="PARAMETER"
11311 ><I
11312 >wins support=yes</I
11313 ></TT
11314 ></A
11315 >) what the maximum
11316                 'time to live' of NetBIOS names that <B
11317 CLASS="COMMAND"
11318 >nmbd</B
11319 >
11320                 will grant will be (in seconds). You should never need to change this
11321                 parameter.  The default is 6 days (518400 seconds).</P
11322 ><P
11323 >See also the <A
11324 HREF="#MINWINSTTL"
11325 ><TT
11326 CLASS="PARAMETER"
11327 ><I
11328 >min
11329                 wins ttl"</I
11330 ></TT
11331 ></A
11332 > parameter.</P
11333 ><P
11334 >Default: <B
11335 CLASS="COMMAND"
11336 >max wins ttl = 518400</B
11337 ></P
11338 ></DD
11339 ><DT
11340 ><A
11341 NAME="MAXXMIT"
11342 ></A
11343 >max xmit (G)</DT
11344 ><DD
11345 ><P
11346 >This option controls the maximum packet size
11347                 that will be negotiated by Samba. The default is 65535, which
11348                 is the maximum. In some cases you may find you get better performance
11349                 with a smaller value. A value below 2048 is likely to cause problems.
11350                 </P
11351 ><P
11352 >Default: <B
11353 CLASS="COMMAND"
11354 >max xmit = 65535</B
11355 ></P
11356 ><P
11357 >Example: <B
11358 CLASS="COMMAND"
11359 >max xmit = 8192</B
11360 ></P
11361 ></DD
11362 ><DT
11363 ><A
11364 NAME="MESSAGECOMMAND"
11365 ></A
11366 >message command (G)</DT
11367 ><DD
11368 ><P
11369 >This specifies what command to run when the
11370                 server receives a WinPopup style message.</P
11371 ><P
11372 >This would normally be a command that would
11373                 deliver the message somehow. How this is to be done is
11374                 up to your imagination.</P
11375 ><P
11376 >An example is:</P
11377 ><P
11378 ><B
11379 CLASS="COMMAND"
11380 >message command = csh -c 'xedit %s;rm %s' &#38;</B
11381 >
11382                 </P
11383 ><P
11384 >This delivers the message using <B
11385 CLASS="COMMAND"
11386 >xedit</B
11387 >, then
11388                 removes it afterwards. <EM
11389 >NOTE THAT IT IS VERY IMPORTANT
11390                 THAT THIS COMMAND RETURN IMMEDIATELY</EM
11391 >. That's why I
11392                 have the '&#38;' on the end. If it doesn't return immediately then
11393                 your PCs may freeze when sending messages (they should recover
11394                 after 30secs, hopefully).</P
11395 ><P
11396 >All messages are delivered as the global guest user.
11397                 The command takes the standard substitutions, although <TT
11398 CLASS="PARAMETER"
11399 ><I
11400 >               %u</I
11401 ></TT
11402 > won't work (<TT
11403 CLASS="PARAMETER"
11404 ><I
11405 >%U</I
11406 ></TT
11407 > may be better
11408                 in this case).</P
11409 ><P
11410 >Apart from the standard substitutions, some additional
11411                 ones apply. In particular:</P
11412 ><P
11413 ></P
11414 ><UL
11415 ><LI
11416 ><P
11417 ><TT
11418 CLASS="PARAMETER"
11419 ><I
11420 >%s</I
11421 ></TT
11422 > = the filename containing
11423                         the message.</P
11424 ></LI
11425 ><LI
11426 ><P
11427 ><TT
11428 CLASS="PARAMETER"
11429 ><I
11430 >%t</I
11431 ></TT
11432 > = the destination that
11433                         the message was sent to (probably the server name).</P
11434 ></LI
11435 ><LI
11436 ><P
11437 ><TT
11438 CLASS="PARAMETER"
11439 ><I
11440 >%f</I
11441 ></TT
11442 > = who the message
11443                         is from.</P
11444 ></LI
11445 ></UL
11446 ><P
11447 >You could make this command send mail, or whatever else
11448                 takes your fancy. Please let us know of any really interesting
11449                 ideas you have.</P
11450 ><P
11451 >Here's a way of sending the messages as mail to root:</P
11452 ><P
11453 ><B
11454 CLASS="COMMAND"
11455 >message command = /bin/mail -s 'message from %f on
11456                 %m' root &#60; %s; rm %s</B
11457 ></P
11458 ><P
11459 >If you don't have a message command then the message
11460                 won't be delivered and Samba will tell the sender there was
11461                 an error. Unfortunately WfWg totally ignores the error code
11462                 and carries on regardless, saying that the message was delivered.
11463                 </P
11464 ><P
11465 >If you want to silently delete it then try:</P
11466 ><P
11467 ><B
11468 CLASS="COMMAND"
11469 >message command = rm %s</B
11470 ></P
11471 ><P
11472 >Default: <EM
11473 >no message command</EM
11474 ></P
11475 ><P
11476 >Example: <B
11477 CLASS="COMMAND"
11478 >message command = csh -c 'xedit %s;
11479                 rm %s' &#38;</B
11480 ></P
11481 ></DD
11482 ><DT
11483 ><A
11484 NAME="MINPASSWDLENGTH"
11485 ></A
11486 >min passwd length (G)</DT
11487 ><DD
11488 ><P
11489 >Synonym for <A
11490 HREF="#MINPASSWORDLENGTH"
11491 >               <TT
11492 CLASS="PARAMETER"
11493 ><I
11494 >min password length</I
11495 ></TT
11496 ></A
11497 >.</P
11498 ></DD
11499 ><DT
11500 ><A
11501 NAME="MINPASSWORDLENGTH"
11502 ></A
11503 >min password length (G)</DT
11504 ><DD
11505 ><P
11506 >This option sets the minimum length in characters
11507                 of a plaintext password that <B
11508 CLASS="COMMAND"
11509 >smbd</B
11510 > will accept when performing
11511                 UNIX password changing.</P
11512 ><P
11513 >See also <A
11514 HREF="#UNIXPASSWORDSYNC"
11515 ><TT
11516 CLASS="PARAMETER"
11517 ><I
11518 >unix
11519                 password sync</I
11520 ></TT
11521 ></A
11522 >, <A
11523 HREF="#PASSWDPROGRAM"
11524 >               <TT
11525 CLASS="PARAMETER"
11526 ><I
11527 >passwd program</I
11528 ></TT
11529 ></A
11530 > and <A
11531 HREF="#PASSWDCHATDEBUG"
11532 ><TT
11533 CLASS="PARAMETER"
11534 ><I
11535 >passwd chat debug</I
11536 ></TT
11537 >
11538                 </A
11539 >.</P
11540 ><P
11541 >Default: <B
11542 CLASS="COMMAND"
11543 >min password length = 5</B
11544 ></P
11545 ></DD
11546 ><DT
11547 ><A
11548 NAME="MINPRINTSPACE"
11549 ></A
11550 >min print space (S)</DT
11551 ><DD
11552 ><P
11553 >This sets the minimum amount of free disk
11554                 space that must be available before a user will be able to spool
11555                 a print job. It is specified in kilobytes. The default is 0, which
11556                 means a user can always spool a print job.</P
11557 ><P
11558 >See also the <A
11559 HREF="#PRINTING"
11560 ><TT
11561 CLASS="PARAMETER"
11562 ><I
11563 >printing
11564                 </I
11565 ></TT
11566 ></A
11567 > parameter.</P
11568 ><P
11569 >Default: <B
11570 CLASS="COMMAND"
11571 >min print space = 0</B
11572 ></P
11573 ><P
11574 >Example: <B
11575 CLASS="COMMAND"
11576 >min print space = 2000</B
11577 ></P
11578 ></DD
11579 ><DT
11580 ><A
11581 NAME="MINPROTOCOL"
11582 ></A
11583 >min protocol (G)</DT
11584 ><DD
11585 ><P
11586 >The value of the parameter (a string) is the
11587                 lowest SMB protocol dialect than Samba will support.  Please refer
11588                 to the <A
11589 HREF="#MAXPROTOCOL"
11590 ><TT
11591 CLASS="PARAMETER"
11592 ><I
11593 >max protocol</I
11594 ></TT
11595 ></A
11596 >
11597                 parameter for a list of valid protocol names and a brief description
11598                 of each.  You may also wish to refer to the C source code in
11599                 <TT
11600 CLASS="FILENAME"
11601 >source/smbd/negprot.c</TT
11602 > for a listing of known protocol
11603                 dialects supported by clients.</P
11604 ><P
11605 >If you are viewing this parameter as a security measure, you should
11606                 also refer to the <A
11607 HREF="#LANMANAUTH"
11608 ><TT
11609 CLASS="PARAMETER"
11610 ><I
11611 >lanman
11612                 auth</I
11613 ></TT
11614 ></A
11615 > parameter.  Otherwise, you should never need
11616                 to change this parameter.</P
11617 ><P
11618 >Default : <B
11619 CLASS="COMMAND"
11620 >min protocol = CORE</B
11621 ></P
11622 ><P
11623 >Example : <B
11624 CLASS="COMMAND"
11625 >min protocol = NT1</B
11626 >  # disable DOS
11627                 clients</P
11628 ></DD
11629 ><DT
11630 ><A
11631 NAME="MINWINSTTL"
11632 ></A
11633 >min wins ttl (G)</DT
11634 ><DD
11635 ><P
11636 >This option tells <A
11637 HREF="nmbd.8.html"
11638 TARGET="_top"
11639 >nmbd(8)</A
11640 >
11641                 when acting as a WINS server (<A
11642 HREF="#WINSSUPPORT"
11643 ><TT
11644 CLASS="PARAMETER"
11645 ><I
11646 >               wins support = yes</I
11647 ></TT
11648 ></A
11649 >) what the minimum 'time to live'
11650                 of NetBIOS names that <B
11651 CLASS="COMMAND"
11652 >nmbd</B
11653 > will grant will be (in
11654                 seconds). You should never need to change this parameter.  The default
11655                 is 6 hours (21600 seconds).</P
11656 ><P
11657 >Default: <B
11658 CLASS="COMMAND"
11659 >min wins ttl = 21600</B
11660 ></P
11661 ></DD
11662 ><DT
11663 ><A
11664 NAME="MSDFSROOT"
11665 ></A
11666 >msdfs root (S)</DT
11667 ><DD
11668 ><P
11669 >This boolean parameter is only available if
11670                 Samba is configured  and  compiled with the <B
11671 CLASS="COMMAND"
11672 >               --with-msdfs</B
11673 > option.  If set to <TT
11674 CLASS="CONSTANT"
11675 >yes&#62;</TT
11676 >,
11677                 Samba treats the share as a Dfs root and  allows clients to browse
11678                 the distributed file system tree rooted at the share directory.
11679                 Dfs links are specified  in  the share directory by symbolic
11680                 links of the form <TT
11681 CLASS="FILENAME"
11682 >msdfs:serverA\shareA,serverB\shareB
11683                 </TT
11684 > and so on.  For more information on setting up a Dfs tree
11685                 on Samba,  refer to <A
11686 HREF="msdfs_setup.html"
11687 TARGET="_top"
11688 >msdfs_setup.html
11689                 </A
11690 >.</P
11691 ><P
11692 >See also <A
11693 HREF="#HOSTMSDFS"
11694 ><TT
11695 CLASS="PARAMETER"
11696 ><I
11697 >host msdfs
11698                 </I
11699 ></TT
11700 ></A
11701 ></P
11702 ><P
11703 >Default: <B
11704 CLASS="COMMAND"
11705 >msdfs root = no</B
11706 ></P
11707 ></DD
11708 ><DT
11709 ><A
11710 NAME="NAMERESOLVEORDER"
11711 ></A
11712 >name resolve order (G)</DT
11713 ><DD
11714 ><P
11715 >This option is used by the programs in the Samba
11716                 suite to determine what naming services to use and in what order
11717                 to resolve host names to IP addresses. The option takes a space
11718                 separated string of name resolution options.</P
11719 ><P
11720 >The options are :"lmhosts", "host", "wins" and "bcast". They
11721                 cause names to be resolved as follows :</P
11722 ><P
11723 ></P
11724 ><UL
11725 ><LI
11726 ><P
11727 ><TT
11728 CLASS="CONSTANT"
11729 >lmhosts</TT
11730 > : Lookup an IP
11731                         address in the Samba lmhosts file. If the line in lmhosts has
11732                         no name type attached to the NetBIOS name (see the <A
11733 HREF="lmhosts.5.html"
11734 TARGET="_top"
11735 >lmhosts(5)</A
11736 > for details) then
11737                         any name type matches for lookup.</P
11738 ></LI
11739 ><LI
11740 ><P
11741 ><TT
11742 CLASS="CONSTANT"
11743 >host</TT
11744 > : Do a standard host
11745                         name to IP address resolution, using the system <TT
11746 CLASS="FILENAME"
11747 >/etc/hosts
11748                         </TT
11749 >, NIS, or DNS lookups. This method of name resolution
11750                         is operating system depended for instance on IRIX or Solaris this
11751                         may be controlled by the <TT
11752 CLASS="FILENAME"
11753 >/etc/nsswitch.conf</TT
11754 >
11755                         file).  Note that this method is only used if the NetBIOS name
11756                         type being queried is the 0x20 (server) name type, otherwise
11757                         it is ignored.</P
11758 ></LI
11759 ><LI
11760 ><P
11761 ><TT
11762 CLASS="CONSTANT"
11763 >wins</TT
11764 > : Query a name with
11765                         the IP address listed in the <A
11766 HREF="#WINSSERVER"
11767 ><TT
11768 CLASS="PARAMETER"
11769 ><I
11770 >                       wins server</I
11771 ></TT
11772 ></A
11773 > parameter.  If no WINS server has
11774                         been specified this method will be ignored.</P
11775 ></LI
11776 ><LI
11777 ><P
11778 ><TT
11779 CLASS="CONSTANT"
11780 >bcast</TT
11781 > : Do a broadcast on
11782                         each of the known local interfaces listed in the <A
11783 HREF="#INTERFACES"
11784 ><TT
11785 CLASS="PARAMETER"
11786 ><I
11787 >interfaces</I
11788 ></TT
11789 ></A
11790 >
11791                         parameter. This is the least reliable of the name resolution
11792                         methods as it depends on the target host being on a locally
11793                         connected subnet.</P
11794 ></LI
11795 ></UL
11796 ><P
11797 >Default: <B
11798 CLASS="COMMAND"
11799 >name resolve order = lmhosts host wins bcast
11800                 </B
11801 ></P
11802 ><P
11803 >Example: <B
11804 CLASS="COMMAND"
11805 >name resolve order = lmhosts bcast host
11806                 </B
11807 ></P
11808 ><P
11809 >This will cause the local lmhosts file to be examined
11810                 first, followed by a broadcast attempt, followed by a normal
11811                 system hostname lookup.</P
11812 ></DD
11813 ><DT
11814 ><A
11815 NAME="NETBIOSALIASES"
11816 ></A
11817 >netbios aliases (G)</DT
11818 ><DD
11819 ><P
11820 >This is a list of NetBIOS names that <A
11821 HREF="nmbd.8.html"
11822 TARGET="_top"
11823 >nmbd(8)</A
11824 > will advertise as additional
11825                 names by which the Samba server is known. This allows one machine
11826                 to appear in browse lists under multiple names. If a machine is
11827                 acting as a browse server or logon server none
11828                 of these names will be advertised as either browse server or logon
11829                 servers, only the primary name of the machine will be advertised
11830                 with these capabilities.</P
11831 ><P
11832 >See also <A
11833 HREF="#NETBIOSNAME"
11834 ><TT
11835 CLASS="PARAMETER"
11836 ><I
11837 >netbios
11838                 name</I
11839 ></TT
11840 ></A
11841 >.</P
11842 ><P
11843 >Default: <EM
11844 >empty string (no additional names)</EM
11845 ></P
11846 ><P
11847 >Example: <B
11848 CLASS="COMMAND"
11849 >netbios aliases = TEST TEST1 TEST2</B
11850 ></P
11851 ></DD
11852 ><DT
11853 ><A
11854 NAME="NETBIOSNAME"
11855 ></A
11856 >netbios name (G)</DT
11857 ><DD
11858 ><P
11859 >This sets the NetBIOS name by which a Samba
11860                 server is known. By default it is the same as the first component
11861                 of the host's DNS name. If a machine is a browse server or
11862                 logon server this name (or the first component
11863                 of the hosts DNS name) will be the name that these services are
11864                 advertised under.</P
11865 ><P
11866 >See also <A
11867 HREF="#NETBIOSALIASES"
11868 ><TT
11869 CLASS="PARAMETER"
11870 ><I
11871 >netbios
11872                 aliases</I
11873 ></TT
11874 ></A
11875 >.</P
11876 ><P
11877 >Default: <EM
11878 >machine DNS name</EM
11879 ></P
11880 ><P
11881 >Example: <B
11882 CLASS="COMMAND"
11883 >netbios name = MYNAME</B
11884 ></P
11885 ></DD
11886 ><DT
11887 ><A
11888 NAME="NETBIOSSCOPE"
11889 ></A
11890 >netbios scope (G)</DT
11891 ><DD
11892 ><P
11893 >This sets the NetBIOS scope that Samba will
11894                 operate under. This should not be set unless every machine
11895                 on your LAN also sets this value.</P
11896 ></DD
11897 ><DT
11898 ><A
11899 NAME="NISHOMEDIR"
11900 ></A
11901 >nis homedir (G)</DT
11902 ><DD
11903 ><P
11904 >Get the home share server from a NIS map. For
11905                 UNIX systems that use an automounter, the user's home directory
11906                 will often be mounted on a workstation on demand from a remote
11907                 server. </P
11908 ><P
11909 >When the Samba logon server is not the actual home directory
11910                 server, but is mounting the home directories via NFS then two
11911                 network hops would be required to access the users home directory
11912                 if the logon server told the client to use itself as the SMB server
11913                 for home directories (one over SMB and one over NFS). This can
11914                 be very slow.</P
11915 ><P
11916 >This option allows Samba to return the home share as
11917                 being on a different server to the logon server and as
11918                 long as a Samba daemon is running on the home directory server,
11919                 it will be mounted on the Samba client directly from the directory
11920                 server. When Samba is returning the home share to the client, it
11921                 will consult the NIS map specified in <A
11922 HREF="#HOMEDIRMAP"
11923 >               <TT
11924 CLASS="PARAMETER"
11925 ><I
11926 >homedir map</I
11927 ></TT
11928 ></A
11929 > and return the server
11930                 listed there.</P
11931 ><P
11932 >Note that for this option to work there must be a working
11933                 NIS system and the Samba server with this option must also
11934                 be a logon server.</P
11935 ><P
11936 >Default: <B
11937 CLASS="COMMAND"
11938 >nis homedir = no</B
11939 ></P
11940 ></DD
11941 ><DT
11942 ><A
11943 NAME="NTACLSUPPORT"
11944 ></A
11945 >nt acl support (G)</DT
11946 ><DD
11947 ><P
11948 >This boolean parameter controls whether
11949                 <A
11950 HREF="smbd.8.html"
11951 TARGET="_top"
11952 >smbd(8)</A
11953 > will attempt to map
11954                 UNIX permissions into Windows NT access control lists.</P
11955 ><P
11956 >Default: <B
11957 CLASS="COMMAND"
11958 >nt acl support = yes</B
11959 ></P
11960 ></DD
11961 ><DT
11962 ><A
11963 NAME="NTPIPESUPPORT"
11964 ></A
11965 >nt pipe support (G)</DT
11966 ><DD
11967 ><P
11968 >This boolean parameter controls whether
11969                 <A
11970 HREF="smbd.8.html"
11971 TARGET="_top"
11972 >smbd(8)</A
11973 > will allow Windows NT
11974                 clients to connect to the NT SMB specific <TT
11975 CLASS="CONSTANT"
11976 >IPC$</TT
11977 >
11978                 pipes. This is a developer debugging option and can be left
11979                 alone.</P
11980 ><P
11981 >Default: <B
11982 CLASS="COMMAND"
11983 >nt pipe support = yes</B
11984 ></P
11985 ></DD
11986 ><DT
11987 ><A
11988 NAME="NTSMBSUPPORT"
11989 ></A
11990 >nt smb support (G)</DT
11991 ><DD
11992 ><P
11993 >This boolean parameter controls whether <A
11994 HREF="smbd.8.html"
11995 TARGET="_top"
11996 >smbd(8)</A
11997 > will negotiate NT specific SMB
11998                 support with Windows NT clients. Although this is a developer
11999                 debugging option and should be left alone, benchmarking has discovered
12000                 that Windows NT clients give faster performance with this option
12001                 set to <TT
12002 CLASS="CONSTANT"
12003 >no</TT
12004 >. This is still being investigated.
12005                 If this option is set to <TT
12006 CLASS="CONSTANT"
12007 >no</TT
12008 > then Samba offers
12009                 exactly the same SMB calls that versions prior to Samba 2.0 offered.
12010                 This information may be of use if any users are having problems
12011                 with NT SMB support.</P
12012 ><P
12013 >You should not need to ever disable this parameter.</P
12014 ><P
12015 >Default: <B
12016 CLASS="COMMAND"
12017 >nt smb support = yes</B
12018 ></P
12019 ></DD
12020 ><DT
12021 ><A
12022 NAME="NULLPASSWORDS"
12023 ></A
12024 >null passwords (G)</DT
12025 ><DD
12026 ><P
12027 >Allow or disallow client access to accounts
12028                 that have null passwords. </P
12029 ><P
12030 >See also <A
12031 HREF="smbpasswd.5.html"
12032 TARGET="_top"
12033 >smbpasswd (5)</A
12034 >.</P
12035 ><P
12036 >Default: <B
12037 CLASS="COMMAND"
12038 >null passwords = no</B
12039 ></P
12040 ></DD
12041 ><DT
12042 ><A
12043 NAME="OBEYPAMRESTRICTIONS"
12044 ></A
12045 >obey pam restrictions (G)</DT
12046 ><DD
12047 ><P
12048 >When Samba 2.2 is configure to enable PAM support
12049                 (i.e. --with-pam), this parameter will control whether or not Samba
12050                 should obey PAM's account and session management directives.  The
12051                 default behavior is to use PAM for clear text authentication only
12052                 and to ignore any account or session management.  Note that Samba
12053                 always ignores PAM for authentication in the case of <A
12054 HREF="#ENCRYPTPASSWORDS"
12055 ><TT
12056 CLASS="PARAMETER"
12057 ><I
12058 >encrypt passwords = yes</I
12059 ></TT
12060 >
12061                 </A
12062 >.  The reason is that PAM modules cannot support the challenge/response
12063                 authentication mechanism needed in the presence of SMB password encryption.
12064                 </P
12065 ><P
12066 >Default: <B
12067 CLASS="COMMAND"
12068 >obey pam restrictions = no</B
12069 ></P
12070 ></DD
12071 ><DT
12072 ><A
12073 NAME="ONLYUSER"
12074 ></A
12075 >only user (S)</DT
12076 ><DD
12077 ><P
12078 >This is a boolean option that controls whether
12079                 connections with usernames not in the <TT
12080 CLASS="PARAMETER"
12081 ><I
12082 >user</I
12083 ></TT
12084 >
12085                 list will be allowed. By default this option is disabled so that a
12086                 client can supply a username to be used by the server.  Enabling
12087                 this parameter will force the server to only user the login
12088                 names from the <TT
12089 CLASS="PARAMETER"
12090 ><I
12091 >user</I
12092 ></TT
12093 > list and is only really
12094                 useful in <A
12095 HREF="#SECURITYEQUALSSHARE"
12096 >shave level</A
12097 >
12098                 security.</P
12099 ><P
12100 >Note that this also means Samba won't try to deduce
12101                 usernames from the service name. This can be annoying for
12102                 the [homes] section. To get around this you could use <B
12103 CLASS="COMMAND"
12104 >user =
12105                 %S</B
12106 > which means your <TT
12107 CLASS="PARAMETER"
12108 ><I
12109 >user</I
12110 ></TT
12111 > list
12112                 will be just the service name, which for home directories is the
12113                 name of the user.</P
12114 ><P
12115 >See also the <A
12116 HREF="#USER"
12117 ><TT
12118 CLASS="PARAMETER"
12119 ><I
12120 >user</I
12121 ></TT
12122 >
12123                 </A
12124 > parameter.</P
12125 ><P
12126 >Default: <B
12127 CLASS="COMMAND"
12128 >only user = no</B
12129 ></P
12130 ></DD
12131 ><DT
12132 ><A
12133 NAME="ONLYGUEST"
12134 ></A
12135 >only guest (S)</DT
12136 ><DD
12137 ><P
12138 >A synonym for <A
12139 HREF="#GUESTONLY"
12140 ><TT
12141 CLASS="PARAMETER"
12142 ><I
12143 >               guest only</I
12144 ></TT
12145 ></A
12146 >.</P
12147 ></DD
12148 ><DT
12149 ><A
12150 NAME="OPLOCKBREAKWAITTIME"
12151 ></A
12152 >oplock break wait time (G)</DT
12153 ><DD
12154 ><P
12155 >This is a tuning parameter added due to bugs in
12156                 both Windows 9x and WinNT. If Samba responds to a client too
12157                 quickly when that client issues an SMB that can cause an oplock
12158                 break request, then the network client can fail and not respond
12159                 to the break request. This tuning parameter (which is set in milliseconds)
12160                 is the amount of time Samba will wait before sending an oplock break
12161                 request to such (broken) clients.</P
12162 ><P
12163 ><EM
12164 >DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ
12165                 AND UNDERSTOOD THE SAMBA OPLOCK CODE</EM
12166 >.</P
12167 ><P
12168 >Default: <B
12169 CLASS="COMMAND"
12170 >oplock break wait time = 0</B
12171 ></P
12172 ></DD
12173 ><DT
12174 ><A
12175 NAME="OPLOCKCONTENTIONLIMIT"
12176 ></A
12177 >oplock contention limit (S)</DT
12178 ><DD
12179 ><P
12180 >This is a <EM
12181 >very</EM
12182 > advanced
12183                 <A
12184 HREF="smbd.8.html"
12185 TARGET="_top"
12186 >smbd(8)</A
12187 > tuning option to
12188                 improve the efficiency of the granting of oplocks under multiple
12189                 client contention for the same file.</P
12190 ><P
12191 >In brief it specifies a number, which causes smbd not to
12192                 grant an oplock even when requested if the approximate number of
12193                 clients contending for an oplock on the same file goes over this
12194                 limit. This causes <B
12195 CLASS="COMMAND"
12196 >smbd</B
12197 > to behave in a similar
12198                 way to Windows NT.</P
12199 ><P
12200 ><EM
12201 >DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ
12202                 AND UNDERSTOOD THE SAMBA OPLOCK CODE</EM
12203 >.</P
12204 ><P
12205 >Default: <B
12206 CLASS="COMMAND"
12207 >oplock contention limit = 2</B
12208 ></P
12209 ></DD
12210 ><DT
12211 ><A
12212 NAME="OPLOCKS"
12213 ></A
12214 >oplocks (S)</DT
12215 ><DD
12216 ><P
12217 >This boolean option tells smbd whether to
12218                 issue oplocks (opportunistic locks) to file open requests on this
12219                 share. The oplock code can dramatically (approx. 30% or more) improve
12220                 the speed of access to files on Samba servers. It allows the clients
12221                 to aggressively cache files locally and you may want to disable this
12222                 option for unreliable network environments (it is turned on by
12223                 default in Windows NT Servers).  For more information see the file
12224                 <TT
12225 CLASS="FILENAME"
12226 >Speed.txt</TT
12227 > in the Samba <TT
12228 CLASS="FILENAME"
12229 >docs/</TT
12230 >
12231                 directory.</P
12232 ><P
12233 >Oplocks may be selectively turned off on certain files with a
12234                 share. See the <A
12235 HREF="#VETOOPLOCKFILES"
12236 ><TT
12237 CLASS="PARAMETER"
12238 ><I
12239 >               veto oplock files</I
12240 ></TT
12241 ></A
12242 > parameter. On some systems
12243                 oplocks are recognized by the underlying operating system. This
12244                 allows data synchronization between all access to oplocked files,
12245                 whether it be via Samba or NFS or a local UNIX process. See the
12246                 <TT
12247 CLASS="PARAMETER"
12248 ><I
12249 >kernel oplocks</I
12250 ></TT
12251 > parameter for details.</P
12252 ><P
12253 >See also the <A
12254 HREF="#KERNELOPLOCKS"
12255 ><TT
12256 CLASS="PARAMETER"
12257 ><I
12258 >kernel
12259                 oplocks</I
12260 ></TT
12261 ></A
12262 > and <A
12263 HREF="#LEVEL2OPLOCKS"
12264 ><TT
12265 CLASS="PARAMETER"
12266 ><I
12267 >               level2 oplocks</I
12268 ></TT
12269 ></A
12270 > parameters.</P
12271 ><P
12272 >Default: <B
12273 CLASS="COMMAND"
12274 >oplocks = yes</B
12275 ></P
12276 ></DD
12277 ><DT
12278 ><A
12279 NAME="OSLEVEL"
12280 ></A
12281 >os level (G)</DT
12282 ><DD
12283 ><P
12284 >This integer value controls what level Samba
12285                 advertises itself as for browse elections. The value of this
12286                 parameter determines whether <A
12287 HREF="nmbd.8.html"
12288 TARGET="_top"
12289 >nmbd(8)</A
12290 >
12291                 has a chance of becoming a local master browser for the <TT
12292 CLASS="PARAMETER"
12293 ><I
12294 >               WORKGROUP</I
12295 ></TT
12296 > in the local broadcast area.</P
12297 ><P
12298 ><EM
12299 >Note :</EM
12300 >By default, Samba will win
12301                 a local master browsing election over all Microsoft operating
12302                 systems except a Windows NT 4.0/2000 Domain Controller.  This
12303                 means that a misconfigured Samba host can effectively isolate
12304                 a subnet for browsing purposes.  See <TT
12305 CLASS="FILENAME"
12306 >BROWSING.txt
12307                 </TT
12308 > in the Samba <TT
12309 CLASS="FILENAME"
12310 >docs/</TT
12311 > directory
12312                 for details.</P
12313 ><P
12314 >Default: <B
12315 CLASS="COMMAND"
12316 >os level = 20</B
12317 ></P
12318 ><P
12319 >Example: <B
12320 CLASS="COMMAND"
12321 >os level = 65 </B
12322 ></P
12323 ></DD
12324 ><DT
12325 ><A
12326 NAME="OS2DRIVERMAP"
12327 ></A
12328 >os2 driver map (G)</DT
12329 ><DD
12330 ><P
12331 >The parameter is used to define the absolute
12332                 path to a file containing a mapping of Windows NT printer driver
12333                 names to OS/2 printer driver names.  The format is:</P
12334 ><P
12335 >&#60;nt driver name&#62; = &#60;os2 driver
12336                 name&#62;.&#60;device name&#62;</P
12337 ><P
12338 >For example, a valid entry using the HP LaserJet 5
12339                 printer driver woudl appear as <B
12340 CLASS="COMMAND"
12341 >HP LaserJet 5L = LASERJET.HP
12342                 LaserJet 5L</B
12343 >.</P
12344 ><P
12345 >The need for the file is due to the printer driver namespace
12346                 problem described in the <A
12347 HREF="printer_driver2.html"
12348 TARGET="_top"
12349 >Samba
12350                 Printing HOWTO</A
12351 >.  For more details on OS/2 clients, please
12352                 refer to the <A
12353 HREF="OS2-Client-HOWTO.html"
12354 TARGET="_top"
12355 >OS2-Client-HOWTO
12356                 </A
12357 > containing in the Samba documentation.</P
12358 ><P
12359 >Default: <B
12360 CLASS="COMMAND"
12361 >os2 driver map = &#60;empty string&#62;
12362                 </B
12363 ></P
12364 ></DD
12365 ><DT
12366 ><A
12367 NAME="PAMPASSWORDCHANGE"
12368 ></A
12369 >pam password change (G)</DT
12370 ><DD
12371 ><P
12372 >With the addition of better PAM support in Samba 2.2,
12373                 this parameter, it is possible to use PAM's password change control
12374                 flag for Samba.  If enabled, then PAM will be used for password
12375                 changes when requested by an SMB client, and  the <A
12376 HREF="#PASSWDCHAT"
12377 ><TT
12378 CLASS="PARAMETER"
12379 ><I
12380 >passwd chat</I
12381 ></TT
12382 ></A
12383 > must be
12384                 be changed to work with the pam prompts.
12385                 </P
12386 ><P
12387 >Default: <B
12388 CLASS="COMMAND"
12389 >pam password change = no</B
12390 ></P
12391 ></DD
12392 ><DT
12393 ><A
12394 NAME="PANICACTION"
12395 ></A
12396 >panic action (G)</DT
12397 ><DD
12398 ><P
12399 >This is a Samba developer option that allows a
12400                 system command to be called when either <A
12401 HREF="smbd.8.html"
12402 TARGET="_top"
12403 >               smbd(8)</A
12404 > or <A
12405 HREF="nmbd.8.html"
12406 TARGET="_top"
12407 >nmbd(8)</A
12408 >
12409                 crashes. This is usually used to draw attention to the fact that
12410                 a problem occurred.</P
12411 ><P
12412 >Default: <B
12413 CLASS="COMMAND"
12414 >panic action = &#60;empty string&#62;</B
12415 ></P
12416 ><P
12417 >Example: <B
12418 CLASS="COMMAND"
12419 >panic action = "/bin/sleep 90000"</B
12420 ></P
12421 ></DD
12422 ><DT
12423 ><A
12424 NAME="PASSWDCHAT"
12425 ></A
12426 >passwd chat (G)</DT
12427 ><DD
12428 ><P
12429 >This string controls the <EM
12430 >"chat"</EM
12431 >
12432                 conversation that takes places between <A
12433 HREF="smbd.8.html"
12434 TARGET="_top"
12435 >smbd</A
12436 > and the local password changing
12437                 program to change the users password. The string describes a
12438                 sequence of response-receive pairs that <A
12439 HREF="smbd.8.html"
12440 TARGET="_top"
12441 >               smbd(8)</A
12442 > uses to determine what to send to the
12443                 <A
12444 HREF="#PASSWDPROGRAM"
12445 ><TT
12446 CLASS="PARAMETER"
12447 ><I
12448 >passwd program</I
12449 ></TT
12450 >
12451                 </A
12452 > and what to expect back. If the expected output is not
12453                 received then the password is not changed.</P
12454 ><P
12455 >This chat sequence is often quite site specific, depending
12456                 on what local methods are used for password control (such as NIS
12457                 etc).</P
12458 ><P
12459 >The string can contain the macros <TT
12460 CLASS="PARAMETER"
12461 ><I
12462 >%o</I
12463 ></TT
12464 >
12465                 and <TT
12466 CLASS="PARAMETER"
12467 ><I
12468 >%n</I
12469 ></TT
12470 > which are substituted for the old
12471                 and new passwords respectively. It can also contain the standard
12472                 macros <TT
12473 CLASS="CONSTANT"
12474 >\n</TT
12475 >, <TT
12476 CLASS="CONSTANT"
12477 >\r</TT
12478 >, <TT
12479 CLASS="CONSTANT"
12480 >               \t</TT
12481 > and <TT
12482 CLASS="CONSTANT"
12483 >%s</TT
12484 > to give line-feed,
12485                 carriage-return, tab and space.</P
12486 ><P
12487 >The string can also contain a '*' which matches
12488                 any sequence of characters.</P
12489 ><P
12490 >Double quotes can be used to collect strings with spaces
12491                 in them into a single string.</P
12492 ><P
12493 >If the send string in any part of the chat sequence
12494                 is a fullstop ".",  then no string is sent. Similarly,
12495                 if the expect string is a fullstop then no string is expected.</P
12496 ><P
12497 >Note that if the <A
12498 HREF="#UNIXPASSWORDSYNC"
12499 ><TT
12500 CLASS="PARAMETER"
12501 ><I
12502 >unix
12503                 password sync</I
12504 ></TT
12505 ></A
12506 > parameter is set to true, then this
12507                 sequence is called <EM
12508 >AS ROOT</EM
12509 > when the SMB password
12510                 in the smbpasswd file is being changed, without access to the old
12511                 password cleartext. In this case the old password cleartext is set
12512                 to "" (the empty string).</P
12513 ><P
12514 >Also, if the <A
12515 HREF="#PAMPASSWORDCHANGE"
12516 ><TT
12517 CLASS="PARAMETER"
12518 ><I
12519 >pam
12520                 password change</I
12521 ></TT
12522 ></A
12523 > parameter is set to true, then the
12524                 chat sequence should consist of three elements. The first element should
12525                 match the pam prompt for the old password, the second element should match
12526                 the pam prompt for the first request for the new password, and the final
12527                 element should match the pam prompt for the second request for the new password.
12528                 These matches are done case insentively. Under most conditions this change
12529                 is done as root so the prompt for the old password will never be matched.
12530                 </P
12531 ><P
12532 >See also <A
12533 HREF="#UNIXPASSWORDSYNC"
12534 ><TT
12535 CLASS="PARAMETER"
12536 ><I
12537 >unix password
12538                 sync</I
12539 ></TT
12540 ></A
12541 >, <A
12542 HREF="#PASSWDPROGRAM"
12543 ><TT
12544 CLASS="PARAMETER"
12545 ><I
12546 >               passwd program</I
12547 ></TT
12548 ></A
12549 > ,<A
12550 HREF="#PASSWDCHATDEBUG"
12551 >               <TT
12552 CLASS="PARAMETER"
12553 ><I
12554 >passwd chat debug</I
12555 ></TT
12556 ></A
12557 > and <A
12558 HREF="#PAMPASSWORDCHANGE"
12559 >               <TT
12560 CLASS="PARAMETER"
12561 ><I
12562 >pam password change</I
12563 ></TT
12564 ></A
12565 >.</P
12566 ><P
12567 >Default: <B
12568 CLASS="COMMAND"
12569 >passwd chat = *new*password* %n\n
12570                 *new*password* %n\n *changed*</B
12571 ></P
12572 ><P
12573 >Example: <B
12574 CLASS="COMMAND"
12575 >passwd chat = "*Enter OLD password*" %o\n
12576                 "*Enter NEW password*" %n\n "*Reenter NEW password*" %n\n "*Password
12577                 changed*"</B
12578 ></P
12579 ></DD
12580 ><DT
12581 ><A
12582 NAME="PASSWDCHATDEBUG"
12583 ></A
12584 >passwd chat debug (G)</DT
12585 ><DD
12586 ><P
12587 >This boolean specifies if the passwd chat script
12588                 parameter is run in <EM
12589 >debug</EM
12590 > mode. In this mode the
12591                 strings passed to and received from the passwd chat are printed
12592                 in the <A
12593 HREF="smbd.8.html"
12594 TARGET="_top"
12595 >smbd(8)</A
12596 > log with a
12597                 <A
12598 HREF="#DEBUGLEVEL"
12599 ><TT
12600 CLASS="PARAMETER"
12601 ><I
12602 >debug level</I
12603 ></TT
12604 ></A
12605 >
12606                 of 100. This is a dangerous option as it will allow plaintext passwords
12607                 to be seen in the <B
12608 CLASS="COMMAND"
12609 >smbd</B
12610 > log. It is available to help
12611                 Samba admins debug their <TT
12612 CLASS="PARAMETER"
12613 ><I
12614 >passwd chat</I
12615 ></TT
12616 > scripts
12617                 when calling the <TT
12618 CLASS="PARAMETER"
12619 ><I
12620 >passwd program</I
12621 ></TT
12622 > and should
12623                 be turned off after this has been done. This parameter is off by
12624                 default.</P
12625 ><P
12626 >See also &#60;<A
12627 HREF="#PASSWDCHAT"
12628 ><TT
12629 CLASS="PARAMETER"
12630 ><I
12631 >passwd chat</I
12632 ></TT
12633 >
12634                 </A
12635 >, <A
12636 HREF="#PASSWDPROGRAM"
12637 ><TT
12638 CLASS="PARAMETER"
12639 ><I
12640 >passwd program</I
12641 ></TT
12642 >
12643                 </A
12644 >.</P
12645 ><P
12646 >Default: <B
12647 CLASS="COMMAND"
12648 >passwd chat debug = no</B
12649 ></P
12650 ></DD
12651 ><DT
12652 ><A
12653 NAME="PASSWDPROGRAM"
12654 ></A
12655 >passwd program (G)</DT
12656 ><DD
12657 ><P
12658 >The name of a program that can be used to set
12659                 UNIX user passwords.  Any occurrences of <TT
12660 CLASS="PARAMETER"
12661 ><I
12662 >%u</I
12663 ></TT
12664 >
12665                 will be replaced with the user name. The user name is checked for
12666                 existence before calling the password changing program.</P
12667 ><P
12668 >Also note that many passwd programs insist in <EM
12669 >reasonable
12670                 </EM
12671 > passwords, such as a minimum length, or the inclusion
12672                 of mixed case chars and digits. This can pose a problem as some clients
12673                 (such as Windows for Workgroups) uppercase the password before sending
12674                 it.</P
12675 ><P
12676 ><EM
12677 >Note</EM
12678 > that if the <TT
12679 CLASS="PARAMETER"
12680 ><I
12681 >unix
12682                 password sync</I
12683 ></TT
12684 > parameter is set to <TT
12685 CLASS="CONSTANT"
12686 >True
12687                 </TT
12688 > then this program is called <EM
12689 >AS ROOT</EM
12690 >
12691                 before the SMB password in the <A
12692 HREF="smbpasswd.5.html"
12693 TARGET="_top"
12694 >smbpasswd(5)
12695                 </A
12696 > file is changed. If this UNIX password change fails, then
12697                 <B
12698 CLASS="COMMAND"
12699 >smbd</B
12700 > will fail to change the SMB password also
12701                 (this is by design).</P
12702 ><P
12703 >If the <TT
12704 CLASS="PARAMETER"
12705 ><I
12706 >unix password sync</I
12707 ></TT
12708 > parameter
12709                 is set this parameter <EM
12710 >MUST USE ABSOLUTE PATHS</EM
12711 >
12712                 for <EM
12713 >ALL</EM
12714 > programs called, and must be examined
12715                 for security implications. Note that by default <TT
12716 CLASS="PARAMETER"
12717 ><I
12718 >unix
12719                 password sync</I
12720 ></TT
12721 > is set to <TT
12722 CLASS="CONSTANT"
12723 >False</TT
12724 >.</P
12725 ><P
12726 >See also <A
12727 HREF="#UNIXPASSWORDSYNC"
12728 ><TT
12729 CLASS="PARAMETER"
12730 ><I
12731 >unix
12732                 password sync</I
12733 ></TT
12734 ></A
12735 >.</P
12736 ><P
12737 >Default: <B
12738 CLASS="COMMAND"
12739 >passwd program = /bin/passwd</B
12740 ></P
12741 ><P
12742 >Example: <B
12743 CLASS="COMMAND"
12744 >passwd program = /sbin/npasswd %u</B
12745 >
12746                 </P
12747 ></DD
12748 ><DT
12749 ><A
12750 NAME="PASSWORDLEVEL"
12751 ></A
12752 >password level (G)</DT
12753 ><DD
12754 ><P
12755 >Some client/server combinations have difficulty
12756                 with mixed-case passwords.  One offending client is Windows for
12757                 Workgroups, which for some reason forces passwords to upper
12758                 case when using the LANMAN1 protocol, but leaves them alone when
12759                 using COREPLUS!  Another problem child is the Windows 95/98
12760                 family of operating systems.  These clients upper case clear
12761                 text passwords even when NT LM 0.12 selected by the protocol
12762                 negotiation request/response.</P
12763 ><P
12764 >This parameter defines the maximum number of characters
12765                 that may be upper case in passwords.</P
12766 ><P
12767 >For example, say the password given was "FRED". If <TT
12768 CLASS="PARAMETER"
12769 ><I
12770 >               password level</I
12771 ></TT
12772 > is set to 1, the following combinations
12773                 would be tried if "FRED" failed:</P
12774 ><P
12775 >"Fred", "fred", "fRed", "frEd","freD"</P
12776 ><P
12777 >If <TT
12778 CLASS="PARAMETER"
12779 ><I
12780 >password level</I
12781 ></TT
12782 > was set to 2,
12783                 the following combinations would also be tried: </P
12784 ><P
12785 >"FRed", "FrEd", "FreD", "fREd", "fReD", "frED", ..</P
12786 ><P
12787 >And so on.</P
12788 ><P
12789 >The higher value this parameter is set to the more likely
12790                 it is that a mixed case password will be matched against a single
12791                 case password. However, you should be aware that use of this
12792                 parameter reduces security and increases the time taken to
12793                 process a new connection.</P
12794 ><P
12795 >A value of zero will cause only two attempts to be
12796                 made - the password as is and the password in all-lower case.</P
12797 ><P
12798 >Default: <B
12799 CLASS="COMMAND"
12800 >password level = 0</B
12801 ></P
12802 ><P
12803 >Example: <B
12804 CLASS="COMMAND"
12805 >password level = 4</B
12806 ></P
12807 ></DD
12808 ><DT
12809 ><A
12810 NAME="PASSWORDSERVER"
12811 ></A
12812 >password server (G)</DT
12813 ><DD
12814 ><P
12815 >By specifying the name of another SMB server (such
12816                 as a WinNT box) with this option, and using <B
12817 CLASS="COMMAND"
12818 >security = domain
12819                 </B
12820 > or <B
12821 CLASS="COMMAND"
12822 >security = server</B
12823 > you can get Samba
12824                 to do all its username/password validation via a remote server.</P
12825 ><P
12826 >This option sets the name of the password server to use.
12827                 It must be a NetBIOS name, so if the machine's NetBIOS name is
12828                 different from its Internet name then you may have to add its NetBIOS
12829                 name to the lmhosts  file which is stored in the same directory
12830                 as the <TT
12831 CLASS="FILENAME"
12832 >smb.conf</TT
12833 > file.</P
12834 ><P
12835 >The name of the password server is looked up using the
12836                 parameter <A
12837 HREF="#NAMERESOLVEORDER"
12838 ><TT
12839 CLASS="PARAMETER"
12840 ><I
12841 >name
12842                 resolve order</I
12843 ></TT
12844 ></A
12845 > and so may resolved
12846                 by any method and order described in that parameter.</P
12847 ><P
12848 >The password server much be a machine capable of using
12849                 the "LM1.2X002" or the "NT LM 0.12" protocol, and it must be in
12850                 user level security mode.</P
12851 ><P
12852 ><EM
12853 >NOTE:</EM
12854 > Using a password server
12855                 means your UNIX box (running Samba) is only as secure as your
12856                 password server. <EM
12857 >DO NOT CHOOSE A PASSWORD SERVER THAT
12858                 YOU DON'T COMPLETELY TRUST</EM
12859 >.</P
12860 ><P
12861 >Never point a Samba server at itself for password
12862                 serving. This will cause a loop and could lock up your Samba
12863                 server!</P
12864 ><P
12865 >The name of the password server takes the standard
12866                 substitutions, but probably the only useful one is <TT
12867 CLASS="PARAMETER"
12868 ><I
12869 >%m
12870                 </I
12871 ></TT
12872 >, which means the Samba server will use the incoming
12873                 client as the password server. If you use this then you better
12874                 trust your clients, and you had better restrict them with hosts allow!</P
12875 ><P
12876 >If the <TT
12877 CLASS="PARAMETER"
12878 ><I
12879 >security</I
12880 ></TT
12881 > parameter is set to
12882                 <TT
12883 CLASS="CONSTANT"
12884 >domain</TT
12885 >, then the list of machines in this
12886                 option must be a list of Primary or Backup Domain controllers for the
12887                 Domain or the character '*', as the Samba server is effectively
12888                 in that domain, and will use cryptographically authenticated RPC calls
12889                 to authenticate the user logging on. The advantage of using <B
12890 CLASS="COMMAND"
12891 >               security = domain</B
12892 > is that if you list several hosts in the
12893                 <TT
12894 CLASS="PARAMETER"
12895 ><I
12896 >password server</I
12897 ></TT
12898 > option then <B
12899 CLASS="COMMAND"
12900 >smbd
12901                 </B
12902 > will try each in turn till it finds one that responds. This
12903                 is useful in case your primary server goes down.</P
12904 ><P
12905 >If the <TT
12906 CLASS="PARAMETER"
12907 ><I
12908 >password server</I
12909 ></TT
12910 > option is set
12911                 to the character '*', then Samba will attempt to auto-locate the
12912                 Primary or Backup Domain controllers to authenticate against by
12913                 doing a query for the name <TT
12914 CLASS="CONSTANT"
12915 >WORKGROUP&#60;1C&#62;</TT
12916 >
12917                 and then contacting each server returned in the list of IP
12918                 addresses from the name resolution source. </P
12919 ><P
12920 >If the <TT
12921 CLASS="PARAMETER"
12922 ><I
12923 >security</I
12924 ></TT
12925 > parameter is
12926                 set to <TT
12927 CLASS="CONSTANT"
12928 >server</TT
12929 >, then there are different
12930                 restrictions that <B
12931 CLASS="COMMAND"
12932 >security = domain</B
12933 > doesn't
12934                 suffer from:</P
12935 ><P
12936 ></P
12937 ><UL
12938 ><LI
12939 ><P
12940 >You may list several password servers in
12941                         the <TT
12942 CLASS="PARAMETER"
12943 ><I
12944 >password server</I
12945 ></TT
12946 > parameter, however if an
12947                         <B
12948 CLASS="COMMAND"
12949 >smbd</B
12950 > makes a connection to a password server,
12951                         and then the password server fails, no more users will be able
12952                         to be authenticated from this <B
12953 CLASS="COMMAND"
12954 >smbd</B
12955 >.  This is a
12956                         restriction of the SMB/CIFS protocol when in <B
12957 CLASS="COMMAND"
12958 >security=server
12959                         </B
12960 > mode and cannot be fixed in Samba.</P
12961 ></LI
12962 ><LI
12963 ><P
12964 >If you are using a Windows NT server as your
12965                         password server then you will have to ensure that your users
12966                         are able to login from the Samba server, as when in <B
12967 CLASS="COMMAND"
12968 >                       security=server</B
12969 >  mode the network logon will appear to
12970                         come from there rather than from the users workstation.</P
12971 ></LI
12972 ></UL
12973 ><P
12974 >See also the <A
12975 HREF="#SECURITY"
12976 ><TT
12977 CLASS="PARAMETER"
12978 ><I
12979 >security
12980                 </I
12981 ></TT
12982 ></A
12983 > parameter.</P
12984 ><P
12985 >Default: <B
12986 CLASS="COMMAND"
12987 >password server = &#60;empty string&#62;</B
12988 >
12989                 </P
12990 ><P
12991 >Example: <B
12992 CLASS="COMMAND"
12993 >password server = NT-PDC, NT-BDC1, NT-BDC2
12994                 </B
12995 ></P
12996 ><P
12997 >Example: <B
12998 CLASS="COMMAND"
12999 >password server = *</B
13000 ></P
13001 ></DD
13002 ><DT
13003 ><A
13004 NAME="PATH"
13005 ></A
13006 >path (S)</DT
13007 ><DD
13008 ><P
13009 >This parameter specifies a directory to which
13010                 the user of the service is to be given access. In the case of
13011                 printable services, this is where print data will spool prior to
13012                 being submitted to the host for printing.</P
13013 ><P
13014 >For a printable service offering guest access, the service
13015                 should be readonly and the path should be world-writeable and
13016                 have the sticky bit set. This is not mandatory of course, but
13017                 you probably won't get the results you expect if you do
13018                 otherwise.</P
13019 ><P
13020 >Any occurrences of <TT
13021 CLASS="PARAMETER"
13022 ><I
13023 >%u</I
13024 ></TT
13025 > in the path
13026                 will be replaced with the UNIX username that the client is using
13027                 on this connection. Any occurrences of <TT
13028 CLASS="PARAMETER"
13029 ><I
13030 >%m</I
13031 ></TT
13032 >
13033                 will be replaced by the NetBIOS name of the machine they are
13034                 connecting from. These replacements are very useful for setting
13035                 up pseudo home directories for users.</P
13036 ><P
13037 >Note that this path will be based on <A
13038 HREF="#ROOTDIR"
13039 >               <TT
13040 CLASS="PARAMETER"
13041 ><I
13042 >root dir</I
13043 ></TT
13044 ></A
13045 > if one was specified.</P
13046 ><P
13047 >Default: <EM
13048 >none</EM
13049 ></P
13050 ><P
13051 >Example: <B
13052 CLASS="COMMAND"
13053 >path = /home/fred</B
13054 ></P
13055 ></DD
13056 ><DT
13057 ><A
13058 NAME="POSIXLOCKING"
13059 ></A
13060 >posix locking (S)</DT
13061 ><DD
13062 ><P
13063 >The <A
13064 HREF="smbd.8.html"
13065 TARGET="_top"
13066 ><B
13067 CLASS="COMMAND"
13068 >smbd(8)</B
13069 ></A
13070 >
13071                 daemon maintains an database of file locks obtained by SMB clients.
13072                 The default behavior is to map this internal database to POSIX
13073                 locks.  This means that file locks obtained by SMB clients are
13074                 consistent with those seen by POSIX compliant applications accessing
13075                 the files via a non-SMB method (e.g. NFS or local file access).
13076                 You should never need to disable this parameter.</P
13077 ><P
13078 >Default: <B
13079 CLASS="COMMAND"
13080 >posix locking = yes</B
13081 ></P
13082 ></DD
13083 ><DT
13084 ><A
13085 NAME="POSTEXEC"
13086 ></A
13087 >postexec (S)</DT
13088 ><DD
13089 ><P
13090 >This option specifies a command to be run
13091                 whenever the service is disconnected. It takes the usual
13092                 substitutions. The command may be run as the root on some
13093                 systems.</P
13094 ><P
13095 >An interesting example may be do unmount server
13096                 resources:</P
13097 ><P
13098 ><B
13099 CLASS="COMMAND"
13100 >postexec = /etc/umount /cdrom</B
13101 ></P
13102 ><P
13103 >See also <A
13104 HREF="#PREEXEC"
13105 ><TT
13106 CLASS="PARAMETER"
13107 ><I
13108 >preexec</I
13109 ></TT
13110 >
13111                 </A
13112 >.</P
13113 ><P
13114 >Default: <EM
13115 >none (no command executed)</EM
13116 >
13117                 </P
13118 ><P
13119 >Example: <B
13120 CLASS="COMMAND"
13121 >postexec = echo \"%u disconnected from %S
13122                 from %m (%I)\" &#62;&#62; /tmp/log</B
13123 ></P
13124 ></DD
13125 ><DT
13126 ><A
13127 NAME="POSTSCRIPT"
13128 ></A
13129 >postscript (S)</DT
13130 ><DD
13131 ><P
13132 >This parameter forces a printer to interpret
13133                 the print files as postscript. This is done by adding a <TT
13134 CLASS="CONSTANT"
13135 >%!
13136                 </TT
13137 > to the start of print output.</P
13138 ><P
13139 >This is most useful when you have lots of PCs that persist
13140                 in putting a control-D at the start of print jobs, which then
13141                 confuses your printer.</P
13142 ><P
13143 >Default: <B
13144 CLASS="COMMAND"
13145 >postscript = no</B
13146 ></P
13147 ></DD
13148 ><DT
13149 ><A
13150 NAME="PREEXEC"
13151 ></A
13152 >preexec (S)</DT
13153 ><DD
13154 ><P
13155 >This option specifies a command to be run whenever
13156                 the service is connected to. It takes the usual substitutions.</P
13157 ><P
13158 >An interesting example is to send the users a welcome
13159                 message every time they log in. Maybe a message of the day? Here
13160                 is an example:</P
13161 ><P
13162 ><B
13163 CLASS="COMMAND"
13164 >preexec = csh -c 'echo \"Welcome to %S!\" |
13165                  /usr/local/samba/bin/smbclient -M %m -I %I' &#38; </B
13166 ></P
13167 ><P
13168 >Of course, this could get annoying after a while :-)</P
13169 ><P
13170 >See also <A
13171 HREF="#PREEXECCLOSE"
13172 ><TT
13173 CLASS="PARAMETER"
13174 ><I
13175 >preexec close
13176                 </I
13177 ></TT
13178 ></A
13179 > and <A
13180 HREF="#POSTEXEC"
13181 ><TT
13182 CLASS="PARAMETER"
13183 ><I
13184 >postexec
13185                 </I
13186 ></TT
13187 ></A
13188 >.</P
13189 ><P
13190 >Default: <EM
13191 >none (no command executed)</EM
13192 ></P
13193 ><P
13194 >Example: <B
13195 CLASS="COMMAND"
13196 >preexec = echo \"%u connected to %S from %m
13197                 (%I)\" &#62;&#62; /tmp/log</B
13198 ></P
13199 ></DD
13200 ><DT
13201 ><A
13202 NAME="PREEXECCLOSE"
13203 ></A
13204 >preexec close (S)</DT
13205 ><DD
13206 ><P
13207 >This boolean option controls whether a non-zero
13208                 return code from <A
13209 HREF="#PREEXEC"
13210 ><TT
13211 CLASS="PARAMETER"
13212 ><I
13213 >preexec
13214                 </I
13215 ></TT
13216 ></A
13217 > should close the service being connected to.</P
13218 ><P
13219 >Default: <B
13220 CLASS="COMMAND"
13221 >preexec close = no</B
13222 ></P
13223 ></DD
13224 ><DT
13225 ><A
13226 NAME="PREFERREDMASTER"
13227 ></A
13228 >preferred master (G)</DT
13229 ><DD
13230 ><P
13231 >This boolean parameter controls if <A
13232 HREF="nmbd.8.html"
13233 TARGET="_top"
13234 >nmbd(8)</A
13235 > is a preferred master browser
13236                 for its workgroup.</P
13237 ><P
13238 >If this is set to true, on startup, <B
13239 CLASS="COMMAND"
13240 >nmbd</B
13241 >
13242                 will force an election, and it will have a slight advantage in
13243                 winning the election.  It is recommended that this parameter is
13244                 used in conjunction with <B
13245 CLASS="COMMAND"
13246 ><A
13247 HREF="#DOMAINMASTER"
13248 ><TT
13249 CLASS="PARAMETER"
13250 ><I
13251 >               domain master</I
13252 ></TT
13253 ></A
13254 > = yes</B
13255 >, so that <B
13256 CLASS="COMMAND"
13257 >               nmbd</B
13258 > can guarantee becoming a domain master.</P
13259 ><P
13260 >Use this option with caution, because if there are several
13261                 hosts (whether Samba servers, Windows 95 or NT) that are preferred
13262                 master browsers on the same subnet, they will each periodically
13263                 and continuously attempt to become the local master browser.
13264                 This will result in unnecessary broadcast traffic and reduced browsing
13265                 capabilities.</P
13266 ><P
13267 >See also <A
13268 HREF="#OSLEVEL"
13269 ><TT
13270 CLASS="PARAMETER"
13271 ><I
13272 >os level</I
13273 ></TT
13274 >
13275                 </A
13276 >.</P
13277 ><P
13278 >Default: <B
13279 CLASS="COMMAND"
13280 >preferred master = auto</B
13281 ></P
13282 ></DD
13283 ><DT
13284 ><A
13285 NAME="PREFEREDMASTER"
13286 ></A
13287 >prefered master (G)</DT
13288 ><DD
13289 ><P
13290 >Synonym for <A
13291 HREF="#PREFERREDMASTER"
13292 ><TT
13293 CLASS="PARAMETER"
13294 ><I
13295 >               preferred master</I
13296 ></TT
13297 ></A
13298 > for people who cannot spell :-).</P
13299 ></DD
13300 ><DT
13301 ><A
13302 NAME="PRELOAD"
13303 ></A
13304 >preload</DT
13305 ><DD
13306 ><P
13307 >This is a list of services that you want to be
13308                 automatically added to the browse lists. This is most useful
13309                 for homes and printers services that would otherwise not be
13310                 visible.</P
13311 ><P
13312 >Note that if you just want all printers in your
13313                 printcap file loaded then the <A
13314 HREF="#LOADPRINTERS"
13315 >               <TT
13316 CLASS="PARAMETER"
13317 ><I
13318 >load printers</I
13319 ></TT
13320 ></A
13321 > option is easier.</P
13322 ><P
13323 >Default: <EM
13324 >no preloaded services</EM
13325 ></P
13326 ><P
13327 >Example: <B
13328 CLASS="COMMAND"
13329 >preload = fred lp colorlp</B
13330 ></P
13331 ></DD
13332 ><DT
13333 ><A
13334 NAME="PRESERVECASE"
13335 ></A
13336 >preserve case (S)</DT
13337 ><DD
13338 ><P
13339 > This controls if new filenames are created
13340                 with the case that the client passes, or if they are forced to
13341                 be the <A
13342 HREF="#DEFAULTCASE"
13343 ><TT
13344 CLASS="PARAMETER"
13345 ><I
13346 >default case
13347                 </I
13348 ></TT
13349 ></A
13350 >.</P
13351 ><P
13352 >Default: <B
13353 CLASS="COMMAND"
13354 >preserve case = yes</B
13355 ></P
13356 ><P
13357 >See the section on <A
13358 HREF="#AEN201"
13359 >NAME
13360                 MANGLING</A
13361 > for a fuller discussion.</P
13362 ></DD
13363 ><DT
13364 ><A
13365 NAME="PRINTCOMMAND"
13366 ></A
13367 >print command (S)</DT
13368 ><DD
13369 ><P
13370 >After a print job has finished spooling to
13371                 a service, this command will be used via a <B
13372 CLASS="COMMAND"
13373 >system()</B
13374 >
13375                 call to process the spool file. Typically the command specified will
13376                 submit the spool file to the host's printing subsystem, but there
13377                 is no requirement that this be the case. The server will not remove
13378                 the spool file, so whatever command you specify should remove the
13379                 spool file when it has been processed, otherwise you will need to
13380                 manually remove old spool files.</P
13381 ><P
13382 >The print command is simply a text string. It will be used
13383                 verbatim, with two exceptions: All occurrences of <TT
13384 CLASS="PARAMETER"
13385 ><I
13386 >%s
13387                 </I
13388 ></TT
13389 > and <TT
13390 CLASS="PARAMETER"
13391 ><I
13392 >%f</I
13393 ></TT
13394 > will be replaced by the
13395                 appropriate spool file name, and all occurrences of <TT
13396 CLASS="PARAMETER"
13397 ><I
13398 >%p
13399                 </I
13400 ></TT
13401 > will be replaced by the appropriate printer name. The
13402                 spool file name is generated automatically by the server, the printer
13403                 name is discussed below.</P
13404 ><P
13405 >The print command <EM
13406 >MUST</EM
13407 > contain at least
13408                 one occurrence of <TT
13409 CLASS="PARAMETER"
13410 ><I
13411 >%s</I
13412 ></TT
13413 > or <TT
13414 CLASS="PARAMETER"
13415 ><I
13416 >%f
13417                 </I
13418 ></TT
13419 > - the <TT
13420 CLASS="PARAMETER"
13421 ><I
13422 >%p</I
13423 ></TT
13424 > is optional. At the time
13425                 a job is submitted, if no printer name is supplied the <TT
13426 CLASS="PARAMETER"
13427 ><I
13428 >%p
13429                 </I
13430 ></TT
13431 > will be silently removed from the printer command.</P
13432 ><P
13433 >If specified in the [global] section, the print command given
13434                 will be used for any printable service that does not have its own
13435                 print command specified.</P
13436 ><P
13437 >If there is neither a specified print command for a
13438                 printable service nor a global print command, spool files will
13439                 be created but not processed and (most importantly) not removed.</P
13440 ><P
13441 >Note that printing may fail on some UNIXes from the
13442                 <TT
13443 CLASS="CONSTANT"
13444 >nobody</TT
13445 > account. If this happens then create
13446                 an alternative guest account that can print and set the <A
13447 HREF="#GUESTACCOUNT"
13448 ><TT
13449 CLASS="PARAMETER"
13450 ><I
13451 >guest account</I
13452 ></TT
13453 ></A
13454 >
13455                 in the [global] section.</P
13456 ><P
13457 >You can form quite complex print commands by realizing
13458                 that they are just passed to a shell. For example the following
13459                 will log a print job, print the file, then remove it. Note that
13460                 ';' is the usual separator for command in shell scripts.</P
13461 ><P
13462 ><B
13463 CLASS="COMMAND"
13464 >print command = echo Printing %s &#62;&#62;
13465                 /tmp/print.log; lpr -P %p %s; rm %s</B
13466 ></P
13467 ><P
13468 >You may have to vary this command considerably depending
13469                 on how you normally print files on your system. The default for
13470                 the parameter varies depending on the setting of the <A
13471 HREF="#PRINTING"
13472 >               <TT
13473 CLASS="PARAMETER"
13474 ><I
13475 >printing</I
13476 ></TT
13477 ></A
13478 > parameter.</P
13479 ><P
13480 >Default: For <B
13481 CLASS="COMMAND"
13482 >printing= BSD, AIX, QNX, LPRNG
13483                 or PLP :</B
13484 ></P
13485 ><P
13486 ><B
13487 CLASS="COMMAND"
13488 >print command = lpr -r -P%p %s</B
13489 ></P
13490 ><P
13491 >For <B
13492 CLASS="COMMAND"
13493 >printing= SYS or HPUX :</B
13494 ></P
13495 ><P
13496 ><B
13497 CLASS="COMMAND"
13498 >print command = lp -c -d%p %s; rm %s</B
13499 ></P
13500 ><P
13501 >For <B
13502 CLASS="COMMAND"
13503 >printing=SOFTQ :</B
13504 ></P
13505 ><P
13506 ><B
13507 CLASS="COMMAND"
13508 >print command = lp -d%p -s %s; rm %s</B
13509 ></P
13510 ><P
13511 >Example: <B
13512 CLASS="COMMAND"
13513 >print command = /usr/local/samba/bin/myprintscript
13514                 %p %s</B
13515 ></P
13516 ></DD
13517 ><DT
13518 ><A
13519 NAME="PRINTOK"
13520 ></A
13521 >print ok (S)</DT
13522 ><DD
13523 ><P
13524 >Synonym for <A
13525 HREF="#PRINTABLE"
13526 >               <TT
13527 CLASS="PARAMETER"
13528 ><I
13529 >printable</I
13530 ></TT
13531 ></A
13532 >.</P
13533 ></DD
13534 ><DT
13535 ><A
13536 NAME="PRINTABLE"
13537 ></A
13538 >printable (S)</DT
13539 ><DD
13540 ><P
13541 >If this parameter is <TT
13542 CLASS="CONSTANT"
13543 >yes</TT
13544 >, then
13545                 clients may open, write to and submit spool files on the directory
13546                 specified for the service. </P
13547 ><P
13548 >Note that a printable service will ALWAYS allow writing
13549                 to the service path (user privileges permitting) via the spooling
13550                 of print data. The <A
13551 HREF="#WRITEABLE"
13552 ><TT
13553 CLASS="PARAMETER"
13554 ><I
13555 >writeable
13556                 </I
13557 ></TT
13558 ></A
13559 > parameter controls only non-printing access to
13560                 the resource.</P
13561 ><P
13562 >Default: <B
13563 CLASS="COMMAND"
13564 >printable = no</B
13565 ></P
13566 ></DD
13567 ><DT
13568 ><A
13569 NAME="PRINTCAP"
13570 ></A
13571 >printcap (G)</DT
13572 ><DD
13573 ><P
13574 >Synonym for    <A
13575 HREF="#PRINTCAPNAME"
13576 ><TT
13577 CLASS="PARAMETER"
13578 ><I
13579 >               printcap name</I
13580 ></TT
13581 ></A
13582 >.</P
13583 ></DD
13584 ><DT
13585 ><A
13586 NAME="PRINTCAPNAME"
13587 ></A
13588 >printcap name (G)</DT
13589 ><DD
13590 ><P
13591 >This parameter may be used to override the
13592                 compiled-in default printcap name used by the server (usually <TT
13593 CLASS="FILENAME"
13594 >               /etc/printcap</TT
13595 >). See the discussion of the <A
13596 HREF="#AEN78"
13597 >[printers]</A
13598 > section above for reasons
13599                 why you might want to do this.</P
13600 ><P
13601 >On System V systems that use <B
13602 CLASS="COMMAND"
13603 >lpstat</B
13604 > to
13605                 list available printers you can use <B
13606 CLASS="COMMAND"
13607 >printcap name = lpstat
13608                 </B
13609 > to automatically obtain lists of available printers. This
13610                 is the default for systems that define SYSV at configure time in
13611                 Samba (this includes most System V based systems). If <TT
13612 CLASS="PARAMETER"
13613 ><I
13614 >               printcap name</I
13615 ></TT
13616 > is set to <B
13617 CLASS="COMMAND"
13618 >lpstat</B
13619 > on
13620                 these systems then Samba will launch <B
13621 CLASS="COMMAND"
13622 >lpstat -v</B
13623 > and
13624                 attempt to parse the output to obtain a printer list.</P
13625 ><P
13626 >A minimal printcap file would look something like this:</P
13627 ><P
13628 ><TABLE
13629 BORDER="0"
13630 BGCOLOR="#E0E0E0"
13631 WIDTH="90%"
13632 ><TR
13633 ><TD
13634 ><PRE
13635 CLASS="PROGRAMLISTING"
13636 >               print1|My Printer 1
13637                 print2|My Printer 2
13638                 print3|My Printer 3
13639                 print4|My Printer 4
13640                 print5|My Printer 5
13641                 </PRE
13642 ></TD
13643 ></TR
13644 ></TABLE
13645 ></P
13646 ><P
13647 >where the '|' separates aliases of a printer. The fact
13648                 that the second alias has a space in it gives a hint to Samba
13649                 that it's a comment.</P
13650 ><P
13651 ><EM
13652 >NOTE</EM
13653 >: Under AIX the default printcap
13654                 name is <TT
13655 CLASS="FILENAME"
13656 >/etc/qconfig</TT
13657 >. Samba will assume the
13658                 file is in AIX <TT
13659 CLASS="FILENAME"
13660 >qconfig</TT
13661 > format if the string
13662                 <TT
13663 CLASS="FILENAME"
13664 >qconfig</TT
13665 > appears in the printcap filename.</P
13666 ><P
13667 >Default: <B
13668 CLASS="COMMAND"
13669 >printcap name = /etc/printcap</B
13670 ></P
13671 ><P
13672 >Example: <B
13673 CLASS="COMMAND"
13674 >printcap name = /etc/myprintcap</B
13675 ></P
13676 ></DD
13677 ><DT
13678 ><A
13679 NAME="PRINTERADMIN"
13680 ></A
13681 >printer admin (S)</DT
13682 ><DD
13683 ><P
13684 >This is a list of users that can do anything to
13685                 printers via the remote administration interfaces offered by MS-RPC
13686                 (usually using a NT workstation). Note that the root user always
13687                 has admin rights.</P
13688 ><P
13689 >Default: <B
13690 CLASS="COMMAND"
13691 >printer admin = &#60;empty string&#62;</B
13692 >
13693                 </P
13694 ><P
13695 >Example: <B
13696 CLASS="COMMAND"
13697 >printer admin = admin, @staff</B
13698 ></P
13699 ></DD
13700 ><DT
13701 ><A
13702 NAME="PRINTERDRIVER"
13703 ></A
13704 >printer driver (S)</DT
13705 ><DD
13706 ><P
13707 ><EM
13708 >Note :</EM
13709 >This is a depreciated
13710                 parameter and will be removed in the next major release
13711                 following version 2.2.  Please see the instructions in
13712                 <TT
13713 CLASS="FILENAME"
13714 >PRINTER_DRIVER2.txt</TT
13715 > in the <TT
13716 CLASS="FILENAME"
13717 >docs
13718                 </TT
13719 > of the Samba distribution for more information
13720                 on the new method of loading printer drivers onto a Samba server.
13721                 </P
13722 ><P
13723 >This option allows you to control the string
13724                 that clients receive when they ask the server for the printer driver
13725                 associated with a printer. If you are using Windows95 or Windows NT
13726                 then you can use this to automate the setup of printers on your
13727                 system.</P
13728 ><P
13729 >You need to set this parameter to the exact string (case
13730                 sensitive) that describes the appropriate printer driver for your
13731                 system. If you don't know the exact string to use then you should
13732                 first try with no <A
13733 HREF="#PRINTERDRIVER"
13734 ><TT
13735 CLASS="PARAMETER"
13736 ><I
13737 >               printer driver</I
13738 ></TT
13739 ></A
13740 > option set and the client will
13741                 give you a list of printer drivers. The appropriate strings are
13742                 shown in a scroll box after you have chosen the printer manufacturer.</P
13743 ><P
13744 >See also <A
13745 HREF="#PRINTERDRIVERFILE"
13746 ><TT
13747 CLASS="PARAMETER"
13748 ><I
13749 >printer
13750                 driver file</I
13751 ></TT
13752 ></A
13753 >.</P
13754 ><P
13755 >Example: <B
13756 CLASS="COMMAND"
13757 >printer driver = HP LaserJet 4L</B
13758 ></P
13759 ></DD
13760 ><DT
13761 ><A
13762 NAME="PRINTERDRIVERFILE"
13763 ></A
13764 >printer driver file (G)</DT
13765 ><DD
13766 ><P
13767 ><EM
13768 >Note :</EM
13769 >This is a depreciated
13770                 parameter and will be removed in the next major release
13771                 following version 2.2.  Please see the instructions in
13772                 <TT
13773 CLASS="FILENAME"
13774 >PRINTER_DRIVER2.txt</TT
13775 > in the <TT
13776 CLASS="FILENAME"
13777 >docs
13778                 </TT
13779 > of the Samba distribution for more information
13780                 on the new method of loading printer drivers onto a Samba server.
13781                 </P
13782 ><P
13783 >This parameter tells Samba where the printer driver
13784                 definition file, used when serving drivers to Windows 95 clients, is
13785                 to be found. If this is not set, the default is :</P
13786 ><P
13787 ><TT
13788 CLASS="FILENAME"
13789 ><TT
13790 CLASS="REPLACEABLE"
13791 ><I
13792 >SAMBA_INSTALL_DIRECTORY</I
13793 ></TT
13794 >
13795                 /lib/printers.def</TT
13796 ></P
13797 ><P
13798 >This file is created from Windows 95 <TT
13799 CLASS="FILENAME"
13800 >msprint.inf
13801                 </TT
13802 > files found on the Windows 95 client system. For more
13803                 details on setting up serving of printer drivers to Windows 95
13804                 clients, see the documentation file in the <TT
13805 CLASS="FILENAME"
13806 >docs/</TT
13807 >
13808                 directory, <TT
13809 CLASS="FILENAME"
13810 >PRINTER_DRIVER.txt</TT
13811 >.</P
13812 ><P
13813 >See also <A
13814 HREF="#PRINTERDRIVERLOCATION"
13815 ><TT
13816 CLASS="PARAMETER"
13817 ><I
13818 >               printer driver location</I
13819 ></TT
13820 ></A
13821 >.</P
13822 ><P
13823 >Default: <EM
13824 >None (set in compile).</EM
13825 ></P
13826 ><P
13827 >Example: <B
13828 CLASS="COMMAND"
13829 >printer driver file =
13830                 /usr/local/samba/printers/drivers.def</B
13831 ></P
13832 ></DD
13833 ><DT
13834 ><A
13835 NAME="PRINTERDRIVERLOCATION"
13836 ></A
13837 >printer driver location (S)</DT
13838 ><DD
13839 ><P
13840 ><EM
13841 >Note :</EM
13842 >This is a depreciated
13843                 parameter and will be removed in the next major release
13844                 following version 2.2.  Please see the instructions in
13845                 <TT
13846 CLASS="FILENAME"
13847 >PRINTER_DRIVER2.txt</TT
13848 > in the <TT
13849 CLASS="FILENAME"
13850 >docs
13851                 </TT
13852 > of the Samba distribution for more information
13853                 on the new method of loading printer drivers onto a Samba server.
13854                 </P
13855 ><P
13856 >This parameter tells clients of a particular printer
13857                 share where to find the printer driver files for the automatic
13858                 installation of drivers for Windows 95 machines. If Samba is set up
13859                 to serve printer drivers to Windows 95 machines, this should be set to</P
13860 ><P
13861 ><B
13862 CLASS="COMMAND"
13863 >\\MACHINE\PRINTER$</B
13864 ></P
13865 ><P
13866 >Where MACHINE is the NetBIOS name of your Samba server,
13867                 and PRINTER$ is a share you set up for serving printer driver
13868                 files. For more details on setting this up see the documentation
13869                 file in the <TT
13870 CLASS="FILENAME"
13871 >docs/</TT
13872 > directory, <TT
13873 CLASS="FILENAME"
13874 >               PRINTER_DRIVER.txt</TT
13875 >.</P
13876 ><P
13877 >See also <A
13878 HREF="#PRINTERDRIVERFILE"
13879 ><TT
13880 CLASS="PARAMETER"
13881 ><I
13882 >               printer driver file</I
13883 ></TT
13884 ></A
13885 >.</P
13886 ><P
13887 >Default: <B
13888 CLASS="COMMAND"
13889 >none</B
13890 ></P
13891 ><P
13892 >Example: <B
13893 CLASS="COMMAND"
13894 >printer driver location = \\MACHINE\PRINTER$
13895                 </B
13896 ></P
13897 ></DD
13898 ><DT
13899 ><A
13900 NAME="PRINTERNAME"
13901 ></A
13902 >printer name (S)</DT
13903 ><DD
13904 ><P
13905 >This parameter specifies the name of the printer
13906                 to which print jobs spooled through a printable service will be sent.</P
13907 ><P
13908 >If specified in the [global] section, the printer
13909                 name given will be used for any printable service that does
13910                 not have its own printer name specified.</P
13911 ><P
13912 >Default: <EM
13913 >none (but may be <TT
13914 CLASS="CONSTANT"
13915 >lp</TT
13916 >
13917                 on many systems)</EM
13918 ></P
13919 ><P
13920 >Example: <B
13921 CLASS="COMMAND"
13922 >printer name = laserwriter</B
13923 ></P
13924 ></DD
13925 ><DT
13926 ><A
13927 NAME="PRINTER"
13928 ></A
13929 >printer (S)</DT
13930 ><DD
13931 ><P
13932 >Synonym for <A
13933 HREF="#PRINTERNAME"
13934 ><TT
13935 CLASS="PARAMETER"
13936 ><I
13937 >               printer name</I
13938 ></TT
13939 ></A
13940 >.</P
13941 ></DD
13942 ><DT
13943 ><A
13944 NAME="PRINTING"
13945 ></A
13946 >printing (S)</DT
13947 ><DD
13948 ><P
13949 >This parameters controls how printer status
13950                 information is interpreted on your system. It also affects the
13951                 default values for the <TT
13952 CLASS="PARAMETER"
13953 ><I
13954 >print command</I
13955 ></TT
13956 >,
13957                 <TT
13958 CLASS="PARAMETER"
13959 ><I
13960 >lpq command</I
13961 ></TT
13962 >, <TT
13963 CLASS="PARAMETER"
13964 ><I
13965 >lppause command
13966                 </I
13967 ></TT
13968 >, <TT
13969 CLASS="PARAMETER"
13970 ><I
13971 >lpresume command</I
13972 ></TT
13973 >, and
13974                 <TT
13975 CLASS="PARAMETER"
13976 ><I
13977 >lprm command</I
13978 ></TT
13979 > if specified in the
13980                 [global]f&#62; section.</P
13981 ><P
13982 >Currently eight printing styles are supported. They are
13983                 <TT
13984 CLASS="CONSTANT"
13985 >BSD</TT
13986 >, <TT
13987 CLASS="CONSTANT"
13988 >AIX</TT
13989 >,
13990                 <TT
13991 CLASS="CONSTANT"
13992 >LPRNG</TT
13993 >, <TT
13994 CLASS="CONSTANT"
13995 >PLP</TT
13996 >,
13997                 <TT
13998 CLASS="CONSTANT"
13999 >SYSV</TT
14000 >, <TT
14001 CLASS="CONSTANT"
14002 >HPUX</TT
14003 >,
14004                 <TT
14005 CLASS="CONSTANT"
14006 >QNX</TT
14007 >, <TT
14008 CLASS="CONSTANT"
14009 >SOFTQ</TT
14010 >,
14011                 and <TT
14012 CLASS="CONSTANT"
14013 >CUPS</TT
14014 >.</P
14015 ><P
14016 >To see what the defaults are for the other print
14017                 commands when using the various options use the <A
14018 HREF="testparm.1.html"
14019 TARGET="_top"
14020 >testparm(1)</A
14021 > program.</P
14022 ><P
14023 >This option can be set on a per printer basis</P
14024 ><P
14025 >See also the discussion in the <A
14026 HREF="#AEN78"
14027 >               [printers]</A
14028 > section.</P
14029 ></DD
14030 ><DT
14031 ><A
14032 NAME="PROTOCOL"
14033 ></A
14034 >protocol (G)</DT
14035 ><DD
14036 ><P
14037 >Synonym for <A
14038 HREF="#MAXPROTOCOL"
14039 >               <TT
14040 CLASS="PARAMETER"
14041 ><I
14042 >max protocol</I
14043 ></TT
14044 ></A
14045 >.</P
14046 ></DD
14047 ><DT
14048 ><A
14049 NAME="PUBLIC"
14050 ></A
14051 >public (S)</DT
14052 ><DD
14053 ><P
14054 >Synonym for <A
14055 HREF="#GUESTOK"
14056 ><TT
14057 CLASS="PARAMETER"
14058 ><I
14059 >guest
14060                 ok</I
14061 ></TT
14062 ></A
14063 >.</P
14064 ></DD
14065 ><DT
14066 ><A
14067 NAME="QUEUEPAUSECOMMAND"
14068 ></A
14069 >queuepause command (S)</DT
14070 ><DD
14071 ><P
14072 >This parameter specifies the command to be
14073                 executed on the server host in order to pause the printerqueue.</P
14074 ><P
14075 >This command should be a program or script which takes
14076                 a printer name as its only parameter and stops the printerqueue,
14077                 such that no longer jobs are submitted to the printer.</P
14078 ><P
14079 >This command is not supported by Windows for Workgroups,
14080                 but can be issued from the Printer's window under Windows 95
14081                 and NT.</P
14082 ><P
14083 >If a <TT
14084 CLASS="PARAMETER"
14085 ><I
14086 >%p</I
14087 ></TT
14088 > is given then the printername
14089                 is put in its place. Otherwise it is placed at the end of the command.
14090                 </P
14091 ><P
14092 >Note that it is good practice to include the absolute
14093                 path in the command as the PATH may not be available to the
14094                 server.</P
14095 ><P
14096 >Default: <EM
14097 >depends on the setting of <TT
14098 CLASS="PARAMETER"
14099 ><I
14100 >printing
14101                 </I
14102 ></TT
14103 ></EM
14104 ></P
14105 ><P
14106 >Example: <B
14107 CLASS="COMMAND"
14108 >queuepause command = disable %p</B
14109 ></P
14110 ></DD
14111 ><DT
14112 ><A
14113 NAME="QUEUERESUMECOMMAND"
14114 ></A
14115 >queueresume command (S)</DT
14116 ><DD
14117 ><P
14118 >This parameter specifies the command to be
14119                 executed on the server host in order to resume the printerqueue. It
14120                 is the command to undo the behavior that is caused by the
14121                 previous parameter (<A
14122 HREF="#QUEUEPAUSECOMMAND"
14123 ><TT
14124 CLASS="PARAMETER"
14125 ><I
14126 >               queuepause command</I
14127 ></TT
14128 ></A
14129 >).</P
14130 ><P
14131 >This command should be a program or script which takes
14132                 a printer name as its only parameter and resumes the printerqueue,
14133                 such that queued jobs are resubmitted to the printer.</P
14134 ><P
14135 >This command is not supported by Windows for Workgroups,
14136                 but can be issued from the Printer's window under Windows 95
14137                 and NT.</P
14138 ><P
14139 >If a <TT
14140 CLASS="PARAMETER"
14141 ><I
14142 >%p</I
14143 ></TT
14144 > is given then the printername
14145                 is put in its place. Otherwise it is placed at the end of the
14146                 command.</P
14147 ><P
14148 >Note that it is good practice to include the absolute
14149                 path in the command as the PATH may not be available to the
14150                 server.</P
14151 ><P
14152 >Default: <EM
14153 >depends on the setting of <A
14154 HREF="#PRINTING"
14155 ><TT
14156 CLASS="PARAMETER"
14157 ><I
14158 >printing</I
14159 ></TT
14160 ></A
14161 ></EM
14162 >
14163                 </P
14164 ><P
14165 >Example: <B
14166 CLASS="COMMAND"
14167 >queuepause command = enable %p
14168                 </B
14169 ></P
14170 ></DD
14171 ><DT
14172 ><A
14173 NAME="READBMPX"
14174 ></A
14175 >read bmpx (G)</DT
14176 ><DD
14177 ><P
14178 >This boolean parameter controls whether <A
14179 HREF="smbd.8.html"
14180 TARGET="_top"
14181 >smbd(8)</A
14182 > will support the "Read
14183                 Block Multiplex" SMB. This is now rarely used and defaults to
14184                 <TT
14185 CLASS="CONSTANT"
14186 >no</TT
14187 >. You should never need to set this
14188                 parameter.</P
14189 ><P
14190 >Default: <B
14191 CLASS="COMMAND"
14192 >read bmpx = no</B
14193 ></P
14194 ></DD
14195 ><DT
14196 ><A
14197 NAME="READLIST"
14198 ></A
14199 >read list (S)</DT
14200 ><DD
14201 ><P
14202 >This is a list of users that are given read-only
14203                 access to a service. If the connecting user is in this list then
14204                 they will not be given write access, no matter what the <A
14205 HREF="#WRITEABLE"
14206 ><TT
14207 CLASS="PARAMETER"
14208 ><I
14209 >writeable</I
14210 ></TT
14211 ></A
14212 >
14213                 option is set to. The list can include group names using the
14214                 syntax described in the <A
14215 HREF="#INVALIDUSERS"
14216 ><TT
14217 CLASS="PARAMETER"
14218 ><I
14219 >               invalid users</I
14220 ></TT
14221 ></A
14222 > parameter.</P
14223 ><P
14224 >See also the <A
14225 HREF="#WRITELIST"
14226 ><TT
14227 CLASS="PARAMETER"
14228 ><I
14229 >               write list</I
14230 ></TT
14231 ></A
14232 > parameter and the <A
14233 HREF="#INVALIDUSERS"
14234 ><TT
14235 CLASS="PARAMETER"
14236 ><I
14237 >invalid users</I
14238 ></TT
14239 >
14240                 </A
14241 > parameter.</P
14242 ><P
14243 >Default: <B
14244 CLASS="COMMAND"
14245 >read list = &#60;empty string&#62;</B
14246 ></P
14247 ><P
14248 >Example: <B
14249 CLASS="COMMAND"
14250 >read list = mary, @students</B
14251 ></P
14252 ></DD
14253 ><DT
14254 ><A
14255 NAME="READONLY"
14256 ></A
14257 >read only (S)</DT
14258 ><DD
14259 ><P
14260 >Note that this is an inverted synonym for <A
14261 HREF="#WRITEABLE"
14262 ><TT
14263 CLASS="PARAMETER"
14264 ><I
14265 >writeable</I
14266 ></TT
14267 ></A
14268 >.</P
14269 ></DD
14270 ><DT
14271 ><A
14272 NAME="READRAW"
14273 ></A
14274 >read raw (G)</DT
14275 ><DD
14276 ><P
14277 >This parameter controls whether or not the server
14278                 will support the raw read SMB requests when transferring data
14279                 to clients.</P
14280 ><P
14281 >If enabled, raw reads allow reads of 65535 bytes in
14282                 one packet. This typically provides a major performance benefit.
14283                 </P
14284 ><P
14285 >However, some clients either negotiate the allowable
14286                 block size incorrectly or are incapable of supporting larger block
14287                 sizes, and for these clients you may need to disable raw reads.</P
14288 ><P
14289 >In general this parameter should be viewed as a system tuning
14290                 tool and left severely alone. See also <A
14291 HREF="#WRITERAW"
14292 >               <TT
14293 CLASS="PARAMETER"
14294 ><I
14295 >write raw</I
14296 ></TT
14297 ></A
14298 >.</P
14299 ><P
14300 >Default: <B
14301 CLASS="COMMAND"
14302 >read raw = yes</B
14303 ></P
14304 ></DD
14305 ><DT
14306 ><A
14307 NAME="READSIZE"
14308 ></A
14309 >read size (G)</DT
14310 ><DD
14311 ><P
14312 >The option <TT
14313 CLASS="PARAMETER"
14314 ><I
14315 >read size</I
14316 ></TT
14317 >
14318                 affects the overlap of disk reads/writes with network reads/writes.
14319                 If the amount of data being transferred in several of the SMB
14320                 commands (currently SMBwrite, SMBwriteX and SMBreadbraw) is larger
14321                 than this value then the server begins writing the data before it
14322                 has received the whole packet from the network, or in the case of
14323                 SMBreadbraw, it begins writing to the network before all the data
14324                 has been read from disk.</P
14325 ><P
14326 >This overlapping works best when the speeds of disk and
14327                 network access are similar, having very little effect when the
14328                 speed of one is much greater than the other.</P
14329 ><P
14330 >The default value is 16384, but very little experimentation
14331                 has been done yet to determine the optimal value, and it is likely
14332                 that the best value will vary greatly between systems anyway.
14333                 A value over 65536 is pointless and will cause you to allocate
14334                 memory unnecessarily.</P
14335 ><P
14336 >Default: <B
14337 CLASS="COMMAND"
14338 >read size = 16384</B
14339 ></P
14340 ><P
14341 >Example: <B
14342 CLASS="COMMAND"
14343 >read size = 8192</B
14344 ></P
14345 ></DD
14346 ><DT
14347 ><A
14348 NAME="REMOTEANNOUNCE"
14349 ></A
14350 >remote announce (G)</DT
14351 ><DD
14352 ><P
14353 >This option allows you to setup <A
14354 HREF="nmbd.8.html"
14355 TARGET="_top"
14356 >nmbd(8)</A
14357 > to periodically announce itself
14358                 to arbitrary IP addresses with an arbitrary workgroup name.</P
14359 ><P
14360 >This is useful if you want your Samba server to appear
14361                 in a remote workgroup for which the normal browse propagation
14362                 rules don't work. The remote workgroup can be anywhere that you
14363                 can send IP packets to.</P
14364 ><P
14365 >For example:</P
14366 ><P
14367 ><B
14368 CLASS="COMMAND"
14369 >remote announce = 192.168.2.255/SERVERS
14370                 192.168.4.255/STAFF</B
14371 ></P
14372 ><P
14373 >the above line would cause nmbd to announce itself
14374                 to the two given IP addresses using the given workgroup names.
14375                 If you leave out the workgroup name then the one given in
14376                 the <A
14377 HREF="#WORKGROUP"
14378 ><TT
14379 CLASS="PARAMETER"
14380 ><I
14381 >workgroup</I
14382 ></TT
14383 ></A
14384 >
14385                 parameter is used instead.</P
14386 ><P
14387 >The IP addresses you choose would normally be the broadcast
14388                 addresses of the remote networks, but can also be the IP addresses
14389                 of known browse masters if your network config is that stable.</P
14390 ><P
14391 >See the documentation file <TT
14392 CLASS="FILENAME"
14393 >BROWSING.txt</TT
14394 >
14395                 in the <TT
14396 CLASS="FILENAME"
14397 >docs/</TT
14398 > directory.</P
14399 ><P
14400 >Default: <B
14401 CLASS="COMMAND"
14402 >remote announce = &#60;empty string&#62;
14403                 </B
14404 ></P
14405 ></DD
14406 ><DT
14407 ><A
14408 NAME="REMOTEBROWSESYNC"
14409 ></A
14410 >remote browse sync (G)</DT
14411 ><DD
14412 ><P
14413 >This option allows you to setup <A
14414 HREF="nmbd.8.html"
14415 TARGET="_top"
14416 >nmbd(8)</A
14417 > to periodically request
14418                 synchronization of browse lists with the master browser of a samba
14419                 server that is on a remote segment. This option will allow you to
14420                 gain browse lists for multiple workgroups across routed networks. This
14421                 is done in a manner that does not work with any non-samba servers.</P
14422 ><P
14423 >This is useful if you want your Samba server and all local
14424                 clients to appear in a remote workgroup for which the normal browse
14425                 propagation rules don't work. The remote workgroup can be anywhere
14426                 that you can send IP packets to.</P
14427 ><P
14428 >For example:</P
14429 ><P
14430 ><B
14431 CLASS="COMMAND"
14432 >remote browse sync = 192.168.2.255 192.168.4.255
14433                 </B
14434 ></P
14435 ><P
14436 >the above line would cause <B
14437 CLASS="COMMAND"
14438 >nmbd</B
14439 > to request
14440                 the master browser on the specified subnets or addresses to
14441                 synchronize their browse lists with the local server.</P
14442 ><P
14443 >The IP addresses you choose would normally be the broadcast
14444                 addresses of the remote networks, but can also be the IP addresses
14445                 of known browse masters if your network config is that stable. If
14446                 a machine IP address is given Samba makes NO attempt to validate
14447                 that the remote machine is available, is listening, nor that it
14448                 is in fact the browse master on it's segment.</P
14449 ><P
14450 >Default: <B
14451 CLASS="COMMAND"
14452 >remote browse sync = &#60;empty string&#62;
14453                 </B
14454 ></P
14455 ></DD
14456 ><DT
14457 ><A
14458 NAME="RESTRICTACLWITHMASK"
14459 ></A
14460 >restrict acl with mask (S)</DT
14461 ><DD
14462 ><P
14463 >This is a boolean parameter.  If set to false (default), then
14464                 Creation of files with access control lists (ACLS) and modification of ACLs
14465                 using the Windows NT/2000 ACL editor will be applied directly to the file
14466                 or directory.</P
14467 ><P
14468 >If set to True, then all requests to set an ACL on a file will have the
14469                 parameters <A
14470 HREF="#CREATEMASK"
14471 ><TT
14472 CLASS="PARAMETER"
14473 ><I
14474 >create mask</I
14475 ></TT
14476 ></A
14477 >,
14478                 <A
14479 HREF="#FORCECREATEMODE"
14480 ><TT
14481 CLASS="PARAMETER"
14482 ><I
14483 >force create mode</I
14484 ></TT
14485 ></A
14486 >
14487                 applied before setting the ACL, and all requests to set an ACL on a directory will
14488                 have the parameters <A
14489 HREF="#DIRECTORYMASK"
14490 ><TT
14491 CLASS="PARAMETER"
14492 ><I
14493 >directory
14494                 mask</I
14495 ></TT
14496 ></A
14497 >, <A
14498 HREF="#FORCEDIRECTORYMODE"
14499 ><TT
14500 CLASS="PARAMETER"
14501 ><I
14502 >force
14503                 directory mode</I
14504 ></TT
14505 ></A
14506 > applied before setting the ACL.
14507                 </P
14508 ><P
14509 >See also <A
14510 HREF="#CREATEMASK"
14511 ><TT
14512 CLASS="PARAMETER"
14513 ><I
14514 >create mask</I
14515 ></TT
14516 ></A
14517 >,
14518                 <A
14519 HREF="#FORCECREATEMODE"
14520 ><TT
14521 CLASS="PARAMETER"
14522 ><I
14523 >force create mode</I
14524 ></TT
14525 ></A
14526 >,
14527                 <A
14528 HREF="#DIRECTORYMASK"
14529 ><TT
14530 CLASS="PARAMETER"
14531 ><I
14532 >directory mask</I
14533 ></TT
14534 ></A
14535 >,
14536                 <A
14537 HREF="#FORCEDIRECTORYMODE"
14538 ><TT
14539 CLASS="PARAMETER"
14540 ><I
14541 >force directory mode</I
14542 ></TT
14543 ></A
14544 >
14545                 </P
14546 ><P
14547 >Default: <B
14548 CLASS="COMMAND"
14549 >restrict acl with mask = no</B
14550 ></P
14551 ></DD
14552 ><DT
14553 ><A
14554 NAME="RESTRICTANONYMOUS"
14555 ></A
14556 >restrict anonymous (G)</DT
14557 ><DD
14558 ><P
14559 >This is a boolean parameter.  If it is true, then
14560                 anonymous access to the server will be restricted, namely in the
14561                 case where the server is expecting the client to send a username,
14562                 but it doesn't.  Setting it to true will force these anonymous
14563                 connections to be denied, and the client will be required to always
14564                 supply a username and password when connecting. Use of this parameter
14565                 is only recommended for homogeneous NT client environments.</P
14566 ><P
14567 >This parameter makes the use of macro expansions that rely
14568                 on the username (%U, %G, etc) consistent.  NT 4.0
14569                 likes to use anonymous connections when refreshing the share list,
14570                 and this is a way to work around that.</P
14571 ><P
14572 >When restrict anonymous is true, all anonymous connections
14573                 are denied no matter what they are for.  This can effect the ability
14574                 of a machine to access the samba Primary Domain Controller to revalidate
14575                 it's machine account after someone else has logged on the client
14576                 interactively.  The NT client will display a message saying that
14577                 the machine's account in  the domain doesn't exist or the password is
14578                 bad.  The best way to deal  with this is to reboot NT client machines
14579                 between interactive logons,  using "Shutdown and Restart", rather
14580                 than "Close all programs and logon as a different user".</P
14581 ><P
14582 >Default: <B
14583 CLASS="COMMAND"
14584 >restrict anonymous = no</B
14585 ></P
14586 ></DD
14587 ><DT
14588 ><A
14589 NAME="ROOT"
14590 ></A
14591 >root (G)</DT
14592 ><DD
14593 ><P
14594 >Synonym for <A
14595 HREF="#ROOTDIRECTORY"
14596 >               <TT
14597 CLASS="PARAMETER"
14598 ><I
14599 >root directory"</I
14600 ></TT
14601 ></A
14602 >.</P
14603 ></DD
14604 ><DT
14605 ><A
14606 NAME="ROOTDIR"
14607 ></A
14608 >root dir (G)</DT
14609 ><DD
14610 ><P
14611 >Synonym for <A
14612 HREF="#ROOTDIRECTORY"
14613 >               <TT
14614 CLASS="PARAMETER"
14615 ><I
14616 >root directory"</I
14617 ></TT
14618 ></A
14619 >.</P
14620 ></DD
14621 ><DT
14622 ><A
14623 NAME="ROOTDIRECTORY"
14624 ></A
14625 >root directory (G)</DT
14626 ><DD
14627 ><P
14628 >The server will <B
14629 CLASS="COMMAND"
14630 >chroot()</B
14631 > (i.e.
14632                 Change it's root directory) to this directory on startup. This is
14633                 not strictly necessary for secure operation. Even without it the
14634                 server will deny access to files not in one of the service entries.
14635                 It may also check for, and deny access to, soft links to other
14636                 parts of the filesystem, or attempts to use ".." in file names
14637                 to access other directories (depending on the setting of the <A
14638 HREF="#WIDELINKS"
14639 ><TT
14640 CLASS="PARAMETER"
14641 ><I
14642 >wide links</I
14643 ></TT
14644 ></A
14645 >
14646                 parameter).</P
14647 ><P
14648 >Adding a <TT
14649 CLASS="PARAMETER"
14650 ><I
14651 >root directory</I
14652 ></TT
14653 > entry other
14654                 than "/" adds an extra level of security, but at a price. It
14655                 absolutely ensures that no access is given to files not in the
14656                 sub-tree specified in the <TT
14657 CLASS="PARAMETER"
14658 ><I
14659 >root directory</I
14660 ></TT
14661 >
14662                 option, <EM
14663 >including</EM
14664 > some files needed for
14665                 complete operation of the server. To maintain full operability
14666                 of the server you will need to mirror some system files
14667                 into the <TT
14668 CLASS="PARAMETER"
14669 ><I
14670 >root directory</I
14671 ></TT
14672 > tree. In particular
14673                 you will need to mirror <TT
14674 CLASS="FILENAME"
14675 >/etc/passwd</TT
14676 > (or a
14677                 subset of it), and any binaries or configuration files needed for
14678                 printing (if required). The set of files that must be mirrored is
14679                 operating system dependent.</P
14680 ><P
14681 >Default: <B
14682 CLASS="COMMAND"
14683 >root directory = /</B
14684 ></P
14685 ><P
14686 >Example: <B
14687 CLASS="COMMAND"
14688 >root directory = /homes/smb</B
14689 ></P
14690 ></DD
14691 ><DT
14692 ><A
14693 NAME="ROOTPOSTEXEC"
14694 ></A
14695 >root postexec (S)</DT
14696 ><DD
14697 ><P
14698 >This is the same as the <TT
14699 CLASS="PARAMETER"
14700 ><I
14701 >postexec</I
14702 ></TT
14703 >
14704                 parameter except that the command is run as root. This
14705                 is useful for unmounting filesystems
14706                 (such as cdroms) after a connection is closed.</P
14707 ><P
14708 >See also <A
14709 HREF="#POSTEXEC"
14710 ><TT
14711 CLASS="PARAMETER"
14712 ><I
14713 >               postexec</I
14714 ></TT
14715 ></A
14716 >.</P
14717 ><P
14718 >Default: <B
14719 CLASS="COMMAND"
14720 >root postexec = &#60;empty string&#62;
14721                 </B
14722 ></P
14723 ></DD
14724 ><DT
14725 ><A
14726 NAME="ROOTPREEXEC"
14727 ></A
14728 >root preexec (S)</DT
14729 ><DD
14730 ><P
14731 >This is the same as the <TT
14732 CLASS="PARAMETER"
14733 ><I
14734 >preexec</I
14735 ></TT
14736 >
14737                 parameter except that the command is run as root. This
14738                 is useful for mounting filesystems (such as cdroms) after a
14739                 connection is closed.</P
14740 ><P
14741 >See also <A
14742 HREF="#PREEXEC"
14743 ><TT
14744 CLASS="PARAMETER"
14745 ><I
14746 >               preexec</I
14747 ></TT
14748 ></A
14749 > and <A
14750 HREF="#PREEXECCLOSE"
14751 >               <TT
14752 CLASS="PARAMETER"
14753 ><I
14754 >preexec close</I
14755 ></TT
14756 ></A
14757 >.</P
14758 ><P
14759 >Default: <B
14760 CLASS="COMMAND"
14761 >root preexec = &#60;empty string&#62;
14762                 </B
14763 ></P
14764 ></DD
14765 ><DT
14766 ><A
14767 NAME="ROOTPREEXECCLOSE"
14768 ></A
14769 >root preexec close (S)</DT
14770 ><DD
14771 ><P
14772 >This is the same as the <TT
14773 CLASS="PARAMETER"
14774 ><I
14775 >preexec close
14776                 </I
14777 ></TT
14778 > parameter except that the command is run as root.</P
14779 ><P
14780 >See also <A
14781 HREF="#PREEXEC"
14782 ><TT
14783 CLASS="PARAMETER"
14784 ><I
14785 >               preexec</I
14786 ></TT
14787 ></A
14788 > and <A
14789 HREF="#PREEXECCLOSE"
14790 >               <TT
14791 CLASS="PARAMETER"
14792 ><I
14793 >preexec close</I
14794 ></TT
14795 ></A
14796 >.</P
14797 ><P
14798 >Default: <B
14799 CLASS="COMMAND"
14800 >root preexec close = no</B
14801 ></P
14802 ></DD
14803 ><DT
14804 ><A
14805 NAME="SECURITY"
14806 ></A
14807 >security (G)</DT
14808 ><DD
14809 ><P
14810 >This option affects how clients respond to
14811                 Samba and is one of the most important settings in the <TT
14812 CLASS="FILENAME"
14813 >               smb.conf</TT
14814 > file.</P
14815 ><P
14816 >The option sets the "security mode bit" in replies to
14817                 protocol negotiations with <A
14818 HREF="smbd.8.html"
14819 TARGET="_top"
14820 >smbd(8)
14821                 </A
14822 > to turn share level security on or off. Clients decide
14823                 based on this bit whether (and how) to transfer user and password
14824                 information to the server.</P
14825 ><P
14826 >The default is <B
14827 CLASS="COMMAND"
14828 >security = user</B
14829 >, as this is
14830                 the most common setting needed when talking to Windows 98 and
14831                 Windows NT.</P
14832 ><P
14833 >The alternatives are <B
14834 CLASS="COMMAND"
14835 >security = share</B
14836 >,
14837                 <B
14838 CLASS="COMMAND"
14839 >security = server</B
14840 > or <B
14841 CLASS="COMMAND"
14842 >security=domain
14843                 </B
14844 >.</P
14845 ><P
14846 >In versions of Samba prior to 2..0, the default was
14847                 <B
14848 CLASS="COMMAND"
14849 >security = share</B
14850 > mainly because that was
14851                 the only option at one stage.</P
14852 ><P
14853 >There is a bug in WfWg that has relevance to this
14854                 setting. When in user or server level security a WfWg client
14855                 will totally ignore the password you type in the "connect
14856                 drive" dialog box. This makes it very difficult (if not impossible)
14857                 to connect to a Samba service as anyone except the user that
14858                 you are logged into WfWg as.</P
14859 ><P
14860 >If your PCs use usernames that are the same as their
14861                 usernames on the UNIX machine then you will want to use
14862                 <B
14863 CLASS="COMMAND"
14864 >security = user</B
14865 >. If you mostly use usernames
14866                 that don't exist on the UNIX box then use <B
14867 CLASS="COMMAND"
14868 >security =
14869                 share</B
14870 >.</P
14871 ><P
14872 >You should also use <B
14873 CLASS="COMMAND"
14874 >security = share</B
14875 > if you
14876                 want to mainly setup shares without a password (guest shares). This
14877                 is commonly used for a shared printer server. It is more difficult
14878                 to setup guest shares with <B
14879 CLASS="COMMAND"
14880 >security = user</B
14881 >, see
14882                 the <A
14883 HREF="#MAPTOGUEST"
14884 ><TT
14885 CLASS="PARAMETER"
14886 ><I
14887 >map to guest</I
14888 ></TT
14889 >
14890                 </A
14891 >parameter for details.</P
14892 ><P
14893 >It is possible to use <B
14894 CLASS="COMMAND"
14895 >smbd</B
14896 > in a <EM
14897 >               hybrid mode</EM
14898 > where it is offers both user and share
14899                 level security under different <A
14900 HREF="#NETBIOSALIASES"
14901 >               <TT
14902 CLASS="PARAMETER"
14903 ><I
14904 >NetBIOS aliases</I
14905 ></TT
14906 ></A
14907 >. </P
14908 ><P
14909 >The different settings will now be explained.</P
14910 ><P
14911 ><A
14912 NAME="SECURITYEQUALSSHARE"
14913 ></A
14914 ><EM
14915 >SECURITY = SHARE
14916                 </EM
14917 ></P
14918 ><P
14919 >When clients connect to a share level security server then
14920                 need not log onto the server with a valid username and password before
14921                 attempting to connect to a shared resource (although modern clients
14922                 such as Windows 95/98 and Windows NT will send a logon request with
14923                 a username but no password when talking to a <B
14924 CLASS="COMMAND"
14925 >security = share
14926                 </B
14927 > server). Instead, the clients send authentication information
14928                 (passwords) on a per-share basis, at the time they attempt to connect
14929                 to that share.</P
14930 ><P
14931 >Note that <B
14932 CLASS="COMMAND"
14933 >smbd</B
14934 > <EM
14935 >ALWAYS</EM
14936 >
14937                 uses a valid UNIX user to act on behalf of the client, even in
14938                 <B
14939 CLASS="COMMAND"
14940 >security = share</B
14941 > level security.</P
14942 ><P
14943 >As clients are not required to send a username to the server
14944                 in share level security, <B
14945 CLASS="COMMAND"
14946 >smbd</B
14947 > uses several
14948                 techniques to determine the correct UNIX user to use on behalf
14949                 of the client.</P
14950 ><P
14951 >A list of possible UNIX usernames to match with the given
14952                 client password is constructed using the following methods :</P
14953 ><P
14954 ></P
14955 ><UL
14956 ><LI
14957 ><P
14958 >If the <A
14959 HREF="#GUESTONLY"
14960 ><TT
14961 CLASS="PARAMETER"
14962 ><I
14963 >guest
14964                         only</I
14965 ></TT
14966 ></A
14967 > parameter is set, then all the other
14968                         stages are missed and only the <A
14969 HREF="#GUESTACCOUNT"
14970 >                       <TT
14971 CLASS="PARAMETER"
14972 ><I
14973 >guest account</I
14974 ></TT
14975 ></A
14976 > username is checked.
14977                         </P
14978 ></LI
14979 ><LI
14980 ><P
14981 >Is a username is sent with the share connection
14982                         request, then this username (after mapping - see <A
14983 HREF="#USERNAMEMAP"
14984 ><TT
14985 CLASS="PARAMETER"
14986 ><I
14987 >username map</I
14988 ></TT
14989 ></A
14990 >),
14991                         is added as a potential username.</P
14992 ></LI
14993 ><LI
14994 ><P
14995 >If the client did a previous <EM
14996 >logon
14997                         </EM
14998 > request (the SessionSetup SMB call) then the
14999                         username sent in this SMB will be added as a potential username.
15000                         </P
15001 ></LI
15002 ><LI
15003 ><P
15004 >The name of the service the client requested is
15005                         added as a potential username.</P
15006 ></LI
15007 ><LI
15008 ><P
15009 >The NetBIOS name of the client is added to
15010                         the list as a potential username.</P
15011 ></LI
15012 ><LI
15013 ><P
15014 >Any users on the <A
15015 HREF="#USER"
15016 ><TT
15017 CLASS="PARAMETER"
15018 ><I
15019 >                       user</I
15020 ></TT
15021 ></A
15022 > list are added as potential usernames.
15023                         </P
15024 ></LI
15025 ></UL
15026 ><P
15027 >If the <TT
15028 CLASS="PARAMETER"
15029 ><I
15030 >guest only</I
15031 ></TT
15032 > parameter is
15033                 not set, then this list is then tried with the supplied password.
15034                 The first user for whom the password matches will be used as the
15035                 UNIX user.</P
15036 ><P
15037 >If the <TT
15038 CLASS="PARAMETER"
15039 ><I
15040 >guest only</I
15041 ></TT
15042 > parameter is
15043                 set, or no username can be determined then if the share is marked
15044                 as available to the <TT
15045 CLASS="PARAMETER"
15046 ><I
15047 >guest account</I
15048 ></TT
15049 >, then this
15050                 guest user will be used, otherwise access is denied.</P
15051 ><P
15052 >Note that it can be <EM
15053 >very</EM
15054 > confusing
15055                 in share-level security as to which UNIX username will eventually
15056                 be used in granting access.</P
15057 ><P
15058 >See also the section <A
15059 HREF="#AEN234"
15060 >               NOTE ABOUT USERNAME/PASSWORD VALIDATION</A
15061 >.</P
15062 ><P
15063 ><A
15064 NAME="SECURITYEQUALSUSER"
15065 ></A
15066 ><EM
15067 >SECURIYT = USER
15068                 </EM
15069 ></P
15070 ><P
15071 >This is the default security setting in Samba 2.2.
15072                 With user-level security a client must first "log=on" with a
15073                 valid username and password (which can be mapped using the <A
15074 HREF="#USERNAMEMAP"
15075 ><TT
15076 CLASS="PARAMETER"
15077 ><I
15078 >username map</I
15079 ></TT
15080 ></A
15081 >
15082                 parameter). Encrypted passwords (see the <A
15083 HREF="#ENCRYPTPASSWORDS"
15084 >               <TT
15085 CLASS="PARAMETER"
15086 ><I
15087 >encrypted passwords</I
15088 ></TT
15089 ></A
15090 > parameter) can also
15091                 be used in this security mode. Parameters such as <A
15092 HREF="#USER"
15093 >               <TT
15094 CLASS="PARAMETER"
15095 ><I
15096 >user</I
15097 ></TT
15098 ></A
15099 > and <A
15100 HREF="#GUESTONLY"
15101 >               <TT
15102 CLASS="PARAMETER"
15103 ><I
15104 >guest only</I
15105 ></TT
15106 ></A
15107 > if set        are then applied and
15108                 may change the UNIX user to use on this connection, but only after
15109                 the user has been successfully authenticated.</P
15110 ><P
15111 ><EM
15112 >Note</EM
15113 > that the name of the resource being
15114                 requested is <EM
15115 >not</EM
15116 > sent to the server until after
15117                 the server has successfully authenticated the client. This is why
15118                 guest shares don't work in user level security without allowing
15119                 the server to automatically map unknown users into the <A
15120 HREF="#GUESTACCOUNT"
15121 ><TT
15122 CLASS="PARAMETER"
15123 ><I
15124 >guest account</I
15125 ></TT
15126 ></A
15127 >.
15128                 See the <A
15129 HREF="#MAPTOGUEST"
15130 ><TT
15131 CLASS="PARAMETER"
15132 ><I
15133 >map to guest</I
15134 ></TT
15135 >
15136                 </A
15137 > parameter for details on doing this.</P
15138 ><P
15139 >See also the section <A
15140 HREF="#AEN234"
15141 >               NOTE ABOUT USERNAME/PASSWORD VALIDATION</A
15142 >.</P
15143 ><P
15144 ><A
15145 NAME="SECURITYEQUALSSERVER"
15146 ></A
15147 ><EM
15148 >SECURITY = SERVER
15149                 </EM
15150 ></P
15151 ><P
15152 >In this mode Samba will try to validate the username/password
15153                 by passing it to another SMB server, such as an NT box. If this
15154                 fails it will revert to <B
15155 CLASS="COMMAND"
15156 >security = user</B
15157 >, but note
15158                 that if encrypted passwords have been negotiated then Samba cannot
15159                 revert back to checking the UNIX password file, it must have a valid
15160                 <TT
15161 CLASS="FILENAME"
15162 >smbpasswd</TT
15163 > file to check users against. See the
15164                 documentation file in the <TT
15165 CLASS="FILENAME"
15166 >docs/</TT
15167 > directory
15168                 <TT
15169 CLASS="FILENAME"
15170 >ENCRYPTION.txt</TT
15171 > for details on how to set this
15172                 up.</P
15173 ><P
15174 ><EM
15175 >Note</EM
15176 > that from the clients point of
15177                 view <B
15178 CLASS="COMMAND"
15179 >security = server</B
15180 > is the same as <B
15181 CLASS="COMMAND"
15182 >               security = user</B
15183 >.  It only affects how the server deals
15184                 with the authentication, it does not in any way affect what the
15185                 client sees.</P
15186 ><P
15187 ><EM
15188 >Note</EM
15189 > that the name of the resource being
15190                 requested is <EM
15191 >not</EM
15192 > sent to the server until after
15193                 the server has successfully authenticated the client. This is why
15194                 guest shares don't work in user level security without allowing
15195                 the server to automatically map unknown users into the <A
15196 HREF="#GUESTACCOUNT"
15197 ><TT
15198 CLASS="PARAMETER"
15199 ><I
15200 >guest account</I
15201 ></TT
15202 ></A
15203 >.
15204                 See the <A
15205 HREF="#MAPTOGUEST"
15206 ><TT
15207 CLASS="PARAMETER"
15208 ><I
15209 >map to guest</I
15210 ></TT
15211 >
15212                 </A
15213 > parameter for details on doing this.</P
15214 ><P
15215 >See also the section <A
15216 HREF="#AEN234"
15217 >               NOTE ABOUT USERNAME/PASSWORD VALIDATION</A
15218 >.</P
15219 ><P
15220 >See also the <A
15221 HREF="#PASSWORDSERVER"
15222 ><TT
15223 CLASS="PARAMETER"
15224 ><I
15225 >password
15226                 server</I
15227 ></TT
15228 ></A
15229 > parameter and the <A
15230 HREF="#ENCRYPTPASSWORDS"
15231 ><TT
15232 CLASS="PARAMETER"
15233 ><I
15234 >encrypted passwords</I
15235 ></TT
15236 >
15237                 </A
15238 > parameter.</P
15239 ><P
15240 ><A
15241 NAME="SECURITYEQUALSDOMAIN"
15242 ></A
15243 ><EM
15244 >SECURITY = DOMAIN
15245                 </EM
15246 ></P
15247 ><P
15248 >This mode will only work correctly if <A
15249 HREF="smbpasswd.8.html"
15250 TARGET="_top"
15251 >smbpasswd(8)</A
15252 > has been used to add this
15253                 machine into a Windows NT Domain. It expects the <A
15254 HREF="#ENCRYPTPASSWORDS"
15255 ><TT
15256 CLASS="PARAMETER"
15257 ><I
15258 >encrypted passwords</I
15259 ></TT
15260 >
15261                 </A
15262 > parameter to be set to <TT
15263 CLASS="CONSTANT"
15264 >true</TT
15265 >. In this
15266                 mode Samba will try to validate the username/password by passing
15267                 it to a Windows NT Primary or Backup Domain Controller, in exactly
15268                 the same way that a Windows NT Server would do.</P
15269 ><P
15270 ><EM
15271 >Note</EM
15272 > that a valid UNIX user must still
15273                 exist as well as the account on the Domain Controller to allow
15274                 Samba to have a valid UNIX account to map file access to.</P
15275 ><P
15276 ><EM
15277 >Note</EM
15278 > that from the clients point
15279                 of view <B
15280 CLASS="COMMAND"
15281 >security = domain</B
15282 > is the same as <B
15283 CLASS="COMMAND"
15284 >security = user
15285                 </B
15286 >. It only affects how the server deals with the authentication,
15287                 it does not in any way affect what the client sees.</P
15288 ><P
15289 ><EM
15290 >Note</EM
15291 > that the name of the resource being
15292                 requested is <EM
15293 >not</EM
15294 > sent to the server until after
15295                 the server has successfully authenticated the client. This is why
15296                 guest shares don't work in user level security without allowing
15297                 the server to automatically map unknown users into the <A
15298 HREF="#GUESTACCOUNT"
15299 ><TT
15300 CLASS="PARAMETER"
15301 ><I
15302 >guest account</I
15303 ></TT
15304 ></A
15305 >.
15306                 See the <A
15307 HREF="#MAPTOGUEST"
15308 ><TT
15309 CLASS="PARAMETER"
15310 ><I
15311 >map to guest</I
15312 ></TT
15313 >
15314                 </A
15315 > parameter for details on doing this.</P
15316 ><P
15317 ><EM
15318 >BUG:</EM
15319 > There is currently a bug in the
15320                 implementation of <B
15321 CLASS="COMMAND"
15322 >security = domain</B
15323 > with respect
15324                 to multi-byte character set usernames. The communication with a
15325                 Domain Controller must be done in UNICODE and Samba currently
15326                 does not widen multi-byte user names to UNICODE correctly, thus
15327                 a multi-byte username will not be recognized correctly at the
15328                 Domain Controller. This issue will be addressed in a future release.</P
15329 ><P
15330 >See also the section <A
15331 HREF="#AEN234"
15332 >               NOTE ABOUT USERNAME/PASSWORD VALIDATION</A
15333 >.</P
15334 ><P
15335 >See also the <A
15336 HREF="#PASSWORDSERVER"
15337 ><TT
15338 CLASS="PARAMETER"
15339 ><I
15340 >password
15341                 server</I
15342 ></TT
15343 ></A
15344 > parameter and the <A
15345 HREF="#ENCRYPTPASSWORDS"
15346 ><TT
15347 CLASS="PARAMETER"
15348 ><I
15349 >encrypted passwords</I
15350 ></TT
15351 >
15352                 </A
15353 > parameter.</P
15354 ><P
15355 >Default: <B
15356 CLASS="COMMAND"
15357 >security = USER</B
15358 ></P
15359 ><P
15360 >Example: <B
15361 CLASS="COMMAND"
15362 >security = DOMAIN</B
15363 ></P
15364 ></DD
15365 ><DT
15366 ><A
15367 NAME="SECURITYMASK"
15368 ></A
15369 >security mask (S)</DT
15370 ><DD
15371 ><P
15372 >This parameter controls what UNIX permission
15373                 bits can be modified when a Windows NT client is manipulating
15374                 the UNIX permission on a file using the native NT security
15375                 dialog box.</P
15376 ><P
15377 >This parameter is applied as a mask (AND'ed with) to
15378                 the changed permission bits, thus preventing any bits not in
15379                 this mask from being modified. Essentially, zero bits in this
15380                 mask may be treated as a set of bits the user is not allowed
15381                 to change.</P
15382 ><P
15383 >If not set explicitly this parameter is 0777, allowing
15384                 a user to modify all the user/group/world permissions on a file.
15385                 </P
15386 ><P
15387 ><EM
15388 >Note</EM
15389 > that users who can access the
15390                 Samba server through other means can easily bypass this
15391                 restriction, so it is primarily useful for standalone
15392                 "appliance" systems.  Administrators of most normal systems will
15393                 probably want to leave it set to 0777.</P
15394 ><P
15395 >See also the <A
15396 HREF="#FORCEDIRECTORYSECURITYMODE"
15397 >               <TT
15398 CLASS="PARAMETER"
15399 ><I
15400 >force directory security mode</I
15401 ></TT
15402 ></A
15403 >,
15404                 <A
15405 HREF="#DIRECTORYSECURITYMASK"
15406 ><TT
15407 CLASS="PARAMETER"
15408 ><I
15409 >directory
15410                 security mask</I
15411 ></TT
15412 ></A
15413 >, <A
15414 HREF="#FORCESECURITYMODE"
15415 >               <TT
15416 CLASS="PARAMETER"
15417 ><I
15418 >force security mode</I
15419 ></TT
15420 ></A
15421 > parameters.</P
15422 ><P
15423 >Default: <B
15424 CLASS="COMMAND"
15425 >security mask = 0777</B
15426 ></P
15427 ><P
15428 >Example: <B
15429 CLASS="COMMAND"
15430 >security mask = 0770</B
15431 ></P
15432 ></DD
15433 ><DT
15434 ><A
15435 NAME="SERVERSTRING"
15436 ></A
15437 >server string (G)</DT
15438 ><DD
15439 ><P
15440 >This controls what string will show up in the
15441                 printer comment box in print manager and next to the IPC connection
15442                 in <B
15443 CLASS="COMMAND"
15444 >net view"</B
15445 >. It can be any string that you wish
15446                 to show to your users.</P
15447 ><P
15448 >It also sets what will appear in browse lists next
15449                 to the machine name.</P
15450 ><P
15451 >A <TT
15452 CLASS="PARAMETER"
15453 ><I
15454 >%v</I
15455 ></TT
15456 > will be replaced with the Samba
15457                 version number.</P
15458 ><P
15459 >A <TT
15460 CLASS="PARAMETER"
15461 ><I
15462 >%h</I
15463 ></TT
15464 > will be replaced with the
15465                 hostname.</P
15466 ><P
15467 >Default: <B
15468 CLASS="COMMAND"
15469 >server string = Samba %v</B
15470 ></P
15471 ><P
15472 >Example: <B
15473 CLASS="COMMAND"
15474 >server string = University of GNUs Samba
15475                 Server</B
15476 ></P
15477 ></DD
15478 ><DT
15479 ><A
15480 NAME="SETDIRECTORY"
15481 ></A
15482 >set directory (S)</DT
15483 ><DD
15484 ><P
15485 >If <B
15486 CLASS="COMMAND"
15487 >set directory = no</B
15488 >, then
15489                 users of the service may not use the setdir command to change
15490                 directory.</P
15491 ><P
15492 >The <B
15493 CLASS="COMMAND"
15494 >setdir</B
15495 > command is only implemented
15496                 in the Digital Pathworks client. See the Pathworks documentation
15497                 for details.</P
15498 ><P
15499 >Default: <B
15500 CLASS="COMMAND"
15501 >set directory = no</B
15502 ></P
15503 ></DD
15504 ><DT
15505 ><A
15506 NAME="SHAREMODES"
15507 ></A
15508 >share modes (S)</DT
15509 ><DD
15510 ><P
15511 >This enables or disables the honoring of
15512                 the <TT
15513 CLASS="PARAMETER"
15514 ><I
15515 >share modes</I
15516 ></TT
15517 > during a file open. These
15518                 modes are used by clients to gain exclusive read or write access
15519                 to a file.</P
15520 ><P
15521 >These open modes are not directly supported by UNIX, so
15522                 they are simulated using shared memory, or lock files if your
15523                 UNIX doesn't support shared memory (almost all do).</P
15524 ><P
15525 >The share modes that are enabled by this option are
15526                 <TT
15527 CLASS="CONSTANT"
15528 >DENY_DOS</TT
15529 >, <TT
15530 CLASS="CONSTANT"
15531 >DENY_ALL</TT
15532 >,
15533                 <TT
15534 CLASS="CONSTANT"
15535 >DENY_READ</TT
15536 >, <TT
15537 CLASS="CONSTANT"
15538 >DENY_WRITE</TT
15539 >,
15540                 <TT
15541 CLASS="CONSTANT"
15542 >DENY_NONE</TT
15543 > and <TT
15544 CLASS="CONSTANT"
15545 >DENY_FCB</TT
15546 >.
15547                 </P
15548 ><P
15549 >This option gives full share compatibility and enabled
15550                 by default.</P
15551 ><P
15552 >You should <EM
15553 >NEVER</EM
15554 > turn this parameter
15555                 off as many Windows applications will break if you do so.</P
15556 ><P
15557 >Default: <B
15558 CLASS="COMMAND"
15559 >share modes = yes</B
15560 ></P
15561 ></DD
15562 ><DT
15563 ><A
15564 NAME="SHORTPRESERVECASE"
15565 ></A
15566 >short preserve case (S)</DT
15567 ><DD
15568 ><P
15569 >This boolean parameter controls if new files
15570                 which conform to 8.3 syntax, that is all in upper case and of
15571                 suitable length, are created upper case, or if they are forced
15572                 to be the <A
15573 HREF="#DEFAULTCASE"
15574 ><TT
15575 CLASS="PARAMETER"
15576 ><I
15577 >default case
15578                 </I
15579 ></TT
15580 ></A
15581 >. This  option can be use with <A
15582 HREF="#PRESERVECASE"
15583 ><B
15584 CLASS="COMMAND"
15585 >preserve case = yes</B
15586 >
15587                 </A
15588 > to permit long filenames to retain their case, while short
15589                 names are lowered. </P
15590 ><P
15591 >See the section on <A
15592 HREF="#AEN201"
15593 >               NAME MANGLING</A
15594 >.</P
15595 ><P
15596 >Default: <B
15597 CLASS="COMMAND"
15598 >short preserve case = yes</B
15599 ></P
15600 ></DD
15601 ><DT
15602 ><A
15603 NAME="SHOWADDPRINTERWIZARD"
15604 ></A
15605 >show add printer wizard (G)</DT
15606 ><DD
15607 ><P
15608 >With the introduction of MS-RPC based printing support
15609                 for Windows NT/2000 client in Samba 2.2, a "Printers..." folder will
15610                 appear on Samba hosts in the share listing.  Normally this folder will
15611                 contain an icon for the MS Add Printer Wizard (APW).  However, it is
15612                 possible to disable this feature regardless of the level of privilege
15613                 of the connected user.</P
15614 ><P
15615 >Under normal circumstances, the Windows NT/2000 client will
15616                 open a handle on the printer server with OpenPrinterEx() asking for
15617                 Administrator privileges.  If the user does not have administrative
15618                 access on the print server (i.e is not root or a member of the
15619                 <TT
15620 CLASS="PARAMETER"
15621 ><I
15622 >printer admin</I
15623 ></TT
15624 > group), the OpenPrinterEx()
15625                 call fails and the clients another open call with a request for
15626                 a lower privilege level.  This should succeed, however the APW
15627                 icon will not be displayed.</P
15628 ><P
15629 >Disabling the <TT
15630 CLASS="PARAMETER"
15631 ><I
15632 >show add printer wizard</I
15633 ></TT
15634 >
15635                 parameter will always cause the OpenPrinterEx() on the server
15636                 to fail.  Thus the APW icon will never be displayed. <EM
15637 >               Note :</EM
15638 >This does not prevent the same user from having
15639                 administrative privilege on an individual printer.</P
15640 ><P
15641 >See also <A
15642 HREF="#ADDPRINTERCOMMAND"
15643 ><TT
15644 CLASS="PARAMETER"
15645 ><I
15646 >addprinter
15647                 command</I
15648 ></TT
15649 ></A
15650 >, <A
15651 HREF="#DELETEPRINTERCOMMAND"
15652 >               <TT
15653 CLASS="PARAMETER"
15654 ><I
15655 >deleteprinter command</I
15656 ></TT
15657 ></A
15658 >, <A
15659 HREF="#PRINTERADMIN"
15660 ><TT
15661 CLASS="PARAMETER"
15662 ><I
15663 >printer admin</I
15664 ></TT
15665 ></A
15666 ></P
15667 ><P
15668 >Default :<B
15669 CLASS="COMMAND"
15670 >show add printer wizard = yes</B
15671 ></P
15672 ></DD
15673 ><DT
15674 ><A
15675 NAME="SMBPASSWDFILE"
15676 ></A
15677 >smb passwd file (G)</DT
15678 ><DD
15679 ><P
15680 >This option sets the path to the encrypted
15681                 smbpasswd file.  By default the path to the smbpasswd file
15682                 is compiled into Samba.</P
15683 ><P
15684 >Default: <B
15685 CLASS="COMMAND"
15686 >smb passwd file = ${prefix}/private/smbpasswd
15687                 </B
15688 ></P
15689 ><P
15690 >Example: <B
15691 CLASS="COMMAND"
15692 >smb passwd file = /etc/samba/smbpasswd
15693                 </B
15694 ></P
15695 ></DD
15696 ><DT
15697 ><A
15698 NAME="SOCKETADDRESS"
15699 ></A
15700 >socket address (G)</DT
15701 ><DD
15702 ><P
15703 >This option allows you to control what
15704                 address Samba will listen for connections on. This is used to
15705                 support multiple virtual interfaces on the one server, each
15706                 with a different configuration.</P
15707 ><P
15708 >By default samba will accept connections on any
15709                 address.</P
15710 ><P
15711 >Example: <B
15712 CLASS="COMMAND"
15713 >socket address = 192.168.2.20</B
15714 >
15715                 </P
15716 ></DD
15717 ><DT
15718 ><A
15719 NAME="SOCKETOPTIONS"
15720 ></A
15721 >socket options (G)</DT
15722 ><DD
15723 ><P
15724 >This option allows you to set socket options
15725                 to be used when talking with the client.</P
15726 ><P
15727 >Socket options are controls on the networking layer
15728                 of the operating systems which allow the connection to be
15729                 tuned.</P
15730 ><P
15731 >This option will typically be used to tune your Samba
15732                 server for optimal performance for your local network. There is
15733                 no way that Samba can know what the optimal parameters are for
15734                 your net, so you must experiment and choose them yourself. We
15735                 strongly suggest you read the appropriate documentation for your
15736                 operating system first (perhaps <B
15737 CLASS="COMMAND"
15738 >man setsockopt</B
15739 >
15740                 will help).</P
15741 ><P
15742 >You may find that on some systems Samba will say
15743                 "Unknown socket option" when you supply an option. This means you
15744                 either incorrectly  typed it or you need to add an include file
15745                 to includes.h for your OS.  If the latter is the case please
15746                 send the patch to <A
15747 HREF="mailto:samba@samba.org"
15748 TARGET="_top"
15749 >               samba@samba.org</A
15750 >.</P
15751 ><P
15752 >Any of the supported socket options may be combined
15753                 in any way you like, as long as your OS allows it.</P
15754 ><P
15755 >This is the list of socket options currently settable
15756                 using this option:</P
15757 ><P
15758 ></P
15759 ><UL
15760 ><LI
15761 ><P
15762 >SO_KEEPALIVE</P
15763 ></LI
15764 ><LI
15765 ><P
15766 >SO_REUSEADDR</P
15767 ></LI
15768 ><LI
15769 ><P
15770 >SO_BROADCAST</P
15771 ></LI
15772 ><LI
15773 ><P
15774 >TCP_NODELAY</P
15775 ></LI
15776 ><LI
15777 ><P
15778 >IPTOS_LOWDELAY</P
15779 ></LI
15780 ><LI
15781 ><P
15782 >IPTOS_THROUGHPUT</P
15783 ></LI
15784 ><LI
15785 ><P
15786 >SO_SNDBUF *</P
15787 ></LI
15788 ><LI
15789 ><P
15790 >SO_RCVBUF *</P
15791 ></LI
15792 ><LI
15793 ><P
15794 >SO_SNDLOWAT *</P
15795 ></LI
15796 ><LI
15797 ><P
15798 >SO_RCVLOWAT *</P
15799 ></LI
15800 ></UL
15801 ><P
15802 >Those marked with a <EM
15803 >'*'</EM
15804 > take an integer
15805                 argument. The others can optionally take a 1 or 0 argument to enable
15806                 or disable the option, by default they will be enabled if you
15807                 don't specify 1 or 0.</P
15808 ><P
15809 >To specify an argument use the syntax SOME_OPTION=VALUE
15810                 for example <B
15811 CLASS="COMMAND"
15812 >SO_SNDBUF=8192</B
15813 >. Note that you must
15814                 not have any spaces before or after the = sign.</P
15815 ><P
15816 >If you are on a local network then a sensible option
15817                 might be</P
15818 ><P
15819 ><B
15820 CLASS="COMMAND"
15821 >socket options = IPTOS_LOWDELAY</B
15822 ></P
15823 ><P
15824 >If you have a local network then you could try:</P
15825 ><P
15826 ><B
15827 CLASS="COMMAND"
15828 >socket options = IPTOS_LOWDELAY TCP_NODELAY</B
15829 ></P
15830 ><P
15831 >If you are on a wide area network then perhaps try
15832                 setting IPTOS_THROUGHPUT. </P
15833 ><P
15834 >Note that several of the options may cause your Samba
15835                 server to fail completely. Use these options with caution!</P
15836 ><P
15837 >Default: <B
15838 CLASS="COMMAND"
15839 >socket options = TCP_NODELAY</B
15840 ></P
15841 ><P
15842 >Example: <B
15843 CLASS="COMMAND"
15844 >socket options = IPTOS_LOWDELAY</B
15845 ></P
15846 ></DD
15847 ><DT
15848 ><A
15849 NAME="SOURCEENVIRONMENT"
15850 ></A
15851 >source environment (G)</DT
15852 ><DD
15853 ><P
15854 >This parameter causes Samba to set environment
15855                 variables as per the content of the file named.</P
15856 ><P
15857 >If the value of this parameter starts with a "|" character
15858                 then Samba will treat that value as a pipe command to open and
15859                 will set the environment variables from the output of the pipe.</P
15860 ><P
15861 >The contents of the file or the output of the pipe should
15862                 be formatted as the output of the standard Unix <B
15863 CLASS="COMMAND"
15864 >env(1)
15865                 </B
15866 > command. This is of the form :</P
15867 ><P
15868 >Example environment entry:</P
15869 ><P
15870 ><B
15871 CLASS="COMMAND"
15872 >SAMBA_NETBIOS_NAME=myhostname</B
15873 ></P
15874 ><P
15875 >Default: <EM
15876 >No default value</EM
15877 ></P
15878 ><P
15879 >Examples: <B
15880 CLASS="COMMAND"
15881 >source environment = |/etc/smb.conf.sh
15882                 </B
15883 ></P
15884 ><P
15885 >Example: <B
15886 CLASS="COMMAND"
15887 >source environment =
15888                 /usr/local/smb_env_vars</B
15889 ></P
15890 ></DD
15891 ><DT
15892 ><A
15893 NAME="SSL"
15894 ></A
15895 >ssl (G)</DT
15896 ><DD
15897 ><P
15898 >This variable is part of SSL-enabled Samba. This
15899                 is only available if the SSL libraries have been compiled on your
15900                 system and the configure option <B
15901 CLASS="COMMAND"
15902 >--with-ssl</B
15903 > was
15904                 given at configure time.</P
15905 ><P
15906 ><EM
15907 >Note</EM
15908 > that for export control reasons
15909                 this code is <EM
15910 >NOT</EM
15911 > enabled by default in any
15912                 current binary version of Samba.</P
15913 ><P
15914 >This variable enables or disables the entire SSL mode. If
15915                 it is set to <TT
15916 CLASS="CONSTANT"
15917 >no</TT
15918 >, the SSL enabled samba behaves
15919                 exactly like the non-SSL samba. If set to <TT
15920 CLASS="CONSTANT"
15921 >yes</TT
15922 >,
15923                 it depends on the variables <A
15924 HREF="#SSLHOSTS"
15925 ><TT
15926 CLASS="PARAMETER"
15927 ><I
15928 >               ssl hosts</I
15929 ></TT
15930 ></A
15931 > and <A
15932 HREF="#SSLHOSTSRESIGN"
15933 >               <TT
15934 CLASS="PARAMETER"
15935 ><I
15936 >ssl hosts resign</I
15937 ></TT
15938 ></A
15939 > whether an SSL
15940                 connection will be required.</P
15941 ><P
15942 >Default: <B
15943 CLASS="COMMAND"
15944 >ssl=no</B
15945 ></P
15946 ></DD
15947 ><DT
15948 ><A
15949 NAME="SSLCACERTDIR"
15950 ></A
15951 >ssl CA certDir (G)</DT
15952 ><DD
15953 ><P
15954 >This variable is part of SSL-enabled Samba. This
15955                 is only available if the SSL libraries have been compiled on your
15956                 system and the configure option <B
15957 CLASS="COMMAND"
15958 >--with-ssl</B
15959 > was
15960                 given at configure time.</P
15961 ><P
15962 ><EM
15963 >Note</EM
15964 > that for export control reasons
15965                 this code is <EM
15966 >NOT</EM
15967 > enabled by default in any
15968                 current binary version of Samba.</P
15969 ><P
15970 >This variable defines where to look up the Certification
15971                 Authorities. The given directory should contain one file for
15972                 each CA that samba will trust.  The file name must be the hash
15973                 value over the "Distinguished Name" of the CA. How this directory
15974                 is set up is explained later in this document. All files within the
15975                 directory that don't fit into this naming scheme are ignored. You
15976                 don't need this variable if you don't verify client certificates.</P
15977 ><P
15978 >Default: <B
15979 CLASS="COMMAND"
15980 >ssl CA certDir = /usr/local/ssl/certs
15981                 </B
15982 ></P
15983 ></DD
15984 ><DT
15985 ><A
15986 NAME="SSLCACERTFILE"
15987 ></A
15988 >ssl CA certFile (G)</DT
15989 ><DD
15990 ><P
15991 >This variable is part of SSL-enabled Samba. This
15992                 is only available if the SSL libraries have been compiled on your
15993                 system and the configure option <B
15994 CLASS="COMMAND"
15995 >--with-ssl</B
15996 > was
15997                 given at configure time.</P
15998 ><P
15999 ><EM
16000 >Note</EM
16001 > that for export control reasons
16002                 this code is <EM
16003 >NOT</EM
16004 > enabled by default in any
16005                 current binary version of Samba.</P
16006 ><P
16007 >This variable is a second way to define the trusted CAs.
16008                 The certificates of the trusted CAs are collected in one big
16009                 file and this variable points to the file. You will probably
16010                 only use one of the two ways to define your CAs. The first choice is
16011                 preferable if you have many CAs or want to be flexible, the second
16012                 is preferable if you only have one CA and want to keep things
16013                 simple (you won't need to create the hashed file names). You
16014                 don't need this variable if you don't verify client certificates.</P
16015 ><P
16016 >Default: <B
16017 CLASS="COMMAND"
16018 >ssl CA certFile = /usr/local/ssl/certs/trustedCAs.pem
16019                 </B
16020 ></P
16021 ></DD
16022 ><DT
16023 ><A
16024 NAME="SSLCIPHERS"
16025 ></A
16026 >ssl ciphers (G)</DT
16027 ><DD
16028 ><P
16029 >This variable is part of SSL-enabled Samba. This
16030                 is only available if the SSL libraries have been compiled on your
16031                 system and the configure option <B
16032 CLASS="COMMAND"
16033 >--with-ssl</B
16034 > was
16035                 given at configure time.</P
16036 ><P
16037 ><EM
16038 >Note</EM
16039 > that for export control reasons
16040                 this code is <EM
16041 >NOT</EM
16042 > enabled by default in any
16043                 current binary version of Samba.</P
16044 ><P
16045 >This variable defines the ciphers that should be offered
16046                 during SSL negotiation. You should not set this variable unless
16047                 you know what you are doing.</P
16048 ></DD
16049 ><DT
16050 ><A
16051 NAME="SSLCLIENTCERT"
16052 ></A
16053 >ssl client cert (G)</DT
16054 ><DD
16055 ><P
16056 >This variable is part of SSL-enabled Samba. This
16057                 is only available if the SSL libraries have been compiled on your
16058                 system and the configure option <B
16059 CLASS="COMMAND"
16060 >--with-ssl</B
16061 > was
16062                 given at configure time.</P
16063 ><P
16064 ><EM
16065 >Note</EM
16066 > that for export control reasons
16067                 this code is <EM
16068 >NOT</EM
16069 > enabled by default in any
16070                 current binary version of Samba.</P
16071 ><P
16072 >The certificate in this file is used by <A
16073 HREF="smbclient.1.html"
16074 TARGET="_top"
16075 >               <B
16076 CLASS="COMMAND"
16077 >smbclient(1)</B
16078 ></A
16079 > if it exists. It's needed
16080                 if the server requires a client certificate.</P
16081 ><P
16082 >Default: <B
16083 CLASS="COMMAND"
16084 >ssl client cert = /usr/local/ssl/certs/smbclient.pem
16085                 </B
16086 ></P
16087 ></DD
16088 ><DT
16089 ><A
16090 NAME="SSLCLIENTKEY"
16091 ></A
16092 >ssl client key (G)</DT
16093 ><DD
16094 ><P
16095 >This variable is part of SSL-enabled Samba. This
16096                 is only available if the SSL libraries have been compiled on your
16097                 system and the configure option <B
16098 CLASS="COMMAND"
16099 >--with-ssl</B
16100 > was
16101                 given at configure time.</P
16102 ><P
16103 ><EM
16104 >Note</EM
16105 > that for export control reasons
16106                 this code is <EM
16107 >NOT</EM
16108 > enabled by default in any
16109                 current binary version of Samba.</P
16110 ><P
16111 >This is the private key for <A
16112 HREF="smbclient.1.html"
16113 TARGET="_top"
16114 >               <B
16115 CLASS="COMMAND"
16116 >smbclient(1)</B
16117 ></A
16118 >. It's only needed if the
16119                 client should have a certificate. </P
16120 ><P
16121 >Default: <B
16122 CLASS="COMMAND"
16123 >ssl client key = /usr/local/ssl/private/smbclient.pem
16124                 </B
16125 ></P
16126 ></DD
16127 ><DT
16128 ><A
16129 NAME="SSLCOMPATIBILITY"
16130 ></A
16131 >ssl compatibility (G)</DT
16132 ><DD
16133 ><P
16134 >This variable is part of SSL-enabled Samba. This
16135                 is only available if the SSL libraries have been compiled on your
16136                 system and the configure option <B
16137 CLASS="COMMAND"
16138 >--with-ssl</B
16139 > was
16140                 given at configure time.</P
16141 ><P
16142 ><EM
16143 >Note</EM
16144 > that for export control reasons
16145                 this code is <EM
16146 >NOT</EM
16147 > enabled by default in any
16148                 current binary version of Samba.</P
16149 ><P
16150 >This variable defines whether SSLeay should be configured
16151                 for bug compatibility with other SSL implementations. This is
16152                 probably not desirable because currently no clients with SSL
16153                 implementations other than SSLeay exist.</P
16154 ><P
16155 >Default: <B
16156 CLASS="COMMAND"
16157 >ssl compatibility = no</B
16158 ></P
16159 ></DD
16160 ><DT
16161 ><A
16162 NAME="SSLHOSTS"
16163 ></A
16164 >ssl hosts (G)</DT
16165 ><DD
16166 ><P
16167 >See <A
16168 HREF="#SSLHOSTSRESIGN"
16169 ><TT
16170 CLASS="PARAMETER"
16171 ><I
16172 >               ssl hosts resign</I
16173 ></TT
16174 ></A
16175 >.</P
16176 ></DD
16177 ><DT
16178 ><A
16179 NAME="SSLHOSTSRESIGN"
16180 ></A
16181 >ssl hosts resign (G)</DT
16182 ><DD
16183 ><P
16184 >This variable is part of SSL-enabled Samba. This
16185                 is only available if the SSL libraries have been compiled on your
16186                 system and the configure option <B
16187 CLASS="COMMAND"
16188 >--with-ssl</B
16189 > was
16190                 given at configure time.</P
16191 ><P
16192 ><EM
16193 >Note</EM
16194 > that for export control reasons
16195                 this code is <EM
16196 >NOT</EM
16197 > enabled by default in any
16198                 current binary version of Samba.</P
16199 ><P
16200 >These two variables define whether samba will go
16201                 into SSL mode or not. If none of them is defined, samba will
16202                 allow only SSL connections. If the <A
16203 HREF="#SSLHOSTS"
16204 >               <TT
16205 CLASS="PARAMETER"
16206 ><I
16207 >ssl hosts</I
16208 ></TT
16209 ></A
16210 > variable lists
16211                 hosts (by IP-address, IP-address range, net group or name),
16212                 only these hosts will be forced into SSL mode. If the <TT
16213 CLASS="PARAMETER"
16214 ><I
16215 >               ssl hosts resign</I
16216 ></TT
16217 > variable lists hosts, only these
16218                 hosts will NOT be forced into SSL mode. The syntax for these two
16219                 variables is the same as for the <A
16220 HREF="#HOSTSALLOW"
16221 ><TT
16222 CLASS="PARAMETER"
16223 ><I
16224 >               hosts allow</I
16225 ></TT
16226 ></A
16227 > and <A
16228 HREF="#HOSTSDENY"
16229 >               <TT
16230 CLASS="PARAMETER"
16231 ><I
16232 >hosts deny</I
16233 ></TT
16234 ></A
16235 > pair of variables, only
16236                 that the subject of the decision is different: It's not the access
16237                 right but whether SSL is used or not. </P
16238 ><P
16239 >The example below requires SSL connections from all hosts
16240                 outside the local net (which is 192.168.*.*).</P
16241 ><P
16242 >Default: <B
16243 CLASS="COMMAND"
16244 >ssl hosts = &#60;empty string&#62;</B
16245 ></P
16246 ><P
16247 ><B
16248 CLASS="COMMAND"
16249 >ssl hosts resign = &#60;empty string&#62;</B
16250 ></P
16251 ><P
16252 >Example: <B
16253 CLASS="COMMAND"
16254 >ssl hosts resign = 192.168.</B
16255 ></P
16256 ></DD
16257 ><DT
16258 ><A
16259 NAME="SSLREQUIRECLIENTCERT"
16260 ></A
16261 >ssl require clientcert (G)</DT
16262 ><DD
16263 ><P
16264 >This variable is part of SSL-enabled Samba. This
16265                 is only available if the SSL libraries have been compiled on your
16266                 system and the configure option <B
16267 CLASS="COMMAND"
16268 >--with-ssl</B
16269 > was
16270                 given at configure time.</P
16271 ><P
16272 ><EM
16273 >Note</EM
16274 > that for export control reasons
16275                 this code is <EM
16276 >NOT</EM
16277 > enabled by default in any
16278                 current binary version of Samba.</P
16279 ><P
16280 >If this variable is set to <TT
16281 CLASS="CONSTANT"
16282 >yes</TT
16283 >, the
16284                 server will not tolerate connections from clients that don't
16285                 have a valid certificate. The directory/file given in <A
16286 HREF="#SSLCACERTDIR"
16287 ><TT
16288 CLASS="PARAMETER"
16289 ><I
16290 >ssl CA certDir</I
16291 ></TT
16292 >
16293                 </A
16294 > and <A
16295 HREF="#SSLCACERTFILE"
16296 ><TT
16297 CLASS="PARAMETER"
16298 ><I
16299 >ssl CA certFile
16300                 </I
16301 ></TT
16302 ></A
16303 > will be used to look up the CAs that issued
16304                 the client's certificate. If the certificate can't be verified
16305                 positively, the connection will be terminated.  If this variable
16306                 is set to <TT
16307 CLASS="CONSTANT"
16308 >no</TT
16309 >, clients don't need certificates.
16310                 Contrary to web applications you really <EM
16311 >should</EM
16312 >
16313                 require client certificates. In the web environment the client's
16314                 data is sensitive (credit card numbers) and the server must prove
16315                 to be trustworthy. In a file server environment the server's data
16316                 will be sensitive and the clients must prove to be trustworthy.</P
16317 ><P
16318 >Default: <B
16319 CLASS="COMMAND"
16320 >ssl require clientcert = no</B
16321 ></P
16322 ></DD
16323 ><DT
16324 ><A
16325 NAME="SSLREQUIRESERVERCERT"
16326 ></A
16327 >ssl require servercert (G)</DT
16328 ><DD
16329 ><P
16330 >This variable is part of SSL-enabled Samba. This
16331                 is only available if the SSL libraries have been compiled on your
16332                 system and the configure option <B
16333 CLASS="COMMAND"
16334 >--with-ssl</B
16335 > was
16336                 given at configure time.</P
16337 ><P
16338 ><EM
16339 >Note</EM
16340 > that for export control reasons
16341                 this code is <EM
16342 >NOT</EM
16343 > enabled by default in any
16344                 current binary version of Samba.</P
16345 ><P
16346 >If this variable is set to <TT
16347 CLASS="CONSTANT"
16348 >yes</TT
16349 >, the
16350                 <A
16351 HREF="smbclient.1.html"
16352 TARGET="_top"
16353 ><B
16354 CLASS="COMMAND"
16355 >smbclient(1)</B
16356 >
16357                 </A
16358 > will request a certificate from the server. Same as
16359                 <A
16360 HREF="#SSLREQUIRECLIENTCERT"
16361 ><TT
16362 CLASS="PARAMETER"
16363 ><I
16364 >ssl require
16365                 clientcert</I
16366 ></TT
16367 ></A
16368 > for the server.</P
16369 ><P
16370 >Default: <B
16371 CLASS="COMMAND"
16372 >ssl require servercert = no</B
16373 >
16374                 </P
16375 ></DD
16376 ><DT
16377 ><A
16378 NAME="SSLSERVERCERT"
16379 ></A
16380 >ssl server cert (G)</DT
16381 ><DD
16382 ><P
16383 >This variable is part of SSL-enabled Samba. This
16384                 is only available if the SSL libraries have been compiled on your
16385                 system and the configure option <B
16386 CLASS="COMMAND"
16387 >--with-ssl</B
16388 > was
16389                 given at configure time.</P
16390 ><P
16391 ><EM
16392 >Note</EM
16393 > that for export control reasons
16394                 this code is <EM
16395 >NOT</EM
16396 > enabled by default in any
16397                 current binary version of Samba.</P
16398 ><P
16399 >This is the file containing the server's certificate.
16400                 The server <EM
16401 >must</EM
16402 > have a certificate. The
16403                 file may also contain the server's private key. See later for
16404                 how certificates and private keys are created.</P
16405 ><P
16406 >Default: <B
16407 CLASS="COMMAND"
16408 >ssl server cert = &#60;empty string&#62;
16409                 </B
16410 ></P
16411 ></DD
16412 ><DT
16413 ><A
16414 NAME="SSLSERVERKEY"
16415 ></A
16416 >ssl server key (G)</DT
16417 ><DD
16418 ><P
16419 >This variable is part of SSL-enabled Samba. This
16420                 is only available if the SSL libraries have been compiled on your
16421                 system and the configure option <B
16422 CLASS="COMMAND"
16423 >--with-ssl</B
16424 > was
16425                 given at configure time.</P
16426 ><P
16427 ><EM
16428 >Note</EM
16429 > that for export control reasons
16430                 this code is <EM
16431 >NOT</EM
16432 > enabled by default in any
16433                 current binary version of Samba.</P
16434 ><P
16435 >This file contains the private key of the server. If
16436                 this variable is not defined, the key is looked up in the
16437                 certificate file (it may be appended to the certificate).
16438                 The server <EM
16439 >must</EM
16440 > have a private key
16441                 and the certificate <EM
16442 >must</EM
16443 >
16444                 match this private key.</P
16445 ><P
16446 >Default: <B
16447 CLASS="COMMAND"
16448 >ssl server key = &#60;empty string&#62;
16449                 </B
16450 ></P
16451 ></DD
16452 ><DT
16453 ><A
16454 NAME="SSLVERSION"
16455 ></A
16456 >ssl version (G)</DT
16457 ><DD
16458 ><P
16459 >This variable is part of SSL-enabled Samba. This
16460                 is only available if the SSL libraries have been compiled on your
16461                 system and the configure option <B
16462 CLASS="COMMAND"
16463 >--with-ssl</B
16464 > was
16465                 given at configure time.</P
16466 ><P
16467 ><EM
16468 >Note</EM
16469 > that for export control reasons
16470                 this code is <EM
16471 >NOT</EM
16472 > enabled by default in any
16473                 current binary version of Samba.</P
16474 ><P
16475 >This enumeration variable defines the versions of the
16476                 SSL protocol that will be used. <TT
16477 CLASS="CONSTANT"
16478 >ssl2or3</TT
16479 > allows
16480                 dynamic negotiation of SSL v2 or v3, <TT
16481 CLASS="CONSTANT"
16482 >ssl2</TT
16483 > results
16484                 in SSL v2, <TT
16485 CLASS="CONSTANT"
16486 >ssl3</TT
16487 > results in SSL v3 and
16488                 <TT
16489 CLASS="CONSTANT"
16490 >tls1</TT
16491 > results in TLS v1. TLS (Transport Layer
16492                 Security) is the new standard for SSL.</P
16493 ><P
16494 >Default: <B
16495 CLASS="COMMAND"
16496 >ssl version = "ssl2or3"</B
16497 ></P
16498 ></DD
16499 ><DT
16500 ><A
16501 NAME="STATCACHE"
16502 ></A
16503 >stat cache (G)</DT
16504 ><DD
16505 ><P
16506 >This parameter determines if <A
16507 HREF="smbd.8.html"
16508 TARGET="_top"
16509 >smbd(8)</A
16510 > will use a cache in order to
16511                 speed up case insensitive name mappings. You should never need
16512                 to change this parameter.</P
16513 ><P
16514 >Default: <B
16515 CLASS="COMMAND"
16516 >stat cache = yes</B
16517 ></P
16518 ></DD
16519 ><DT
16520 ><A
16521 NAME="STATCACHESIZE"
16522 ></A
16523 >stat cache size (G)</DT
16524 ><DD
16525 ><P
16526 >This parameter determines the number of
16527                 entries in the <TT
16528 CLASS="PARAMETER"
16529 ><I
16530 >stat cache</I
16531 ></TT
16532 >.  You should
16533                 never need to change this parameter.</P
16534 ><P
16535 >Default: <B
16536 CLASS="COMMAND"
16537 >stat cache size = 50</B
16538 ></P
16539 ></DD
16540 ><DT
16541 ><A
16542 NAME="STATUS"
16543 ></A
16544 >status (G)</DT
16545 ><DD
16546 ><P
16547 >This enables or disables logging of connections
16548                 to a status file that <A
16549 HREF="smbstatus.1.html"
16550 TARGET="_top"
16551 >smbstatus(1)</A
16552 >
16553                 can read.</P
16554 ><P
16555 >With this disabled <B
16556 CLASS="COMMAND"
16557 >smbstatus</B
16558 > won't be able
16559                 to tell you what connections are active. You should never need to
16560                 change this parameter.</P
16561 ><P
16562 >Default: <B
16563 CLASS="COMMAND"
16564 >status = yes</B
16565 ></P
16566 ></DD
16567 ><DT
16568 ><A
16569 NAME="STRICTLOCKING"
16570 ></A
16571 >strict locking (S)</DT
16572 ><DD
16573 ><P
16574 >This is a boolean that controls the handling of
16575                 file locking in the server. When this is set to <TT
16576 CLASS="CONSTANT"
16577 >yes</TT
16578 >
16579                 the server will check every read and write access for file locks, and
16580                 deny access if locks exist. This can be slow on some systems.</P
16581 ><P
16582 >When strict locking is <TT
16583 CLASS="CONSTANT"
16584 >no</TT
16585 > the server does file
16586                 lock checks only when the client explicitly asks for them.</P
16587 ><P
16588 >Well behaved clients always ask for lock checks when it
16589                 is important, so in the vast majority of cases <B
16590 CLASS="COMMAND"
16591 >strict
16592                 locking = no</B
16593 > is preferable.</P
16594 ><P
16595 >Default: <B
16596 CLASS="COMMAND"
16597 >strict locking = no</B
16598 ></P
16599 ></DD
16600 ><DT
16601 ><A
16602 NAME="STRICTSYNC"
16603 ></A
16604 >strict sync (S)</DT
16605 ><DD
16606 ><P
16607 >Many Windows applications (including the Windows
16608                 98 explorer shell) seem to confuse flushing buffer contents to
16609                 disk with doing a sync to disk. Under UNIX, a sync call forces
16610                 the process to be suspended until the kernel has ensured that
16611                 all outstanding data in kernel disk buffers has been safely stored
16612                 onto stable storage. This is very slow and should only be done
16613                 rarely. Setting this parameter to <TT
16614 CLASS="CONSTANT"
16615 >no</TT
16616 > (the
16617                 default) means that smbd ignores the Windows applications requests for
16618                 a sync call. There is only a possibility of losing data if the
16619                 operating system itself that Samba is running on crashes, so there is
16620                 little danger in this default setting. In addition, this fixes many
16621                 performance problems that people have reported with the new Windows98
16622                 explorer shell file copies.</P
16623 ><P
16624 >See also the <A
16625 HREF="#SYNCALWAYS"
16626 ><TT
16627 CLASS="PARAMETER"
16628 ><I
16629 >sync
16630                 always&#62;</I
16631 ></TT
16632 ></A
16633 > parameter.</P
16634 ><P
16635 >Default: <B
16636 CLASS="COMMAND"
16637 >strict sync = no</B
16638 ></P
16639 ></DD
16640 ><DT
16641 ><A
16642 NAME="STRIPDOT"
16643 ></A
16644 >strip dot (G)</DT
16645 ><DD
16646 ><P
16647 >This is a boolean that controls whether to
16648                 strip trailing dots off UNIX filenames. This helps with some
16649                 CDROMs that have filenames ending in a single dot.</P
16650 ><P
16651 >Default: <B
16652 CLASS="COMMAND"
16653 >strip dot = no</B
16654 ></P
16655 ></DD
16656 ><DT
16657 ><A
16658 NAME="SYNCALWAYS"
16659 ></A
16660 >sync always (S)</DT
16661 ><DD
16662 ><P
16663 >This is a boolean parameter that controls
16664                 whether writes will always be written to stable storage before
16665                 the write call returns. If this is false then the server will be
16666                 guided by the client's request in each write call (clients can
16667                 set a bit indicating that a particular write should be synchronous).
16668                 If this is true then every write will be followed by a <B
16669 CLASS="COMMAND"
16670 >fsync()
16671                 </B
16672 > call to ensure the data is written to disk. Note that
16673                 the <TT
16674 CLASS="PARAMETER"
16675 ><I
16676 >strict sync</I
16677 ></TT
16678 > parameter must be set to
16679                 <TT
16680 CLASS="CONSTANT"
16681 >yes</TT
16682 > in order for this parameter to have
16683                 any affect.</P
16684 ><P
16685 >See also the <A
16686 HREF="#STRICTSYNC"
16687 ><TT
16688 CLASS="PARAMETER"
16689 ><I
16690 >strict
16691                 sync</I
16692 ></TT
16693 ></A
16694 > parameter.</P
16695 ><P
16696 >Default: <B
16697 CLASS="COMMAND"
16698 >sync always = no</B
16699 ></P
16700 ></DD
16701 ><DT
16702 ><A
16703 NAME="SYSLOG"
16704 ></A
16705 >syslog (G)</DT
16706 ><DD
16707 ><P
16708 >This parameter maps how Samba debug messages
16709                 are logged onto the system syslog logging levels. Samba debug
16710                 level zero maps onto syslog <TT
16711 CLASS="CONSTANT"
16712 >LOG_ERR</TT
16713 >, debug
16714                 level one maps onto <TT
16715 CLASS="CONSTANT"
16716 >LOG_WARNING</TT
16717 >, debug level
16718                 two maps onto <TT
16719 CLASS="CONSTANT"
16720 >LOG_NOTICE</TT
16721 >, debug level three
16722                 maps onto LOG_INFO. All higher levels are mapped to <TT
16723 CLASS="CONSTANT"
16724 >               LOG_DEBUG</TT
16725 >.</P
16726 ><P
16727 >This parameter sets the threshold for sending messages
16728                 to syslog.  Only messages with debug level less than this value
16729                 will be sent to syslog.</P
16730 ><P
16731 >Default: <B
16732 CLASS="COMMAND"
16733 >syslog = 1</B
16734 ></P
16735 ></DD
16736 ><DT
16737 ><A
16738 NAME="SYSLOGONLY"
16739 ></A
16740 >syslog only (G)</DT
16741 ><DD
16742 ><P
16743 >If this parameter is set then Samba debug
16744                 messages are logged into the system syslog only, and not to
16745                 the debug log files.</P
16746 ><P
16747 >Default: <B
16748 CLASS="COMMAND"
16749 >syslog only = no</B
16750 ></P
16751 ></DD
16752 ><DT
16753 ><A
16754 NAME="TEMPLATEHOMEDIR"
16755 ></A
16756 >template homedir (G)</DT
16757 ><DD
16758 ><P
16759 ><EM
16760 >NOTE:</EM
16761 > this parameter is
16762                 only available in Samba 3.0.</P
16763 ><P
16764 >When filling out the user information for a Windows NT
16765                 user, the <A
16766 HREF="winbindd.8.html"
16767 TARGET="_top"
16768 >winbindd(8)</A
16769 > daemon
16770                 uses this parameter to fill in the home directory for that user.
16771                 If the string <TT
16772 CLASS="PARAMETER"
16773 ><I
16774 >%D</I
16775 ></TT
16776 > is present it is substituted
16777                 with the user's Windows NT domain name.  If the string <TT
16778 CLASS="PARAMETER"
16779 ><I
16780 >%U
16781                 </I
16782 ></TT
16783 > is present it is substituted with the user's Windows
16784                 NT user name.</P
16785 ><P
16786 >Default: <B
16787 CLASS="COMMAND"
16788 >template homedir = /home/%D/%U</B
16789 ></P
16790 ></DD
16791 ><DT
16792 ><A
16793 NAME="TEMPLATESHELL"
16794 ></A
16795 >template shell (G)</DT
16796 ><DD
16797 ><P
16798 ><EM
16799 >NOTE:</EM
16800 > this parameter is
16801                 only available in Samba 3.0.</P
16802 ><P
16803 >When filling out the user information for a Windows NT
16804                 user, the <A
16805 HREF="winbindd.8.html"
16806 TARGET="_top"
16807 >winbindd(8)</A
16808 > daemon
16809                 uses this parameter to fill in the login shell for that user.</P
16810 ><P
16811 >Default: <B
16812 CLASS="COMMAND"
16813 >template shell = /bin/false</B
16814 ></P
16815 ></DD
16816 ><DT
16817 ><A
16818 NAME="TIMEOFFSET"
16819 ></A
16820 >time offset (G)</DT
16821 ><DD
16822 ><P
16823 >This parameter is a setting in minutes to add
16824                 to the normal GMT to local time conversion. This is useful if
16825                 you are serving a lot of PCs that have incorrect daylight
16826                 saving time handling.</P
16827 ><P
16828 >Default: <B
16829 CLASS="COMMAND"
16830 >time offset = 0</B
16831 ></P
16832 ><P
16833 >Example: <B
16834 CLASS="COMMAND"
16835 >time offset = 60</B
16836 ></P
16837 ></DD
16838 ><DT
16839 ><A
16840 NAME="TIMESERVER"
16841 ></A
16842 >time server (G)</DT
16843 ><DD
16844 ><P
16845 >This parameter determines if <A
16846 HREF="nmbd.8.html"
16847 TARGET="_top"
16848 >
16849                 nmbd(8)</A
16850 > advertises itself as a time server to Windows
16851                 clients.</P
16852 ><P
16853 >Default: <B
16854 CLASS="COMMAND"
16855 >time server = no</B
16856 ></P
16857 ></DD
16858 ><DT
16859 ><A
16860 NAME="TIMESTAMPLOGS"
16861 ></A
16862 >timestamp logs (G)</DT
16863 ><DD
16864 ><P
16865 >Synonym for <A
16866 HREF="#DEBUGTIMESTAMP"
16867 ><TT
16868 CLASS="PARAMETER"
16869 ><I
16870 >               debug timestamp</I
16871 ></TT
16872 ></A
16873 >.</P
16874 ></DD
16875 ><DT
16876 ><A
16877 NAME="TOTALPRINTJOBS"
16878 ></A
16879 >total print jobs (G)</DT
16880 ><DD
16881 ><P
16882 >This parameter accepts an integer value which defines
16883                 a limit on the maximum number of print jobs that will be accepted
16884                 system wide at any given time.  If a print job is submitted
16885                 by a client which will exceed this number, then smbd will return an
16886                 error indicating that no space is available on the server.  The
16887                 default value of 0 means that no such limit exists.  This parameter
16888                 can be used to prevent a server from exceeding its capacity and is
16889                 designed as a printing throttle.  See also
16890                 <A
16891 HREF="#MAXPRINTJOBS"
16892 ><TT
16893 CLASS="PARAMETER"
16894 ><I
16895 >max print jobs</I
16896 ></TT
16897 ></A
16898 >.
16899                 </P
16900 ><P
16901 >Default: <B
16902 CLASS="COMMAND"
16903 >total print jobs = 0</B
16904 ></P
16905 ><P
16906 >Example: <B
16907 CLASS="COMMAND"
16908 >total print jobs = 5000</B
16909 ></P
16910 ></DD
16911 ><DT
16912 ><A
16913 NAME="UNIXPASSWORDSYNC"
16914 ></A
16915 >unix password sync (G)</DT
16916 ><DD
16917 ><P
16918 >This boolean parameter controls whether Samba
16919                 attempts to synchronize the UNIX password with the SMB password
16920                 when the encrypted SMB password in the smbpasswd file is changed.
16921                 If this is set to true the program specified in the <TT
16922 CLASS="PARAMETER"
16923 ><I
16924 >passwd
16925                 program</I
16926 ></TT
16927 >parameter is called <EM
16928 >AS ROOT</EM
16929 > -
16930                 to allow the new UNIX password to be set without access to the
16931                 old UNIX password (as the SMB password has change code has no
16932                 access to the old password cleartext, only the new).</P
16933 ><P
16934 >See also <A
16935 HREF="#PASSWDPROGRAM"
16936 ><TT
16937 CLASS="PARAMETER"
16938 ><I
16939 >passwd
16940                 program</I
16941 ></TT
16942 ></A
16943 >, <A
16944 HREF="#PASSWDCHAT"
16945 ><TT
16946 CLASS="PARAMETER"
16947 ><I
16948 >               passwd chat</I
16949 ></TT
16950 ></A
16951 >.</P
16952 ><P
16953 >Default: <B
16954 CLASS="COMMAND"
16955 >unix password sync = no</B
16956 ></P
16957 ></DD
16958 ><DT
16959 ><A
16960 NAME="UPDATEENCRYPTED"
16961 ></A
16962 >update encrypted (G)</DT
16963 ><DD
16964 ><P
16965 >This boolean parameter allows a user logging
16966                 on with a plaintext password to have their encrypted (hashed)
16967                 password in the smbpasswd file to be updated automatically as
16968                 they log on. This option allows a site to migrate from plaintext
16969                 password authentication (users authenticate with plaintext
16970                 password over the wire, and are checked against a UNIX account
16971                 database) to encrypted password authentication (the SMB
16972                 challenge/response authentication mechanism) without forcing
16973                 all users to re-enter their passwords via smbpasswd at the time the
16974                 change is made. This is a convenience option to allow the change over
16975                 to encrypted passwords to be made over a longer period. Once all users
16976                 have encrypted representations of their passwords in the smbpasswd
16977                 file this parameter should be set to <TT
16978 CLASS="CONSTANT"
16979 >no</TT
16980 >.</P
16981 ><P
16982 >In order for this parameter to work correctly the <A
16983 HREF="#ENCRYPTPASSWORDS"
16984 ><TT
16985 CLASS="PARAMETER"
16986 ><I
16987 >encrypt passwords</I
16988 ></TT
16989 >
16990                 </A
16991 > parameter must be set to <TT
16992 CLASS="CONSTANT"
16993 >no</TT
16994 > when
16995                 this parameter is set to <TT
16996 CLASS="CONSTANT"
16997 >yes</TT
16998 >.</P
16999 ><P
17000 >Note that even when this parameter is set a user
17001                 authenticating to <B
17002 CLASS="COMMAND"
17003 >smbd</B
17004 > must still enter a valid
17005                 password in order to connect correctly, and to update their hashed
17006                 (smbpasswd) passwords.</P
17007 ><P
17008 >Default: <B
17009 CLASS="COMMAND"
17010 >update encrypted = no</B
17011 ></P
17012 ></DD
17013 ><DT
17014 ><A
17015 NAME="USERHOSTS"
17016 ></A
17017 >use rhosts (G)</DT
17018 ><DD
17019 ><P
17020 >If this global parameter is a true, it specifies
17021                 that the UNIX users <TT
17022 CLASS="FILENAME"
17023 >.rhosts</TT
17024 > file in their home directory
17025                 will be read to find the names of hosts and users who will be allowed
17026                 access without specifying a password.</P
17027 ><P
17028 ><EM
17029 >NOTE:</EM
17030 > The use of <TT
17031 CLASS="PARAMETER"
17032 ><I
17033 >use rhosts
17034                 </I
17035 ></TT
17036 > can be a major security hole. This is because you are
17037                 trusting the PC to supply the correct username. It is very easy to
17038                 get a PC to supply a false username. I recommend that the <TT
17039 CLASS="PARAMETER"
17040 ><I
17041 >               use rhosts</I
17042 ></TT
17043 > option be only used if you really know what
17044                 you are doing.</P
17045 ><P
17046 >Default: <B
17047 CLASS="COMMAND"
17048 >use rhosts = no</B
17049 ></P
17050 ></DD
17051 ><DT
17052 ><A
17053 NAME="USER"
17054 ></A
17055 >user (S)</DT
17056 ><DD
17057 ><P
17058 >Synonym for <A
17059 HREF="#USERNAME"
17060 ><TT
17061 CLASS="PARAMETER"
17062 ><I
17063 >               username</I
17064 ></TT
17065 ></A
17066 >.</P
17067 ></DD
17068 ><DT
17069 ><A
17070 NAME="USERS"
17071 ></A
17072 >users (S)</DT
17073 ><DD
17074 ><P
17075 >Synonym for <A
17076 HREF="#USERNAME"
17077 ><TT
17078 CLASS="PARAMETER"
17079 ><I
17080 >               username</I
17081 ></TT
17082 ></A
17083 >.</P
17084 ></DD
17085 ><DT
17086 ><A
17087 NAME="USERNAME"
17088 ></A
17089 >username (S)</DT
17090 ><DD
17091 ><P
17092 >Multiple users may be specified in a comma-delimited
17093                 list, in which case the supplied password will be tested against
17094                 each username in turn (left to right).</P
17095 ><P
17096 >The <TT
17097 CLASS="PARAMETER"
17098 ><I
17099 >username</I
17100 ></TT
17101 > line is needed only when
17102                 the PC is unable to supply its own username. This is the case
17103                 for the COREPLUS protocol or where your users have different WfWg
17104                 usernames to UNIX usernames. In both these cases you may also be
17105                 better using the \\server\share%user syntax instead.</P
17106 ><P
17107 >The <TT
17108 CLASS="PARAMETER"
17109 ><I
17110 >username</I
17111 ></TT
17112 > line is not a great
17113                 solution in many cases as it means Samba will try to validate
17114                 the supplied password against each of the usernames in the
17115                 <TT
17116 CLASS="PARAMETER"
17117 ><I
17118 >username</I
17119 ></TT
17120 > line in turn. This is slow and
17121                 a bad idea for lots of users in case of duplicate passwords.
17122                 You may get timeouts or security breaches using this parameter
17123                 unwisely.</P
17124 ><P
17125 >Samba relies on the underlying UNIX security. This
17126                 parameter does not restrict who can login, it just offers hints
17127                 to the Samba server as to what usernames might correspond to the
17128                 supplied password. Users can login as whoever they please and
17129                 they will be able to do no more damage than if they started a
17130                 telnet session. The daemon runs as the user that they log in as,
17131                 so they cannot do anything that user cannot do.</P
17132 ><P
17133 >To restrict a service to a particular set of users you
17134                 can use the <A
17135 HREF="#VALIDUSERS"
17136 ><TT
17137 CLASS="PARAMETER"
17138 ><I
17139 >valid users
17140                 </I
17141 ></TT
17142 ></A
17143 > parameter.</P
17144 ><P
17145 >If any of the usernames begin with a '@' then the name
17146                 will be looked up first in the yp netgroups list (if Samba
17147                 is compiled with netgroup support), followed by a lookup in
17148                 the UNIX groups database and will expand to a list of all users
17149                 in the group of that name.</P
17150 ><P
17151 >If any of the usernames begin with a '+' then the name
17152                 will be looked up only in the UNIX groups database and will
17153                 expand to a list of all users in the group of that name.</P
17154 ><P
17155 >If any of the usernames begin with a '&#38;'then the name
17156                 will be looked up only in the yp netgroups database (if Samba
17157                 is compiled with netgroup support) and will expand to a list
17158                 of all users in the netgroup group of that name.</P
17159 ><P
17160 >Note that searching though a groups database can take
17161                 quite some time, and some clients may time out during the
17162                 search.</P
17163 ><P
17164 >See the section <A
17165 HREF="#AEN234"
17166 >NOTE ABOUT
17167                 USERNAME/PASSWORD VALIDATION</A
17168 > for more information on how
17169                 this parameter determines access to the services.</P
17170 ><P
17171 >Default: <B
17172 CLASS="COMMAND"
17173 >The guest account if a guest service,
17174                 else &#60;empty string&#62;.</B
17175 ></P
17176 ><P
17177 >Examples:<B
17178 CLASS="COMMAND"
17179 >username = fred, mary, jack, jane,
17180                 @users, @pcgroup</B
17181 ></P
17182 ></DD
17183 ><DT
17184 ><A
17185 NAME="USERNAMELEVEL"
17186 ></A
17187 >username level (G)</DT
17188 ><DD
17189 ><P
17190 >This option helps Samba to try and 'guess' at
17191                 the real UNIX username, as many DOS clients send an all-uppercase
17192                 username. By default Samba tries all lowercase, followed by the
17193                 username with the first letter capitalized, and fails if the
17194                 username is not found on the UNIX machine.</P
17195 ><P
17196 >If this parameter is set to non-zero the behavior changes.
17197                 This parameter is a number that specifies the number of uppercase
17198                 combinations to try while trying to determine the UNIX user name. The
17199                 higher the number the more combinations will be tried, but the slower
17200                 the discovery of usernames will be. Use this parameter when you have
17201                 strange usernames on your UNIX machine, such as <TT
17202 CLASS="CONSTANT"
17203 >AstrangeUser
17204                 </TT
17205 >.</P
17206 ><P
17207 >Default: <B
17208 CLASS="COMMAND"
17209 >username level = 0</B
17210 ></P
17211 ><P
17212 >Example: <B
17213 CLASS="COMMAND"
17214 >username level = 5</B
17215 ></P
17216 ></DD
17217 ><DT
17218 ><A
17219 NAME="USERNAMEMAP"
17220 ></A
17221 >username map (G)</DT
17222 ><DD
17223 ><P
17224 >This option allows you to specify a file containing
17225                 a mapping of usernames from the clients to the server. This can be
17226                 used for several purposes. The most common is to map usernames
17227                 that users use on DOS or Windows machines to those that the UNIX
17228                 box uses. The other is to map multiple users to a single username
17229                 so that they can more easily share files.</P
17230 ><P
17231 >The map file is parsed line by line. Each line should
17232                 contain a single UNIX username on the left then a '=' followed
17233                 by a list of usernames on the right. The list of usernames on the
17234                 right may contain names of the form @group in which case they
17235                 will match any UNIX username in that group. The special client
17236                 name '*' is a wildcard and matches any name. Each line of the
17237                 map file may be up to 1023 characters long.</P
17238 ><P
17239 >The file is processed on each line by taking the
17240                 supplied username and comparing it with each username on the right
17241                 hand side of the '=' signs. If the supplied name matches any of
17242                 the names on the right hand side then it is replaced with the name
17243                 on the left. Processing then continues with the next line.</P
17244 ><P
17245 >If any line begins with a '#' or a ';' then it is
17246                 ignored</P
17247 ><P
17248 >If any line begins with an '!' then the processing
17249                 will stop after that line if a mapping was done by the line.
17250                 Otherwise mapping continues with every line being processed.
17251                 Using '!' is most useful when you have a wildcard mapping line
17252                 later in the file.</P
17253 ><P
17254 >For example to map from the name <TT
17255 CLASS="CONSTANT"
17256 >admin</TT
17257 >
17258                 or <TT
17259 CLASS="CONSTANT"
17260 >administrator</TT
17261 > to the UNIX name <TT
17262 CLASS="CONSTANT"
17263 >               root</TT
17264 > you would use:</P
17265 ><P
17266 ><B
17267 CLASS="COMMAND"
17268 >root = admin administrator</B
17269 ></P
17270 ><P
17271 >Or to map anyone in the UNIX group <TT
17272 CLASS="CONSTANT"
17273 >system</TT
17274 >
17275                 to the UNIX name <TT
17276 CLASS="CONSTANT"
17277 >sys</TT
17278 > you would use:</P
17279 ><P
17280 ><B
17281 CLASS="COMMAND"
17282 >sys = @system</B
17283 ></P
17284 ><P
17285 >You can have as many mappings as you like in a username
17286                 map file.</P
17287 ><P
17288 >If your system supports the NIS NETGROUP option then
17289                 the netgroup database is checked before the <TT
17290 CLASS="FILENAME"
17291 >/etc/group
17292                 </TT
17293 > database for matching groups.</P
17294 ><P
17295 >You can map Windows usernames that have spaces in them
17296                  by using double quotes around the name. For example:</P
17297 ><P
17298 ><B
17299 CLASS="COMMAND"
17300 >tridge = "Andrew Tridgell"</B
17301 ></P
17302 ><P
17303 >would map the windows username "Andrew Tridgell" to the
17304                 unix username "tridge".</P
17305 ><P
17306 >The following example would map mary and fred to the
17307                 unix user sys, and map the rest to guest. Note the use of the
17308                 '!' to tell Samba to stop processing if it gets a match on
17309                 that line.</P
17310 ><P
17311 ><TABLE
17312 BORDER="0"
17313 BGCOLOR="#E0E0E0"
17314 WIDTH="90%"
17315 ><TR
17316 ><TD
17317 ><PRE
17318 CLASS="PROGRAMLISTING"
17319 >               !sys = mary fred
17320                 guest = *
17321                 </PRE
17322 ></TD
17323 ></TR
17324 ></TABLE
17325 ></P
17326 ><P
17327 >Note that the remapping is applied to all occurrences
17328                 of usernames. Thus if you connect to \\server\fred and <TT
17329 CLASS="CONSTANT"
17330 >               fred</TT
17331 > is remapped to <TT
17332 CLASS="CONSTANT"
17333 >mary</TT
17334 > then you
17335                 will actually be connecting to \\server\mary and will need to
17336                 supply a password suitable for <TT
17337 CLASS="CONSTANT"
17338 >mary</TT
17339 > not
17340                 <TT
17341 CLASS="CONSTANT"
17342 >fred</TT
17343 >. The only exception to this is the
17344                 username passed to the <A
17345 HREF="#PASSWORDSERVER"
17346 ><TT
17347 CLASS="PARAMETER"
17348 ><I
17349 >               password server</I
17350 ></TT
17351 ></A
17352 > (if you have one). The password
17353                 server will receive whatever username the client supplies without
17354                 modification.</P
17355 ><P
17356 >Also note that no reverse mapping is done. The main effect
17357                 this has is with printing. Users who have been mapped may have
17358                 trouble deleting print jobs as PrintManager under WfWg will think
17359                 they don't own the print job.</P
17360 ><P
17361 >Default: <EM
17362 >no username map</EM
17363 ></P
17364 ><P
17365 >Example: <B
17366 CLASS="COMMAND"
17367 >username map = /usr/local/samba/lib/users.map
17368                 </B
17369 ></P
17370 ></DD
17371 ><DT
17372 ><A
17373 NAME="UTMP"
17374 ></A
17375 >utmp (S)</DT
17376 ><DD
17377 ><P
17378 >This boolean parameter is only available if
17379                 Samba has been configured and compiled  with the option <B
17380 CLASS="COMMAND"
17381 >               --with-utmp</B
17382 >. If set to True then Samba will attempt
17383                 to add utmp or utmpx records (depending on the UNIX system) whenever a
17384                 connection is made to a Samba server. Sites may use this to record the
17385                 user connecting to a Samba share.</P
17386 ><P
17387 >See also the <A
17388 HREF="#UTMPDIRECTORY"
17389 ><TT
17390 CLASS="PARAMETER"
17391 ><I
17392 >               utmp directory</I
17393 ></TT
17394 ></A
17395 > parameter.</P
17396 ><P
17397 >Default: <B
17398 CLASS="COMMAND"
17399 >utmp = no</B
17400 ></P
17401 ></DD
17402 ><DT
17403 ><A
17404 NAME="UTMPDIRECTORY"
17405 ></A
17406 >utmp directory(G)</DT
17407 ><DD
17408 ><P
17409 >This parameter is only available if Samba has
17410                 been configured and compiled with the option <B
17411 CLASS="COMMAND"
17412 >               --with-utmp</B
17413 >. It specifies a directory pathname that is
17414                 used to store the utmp or utmpx files (depending on the UNIX system) that
17415                 record user connections to a Samba server. See also the <A
17416 HREF="#UTMP"
17417 >               <TT
17418 CLASS="PARAMETER"
17419 ><I
17420 >utmp</I
17421 ></TT
17422 ></A
17423 > parameter. By default this is
17424                 not set, meaning the system will use whatever utmp file the
17425                 native system is set to use (usually
17426                 <TT
17427 CLASS="FILENAME"
17428 >/var/run/utmp</TT
17429 > on Linux).</P
17430 ><P
17431 >Default: <EM
17432 >no utmp directory</EM
17433 ></P
17434 ></DD
17435 ><DT
17436 ><A
17437 NAME="VALIDCHARS"
17438 ></A
17439 >valid chars (G)</DT
17440 ><DD
17441 ><P
17442 >The option allows you to specify additional
17443                 characters that should be considered valid by the server in
17444                 filenames. This is particularly useful for national character
17445                 sets, such as adding u-umlaut or a-ring.</P
17446 ><P
17447 >The option takes a list of characters in either integer
17448                 or character form with spaces between them. If you give two
17449                 characters with a colon between them then it will be taken as
17450                 an lowercase:uppercase pair.</P
17451 ><P
17452 >If you have an editor capable of entering the characters
17453                 into the config file then it is probably easiest to use this
17454                 method. Otherwise you can specify the characters in octal,
17455                 decimal or hexadecimal form using the usual C notation.</P
17456 ><P
17457 >For example to add the single character 'Z' to the charset
17458                 (which is a pointless thing to do as it's already there) you could
17459                 do one of the following</P
17460 ><P
17461 ><TABLE
17462 BORDER="0"
17463 BGCOLOR="#E0E0E0"
17464 WIDTH="90%"
17465 ><TR
17466 ><TD
17467 ><PRE
17468 CLASS="PROGRAMLISTING"
17469 >               valid chars = Z
17470                 valid chars = z:Z
17471                 valid chars = 0132:0172
17472                 </PRE
17473 ></TD
17474 ></TR
17475 ></TABLE
17476 ></P
17477 ><P
17478 >The last two examples above actually add two characters,
17479                 and alter the uppercase and lowercase mappings appropriately.</P
17480 ><P
17481 >Note that you <EM
17482 >MUST</EM
17483 > specify this parameter
17484                 after the <TT
17485 CLASS="PARAMETER"
17486 ><I
17487 >client code page</I
17488 ></TT
17489 > parameter if you
17490                 have both set. If <TT
17491 CLASS="PARAMETER"
17492 ><I
17493 >client code page</I
17494 ></TT
17495 > is set after
17496                 the <TT
17497 CLASS="PARAMETER"
17498 ><I
17499 >valid chars</I
17500 ></TT
17501 > parameter the <TT
17502 CLASS="PARAMETER"
17503 ><I
17504 >valid
17505                 chars</I
17506 ></TT
17507 > settings will be overwritten.</P
17508 ><P
17509 >See also the <A
17510 HREF="#CLIENTCODEPAGE"
17511 ><TT
17512 CLASS="PARAMETER"
17513 ><I
17514 >client
17515                 code page</I
17516 ></TT
17517 ></A
17518 > parameter.</P
17519 ><P
17520 >Default: <EM
17521 >Samba defaults to using a reasonable set
17522                 of valid characters for English systems</EM
17523 ></P
17524 ><P
17525 >Example: <B
17526 CLASS="COMMAND"
17527 >valid chars = 0345:0305 0366:0326 0344:0304
17528                 </B
17529 ></P
17530 ><P
17531 >The above example allows filenames to have the Swedish
17532                 characters in them.</P
17533 ><P
17534 ><EM
17535 >NOTE:</EM
17536 > It is actually quite difficult to
17537                 correctly produce a <TT
17538 CLASS="PARAMETER"
17539 ><I
17540 >valid chars</I
17541 ></TT
17542 > line for
17543                 a particular system. To automate the process <A
17544 HREF="mailto:tino@augsburg.net"
17545 TARGET="_top"
17546 >tino@augsburg.net</A
17547 > has written
17548                 a package called <B
17549 CLASS="COMMAND"
17550 >validchars</B
17551 > which will automatically
17552                 produce a complete <TT
17553 CLASS="PARAMETER"
17554 ><I
17555 >valid chars</I
17556 ></TT
17557 > line for
17558                 a given client system. Look in the <TT
17559 CLASS="FILENAME"
17560 >examples/validchars/
17561                 </TT
17562 > subdirectory of your Samba source code distribution
17563                 for this package.</P
17564 ></DD
17565 ><DT
17566 ><A
17567 NAME="VALIDUSERS"
17568 ></A
17569 >valid users (S)</DT
17570 ><DD
17571 ><P
17572 >This is a list of users that should be allowed
17573                 to login to this service. Names starting with '@', '+' and  '&#38;'
17574                 are interpreted using the same rules as described in the
17575                 <TT
17576 CLASS="PARAMETER"
17577 ><I
17578 >invalid users</I
17579 ></TT
17580 > parameter.</P
17581 ><P
17582 >If this is empty (the default) then any user can login.
17583                 If a username is in both this list and the <TT
17584 CLASS="PARAMETER"
17585 ><I
17586 >invalid
17587                 users</I
17588 ></TT
17589 > list then access is denied for that user.</P
17590 ><P
17591 >The current servicename is substituted for <TT
17592 CLASS="PARAMETER"
17593 ><I
17594 >%S
17595                 </I
17596 ></TT
17597 >. This is useful in the [homes] section.</P
17598 ><P
17599 >See also <A
17600 HREF="#INVALIDUSERS"
17601 ><TT
17602 CLASS="PARAMETER"
17603 ><I
17604 >invalid users
17605                 </I
17606 ></TT
17607 ></A
17608 ></P
17609 ><P
17610 >Default: <EM
17611 >No valid users list (anyone can login)
17612                 </EM
17613 ></P
17614 ><P
17615 >Example: <B
17616 CLASS="COMMAND"
17617 >valid users = greg, @pcusers</B
17618 ></P
17619 ></DD
17620 ><DT
17621 ><A
17622 NAME="VETOFILES"
17623 ></A
17624 >veto files(S)</DT
17625 ><DD
17626 ><P
17627 >This is a list of files and directories that
17628                 are neither visible nor accessible.  Each entry in the list must
17629                 be separated by a '/', which allows spaces to be included
17630                 in the entry. '*' and '?' can be used to specify multiple files
17631                 or directories as in DOS wildcards.</P
17632 ><P
17633 >Each entry must be a unix path, not a DOS path and
17634                 must <EM
17635 >not</EM
17636 > include the  unix directory
17637                 separator '/'.</P
17638 ><P
17639 >Note that the <TT
17640 CLASS="PARAMETER"
17641 ><I
17642 >case sensitive</I
17643 ></TT
17644 > option
17645                 is applicable in vetoing files.</P
17646 ><P
17647 >One feature of the veto files parameter that it is important
17648                 to be aware of, is that if a directory contains nothing but files
17649                 that match the veto files parameter (which means that Windows/DOS
17650                 clients cannot ever see them) is deleted, the veto files within
17651                 that directory <EM
17652 >are automatically deleted</EM
17653 > along
17654                 with it, if the user has UNIX permissions to do so.</P
17655 ><P
17656 >Setting this parameter will affect the performance
17657                 of Samba, as it will be forced to check all files and directories
17658                 for a match as they are scanned.</P
17659 ><P
17660 >See also <A
17661 HREF="#HIDEFILES"
17662 ><TT
17663 CLASS="PARAMETER"
17664 ><I
17665 >hide files
17666                 </I
17667 ></TT
17668 ></A
17669 > and <A
17670 HREF="#CASESENSITIVE"
17671 ><TT
17672 CLASS="PARAMETER"
17673 ><I
17674 >               case sensitive</I
17675 ></TT
17676 ></A
17677 >.</P
17678 ><P
17679 >Default: <EM
17680 >No files or directories are vetoed.
17681                 </EM
17682 ></P
17683 ><P
17684 >Examples:<TABLE
17685 BORDER="0"
17686 BGCOLOR="#E0E0E0"
17687 WIDTH="90%"
17688 ><TR
17689 ><TD
17690 ><PRE
17691 CLASS="PROGRAMLISTING"
17692 >          ; Veto any files containing the word Security,
17693         ; any ending in .tmp, and any directory containing the
17694         ; word root.
17695                 veto files = /*Security*/*.tmp/*root*/
17696
17697                 ; Veto the Apple specific files that a NetAtalk server
17698         ; creates.
17699                 veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/
17700                 </PRE
17701 ></TD
17702 ></TR
17703 ></TABLE
17704 ></P
17705 ></DD
17706 ><DT
17707 ><A
17708 NAME="VETOOPLOCKFILES"
17709 ></A
17710 >veto oplock files (S)</DT
17711 ><DD
17712 ><P
17713 >This parameter is only valid when the <A
17714 HREF="#OPLOCKS"
17715 ><TT
17716 CLASS="PARAMETER"
17717 ><I
17718 >oplocks</I
17719 ></TT
17720 ></A
17721 >
17722                 parameter is turned on for a share. It allows the Samba administrator
17723                 to selectively turn off the granting of oplocks on selected files that
17724                 match a wildcarded list, similar to the wildcarded list used in the
17725                 <A
17726 HREF="#VETOFILES"
17727 ><TT
17728 CLASS="PARAMETER"
17729 ><I
17730 >veto files</I
17731 ></TT
17732 ></A
17733 >
17734                 parameter.</P
17735 ><P
17736 >Default: <EM
17737 >No files are vetoed for oplock
17738                 grants</EM
17739 ></P
17740 ><P
17741 >You might want to do this on files that you know will
17742                 be heavily contended for by clients. A good example of this
17743                 is in the NetBench SMB benchmark program, which causes heavy
17744                 client contention for files ending in <TT
17745 CLASS="FILENAME"
17746 >.SEM</TT
17747 >.
17748                 To cause Samba not to grant oplocks on these files you would use
17749                 the line (either in the [global] section or in the section for
17750                 the particular NetBench share :</P
17751 ><P
17752 >Example: <B
17753 CLASS="COMMAND"
17754 >veto oplock files = /*;.SEM/
17755                 </B
17756 ></P
17757 ></DD
17758 ><DT
17759 ><A
17760 NAME="VFSOBJECT"
17761 ></A
17762 >vfs object (S)</DT
17763 ><DD
17764 ><P
17765 >This parameter specifies a shared object file that
17766                 is used for Samba VFS I/O operations.  By default, normal
17767                 disk I/O operations are used but these can be overloaded
17768                 with a VFS object.  The Samba VFS layer is new to Samba 2.2 and
17769                 must be enabled at compile time with --with-vfs.</P
17770 ><P
17771 >Default : <EM
17772 >no value</EM
17773 ></P
17774 ></DD
17775 ><DT
17776 ><A
17777 NAME="VFSOPTIONS"
17778 ></A
17779 >vfs options (S)</DT
17780 ><DD
17781 ><P
17782 >This parameter allows parameters to be passed
17783                 to the vfs layer at initialisation time.  The Samba VFS layer
17784                 is new to Samba 2.2 and must be enabled at compile time
17785                 with --with-vfs.  See also <A
17786 HREF="#VFSOBJECT"
17787 ><TT
17788 CLASS="PARAMETER"
17789 ><I
17790 >               vfs object</I
17791 ></TT
17792 ></A
17793 >.</P
17794 ><P
17795 >Default : <EM
17796 >no value</EM
17797 ></P
17798 ></DD
17799 ><DT
17800 ><A
17801 NAME="VOLUME"
17802 ></A
17803 >volume (S)</DT
17804 ><DD
17805 ><P
17806 > This allows you to override the volume label
17807                 returned for a share. Useful for CDROMs with installation programs
17808                 that insist on a particular volume label.</P
17809 ><P
17810 >Default: <EM
17811 >the name of the share</EM
17812 ></P
17813 ></DD
17814 ><DT
17815 ><A
17816 NAME="WIDELINKS"
17817 ></A
17818 >wide links (S)</DT
17819 ><DD
17820 ><P
17821 >This parameter controls whether or not links
17822                 in the UNIX file system may be followed by the server. Links
17823                 that point to areas within the directory tree exported by the
17824                 server are always allowed; this parameter controls access only
17825                 to areas that are outside the directory tree being exported.</P
17826 ><P
17827 >Note that setting this parameter can have a negative
17828                 effect on your server performance due to the extra system calls
17829                 that Samba has to  do in order to perform the link checks.</P
17830 ><P
17831 >Default: <B
17832 CLASS="COMMAND"
17833 >wide links = yes</B
17834 ></P
17835 ></DD
17836 ><DT
17837 ><A
17838 NAME="WINBINDCACHETIME"
17839 ></A
17840 >winbind cache time</DT
17841 ><DD
17842 ><P
17843 ><EM
17844 >NOTE:</EM
17845 > this parameter is only
17846                 available in Samba 3.0.</P
17847 ><P
17848 >This parameter specifies the number of seconds the
17849                 <A
17850 HREF="winbindd.8.html"
17851 TARGET="_top"
17852 >winbindd(8)</A
17853 > daemon will cache
17854                 user and group information before querying a Windows NT server
17855                 again.</P
17856 ><P
17857 >Default: <B
17858 CLASS="COMMAND"
17859 >winbind cache type = 15</B
17860 ></P
17861 ></DD
17862 ><DT
17863 ><A
17864 NAME="WINBINDGID"
17865 ></A
17866 >winbind gid</DT
17867 ><DD
17868 ><P
17869 ><EM
17870 >NOTE:</EM
17871 > this parameter is only
17872                 available in Samba 3.0.</P
17873 ><P
17874 >The winbind gid parameter specifies the range of group
17875                 ids that are allocated by the <A
17876 HREF="winbindd.8.html"
17877 TARGET="_top"
17878 >               winbindd(8)</A
17879 > daemon.  This range of group ids should have no
17880                 existing local or nis groups within it as strange conflicts can
17881                 occur otherwise.</P
17882 ><P
17883 >Default: <B
17884 CLASS="COMMAND"
17885 >winbind gid = &#60;empty string&#62;
17886                 </B
17887 ></P
17888 ><P
17889 >Example: <B
17890 CLASS="COMMAND"
17891 >winbind gid = 10000-20000</B
17892 ></P
17893 ></DD
17894 ><DT
17895 ><A
17896 NAME="WINBINDSEPARATOR"
17897 ></A
17898 >winbind separator</DT
17899 ><DD
17900 ><P
17901 ><EM
17902 >NOTE:</EM
17903 > this parameter is only
17904                 available in Samba 3.0.</P
17905 ><P
17906 >This parameter allows an admin to define the character
17907                 used when listing a username of the form of <TT
17908 CLASS="REPLACEABLE"
17909 ><I
17910 >DOMAIN
17911                 </I
17912 ></TT
17913 >\<TT
17914 CLASS="REPLACEABLE"
17915 ><I
17916 >user</I
17917 ></TT
17918 >.  This parameter
17919                 is only applicable when using the <TT
17920 CLASS="FILENAME"
17921 >pam_winbind.so</TT
17922 >
17923                 and <TT
17924 CLASS="FILENAME"
17925 >nss_winbind.so</TT
17926 > modules for UNIX services.
17927                 </P
17928 ><P
17929 >Example: <B
17930 CLASS="COMMAND"
17931 >winbind separator = \</B
17932 ></P
17933 ><P
17934 >Example: <B
17935 CLASS="COMMAND"
17936 >winbind separator = +</B
17937 ></P
17938 ></DD
17939 ><DT
17940 ><A
17941 NAME="WINBINDUID"
17942 ></A
17943 >winbind uid</DT
17944 ><DD
17945 ><P
17946 ><EM
17947 >NOTE:</EM
17948 > this parameter is only
17949                 available in Samba 3.0.</P
17950 ><P
17951 >The winbind gid parameter specifies the range of group
17952                 ids that are allocated by the <A
17953 HREF="winbindd.8.html"
17954 TARGET="_top"
17955 >               winbindd(8)</A
17956 > daemon.  This range of ids should have no
17957                 existing local or nis users within it as strange conflicts can
17958                 occur otherwise.</P
17959 ><P
17960 >Default: <B
17961 CLASS="COMMAND"
17962 >winbind uid = &#60;empty string&#62;
17963                 </B
17964 ></P
17965 ><P
17966 >Example: <B
17967 CLASS="COMMAND"
17968 >winbind uid = 10000-20000</B
17969 ></P
17970 ></DD
17971 ><DT
17972 ><A
17973 NAME="WINSHOOK"
17974 ></A
17975 >wins hook (G)</DT
17976 ><DD
17977 ><P
17978 >When Samba is running as a WINS server this
17979                 allows you to call an external program for all changes to the
17980                 WINS database. The primary use for this option is to allow the
17981                 dynamic update of external name resolution databases such as
17982                 dynamic DNS.</P
17983 ><P
17984 >The wins hook parameter specifies the name of a script
17985                 or executable that will be called as follows:</P
17986 ><P
17987 ><B
17988 CLASS="COMMAND"
17989 >wins_hook operation name nametype ttl IP_list
17990                 </B
17991 ></P
17992 ><P
17993 ></P
17994 ><UL
17995 ><LI
17996 ><P
17997 >The first argument is the operation and is one
17998                         of "add", "delete", or "refresh". In most cases the operation can
17999                         be ignored as the rest of the parameters provide sufficient
18000                         information. Note that "refresh" may sometimes be called when the
18001                         name has not previously been added, in that case it should be treated
18002                         as an add.</P
18003 ></LI
18004 ><LI
18005 ><P
18006 >The second argument is the netbios name. If the
18007                         name is not a legal name then the wins hook is not called.
18008                         Legal names contain only  letters, digits, hyphens, underscores
18009                         and periods.</P
18010 ></LI
18011 ><LI
18012 ><P
18013 >The third argument is the netbios name
18014                         type as a 2 digit hexadecimal number. </P
18015 ></LI
18016 ><LI
18017 ><P
18018 >The fourth argument is the TTL (time to live)
18019                         for the name in seconds.</P
18020 ></LI
18021 ><LI
18022 ><P
18023 >The fifth and subsequent arguments are the IP
18024                         addresses currently registered for that name. If this list is
18025                         empty then the name should be deleted.</P
18026 ></LI
18027 ></UL
18028 ><P
18029 >An example script that calls the BIND dynamic DNS update
18030                 program <B
18031 CLASS="COMMAND"
18032 >nsupdate</B
18033 > is provided in the examples
18034                 directory of the Samba source code. </P
18035 ></DD
18036 ><DT
18037 ><A
18038 NAME="WINSPROXY"
18039 ></A
18040 >wins proxy (G)</DT
18041 ><DD
18042 ><P
18043 >This is a boolean that controls if <A
18044 HREF="nmbd.8.html"
18045 TARGET="_top"
18046 >nmbd(8)</A
18047 > will respond to broadcast name
18048                 queries on behalf of  other hosts. You may need to set this
18049                 to <TT
18050 CLASS="CONSTANT"
18051 >yes</TT
18052 > for some older clients.</P
18053 ><P
18054 >Default: <B
18055 CLASS="COMMAND"
18056 >wins proxy = no</B
18057 ></P
18058 ></DD
18059 ><DT
18060 ><A
18061 NAME="WINSSERVER"
18062 ></A
18063 >wins server (G)</DT
18064 ><DD
18065 ><P
18066 >This specifies the IP address (or DNS name: IP
18067                 address for preference) of the WINS server that <A
18068 HREF="nmbd.8.html"
18069 TARGET="_top"
18070 >               nmbd(8)</A
18071 > should register with. If you have a WINS server on
18072                 your network then you should set this to the WINS server's IP.</P
18073 ><P
18074 >You should point this at your WINS server if you have a
18075                 multi-subnetted network.</P
18076 ><P
18077 ><EM
18078 >NOTE</EM
18079 >. You need to set up Samba to point
18080                 to a WINS server if you have multiple subnets and wish cross-subnet
18081                 browsing to work correctly.</P
18082 ><P
18083 >See the documentation file <TT
18084 CLASS="FILENAME"
18085 >BROWSING.txt</TT
18086 >
18087                 in the docs/ directory of your Samba source distribution.</P
18088 ><P
18089 >Default: <EM
18090 >not enabled</EM
18091 ></P
18092 ><P
18093 >Example: <B
18094 CLASS="COMMAND"
18095 >wins server = 192.9.200.1</B
18096 ></P
18097 ></DD
18098 ><DT
18099 ><A
18100 NAME="WINSSUPPORT"
18101 ></A
18102 >wins support (G)</DT
18103 ><DD
18104 ><P
18105 >This boolean controls if the <A
18106 HREF="nmbd.8.html"
18107 TARGET="_top"
18108 >
18109                 nmbd(8)</A
18110 > process in Samba will act as a WINS server. You should
18111                 not set this to true unless you have a multi-subnetted network and
18112                 you wish a particular <B
18113 CLASS="COMMAND"
18114 >nmbd</B
18115 > to be your WINS server.
18116                 Note that you should <EM
18117 >NEVER</EM
18118 > set this to true
18119                 on more than one machine in your network.</P
18120 ><P
18121 >Default: <B
18122 CLASS="COMMAND"
18123 >wins support = no</B
18124 ></P
18125 ></DD
18126 ><DT
18127 ><A
18128 NAME="WORKGROUP"
18129 ></A
18130 >workgroup (G)</DT
18131 ><DD
18132 ><P
18133 >This controls what workgroup your server will
18134                 appear to be in when queried by clients. Note that this parameter
18135                 also controls the Domain name used with the <A
18136 HREF="#SECURITYEQUALSDOMAIN"
18137 ><B
18138 CLASS="COMMAND"
18139 >security=domain</B
18140 ></A
18141 >
18142                 setting.</P
18143 ><P
18144 >Default: <EM
18145 >set at compile time to WORKGROUP</EM
18146 ></P
18147 ><P
18148 >Example: <B
18149 CLASS="COMMAND"
18150 >workgroup = MYGROUP</B
18151 ></P
18152 ></DD
18153 ><DT
18154 ><A
18155 NAME="WRITABLE"
18156 ></A
18157 >writable (S)</DT
18158 ><DD
18159 ><P
18160 >Synonym for <A
18161 HREF="#WRITEABLE"
18162 ><TT
18163 CLASS="PARAMETER"
18164 ><I
18165 >               writeable</I
18166 ></TT
18167 ></A
18168 > for people who can't spell :-).</P
18169 ></DD
18170 ><DT
18171 ><A
18172 NAME="WRITECACHESIZE"
18173 ></A
18174 >write cache size (S)</DT
18175 ><DD
18176 ><P
18177 >If this integer parameter is set to non-zero value,
18178                 Samba will create an in-memory cache for each oplocked file
18179                 (it does <EM
18180 >not</EM
18181 > do this for
18182                 non-oplocked files). All writes that the client does not request
18183                 to be flushed directly to disk will be stored in this cache if possible.
18184                 The cache is flushed onto disk when a write comes in whose offset
18185                 would not fit into the cache or when the file is closed by the client.
18186                 Reads for the file are also served from this cache if the data is stored
18187                 within it.</P
18188 ><P
18189 >This cache allows Samba to batch client writes into a more
18190                 efficient write size for RAID disks (ie. writes may be tuned to
18191                 be the RAID stripe size) and can improve performance on systems
18192                 where the disk subsystem is a bottleneck but there is free
18193                 memory for userspace programs.</P
18194 ><P
18195 >The integer parameter specifies the size of this cache
18196                 (per oplocked file) in bytes.</P
18197 ><P
18198 >Default: <B
18199 CLASS="COMMAND"
18200 >write cache size = 0</B
18201 ></P
18202 ><P
18203 >Example: <B
18204 CLASS="COMMAND"
18205 >write cache size = 262144</B
18206 ></P
18207 ><P
18208 >for a 256k cache size per file.</P
18209 ></DD
18210 ><DT
18211 ><A
18212 NAME="WRITELIST"
18213 ></A
18214 >write list (S)</DT
18215 ><DD
18216 ><P
18217 >This is a list of users that are given read-write
18218                 access to a service. If the connecting user is in this list then
18219                 they will be given write access, no matter what the <A
18220 HREF="#WRITEABLE"
18221 ><TT
18222 CLASS="PARAMETER"
18223 ><I
18224 >writeable</I
18225 ></TT
18226 ></A
18227 >
18228                 option is set to. The list can include group names using the
18229                 @group syntax.</P
18230 ><P
18231 >Note that if a user is in both the read list and the
18232                 write list then they will be given write access.</P
18233 ><P
18234 >See also the <A
18235 HREF="#READLIST"
18236 ><TT
18237 CLASS="PARAMETER"
18238 ><I
18239 >read list
18240                 </I
18241 ></TT
18242 ></A
18243 > option.</P
18244 ><P
18245 >Default: <B
18246 CLASS="COMMAND"
18247 >write list = &#60;empty string&#62;
18248                 </B
18249 ></P
18250 ><P
18251 >Example: <B
18252 CLASS="COMMAND"
18253 >write list = admin, root, @staff
18254                 </B
18255 ></P
18256 ></DD
18257 ><DT
18258 ><A
18259 NAME="WRITEOK"
18260 ></A
18261 >write ok (S)</DT
18262 ><DD
18263 ><P
18264 >Synonym for <A
18265 HREF="#WRITEABLE"
18266 ><TT
18267 CLASS="PARAMETER"
18268 ><I
18269 >               writeable</I
18270 ></TT
18271 ></A
18272 >.</P
18273 ></DD
18274 ><DT
18275 ><A
18276 NAME="WRITERAW"
18277 ></A
18278 >write raw (G)</DT
18279 ><DD
18280 ><P
18281 >This parameter controls whether or not the server
18282                 will support raw writes SMB's when transferring data from clients.
18283                 You should never need to change this parameter.</P
18284 ><P
18285 >Default: <B
18286 CLASS="COMMAND"
18287 >write raw = yes</B
18288 ></P
18289 ></DD
18290 ><DT
18291 ><A
18292 NAME="WRITEABLE"
18293 ></A
18294 >writeable (S)</DT
18295 ><DD
18296 ><P
18297 >An inverted synonym is <A
18298 HREF="#READONLY"
18299 >               <TT
18300 CLASS="PARAMETER"
18301 ><I
18302 >read only</I
18303 ></TT
18304 ></A
18305 >.</P
18306 ><P
18307 >If this parameter is <TT
18308 CLASS="CONSTANT"
18309 >no</TT
18310 >, then users
18311                 of a service may not create or modify files in the service's
18312                 directory.</P
18313 ><P
18314 >Note that a printable service (<B
18315 CLASS="COMMAND"
18316 >printable = yes</B
18317 >)
18318                 will <EM
18319 >ALWAYS</EM
18320 > allow writing to the directory
18321                 (user privileges permitting), but only via spooling operations.</P
18322 ><P
18323 >Default: <B
18324 CLASS="COMMAND"
18325 >writeable = no</B
18326 ></P
18327 ></DD
18328 ></DL
18329 ></DIV
18330 ></DIV
18331 ><DIV
18332 CLASS="REFSECT1"
18333 ><A
18334 NAME="AEN5791"
18335 ></A
18336 ><H2
18337 >WARNINGS</H2
18338 ><P
18339 >Although the configuration file permits service names
18340         to contain spaces, your client software may not. Spaces will
18341         be ignored in comparisons anyway, so it shouldn't be a
18342         problem - but be aware of the possibility.</P
18343 ><P
18344 >On a similar note, many clients - especially DOS clients -
18345         limit service names to eight characters. <A
18346 HREF="smbd.8.html"
18347 TARGET="_top"
18348 >smbd(8)
18349         </A
18350 > has no such limitation, but attempts to connect from such
18351         clients will fail if they truncate the service names.  For this reason
18352         you should probably keep your service names down to eight characters
18353         in length.</P
18354 ><P
18355 >Use of the [homes] and [printers] special sections make life
18356         for an administrator easy, but the various combinations of default
18357         attributes can be tricky. Take extreme care when designing these
18358         sections. In particular, ensure that the permissions on spool
18359         directories are correct.</P
18360 ></DIV
18361 ><DIV
18362 CLASS="REFSECT1"
18363 ><A
18364 NAME="AEN5797"
18365 ></A
18366 ><H2
18367 >VERSION</H2
18368 ><P
18369 >This man page is correct for version 2.2 of
18370         the Samba suite.</P
18371 ></DIV
18372 ><DIV
18373 CLASS="REFSECT1"
18374 ><A
18375 NAME="AEN5800"
18376 ></A
18377 ><H2
18378 >SEE ALSO</H2
18379 ><P
18380 ><A
18381 HREF="samba.7.html"
18382 TARGET="_top"
18383 >samba(7)</A
18384 >,
18385         <A
18386 HREF="smbpasswd.8.html"
18387 TARGET="_top"
18388 ><B
18389 CLASS="COMMAND"
18390 >smbpasswd(8)</B
18391 ></A
18392 >,
18393         <A
18394 HREF="swat.8.html"
18395 TARGET="_top"
18396 ><B
18397 CLASS="COMMAND"
18398 >swat(8)</B
18399 ></A
18400 >,
18401         <A
18402 HREF="smbd.8.html"
18403 TARGET="_top"
18404 ><B
18405 CLASS="COMMAND"
18406 >smbd(8)</B
18407 ></A
18408 >,
18409         <A
18410 HREF="nmbd.8.html"
18411 TARGET="_top"
18412 ><B
18413 CLASS="COMMAND"
18414 >nmbd(8)</B
18415 ></A
18416 >,
18417         <A
18418 HREF="smbclient.1.html"
18419 TARGET="_top"
18420 ><B
18421 CLASS="COMMAND"
18422 >smbclient(1)</B
18423 ></A
18424 >,
18425         <A
18426 HREF="nmblookup.1.html"
18427 TARGET="_top"
18428 ><B
18429 CLASS="COMMAND"
18430 >nmblookup(1)</B
18431 ></A
18432 >,
18433         <A
18434 HREF="testparm.1.html"
18435 TARGET="_top"
18436 ><B
18437 CLASS="COMMAND"
18438 >testparm(1)</B
18439 ></A
18440 >,
18441         <A
18442 HREF="testprns.1.html"
18443 TARGET="_top"
18444 ><B
18445 CLASS="COMMAND"
18446 >testprns(1)</B
18447 ></A
18448 >
18449         </P
18450 ></DIV
18451 ><DIV
18452 CLASS="REFSECT1"
18453 ><A
18454 NAME="AEN5820"
18455 ></A
18456 ><H2
18457 >AUTHOR</H2
18458 ><P
18459 >The original Samba software and related utilities
18460         were created by Andrew Tridgell. Samba is now developed
18461         by the Samba Team as an Open Source project similar
18462         to the way the Linux kernel is developed.</P
18463 ><P
18464 >The original Samba man pages were written by Karl Auer.
18465         The man page sources were converted to YODL format (another
18466         excellent piece of Open Source software, available at
18467         <A
18468 HREF="ftp://ftp.icce.rug.nl/pub/unix/"
18469 TARGET="_top"
18470 >       ftp://ftp.icce.rug.nl/pub/unix/</A
18471 >) and updated for the Samba 2.0
18472         release by Jeremy Allison.  The conversion to DocBook for
18473         Samba 2.2 was done by Gerald Carter</P
18474 ></DIV
18475 ></BODY
18476 ></HTML
18477 >