7 CONTENT=
"Modular DocBook HTML Stylesheet Version 1.57"></HEAD
27 >smb.conf
--
The configuration file for the Samba suite
</DIV
39 > file is a configuration
40 file for the Samba suite.
<TT
44 runtime configuration information for the Samba programs. The
48 > file is designed to be configured and
49 administered by the
<A
57 > program. The complete description of the file format and
58 possible parameters held within are here for reference purposes.
</P
68 >The file consists of sections and parameters. A section
69 begins with the name of the section in square brackets and continues
70 until the next section begins. Sections contain parameters of the
86 >The file is line-based - that is, each newline-terminated
87 line represents either a comment, a section name or a parameter.
</P
89 >Section and parameter names are not case sensitive.
</P
91 >Only the first equals sign in a parameter is significant.
92 Whitespace before or after the first equals sign is discarded.
93 Leading, trailing and internal whitespace in section and parameter
94 names is irrelevant. Leading and trailing whitespace in a parameter
95 value is discarded. Internal whitespace within a parameter value
96 is retained verbatim.
</P
98 >Any line beginning with a semicolon (';') or a hash ('#')
99 character is ignored, as are lines containing only whitespace.
</P
101 >Any line ending in a '\' is continued
102 on the next line in the customary UNIX fashion.
</P
104 >The values following the equals sign in parameters are all
105 either a string (no quotes needed) or a boolean, which may be given
106 as yes/no,
0/
1 or true/false. Case is not significant in boolean
107 values, but is preserved in string values. Some items such as
108 create modes are numeric.
</P
116 >SECTION DESCRIPTIONS
</H2
118 >Each section in the configuration file (except for the
119 [global] section) describes a shared resource (known
120 as a
"share"). The section name is the name of the
121 shared resource and the parameters within the section define
122 the shares attributes.
</P
124 >There are three special sections, [global],
125 [homes] and [printers], which are
130 following notes apply to ordinary section descriptions.
</P
132 >A share consists of a directory to which access is being
133 given plus a description of the access rights which are granted
134 to the user of the service. Some housekeeping options are
137 >Sections are either file share services (used by the
138 client as an extension of their native file systems) or
139 printable services (used by the client to access print services
140 on the host running the server).
</P
142 >Sections may be designated
<I
146 in which case no password is required to access them. A specified
150 > is used to define access
151 privileges in this case.
</P
153 >Sections other than guest services will require a password
154 to access them. The client provides the username. As older clients
155 only provide passwords and not usernames, you may specify a list
156 of usernames to check against the password using the
"user="
157 option in the share definition. For modern clients such as
158 Windows
95/
98/ME/NT/
2000, this should not be necessary.
</P
160 >Note that the access rights granted by the server are
161 masked by the access rights granted to the specified or guest
162 UNIX user by the host system. The server does not grant more
163 access than the host system grants.
</P
165 >The following sample section defines a file space share.
166 The user has write access to the path
<TT
170 The share is accessed via the share name
"foo":
</P
174 CLASS=
"COMPUTEROUTPUT"
182 >The following sample section defines a printable share.
183 The share is readonly, but printable. That is, the only write
184 access permitted is via calls to open, write to and close a
189 access will be permitted as the default guest user (specified
194 CLASS=
"COMPUTEROUTPUT"
196 path = /usr/spool/public
210 >SPECIAL SECTIONS
</H2
217 >The [global] section
</H3
219 >parameters in this section apply to the server
220 as a whole, or are defaults for sections which do not
221 specifically define certain items. See the notes
222 under PARAMETERS for more information.
</P
230 >The [homes] section
</H3
232 >If a section called homes is included in the
233 configuration file, services connecting clients to their
234 home directories can be created on the fly by the server.
</P
236 >When the connection request is made, the existing
237 sections are scanned. If a match is found, it is used. If no
238 match is found, the requested section name is treated as a
239 user name and looked up in the local password file. If the
240 name exists and the correct password has been given, a share is
241 created by cloning the [homes] section.
</P
243 >Some modifications are then made to the newly
250 >The share name is changed from homes to
251 the located username.
</P
255 >If no path was given, the path is set to
256 the user's home directory.
</P
260 >If you decide to use a
<I
264 in your [homes] section then you may find it useful
265 to use the %S macro. For example :
</P
270 >path=/data/pchome/%S
</B
274 >would be useful if you have different home directories
275 for your PCs than for UNIX access.
</P
277 >This is a fast and simple way to give a large number
278 of clients access to their home directories with a minimum
281 >A similar process occurs if the requested section
282 name is
"homes", except that the share name is not
283 changed to that of the requesting user. This method of using
284 the [homes] section works well if different users share
287 >The [homes] section can specify all the parameters
288 a normal service section can specify, though some make more sense
289 than others. The following is a typical and suitable [homes]
294 CLASS=
"COMPUTEROUTPUT"
301 >An important point is that if guest access is specified
302 in the [homes] section, all home directories will be
303 visible to all clients
<I
305 >without a password
</I
307 In the very unlikely event that this is actually desirable, it
308 would be wise to also specify
<I
318 auto home directories will be inherited from the global browseable
319 flag, not the [homes] browseable flag. This is useful as
320 it means setting browseable=no in the [homes] section
321 will hide the [homes] share but make any auto home
322 directories visible.
</P
330 >The [printers] section
</H3
332 >This section works like [homes],
335 >If a [printers] section occurs in the
336 configuration file, users are able to connect to any printer
337 specified in the local host's printcap file.
</P
339 >When a connection request is made, the existing sections
340 are scanned. If a match is found, it is used. If no match is found,
341 but a [homes] section exists, it is used as described
342 above. Otherwise, the requested section name is treated as a
343 printer name and the appropriate printcap file is scanned to see
344 if the requested section name is a valid printer share name. If
345 a match is found, a new printer share is created by cloning
346 the [printers] section.
</P
348 >A few modifications are then made to the newly created
355 >The share name is set to the located printer
360 >If no printer name was given, the printer name
361 is set to the located printer name
</P
365 >If the share does not permit guest access and
366 no username was given, the username is set to the located
371 >Note that the [printers] service MUST be
372 printable - if you specify otherwise, the server will refuse
373 to load the configuration file.
</P
375 >Typically the path specified would be that of a
376 world-writeable spool directory with the sticky bit set on
377 it. A typical [printers] entry would look like
382 CLASS=
"COMPUTEROUTPUT"
384 path = /usr/spool/public
390 >All aliases given for a printer in the printcap file
391 are legitimate printer names as far as the server is concerned.
392 If your printing subsystem doesn't work like that, you will have
393 to set up a pseudo-printcap. This is a file consisting of one or
394 more lines like this:
</P
398 CLASS=
"COMPUTEROUTPUT"
399 > alias|alias|alias|alias...
404 >Each alias should be an acceptable printer name for
405 your printing subsystem. In the [global] section, specify
406 the new file as your printcap. The server will then only recognize
407 names found in your pseudo-printcap, which of course can contain
408 whatever aliases you like. The same technique could be used
409 simply to limit access to a subset of your local printers.
</P
411 >An alias, by the way, is defined as any component of the
412 first entry of a printcap record. Records are separated by newlines,
413 components (if there are more than one) are separated by vertical
414 bar symbols ('|').
</P
416 >NOTE: On SYSV systems which use lpstat to determine what
417 printers are defined on the system you may be able to use
418 "printcap name = lpstat" to automatically obtain a list
419 of printers. See the
"printcap name" option
431 >parameters define the specific attributes of sections.
</P
433 >Some parameters are specific to the [global] section
437 >). Some parameters are usable
438 in all sections (e.g.,
<I
442 are permissible only in normal sections. For the purposes of the
443 following descriptions the [homes] and [printers]
444 sections will be considered normal. The letter
<I
448 in parentheses indicates that a parameter is specific to the
449 [global] section. The letter
<I
453 indicates that a parameter can be specified in a service specific
454 section. Note that all
<I
457 > parameters can also be specified in
458 the [global] section - in which case they will define
459 the default behavior for all services.
</P
461 >parameters are arranged here in alphabetical order - this may
462 not create best bedfellows, but at least you can find them! Where
463 there are synonyms, the preferred synonym is described, others refer
464 to the preferred synonym.
</P
472 >VARIABLE SUBSTITUTIONS
</H2
474 >Many of the strings that are settable in the config file
475 can take substitutions. For example the option
"path =
476 /tmp/%u" would be interpreted as
"path =
477 /tmp/john" if the user connected with the username john.
</P
479 >These substitutions are mostly noted in the descriptions below,
480 but there are some general substitutions which apply whenever they
481 might be relevant. These are:
</P
491 >the name of the current service, if any.
</P
497 >the root directory of the current service,
504 >user name of the current service, if any.
</P
510 >primary group name of %u.
</P
516 >session user name (the user name that the client
517 wanted, not necessarily the same as the one they got).
</P
523 >primary group name of %U.
</P
529 >the home directory of the user given
536 >the Samba version.
</P
542 >the Internet hostname that Samba is running
549 >the NetBIOS name of the client machine
556 >the NetBIOS name of the server. This allows you
557 to change your config based on what the client calls you. Your
558 server can have a
"dual personality".
</P
564 >the Internet name of the client machine.
571 >the name of your NIS home directory server.
572 This is obtained from your NIS auto.map entry. If you have
573 not compiled Samba with the
<I
577 option then this value will be the same as %.
</P
583 >the path of the service's home directory,
584 obtained from your NIS auto.map entry. The NIS auto.map entry
585 is split up as
"%N:%p".
</P
591 >the selected protocol level after
592 protocol negotiation. It can be one of CORE, COREPLUS,
593 LANMAN1, LANMAN2 or NT1.
</P
599 >The process id of the current server
606 >the architecture of the remote
607 machine. Only some are recognized, and those may not be
608 100% reliable. It currently recognizes Samba, WfWg,
609 WinNT and Win95. Anything else will be known as
610 "UNKNOWN". If it gets it wrong then sending a level
612 HREF=
"mailto:samba@samba.org"
616 > should allow it to be fixed.
</P
622 >The IP address of the client machine.
</P
628 >the current date and time.
</P
639 >The value of the environment variable
650 >There are some quite creative things that can be done
651 with these substitutions and other smb.conf options.
</P
661 >Samba supports
"name mangling" so that DOS and
662 Windows clients can use files that don't conform to the
8.3 format.
663 It can also be set to adjust the case of
8.3 format filenames.
</P
665 >There are several options that control the way mangling is
666 performed, and they are grouped here rather than listed separately.
667 For the defaults look at the output of the testparm program.
</P
669 >All of these options can be set separately for each service
670 (or globally, of course).
</P
672 >The options are:
</P
679 >mangle case= yes/no
</DT
682 > controls if names that have characters that
683 aren't of the
"default" case are mangled. For example,
684 if this is yes then a name like
"Mail" would be mangled.
691 >case sensitive = yes/no
</DT
694 >controls whether filenames are case sensitive. If
695 they aren't then Samba must do a filename search and match on passed
702 >default case = upper/lower
</DT
705 >controls what the default case is for new
706 filenames. Default
<I
712 >preserve case = yes/no
</DT
715 >controls if new files are created with the
716 case that the client passes, or if they are forced to be the
717 "default" case. Default
<I
724 >short preserve case = yes/no
</DT
727 >controls if new files which conform to
8.3 syntax,
728 that is all in upper case and of suitable length, are created
729 upper case, or if they are forced to be the
"default"
730 case. This option can be use with
"preserve case = yes"
731 to permit long filenames to retain their case, while short names
732 are lowered. Default
<I
740 >By default, Samba
2.2 has the same semantics as a Windows
741 NT server, in that it is case insensitive but case preserving.
</P
749 >NOTE ABOUT USERNAME/PASSWORD VALIDATION
</H2
751 >There are a number of ways in which a user can connect
752 to a service. The server uses the following steps in determining
753 if it will allow a connection to a specified service. If all the
754 steps fail, then the connection request is rejected. However, if one of the
755 steps succeeds, then the following steps are not checked.
</P
757 >If the service is marked
"guest only = yes" then
758 steps
1 to
5 are skipped.
</P
765 >If the client has passed a username/password
766 pair and that username/password pair is validated by the UNIX
767 system's password programs then the connection is made as that
768 username. Note that this includes the
779 >If the client has previously registered a username
780 with the system and now supplies a correct password for that
781 username then the connection is allowed.
</P
785 >The client's netbios name and any previously
786 used user names are checked against the supplied password, if
787 they match then the connection is allowed as the corresponding
792 >If the client has previously validated a
793 username/password pair with the server and the client has passed
794 the validation token then that username is used.
</P
798 >If a
"user = " field is given in the
802 > file for the service and the client
803 has supplied a password, and that password matches (according to
804 the UNIX system's password checking) with one of the usernames
805 from the
"user=" field then the connection is made as
806 the username in the
"user=" line. If one
807 of the username in the
"user=" list begins with a
808 '@' then that name expands to a list of names in
809 the group of the same name.
</P
813 >If the service is a guest service then a
814 connection is made as the username given in the
"guest
815 account =" for the service, irrespective of the
816 supplied password.
</P
826 >COMPLETE LIST OF GLOBAL PARAMETERS
</H2
828 >Here is a list of all global parameters. See the section of
829 each parameter for details. Note that some are synonyms.
</P
836 HREF=
"#ADDUSERSCRIPT"
848 HREF=
"#ADDPRINTERCOMMAND"
852 >addprinter command
</I
860 HREF=
"#ALLOWTRUSTEDDOMAINS"
864 >allow trusted domains
</I
884 HREF=
"#ANNOUNCEVERSION"
908 HREF=
"#BINDINTERFACESONLY"
912 >bind interfaces only
</I
932 HREF=
"#CHANGENOTIFYTIMEOUT"
936 >change notify timeout
</I
956 HREF=
"#CLIENTCODEPAGE"
968 HREF=
"#CODEPAGEDIRECTORY"
972 >code page directory
</I
1016 HREF=
"#DEBUGHIRESTIMESTAMP"
1020 >debug hires timestamp
</I
1040 HREF=
"#DEBUGTIMESTAMP"
1088 HREF=
"#DEFAULTSERVICE"
1100 HREF=
"#DELETEUSERSCRIPT"
1104 >delete user script
</I
1112 HREF=
"#DELETEPRINTERCOMMAND"
1116 >deleteprinter command
</I
1124 HREF=
"#DFREECOMMAND"
1148 HREF=
"#DOMAINADMINGROUP"
1152 >domain admin group
</I
1160 HREF=
"#DOMAINADMINUSERS"
1164 >domain admin users
</I
1172 HREF=
"#DOMAINGROUPS"
1184 HREF=
"#DOMAINGUESTGROUP"
1188 >domain guest group
</I
1196 HREF=
"#DOMAINGUESTUSERS"
1200 >domain guest users
</I
1208 HREF=
"#DOMAINLOGONS"
1220 HREF=
"#DOMAINMASTER"
1232 HREF=
"#ENCRYPTPASSWORDS"
1236 >encrypt passwords
</I
1244 HREF=
"#ENHANCEDBROWSING"
1248 >enhanced browsing
</I
1256 HREF=
"#ENUMPORTSCOMMAND"
1260 >enumports command
</I
1280 HREF=
"#HIDELOCALUSERS"
1284 >hide local users
</I
1352 HREF=
"#KERNELOPLOCKS"
1400 HREF=
"#LOADPRINTERS"
1436 HREF=
"#LOCKDIRECTORY"
1520 HREF=
"#LPQCACHETIME"
1532 HREF=
"#MACHINEPASSWORDTIMEOUT"
1536 >machine password timeout
</I
1544 HREF=
"#MANGLEDSTACK"
1604 HREF=
"#MAXOPENFILES"
1628 HREF=
"#MAXSMBDPROCESSES"
1632 >max smbd processes
</I
1676 HREF=
"#MESSAGECOMMAND"
1688 HREF=
"#MINPASSWDLENGTH"
1692 >min passwd length
</I
1700 HREF=
"#MINPASSWORDLENGTH"
1704 >min password length
</I
1736 HREF=
"#NAMERESOLVEORDER"
1740 >name resolve order
</I
1748 HREF=
"#NETBIOSALIASES"
1772 HREF=
"#NETBIOSSCOPE"
1796 HREF=
"#NTACLSUPPORT"
1808 HREF=
"#NTPIPESUPPORT"
1820 HREF=
"#NTSMBSUPPORT"
1832 HREF=
"#NULLPASSWORDS"
1844 HREF=
"#OPLOCKBREAKWAITTIME"
1848 >oplock break wait time
</I
1868 HREF=
"#OS2DRIVERMAP"
1904 HREF=
"#PASSWDCHATDEBUG"
1908 >passwd chat debug
</I
1916 HREF=
"#PASSWDPROGRAM"
1928 HREF=
"#PASSWORDLEVEL"
1940 HREF=
"#PASSWORDSERVER"
1952 HREF=
"#PREFEREDMASTER"
1964 HREF=
"#PREFERREDMASTER"
1968 >preferred master
</I
2000 HREF=
"#PRINTCAPNAME"
2012 HREF=
"#PRINTERDRIVERFILE"
2016 >printer driver file
</I
2072 HREF=
"#REMOTEANNOUNCE"
2084 HREF=
"#REMOTEBROWSESYNC"
2088 >remote browse sync
</I
2096 HREF=
"#RESTRICTANONYMOUS"
2100 >restrict anonymous
</I
2132 HREF=
"#ROOTDIRECTORY"
2156 HREF=
"#SERVERSTRING"
2168 HREF=
"#SHOWADDPRINTERWIZARD"
2172 >show add printer wizard
</I
2180 HREF=
"#SMBPASSWDFILE"
2192 HREF=
"#SOCKETADDRESS"
2204 HREF=
"#SOCKETOPTIONS"
2216 HREF=
"#SOURCEENVIRONMENT"
2220 >source environment
</I
2240 HREF=
"#SSLCACERTDIR"
2252 HREF=
"#SSLCACERTFILE"
2276 HREF=
"#SSLCLIENTCERT"
2288 HREF=
"#SSLCLIENTKEY"
2300 HREF=
"#SSLCOMPATIBILITY"
2304 >ssl compatibility
</I
2324 HREF=
"#SSLHOSTSRESIGN"
2328 >ssl hosts resign
</I
2336 HREF=
"#SSLREQUIRECLIENTCERT"
2340 >ssl require clientcert
</I
2348 HREF=
"#SSLREQUIRESERVERCERT"
2352 >ssl require servercert
</I
2360 HREF=
"#SSLSERVERCERT"
2372 HREF=
"#SSLSERVERKEY"
2408 HREF=
"#STATCACHESIZE"
2456 HREF=
"#TEMPLATEHOMEDIR"
2460 >template homedir
</I
2468 HREF=
"#TEMPLATESHELL"
2504 HREF=
"#TIMESTAMPLOGS"
2516 HREF=
"#TOTALPRINTJOBS"
2520 >total print jobs
</I
2528 HREF=
"#UNIXPASSWORDSYNC"
2532 >unix password sync
</I
2540 HREF=
"#UPDATEENCRYPTED"
2544 >update encrypted
</I
2564 HREF=
"#USERNAMELEVEL"
2588 HREF=
"#UTMPDIRECTORY"
2612 HREF=
"#WINBINDCACHETIME"
2616 >winbind cache time
</I
2636 HREF=
"#WINBINDSEPARATOR"
2640 >winbind separator
</I
2737 >COMPLETE LIST OF SERVICE PARAMETERS
</H2
2739 >Here is a list of all service parameters. See the section on
2740 each parameter for details. Note that some are synonyms.
</P
2783 HREF=
"#BLOCKINGLOCKS"
2819 HREF=
"#CASESENSITIVE"
2831 HREF=
"#CASESIGNAMES"
2903 HREF=
"#DELETEREADONLY"
2915 HREF=
"#DELETEVETOFILES"
2919 >delete veto files
</I
2951 HREF=
"#DIRECTORYMASK"
2963 HREF=
"#DIRECTORYMODE"
2975 HREF=
"#DIRECTORYSECURITYMASK"
2979 >directory security mask
</I
3011 HREF=
"#DOSFILETIMERESOLUTION"
3015 >dos filetime resolution
</I
3023 HREF=
"#DOSFILETIMES"
3047 HREF=
"#FAKEDIRECTORYCREATETIMES"
3051 >fake directory create times
</I
3071 HREF=
"#FOLLOWSYMLINKS"
3083 HREF=
"#FORCECREATEMODE"
3087 >force create mode
</I
3095 HREF=
"#FORCEDIRECTORYMODE"
3099 >force directory mode
</I
3107 HREF=
"#FORCEDIRECTORYSECURITYMODE"
3111 >force directory security mode
</I
3131 HREF=
"#FORCESECURITYMODE"
3135 >force security mode
</I
3179 HREF=
"#GUESTACCOUNT"
3215 HREF=
"#HIDEDOTFILES"
3275 HREF=
"#INHERITPERMISSIONS"
3279 >inherit permissions
</I
3287 HREF=
"#INVALIDUSERS"
3299 HREF=
"#LEVEL2OPLOCKS"
3323 HREF=
"#LPPAUSECOMMAND"
3347 HREF=
"#LPRESUMECOMMAND"
3351 >lpresume command
</I
3419 HREF=
"#MANGLEDNAMES"
3431 HREF=
"#MANGLINGCHAR"
3479 HREF=
"#MAXCONNECTIONS"
3491 HREF=
"#MAXPRINTJOBS"
3503 HREF=
"#MINPRINTSPACE"
3551 HREF=
"#OPLOCKCONTENTIONLIMIT"
3555 >oplock contention limit
</I
3587 HREF=
"#POSIXLOCKING"
3635 HREF=
"#PREEXECCLOSE"
3647 HREF=
"#PRESERVECASE"
3659 HREF=
"#PRINTCOMMAND"
3707 HREF=
"#PRINTERADMIN"
3719 HREF=
"#PRINTERDRIVER"
3731 HREF=
"#PRINTERDRIVERLOCATION"
3735 >printer driver location
</I
3779 HREF=
"#QUEUEPAUSECOMMAND"
3783 >queuepause command
</I
3791 HREF=
"#QUEUERESUMECOMMAND"
3795 >queueresume command
</I
3827 HREF=
"#ROOTPOSTEXEC"
3851 HREF=
"#ROOTPREEXECCLOSE"
3855 >root preexec close
</I
3863 HREF=
"#SECURITYMASK"
3875 HREF=
"#SETDIRECTORY"
3899 HREF=
"#SHORTPRESERVECASE"
3903 >short preserve case
</I
3923 HREF=
"#STRICTLOCKING"
4031 HREF=
"#VETOOPLOCKFILES"
4035 >veto oplock files
</I
4103 HREF=
"#WRITECACHESIZE"
4107 >write cache size
</I
4156 >EXPLANATION OF EACH PARAMETER
</H2
4160 CLASS=
"VARIABLELIST"
4164 NAME=
"ADDUSERSCRIPT"
4166 >add user script (G)
</DT
4169 >This is the full pathname to a script that will
4178 > under special circumstances described below.
</P
4180 >Normally, a Samba server requires that UNIX users are
4181 created for all users accessing files on this server. For sites
4182 that use Windows NT account databases as their primary user database
4183 creating these users and keeping the user list in sync with the
4184 Windows NT PDC is an onerous task. This option allows
<A
4188 > to create the required UNIX users
4192 > when a user accesses the Samba server.
</P
4194 >In order to use this option,
<A
4207 > security=domain
</I
4215 must be set to a full pathname for a script that will create a UNIX
4216 user given one argument of
<TT
4221 >, which expands into
4222 the UNIX user name to create.
</P
4224 >When the Windows user attempts to access the Samba server,
4225 at login (session setup in the SMB protocol) time,
<A
4235 attempts to authenticate the given user with the given password. If the
4236 authentication succeeds then
<B
4240 attempts to find a UNIX user in the UNIX password database to map the
4241 Windows user into. If this lookup fails, and
<TT
4251 call the specified script
<I
4260 > argument to be the user name to create.
</P
4262 >If this script successfully creates the user then
<B
4266 > will continue on as though the UNIX user
4267 already existed. In this way, UNIX users are dynamically created to
4268 match existing Windows NT accounts.
</P
4279 HREF=
"#PASSWORDSERVER"
4288 HREF=
"#DELETEUSERSCRIPT"
4300 >add user script =
<empty string
>
4306 >add user script = /usr/local/samba/bin/add_user
4312 NAME=
"ADDPRINTERCOMMAND"
4314 >addprinter command (G)
</DT
4317 >With the introduction of MS-RPC based printing
4318 support for Windows NT/
2000 clients in Samba
2.2, The MS Add
4319 Printer Wizard (APW) icon is now also available in the
4320 "Printers..." folder displayed a share listing. The APW
4321 allows for printers to be add remotely to a Samba or Windows
4322 NT/
2000 print server.
</P
4324 >For a Samba host this means that the printer must be
4325 physically added to underlying printing system. The
<TT
4328 > addprinter command
</I
4330 > defines a script to be run which
4331 will perform the necessary operations for adding the printer
4332 to the print system and to add the appropriate service definition
4336 > file in order that it can be
4350 >addprinter command
</I
4353 automatically invoked with the following parameter (in
4408 >Windows
9x driver location
</I
4415 >All parameters are filled in from the PRINTER_INFO_2 structure sent
4416 by the Windows NT/
2000 client with one exception. The
"Windows 9x
4417 driver location" parameter is included for backwards compatibility
4418 only. The remaining fields in the structure are generated from answers
4419 to the APW questions.
</P
4424 >addprinter command
</I
4430 > will reparse the
<TT
4433 > to determine if the share defined by the APW
4434 exists. If the sharename is still invalid, then
<B
4438 > will return an ACCESS_DENIED error to the client.
</P
4441 HREF=
"#DELETEPRINTERCOMMAND"
4445 > deleteprinter command
</I
4458 HREF=
"#SHOWADDPRINTERWIZARD"
4475 >addprinter command = /usr/bin/addprinter
4483 >admin users (S)
</DT
4486 >This is a list of users who will be granted
4487 administrative privileges on the share. This means that they
4488 will do all file operations as the super-user (root).
</P
4490 >You should use this option very carefully, as any user in
4491 this list will be able to do anything they like on the share,
4492 irrespective of file permissions.
</P
4501 >admin users = jason
</B
4508 >allow hosts (S)
</DT
4523 NAME=
"ALLOWTRUSTEDDOMAINS"
4525 >allow trusted domains (G)
</DT
4528 >This option only takes effect when the
<A
4544 If it is set to no, then attempts to connect to a resource from
4545 a domain or workgroup other than the one which smbd is running
4546 in will fail, even if that domain is trusted by the remote server
4547 doing the authentication.
</P
4549 >This is useful if you only want your Samba server to
4550 serve resources to users in the domain it is a member of. As
4551 an example, suppose that there are two domains DOMA and DOMB. DOMB
4552 is trusted by DOMA, which contains the Samba server. Under normal
4553 circumstances, a user with an account in DOMB can then access the
4554 resources of a UNIX account with the same account name on the
4555 Samba server even if they do not have an account in DOMA. This
4556 can make implementing a security boundary difficult.
</P
4560 >allow trusted domains = yes
</B
4567 >announce as (G)
</DT
4570 >This specifies what type of server
4579 will announce itself as, to a network neighborhood browse
4580 list. By default this is set to Windows NT. The valid options
4581 are :
"NT Server" (which can also be written as
"NT"),
4582 "NT Workstation",
"Win95" or
"WfW" meaning Windows NT Server,
4583 Windows NT Workstation, Windows
95 and Windows for Workgroups
4584 respectively. Do not change this parameter unless you have a
4585 specific need to stop Samba appearing as an NT server as this
4586 may prevent Samba servers from participating as browser servers
4591 >announce as = NT Server
</B
4596 >announce as = Win95
</B
4601 NAME=
"ANNOUNCEVERSION"
4603 >annouce version (G)
</DT
4606 >This specifies the major and minor version numbers
4607 that nmbd will use when announcing itself as a server. The default
4608 is
4.2. Do not change this parameter unless you have a specific
4609 need to set a Samba server to be a downlevel server.
</P
4613 >announce version =
4.2</B
4618 >announce version =
2.0</B
4625 >auto services (G)
</DT
4628 >This is a synonym for the
<A
4645 >This parameter lets you
"turn off" a service. If
4655 attempts to connect to the service will fail. Such failures are
4665 NAME=
"BINDINTERFACESONLY"
4667 >bind interfaces only (G)
</DT
4670 >This global parameter allows the Samba admin
4671 to limit what interfaces on a machine will serve smb requests. If
4672 affects file service
<A
4684 >For name service it causes
<B
4688 to ports
137 and
138 on the interfaces listed in the
<A
4695 > also binds to the
"all addresses" interface (
0.0.0.0)
4696 on ports
137 and
138 for the purposes of reading broadcast messages.
4697 If this option is not set then
<B
4701 name requests on all of these sockets. If
<TT
4711 source address of any packets coming in on the broadcast sockets
4712 and discard any that don't match the broadcast addresses of the
4713 interfaces in the
<TT
4719 As unicast packets are received on the other sockets it allows
4723 > to refuse to serve names to machines that
4724 send packets that arrive through any interfaces not listed in the
4730 > list. IP Source address spoofing
4731 does defeat this simple check, however so it must not be used
4732 seriously as a security feature for
<B
4737 >For file service it causes
<A
4742 to bind only to the interface list given in the
<A
4745 > parameter. This restricts the networks that
4749 > will serve to packets coming in those
4750 interfaces. Note that you should not use this parameter for machines
4751 that are serving PPP or other intermittent or non-broadcast network
4752 interfaces as it will not cope with non-permanent interfaces.
</P
4757 >bind interfaces only
</I
4760 unless the network address
<I
4770 HREF=
"smbpasswd.8.html"
4785 not work as expected due to the reasons covered below.
</P
4787 >To change a users SMB password, the
<B
4791 by default connects to the
<I
4793 >localhost -
127.0.0.1</I
4795 address as an SMB client to issue the password change request. If
4799 >bind interfaces only
</I
4801 > is set then unless the
4811 > parameter list then
<B
4814 > will fail to connect in it's default mode.
4818 > can be forced to use the primary IP interface
4819 of the local host by using its
<A
4820 HREF=
"smbpasswd.8.html#minusr"
4834 > parameter, with
<TT
4840 to the IP name of the primary interface of the local host.
</P
4845 > status page tries to connect with
4856 > to determine if they are running.
4867 "not running" even if they really are. This can prevent
<B
4870 > from starting/stopping/restarting
<B
4881 >bind interfaces only = no
</B
4886 NAME=
"BLOCKINGLOCKS"
4888 >blocking locks (S)
</DT
4891 >This parameter controls the behavior of
<A
4895 > when given a request by a client
4896 to obtain a byte range lock on a region of an open file, and the
4897 request has a time limit associated with it.
</P
4899 >If this parameter is set and the lock range requested
4900 cannot be immediately satisfied, Samba
2.2 will internally
4901 queue the lock request, and periodically attempt to obtain
4902 the lock until the timeout period expires.
</P
4904 >If this parameter is set to
<TT
4908 Samba
2.2 will behave as previous versions of Samba would and
4909 will fail the lock request immediately if the lock range
4910 cannot be obtained.
</P
4914 >blocking locks = yes
</B
4938 >browse list (G)
</DT
4941 >This controls whether
<A
4948 > will serve a browse list to
4956 >. You should never need to change
4961 >browse list = yes
</B
4971 >This controls whether this share is seen in
4972 the list of available shares in a net view and in the browse list.
</P
4976 >browseable = yes
</B
4981 NAME=
"CASESENSITIVE"
4983 >case sensitive (S)
</DT
4986 >See the discussion in the section
<A
4993 >case sensitive = no
</B
5000 >casesignames (S)
</DT
5004 HREF=
"#CASESENSITIVE"
5011 NAME=
"CHANGENOTIFYTIMEOUT"
5013 >change notify timeout (G)
</DT
5016 >This SMB allows a client to tell a server to
5017 "watch" a particular directory for any changes and only reply to
5018 the SMB request when a change has occurred. Such constant scanning of
5019 a directory is expensive under UNIX, hence an
<A
5026 > daemon only performs such a scan
5027 on each requested directory once every
<TT
5037 >change notify timeout =
60</B
5042 >change notify timeout =
300</B
5045 >Would change the scan time to every
5 minutes.
</P
5051 >character set (G)
</DT
5054 >This allows a smbd to map incoming filenames
5055 from a DOS Code page (see the
<A
5056 HREF=
"#CLIENTCODEPAGE"
5059 > parameter) to several built in UNIX character sets.
5060 The built in code page translations are:
</P
5069 > : Western European
5070 UNIX character set. The parameter
<TT
5073 >client code page
</I
5079 > be set to code page
850 if the
5085 > parameter is set to
5089 > in order for the conversion to the
5090 UNIX character set to be done correctly.
</P
5097 > : Eastern European
5098 UNIX character set. The parameter
<TT
5107 > be set to code page
852 if
5117 > in order for the conversion
5118 to the UNIX character set to be done correctly.
</P
5125 > : Russian Cyrillic
5126 UNIX character set. The parameter
<TT
5135 > be set to code page
5145 > in order for the conversion
5146 to the UNIX character set to be done correctly.
</P
5154 character set. The parameter
<TT
5163 > be set to code page
5173 > in order for the conversion
5174 to the UNIX character set to be done correctly.
</P
5181 > : Alternate mapping
5182 for Russian Cyrillic UNIX character set. The parameter
5186 >client code page
</I
5192 be set to code page
866 if the
<TT
5198 parameter is set to
<TT
5202 conversion to the UNIX character set to be done correctly.
</P
5209 >. These MSDOS code page to UNIX character
5210 set mappings should be dynamic, like the loading of MS DOS code pages,
5213 >Normally this parameter is not set, meaning no filename
5214 translation is done.
</P
5218 >character set =
<empty string
></B
5223 >character set = ISO8859-
1</B
5228 NAME=
"CLIENTCODEPAGE"
5230 >client code page (G)
</DT
5233 >This parameter specifies the DOS code page
5234 that the clients accessing Samba are using. To determine what code
5235 page a Windows or DOS client is using, open a DOS command prompt
5236 and type the command
<B
5240 the code page. The default for USA MS-DOS, Windows
95, and
5241 Windows NT releases is code page
437. The default for western
5242 European releases of the above operating systems is code page
850.
</P
5244 >This parameter tells
<A
5258 > files to dynamically load on startup. These files,
5259 described more fully in the manual page
<A
5260 HREF=
"make_smbcodepage.1.html"
5264 >make_smbcodepage(
1)
</B
5269 > how to map lower to upper case characters to provide
5270 the case insensitivity of filenames that Windows clients expect.
</P
5272 >Samba currently ships with the following code page files :
</P
5278 >Code Page
437 - MS-DOS Latin US
</P
5282 >Code Page
737 - Windows '
95 Greek
</P
5286 >Code Page
850 - MS-DOS Latin
1</P
5290 >Code Page
852 - MS-DOS Latin
2</P
5294 >Code Page
861 - MS-DOS Icelandic
</P
5298 >Code Page
866 - MS-DOS Cyrillic
</P
5302 >Code Page
932 - MS-DOS Japanese SJIS
</P
5306 >Code Page
936 - MS-DOS Simplified Chinese
</P
5310 >Code Page
949 - MS-DOS Korean Hangul
</P
5314 >Code Page
950 - MS-DOS Traditional Chinese
</P
5318 >Thus this parameter may have any of the values
437,
737,
850,
852,
5319 861,
932,
936,
949, or
950. If you don't find the codepage you need,
5320 read the comments in one of the other codepage files and the
5323 >make_smbcodepage(
1)
</B
5324 > man page and write one. Please
5325 remember to donate it back to the Samba user community.
</P
5327 >This parameter co-operates with the
<TT
5333 > parameter in determining what characters are
5334 valid in filenames and how capitalization is done. If you set both
5335 this parameter and the
<TT
5344 >client code page
</I
5350 > be set before the
<TT
5356 > parameter in the
<TT
5366 augment the character settings in the
<TT
5369 >client code page
</I
5377 >client code page
</I
5392 HREF=
"#CODEPAGEDIRECTORY"
5396 >code page directory
</I
5403 >client code page =
850</B
5408 >client code page =
936</B
5413 NAME=
"CODEPAGEDIRECTORY"
5415 >code page directory (G)
</DT
5418 >Define the location of the various client code page
5422 HREF=
"#CLIENTCODEPAGE"
5434 >code page directory = ${prefix}/lib/codepages
5440 >code page directory = /usr/share/samba/codepages
5448 >codingsystem (G)
</DT
5451 >This parameter is used to determine how incoming
5452 Shift-JIS Japanese characters are mapped from the incoming
<A
5453 HREF=
"#CLIENTCODEPAGE"
5457 >client code page
</I
5461 > used by the client, into file names in the UNIX filesystem.
5465 >client code page
</I
5468 932 (Japanese Shift-JIS). The options are :
</P
5477 > - Shift-JIS. Does no
5478 conversion of the incoming filename.
</P
5484 >JIS8, J8BB, J8BH, J8@B,
5486 > - Convert from incoming Shift-JIS to eight
5487 bit JIS code with different shift-in, shift out codes.
</P
5493 >JIS7, J7BB, J7BH, J7@B, J7@J,
5495 > - Convert from incoming Shift-JIS to seven bit
5496 JIS code with different shift-in, shift out codes.
</P
5502 >JUNET, JUBB, JUBH, JU@B, JU@J, JU@H
</TT
5504 - Convert from incoming Shift-JIS to JUNET code with different shift-in,
5512 > - Convert an incoming
5513 Shift-JIS character to EUC code.
</P
5520 > - Convert an incoming
5521 Shift-JIS character to a
3 byte hex representation, i.e.
5532 > - Convert an incoming
5533 Shift-JIS character to the
3 byte hex representation used by
5534 the Columbia AppleTalk Program (CAP), i.e.
<TT
5538 This is used for compatibility between Samba and CAP.
</P
5544 >coding system =
<empty value
></B
5555 >This is a text field that is seen next to a share
5556 when a client does a queries the server, either via the network
5557 neighborhood or via
<B
5560 > to list what shares
5563 >If you want to set the string that is displayed next to the
5564 machine name then see the
<A
5565 HREF=
"#SERVERSTRING"
5576 >No comment string
</I
5581 >comment = Fred's Files
</B
5588 >config file (G)
</DT
5591 >This allows you to override the config file
5592 to use, instead of the default (usually
<TT
5596 There is a chicken and egg problem here as this option is set
5597 in the config file!
</P
5599 >For this reason, if the name of the config file has changed
5600 when the parameters are loaded then it will reload them from
5601 the new config file.
</P
5603 >This option takes the usual substitutions, which can
5606 >If the config file doesn't exist then it won't be loaded
5607 (allowing you to special case the config files of just a few
5612 >config file = /usr/local/samba/lib/smb.conf.%m
5623 >This parameter allows you to
"clone" service
5624 entries. The specified service is simply duplicated under the
5625 current service's name. Any parameters specified in the current
5626 section will override those in the section being copied.
</P
5628 >This feature lets you set up a 'template' service and
5629 create similar services easily. Note that the service being
5630 copied must occur earlier in the configuration file than the
5631 service doing the copying.
</P
5640 >copy = otherservice
</B
5647 >create mask (S)
</DT
5650 >A synonym for this parameter is
5662 >When a file is created, the necessary permissions are
5663 calculated according to the mapping from DOS modes to UNIX
5664 permissions, and the resulting UNIX mode is then bit-wise 'AND'ed
5665 with this parameter. This parameter may be thought of as a bit-wise
5666 MASK for the UNIX modes of a file. Any bit
<I
5670 set here will be removed from the modes set on a file when it is
5673 >The default value of this parameter removes the
5674 'group' and 'other' write and execute bits from the UNIX modes.
</P
5676 >Following this Samba will bit-wise 'OR' the UNIX mode created
5677 from this parameter with the value of the
<A
5678 HREF=
"#FORCECREATEMODE"
5682 >force create mode
</I
5686 parameter which is set to
000 by default.
</P
5688 >This parameter does not affect directory modes. See the
5690 HREF=
"#DIRECTORYMODE"
5701 HREF=
"#FORCECREATEMODE"
5709 > parameter for forcing particular mode
5710 bits to be set on created files. See also the
<A
5711 HREF=
"#DIRECTORYMODE"
5718 > parameter for masking
5719 mode bits on created directories. See also the <A
5720 HREF="#INHERITPERMISSIONS
"
5724 >inherit permissions</I
5731 >create mask = 0744</B
5736 >create mask = 0775</B
5743 >create mode (S)</DT
5746 >This is a synonym for <A
5763 >The value of the parameter (a decimal integer)
5764 represents the number of minutes of inactivity before a connection
5765 is considered dead, and it is disconnected. The deadtime only takes
5766 effect if the number of open files is zero.</P
5768 >This is useful to stop a server's resources being
5769 exhausted by a large number of inactive connections.</P
5771 >Most clients have an auto-reconnect feature when a
5772 connection is broken so in most cases this parameter should be
5773 transparent to users.</P
5775 >Using this parameter with a timeout of a few minutes
5776 is recommended for most systems.</P
5778 >A deadtime of zero indicates that no auto-disconnection
5779 should be performed.</P
5793 NAME="DEBUGHIRESTIMESTAMP
"
5795 >debug hires timestamp (G)</DT
5798 >Sometimes the timestamps in the log messages
5799 are needed with a resolution of higher that seconds, this
5800 boolean parameter adds microsecond resolution to the timestamp
5801 message header when turned on.</P
5803 >Note that the parameter <A
5804 HREF="#DEBUGTIMESTAMP
"
5808 > debug timestamp</I
5811 > must be on for this to have an
5816 >debug hires timestamp = no</B
5826 >When using only one log file for more then one
5827 forked smbd-process there may be hard to follow which process
5828 outputs which message. This boolean parameter is adds the process-id
5829 to the timestamp message headers in the logfile when turned on.</P
5831 >Note that the parameter <A
5832 HREF="#DEBUGTIMESTAMP
"
5836 > debug timestamp</I
5839 > must be on for this to have an
5849 NAME="DEBUGTIMESTAMP
"
5851 >debug timestamp (G)</DT
5854 >Samba 2.2 debug log messages are timestamped
5855 by default. If you are running at a high <A
5864 can be distracting. This boolean parameter allows timestamping
5865 to be turned off.</P
5869 >debug timestamp = yes</B
5879 >Samba is sometimes run as root and sometime
5880 run as the connected user, this boolean parameter inserts the
5881 current euid, egid, uid and gid to the timestamp message headers
5882 in the log file if turned on.</P
5884 >Note that the parameter <A
5885 HREF="#DEBUGTIMESTAMP
"
5889 > debug timestamp</I
5892 > must be on for this to have an
5907 >The value of the parameter (an integer) allows
5908 the debug level (logging level) to be specified in the
5912 > file. This is to give greater
5913 flexibility in the configuration of the system.</P
5915 >The default will be the debug level specified on
5916 the command line or level zero if none was specified.</P
5931 HREF="#DEFAULTSERVICE
"
5935 > default service</I
5944 >default case (S)</DT
5947 >See the section on <A
5951 HREF="#SHORTPRESERVECASE
"
5955 >short preserve case"</I
5962 >default case = lower
</B
5967 NAME=
"DEFAULTSERVICE"
5969 >default service (G)
</DT
5972 >This parameter specifies the name of a service
5973 which will be connected to if the service actually requested cannot
5974 be found. Note that the square brackets are
<I
5978 given in the parameter value (see example below).
</P
5980 >There is no default value for this parameter. If this
5981 parameter is not given, attempting to connect to a nonexistent
5982 service results in an error.
</P
5984 >Typically the default service would be a
<A
6002 >Also note that the apparent service name will be changed
6003 to equal that of the requested service, this is very useful as it
6004 allows you to use macros like
<TT
6010 a wildcard service.
</P
6012 >Note also that any
"_" characters in the name of the service
6013 used in the default service will get mapped to a
"/". This allows for
6014 interesting things.
</P
6019 CLASS=
"PROGRAMLISTING"
6021 default service = pub
6030 NAME=
"DELETEREADONLY"
6032 >delete readonly (S)
</DT
6035 >This parameter allows readonly files to be deleted.
6036 This is not normal DOS semantics, but is allowed by UNIX.
</P
6038 >This option may be useful for running applications such
6039 as rcs, where UNIX file ownership prevents changing file
6040 permissions, and DOS semantics prevent deletion of a read only file.
</P
6044 >delete readonly = no
</B
6049 NAME=
"DELETEUSERSCRIPT"
6051 >delete user script (G)
</DT
6054 >This is the full pathname to a script that will
6065 > under special circumstances
6068 >Normally, a Samba server requires that UNIX users are
6069 created for all users accessing files on this server. For sites
6070 that use Windows NT account databases as their primary user database
6071 creating these users and keeping the user list in sync with the
6072 Windows NT PDC is an onerous task. This option allows
<B
6075 > to delete the required UNIX users
<I
6079 > when a user accesses the Samba server and the
6080 Windows NT user no longer exists.
</P
6082 >In order to use this option,
<B
6097 > must be set to a full pathname for a script
6098 that will delete a UNIX user given one argument of
<TT
6104 >, which expands into the UNIX user name to delete.
6108 > that this is different to the
<A
6109 HREF=
"#ADDUSERSCRIPT"
6117 which will work with the
<TT
6128 >. The reason for this
6129 is only when Samba is a domain member does it get the information
6130 on an attempted user logon that a user no longer exists. In the
6136 > mode a missing user
6137 is treated the same as an invalid password logon attempt. Deleting
6138 the user in this circumstance would not be a good idea.
</P
6140 >When the Windows user attempts to access the Samba server,
6144 > (session setup in the SMB protocol)
6149 HREF=
"#PASSWORDSERVER"
6156 > and attempts to authenticate
6157 the given user with the given password. If the authentication fails
6158 with the specific Domain error code meaning that the user no longer
6162 > attempts to find a UNIX user in
6163 the UNIX password database that matches the Windows user account. If
6164 this lookup succeeds, and
<TT
6167 >delete user script
</I
6173 > will all the specified script
6177 >, expanding any
<TT
6183 argument to be the user name to delete.
</P
6185 >This script should delete the given UNIX username. In this way,
6186 UNIX users are dynamically deleted to match existing Windows NT
6190 HREF=
"#SECURITYEQUALSDOMAIN"
6194 HREF=
"#PASSWORDSERVER"
6203 HREF=
"#ADDUSERSCRIPT"
6215 >delete user script =
<empty string
>
6221 >delete user script = /usr/local/samba/bin/del_user
6227 NAME=
"DELETEPRINTERCOMMAND"
6229 >deleteprinter command (G)
</DT
6232 >With the introduction of MS-RPC based printer
6233 support for Windows NT/
2000 clients in Samba
2.2, it is now
6234 possible to delete printer at run time by issuing the
6235 DeletePrinter() RPC call.
</P
6237 >For a Samba host this means that the printer must be
6238 physically deleted from underlying printing system. The
<TT
6241 > deleteprinter command
</I
6243 > defines a script to be run which
6244 will perform the necessary operations for removing the printer
6245 from the print system and from
<TT
6254 >deleteprinter command
</I
6257 automatically called with only one parameter:
<TT
6267 >deleteprinter command
</I
6273 > will reparse the
<TT
6276 > to associated printer no longer exists.
6277 If the sharename is still valid, then
<B
6281 > will return an ACCESS_DENIED error to the client.
</P
6284 HREF=
"#ADDPRINTERCOMMAND"
6288 > addprinter command
</I
6301 HREF=
"#SHOWADDPRINTERWIZARD"
6318 >deleteprinter command = /usr/bin/removeprinter
6324 NAME=
"DELETEVETOFILES"
6326 >delete veto files (S)
</DT
6329 >This option is used when Samba is attempting to
6330 delete a directory that contains one or more vetoed directories
6340 option). If this option is set to False (the default) then if a vetoed
6341 directory contains any non-vetoed files or directories then the
6342 directory delete will fail. This is usually what you want.
</P
6344 >If this option is set to
<TT
6348 will attempt to recursively delete any files and directories within
6349 the vetoed directory. This can be useful for integration with file
6350 serving systems such as NetAtalk which create meta-files within
6351 directories you might normally veto DOS/Windows users from seeing
6359 >delete veto files = yes
</B
6361 directories to be transparently deleted when the parent directory
6362 is deleted (so long as the user has permissions to do so).
</P
6377 >delete veto files = no
</B
6402 >dfree command (G)
</DT
6411 only be used on systems where a problem occurs with the internal
6412 disk space calculations. This has been known to happen with Ultrix,
6413 but may occur with other operating systems. The symptom that was
6414 seen was an error of
"Abort Retry Ignore" at the end of each
6415 directory listing.
</P
6417 >This setting allows the replacement of the internal routines to
6418 calculate the total disk space and amount available with an external
6419 routine. The example below gives a possible script that might fulfill
6422 >The external program will be passed a single parameter indicating
6423 a directory in the filesystem being queried. This will typically consist
6427 >. The script should return two
6428 integers in ASCII. The first should be the total disk space in blocks,
6429 and the second should be the number of available blocks. An optional
6430 third return value can give the block size in bytes. The default
6431 blocksize is
1024 bytes.
</P
6433 >Note: Your script should
<I
6437 setgid and should be owned by (and writeable only by) root!
</P
6441 >By default internal routines for
6442 determining the disk capacity and remaining space will be used.
6448 >dfree command = /usr/local/samba/bin/dfree
6452 >Where the script dfree (which must be made executable) could be:
</P
6455 CLASS=
"PROGRAMLISTING"
6458 df $
1 | tail -
1 | awk '{print $
2" "$
4}'
6462 >or perhaps (on Sys V based systems):
</P
6465 CLASS=
"PROGRAMLISTING"
6468 /usr/bin/df -k $
1 | tail -
1 | awk '{print $
3" "$
5}'
6472 >Note that you may have to replace the command names
6473 with full path names on some systems.
</P
6495 NAME=
"DIRECTORYMASK"
6497 >directory mask (S)
</DT
6500 >This parameter is the octal modes which are
6501 used when converting DOS modes to UNIX modes when creating UNIX
6504 >When a directory is created, the necessary permissions are
6505 calculated according to the mapping from DOS modes to UNIX permissions,
6506 and the resulting UNIX mode is then bit-wise 'AND'ed with this
6507 parameter. This parameter may be thought of as a bit-wise MASK for
6508 the UNIX modes of a directory. Any bit
<I
6512 here will be removed from the modes set on a directory when it is
6515 >The default value of this parameter removes the 'group'
6516 and 'other' write bits from the UNIX mode, allowing only the
6517 user who owns the directory to modify it.
</P
6519 >Following this Samba will bit-wise 'OR' the UNIX mode
6520 created from this parameter with the value of the
<A
6521 HREF=
"#FORCEDIRECTORYMODE"
6525 >force directory mode
6529 > parameter. This parameter is set to
000 by
6530 default (i.e. no extra mode bits are added).
</P
6533 HREF=
"#FORCEDIRECTORYMODE"
6541 > parameter to cause particular mode
6542 bits to always be set on created directories.
</P
6553 > parameter for masking mode bits on created files,
6555 HREF=
"#DIRECTORYSECURITYMASK"
6565 >Also refer to the
<A
6566 HREF=
"#INHERITPERMISSIONS"
6570 > inherit permissions
</I
6577 >directory mask =
0755</B
6582 >directory mask =
0775</B
6587 NAME=
"DIRECTORYMODE"
6589 >directory mode (S)
</DT
6593 HREF=
"#DIRECTORYMASK"
6604 NAME=
"DIRECTORYSECURITYMASK"
6606 >directory security mask (S)
</DT
6609 >This parameter controls what UNIX permission bits
6610 can be modified when a Windows NT client is manipulating the UNIX
6611 permission on a directory using the native NT security dialog
6614 >This parameter is applied as a mask (AND'ed with) to
6615 the changed permission bits, thus preventing any bits not in
6616 this mask from being modified. Essentially, zero bits in this
6617 mask may be treated as a set of bits the user is not allowed
6620 >If not set explicitly this parameter is set to the same
6622 HREF=
"#DIRECTORYMASK"
6630 > parameter. To allow a user to
6631 modify all the user/group/world permissions on a directory, set
6632 this parameter to
0777.
</P
6637 > that users who can access the
6638 Samba server through other means can easily bypass this restriction,
6639 so it is primarily useful for standalone
"appliance" systems.
6640 Administrators of most normal systems will probably want to set
6644 HREF=
"#FORCEDIRECTORYSECURITYMODE"
6648 > force directory security mode
</I
6652 HREF=
"#SECURITYMASK"
6661 HREF=
"#FORCESECURITYMODE"
6665 >force security mode
6673 >directory security mask =
<same as
6674 directory mask
></B
6679 >directory security mask =
0777</B
6694 when acting as a WINS server and finding that a NetBIOS name has not
6695 been registered, should treat the NetBIOS name word-for-word as a DNS
6696 name and do a lookup with the DNS server for that name on behalf of
6697 the name-querying client.
</P
6699 >Note that the maximum length for a NetBIOS name is
15
6700 characters, so the DNS name (or DNS alias) can likewise only be
6701 15 characters, maximum.
</P
6706 > spawns a second copy of itself to do the
6707 DNS name lookup requests, as doing a name lookup is a blocking
6710 >See also the parameter
<A
6727 NAME=
"DOMAINADMINGROUP"
6729 >domain admin group (G)
</DT
6736 that is part of the unfinished Samba NT Domain Controller Code. It may
6737 be removed in a later release. To work with the latest code builds
6738 that may have more support for Samba NT Domain Controller functionality
6739 please subscribe to the mailing list
<A
6740 HREF=
"mailto:samba-ntdom@samba.org"
6744 visiting the web page at
<A
6745 HREF=
"http://lists.samba.org/"
6747 > http://lists.samba.org/
</A
6752 NAME=
"DOMAINADMINUSERS"
6754 >domain admin users (G)
</DT
6761 that is part of the unfinished Samba NT Domain Controller Code. It may
6762 be removed in a later release. To work with the latest code builds
6763 that may have more support for Samba NT Domain Controller functionality
6764 please subscribe to the mailing list
<A
6765 HREF=
"mailto:samba-ntdom@samba.org"
6769 visiting the web page at
<A
6770 HREF=
"http://lists.samba.org/"
6772 > http://lists.samba.org/
</A
6779 >domain groups (G)
</DT
6786 that is part of the unfinished Samba NT Domain Controller Code. It may
6787 be removed in a later release. To work with the latest code builds
6788 that may have more support for Samba NT Domain Controller functionality
6789 please subscribe to the mailing list
<A
6790 HREF=
"mailto:samba-ntdom@samba.org"
6794 visiting the web page at
<A
6795 HREF=
"http://lists.samba.org/"
6797 > http://lists.samba.org/
</A
6802 NAME=
"DOMAINGUESTGROUP"
6804 >domain guest group (G)
</DT
6811 that is part of the unfinished Samba NT Domain Controller Code. It may
6812 be removed in a later release. To work with the latest code builds
6813 that may have more support for Samba NT Domain Controller functionality
6814 please subscribe to the mailing list
<A
6815 HREF=
"mailto:samba-ntdom@samba.org"
6819 visiting the web page at
<A
6820 HREF=
"http://lists.samba.org/"
6822 > http://lists.samba.org/
</A
6827 NAME=
"DOMAINGUESTUSERS"
6829 >domain guest users (G)
</DT
6836 that is part of the unfinished Samba NT Domain Controller Code. It may
6837 be removed in a later release. To work with the latest code builds
6838 that may have more support for Samba NT Domain Controller functionality
6839 please subscribe to the mailing list
<A
6840 HREF=
"mailto:samba-ntdom@samba.org"
6844 visiting the web page at
<A
6845 HREF=
"http://lists.samba.org/"
6847 > http://lists.samba.org/
</A
6854 >domain logons (G)
</DT
6857 >If set to true, the Samba server will serve
6858 Windows
95/
98 Domain logons for the
<A
6866 > it is in. Samba
2.2 also
6867 has limited capability to act as a domain controller for Windows
6868 NT
4 Domains. For more details on setting up this feature see
6869 the file DOMAINS.txt in the Samba documentation directory
<TT
6873 > shipped with the source code.
</P
6877 >domain logons = no
</B
6884 >domain master (G)
</DT
6894 > to enable WAN-wide browse list
6895 collation. Setting this option causes
<B
6899 claim a special domain specific NetBIOS name that identifies
6900 it as a domain master browser for its given
<A
6908 >. Local master browsers
6914 > on broadcast-isolated
6915 subnets will give this
<B
6918 > their local browse lists,
6927 for a complete copy of the browse list for the whole wide area
6928 network. Browser clients will then contact their local master browser,
6929 and will receive the domain-wide browse list, instead of just the list
6930 for their broadcast-isolated subnet.
</P
6932 >Note that Windows NT Primary Domain Controllers expect to be
6933 able to claim this
<TT
6939 NetBIOS name that identifies them as domain master browsers for
6945 > by default (i.e. there is no
6946 way to prevent a Windows NT PDC from attempting to do this). This
6947 means that if this parameter is set and
<B
6951 the special name for a
<TT
6957 NT PDC is able to do so then cross subnet browsing will behave
6958 strangely and may fail.
</P
6961 HREF=
"#DOMAINLOGONS"
6964 >domain logons = yes
</B
6967 >, then the default behavior is to enable the
<TT
6979 not enabled (the default setting), then neither will
<TT
6985 > be enabled by default.
</P
6989 >domain master = auto
</B
6996 >dont descend (S)
</DT
6999 >There are certain directories on some systems
7003 > tree under Linux) that are either not
7004 of interest to clients or are infinitely deep (recursive). This
7005 parameter allows you to specify a comma-delimited list of directories
7006 that the server should always show as empty.
</P
7008 >Note that Samba can be very fussy about the exact format
7009 of the
"dont descend" entries. For example you may need
<TT
7012 > instead of just
<TT
7016 Experimentation is the best policy :-)
</P
7020 >none (i.e., all directories are OK
7026 >dont descend = /proc,/dev
</B
7033 >dos filemode (S)
</DT
7036 > The default behavior in Samba is to provide
7037 UNIX-like behavor where only the owner of a file/directory is
7038 able to change the permissions on it. However, this behavior
7039 is often confusing to DOS/Windows users. Enabling this parameter
7040 allows a user who has write access to the file (by whatever
7041 means) to modify the permissions on it. Note that a user
7042 belonging to the group owning the file will not be allowed to
7043 change permissions if the group is only granted read access.
7044 Ownership of the file/directory is not changed, only the permissions
7049 >dos filemode = no
</B
7054 NAME=
"DOSFILETIMERESOLUTION"
7056 >dos filetime resolution (S)
</DT
7059 >Under the DOS and Windows FAT filesystem, the finest
7060 granularity on time resolution is two seconds. Setting this parameter
7061 for a share causes Samba to round the reported time down to the
7062 nearest two second boundary when a query call that requires one second
7063 resolution is made to
<A
7073 >This option is mainly used as a compatibility option for Visual
7074 C++ when used against Samba shares. If oplocks are enabled on a
7075 share, Visual C++ uses two different time reading calls to check if a
7076 file has changed since it was last read. One of these calls uses a
7077 one-second granularity, the other uses a two second granularity. As
7078 the two second call rounds any odd second down, then if the file has a
7079 timestamp of an odd number of seconds then the two timestamps will not
7080 match and Visual C++ will keep reporting the file has changed. Setting
7081 this option causes the two timestamps to match, and Visual C++ is
7086 >dos filetime resolution = no
</B
7093 >dos filetimes (S)
</DT
7096 >Under DOS and Windows, if a user can write to a
7097 file they can change the timestamp on it. Under POSIX semantics,
7098 only the owner of the file or root may change the timestamp. By
7099 default, Samba runs with POSIX semantics and refuses to change the
7100 timestamp on a file if the user
<B
7104 on behalf of is not the file owner. Setting this option to
<TT
7107 > allows DOS semantics and smbd will change the file
7108 timestamp as DOS requires.
</P
7112 >dos filetimes = no
</B
7117 NAME=
"ENCRYPTPASSWORDS"
7119 >encrypt passwords (G)
</DT
7122 >This boolean controls whether encrypted passwords
7123 will be negotiated with the client. Note that Windows NT
4.0 SP3 and
7124 above and also Windows
98 will by default expect encrypted passwords
7125 unless a registry entry is changed. To use encrypted passwords in
7126 Samba see the file ENCRYPTION.txt in the Samba documentation
7130 > shipped with the source code.
</P
7132 >In order for encrypted passwords to work correctly
7141 have access to a local
<A
7142 HREF=
"smbpasswd.5.html"
7150 HREF=
"smbpasswd.8.html"
7156 > program for information on how to set up
7157 and maintain this file), or set the
<A
7159 >security=[serve|domain]
</A
7164 > to authenticate against another
7169 >encrypt passwords = no
</B
7174 NAME=
"ENHANCEDBROWSING"
7176 >enhanced browsing (G)
</DT
7179 >This option enables a couple of enhancements to
7180 cross-subnet browse propogation that have been added in Samba
7181 but which are not standard in Microsoft implementations.
7184 >These enhancements are currently only available in
7185 the HEAD Samba CVS tree (not Samba
2.2.x).
</I
7188 >The first enhancement to browse propogation consists of a regular
7189 wildcard query to a Samba WINS server for all Domain Master Browsers,
7190 followed by a browse synchronisation with each of the returned
7191 DMBs. The second enhancement consists of a regular randomised browse
7192 synchronisation with all currently known DMBs.
</P
7194 >You may wish to disable this option if you have a problem with empty
7195 workgroups not disappearing from browse lists. Due to the restrictions
7196 of the browse protocols these enhancements can cause a empty workgroup
7197 to stay around forever which can be annoying.
</P
7199 >In general you should leave this option enabled as it makes
7200 cross-subnet browse propogation much more reliable.
</P
7204 >enhanced browsing = yes
</B
7209 NAME=
"ENUMPORTSCOMMAND"
7211 >enumports command (G)
</DT
7214 >The concept of a
"port" is fairly foreign
7215 to UNIX hosts. Under Windows NT/
2000 print servers, a port
7216 is associated with a port monitor and generally takes the form of
7217 a local port (i.e. LPT1:, COM1:, FILE:) or a remote port
7218 (i.e. LPD Port Monitor, etc...). By default, Samba has only one
7221 >"Samba Printer Port"</TT
7223 Windows NT/
2000, all printers must have a valid port name.
7224 If you wish to have a list of ports displayed (
<B
7228 > does not use a port name for anything) other than
7231 >"Samba Printer Port"</TT
7236 >enumports command
</I
7239 a program which should generate a list of ports, one per line,
7240 to standard output. This listing will then be used in response
7241 to the level
1 and
2 EnumPorts() RPC.
</P
7245 >no enumports command
</I
7250 >enumports command = /usr/bin/listports
7261 >This is a synonym for
<A
7273 NAME=
"FAKEDIRECTORYCREATETIMES"
7275 >fake directory create times (S)
</DT
7278 >NTFS and Windows VFAT file systems keep a create
7279 time for all files and directories. This is not the same as the
7280 ctime - status change time - that Unix keeps, so Samba by default
7281 reports the earliest of the various times Unix does keep. Setting
7282 this parameter for a share causes Samba to always report midnight
7283 1-
1-
1980 as the create time for directories.
</P
7285 >This option is mainly used as a compatibility option for
7286 Visual C++ when used against Samba shares. Visual C++ generated
7287 makefiles have the object directory as a dependency for each object
7288 file, and a make rule to create the directory. Also, when NMAKE
7289 compares timestamps it uses the creation time when examining a
7290 directory. Thus the object directory will be created if it does not
7291 exist, but once it does exist it will always have an earlier
7292 timestamp than the object files it contains.
</P
7294 >However, Unix time semantics mean that the create time
7295 reported by Samba will be updated whenever a file is created or
7296 or deleted in the directory. NMAKE finds all object files in
7297 the object directory. The timestamp of the last one built is then
7298 compared to the timestamp of the object dircetory. If the
7299 directory's timestamp if newer, then all object files
7300 will be rebuilt. Enabling this option
7301 ensures directories always predate their contents and an NMAKE build
7302 will proceed as expected.
</P
7306 >fake directory create times = no
</B
7313 >fake oplocks (S)
</DT
7316 >Oplocks are the way that SMB clients get permission
7317 from a server to locally cache file operations. If a server grants
7318 an oplock (opportunistic lock) then the client is free to assume
7319 that it is the only one accessing the file and it will aggressively
7320 cache file data. With some oplock types the client may even cache
7321 file open/close operations. This can give enormous performance benefits.
7326 >fake oplocks = yes
</B
7335 always grant oplock requests no matter how many clients are using
7338 >It is generally much better to use the real
<A
7347 than this parameter.
</P
7349 >If you enable this option on all read-only shares or
7350 shares that you know will only be accessed from one client at a
7351 time such as physically read-only media like CDROMs, you will see
7352 a big performance improvement on many operations. If you enable
7353 this option on shares where multiple clients may be accessing the
7354 files read-write at the same time you can get data corruption. Use
7355 this option carefully!
</P
7359 >fake oplocks = no
</B
7364 NAME=
"FOLLOWSYMLINKS"
7366 >follow symlinks (S)
</DT
7369 >This parameter allows the Samba administrator
7378 from following symbolic links in a particular share. Setting this
7382 > prevents any file or directory
7383 that is a symbolic link from being followed (the user will get an
7384 error). This option is very useful to stop users from adding a
7385 symbolic link to
<TT
7389 directory for instance. However it will slow filename lookups
7392 >This option is enabled (i.e.
<B
7396 follow symbolic links) by default.
</P
7400 >follow symlinks = yes
</B
7405 NAME=
"FORCECREATEMODE"
7407 >force create mode (S)
</DT
7410 >This parameter specifies a set of UNIX mode bit
7411 permissions that will
<I
7415 file created by Samba. This is done by bitwise 'OR'ing these bits onto
7416 the mode bits of a file that is being created or having its
7417 permissions changed. The default for this parameter is (in octal)
7418 000. The modes in this parameter are bitwise 'OR'ed onto the file
7419 mode after the mask set in the
<TT
7425 parameter is applied.
</P
7427 >See also the parameter
<A
7436 > for details on masking mode bits on files.
</P
7439 HREF=
"#INHERITPERMISSIONS"
7451 >force create mode =
000</B
7456 >force create mode =
0755</B
7459 >would force all created files to have read and execute
7460 permissions set for 'group' and 'other' as well as the
7461 read/write/execute bits set for the 'user'.
</P
7465 NAME=
"FORCEDIRECTORYMODE"
7467 >force directory mode (S)
</DT
7470 >This parameter specifies a set of UNIX mode bit
7471 permissions that will
<I
7474 > be set on a directory
7475 created by Samba. This is done by bitwise 'OR'ing these bits onto the
7476 mode bits of a directory that is being created. The default for this
7477 parameter is (in octal)
0000 which will not add any extra permission
7478 bits to a created directory. This operation is done after the mode
7479 mask in the parameter
<TT
7487 >See also the parameter
<A
7488 HREF=
"#DIRECTORYMASK"
7495 > for details on masking mode bits
7496 on created directories.
</P
7499 HREF=
"#INHERITPERMISSIONS"
7503 > inherit permissions
</I
7510 >force directory mode =
000</B
7515 >force directory mode =
0755</B
7518 >would force all created directories to have read and execute
7519 permissions set for 'group' and 'other' as well as the
7520 read/write/execute bits set for the 'user'.
</P
7524 NAME=
"FORCEDIRECTORYSECURITYMODE"
7527 security mode (S)
</DT
7530 >This parameter controls what UNIX permission bits
7531 can be modified when a Windows NT client is manipulating the UNIX
7532 permission on a directory using the native NT security dialog box.
</P
7534 >This parameter is applied as a mask (OR'ed with) to the
7535 changed permission bits, thus forcing any bits in this mask that
7536 the user may have modified to be on. Essentially, one bits in this
7537 mask may be treated as a set of bits that, when modifying security
7538 on a directory, the user has always set to be 'on'.
</P
7540 >If not set explicitly this parameter is set to the same
7542 HREF=
"#FORCEDIRECTORYMODE"
7550 > parameter. To allow
7551 a user to modify all the user/group/world permissions on a
7552 directory without restrictions, set this parameter to
000.
</P
7557 > that users who can access the
7558 Samba server through other means can easily bypass this restriction,
7559 so it is primarily useful for standalone
"appliance" systems.
7560 Administrators of most normal systems will probably want to set
7564 HREF=
"#DIRECTORYSECURITYMASK"
7568 > directory security mask
</I
7572 HREF=
"#SECURITYMASK"
7581 HREF=
"#FORCESECURITYMODE"
7585 >force security mode
7593 >force directory security mode =
<same as
7594 force directory mode
></B
7599 >force directory security mode =
0</B
7606 >force group (S)
</DT
7609 >This specifies a UNIX group name that will be
7610 assigned as the default primary group for all users connecting
7611 to this service. This is useful for sharing files by ensuring
7612 that all access to files on service will use the named group for
7613 their permissions checking. Thus, by assigning permissions for this
7614 group to the files and directories within this service the Samba
7615 administrator can restrict or allow sharing of these files.
</P
7617 >In Samba
2.0.5 and above this parameter has extended
7618 functionality in the following way. If the group name listed here
7619 has a '+' character prepended to it then the current user accessing
7620 the share only has the primary group default assigned to this group
7621 if they are already assigned as a member of that group. This allows
7622 an administrator to decide that only users who are already in a
7623 particular group will create files with group ownership set to that
7624 group. This gives a finer granularity of ownership assignment. For
7625 example, the setting
<TT
7627 >force group = +sys
</TT
7629 that only users who are already in group sys will have their default
7630 primary group assigned to sys when accessing this Samba share. All
7631 other users will retain their ordinary primary group.
</P
7642 > parameter is also set the group specified in
7648 > will override the primary group
7674 >force group = agroup
</B
7679 NAME=
"FORCESECURITYMODE"
7681 >force security mode (S)
</DT
7684 >This parameter controls what UNIX permission
7685 bits can be modified when a Windows NT client is manipulating
7686 the UNIX permission on a file using the native NT security dialog
7689 >This parameter is applied as a mask (OR'ed with) to the
7690 changed permission bits, thus forcing any bits in this mask that
7691 the user may have modified to be on. Essentially, one bits in this
7692 mask may be treated as a set of bits that, when modifying security
7693 on a file, the user has always set to be 'on'.
</P
7695 >If not set explicitly this parameter is set to the same
7697 HREF=
"#FORCECREATEMODE"
7705 > parameter. To allow a user to
7706 modify all the user/group/world permissions on a file, with no
7707 restrictions set this parameter to
000.
</P
7712 > that users who can access
7713 the Samba server through other means can easily bypass this restriction,
7714 so it is primarily useful for standalone
"appliance" systems.
7715 Administrators of most normal systems will probably want to set
7719 HREF=
"#FORCEDIRECTORYSECURITYMODE"
7723 > force directory security mode
</I
7728 HREF=
"#DIRECTORYSECURITYMASK"
7737 HREF=
"#SECURITYMASK"
7748 >force security mode =
<same as force
7754 >force security mode =
0</B
7764 >This specifies a UNIX user name that will be
7765 assigned as the default user for all users connecting to this service.
7766 This is useful for sharing files. You should also use it carefully
7767 as using it incorrectly can cause security problems.
</P
7769 >This user name only gets used once a connection is established.
7770 Thus clients still need to connect as a valid user and supply a
7771 valid password. Once connected, all file operations will be performed
7772 as the
"forced user", no matter what username the client connected
7773 as. This can be very useful.
</P
7775 >In Samba
2.0.5 and above this parameter also causes the
7776 primary group of the forced user to be used as the primary group
7777 for all file activity. Prior to
2.0.5 the primary group was left
7778 as the primary group of the connecting user (this was a bug).
</P
7798 >force user = auser
</B
7808 >This parameter allows the administrator to
7809 configure the string that specifies the type of filesystem a share
7810 is using that is reported by
<A
7818 > when a client queries the filesystem type
7819 for a share. The default type is
<TT
7823 compatibility with Windows NT but this can be changed to other
7847 >getwd cache (G)
</DT
7850 >This is a tuning option. When this is enabled a
7851 caching algorithm will be used to reduce the time taken for getwd()
7852 calls. This can have a significant impact on performance, especially
7862 >parameter is set to
<TT
7869 >getwd cache = yes
</B
7894 >guest account (S)
</DT
7897 >This is a username which will be used for access
7898 to services which are specified as
<A
7906 > (see below). Whatever privileges this
7907 user has will be available to any client connecting to the guest service.
7908 Typically this user will exist in the password file, but will not
7909 have a valid login. The user account
"ftp" is often a good choice
7910 for this parameter. If a username is specified in a given service,
7911 the specified username overrides this one.
</P
7913 >One some systems the default guest account
"nobody" may not
7914 be able to print. Use another account in this case. You should test
7915 this by trying to log in as your guest user (perhaps by using the
7919 > command) and trying to print using the
7920 system print command such as
<B
7930 >specified at compile time, usually
7936 >guest account = ftp
</B
7946 >If this parameter is
<TT
7950 a service, then no password is required to connect to the service.
7951 Privileges will be those of the
<A
7952 HREF=
"#GUESTACCOUNT"
7961 >See the section below on
<A
7969 > for more information about this option.
7984 >If this parameter is
<TT
7988 a service, then only guest connections to the service are permitted.
7989 This parameter will have no effect if
<A
7997 > is not set for the service.
</P
7999 >See the section below on
<A
8007 > for more information about this option.
8019 >hide dot files (S)
</DT
8022 >This is a boolean parameter that controls whether
8023 files starting with a dot appear as hidden files.
</P
8027 >hide dot files = yes
</B
8037 >This is a list of files or directories that are not
8038 visible but are accessible. The DOS 'hidden' attribute is applied
8039 to any files or directories that match.
</P
8041 >Each entry in the list must be separated by a '/',
8042 which allows spaces to be included in the entry. '*'
8043 and '?' can be used to specify multiple files or directories
8044 as in DOS wildcards.
</P
8046 >Each entry must be a Unix path, not a DOS path and must
8047 not include the Unix directory separator '/'.
</P
8049 >Note that the case sensitivity option is applicable
8052 >Setting this parameter will affect the performance of Samba,
8053 as it will be forced to check all files and directories for a match
8054 as they are scanned.
</P
8057 HREF=
"#HIDEDOTFILES"
8074 HREF=
"#CASESENSITIVE"
8085 >no file are hidden
</I
8091 /.*/DesktopFolderDB/TrashFor%m/resource.frk/
</B
8094 >The above example is based on files that the Macintosh
8095 SMB client (DAVE) available from
<A
8096 HREF=
"http://www.thursby.com"
8100 > creates for internal use, and also still hides
8101 all files beginning with a dot.
</P
8105 NAME=
"HIDELOCALUSERS"
8107 >hide local users(G)
</DT
8110 >This parameter toggles the hiding of local UNIX
8111 users (root, wheel, floppy, etc) from remote clients.
</P
8115 >hide local users = no
</B
8122 >homedir map (G)
</DT
8150 > then this parameter
8151 specifies the NIS (or YP) map from which the server for the user's
8152 home directory should be extracted. At present, only the Sun
8153 auto.home map format is understood. The form of the map is:
</P
8157 >username server:/some/file/system
</B
8160 >and the program will extract the servername from before
8161 the first ':'. There should probably be a better parsing system
8162 that copes with different map formats and also Amd (another
8163 automounter) maps.
</P
8168 >A working NIS client is required on
8169 the system for this option to work.
</P
8181 HREF=
"#DOMAINLOGONS"
8193 >homedir map =
<empty string
></B
8198 >homedir map = amd.homedir
</B
8208 >This boolean parameter is only available
8209 if Samba has been configured and compiled with the
<B
8212 > option. If set to
<TT
8216 Samba will act as a Dfs server, and allow Dfs-aware clients
8217 to browse Dfs trees hosted on the server.
</P
8227 > share level parameter. For
8228 more information on setting up a Dfs tree on Samba,
8230 HREF=
"msdfs_setup.html"
8232 >msdfs_setup.html
</A
8245 >hosts allow (S)
</DT
8248 >A synonym for this parameter is
<TT
8256 >This parameter is a comma, space, or tab delimited
8257 set of hosts which are permitted to access a service.
</P
8259 >If specified in the [global] section then it will
8260 apply to all services, regardless of whether the individual
8261 service has a different setting.
</P
8263 >You can specify the hosts by name or IP number. For
8264 example, you could restrict access to only the hosts on a
8265 Class C subnet with something like
<B
8267 >allow hosts =
150.203.5.
8269 >. The full syntax of the list is described in the man
8272 >hosts_access(
5)
</TT
8273 >. Note that this man
8274 page may not be present on your system, so a brief description will
8275 be given here also.
</P
8277 >Note that the localhost address
127.0.0.1 will always
8278 be allowed access unless specifically denied by a
<A
8288 >You can also specify hosts by network/netmask pairs and
8289 by netgroup names if your system supports netgroups. The
8293 > keyword can also be used to limit a
8294 wildcard list. The following examples may provide some help:
</P
8296 >Example
1: allow all IPs in
150.203.*.*; except one
</P
8300 >hosts allow =
150.203. EXCEPT
150.203.6.66</B
8303 >Example
2: allow hosts that match the given network/netmask
</P
8307 >hosts allow =
150.203.15.0/
255.255.255.0</B
8310 >Example
3: allow a couple of hosts
</P
8314 >hosts allow = lapland, arvidsjaur
</B
8317 >Example
4: allow only hosts in NIS netgroup
"foonet", but
8318 deny access from one particular host
</P
8322 >hosts allow = @foonet
</B
8327 >hosts deny = pirate
</B
8330 >Note that access still requires suitable user-level passwords.
</P
8333 HREF=
"testparm.1.html"
8340 > for a way of testing your host access to see if it does
8345 >none (i.e., all hosts permitted access)
8351 >allow hosts =
150.203.5. myhost.mynet.edu.au
8362 >The opposite of
<TT
8368 - hosts listed here are
<I
8371 > permitted access to
8372 services unless the specific services have their own lists to override
8373 this one. Where the lists conflict, the
<TT
8379 list takes precedence.
</P
8383 >none (i.e., no hosts specifically excluded)
8389 >hosts deny =
150.203.4. badhost.mynet.edu.au
8397 >hosts equiv (G)
</DT
8400 >If this global parameter is a non-null string,
8401 it specifies the name of a file to read for the names of hosts
8402 and users who will be allowed access without specifying a password.
8405 >This is not be confused with
<A
8413 > which is about hosts
8414 access to services and is more useful for guest services.
<TT
8419 > may be useful for NT clients which will
8420 not supply passwords to samba.
</P
8431 > can be a major security hole. This is because you are
8432 trusting the PC to supply the correct username. It is very easy to
8433 get a PC to supply a false username. I recommend that the
8439 > option be only used if you really
8440 know what you are doing, or perhaps on a home network where you trust
8441 your spouse and kids. And only if you
<I
8449 >no host equivalences
</I
8454 >hosts equiv = /etc/hosts.equiv
</B
8464 >This allows you to include one config file
8465 inside another. The file is included literally, as though typed
8468 >It takes the standard substitutions, except
<TT
8489 >no file included
</I
8494 >include = /usr/local/samba/lib/admin_smb.conf
8500 NAME=
"INHERITPERMISSIONS"
8502 >inherit permissions (S)
</DT
8505 >The permissions on new files and directories
8506 are normally governed by
<A
8515 HREF=
"#DIRECTORYMASK"
8523 HREF=
"#FORCECREATEMODE"
8527 >force create mode
</I
8532 HREF=
"#FORCEDIRECTORYMODE"
8540 > but the boolean inherit
8541 permissions parameter overrides this.
</P
8543 >New directories inherit the mode of the parent directory,
8544 including bits such as setgid.
</P
8546 >New files inherit their read/write bits from the parent
8547 directory. Their execute bits continue to be determined by
8577 >Note that the setuid bit is
<I
8581 inheritance (the code explicitly prohibits this).
</P
8583 >This can be particularly useful on large systems with
8584 many users, perhaps several thousand,to allow a single [homes]
8585 share to be used flexibly by each user.
</P
8597 HREF=
"#DIRECTORYMASK"
8605 HREF=
"#FORCECREATEMODE"
8609 >force create mode
</I
8613 HREF=
"#FORCEDIRECTORYMODE"
8617 >force directory mode
</I
8625 >inherit permissions = no
</B
8635 >This option allows you to override the default
8636 network interfaces list that Samba will use for browsing, name
8637 registration and other NBT traffic. By default Samba will query
8638 the kernel for the list of all active interfaces and use any
8639 interfaces except
127.0.0.1 that are broadcast capable.
</P
8641 >The option takes a list of interface strings. Each string
8642 can be in any of the following forms:
</P
8648 >a network interface name (such as eth0).
8649 This may include shell-like wildcards so eth* will match
8650 any interface starting with the substring
"eth"</P
8654 >an IP address. In this case the netmask is
8655 determined from the list of interfaces obtained from the
8660 >an IP/mask pair.
</P
8664 >a broadcast/mask pair.
</P
8668 >The
"mask" parameters can either be a bit length (such
8669 as
24 for a C class network) or a full netmask in dotted
8672 >The
"IP" parameters above can either be a full dotted
8673 decimal IP address or a hostname which will be looked up via
8674 the OS's normal hostname resolution mechanisms.
</P
8676 >For example, the following line:
</P
8680 >interfaces = eth0
192.168.2.10/
24 192.168.3.10/
255.255.255.0
8684 >would configure three network interfaces corresponding
8685 to the eth0 device and IP addresses
192.168.2.10 and
192.168.3.10.
8686 The netmasks of the latter two interfaces would be set to
255.255.255.0.
</P
8689 HREF=
"#BINDINTERFACESONLY"
8701 >all active interfaces except
127.0.0.1
8702 that are broadcast capable
</I
8709 >invalid users (S)
</DT
8712 >This is a list of users that should not be allowed
8713 to login to this service. This is really a
<I
8717 check to absolutely ensure an improper setting does not breach
8720 >A name starting with a '@' is interpreted as an NIS
8721 netgroup first (if your system supports NIS), and then as a UNIX
8722 group if the name was not found in the NIS netgroup database.
</P
8724 >A name starting with '+' is interpreted only
8725 by looking in the UNIX group database. A name starting with
8726 '
&' is interpreted only by looking in the NIS netgroup database
8727 (this requires NIS to be working on your system). The characters
8728 '+' and '
&' may be used at the start of the name in either order
8735 UNIX group database, followed by the NIS netgroup database, and
8741 > means check the NIS
8742 netgroup database, followed by the UNIX group database (the
8743 same as the '@' prefix).</P
8745 >The current servicename is substituted for <TT
8751 This is useful in the [homes] section.</P
8766 >no invalid users</I
8771 >invalid users = root fred admin @wheel
8782 >The value of the parameter (an integer) represents
8783 the number of seconds between <TT
8789 packets. If this parameter is zero, no keepalive packets will be
8790 sent. Keepalive packets, if sent, allow the server to tell whether
8791 a client is still present and responding.</P
8793 >Keepalives should, in general, not be needed if the socket
8794 being used has the SO_KEEPALIVE attribute set on it (see <A
8795 HREF="#SOCKETOPTIONS
"
8803 Basically you should only use this option if you strike difficulties.</P
8817 NAME="KERNELOPLOCKS
"
8819 >kernel oplocks (G)</DT
8822 >For UNIXes that support kernel based <A
8831 (currently only IRIX and the Linux 2.4 kernel), this parameter
8832 allows the use of them to be turned on or off.</P
8834 >Kernel oplocks support allows Samba <TT
8840 > to be broken whenever a local UNIX process or NFS operation
8841 accesses a file that <A
8849 > has oplocked. This allows complete data consistency between
8850 SMB/CIFS, NFS and local file access (and is a <I
8854 cool feature :-).</P
8856 >This parameter defaults to <TT
8860 that have the support, and <TT
8864 don't. You should never need to touch this parameter.</P
8876 HREF="#LEVEL2OPLOCKS
"
8888 >kernel oplocks = yes</B
8895 >lanman auth (G)</DT
8898 >This parameter determines whether or not smbd will
8899 attempt to authentication users using the LANMAN password hash.
8900 If disabled, only clients which support NT password hashes (e.g. Windows
8901 NT/2000 clients, smbclient, etc... but not Windows 95/98 or the MS DOS
8902 network client) will be able to connect to the Samba host.</P
8906 >lanman auth = yes</B
8911 NAME="LEVEL2OPLOCKS
"
8913 >level2 oplocks (S)</DT
8916 >This parameter controls whether Samba supports
8917 level2 (read-only) oplocks on a share.</P
8919 >Level2, or read-only oplocks allow Windows NT clients
8920 that have an oplock on a file to downgrade from a read-write oplock
8921 to a read-only oplock once a second client opens the file (instead
8922 of releasing all oplocks on a second open, as in traditional,
8923 exclusive oplocks). This allows all openers of the file that
8924 support level2 oplocks to cache the file for read-ahead only (ie.
8925 they may not cache writes or lock requests) and increases performance
8926 for many accesses of files that are not commonly written (such as
8927 application .EXE files).</P
8929 >Once one of the clients which have a read-only oplock
8930 writes to the file all clients are notified (no reply is needed
8931 or waited for) and told to break their oplocks to "none
" and
8932 delete any read-ahead caches.</P
8934 >It is recommended that this parameter be turned on
8935 to speed access to shared executables.</P
8937 >For more discussions on level2 oplocks see the CIFS spec.</P
8940 HREF="#KERNELOPLOCKS
"
8948 > are supported then level2 oplocks are
8949 not granted (even if this parameter is set to <TT
8962 > parameter must be set to "true
" on this share in order for
8963 this parameter to have any effect.</P
8987 >level2 oplocks = yes</B
8994 >lm announce (G)</DT
8997 >This parameter determines if <A
9004 > will produce Lanman announce
9005 broadcasts that are needed by OS/2 clients in order for them to see
9006 the Samba server in their browse list. This parameter can have three
9017 >. The default is <TT
9024 > Samba will never produce these
9025 broadcasts. If set to <TT
9028 > Samba will produce
9029 Lanman announce broadcasts at a frequency set by the parameter
9039 Samba will not send Lanman announce broadcasts by default but will
9040 listen for them. If it hears such a broadcast on the wire it will
9041 then start sending them at a frequency set by the parameter
9062 >lm announce = auto</B
9067 >lm announce = yes</B
9074 >lm interval (G)</DT
9077 >If Samba is set to produce Lanman announce
9078 broadcasts needed by OS/2 clients (see the <A
9086 > parameter) then this
9087 parameter defines the frequency in seconds with which they will be
9088 made. If this is set to zero then no Lanman announcements will be
9089 made despite the setting of the <TT
9110 >lm interval = 60</B
9115 >lm interval = 120</B
9122 >load printers (G)</DT
9125 >A boolean variable that controls whether all
9126 printers in the printcap will be loaded for browsing by default.
9135 >load printers = yes</B
9142 >local master (G)</DT
9145 >This option allows <A
9152 > to try and become a local master browser
9153 on a subnet. If set to <TT
9159 > will not attempt to become a local master browser
9160 on a subnet and will also lose in all browsing elections. By
9161 default this value is set to true. Setting this value to true doesn't
9162 mean that Samba will <I
9166 browser on a subnet, just that <B
9172 > in elections for local master browser.</P
9174 >Setting this value to False will cause <B
9181 > to become a local master browser.</P
9185 >local master = yes</B
9196 HREF="#LOCKDIRECTORY
"
9207 NAME="LOCKDIRECTORY
"
9209 >lock directory (G)</DT
9212 >This option specifies the directory where lock
9213 files will be placed. The lock files are used to implement the
9215 HREF="#MAXCONNECTIONS
"
9227 >lock directory = ${prefix}/var/locks</B
9232 >lock directory = /var/run/samba/locks</B
9243 >This controls whether or not locking will be
9244 performed by the server in response to lock requests from the
9250 >, all lock and unlock
9251 requests will appear to succeed and all lock queries will report
9252 that the file in question is available for locking.</P
9257 >, real locking will be performed
9263 > be useful for read-only
9264 filesystems which <I
9267 > not need locking (such as
9268 cdrom drives), although setting this parameter of <TT
9272 is not really recommended even in this case.</P
9274 >Be careful about disabling locking either globally or in a
9275 specific service, as lack of locking may result in data corruption.
9276 You should never need to set this parameter.</P
9290 >This option allows you to override the name
9291 of the Samba log file (also known as the debug file).</P
9293 >This option takes the standard substitutions, allowing
9294 you to have separate log files for each user or machine.</P
9298 >log file = /usr/local/samba/var/log.%m
9323 >logon drive (G)</DT
9326 >This parameter specifies the local path to
9327 which the home directory will be connected (see <A
9336 and is only used by NT Workstations. </P
9338 >Note that this option is only useful if Samba is set up as a
9343 >logon drive = z:</B
9348 >logon drive = h:</B
9358 >This parameter specifies the home directory
9359 location when a Win95/98 or NT Workstation logs into a Samba PDC.
9360 It allows you to do </P
9368 >NET USE H: /HOME</B
9373 >from a command prompt, for example.</P
9375 >This option takes the standard substitutions, allowing
9376 you to have separate logon scripts for each user or machine.</P
9378 >This parameter can be used with Win9X workstations to ensure
9379 that roaming profiles are stored in a subdirectory of the user's
9380 home directory. This is done in the following way:</P
9384 >logon home = \\%N\%U\profile</B
9387 >This tells Samba to return the above string, with
9388 substitutions made when a client requests the info, generally
9389 in a NetUserGetInfo request. Win9X clients truncate the info to
9390 \\server\share when a user does <B
9394 but use the whole string when dealing with profiles.
</P
9396 >Note that in prior versions of Samba, the
<A
9404 > was returned rather than
9414 > but allowed profiles outside the home directory.
9415 The current implementation is correct, and can be used for
9416 profiles if you use the above trick.
</P
9418 >This option is only useful if Samba is set up as a logon
9423 >logon home =
"\\%N\%U"</B
9428 >logon home =
"\\remote_smb_server\%U"</B
9439 >This parameter specifies the home directory
9440 where roaming profiles (NTuser.dat etc files for Windows NT) are
9441 stored. Contrary to previous versions of these manual pages, it has
9442 nothing to do with Win
9X roaming profiles. To find out how to
9443 handle roaming profiles for Win
9X system, see the
<A
9453 >This option takes the standard substitutions, allowing you
9454 to have separate logon scripts for each user or machine. It also
9455 specifies the directory from which the
"Application Data",
9465 >network neighborhood
</TT
9470 and other folders, and their contents, are loaded and displayed on
9471 your Windows NT client.
</P
9473 >The share and the path must be readable by the user for
9474 the preferences and directories to be loaded onto the Windows NT
9475 client. The share must be writeable when the logs in for the first
9476 time, in order that the Windows NT client can create the NTuser.dat
9477 and other directories.
</P
9479 >Thereafter, the directories and any of the contents can,
9480 if required, be made read-only. It is not advisable that the
9481 NTuser.dat file be made read-only - rename it to NTuser.man to
9482 achieve the desired effect (a
<I
9488 >Windows clients can sometimes maintain a connection to
9489 the [homes] share, even though there is no user logged in.
9490 Therefore, it is vital that the logon path does not include a
9491 reference to the homes share (i.e. setting this parameter to
9492 \%N\%U\profile_path will cause problems).
</P
9494 >This option takes the standard substitutions, allowing
9495 you to have separate logon scripts for each user or machine.
</P
9497 >Note that this option is only useful if Samba is set up
9498 as a logon server.
</P
9502 >logon path = \\%N\%U\profile
</B
9507 >logon path = \\PROFILESERVER\PROFILE\%U
</B
9514 >logon script (G)
</DT
9517 >This parameter specifies the batch file (.bat) or
9518 NT command file (.cmd) to be downloaded and run on a machine when
9519 a user successfully logs in. The file must contain the DOS
9520 style cr/lf line endings. Using a DOS-style editor to create the
9521 file is recommended.
</P
9523 >The script must be a relative path to the [netlogon]
9524 service. If the [netlogon] service specifies a
<A
9534 >/usr/local/samba/netlogon
9538 >logon script = STARTUP.BAT
</B
9540 the file that will be downloaded is:
</P
9544 >/usr/local/samba/netlogon/STARTUP.BAT
</TT
9547 >The contents of the batch file is entirely your choice. A
9548 suggested command would be to add
<B
9550 >NET TIME \\SERVER /SET
9552 >, to force every machine to synchronize clocks with
9553 the same time server. Another use would be to add
<B
9556 U: \\SERVER\UTILS
</B
9557 > for commonly used utilities, or
<B
9559 > NET USE Q: \\SERVER\ISO9001_QA
</B
9562 >Note that it is particularly important not to allow write
9563 access to the [netlogon] share, or to grant users write permission
9564 on the batch files in a secure environment, as this would allow
9565 the batch files to be arbitrarily modified and security to be
9568 >This option takes the standard substitutions, allowing you
9569 to have separate logon scripts for each user or machine.
</P
9571 >This option is only useful if Samba is set up as a logon
9576 >no logon script defined
</I
9581 >logon script = scripts\%U.bat
</B
9586 NAME=
"LPPAUSECOMMAND"
9588 >lppause command (S)
</DT
9591 >This parameter specifies the command to be
9592 executed on the server host in order to stop printing or spooling
9593 a specific print job.
</P
9595 >This command should be a program or script which takes
9596 a printer name and job number to pause the print job. One way
9597 of implementing this is by using job priorities, where jobs
9598 having a too low priority won't be sent to the printer.
</P
9605 > is given then the printername
9606 is put in its place. A
<TT
9612 the job number (an integer). On HPUX (see
<TT
9624 to the lpq command, the job will show up with the correct status, i.e.
9625 if the job priority is lower than the set fence priority it will
9626 have the PAUSED status, whereas if the priority is equal or higher it
9627 will have the SPOOLED or PRINTING status.
</P
9629 >Note that it is good practice to include the absolute path
9630 in the lppause command as the PATH may not be available to the server.
</P
9643 >Default: Currently no default value is given to
9644 this string, unless the value of the
<TT
9653 >, in which case the default is :
</P
9657 >lp -i %p-%j -H hold
</B
9660 >or if the value of the
<TT
9669 >, then the default is:
</P
9673 >qstat -s -j%j -h
</B
9676 >Example for HPUX:
<B
9678 >lppause command = /usr/bin/lpalt
9686 >lpq cache time (G)
</DT
9689 >This controls how long lpq info will be cached
9690 for to prevent the
<B
9693 > command being called too
9694 often. A separate cache is kept for each variation of the
<B
9697 > command used by the system, so if you use different
9701 > commands for different users then they won't
9702 share cache information.
</P
9704 >The cache files are stored in
<TT
9708 where xxxx is a hash of the
<B
9711 > command in use.
</P
9713 >The default is
10 seconds, meaning that the cached results
9714 of a previous identical
<B
9717 > command will be used
9718 if the cached data is less than
10 seconds old. A large value may
9719 be advisable if your
<B
9722 > command is very slow.
</P
9724 >A value of
0 will disable caching completely.
</P
9739 >lpq cache time =
10</B
9744 >lpq cache time =
30</B
9751 >lpq command (S)
</DT
9754 >This parameter specifies the command to be
9755 executed on the server host in order to obtain
<B
9759 >-style printer status information.
</P
9761 >This command should be a program or script which
9762 takes a printer name as its only parameter and outputs printer
9763 status information.
</P
9765 >Currently eight styles of printer status information
9766 are supported; BSD, AIX, LPRNG, PLP, SYSV, HPUX, QNX and SOFTQ.
9767 This covers most UNIX systems. You control which type is expected
9775 >Some clients (notably Windows for Workgroups) may not
9776 correctly send the connection number for the printer they are
9777 requesting status information about. To get around this, the
9778 server reports on the first printer service connected to by the
9779 client. This only happens if the connection number sent is invalid.
</P
9786 > is given then the printername
9787 is put in its place. Otherwise it is placed at the end of the
9790 >Note that it is good practice to include the absolute path
9800 > may not be available to the server.
</P
9815 >depends on the setting of
<TT
9825 >lpq command = /usr/bin/lpq -P%p
</B
9830 NAME=
"LPRESUMECOMMAND"
9832 >lpresume command (S)
</DT
9835 >This parameter specifies the command to be
9836 executed on the server host in order to restart or continue
9837 printing or spooling a specific print job.
</P
9839 >This command should be a program or script which takes
9840 a printer name and job number to resume the print job. See
9842 HREF=
"#LPPAUSECOMMAND"
9857 > is given then the printername
9858 is put in its place. A
<TT
9864 the job number (an integer).
</P
9866 >Note that it is good practice to include the absolute path
9870 >lpresume command
</I
9872 > as the PATH may not
9873 be available to the server.
</P
9886 >Default: Currently no default value is given
9887 to this string, unless the value of the
<TT
9896 >, in which case the default is :
</P
9900 >lp -i %p-%j -H resume
</B
9903 >or if the value of the
<TT
9912 >, then the default is:
</P
9916 >qstat -s -j%j -r
</B
9919 >Example for HPUX:
<B
9921 >lpresume command = /usr/bin/lpalt
9929 >lprm command (S)
</DT
9932 >This parameter specifies the command to be
9933 executed on the server host in order to delete a print job.
</P
9935 >This command should be a program or script which takes
9936 a printer name and job number, and deletes the print job.
</P
9943 > is given then the printername
9944 is put in its place. A
<TT
9950 the job number (an integer).
</P
9952 >Note that it is good practice to include the absolute
9958 > as the PATH may not be
9959 available to the server.
</P
9974 >depends on the setting of
<TT
9985 >lprm command = /usr/bin/lprm -P%p %j
9991 >lprm command = /usr/bin/cancel %p-%j
9997 NAME=
"MACHINEPASSWORDTIMEOUT"
9999 >machine password timeout (G)
</DT
10002 >If a Samba server is a member of an Windows
10003 NT Domain (see the
<A
10004 HREF=
"#SECURITYEQUALSDOMAIN"
10005 >security=domain
</A
10007 parameter) then periodically a running
<A
10011 > process will try and change the MACHINE ACCOUNT
10012 PASSWORD stored in the TDB called
<TT
10014 >private/secrets.tdb
10016 >. This parameter specifies how often this password
10017 will be changed, in seconds. The default is one week (expressed in
10018 seconds), the same as a Windows NT Domain member server.
</P
10021 HREF=
"smbpasswd.8.html"
10029 HREF=
"#SECURITYEQUALSDOMAIN"
10030 > security=domain
</A
10035 >machine password timeout =
604800</B
10042 >magic output (S)
</DT
10045 >This parameter specifies the name of a file
10046 which will contain output created by a magic script (see the
10048 HREF=
"#MAGICSCRIPT"
10056 parameter below).
</P
10058 >Warning: If two clients use the same
<TT
10064 > in the same directory the output file content
10069 >magic output =
<magic script name
>.out
10075 >magic output = myfile.txt
</B
10082 >magic script (S)
</DT
10085 >This parameter specifies the name of a file which,
10086 if opened, will be executed by the server when the file is closed.
10087 This allows a UNIX script to be sent to the Samba host and
10088 executed on behalf of the connected user.
</P
10090 >Scripts executed in this way will be deleted upon
10091 completion assuming that the user has the appripriate level
10092 of priviledge and the ile permissions allow the deletion.
</P
10094 >If the script generates output, output will be sent to
10095 the file specified by the
<A
10096 HREF=
"#MAGICOUTPUT"
10103 > parameter (see above).
</P
10105 >Note that some shells are unable to interpret scripts
10106 containing CR/LF instead of CR as
10107 the end-of-line marker. Magic scripts must be executable
10111 > on the host, which for some hosts and
10112 some shells will require filtering at the DOS end.
</P
10114 >Magic scripts are
<I
10121 > be relied upon.
</P
10125 >None. Magic scripts disabled.
</I
10130 >magic script = user.csh
</B
10137 >mangle case (S)
</DT
10140 >See the section on
<A
10147 >mangle case = no
</B
10154 >mangled map (S)
</DT
10157 >This is for those who want to directly map UNIX
10158 file names which can not be represented on Windows/DOS. The mangling
10159 of names is not always what is needed. In particular you may have
10160 documents with file extensions that differ between DOS and UNIX.
10161 For example, under UNIX it is common to use
<TT
10165 for HTML files, whereas under Windows/DOS
<TT
10169 is more commonly used.
</P
10182 >mangled map = (*.html *.htm)
</B
10185 >One very useful case is to remove the annoying
<TT
10189 > off the ends of filenames on some CDROMS (only visible
10190 under some UNIXes). To do this use a map of (*;
1 *;).
</P
10199 >mangled map = (*;
1 *;)
</B
10204 NAME=
"MANGLEDNAMES"
10206 >mangled names (S)
</DT
10209 >This controls whether non-DOS names under UNIX
10210 should be mapped to DOS-compatible names (
"mangled") and made visible,
10211 or whether non-DOS names should simply be ignored.
</P
10213 >See the section on
<A
10216 > for details on how to control the mangling process.
</P
10218 >If mangling is used then the mangling algorithm is as follows:
</P
10224 >The first (up to) five alphanumeric characters
10225 before the rightmost dot of the filename are preserved, forced
10226 to upper case, and appear as the first (up to) five characters
10227 of the mangled name.
</P
10231 >A tilde
"~" is appended to the first part of the mangled
10232 name, followed by a two-character unique sequence, based on the
10233 original root name (i.e., the original filename minus its final
10234 extension). The final extension is included in the hash calculation
10235 only if it contains any upper case characters or is longer than three
10238 >Note that the character to use may be specified using
10240 HREF=
"#MANGLINGCHAR"
10248 > option, if you don't like '~'.
</P
10252 >The first three alphanumeric characters of the final
10253 extension are preserved, forced to upper case and appear as the
10254 extension of the mangled name. The final extension is defined as that
10255 part of the original filename after the rightmost dot. If there are no
10256 dots in the filename, the mangled name will have no extension (except
10257 in the case of
"hidden files" - see below).
</P
10261 >Files whose UNIX name begins with a dot will be
10262 presented as DOS hidden files. The mangled name will be created as
10263 for other filenames, but with the leading dot removed and
"___" as
10264 its extension regardless of actual original extension (that's three
10269 >The two-digit hash value consists of upper case
10270 alphanumeric characters.
</P
10272 >This algorithm can cause name collisions only if files
10273 in a directory share the same first five alphanumeric characters.
10274 The probability of such a clash is
1/
1300.
</P
10276 >The name mangling (if enabled) allows a file to be
10277 copied between UNIX directories from Windows/DOS while retaining
10278 the long UNIX filename. UNIX files can be renamed to a new extension
10279 from Windows/DOS and will retain the same basename. Mangled names
10280 do not change between sessions.
</P
10284 >mangled names = yes
</B
10289 NAME=
"MANGLEDSTACK"
10291 >mangled stack (G)
</DT
10294 >This parameter controls the number of mangled names
10295 that should be cached in the Samba server
<A
10301 >This stack is a list of recently mangled base names
10302 (extensions are only maintained if they are longer than
3 characters
10303 or contains upper case characters).
</P
10305 >The larger this value, the more likely it is that mangled
10306 names can be successfully converted to correct long UNIX names.
10307 However, large stack sizes will slow most directory access. Smaller
10308 stacks save memory in the server (each stack element costs
256 bytes).
10311 >It is not possible to absolutely guarantee correct long
10312 file names, so be prepared for some surprises!
</P
10316 >mangled stack =
50</B
10321 >mangled stack =
100</B
10326 NAME=
"MANGLINGCHAR"
10328 >mangling char (S)
</DT
10331 >This controls what character is used as
10338 >. The default is a '~'
10339 but this may interfere with some software. Use this option to set
10340 it to whatever you prefer.
</P
10344 >mangling char = ~
</B
10349 >mangling char = ^
</B
10356 >map archive (S)
</DT
10359 >This controls whether the DOS archive attribute
10360 should be mapped to the UNIX owner execute bit. The DOS archive bit
10361 is set when a file has been modified since its last backup. One
10362 motivation for this option it to keep Samba/your PC from making
10363 any file it touches from becoming executable under UNIX. This can
10364 be quite annoying for shared source code, documents, etc...
</P
10366 >Note that this requires the
<TT
10372 parameter to be set such that owner execute bit is not masked out
10373 (i.e. it must include
100). See the parameter
<A
10385 >map archive = yes
</B
10392 >map hidden (S)
</DT
10395 >This controls whether DOS style hidden files
10396 should be mapped to the UNIX world execute bit.
</P
10398 >Note that this requires the
<TT
10404 to be set such that the world execute bit is not masked out (i.e.
10405 it must include
001). See the parameter
<A
10417 >map hidden = no
</B
10424 >map system (S)
</DT
10427 >This controls whether DOS style system files
10428 should be mapped to the UNIX group execute bit.
</P
10430 >Note that this requires the
<TT
10436 to be set such that the group execute bit is not masked out (i.e.
10437 it must include
010). See the parameter
<A
10449 >map system = no
</B
10456 >map to guest (G)
</DT
10459 >This parameter is only useful in
<A
10462 > modes other than
<TT
10480 >This parameter can take three different values, which tell
10485 > what to do with user
10486 login requests that don't match a valid UNIX user in some way.
</P
10488 >The three settings are :
</P
10497 > - Means user login
10498 requests with an invalid password are rejected. This is the
10507 logins with an invalid password are rejected, unless the username
10508 does not exist, in which case it is treated as a guest login and
10510 HREF=
"#GUESTACCOUNT"
10524 > - Means user logins
10525 with an invalid password are treated as a guest login and mapped
10527 HREF=
"#GUESTACCOUNT"
10530 this can cause problems as it means that any user incorrectly typing
10531 their password will be silently logged on as
"guest" - and
10532 will not know the reason they cannot access files they think
10533 they should - there will have been no message given to them
10534 that they got their password wrong. Helpdesk services will
10538 > you if you set the
<TT
10544 > parameter this way :-).
</P
10548 >Note that this parameter is needed to set up
"Guest"
10549 share services when using
<TT
10555 share. This is because in these modes the name of the resource being
10559 > sent to the server until after
10560 the server has successfully authenticated the client so the server
10561 cannot make authentication decisions at the correct time (connection
10562 to the share) for
"Guest" shares.
</P
10564 >For people familiar with the older Samba releases, this
10565 parameter maps to the old compile-time setting of the
<TT
10567 > GUEST_SESSSETUP
</TT
10568 > value in local.h.
</P
10572 >map to guest = Never
</B
10577 >map to guest = Bad User
</B
10582 NAME=
"MAXCONNECTIONS"
10584 >max connections (S)
</DT
10587 >This option allows the number of simultaneous
10588 connections to a service to be limited. If
<TT
10594 > is greater than
0 then connections will be refused if
10595 this number of connections to the service are already open. A value
10596 of zero mean an unlimited number of connections may be made.
</P
10598 >Record lock files are used to implement this feature. The
10599 lock files will be stored in the directory specified by the
<A
10600 HREF=
"#LOCKDIRECTORY"
10612 >max connections =
0</B
10617 >max connections =
10</B
10624 >max disk size (G)
</DT
10627 >This option allows you to put an upper limit
10628 on the apparent size of disks. If you set this option to
100
10629 then all shares will appear to be not larger than
100 MB in
10632 >Note that this option does not limit the amount of
10633 data you can put on the disk. In the above case you could still
10634 store much more than
100 MB on the disk, but if a client ever asks
10635 for the amount of free disk space or the total disk size then the
10636 result will be bounded by the amount specified in
<TT
10644 >This option is primarily useful to work around bugs
10645 in some pieces of software that can't handle very large disks,
10646 particularly disks over
1GB in size.
</P
10653 > of
0 means no limit.
</P
10657 >max disk size =
0</B
10662 >max disk size =
1000</B
10669 >max log size (G)
</DT
10672 >This option (an integer in kilobytes) specifies
10673 the max size the log file should grow to. Samba periodically checks
10674 the size and if it is exceeded it will rename the file, adding
10680 >A size of
0 means no limit.
</P
10684 >max log size =
5000</B
10689 >max log size =
1000</B
10699 >This option controls the maximum number of
10700 outstanding simultaneous SMB operations that samba tells the client
10701 it will allow. You should never need to set this parameter.
</P
10710 NAME=
"MAXOPENFILES"
10712 >max open files (G)
</DT
10715 >This parameter limits the maximum number of
10716 open files that one
<A
10721 serving process may have open for a client at any one time. The
10722 default for this parameter is set very high (
10,
000) as Samba uses
10723 only one bit per unopened file.
</P
10725 >The limit of the number of open files is usually set
10726 by the UNIX per-process file descriptor limit rather than
10727 this parameter so you should never need to touch this parameter.
</P
10731 >max open files =
10000</B
10736 NAME=
"MAXPRINTJOBS"
10738 >max print jobs (S)
</DT
10741 >This parameter limits the maximum number of
10742 jobs allowable in a Samba printer queue at any given moment.
10743 If this number is exceeded,
<A
10750 > will remote
"Out of Space" to the client.
10752 HREF=
"#TOTALPRINTJOBS"
10765 >max print jobs =
1000</B
10770 >max print jobs =
5000</B
10777 >max protocol (G)
</DT
10780 >The value of the parameter (a string) is the highest
10781 protocol level that will be supported by the server.
</P
10783 >Possible values are :
</P
10792 >: Earliest version. No
10793 concept of user names.
</P
10800 >: Slight improvements on
10801 CORE for efficiency.
</P
10811 > version of the protocol. Long filename
10819 >: Updates to Lanman1 protocol.
10827 >: Current up to date version of
10828 the protocol. Used by Windows NT. Known as CIFS.
</P
10832 >Normally this option should not be set as the automatic
10833 negotiation phase in the SMB protocol takes care of choosing
10834 the appropriate protocol.
</P
10837 HREF=
"#MINPROTOCOL"
10849 >max protocol = NT1
</B
10854 >max protocol = LANMAN1
</B
10859 NAME=
"MAXSMBDPROCESSES"
10861 >max smbd processes (G)
</DT
10864 >This parameter limits the maximum number of
10873 processes concurrently running on a system and is intended
10874 as a stop gap to prevent degrading service to clients in the event
10875 that the server has insufficient resources to handle more than this
10876 number of connections. Remember that under normal operating
10877 conditions, each user will have an smbd associated with him or her
10878 to handle connections to all shares from a given host.
10883 >max smbd processes =
0</B
10888 >max smbd processes =
1000</B
10898 >This option tells
<A
10903 what the default 'time to live' of NetBIOS names should be (in seconds)
10907 > is requesting a name using either a
10908 broadcast packet or from a WINS server. You should never need to
10909 change this parameter. The default is
3 days.
</P
10913 >max ttl =
259200</B
10920 >max wins ttl (G)
</DT
10923 >This option tells
<A
10928 > when acting as a WINS server (
<A
10929 HREF=
"#WINSSUPPORT"
10933 >wins support=yes
</I
10936 >) what the maximum
10937 'time to live' of NetBIOS names that
<B
10941 will grant will be (in seconds). You should never need to change this
10942 parameter. The default is
6 days (
518400 seconds).
</P
10957 >max wins ttl = 518400</B
10967 >This option controls the maximum packet size
10968 that will be negotiated by Samba. The default is 65535, which
10969 is the maximum. In some cases you may find you get better performance
10970 with a smaller value. A value below 2048 is likely to cause problems.
10975 >max xmit = 65535</B
10980 >max xmit = 8192</B
10985 NAME="MESSAGECOMMAND
"
10987 >message command (G)</DT
10990 >This specifies what command to run when the
10991 server receives a WinPopup style message.</P
10993 >This would normally be a command that would
10994 deliver the message somehow. How this is to be done is
10995 up to your imagination.</P
11001 >message command = csh -c 'xedit %s;rm %s' &</B
11005 >This delivers the message using <B
11009 removes it afterwards. <I
11011 >NOTE THAT IT IS VERY IMPORTANT
11012 THAT THIS COMMAND RETURN IMMEDIATELY</I
11014 have the '&' on the end. If it doesn't return immediately then
11015 your PCs may freeze when sending messages (they should recover
11016 after 30secs, hopefully).</P
11018 >All messages are delivered as the global guest user.
11019 The command takes the standard substitutions, although <TT
11032 >Apart from the standard substitutions, some additional
11033 ones apply. In particular:</P
11044 > = the filename containing
11054 > = the destination that
11055 the message was sent to (probably the server name).</P
11064 > = who the message
11069 >You could make this command send mail, or whatever else
11070 takes your fancy. Please let us know of any really interesting
11073 >Here's a way of sending the messages as mail to root:</P
11077 >message command = /bin/mail -s 'message from %f on
11078 %m' root < %s; rm %s</B
11081 >If you don't have a message command then the message
11082 won't be delivered and Samba will tell the sender there was
11083 an error. Unfortunately WfWg totally ignores the error code
11084 and carries on regardless, saying that the message was delivered.
11087 >If you want to silently delete it then try:</P
11091 >message command = rm %s</B
11096 >no message command</I
11101 >message command = csh -c 'xedit %s;
11107 NAME="MINPASSWDLENGTH
"
11109 >min passwd length (G)</DT
11113 HREF="#MINPASSWORDLENGTH
"
11117 >min password length</I
11124 NAME="MINPASSWORDLENGTH
"
11126 >min password length (G)</DT
11129 >This option sets the minimum length in characters
11130 of a plaintext password that <B
11133 > will accept when performing
11134 UNIX password changing.</P
11137 HREF="#UNIXPASSWORDSYNC
"
11146 HREF="#PASSWDPROGRAM
"
11154 HREF="#PASSWDCHATDEBUG
"
11158 >passwd chat debug</I
11166 >min password length = 5</B
11171 NAME="MINPRINTSPACE
"
11173 >min print space (S)</DT
11176 >This sets the minimum amount of free disk
11177 space that must be available before a user will be able to spool
11178 a print job. It is specified in kilobytes. The default is 0, which
11179 means a user can always spool a print job.</P
11194 >min print space = 0</B
11199 >min print space = 2000</B
11206 >min protocol (G)</DT
11209 >The value of the parameter (a string) is the
11210 lowest SMB protocol dialect than Samba will support. Please refer
11212 HREF="#MAXPROTOCOL
"
11220 parameter for a list of valid protocol names and a brief description
11221 of each. You may also wish to refer to the C source code in
11224 >source/smbd/negprot.c</TT
11225 > for a listing of known protocol
11226 dialects supported by clients.</P
11228 >If you are viewing this parameter as a security measure, you should
11229 also refer to the <A
11238 > parameter. Otherwise, you should never need
11239 to change this parameter.</P
11243 >min protocol = CORE</B
11248 >min protocol = NT1</B
11256 >min wins ttl (G)</DT
11259 >This option tells <A
11264 when acting as a WINS server (<A
11265 HREF="#WINSSUPPORT
"
11269 > wins support = yes</I
11272 >) what the minimum 'time to live'
11273 of NetBIOS names that <B
11276 > will grant will be (in
11277 seconds). You should never need to change this parameter. The default
11278 is 6 hours (21600 seconds).</P
11282 >min wins ttl = 21600</B
11289 >msdfs root (S)</DT
11292 >This boolean parameter is only available if
11293 Samba is configured and compiled with the <B
11296 > option. If set to <TT
11300 Samba treats the share as a Dfs root and allows clients to browse
11301 the distributed file system tree rooted at the share directory.
11302 Dfs links are specified in the share directory by symbolic
11303 links of the form <TT
11305 >msdfs:serverA\shareA,serverB\shareB
11307 > and so on. For more information on setting up a Dfs tree
11308 on Samba, refer to <A
11309 HREF="msdfs_setup.html
"
11328 >msdfs root = no</B
11333 NAME="NAMERESOLVEORDER
"
11335 >name resolve order (G)</DT
11338 >This option is used by the programs in the Samba
11339 suite to determine what naming services to use and in what order
11340 to resolve host names to IP addresses. The option takes a space
11341 separated string of name resolution options.</P
11343 >The options are :"lmhosts
", "host
", "wins
" and "bcast
". They
11344 cause names to be resolved as follows :</P
11354 address in the Samba lmhosts file. If the line in lmhosts has
11355 no name type attached to the NetBIOS name (see the <A
11356 HREF="lmhosts
.5.html
"
11359 > for details) then
11360 any name type matches for lookup.</P
11367 > : Do a standard host
11368 name to IP address resolution, using the system <TT
11372 >, NIS, or DNS lookups. This method of name resolution
11373 is operating system depended for instance on IRIX or Solaris this
11374 may be controlled by the <TT
11376 >/etc/nsswitch.conf</TT
11378 file). Note that this method is only used if the NetBIOS name
11379 type being queried is the 0x20 (server) name type, otherwise
11387 > : Query a name with
11388 the IP address listed in the <A
11396 > parameter. If no WINS server has
11397 been specified this method will be ignored.</P
11404 > : Do a broadcast on
11405 each of the known local interfaces listed in the <A
11414 parameter. This is the least reliable of the name resolution
11415 methods as it depends on the target host being on a locally
11416 connected subnet.</P
11422 >name resolve order = lmhosts host wins bcast
11428 >name resolve order = lmhosts bcast host
11432 >This will cause the local lmhosts file to be examined
11433 first, followed by a broadcast attempt, followed by a normal
11434 system hostname lookup.</P
11438 NAME="NETBIOSALIASES
"
11440 >netbios aliases (G)</DT
11443 >This is a list of NetBIOS names that <A
11447 > will advertise as additional
11448 names by which the Samba server is known. This allows one machine
11449 to appear in browse lists under multiple names. If a machine is
11450 acting as a browse server or logon server none
11451 of these names will be advertised as either browse server or logon
11452 servers, only the primary name of the machine will be advertised
11453 with these capabilities.</P
11456 HREF="#NETBIOSNAME
"
11468 >empty string (no additional names)</I
11473 >netbios aliases = TEST TEST1 TEST2</B
11480 >netbios name (G)</DT
11483 >This sets the NetBIOS name by which a Samba
11484 server is known. By default it is the same as the first component
11485 of the host's DNS name. If a machine is a browse server or
11486 logon server this name (or the first component
11487 of the hosts DNS name) will be the name that these services are
11488 advertised under.</P
11491 HREF="#NETBIOSALIASES
"
11503 >machine DNS name</I
11508 >netbios name = MYNAME</B
11513 NAME="NETBIOSSCOPE
"
11515 >netbios scope (G)</DT
11518 >This sets the NetBIOS scope that Samba will
11519 operate under. This should not be set unless every machine
11520 on your LAN also sets this value.</P
11526 >nis homedir (G)</DT
11529 >Get the home share server from a NIS map. For
11530 UNIX systems that use an automounter, the user's home directory
11531 will often be mounted on a workstation on demand from a remote
11534 >When the Samba logon server is not the actual home directory
11535 server, but is mounting the home directories via NFS then two
11536 network hops would be required to access the users home directory
11537 if the logon server told the client to use itself as the SMB server
11538 for home directories (one over SMB and one over NFS). This can
11541 >This option allows Samba to return the home share as
11542 being on a different server to the logon server and as
11543 long as a Samba daemon is running on the home directory server,
11544 it will be mounted on the Samba client directly from the directory
11545 server. When Samba is returning the home share to the client, it
11546 will consult the NIS map specified in <A
11554 > and return the server
11557 >Note that for this option to work there must be a working
11558 NIS system and the Samba server with this option must also
11559 be a logon server.</P
11563 >nis homedir = no</B
11568 NAME="NTACLSUPPORT
"
11570 >nt acl support (G)</DT
11573 >This boolean parameter controls whether
11578 > will attempt to map
11579 UNIX permissions into Windows NT access control lists.</P
11583 >nt acl support = yes</B
11588 NAME="NTPIPESUPPORT
"
11590 >nt pipe support (G)</DT
11593 >This boolean parameter controls whether
11598 > will allow Windows NT
11599 clients to connect to the NT SMB specific <TT
11603 pipes. This is a developer debugging option and can be left
11608 >nt pipe support = yes</B
11613 NAME="NTSMBSUPPORT
"
11615 >nt smb support (G)</DT
11618 >This boolean parameter controls whether <A
11622 > will negotiate NT specific SMB
11623 support with Windows NT clients. Although this is a developer
11624 debugging option and should be left alone, benchmarking has discovered
11625 that Windows NT clients give faster performance with this option
11629 >. This is still being investigated.
11630 If this option is set to <TT
11633 > then Samba offers
11634 exactly the same SMB calls that versions prior to Samba 2.0 offered.
11635 This information may be of use if any users are having problems
11636 with NT SMB support.</P
11638 >You should not need to ever disable this parameter.</P
11642 >nt smb support = yes</B
11647 NAME="NULLPASSWORDS
"
11649 >null passwords (G)</DT
11652 >Allow or disallow client access to accounts
11653 that have null passwords. </P
11656 HREF="smbpasswd
.5.html
"
11663 >null passwords = no</B
11673 >This is a boolean option that controls whether
11674 connections with usernames not in the <TT
11680 list will be allowed. By default this option is disabled so that a
11681 client can supply a username to be used by the server. Enabling
11682 this parameter will force the server to only user the login
11688 > list and is only really
11690 HREF="#SECURITYEQUALSSHARE
"
11695 >Note that this also means Samba won't try to deduce
11696 usernames from the service name. This can be annoying for
11697 the [homes] section. To get around this you could use <B
11701 > which means your <TT
11707 will be just the service name, which for home directories is the
11708 name of the user.</P
11728 NAME="OLELOCKINGCOMPATIBILITY
"
11730 >ole locking compatibility (G)</DT
11733 >This parameter allows an administrator to turn
11734 off the byte range lock manipulation that is done within Samba to
11735 give compatibility for OLE applications. Windows OLE applications
11736 use byte range locking as a form of inter-process communication, by
11737 locking ranges of bytes around the 2^32 region of a file range. This
11738 can cause certain UNIX lock managers to crash or otherwise cause
11739 problems. Setting this parameter to <TT
11743 trust your UNIX lock manager to handle such cases correctly.</P
11747 >ole locking compatibility = yes</B
11754 >only guest (S)</DT
11769 NAME="OPLOCKBREAKWAITTIME
"
11771 >oplock break wait time (G)</DT
11774 >This is a tuning parameter added due to bugs in
11775 both Windows 9x and WinNT. If Samba responds to a client too
11776 quickly when that client issues an SMB that can cause an oplock
11777 break request, then the network client can fail and not respond
11778 to the break request. This tuning parameter (which is set in milliseconds)
11779 is the amount of time Samba will wait before sending an oplock break
11780 request to such (broken) clients.</P
11784 >DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ
11785 AND UNDERSTOOD THE SAMBA OPLOCK CODE</I
11790 >oplock break wait time = 0</B
11795 NAME="OPLOCKCONTENTIONLIMIT
"
11797 >oplock contention limit (S)</DT
11809 improve the efficiency of the granting of oplocks under multiple
11810 client contention for the same file.</P
11812 >In brief it specifies a number, which causes smbd not to
11813 grant an oplock even when requested if the approximate number of
11814 clients contending for an oplock on the same file goes over this
11815 limit. This causes <B
11818 > to behave in a similar
11819 way to Windows NT.</P
11823 >DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ
11824 AND UNDERSTOOD THE SAMBA OPLOCK CODE</I
11829 >oplock contention limit = 2</B
11839 >This boolean option tells smbd whether to
11840 issue oplocks (opportunistic locks) to file open requests on this
11841 share. The oplock code can dramatically (approx. 30% or more) improve
11842 the speed of access to files on Samba servers. It allows the clients
11843 to aggressively cache files locally and you may want to disable this
11844 option for unreliable network environments (it is turned on by
11845 default in Windows NT Servers). For more information see the file
11855 >Oplocks may be selectively turned off on certain files with a
11857 HREF="#VETOOPLOCKFILES
"
11861 > veto oplock files</I
11864 > parameter. On some systems
11865 oplocks are recognized by the underlying operating system. This
11866 allows data synchronization between all access to oplocked files,
11867 whether it be via Samba or NFS or a local UNIX process. See the
11873 > parameter for details.</P
11876 HREF="#KERNELOPLOCKS
"
11885 HREF="#LEVEL2OPLOCKS
"
11889 > level2 oplocks</I
11906 >This integer value controls what level Samba
11907 advertises itself as for browse elections. The value of this
11908 parameter determines whether <A
11913 has a chance of becoming a local master browser for the <TT
11918 > in the local broadcast area.</P
11923 >By default, Samba will win
11924 a local master browsing election over all Microsoft operating
11925 systems except a Windows NT 4.0/2000 Domain Controller. This
11926 means that a misconfigured Samba host can effectively isolate
11927 a subnet for browsing purposes. See <TT
11949 NAME="OS2DRIVERMAP
"
11951 >os2 driver map (G)</DT
11954 >The parameter is used to define the absolute
11955 path to a file containing a mapping of Windows NT printer driver
11956 names to OS/2 printer driver names. The format is:</P
11958 ><nt driver name> = <os2 driver
11959 name>.<device name></P
11961 >For example, a valid entry using the HP LaserJet 5
11962 printer driver woudl appear as <B
11964 >HP LaserJet 5L = LASERJET.HP
11968 >The need for the file is due to the printer driver namespace
11969 problem described in the <A
11970 HREF="printer_driver2.html
"
11974 >. For more details on OS/2 clients, please
11976 HREF="OS2-Client-HOWTO.html
"
11980 > containing in the Samba documentation.</P
11984 >os2 driver map = <empty string>
11992 >panic action (G)</DT
11995 >This is a Samba developer option that allows a
11996 system command to be called when either <A
12005 crashes. This is usually used to draw attention to the fact that
12006 a problem occurred.</P
12010 >panic action = <empty string></B
12015 >panic action = "/bin/sleep
90000"</B
12022 >passwd chat (G)</DT
12025 >This string controls the <I
12029 conversation that takes places between <A
12033 > and the local password changing
12034 program to change the users password. The string describes a
12035 sequence of response-receive pairs that <A
12039 > uses to determine what to send to the
12041 HREF="#PASSWDPROGRAM
"
12049 > and what to expect back. If the expected output is not
12050 received then the password is not changed.</P
12052 >This chat sequence is often quite site specific, depending
12053 on what local methods are used for password control (such as NIS
12056 >The string can contain the macros <TT
12067 > which are substituted for the old
12068 and new passwords respectively. It can also contain the standard
12081 > to give line-feed,
12082 carriage-return, tab and space.</P
12084 >The string can also contain a '*' which matches
12085 any sequence of characters.</P
12087 >Double quotes can be used to collect strings with spaces
12088 in them into a single string.</P
12090 >If the send string in any part of the chat sequence
12091 is a fullstop ".
", then no string is sent. Similarly,
12092 if the expect string is a fullstop then no string is expected.</P
12094 >Note that if the <A
12095 HREF="#UNIXPASSWORDSYNC
"
12103 > parameter is set to true, then this
12104 sequence is called <I
12107 > when the SMB password
12108 in the smbpasswd file is being changed, without access to the old
12109 password cleartext. In this case the old password cleartext is set
12110 to "" (the empty string).</P
12113 HREF="#UNIXPASSWORDSYNC
"
12122 HREF="#PASSWDPROGRAM
"
12126 > passwd program</I
12130 HREF="#PASSWDCHATDEBUG
"
12134 >passwd chat debug</I
12141 >passwd chat = *new*password* %n\n
12142 *new*password* %n\n *changed*</B
12147 >passwd chat = "*Enter OLD password*
" %o\n
12148 "*Enter NEW password*
" %n\n "*Reenter NEW password*
" %n\n "*Password
12154 NAME="PASSWDCHATDEBUG
"
12156 >passwd chat debug (G)</DT
12159 >This boolean specifies if the passwd chat script
12160 parameter is run in <I
12163 > mode. In this mode the
12164 strings passed to and received from the passwd chat are printed
12179 of 100. This is a dangerous option as it will allow plaintext passwords
12180 to be seen in the <B
12183 > log. It is available to help
12184 Samba admins debug their <TT
12190 when calling the <TT
12196 be turned off after this has been done. This parameter is off by
12209 HREF="#PASSWDPROGRAM
"
12221 >passwd chat debug = no</B
12226 NAME="PASSWDPROGRAM
"
12228 >passwd program (G)</DT
12231 >The name of a program that can be used to set
12232 UNIX user passwords. Any occurrences of <TT
12238 will be replaced with the user name. The user name is checked for
12239 existence before calling the password changing program.</P
12241 >Also note that many passwd programs insist in <I
12245 > passwords, such as a minimum length, or the inclusion
12246 of mixed case chars and digits. This can pose a problem as some clients
12247 (such as Windows for Workgroups) uppercase the password before sending
12259 > parameter is set to <TT
12263 > then this program is called <I
12267 before the SMB password in the <A
12268 HREF="smbpasswd
.5.html
"
12272 > file is changed. If this UNIX password change fails, then
12276 > will fail to change the SMB password also
12277 (this is by design).</P
12282 >unix password sync</I
12285 is set this parameter <I
12287 >MUST USE ABSOLUTE PATHS</I
12292 > programs called, and must be examined
12293 for security implications. Note that by default <TT
12305 HREF="#UNIXPASSWORDSYNC
"
12317 >passwd program = /bin/passwd</B
12322 >passwd program = /sbin/npasswd %u</B
12328 NAME="PASSWORDLEVEL
"
12330 >password level (G)</DT
12333 >Some client/server combinations have difficulty
12334 with mixed-case passwords. One offending client is Windows for
12335 Workgroups, which for some reason forces passwords to upper
12336 case when using the LANMAN1 protocol, but leaves them alone when
12337 using COREPLUS! Another problem child is the Windows 95/98
12338 family of operating systems. These clients upper case clear
12339 text passwords even when NT LM 0.12 selected by the protocol
12340 negotiation request/response.</P
12342 >This parameter defines the maximum number of characters
12343 that may be upper case in passwords.</P
12345 >For example, say the password given was "FRED
". If <TT
12348 > password level</I
12350 > is set to 1, the following combinations
12351 would be tried if "FRED
" failed:</P
12353 >"Fred
", "fred
", "fRed
", "frEd
","freD
"</P
12361 the following combinations would also be tried: </P
12363 >"FRed
", "FrEd
", "FreD
", "fREd
", "fReD
", "frED
", ..</P
12367 >The higher value this parameter is set to the more likely
12368 it is that a mixed case password will be matched against a single
12369 case password. However, you should be aware that use of this
12370 parameter reduces security and increases the time taken to
12371 process a new connection.</P
12373 >A value of zero will cause only two attempts to be
12374 made - the password as is and the password in all-lower case.</P
12378 >password level = 0</B
12383 >password level = 4</B
12388 NAME="PASSWORDSERVER
"
12390 >password server (G)</DT
12393 >By specifying the name of another SMB server (such
12394 as a WinNT box) with this option, and using <B
12400 >security = server</B
12401 > you can get Samba
12402 to do all its username/password validation via a remote server.</P
12404 >This option sets the name of the password server to use.
12405 It must be a NetBIOS name, so if the machine's NetBIOS name is
12406 different from its Internet name then you may have to add its NetBIOS
12407 name to the lmhosts file which is stored in the same directory
12413 >The name of the password server is looked up using the
12415 HREF="#NAMERESOLVEORDER
"
12423 > and so may resolved
12424 by any method and order described in that parameter.</P
12426 >The password server much be a machine capable of using
12427 the "LM1.2X002
" or the "NT LM
0.12" protocol, and it must be in
12428 user level security mode.</P
12433 > Using a password server
12434 means your UNIX box (running Samba) is only as secure as your
12435 password server. <I
12437 >DO NOT CHOOSE A PASSWORD SERVER THAT
12438 YOU DON'T COMPLETELY TRUST</I
12441 >Never point a Samba server at itself for password
12442 serving. This will cause a loop and could lock up your Samba
12445 >The name of the password server takes the standard
12446 substitutions, but probably the only useful one is <TT
12452 >, which means the Samba server will use the incoming
12453 client as the password server. If you use this then you better
12454 trust your clients, and you had better restrict them with hosts allow!</P
12461 > parameter is set to
12465 >, then the list of machines in this
12466 option must be a list of Primary or Backup Domain controllers for the
12467 Domain or the character '*', as the Samba server is effectively
12468 in that domain, and will use cryptographically authenticated RPC calls
12469 to authenticate the user logging on. The advantage of using <B
12471 > security = domain</B
12472 > is that if you list several hosts in the
12476 >password server</I
12482 > will try each in turn till it finds one that responds. This
12483 is useful in case your primary server goes down.</P
12488 >password server</I
12491 to the character '*', then Samba will attempt to auto-locate the
12492 Primary or Backup Domain controllers to authenticate against by
12493 doing a query for the name <TT
12495 >WORKGROUP<1C></TT
12497 and then contacting each server returned in the list of IP
12498 addresses from the name resolution source. </P
12509 >, then there are different
12510 restrictions that <B
12512 >security = domain</B
12520 >You may list several password servers in
12524 >password server</I
12526 > parameter, however if an
12530 > makes a connection to a password server,
12531 and then the password server fails, no more users will be able
12532 to be authenticated from this <B
12536 restriction of the SMB/CIFS protocol when in <B
12540 > mode and cannot be fixed in Samba.</P
12544 >If you are using a Windows NT server as your
12545 password server then you will have to ensure that your users
12546 are able to login from the Samba server, as when in <B
12548 > security=server</B
12549 > mode the network logon will appear to
12550 come from there rather than from the users workstation.</P
12567 >password server = <empty string></B
12573 >password server = NT-PDC, NT-BDC1, NT-BDC2
12579 >password server = *</B
12589 >This parameter specifies a directory to which
12590 the user of the service is to be given access. In the case of
12591 printable services, this is where print data will spool prior to
12592 being submitted to the host for printing.</P
12594 >For a printable service offering guest access, the service
12595 should be readonly and the path should be world-writeable and
12596 have the sticky bit set. This is not mandatory of course, but
12597 you probably won't get the results you expect if you do
12600 >Any occurrences of <TT
12606 will be replaced with the UNIX username that the client is using
12607 on this connection. Any occurrences of <TT
12613 will be replaced by the NetBIOS name of the machine they are
12614 connecting from. These replacements are very useful for setting
12615 up pseudo home directories for users.</P
12617 >Note that this path will be based on <A
12625 > if one was specified.</P
12634 >path = /home/fred</B
12639 NAME="POSIXLOCKING
"
12641 >posix locking (S)</DT
12652 daemon maintains an database of file locks obtained by SMB clients.
12653 The default behavior is to map this internal database to POSIX
12654 locks. This means that file locks obtained by SMB clients are
12655 consistent with those seen by POSIX compliant applications accessing
12656 the files via a non-SMB method (e.g. NFS or local file access).
12657 You should never need to disable this parameter.</P
12661 >posix locking = yes</B
12671 >This option specifies a command to be run
12672 whenever the service is disconnected. It takes the usual
12673 substitutions. The command may be run as the root on some
12676 >An interesting example may be do unmount server
12681 >postexec = /etc/umount /cdrom</B
12697 >none (no command executed)</I
12703 >postexec = echo \"%u disconnected from %S
12704 from %m (%I)\
" >> /tmp/log</B
12711 >postscript (S)</DT
12714 >This parameter forces a printer to interpret
12715 the print files as postscript. This is done by adding a <TT
12719 > to the start of print output.</P
12721 >This is most useful when you have lots of PCs that persist
12722 in putting a control-D at the start of print jobs, which then
12723 confuses your printer.</P
12727 >postscript = no</B
12737 >This option specifies a command to be run whenever
12738 the service is connected to. It takes the usual substitutions.</P
12740 >An interesting example is to send the users a welcome
12741 message every time they log in. Maybe a message of the day? Here
12746 >preexec = csh -c 'echo \"Welcome to %S!\
" |
12747 /usr/local/samba/bin/smbclient -M %m -I %I' & </B
12750 >Of course, this could get annoying after a while :-)</P
12753 HREF="#PREEXECCLOSE
"
12774 >none (no command executed)</I
12779 >preexec = echo \"%u connected to %S from %m
12780 (%I)\
" >> /tmp/log</B
12785 NAME="PREEXECCLOSE
"
12787 >preexec close (S)</DT
12790 >This boolean option controls whether a non-zero
12791 return code from <A
12800 > should close the service being connected to.</P
12804 >preexec close = no</B
12809 NAME="PREFERREDMASTER
"
12811 >preferred master (G)</DT
12814 >This boolean parameter controls if <A
12818 > is a preferred master browser
12819 for its workgroup.</P
12821 >If this is set to true, on startup, <B
12825 will force an election, and it will have a slight advantage in
12826 winning the election. It is recommended that this parameter is
12827 used in conjunction with <B
12830 HREF="#DOMAINMASTER
"
12841 > can guarantee becoming a domain master.</P
12843 >Use this option with caution, because if there are several
12844 hosts (whether Samba servers, Windows 95 or NT) that are preferred
12845 master browsers on the same subnet, they will each periodically
12846 and continuously attempt to become the local master browser.
12847 This will result in unnecessary broadcast traffic and reduced browsing
12863 >preferred master = auto</B
12868 NAME="PREFEREDMASTER
"
12870 >prefered master (G)</DT
12874 HREF="#PREFERREDMASTER
"
12878 > preferred master</I
12881 > for people who cannot spell :-).</P
12890 >This is a list of services that you want to be
12891 automatically added to the browse lists. This is most useful
12892 for homes and printers services that would otherwise not be
12895 >Note that if you just want all printers in your
12896 printcap file loaded then the <A
12897 HREF="#LOADPRINTERS
"
12904 > option is easier.</P
12908 >no preloaded services</I
12913 >preload = fred lp colorlp</B
12918 NAME="PRESERVECASE
"
12920 >preserve case (S)</DT
12923 > This controls if new filenames are created
12924 with the case that the client passes, or if they are forced to
12926 HREF="#DEFAULTCASE
"
12938 >preserve case = yes</B
12941 >See the section on <A
12945 > for a fuller discussion.</P
12949 NAME="PRINTCOMMAND
"
12951 >print command (S)</DT
12954 >After a print job has finished spooling to
12955 a service, this command will be used via a <B
12959 call to process the spool file. Typically the command specified will
12960 submit the spool file to the host's printing subsystem, but there
12961 is no requirement that this be the case. The server will not remove
12962 the spool file, so whatever command you specify should remove the
12963 spool file when it has been processed, otherwise you will need to
12964 manually remove old spool files.</P
12966 >The print command is simply a text string. It will be used
12967 verbatim, with two exceptions: All occurrences of <TT
12978 > will be replaced by the
12979 appropriate spool file name, and all occurrences of <TT
12985 > will be replaced by the appropriate printer name. The
12986 spool file name is generated automatically by the server, the printer
12987 name is discussed below.</P
12989 >The print command <I
12993 one occurrence of <TT
13009 > is optional. At the time
13010 a job is submitted, if no printer name is supplied the <TT
13016 > will be silently removed from the printer command.</P
13018 >If specified in the [global] section, the print command given
13019 will be used for any printable service that does not have its own
13020 print command specified.</P
13022 >If there is neither a specified print command for a
13023 printable service nor a global print command, spool files will
13024 be created but not processed and (most importantly) not removed.</P
13026 >Note that printing may fail on some UNIXes from the
13030 > account. If this happens then create
13031 an alternative guest account that can print and set the <A
13032 HREF="#GUESTACCOUNT
"
13040 in the [global] section.</P
13042 >You can form quite complex print commands by realizing
13043 that they are just passed to a shell. For example the following
13044 will log a print job, print the file, then remove it. Note that
13045 ';' is the usual separator for command in shell scripts.</P
13049 >print command = echo Printing %s >>
13050 /tmp/print.log; lpr -P %p %s; rm %s</B
13053 >You may have to vary this command considerably depending
13054 on how you normally print files on your system. The default for
13055 the parameter varies depending on the setting of the <A
13067 >printing= BSD, AIX, QNX, LPRNG
13073 >print command = lpr -r -P%p %s</B
13078 >printing= SYS or HPUX :</B
13083 >print command = lp -c -d%p %s; rm %s</B
13088 >printing=SOFTQ :</B
13093 >print command = lp -d%p -s %s; rm %s</B
13098 >print command = /usr/local/samba/bin/myprintscript
13126 >If this parameter is <TT
13130 clients may open, write to and submit spool files on the directory
13131 specified for the service. </P
13133 >Note that a printable service will ALWAYS allow writing
13134 to the service path (user privileges permitting) via the spooling
13135 of print data. The <A
13144 > parameter controls only non-printing access to
13160 HREF="#PRINTCAPNAME
"
13171 NAME="PRINTCAPNAME
"
13173 >printcap name (G)</DT
13176 >This parameter may be used to override the
13177 compiled-in default printcap name used by the server (usually <TT
13179 > /etc/printcap</TT
13180 >). See the discussion of the <A
13183 > section above for reasons
13184 why you might want to do this.</P
13186 >On System V systems that use <B
13190 list available printers you can use <B
13192 >printcap name = lpstat
13194 > to automatically obtain lists of available printers. This
13195 is the default for systems that define SYSV at configure time in
13196 Samba (this includes most System V based systems). If <TT
13205 these systems then Samba will launch <B
13209 attempt to parse the output to obtain a printer list.</P
13211 >A minimal printcap file would look something like this:</P
13214 CLASS="PROGRAMLISTING
"
13215 > print1|My Printer 1
13216 print2|My Printer 2
13217 print3|My Printer 3
13218 print4|My Printer 4
13219 print5|My Printer 5
13223 >where the '|' separates aliases of a printer. The fact
13224 that the second alias has a space in it gives a hint to Samba
13225 that it's a comment.</P
13230 >: Under AIX the default printcap
13234 >. Samba will assume the
13238 > format if the string
13242 > appears in the printcap filename.</P
13246 >printcap name = /etc/printcap</B
13251 >printcap name = /etc/myprintcap</B
13256 NAME="PRINTERADMIN
"
13258 >printer admin (S)</DT
13261 >This is a list of users that can do anything to
13262 printers via the remote administration interfaces offered by MS-RPC
13263 (usually using a NT workstation). Note that the root user always
13264 has admin rights.</P
13268 >printer admin = <empty string></B
13274 >printer admin = admin, @staff</B
13279 NAME="PRINTERDRIVER
"
13281 >printer driver (S)</DT
13287 >This is a depreciated
13288 parameter and will be removed in the next major release
13289 following version 2.2. Please see the instructions in
13292 >PRINTER_DRIVER2.txt</TT
13297 > of the Samba distribution for more information
13298 on the new method of loading printer drivers onto a Samba server.
13301 >This option allows you to control the string
13302 that clients receive when they ask the server for the printer driver
13303 associated with a printer. If you are using Windows95 or Windows NT
13304 then you can use this to automate the setup of printers on your
13307 >You need to set this parameter to the exact string (case
13308 sensitive) that describes the appropriate printer driver for your
13309 system. If you don't know the exact string to use then you should
13310 first try with no <A
13311 HREF="#PRINTERDRIVER
"
13315 > printer driver</I
13318 > option set and the client will
13319 give you a list of printer drivers. The appropriate strings are
13320 shown in a scroll box after you have chosen the printer manufacturer.</P
13323 HREF="#PRINTERDRIVERFILE
"
13335 >printer driver = HP LaserJet 4L</B
13340 NAME="PRINTERDRIVERFILE
"
13342 >printer driver file (G)</DT
13348 >This is a depreciated
13349 parameter and will be removed in the next major release
13350 following version 2.2. Please see the instructions in
13353 >PRINTER_DRIVER2.txt</TT
13358 > of the Samba distribution for more information
13359 on the new method of loading printer drivers onto a Samba server.
13362 >This parameter tells Samba where the printer driver
13363 definition file, used when serving drivers to Windows 95 clients, is
13364 to be found. If this is not set, the default is :</P
13369 CLASS="REPLACEABLE
"
13371 >SAMBA_INSTALL_DIRECTORY</I
13374 /lib/printers.def</TT
13377 >This file is created from Windows 95 <TT
13381 > files found on the Windows 95 client system. For more
13382 details on setting up serving of printer drivers to Windows 95
13383 clients, see the documentation file in the <TT
13389 >PRINTER_DRIVER.txt</TT
13393 HREF="#PRINTERDRIVERLOCATION
"
13397 > printer driver location</I
13404 >None (set in compile).</I
13409 >printer driver file =
13410 /usr/local/samba/printers/drivers.def</B
13415 NAME="PRINTERDRIVERLOCATION
"
13417 >printer driver location (S)</DT
13423 >This is a depreciated
13424 parameter and will be removed in the next major release
13425 following version 2.2. Please see the instructions in
13428 >PRINTER_DRIVER2.txt</TT
13433 > of the Samba distribution for more information
13434 on the new method of loading printer drivers onto a Samba server.
13437 >This parameter tells clients of a particular printer
13438 share where to find the printer driver files for the automatic
13439 installation of drivers for Windows 95 machines. If Samba is set up
13440 to serve printer drivers to Windows 95 machines, this should be set to</P
13444 >\\MACHINE\PRINTER$</B
13447 >Where MACHINE is the NetBIOS name of your Samba server,
13448 and PRINTER$ is a share you set up for serving printer driver
13449 files. For more details on setting this up see the documentation
13455 > PRINTER_DRIVER.txt</TT
13459 HREF="#PRINTERDRIVERFILE
"
13463 > printer driver file</I
13475 >printer driver location = \\MACHINE\PRINTER$
13483 >printer name (S)</DT
13486 >This parameter specifies the name of the printer
13487 to which print jobs spooled through a printable service will be sent.</P
13489 >If specified in the [global] section, the printer
13490 name given will be used for any printable service that does
13491 not have its own printer name specified.</P
13495 >none (but may be <TT
13499 on many systems)</I
13504 >printer name = laserwriter</B
13515 HREF="#PRINTERNAME
"
13531 >This parameters controls how printer status
13532 information is interpreted on your system. It also affects the
13533 default values for the <TT
13553 >lpresume command</I
13561 > if specified in the
13562 [global]f> section.</P
13564 >Currently eight printing styles are supported. They are
13598 >To see what the defaults are for the other print
13599 commands when using the various options use the <A
13600 HREF="testparm
.1.html
"
13605 >This option can be set on a per printer basis</P
13607 >See also the discussion in the <A
13620 HREF="#MAXPROTOCOL
"
13649 NAME="QUEUEPAUSECOMMAND
"
13651 >queuepause command (S)</DT
13654 >This parameter specifies the command to be
13655 executed on the server host in order to pause the printerqueue.</P
13657 >This command should be a program or script which takes
13658 a printer name as its only parameter and stops the printerqueue,
13659 such that no longer jobs are submitted to the printer.</P
13661 >This command is not supported by Windows for Workgroups,
13662 but can be issued from the Printer's window under Windows 95
13670 > is given then the printername
13671 is put in its place. Otherwise it is placed at the end of the command.
13674 >Note that it is good practice to include the absolute
13675 path in the command as the PATH may not be available to the
13680 >depends on the setting of <TT
13691 >queuepause command = disable %p</B
13696 NAME="QUEUERESUMECOMMAND
"
13698 >queueresume command (S)</DT
13701 >This parameter specifies the command to be
13702 executed on the server host in order to resume the printerqueue. It
13703 is the command to undo the behavior that is caused by the
13704 previous parameter (<A
13705 HREF="#QUEUEPAUSECOMMAND
"
13709 > queuepause command</I
13714 >This command should be a program or script which takes
13715 a printer name as its only parameter and resumes the printerqueue,
13716 such that queued jobs are resubmitted to the printer.</P
13718 >This command is not supported by Windows for Workgroups,
13719 but can be issued from the Printer's window under Windows 95
13727 > is given then the printername
13728 is put in its place. Otherwise it is placed at the end of the
13731 >Note that it is good practice to include the absolute
13732 path in the command as the PATH may not be available to the
13737 >depends on the setting of <A
13751 >queuepause command = enable %p
13762 >This boolean parameter controls whether <A
13766 > will support the "Read
13767 Block Multiplex
" SMB. This is now rarely used and defaults to
13771 >. You should never need to set this
13786 >This is a list of users that are given read-only
13787 access to a service. If the connecting user is in this list then
13788 they will not be given write access, no matter what the <A
13797 option is set to. The list can include group names using the
13798 syntax described in the <A
13799 HREF="#INVALIDUSERS
"
13816 > parameter and the <A
13817 HREF="#INVALIDUSERS
"
13829 >read list = <empty string></B
13834 >read list = mary, @students</B
13844 >Note that this is an inverted synonym for <A
13861 >This parameter controls whether or not the server
13862 will support the raw read SMB requests when transferring data
13865 >If enabled, raw reads allow reads of 65535 bytes in
13866 one packet. This typically provides a major performance benefit.
13869 >However, some clients either negotiate the allowable
13870 block size incorrectly or are incapable of supporting larger block
13871 sizes, and for these clients you may need to disable raw reads.</P
13873 >In general this parameter should be viewed as a system tuning
13874 tool and left severely alone. See also <A
13902 affects the overlap of disk reads/writes with network reads/writes.
13903 If the amount of data being transferred in several of the SMB
13904 commands (currently SMBwrite, SMBwriteX and SMBreadbraw) is larger
13905 than this value then the server begins writing the data before it
13906 has received the whole packet from the network, or in the case of
13907 SMBreadbraw, it begins writing to the network before all the data
13908 has been read from disk.</P
13910 >This overlapping works best when the speeds of disk and
13911 network access are similar, having very little effect when the
13912 speed of one is much greater than the other.</P
13914 >The default value is 16384, but very little experimentation
13915 has been done yet to determine the optimal value, and it is likely
13916 that the best value will vary greatly between systems anyway.
13917 A value over 65536 is pointless and will cause you to allocate
13918 memory unnecessarily.</P
13922 >read size = 16384</B
13927 >read size = 8192</B
13932 NAME="REMOTEANNOUNCE
"
13934 >remote announce (G)</DT
13937 >This option allows you to setup <A
13941 > to periodically announce itself
13942 to arbitrary IP addresses with an arbitrary workgroup name.</P
13944 >This is useful if you want your Samba server to appear
13945 in a remote workgroup for which the normal browse propagation
13946 rules don't work. The remote workgroup can be anywhere that you
13947 can send IP packets to.</P
13953 >remote announce = 192.168.2.255/SERVERS
13954 192.168.4.255/STAFF</B
13957 >the above line would cause nmbd to announce itself
13958 to the two given IP addresses using the given workgroup names.
13959 If you leave out the workgroup name then the one given in
13969 parameter is used instead.</P
13971 >The IP addresses you choose would normally be the broadcast
13972 addresses of the remote networks, but can also be the IP addresses
13973 of known browse masters if your network config is that stable.</P
13975 >See the documentation file <TT
13986 >remote announce = <empty string>
13992 NAME="REMOTEBROWSESYNC
"
13994 >remote browse sync (G)</DT
13997 >This option allows you to setup <A
14001 > to periodically request
14002 synchronization of browse lists with the master browser of a samba
14003 server that is on a remote segment. This option will allow you to
14004 gain browse lists for multiple workgroups across routed networks. This
14005 is done in a manner that does not work with any non-samba servers.</P
14007 >This is useful if you want your Samba server and all local
14008 clients to appear in a remote workgroup for which the normal browse
14009 propagation rules don't work. The remote workgroup can be anywhere
14010 that you can send IP packets to.</P
14016 >remote browse sync = 192.168.2.255 192.168.4.255
14020 >the above line would cause <B
14024 the master browser on the specified subnets or addresses to
14025 synchronize their browse lists with the local server.</P
14027 >The IP addresses you choose would normally be the broadcast
14028 addresses of the remote networks, but can also be the IP addresses
14029 of known browse masters if your network config is that stable. If
14030 a machine IP address is given Samba makes NO attempt to validate
14031 that the remote machine is available, is listening, nor that it
14032 is in fact the browse master on it's segment.</P
14036 >remote browse sync = <empty string>
14042 NAME="RESTRICTANONYMOUS
"
14044 >restrict anonymous (G)</DT
14047 >This is a boolean parameter. If it is true, then
14048 anonymous access to the server will be restricted, namely in the
14049 case where the server is expecting the client to send a username,
14050 but it doesn't. Setting it to true will force these anonymous
14051 connections to be denied, and the client will be required to always
14052 supply a username and password when connecting. Use of this parameter
14053 is only recommended for homogeneous NT client environments.</P
14055 >This parameter makes the use of macro expansions that rely
14056 on the username (%U, %G, etc) consistent. NT 4.0
14057 likes to use anonymous connections when refreshing the share list,
14058 and this is a way to work around that.</P
14060 >When restrict anonymous is true, all anonymous connections
14061 are denied no matter what they are for. This can effect the ability
14062 of a machine to access the samba Primary Domain Controller to revalidate
14063 it's machine account after someone else has logged on the client
14064 interactively. The NT client will display a message saying that
14065 the machine's account in the domain doesn't exist or the password is
14066 bad. The best way to deal with this is to reboot NT client machines
14067 between interactive logons, using "Shutdown and Restart
", rather
14068 than "Close all programs and logon as a different user
".</P
14072 >restrict anonymous = no</B
14083 HREF="#ROOTDIRECTORY
"
14087 >root directory"</I
14100 HREF=
"#ROOTDIRECTORY"
14104 >root directory
"</I
14111 NAME="ROOTDIRECTORY
"
14113 >root directory (G)</DT
14116 >The server will <B
14120 Change it's root directory) to this directory on startup. This is
14121 not strictly necessary for secure operation. Even without it the
14122 server will deny access to files not in one of the service entries.
14123 It may also check for, and deny access to, soft links to other
14124 parts of the filesystem, or attempts to use "..
" in file names
14125 to access other directories (depending on the setting of the <A
14142 than "/
" adds an extra level of security, but at a price. It
14143 absolutely ensures that no access is given to files not in the
14144 sub-tree specified in the <TT
14153 > some files needed for
14154 complete operation of the server. To maintain full operability
14155 of the server you will need to mirror some system files
14161 > tree. In particular
14162 you will need to mirror <TT
14166 subset of it), and any binaries or configuration files needed for
14167 printing (if required). The set of files that must be mirrored is
14168 operating system dependent.</P
14172 >root directory = /</B
14177 >root directory = /homes/smb</B
14182 NAME="ROOTPOSTEXEC
"
14184 >root postexec (S)</DT
14187 >This is the same as the <TT
14193 parameter except that the command is run as root. This
14194 is useful for unmounting filesystems
14195 (such as cdroms) after a connection is closed.</P
14209 >root postexec = <empty string>
14217 >root preexec (S)</DT
14220 >This is the same as the <TT
14226 parameter except that the command is run as root. This
14227 is useful for mounting filesystems (such as cdroms) after a
14228 connection is closed.</P
14239 HREF="#PREEXECCLOSE
"
14250 >root preexec = <empty string>
14256 NAME="ROOTPREEXECCLOSE
"
14258 >root preexec close (S)</DT
14261 >This is the same as the <TT
14267 > parameter except that the command is run as root.</P
14278 HREF="#PREEXECCLOSE
"
14289 >root preexec close = no</B
14299 >This option affects how clients respond to
14300 Samba and is one of the most important settings in the <TT
14305 >The option sets the "security mode bit
" in replies to
14306 protocol negotiations with <A
14311 > to turn share level security on or off. Clients decide
14312 based on this bit whether (and how) to transfer user and password
14313 information to the server.</P
14317 >security = user</B
14319 the most common setting needed when talking to Windows 98 and
14322 >The alternatives are <B
14324 >security = share</B
14328 >security = server</B
14335 >In versions of Samba prior to 2..0, the default was
14338 >security = share</B
14339 > mainly because that was
14340 the only option at one stage.</P
14342 >There is a bug in WfWg that has relevance to this
14343 setting. When in user or server level security a WfWg client
14344 will totally ignore the password you type in the "connect
14345 drive
" dialog box. This makes it very difficult (if not impossible)
14346 to connect to a Samba service as anyone except the user that
14347 you are logged into WfWg as.</P
14349 >If your PCs use usernames that are the same as their
14350 usernames on the UNIX machine then you will want to use
14353 >security = user</B
14354 >. If you mostly use usernames
14355 that don't exist on the UNIX box then use <B
14361 >You should also use <B
14363 >security = share</B
14365 want to mainly setup shares without a password (guest shares). This
14366 is commonly used for a shared printer server. It is more difficult
14367 to setup guest shares with <B
14369 >security = user</B
14380 >parameter for details.</P
14382 >It is possible to use <B
14388 > where it is offers both user and share
14389 level security under different <A
14390 HREF="#NETBIOSALIASES
"
14394 >NetBIOS aliases</I
14399 >The different settings will now be explained.</P
14402 NAME="SECURITYEQUALSSHARE
"
14410 >When clients connect to a share level security server then
14411 need not log onto the server with a valid username and password before
14412 attempting to connect to a shared resource (although modern clients
14413 such as Windows 95/98 and Windows NT will send a logon request with
14414 a username but no password when talking to a <B
14418 > server). Instead, the clients send authentication information
14419 (passwords) on a per-share basis, at the time they attempt to connect
14429 uses a valid UNIX user to act on behalf of the client, even in
14432 >security = share</B
14433 > level security.</P
14435 >As clients are not required to send a username to the server
14436 in share level security, <B
14440 techniques to determine the correct UNIX user to use on behalf
14443 >A list of possible UNIX usernames to match with the given
14444 client password is constructed using the following methods :</P
14459 > parameter is set, then all the other
14460 stages are missed and only the <A
14461 HREF="#GUESTACCOUNT
"
14468 > username is checked.
14473 >Is a username is sent with the share connection
14474 request, then this username (after mapping - see <A
14475 HREF="#USERNAMEMAP
"
14483 is added as a potential username.</P
14487 >If the client did a previous <I
14491 > request (the SessionSetup SMB call) then the
14492 username sent in this SMB will be added as a potential username.
14497 >The name of the service the client requested is
14498 added as a potential username.</P
14502 >The NetBIOS name of the client is added to
14503 the list as a potential username.</P
14507 >Any users on the <A
14515 > list are added as potential usernames.
14526 not set, then this list is then tried with the supplied password.
14527 The first user for whom the password matches will be used as the
14536 set, or no username can be determined then if the share is marked
14537 as available to the <TT
14543 guest user will be used, otherwise access is denied.</P
14545 >Note that it can be <I
14549 in share-level security as to which UNIX username will eventually
14550 be used in granting access.</P
14552 >See also the section <A
14554 > NOTE ABOUT USERNAME/PASSWORD VALIDATION</A
14558 NAME="SECURITYEQUALSUSER
"
14566 >This is the default security setting in Samba 2.2.
14567 With user-level security a client must first "log=on
" with a
14568 valid username and password (which can be mapped using the <A
14569 HREF="#USERNAMEMAP
"
14577 parameter). Encrypted passwords (see the <A
14578 HREF="#ENCRYPTPASSWORDS
"
14582 >encrypted passwords</I
14585 > parameter) can also
14586 be used in this security mode. Parameters such as <A
14602 > if set are then applied and
14603 may change the UNIX user to use on this connection, but only after
14604 the user has been successfully authenticated.</P
14609 > that the name of the resource being
14613 > sent to the server until after
14614 the server has successfully authenticated the client. This is why
14615 guest shares don't work in user level security without allowing
14616 the server to automatically map unknown users into the <A
14617 HREF="#GUESTACCOUNT
"
14634 > parameter for details on doing this.</P
14636 >See also the section <A
14638 > NOTE ABOUT USERNAME/PASSWORD VALIDATION</A
14642 NAME="SECURITYEQUALSSERVER
"
14650 >In this mode Samba will try to validate the username/password
14651 by passing it to another SMB server, such as an NT box. If this
14652 fails it will revert to <B
14654 >security = user</B
14656 that if encrypted passwords have been negotiated then Samba cannot
14657 revert back to checking the UNIX password file, it must have a valid
14661 > file to check users against. See the
14662 documentation file in the <TT
14668 >ENCRYPTION.txt</TT
14669 > for details on how to set this
14675 > that from the clients point of
14678 >security = server</B
14679 > is the same as <B
14681 > security = user</B
14682 >. It only affects how the server deals
14683 with the authentication, it does not in any way affect what the
14689 > that the name of the resource being
14693 > sent to the server until after
14694 the server has successfully authenticated the client. This is why
14695 guest shares don't work in user level security without allowing
14696 the server to automatically map unknown users into the <A
14697 HREF="#GUESTACCOUNT
"
14714 > parameter for details on doing this.</P
14716 >See also the section <A
14718 > NOTE ABOUT USERNAME/PASSWORD VALIDATION</A
14722 HREF="#PASSWORDSERVER
"
14730 > parameter and the <A
14731 HREF="#ENCRYPTPASSWORDS
"
14735 >encrypted passwords</I
14742 NAME="SECURITYEQUALSDOMAIN
"
14750 >This mode will only work correctly if <A
14751 HREF="smbpasswd
.8.html
"
14754 > has been used to add this
14755 machine into a Windows NT Domain. It expects the <A
14756 HREF="#ENCRYPTPASSWORDS
"
14760 >encrypted passwords</I
14764 > parameter to be set to <TT
14768 mode Samba will try to validate the username/password by passing
14769 it to a Windows NT Primary or Backup Domain Controller, in exactly
14770 the same way that a Windows NT Server would do.</P
14775 > that a valid UNIX user must still
14776 exist as well as the account on the Domain Controller to allow
14777 Samba to have a valid UNIX account to map file access to.</P
14782 > that from the clients point
14785 >security = domain</B
14786 > is the same as <B
14790 >. It only affects how the server deals with the authentication,
14791 it does not in any way affect what the client sees.</P
14796 > that the name of the resource being
14800 > sent to the server until after
14801 the server has successfully authenticated the client. This is why
14802 guest shares don't work in user level security without allowing
14803 the server to automatically map unknown users into the <A
14804 HREF="#GUESTACCOUNT
"
14821 > parameter for details on doing this.</P
14826 > There is currently a bug in the
14827 implementation of <B
14829 >security = domain</B
14831 to multi-byte character set usernames. The communication with a
14832 Domain Controller must be done in UNICODE and Samba currently
14833 does not widen multi-byte user names to UNICODE correctly, thus
14834 a multi-byte username will not be recognized correctly at the
14835 Domain Controller. This issue will be addressed in a future release.</P
14837 >See also the section <A
14839 > NOTE ABOUT USERNAME/PASSWORD VALIDATION</A
14843 HREF="#PASSWORDSERVER
"
14851 > parameter and the <A
14852 HREF="#ENCRYPTPASSWORDS
"
14856 >encrypted passwords</I
14864 >security = USER</B
14869 >security = DOMAIN</B
14874 NAME="SECURITYMASK
"
14876 >security mask (S)</DT
14879 >This parameter controls what UNIX permission
14880 bits can be modified when a Windows NT client is manipulating
14881 the UNIX permission on a file using the native NT security
14884 >This parameter is applied as a mask (AND'ed with) to
14885 the changed permission bits, thus preventing any bits not in
14886 this mask from being modified. Essentially, zero bits in this
14887 mask may be treated as a set of bits the user is not allowed
14890 >If not set explicitly this parameter is set to the same
14900 > parameter. To allow a user to modify all the
14901 user/group/world permissions on a file, set this parameter to
14907 > that users who can access the
14908 Samba server through other means can easily bypass this
14909 restriction, so it is primarily useful for standalone
14910 "appliance
" systems. Administrators of most normal systems will
14911 probably want to set it to 0777.</P
14914 HREF="#FORCEDIRECTORYSECURITYMODE
"
14918 >force directory security mode</I
14923 HREF="#DIRECTORYSECURITYMASK
"
14932 HREF="#FORCESECURITYMODE
"
14936 >force security mode</I
14943 >security mask = <same as create mask>
14949 >security mask = 0777</B
14954 NAME="SERVERSTRING
"
14956 >server string (G)</DT
14959 >This controls what string will show up in the
14960 printer comment box in print manager and next to the IPC connection
14964 >. It can be any string that you wish
14965 to show to your users.
</P
14967 >It also sets what will appear in browse lists next
14968 to the machine name.
</P
14975 > will be replaced with the Samba
14983 > will be replaced with the
14988 >server string = Samba %v
</B
14993 >server string = University of GNUs Samba
14999 NAME=
"SETDIRECTORY"
15001 >set directory (S)
</DT
15006 >set directory = no
</B
15008 users of the service may not use the setdir command to change
15014 > command is only implemented
15015 in the Digital Pathworks client. See the Pathworks documentation
15020 >set directory = no
</B
15027 >share modes (S)
</DT
15030 >This enables or disables the honoring of
15036 > during a file open. These
15037 modes are used by clients to gain exclusive read or write access
15040 >These open modes are not directly supported by UNIX, so
15041 they are simulated using shared memory, or lock files if your
15042 UNIX doesn't support shared memory (almost all do).
</P
15044 >The share modes that are enabled by this option are
15068 >This option gives full share compatibility and enabled
15074 > turn this parameter
15075 off as many Windows applications will break if you do so.
</P
15079 >share modes = yes
</B
15084 NAME=
"SHORTPRESERVECASE"
15086 >short preserve case (S)
</DT
15089 >This boolean parameter controls if new files
15090 which conform to
8.3 syntax, that is all in upper case and of
15091 suitable length, are created upper case, or if they are forced
15093 HREF=
"#DEFAULTCASE"
15101 >. This option can be use with
<A
15102 HREF=
"#PRESERVECASE"
15105 >preserve case = yes
</B
15108 > to permit long filenames to retain their case, while short
15109 names are lowered.
</P
15111 >See the section on
<A
15118 >short preserve case = yes
</B
15123 NAME=
"SHOWADDPRINTERWIZARD"
15125 >show add printer wizard (G)
</DT
15128 >With the introduction of MS-RPC based printing support
15129 for Windows NT/
2000 client in Samba
2.2, a
"Printers..." folder will
15130 appear on Samba hosts in the share listing. Normally this folder will
15131 contain an icon for the MS Add Printer Wizard (APW). However, it is
15132 possible to disable this feature regardless of the level of privilege
15133 of the connected user.
</P
15135 >Under normal circumstances, the Windows NT/
2000 client will
15136 open a handle on the printer server with OpenPrinterEx() asking for
15137 Administrator privileges. If the user does not have administrative
15138 access on the print server (i.e is not root or a member of the
15144 > group), the OpenPrinterEx()
15145 call fails and the clients another open call with a request for
15146 a lower privilege level. This should succeed, however the APW
15147 icon will not be displayed.
</P
15152 >show add printer wizard
</I
15155 parameter will always cause the OpenPrinterEx() on the server
15156 to fail. Thus the APW icon will never be displayed.
<I
15159 >This does not prevent the same user from having
15160 administrative privilege on an individual printer.
</P
15163 HREF=
"#ADDPRINTERCOMMAND"
15172 HREF=
"#DELETEPRINTERCOMMAND"
15176 >deleteprinter command
</I
15180 HREF=
"#PRINTERADMIN"
15191 >show add printer wizard = yes
</B
15196 NAME=
"SMBPASSWDFILE"
15198 >smb passwd file (G)
</DT
15201 >This option sets the path to the encrypted
15202 smbpasswd file. By default the path to the smbpasswd file
15203 is compiled into Samba.
</P
15207 >smb passwd file = ${prefix}/private/smbpasswd
15213 >smb passwd file = /etc/samba/smbpasswd
15219 NAME=
"SOCKETADDRESS"
15221 >socket address (G)
</DT
15224 >This option allows you to control what
15225 address Samba will listen for connections on. This is used to
15226 support multiple virtual interfaces on the one server, each
15227 with a different configuration.
</P
15229 >By default samba will accept connections on any
15234 >socket address =
192.168.2.20</B
15240 NAME=
"SOCKETOPTIONS"
15242 >socket options (G)
</DT
15245 >This option allows you to set socket options
15246 to be used when talking with the client.
</P
15248 >Socket options are controls on the networking layer
15249 of the operating systems which allow the connection to be
15252 >This option will typically be used to tune your Samba
15253 server for optimal performance for your local network. There is
15254 no way that Samba can know what the optimal parameters are for
15255 your net, so you must experiment and choose them yourself. We
15256 strongly suggest you read the appropriate documentation for your
15257 operating system first (perhaps
<B
15263 >You may find that on some systems Samba will say
15264 "Unknown socket option" when you supply an option. This means you
15265 either incorrectly typed it or you need to add an include file
15266 to includes.h for your OS. If the latter is the case please
15267 send the patch to
<A
15268 HREF=
"mailto:samba@samba.org"
15270 > samba@samba.org
</A
15273 >Any of the supported socket options may be combined
15274 in any way you like, as long as your OS allows it.
</P
15276 >This is the list of socket options currently settable
15277 using this option:
</P
15303 >IPTOS_THROUGHPUT
</P
15323 >Those marked with a
<I
15327 argument. The others can optionally take a
1 or
0 argument to enable
15328 or disable the option, by default they will be enabled if you
15329 don't specify
1 or
0.
</P
15331 >To specify an argument use the syntax SOME_OPTION=VALUE
15335 >. Note that you must
15336 not have any spaces before or after the = sign.
</P
15338 >If you are on a local network then a sensible option
15343 >socket options = IPTOS_LOWDELAY
</B
15346 >If you have a local network then you could try:
</P
15350 >socket options = IPTOS_LOWDELAY TCP_NODELAY
</B
15353 >If you are on a wide area network then perhaps try
15354 setting IPTOS_THROUGHPUT.
</P
15356 >Note that several of the options may cause your Samba
15357 server to fail completely. Use these options with caution!
</P
15361 >socket options = TCP_NODELAY
</B
15366 >socket options = IPTOS_LOWDELAY
</B
15371 NAME=
"SOURCEENVIRONMENT"
15373 >source environment (G)
</DT
15376 >This parameter causes Samba to set environment
15377 variables as per the content of the file named.
</P
15379 >If the value of this parameter starts with a
"|" character
15380 then Samba will treat that value as a pipe command to open and
15381 will set the environment variables from the output of the pipe.
</P
15383 >The contents of the file or the output of the pipe should
15384 be formatted as the output of the standard Unix
<B
15388 > command. This is of the form :
</P
15390 >Example environment entry:
</P
15394 >SAMBA_NETBIOS_NAME=myhostname
</B
15399 >No default value
</I
15404 >source environment = |/etc/smb.conf.sh
15410 >source environment =
15411 /usr/local/smb_env_vars
</B
15421 >This variable is part of SSL-enabled Samba. This
15422 is only available if the SSL libraries have been compiled on your
15423 system and the configure option
<B
15427 given at configure time.
</P
15432 > that for export control reasons
15436 > enabled by default in any
15437 current binary version of Samba.
</P
15439 >This variable enables or disables the entire SSL mode. If
15443 >, the SSL enabled samba behaves
15444 exactly like the non-SSL samba. If set to
<TT
15448 it depends on the variables
<A
15457 HREF=
"#SSLHOSTSRESIGN"
15461 >ssl hosts resign
</I
15465 connection will be required.
</P
15474 NAME=
"SSLCACERTDIR"
15476 >ssl CA certDir (G)
</DT
15479 >This variable is part of SSL-enabled Samba. This
15480 is only available if the SSL libraries have been compiled on your
15481 system and the configure option
<B
15485 given at configure time.
</P
15490 > that for export control reasons
15494 > enabled by default in any
15495 current binary version of Samba.
</P
15497 >This variable defines where to look up the Certification
15498 Authorities. The given directory should contain one file for
15499 each CA that samba will trust. The file name must be the hash
15500 value over the
"Distinguished Name" of the CA. How this directory
15501 is set up is explained later in this document. All files within the
15502 directory that don't fit into this naming scheme are ignored. You
15503 don't need this variable if you don't verify client certificates.
</P
15507 >ssl CA certDir = /usr/local/ssl/certs
15513 NAME=
"SSLCACERTFILE"
15515 >ssl CA certFile (G)
</DT
15518 >This variable is part of SSL-enabled Samba. This
15519 is only available if the SSL libraries have been compiled on your
15520 system and the configure option
<B
15524 given at configure time.
</P
15529 > that for export control reasons
15533 > enabled by default in any
15534 current binary version of Samba.
</P
15536 >This variable is a second way to define the trusted CAs.
15537 The certificates of the trusted CAs are collected in one big
15538 file and this variable points to the file. You will probably
15539 only use one of the two ways to define your CAs. The first choice is
15540 preferable if you have many CAs or want to be flexible, the second
15541 is preferable if you only have one CA and want to keep things
15542 simple (you won't need to create the hashed file names). You
15543 don't need this variable if you don't verify client certificates.
</P
15547 >ssl CA certFile = /usr/local/ssl/certs/trustedCAs.pem
15555 >ssl ciphers (G)
</DT
15558 >This variable is part of SSL-enabled Samba. This
15559 is only available if the SSL libraries have been compiled on your
15560 system and the configure option
<B
15564 given at configure time.
</P
15569 > that for export control reasons
15573 > enabled by default in any
15574 current binary version of Samba.
</P
15576 >This variable defines the ciphers that should be offered
15577 during SSL negotiation. You should not set this variable unless
15578 you know what you are doing.
</P
15582 NAME=
"SSLCLIENTCERT"
15584 >ssl client cert (G)
</DT
15587 >This variable is part of SSL-enabled Samba. This
15588 is only available if the SSL libraries have been compiled on your
15589 system and the configure option
<B
15593 given at configure time.
</P
15598 > that for export control reasons
15602 > enabled by default in any
15603 current binary version of Samba.
</P
15605 >The certificate in this file is used by
<A
15606 HREF=
"smbclient.1.html"
15612 > if it exists. It's needed
15613 if the server requires a client certificate.
</P
15617 >ssl client cert = /usr/local/ssl/certs/smbclient.pem
15623 NAME=
"SSLCLIENTKEY"
15625 >ssl client key (G)
</DT
15628 >This variable is part of SSL-enabled Samba. This
15629 is only available if the SSL libraries have been compiled on your
15630 system and the configure option
<B
15634 given at configure time.
</P
15639 > that for export control reasons
15643 > enabled by default in any
15644 current binary version of Samba.
</P
15646 >This is the private key for
<A
15647 HREF=
"smbclient.1.html"
15653 >. It's only needed if the
15654 client should have a certificate.
</P
15658 >ssl client key = /usr/local/ssl/private/smbclient.pem
15664 NAME=
"SSLCOMPATIBILITY"
15666 >ssl compatibility (G)
</DT
15669 >This variable is part of SSL-enabled Samba. This
15670 is only available if the SSL libraries have been compiled on your
15671 system and the configure option
<B
15675 given at configure time.
</P
15680 > that for export control reasons
15684 > enabled by default in any
15685 current binary version of Samba.
</P
15687 >This variable defines whether SSLeay should be configured
15688 for bug compatibility with other SSL implementations. This is
15689 probably not desirable because currently no clients with SSL
15690 implementations other than SSLeay exist.
</P
15694 >ssl compatibility = no
</B
15705 HREF=
"#SSLHOSTSRESIGN"
15709 > ssl hosts resign
</I
15716 NAME=
"SSLHOSTSRESIGN"
15718 >ssl hosts resign (G)
</DT
15721 >This variable is part of SSL-enabled Samba. This
15722 is only available if the SSL libraries have been compiled on your
15723 system and the configure option
<B
15727 given at configure time.
</P
15732 > that for export control reasons
15736 > enabled by default in any
15737 current binary version of Samba.
</P
15739 >These two variables define whether samba will go
15740 into SSL mode or not. If none of them is defined, samba will
15741 allow only SSL connections. If the
<A
15750 hosts (by IP-address, IP-address range, net group or name),
15751 only these hosts will be forced into SSL mode. If the
<TT
15754 > ssl hosts resign
</I
15756 > variable lists hosts, only these
15757 hosts will NOT be forced into SSL mode. The syntax for these two
15758 variables is the same as for the
<A
15774 > pair of variables, only
15775 that the subject of the decision is different: It's not the access
15776 right but whether SSL is used or not.
</P
15778 >The example below requires SSL connections from all hosts
15779 outside the local net (which is
192.168.*.*).
</P
15783 >ssl hosts =
<empty string
></B
15788 >ssl hosts resign =
<empty string
></B
15793 >ssl hosts resign =
192.168.
</B
15798 NAME=
"SSLREQUIRECLIENTCERT"
15800 >ssl require clientcert (G)
</DT
15803 >This variable is part of SSL-enabled Samba. This
15804 is only available if the SSL libraries have been compiled on your
15805 system and the configure option
<B
15809 given at configure time.
</P
15814 > that for export control reasons
15818 > enabled by default in any
15819 current binary version of Samba.
</P
15821 >If this variable is set to
<TT
15825 server will not tolerate connections from clients that don't
15826 have a valid certificate. The directory/file given in
<A
15827 HREF=
"#SSLCACERTDIR"
15836 HREF=
"#SSLCACERTFILE"
15844 > will be used to look up the CAs that issued
15845 the client's certificate. If the certificate can't be verified
15846 positively, the connection will be terminated. If this variable
15850 >, clients don't need certificates.
15851 Contrary to web applications you really
<I
15855 require client certificates. In the web environment the client's
15856 data is sensitive (credit card numbers) and the server must prove
15857 to be trustworthy. In a file server environment the server's data
15858 will be sensitive and the clients must prove to be trustworthy.
</P
15862 >ssl require clientcert = no
</B
15867 NAME=
"SSLREQUIRESERVERCERT"
15869 >ssl require servercert (G)
</DT
15872 >This variable is part of SSL-enabled Samba. This
15873 is only available if the SSL libraries have been compiled on your
15874 system and the configure option
<B
15878 given at configure time.
</P
15883 > that for export control reasons
15887 > enabled by default in any
15888 current binary version of Samba.
</P
15890 >If this variable is set to
<TT
15895 HREF=
"smbclient.1.html"
15902 > will request a certificate from the server. Same as
15904 HREF=
"#SSLREQUIRECLIENTCERT"
15912 > for the server.
</P
15916 >ssl require servercert = no
</B
15922 NAME=
"SSLSERVERCERT"
15924 >ssl server cert (G)
</DT
15927 >This variable is part of SSL-enabled Samba. This
15928 is only available if the SSL libraries have been compiled on your
15929 system and the configure option
<B
15933 given at configure time.
</P
15938 > that for export control reasons
15942 > enabled by default in any
15943 current binary version of Samba.
</P
15945 >This is the file containing the server's certificate.
15949 > have a certificate. The
15950 file may also contain the server's private key. See later for
15951 how certificates and private keys are created.
</P
15955 >ssl server cert =
<empty string
>
15961 NAME=
"SSLSERVERKEY"
15963 >ssl server key (G)
</DT
15966 >This variable is part of SSL-enabled Samba. This
15967 is only available if the SSL libraries have been compiled on your
15968 system and the configure option
<B
15972 given at configure time.
</P
15977 > that for export control reasons
15981 > enabled by default in any
15982 current binary version of Samba.
</P
15984 >This file contains the private key of the server. If
15985 this variable is not defined, the key is looked up in the
15986 certificate file (it may be appended to the certificate).
15990 > have a private key
15991 and the certificate
<I
15995 match this private key.
</P
15999 >ssl server key =
<empty string
>
16007 >ssl version (G)
</DT
16010 >This variable is part of SSL-enabled Samba. This
16011 is only available if the SSL libraries have been compiled on your
16012 system and the configure option
<B
16016 given at configure time.
</P
16021 > that for export control reasons
16025 > enabled by default in any
16026 current binary version of Samba.
</P
16028 >This enumeration variable defines the versions of the
16029 SSL protocol that will be used.
<TT
16033 dynamic negotiation of SSL v2 or v3,
<TT
16040 > results in SSL v3 and
16044 > results in TLS v1. TLS (Transport Layer
16045 Security) is the new standard for SSL.
</P
16049 >ssl version =
"ssl2or3"</B
16056 >stat cache (G)
</DT
16059 >This parameter determines if
<A
16063 > will use a cache in order to
16064 speed up case insensitive name mappings. You should never need
16065 to change this parameter.
</P
16069 >stat cache = yes
</B
16074 NAME=
"STATCACHESIZE"
16076 >stat cache size (G)
</DT
16079 >This parameter determines the number of
16086 never need to change this parameter.
</P
16090 >stat cache size =
50</B
16100 >This enables or disables logging of connections
16101 to a status file that
<A
16102 HREF=
"smbstatus.1.html"
16108 >With this disabled
<B
16112 to tell you what connections are active. You should never need to
16113 change this parameter.
</P
16122 NAME=
"STRICTLOCKING"
16124 >strict locking (S)
</DT
16127 >This is a boolean that controls the handling of
16128 file locking in the server. When this is set to
<TT
16132 the server will check every read and write access for file locks, and
16133 deny access if locks exist. This can be slow on some systems.
</P
16135 >When strict locking is
<TT
16138 > the server does file
16139 lock checks only when the client explicitly asks for them.
</P
16141 >Well behaved clients always ask for lock checks when it
16142 is important, so in the vast majority of cases
<B
16146 > is preferable.
</P
16150 >strict locking = no
</B
16157 >strict sync (S)
</DT
16160 >Many Windows applications (including the Windows
16161 98 explorer shell) seem to confuse flushing buffer contents to
16162 disk with doing a sync to disk. Under UNIX, a sync call forces
16163 the process to be suspended until the kernel has ensured that
16164 all outstanding data in kernel disk buffers has been safely stored
16165 onto stable storage. This is very slow and should only be done
16166 rarely. Setting this parameter to
<TT
16170 default) means that smbd ignores the Windows applications requests for
16171 a sync call. There is only a possibility of losing data if the
16172 operating system itself that Samba is running on crashes, so there is
16173 little danger in this default setting. In addition, this fixes many
16174 performance problems that people have reported with the new Windows98
16175 explorer shell file copies.
</P
16190 >strict sync = no
</B
16200 >This is a boolean that controls whether to
16201 strip trailing dots off UNIX filenames. This helps with some
16202 CDROMs that have filenames ending in a single dot.
</P
16213 >sync always (S)
</DT
16216 >This is a boolean parameter that controls
16217 whether writes will always be written to stable storage before
16218 the write call returns. If this is false then the server will be
16219 guided by the client's request in each write call (clients can
16220 set a bit indicating that a particular write should be synchronous).
16221 If this is true then every write will be followed by a
<B
16225 > call to ensure the data is written to disk. Note that
16231 > parameter must be set to
16235 > in order for this parameter to have
16251 >sync always = no
</B
16261 >This parameter maps how Samba debug messages
16262 are logged onto the system syslog logging levels. Samba debug
16263 level zero maps onto syslog
<TT
16267 level one maps onto
<TT
16274 >, debug level three
16275 maps onto LOG_INFO. All higher levels are mapped to
<TT
16280 >This parameter sets the threshold for sending messages
16281 to syslog. Only messages with debug level less than this value
16282 will be sent to syslog.
</P
16293 >syslog only (G)
</DT
16296 >If this parameter is set then Samba debug
16297 messages are logged into the system syslog only, and not to
16298 the debug log files.
</P
16302 >syslog only = no
</B
16307 NAME=
"TEMPLATEHOMEDIR"
16309 >template homedir (G)
</DT
16315 > this parameter is
16316 only available in Samba
3.0.
</P
16318 >When filling out the user information for a Windows NT
16320 HREF=
"winbindd.8.html"
16324 uses this parameter to fill in the home directory for that user.
16330 > is present it is substituted
16331 with the user's Windows NT domain name. If the string
<TT
16337 > is present it is substituted with the user's Windows
16342 >template homedir = /home/%D/%U
</B
16347 NAME=
"TEMPLATESHELL"
16349 >template shell (G)
</DT
16355 > this parameter is
16356 only available in Samba
3.0.
</P
16358 >When filling out the user information for a Windows NT
16360 HREF=
"winbindd.8.html"
16364 uses this parameter to fill in the login shell for that user.
</P
16368 >template shell = /bin/false
</B
16375 >time offset (G)
</DT
16378 >This parameter is a setting in minutes to add
16379 to the normal GMT to local time conversion. This is useful if
16380 you are serving a lot of PCs that have incorrect daylight
16381 saving time handling.
</P
16385 >time offset =
0</B
16390 >time offset =
60</B
16397 >time server (G)
</DT
16400 >This parameter determines if
<A
16405 > advertises itself as a time server to Windows
16410 >time server = no
</B
16415 NAME=
"TIMESTAMPLOGS"
16417 >timestamp logs (G)
</DT
16421 HREF=
"#DEBUGTIMESTAMP"
16425 > debug timestamp
</I
16432 NAME=
"TOTALPRINTJOBS"
16434 >total print jobs (G)
</DT
16437 >This parameter accepts an integer value which defines
16438 a limit on the maximum number of print jobs that will be accepted
16439 system wide at any given time. If a print job is submitted
16440 by a client which will exceed this number, then smbd will return an
16441 error indicating that no space is available on the server. The
16442 default value of
0 means that no such limit exists. This parameter
16443 can be used to prevent a server from exceeding its capacity and is
16444 designed as a printing throttle. See also
16446 HREF=
"#MAXPRINTJOBS"
16458 >total print jobs =
0</B
16463 >total print jobs =
5000</B
16468 NAME=
"UNIXPASSWORDSYNC"
16470 >unix password sync (G)
</DT
16473 >This boolean parameter controls whether Samba
16474 attempts to synchronize the UNIX password with the SMB password
16475 when the encrypted SMB password in the smbpasswd file is changed.
16476 If this is set to true the program specified in the
<TT
16482 >parameter is called
<I
16486 to allow the new UNIX password to be set without access to the
16487 old UNIX password (as the SMB password has change code has no
16488 access to the old password cleartext, only the new).
</P
16491 HREF=
"#PASSWDPROGRAM"
16511 >unix password sync = no
</B
16516 NAME=
"UPDATEENCRYPTED"
16518 >update encrypted (G)
</DT
16521 >This boolean parameter allows a user logging
16522 on with a plaintext password to have their encrypted (hashed)
16523 password in the smbpasswd file to be updated automatically as
16524 they log on. This option allows a site to migrate from plaintext
16525 password authentication (users authenticate with plaintext
16526 password over the wire, and are checked against a UNIX account
16527 database) to encrypted password authentication (the SMB
16528 challenge/response authentication mechanism) without forcing
16529 all users to re-enter their passwords via smbpasswd at the time the
16530 change is made. This is a convenience option to allow the change over
16531 to encrypted passwords to be made over a longer period. Once all users
16532 have encrypted representations of their passwords in the smbpasswd
16533 file this parameter should be set to
<TT
16538 >In order for this parameter to work correctly the
<A
16539 HREF=
"#ENCRYPTPASSWORDS"
16543 >encrypt passwords
</I
16547 > parameter must be set to
<TT
16551 this parameter is set to
<TT
16556 >Note that even when this parameter is set a user
16557 authenticating to
<B
16560 > must still enter a valid
16561 password in order to connect correctly, and to update their hashed
16562 (smbpasswd) passwords.
</P
16566 >update encrypted = no
</B
16573 >use rhosts (G)
</DT
16576 >If this global parameter is a true, it specifies
16577 that the UNIX users
<TT
16580 > file in their home directory
16581 will be read to find the names of hosts and users who will be allowed
16582 access without specifying a password.
</P
16593 > can be a major security hole. This is because you are
16594 trusting the PC to supply the correct username. It is very easy to
16595 get a PC to supply a false username. I recommend that the
<TT
16600 > option be only used if you really know what
16605 >use rhosts = no
</B
16649 >Multiple users may be specified in a comma-delimited
16650 list, in which case the supplied password will be tested against
16651 each username in turn (left to right).
</P
16658 > line is needed only when
16659 the PC is unable to supply its own username. This is the case
16660 for the COREPLUS protocol or where your users have different WfWg
16661 usernames to UNIX usernames. In both these cases you may also be
16662 better using the \\server\share%user syntax instead.
</P
16669 > line is not a great
16670 solution in many cases as it means Samba will try to validate
16671 the supplied password against each of the usernames in the
16677 > line in turn. This is slow and
16678 a bad idea for lots of users in case of duplicate passwords.
16679 You may get timeouts or security breaches using this parameter
16682 >Samba relies on the underlying UNIX security. This
16683 parameter does not restrict who can login, it just offers hints
16684 to the Samba server as to what usernames might correspond to the
16685 supplied password. Users can login as whoever they please and
16686 they will be able to do no more damage than if they started a
16687 telnet session. The daemon runs as the user that they log in as,
16688 so they cannot do anything that user cannot do.
</P
16690 >To restrict a service to a particular set of users you
16702 >If any of the usernames begin with a '@' then the name
16703 will be looked up first in the yp netgroups list (if Samba
16704 is compiled with netgroup support), followed by a lookup in
16705 the UNIX groups database and will expand to a list of all users
16706 in the group of that name.
</P
16708 >If any of the usernames begin with a '+' then the name
16709 will be looked up only in the UNIX groups database and will
16710 expand to a list of all users in the group of that name.
</P
16712 >If any of the usernames begin with a '
&'then the name
16713 will be looked up only in the yp netgroups database (if Samba
16714 is compiled with netgroup support) and will expand to a list
16715 of all users in the netgroup group of that name.
</P
16717 >Note that searching though a groups database can take
16718 quite some time, and some clients may time out during the
16721 >See the section
<A
16724 USERNAME/PASSWORD VALIDATION
</A
16725 > for more information on how
16726 this parameter determines access to the services.
</P
16730 >The guest account if a guest service,
16731 else
<empty string
>.
</B
16736 >username = fred, mary, jack, jane,
16737 @users, @pcgroup
</B
16742 NAME=
"USERNAMELEVEL"
16744 >username level (G)
</DT
16747 >This option helps Samba to try and 'guess' at
16748 the real UNIX username, as many DOS clients send an all-uppercase
16749 username. By default Samba tries all lowercase, followed by the
16750 username with the first letter capitalized, and fails if the
16751 username is not found on the UNIX machine.
</P
16753 >If this parameter is set to non-zero the behavior changes.
16754 This parameter is a number that specifies the number of uppercase
16755 combinations to try while trying to determine the UNIX user name. The
16756 higher the number the more combinations will be tried, but the slower
16757 the discovery of usernames will be. Use this parameter when you have
16758 strange usernames on your UNIX machine, such as
<TT
16766 >username level =
0</B
16771 >username level =
5</B
16778 >username map (G)
</DT
16781 >This option allows you to specify a file containing
16782 a mapping of usernames from the clients to the server. This can be
16783 used for several purposes. The most common is to map usernames
16784 that users use on DOS or Windows machines to those that the UNIX
16785 box uses. The other is to map multiple users to a single username
16786 so that they can more easily share files.
</P
16788 >The map file is parsed line by line. Each line should
16789 contain a single UNIX username on the left then a '=' followed
16790 by a list of usernames on the right. The list of usernames on the
16791 right may contain names of the form @group in which case they
16792 will match any UNIX username in that group. The special client
16793 name '*' is a wildcard and matches any name. Each line of the
16794 map file may be up to
1023 characters long.
</P
16796 >The file is processed on each line by taking the
16797 supplied username and comparing it with each username on the right
16798 hand side of the '=' signs. If the supplied name matches any of
16799 the names on the right hand side then it is replaced with the name
16800 on the left. Processing then continues with the next line.
</P
16802 >If any line begins with a '#' or a ';' then it is
16805 >If any line begins with an '!' then the processing
16806 will stop after that line if a mapping was done by the line.
16807 Otherwise mapping continues with every line being processed.
16808 Using '!' is most useful when you have a wildcard mapping line
16809 later in the file.
</P
16811 >For example to map from the name
<TT
16818 > to the UNIX name
<TT
16821 > you would use:
</P
16825 >root = admin administrator
</B
16828 >Or to map anyone in the UNIX group
<TT
16832 to the UNIX name
<TT
16835 > you would use:
</P
16842 >You can have as many mappings as you like in a username
16845 >If your system supports the NIS NETGROUP option then
16846 the netgroup database is checked before the
<TT
16850 > database for matching groups.
</P
16852 >You can map Windows usernames that have spaces in them
16853 by using double quotes around the name. For example:
</P
16857 >tridge =
"Andrew Tridgell"</B
16860 >would map the windows username
"Andrew Tridgell" to the
16861 unix username
"tridge".
</P
16863 >The following example would map mary and fred to the
16864 unix user sys, and map the rest to guest. Note the use of the
16865 '!' to tell Samba to stop processing if it gets a match on
16869 CLASS=
"PROGRAMLISTING"
16875 >Note that the remapping is applied to all occurrences
16876 of usernames. Thus if you connect to \\server\fred and
<TT
16879 > is remapped to
<TT
16883 will actually be connecting to \\server\mary and will need to
16884 supply a password suitable for
<TT
16891 >. The only exception to this is the
16892 username passed to the
<A
16893 HREF=
"#PASSWORDSERVER"
16897 > password server
</I
16900 > (if you have one). The password
16901 server will receive whatever username the client supplies without
16904 >Also note that no reverse mapping is done. The main effect
16905 this has is with printing. Users who have been mapped may have
16906 trouble deleting print jobs as PrintManager under WfWg will think
16907 they don't own the print job.
</P
16911 >no username map
</I
16916 >username map = /usr/local/samba/lib/users.map
16927 >This boolean parameter is only available if
16928 Samba has been configured and compiled with the option
<B
16931 >. If set to True then Samba will attempt
16932 to add utmp or utmpx records (depending on the UNIX system) whenever a
16933 connection is made to a Samba server. Sites may use this to record the
16934 user connecting to a Samba share.
</P
16937 HREF=
"#UTMPDIRECTORY"
16941 > utmp directory
</I
16953 NAME=
"UTMPDIRECTORY"
16955 >utmp directory(G)
</DT
16958 >This parameter is only available if Samba has
16959 been configured and compiled with the option
<B
16962 >. It specifies a directory pathname that is
16963 used to store the utmp or utmpx files (depending on the UNIX system) that
16964 record user connections to a Samba server. See also the
<A
16972 > parameter. By default this is
16973 not set, meaning the system will use whatever utmp file the
16974 native system is set to use (usually
16982 >no utmp directory
</I
16989 >valid chars (G)
</DT
16992 >The option allows you to specify additional
16993 characters that should be considered valid by the server in
16994 filenames. This is particularly useful for national character
16995 sets, such as adding u-umlaut or a-ring.
</P
16997 >The option takes a list of characters in either integer
16998 or character form with spaces between them. If you give two
16999 characters with a colon between them then it will be taken as
17000 an lowercase:uppercase pair.
</P
17002 >If you have an editor capable of entering the characters
17003 into the config file then it is probably easiest to use this
17004 method. Otherwise you can specify the characters in octal,
17005 decimal or hexadecimal form using the usual C notation.
</P
17007 >For example to add the single character 'Z' to the charset
17008 (which is a pointless thing to do as it's already there) you could
17009 do one of the following
</P
17012 CLASS=
"PROGRAMLISTING"
17015 valid chars =
0132:
0172
17019 >The last two examples above actually add two characters,
17020 and alter the uppercase and lowercase mappings appropriately.
</P
17025 > specify this parameter
17029 >client code page
</I
17032 have both set. If
<TT
17035 >client code page
</I
17043 > parameter the
<TT
17049 > settings will be overwritten.
</P
17052 HREF=
"#CLIENTCODEPAGE"
17064 >Samba defaults to using a reasonable set
17065 of valid characters for English systems
</I
17070 >valid chars =
0345:
0305 0366:
0326 0344:
0304
17074 >The above example allows filenames to have the Swedish
17075 characters in them.
</P
17080 > It is actually quite difficult to
17081 correctly produce a
<TT
17087 a particular system. To automate the process
<A
17088 HREF=
"mailto:tino@augsburg.net"
17090 >tino@augsburg.net
</A
17092 a package called
<B
17095 > which will automatically
17096 produce a complete
<TT
17102 a given client system. Look in the
<TT
17104 >examples/validchars/
17106 > subdirectory of your Samba source code distribution
17107 for this package.
</P
17113 >valid users (S)
</DT
17116 >This is a list of users that should be allowed
17117 to login to this service. Names starting with '@', '+' and '
&'
17118 are interpreted using the same rules as described in the
17126 >If this is empty (the default) then any user can login.
17127 If a username is in both this list and the
<TT
17133 > list then access is denied for that user.
</P
17135 >The current servicename is substituted for
<TT
17141 >. This is useful in the [homes] section.
</P
17144 HREF=
"#INVALIDUSERS"
17156 >No valid users list (anyone can login)
17162 >valid users = greg, @pcusers
</B
17172 >This is a list of files and directories that
17173 are neither visible nor accessible. Each entry in the list must
17174 be separated by a '/', which allows spaces to be included
17175 in the entry. '*' and '?' can be used to specify multiple files
17176 or directories as in DOS wildcards.
</P
17178 >Each entry must be a unix path, not a DOS path and
17182 > include the unix directory
17191 is applicable in vetoing files.
</P
17193 >One feature of the veto files parameter that it is important
17194 to be aware of, is that if a directory contains nothing but files
17195 that match the veto files parameter (which means that Windows/DOS
17196 clients cannot ever see them) is deleted, the veto files within
17199 >are automatically deleted
</I
17201 with it, if the user has UNIX permissions to do so.
</P
17203 >Setting this parameter will affect the performance
17204 of Samba, as it will be forced to check all files and directories
17205 for a match as they are scanned.
</P
17217 HREF=
"#CASESENSITIVE"
17221 > case sensitive
</I
17228 >No files or directories are vetoed.
17233 CLASS=
"PROGRAMLISTING"
17234 > ; Veto any files containing the word Security,
17235 ; any ending in .tmp, and any directory containing the
17237 veto files = /*Security*/*.tmp/*root*/
17239 ; Veto the Apple specific files that a NetAtalk server
17241 veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/
17247 NAME=
"VETOOPLOCKFILES"
17249 >veto oplock files (S)
</DT
17252 >This parameter is only valid when the
<A
17261 parameter is turned on for a share. It allows the Samba administrator
17262 to selectively turn off the granting of oplocks on selected files that
17263 match a wildcarded list, similar to the wildcarded list used in the
17277 >No files are vetoed for oplock
17281 >You might want to do this on files that you know will
17282 be heavily contended for by clients. A good example of this
17283 is in the NetBench SMB benchmark program, which causes heavy
17284 client contention for files ending in
<TT
17288 To cause Samba not to grant oplocks on these files you would use
17289 the line (either in the [global] section or in the section for
17290 the particular NetBench share :
</P
17294 >veto oplock files = /*;.SEM/
17302 >vfs object (S)
</DT
17305 >This parameter specifies a shared object file that
17306 is used for Samba VFS I/O operations. By default, normal
17307 disk I/O operations are used but these can be overloaded
17308 with a VFS object. The Samba VFS layer is new to Samba
2.2 and
17309 must be enabled at compile time with --with-vfs.
</P
17320 >vfs options (S)
</DT
17323 >This parameter allows parameters to be passed
17324 to the vfs layer at initialisation time. The Samba VFS layer
17325 is new to Samba
2.2 and must be enabled at compile time
17326 with --with-vfs. See also
<A
17348 > This allows you to override the volume label
17349 returned for a share. Useful for CDROMs with installation programs
17350 that insist on a particular volume label.
</P
17354 >the name of the share
</I
17361 >wide links (S)
</DT
17364 >This parameter controls whether or not links
17365 in the UNIX file system may be followed by the server. Links
17366 that point to areas within the directory tree exported by the
17367 server are always allowed; this parameter controls access only
17368 to areas that are outside the directory tree being exported.
</P
17370 >Note that setting this parameter can have a negative
17371 effect on your server performance due to the extra system calls
17372 that Samba has to do in order to perform the link checks.
</P
17376 >wide links = yes
</B
17381 NAME=
"WINBINDCACHETIME"
17383 >winbind cache time
</DT
17389 > this parameter is only
17390 available in Samba
3.0.
</P
17392 >This parameter specifies the number of seconds the
17394 HREF=
"winbindd.8.html"
17397 > daemon will cache
17398 user and group information before querying a Windows NT server
17403 >winbind cache type =
15</B
17416 > this parameter is only
17417 available in Samba
3.0.
</P
17419 >The winbind gid parameter specifies the range of group
17420 ids that are allocated by the
<A
17421 HREF=
"winbindd.8.html"
17424 > daemon. This range of group ids should have no
17425 existing local or nis groups within it as strange conflicts can
17426 occur otherwise.
</P
17430 >winbind gid =
<empty string
>
17436 >winbind gid =
10000-
20000</B
17441 NAME=
"WINBINDSEPARATOR"
17443 >winbind separator
</DT
17449 > this parameter is only
17450 available in Samba
3.0.
</P
17452 >This parameter allows an admin to define the character
17453 used when listing a username of the form of
<TT
17454 CLASS=
"REPLACEABLE"
17460 CLASS=
"REPLACEABLE"
17465 is only applicable when using the
<TT
17467 >pam_winbind.so
</TT
17471 >nss_winbind.so
</TT
17472 > modules for UNIX services.
17477 >winbind separator = \
</B
17482 >winbind separator = +
</B
17495 > this parameter is only
17496 available in Samba
3.0.
</P
17498 >The winbind gid parameter specifies the range of group
17499 ids that are allocated by the
<A
17500 HREF=
"winbindd.8.html"
17503 > daemon. This range of ids should have no
17504 existing local or nis users within it as strange conflicts can
17505 occur otherwise.
</P
17509 >winbind uid =
<empty string
>
17515 >winbind uid =
10000-
20000</B
17525 >When Samba is running as a WINS server this
17526 allows you to call an external program for all changes to the
17527 WINS database. The primary use for this option is to allow the
17528 dynamic update of external name resolution databases such as
17531 >The wins hook parameter specifies the name of a script
17532 or executable that will be called as follows:
</P
17536 >wins_hook operation name nametype ttl IP_list
17544 >The first argument is the operation and is one
17545 of
"add",
"delete", or
"refresh". In most cases the operation can
17546 be ignored as the rest of the parameters provide sufficient
17547 information. Note that
"refresh" may sometimes be called when the
17548 name has not previously been added, in that case it should be treated
17553 >The second argument is the netbios name. If the
17554 name is not a legal name then the wins hook is not called.
17555 Legal names contain only letters, digits, hyphens, underscores
17560 >The third argument is the netbios name
17561 type as a
2 digit hexadecimal number.
</P
17565 >The fourth argument is the TTL (time to live)
17566 for the name in seconds.
</P
17570 >The fifth and subsequent arguments are the IP
17571 addresses currently registered for that name. If this list is
17572 empty then the name should be deleted.
</P
17576 >An example script that calls the BIND dynamic DNS update
17580 > is provided in the examples
17581 directory of the Samba source code.
</P
17587 >wins proxy (G)
</DT
17590 >This is a boolean that controls if
<A
17594 > will respond to broadcast name
17595 queries on behalf of other hosts. You may need to set this
17599 > for some older clients.
</P
17603 >wins proxy = no
</B
17610 >wins server (G)
</DT
17613 >This specifies the IP address (or DNS name: IP
17614 address for preference) of the WINS server that
<A
17618 > should register with. If you have a WINS server on
17619 your network then you should set this to the WINS server's IP.
</P
17621 >You should point this at your WINS server if you have a
17622 multi-subnetted network.
</P
17627 >. You need to set up Samba to point
17628 to a WINS server if you have multiple subnets and wish cross-subnet
17629 browsing to work correctly.
</P
17631 >See the documentation file
<TT
17635 in the docs/ directory of your Samba source distribution.
</P
17644 >wins server =
192.9.200.1</B
17651 >wins support (G)
</DT
17654 >This boolean controls if the
<A
17659 > process in Samba will act as a WINS server. You should
17660 not set this to true unless you have a multi-subnetted network and
17661 you wish a particular
<B
17664 > to be your WINS server.
17665 Note that you should
<I
17669 on more than one machine in your network.
</P
17673 >wins support = no
</B
17683 >This controls what workgroup your server will
17684 appear to be in when queried by clients. Note that this parameter
17685 also controls the Domain name used with the
<A
17686 HREF=
"#SECURITYEQUALSDOMAIN"
17689 >security=domain
</B
17696 >set at compile time to WORKGROUP
</I
17701 >workgroup = MYGROUP
</B
17719 > for people who can't spell :-).
</P
17723 NAME=
"WRITECACHESIZE"
17725 >write cache size (S)
</DT
17728 >If this integer parameter is set to non-zero value,
17729 Samba will create an in-memory cache for each oplocked file
17734 non-oplocked files). All writes that the client does not request
17735 to be flushed directly to disk will be stored in this cache if possible.
17736 The cache is flushed onto disk when a write comes in whose offset
17737 would not fit into the cache or when the file is closed by the client.
17738 Reads for the file are also served from this cache if the data is stored
17741 >This cache allows Samba to batch client writes into a more
17742 efficient write size for RAID disks (ie. writes may be tuned to
17743 be the RAID stripe size) and can improve performance on systems
17744 where the disk subsystem is a bottleneck but there is free
17745 memory for userspace programs.
</P
17747 >The integer parameter specifies the size of this cache
17748 (per oplocked file) in bytes.
</P
17752 >write cache size =
0</B
17757 >write cache size =
262144</B
17760 >for a
256k cache size per file.
</P
17766 >write list (S)
</DT
17769 >This is a list of users that are given read-write
17770 access to a service. If the connecting user is in this list then
17771 they will be given write access, no matter what the
<A
17780 option is set to. The list can include group names using the
17783 >Note that if a user is in both the read list and the
17784 write list then they will be given write access.
</P
17799 >write list =
<empty string
>
17805 >write list = admin, root, @staff
17833 >This parameter controls whether or not the server
17834 will support raw writes SMB's when transferring data from clients.
17835 You should never need to change this parameter.
</P
17839 >write raw = yes
</B
17849 >An inverted synonym is
<A
17859 >If this parameter is
<TT
17863 of a service may not create or modify files in the service's
17866 >Note that a printable service (
<B
17868 >printable = yes
</B
17873 > allow writing to the directory
17874 (user privileges permitting), but only via spooling operations.
</P
17892 >Although the configuration file permits service names
17893 to contain spaces, your client software may not. Spaces will
17894 be ignored in comparisons anyway, so it shouldn't be a
17895 problem - but be aware of the possibility.
</P
17897 >On a similar note, many clients - especially DOS clients -
17898 limit service names to eight characters.
<A
17903 > has no such limitation, but attempts to connect from such
17904 clients will fail if they truncate the service names. For this reason
17905 you should probably keep your service names down to eight characters
17908 >Use of the [homes] and [printers] special sections make life
17909 for an administrator easy, but the various combinations of default
17910 attributes can be tricky. Take extreme care when designing these
17911 sections. In particular, ensure that the permissions on spool
17912 directories are correct.
</P
17922 >This man page is correct for version
2.2 of
17923 the Samba suite.
</P
17934 HREF=
"samba.7.html"
17939 HREF=
"smbpasswd.8.html"
17971 HREF=
"smbclient.1.html"
17979 HREF=
"nmblookup.1.html"
17987 HREF=
"testparm.1.html"
17995 HREF=
"testprns.1.html"
18012 >The original Samba software and related utilities
18013 were created by Andrew Tridgell. Samba is now developed
18014 by the Samba Team as an Open Source project similar
18015 to the way the Linux kernel is developed.
</P
18017 >The original Samba man pages were written by Karl Auer.
18018 The man page sources were converted to YODL format (another
18019 excellent piece of Open Source software, available at
18021 HREF=
"ftp://ftp.icce.rug.nl/pub/unix/"
18023 > ftp://ftp.icce.rug.nl/pub/unix/
</A
18024 >) and updated for the Samba
2.0
18025 release by Jeremy Allison. The conversion to DocBook for
18026 Samba
2.2 was done by Gerald Carter
</P