docs/htmldocs/smb.conf.5.html

   1 <HTML
   2 ><HEAD
   3 ><TITLE
   4 >smb.conf</TITLE
   5 ><META
   6 NAME="GENERATOR"
   7 CONTENT="Modular DocBook HTML Stylesheet Version 1.57"></HEAD
   8 ><BODY
   9 CLASS="REFENTRY"
  10 BGCOLOR="#FFFFFF"
  11 TEXT="#000000"
  12 LINK="#0000FF"
  13 VLINK="#840084"
  14 ALINK="#0000FF"
  15 ><H1
  16 ><A
  17 NAME="SMB.CONF"
  18 >smb.conf</A
  19 ></H1
  20 ><DIV
  21 CLASS="REFNAMEDIV"
  22 ><A
  23 NAME="AEN5"
  24 ></A
  25 ><H2
  26 >Name</H2
  27 >smb.conf&nbsp;--&nbsp;The configuration file for the Samba suite</DIV
  28 ><DIV
  29 CLASS="REFSECT1"
  30 ><A
  31 NAME="AEN8"
  32 ></A
  33 ><H2
  34 >SYNOPSIS</H2
  35 ><P
  36 >The <TT
  37 CLASS="FILENAME"
  38 >smb.conf</TT
  39 > file is a configuration
  40         file for the Samba suite. <TT
  41 CLASS="FILENAME"
  42 >smb.conf</TT
  43 > contains
  44         runtime configuration information for the Samba programs. The
  45         <TT
  46 CLASS="FILENAME"
  47 >smb.conf</TT
  48 > file is designed to be configured and
  49         administered by the <A
  50 HREF="swat.8.html"
  51 TARGET="_top"
  52 ><B
  53 CLASS="COMMAND"
  54 >swat(8)</B
  55 >
  56         </A
  57 > program. The complete description of the file format and
  58         possible parameters held within are here for reference purposes.</P
  59 ></DIV
  60 ><DIV
  61 CLASS="REFSECT1"
  62 ><A
  63 NAME="AEN16"
  64 ></A
  65 ><H2
  66 >FILE FORMAT</H2
  67 ><P
  68 >The file consists of sections and parameters. A section
  69         begins with the name of the section in square brackets and continues
  70         until the next section begins. Sections contain parameters of the
  71         form</P
  72 ><P
  73 ><TT
  74 CLASS="REPLACEABLE"
  75 ><I
  76 >name</I
  77 ></TT
  78 > = <TT
  79 CLASS="REPLACEABLE"
  80 ><I
  81 >value
  82         </I
  83 ></TT
  84 ></P
  85 ><P
  86 >The file is line-based - that is, each newline-terminated
  87         line represents either a comment, a section name or a parameter.</P
  88 ><P
  89 >Section and parameter names are not case sensitive.</P
  90 ><P
  91 >Only the first equals sign in a parameter is significant.
  92         Whitespace before or after the first equals sign is discarded.
  93         Leading, trailing and internal whitespace in section and parameter
  94         names is irrelevant. Leading and trailing whitespace in a parameter
  95         value is discarded. Internal whitespace within a parameter value
  96         is retained verbatim.</P
  97 ><P
  98 >Any line beginning with a semicolon (';') or a hash ('#')
  99         character is ignored, as are lines containing only whitespace.</P
 100 ><P
 101 >Any line ending in a '\' is continued
 102         on the next line in the customary UNIX fashion.</P
 103 ><P
 104 >The values following the equals sign in parameters are all
 105         either a string (no quotes needed) or a boolean, which may be given
 106         as yes/no, 0/1 or true/false. Case is not significant in boolean
 107         values, but is preserved in string values. Some items such as
 108         create modes are numeric.</P
 109 ></DIV
 110 ><DIV
 111 CLASS="REFSECT1"
 112 ><A
 113 NAME="AEN28"
 114 ></A
 115 ><H2
 116 >SECTION DESCRIPTIONS</H2
 117 ><P
 118 >Each section in the configuration file (except for the
 119         [global] section) describes a shared resource (known
 120         as a "share"). The section name is the name of the
 121         shared resource and the parameters within the section define
 122         the shares attributes.</P
 123 ><P
 124 >There are three special sections, [global],
 125         [homes] and [printers], which are
 126         described under <I
 127 CLASS="EMPHASIS"
 128 >special sections</I
 129 >. The
 130         following notes apply to ordinary section descriptions.</P
 131 ><P
 132 >A share consists of a directory to which access is being
 133         given plus a description of the access rights which are granted
 134         to the user of the service. Some housekeeping options are
 135         also specifiable.</P
 136 ><P
 137 >Sections are either file share services (used by the
 138         client as an extension of their native file systems) or
 139         printable services (used by the client to access print services
 140         on the host running the server).</P
 141 ><P
 142 >Sections may be designated <I
 143 CLASS="EMPHASIS"
 144 >guest</I
 145 > services,
 146         in which case no password is required to access them. A specified
 147         UNIX <I
 148 CLASS="EMPHASIS"
 149 >guest account</I
 150 > is used to define access
 151         privileges in this case.</P
 152 ><P
 153 >Sections other than guest services will require a password
 154         to access them. The client provides the username. As older clients
 155         only provide passwords and not usernames, you may specify a list
 156         of usernames to check against the password using the "user="
 157         option in the share definition. For modern clients such as
 158         Windows 95/98/ME/NT/2000, this should not be necessary.</P
 159 ><P
 160 >Note that the access rights granted by the server are
 161         masked by the access rights granted to the specified or guest
 162         UNIX user by the host system. The server does not grant more
 163         access than the host system grants.</P
 164 ><P
 165 >The following sample section defines a file space share.
 166         The user has write access to the path <TT
 167 CLASS="FILENAME"
 168 >/home/bar</TT
 169 >.
 170         The share is accessed via the share name "foo":</P
 171 ><PRE
 172 CLASS="SCREEN"
 173 >       <TT
 174 CLASS="COMPUTEROUTPUT"
 175 >       [foo]
 176                 path = /home/bar
 177                 writeable = true
 178         </TT
 179 >
 180         </PRE
 181 ><P
 182 >The following sample section defines a printable share.
 183         The share is readonly, but printable. That is, the only write
 184         access permitted is via calls to open, write to and close a
 185         spool file. The <I
 186 CLASS="EMPHASIS"
 187 >guest ok</I
 188 > parameter means
 189         access will be permitted as the default guest user (specified
 190         elsewhere):</P
 191 ><PRE
 192 CLASS="SCREEN"
 193 >       <TT
 194 CLASS="COMPUTEROUTPUT"
 195 >       [aprinter]
 196                 path = /usr/spool/public
 197                 writeable = false
 198                 printable = true
 199                 guest ok = true
 200         </TT
 201 >
 202         </PRE
 203 ></DIV
 204 ><DIV
 205 CLASS="REFSECT1"
 206 ><A
 207 NAME="AEN48"
 208 ></A
 209 ><H2
 210 >SPECIAL SECTIONS</H2
 211 ><DIV
 212 CLASS="REFSECT2"
 213 ><A
 214 NAME="AEN50"
 215 ></A
 216 ><H3
 217 >The [global] section</H3
 218 ><P
 219 >parameters in this section apply to the server
 220                 as a whole, or are defaults for sections which do not
 221                 specifically define certain items. See the notes
 222                 under PARAMETERS for more information.</P
 223 ></DIV
 224 ><DIV
 225 CLASS="REFSECT2"
 226 ><A
 227 NAME="AEN53"
 228 ></A
 229 ><H3
 230 >The [homes] section</H3
 231 ><P
 232 >If a section called homes is included in the
 233                 configuration file, services connecting clients to their
 234                 home directories can be created on the fly by the server.</P
 235 ><P
 236 >When the connection request is made, the existing
 237                 sections are scanned. If a match is found, it is used. If no
 238                 match is found, the requested section name is treated as a
 239                 user name and looked up in the local password file. If the
 240                 name exists and the correct password has been given, a share is
 241                 created by cloning the [homes] section.</P
 242 ><P
 243 >Some modifications are then made to the newly
 244                 created share:</P
 245 ><P
 246 ></P
 247 ><UL
 248 ><LI
 249 ><P
 250 >The share name is changed from homes to
 251                 the located username.</P
 252 ></LI
 253 ><LI
 254 ><P
 255 >If no path was given, the path is set to
 256                 the user's home directory.</P
 257 ></LI
 258 ></UL
 259 ><P
 260 >If you decide to use a <I
 261 CLASS="EMPHASIS"
 262 >path=</I
 263 > line
 264                 in your [homes] section then you may find it useful
 265                 to use the %S macro. For example :</P
 266 ><P
 267 ><TT
 268 CLASS="USERINPUT"
 269 ><B
 270 >path=/data/pchome/%S</B
 271 ></TT
 272 ></P
 273 ><P
 274 >would be useful if you have different home directories
 275                 for your PCs than for UNIX access.</P
 276 ><P
 277 >This is a fast and simple way to give a large number
 278                 of clients access to their home directories with a minimum
 279                 of fuss.</P
 280 ><P
 281 >A similar process occurs if the requested section
 282                 name is "homes", except that the share name is not
 283                 changed to that of the requesting user. This method of using
 284                 the [homes] section works well if different users share
 285                 a client PC.</P
 286 ><P
 287 >The [homes] section can specify all the parameters
 288                 a normal service section can specify, though some make more sense
 289                 than others. The following is a typical and suitable [homes]
 290                 section:</P
 291 ><PRE
 292 CLASS="SCREEN"
 293 >               <TT
 294 CLASS="COMPUTEROUTPUT"
 295 >               [homes]
 296                         writeable = yes
 297                 </TT
 298 >
 299                 </PRE
 300 ><P
 301 >An important point is that if guest access is specified
 302                 in the [homes] section, all home directories will be
 303                 visible to all clients <I
 304 CLASS="EMPHASIS"
 305 >without a password</I
 306 >.
 307                 In the very unlikely event that this is actually desirable, it
 308                 would be wise to also specify <I
 309 CLASS="EMPHASIS"
 310 >read only
 311                 access</I
 312 >.</P
 313 ><P
 314 >Note that the <I
 315 CLASS="EMPHASIS"
 316 >browseable</I
 317 > flag for
 318                 auto home directories will be inherited from the global browseable
 319                 flag, not the [homes] browseable flag. This is useful as
 320                 it means setting browseable=no in the [homes] section
 321                 will hide the [homes] share but make any auto home
 322                 directories visible.</P
 323 ></DIV
 324 ><DIV
 325 CLASS="REFSECT2"
 326 ><A
 327 NAME="AEN78"
 328 ></A
 329 ><H3
 330 >The [printers] section</H3
 331 ><P
 332 >This section works like [homes],
 333                 but for printers.</P
 334 ><P
 335 >If a [printers] section occurs in the
 336                 configuration file, users are able to connect to any printer
 337                 specified in the local host's printcap file.</P
 338 ><P
 339 >When a connection request is made, the existing sections
 340                 are scanned. If a match is found, it is used. If no match is found,
 341                 but a [homes] section exists, it is used as described
 342                 above. Otherwise, the requested section name is treated as a
 343                 printer name and the appropriate printcap file is scanned to see
 344                 if the requested section name is a valid printer share name. If
 345                 a match is found, a new printer share is created by cloning
 346                 the [printers] section.</P
 347 ><P
 348 >A few modifications are then made to the newly created
 349                 share:</P
 350 ><P
 351 ></P
 352 ><UL
 353 ><LI
 354 ><P
 355 >The share name is set to the located printer
 356                 name</P
 357 ></LI
 358 ><LI
 359 ><P
 360 >If no printer name was given, the printer name
 361                 is set to the located printer name</P
 362 ></LI
 363 ><LI
 364 ><P
 365 >If the share does not permit guest access and
 366                 no username was given, the username is set to the located
 367                 printer name.</P
 368 ></LI
 369 ></UL
 370 ><P
 371 >Note that the [printers] service MUST be
 372                 printable - if you specify otherwise, the server will refuse
 373                 to load the configuration file.</P
 374 ><P
 375 >Typically the path specified would be that of a
 376                 world-writeable spool directory with the sticky bit set on
 377                 it. A typical [printers] entry would look like
 378                 this:</P
 379 ><PRE
 380 CLASS="SCREEN"
 381 ><TT
 382 CLASS="COMPUTEROUTPUT"
 383 >               [printers]
 384                         path = /usr/spool/public
 385                         guest ok = yes
 386                         printable = yes
 387                 </TT
 388 ></PRE
 389 ><P
 390 >All aliases given for a printer in the printcap file
 391                 are legitimate printer names as far as the server is concerned.
 392                 If your printing subsystem doesn't work like that, you will have
 393                 to set up a pseudo-printcap. This is a file consisting of one or
 394                 more lines like this:</P
 395 ><PRE
 396 CLASS="SCREEN"
 397 >               <TT
 398 CLASS="COMPUTEROUTPUT"
 399 >               alias|alias|alias|alias...
 400                 </TT
 401 >
 402                 </PRE
 403 ><P
 404 >Each alias should be an acceptable printer name for
 405                 your printing subsystem. In the [global] section, specify
 406                 the new file as your printcap.  The server will then only recognize
 407                 names found in your pseudo-printcap, which of course can contain
 408                 whatever aliases you like. The same technique could be used
 409                 simply to limit access to a subset of your local printers.</P
 410 ><P
 411 >An alias, by the way, is defined as any component of the
 412                 first entry of a printcap record. Records are separated by newlines,
 413                 components (if there are more than one) are separated by vertical
 414                 bar symbols ('|').</P
 415 ><P
 416 >NOTE: On SYSV systems which use lpstat to determine what
 417                 printers are defined on the system you may be able to use
 418                 "printcap name = lpstat" to automatically obtain a list
 419                 of printers. See the "printcap name" option
 420                 for more details.</P
 421 ></DIV
 422 ></DIV
 423 ><DIV
 424 CLASS="REFSECT1"
 425 ><A
 426 NAME="AEN101"
 427 ></A
 428 ><H2
 429 >PARAMETERS</H2
 430 ><P
 431 >parameters define the specific attributes of sections.</P
 432 ><P
 433 >Some parameters are specific to the [global] section
 434         (e.g., <I
 435 CLASS="EMPHASIS"
 436 >security</I
 437 >).  Some parameters are usable
 438         in all sections (e.g., <I
 439 CLASS="EMPHASIS"
 440 >create mode</I
 441 >). All others
 442         are permissible only in normal sections. For the purposes of the
 443         following descriptions the [homes] and [printers]
 444         sections will be considered normal.  The letter <I
 445 CLASS="EMPHASIS"
 446 >G</I
 447 >
 448         in parentheses indicates that a parameter is specific to the
 449         [global] section. The letter <I
 450 CLASS="EMPHASIS"
 451 >S</I
 452 >
 453         indicates that a parameter can be specified in a service specific
 454         section. Note that all <I
 455 CLASS="EMPHASIS"
 456 >S</I
 457 > parameters can also be specified in
 458         the [global] section - in which case they will define
 459         the default behavior for all services.</P
 460 ><P
 461 >parameters are arranged here in alphabetical order - this may
 462         not create best bedfellows, but at least you can find them! Where
 463         there are synonyms, the preferred synonym is described, others refer
 464         to the preferred synonym.</P
 465 ></DIV
 466 ><DIV
 467 CLASS="REFSECT1"
 468 ><A
 469 NAME="AEN111"
 470 ></A
 471 ><H2
 472 >VARIABLE SUBSTITUTIONS</H2
 473 ><P
 474 >Many of the strings that are settable in the config file
 475         can take substitutions. For example the option "path =
 476         /tmp/%u" would be interpreted as "path =
 477         /tmp/john" if the user connected with the username john.</P
 478 ><P
 479 >These substitutions are mostly noted in the descriptions below,
 480         but there are some general substitutions which apply whenever they
 481         might be relevant. These are:</P
 482 ><P
 483 ></P
 484 ><DIV
 485 CLASS="VARIABLELIST"
 486 ><DL
 487 ><DT
 488 >%S</DT
 489 ><DD
 490 ><P
 491 >the name of the current service, if any.</P
 492 ></DD
 493 ><DT
 494 >%P</DT
 495 ><DD
 496 ><P
 497 >the root directory of the current service,
 498                 if any.</P
 499 ></DD
 500 ><DT
 501 >%u</DT
 502 ><DD
 503 ><P
 504 >user name of the current service, if any.</P
 505 ></DD
 506 ><DT
 507 >%g</DT
 508 ><DD
 509 ><P
 510 >primary group name of %u.</P
 511 ></DD
 512 ><DT
 513 >%U</DT
 514 ><DD
 515 ><P
 516 >session user name (the user name that the client
 517                 wanted, not necessarily the same as the one they got).</P
 518 ></DD
 519 ><DT
 520 >%G</DT
 521 ><DD
 522 ><P
 523 >primary group name of %U.</P
 524 ></DD
 525 ><DT
 526 >%H</DT
 527 ><DD
 528 ><P
 529 >the home directory of the user given
 530                 by %u.</P
 531 ></DD
 532 ><DT
 533 >%v</DT
 534 ><DD
 535 ><P
 536 >the Samba version.</P
 537 ></DD
 538 ><DT
 539 >%h</DT
 540 ><DD
 541 ><P
 542 >the Internet hostname that Samba is running
 543                 on.</P
 544 ></DD
 545 ><DT
 546 >%m</DT
 547 ><DD
 548 ><P
 549 >the NetBIOS name of the client machine
 550                 (very useful).</P
 551 ></DD
 552 ><DT
 553 >%L</DT
 554 ><DD
 555 ><P
 556 >the NetBIOS name of the server. This allows you
 557                 to change your config based on what the client calls you. Your
 558                 server can have a "dual personality".</P
 559 ></DD
 560 ><DT
 561 >%M</DT
 562 ><DD
 563 ><P
 564 >the Internet name of the client machine.
 565                 </P
 566 ></DD
 567 ><DT
 568 >%N</DT
 569 ><DD
 570 ><P
 571 >the name of your NIS home directory server.
 572                 This is obtained from your NIS auto.map entry.  If you have
 573                 not compiled Samba with the <I
 574 CLASS="EMPHASIS"
 575 >--with-automount</I
 576 >
 577                 option then this value will be the same as %.</P
 578 ></DD
 579 ><DT
 580 >%p</DT
 581 ><DD
 582 ><P
 583 >the path of the service's home directory,
 584                 obtained from your NIS auto.map entry. The NIS auto.map entry
 585                 is split up as "%N:%p".</P
 586 ></DD
 587 ><DT
 588 >%R</DT
 589 ><DD
 590 ><P
 591 >the selected protocol level after
 592                 protocol negotiation. It can be one of CORE, COREPLUS,
 593                 LANMAN1, LANMAN2 or NT1.</P
 594 ></DD
 595 ><DT
 596 >%d</DT
 597 ><DD
 598 ><P
 599 >The process id of the current server
 600                 process.</P
 601 ></DD
 602 ><DT
 603 >%a</DT
 604 ><DD
 605 ><P
 606 >the architecture of the remote
 607                 machine. Only some are recognized, and those may not be
 608                 100% reliable. It currently recognizes Samba, WfWg,
 609                 WinNT and Win95. Anything else will be known as
 610                 "UNKNOWN". If it gets it wrong then sending a level
 611                 3 log to <A
 612 HREF="mailto:samba@samba.org"
 613 TARGET="_top"
 614 >samba@samba.org
 615                 </A
 616 > should allow it to be fixed.</P
 617 ></DD
 618 ><DT
 619 >%I</DT
 620 ><DD
 621 ><P
 622 >The IP address of the client machine.</P
 623 ></DD
 624 ><DT
 625 >%T</DT
 626 ><DD
 627 ><P
 628 >the current date and time.</P
 629 ></DD
 630 ><DT
 631 >%$(<TT
 632 CLASS="REPLACEABLE"
 633 ><I
 634 >envvar</I
 635 ></TT
 636 >)</DT
 637 ><DD
 638 ><P
 639 >The value of the environment variable
 640                 <TT
 641 CLASS="REPLACEABLE"
 642 ><I
 643 >envar</I
 644 ></TT
 645 >.</P
 646 ></DD
 647 ></DL
 648 ></DIV
 649 ><P
 650 >There are some quite creative things that can be done
 651         with these substitutions and other smb.conf options.</P
 652 ></DIV
 653 ><DIV
 654 CLASS="REFSECT1"
 655 ><A
 656 NAME="AEN201"
 657 ></A
 658 ><H2
 659 >NAME MANGLING</H2
 660 ><P
 661 >Samba supports "name mangling" so that DOS and
 662         Windows clients can use files that don't conform to the 8.3 format.
 663         It can also be set to adjust the case of 8.3 format filenames.</P
 664 ><P
 665 >There are several options that control the way mangling is
 666         performed, and they are grouped here rather than listed separately.
 667         For the defaults look at the output of the testparm program. </P
 668 ><P
 669 >All of these options can be set separately for each service
 670         (or globally, of course). </P
 671 ><P
 672 >The options are: </P
 673 ><P
 674 ></P
 675 ><DIV
 676 CLASS="VARIABLELIST"
 677 ><DL
 678 ><DT
 679 >mangle case= yes/no</DT
 680 ><DD
 681 ><P
 682 > controls if names that have characters that
 683                 aren't of the "default" case are mangled. For example,
 684                 if this is yes then a name like "Mail" would be mangled.
 685                 Default <I
 686 CLASS="EMPHASIS"
 687 >no</I
 688 >.</P
 689 ></DD
 690 ><DT
 691 >case sensitive = yes/no</DT
 692 ><DD
 693 ><P
 694 >controls whether filenames are case sensitive. If
 695                 they aren't then Samba must do a filename search and match on passed
 696                 names. Default <I
 697 CLASS="EMPHASIS"
 698 >no</I
 699 >.</P
 700 ></DD
 701 ><DT
 702 >default case = upper/lower</DT
 703 ><DD
 704 ><P
 705 >controls what the default case is for new
 706                 filenames. Default <I
 707 CLASS="EMPHASIS"
 708 >lower</I
 709 >.</P
 710 ></DD
 711 ><DT
 712 >preserve case = yes/no</DT
 713 ><DD
 714 ><P
 715 >controls if new files are created with the
 716                 case that the client passes, or if they are forced to be the
 717                 "default" case. Default <I
 718 CLASS="EMPHASIS"
 719 >yes</I
 720 >.
 721                 </P
 722 ></DD
 723 ><DT
 724 >short preserve case = yes/no</DT
 725 ><DD
 726 ><P
 727 >controls if new files which conform to 8.3 syntax,
 728                 that is all in upper case and of suitable length, are created
 729                 upper case, or if they are forced to be the "default"
 730                 case. This option can be use with "preserve case = yes"
 731                 to permit long filenames to retain their case, while short names
 732                 are lowered. Default <I
 733 CLASS="EMPHASIS"
 734 >yes</I
 735 >.</P
 736 ></DD
 737 ></DL
 738 ></DIV
 739 ><P
 740 >By default, Samba 2.2 has the same semantics as a Windows
 741         NT server, in that it is case insensitive but case preserving.</P
 742 ></DIV
 743 ><DIV
 744 CLASS="REFSECT1"
 745 ><A
 746 NAME="AEN234"
 747 ></A
 748 ><H2
 749 >NOTE ABOUT USERNAME/PASSWORD VALIDATION</H2
 750 ><P
 751 >There are a number of ways in which a user can connect
 752         to a service. The server uses the following steps in determining
 753         if it will allow a connection to a specified service. If all the
 754         steps fail, then the connection request is rejected.  However, if one of the
 755         steps succeeds, then the following steps are not checked.</P
 756 ><P
 757 >If the service is marked "guest only = yes" then
 758         steps 1 to 5 are skipped.</P
 759 ><P
 760 ></P
 761 ><OL
 762 TYPE="1"
 763 ><LI
 764 ><P
 765 >If the client has passed a username/password
 766                 pair and that username/password pair is validated by the UNIX
 767                 system's password programs then the connection is made as that
 768                 username. Note that this includes the
 769                 \\server\service%<TT
 770 CLASS="REPLACEABLE"
 771 ><I
 772 >username</I
 773 ></TT
 774 > method of passing
 775                 a username.</P
 776 ></LI
 777 ><LI
 778 ><P
 779 >If the client has previously registered a username
 780                 with the system and now supplies a correct password for that
 781                 username then the connection is allowed.</P
 782 ></LI
 783 ><LI
 784 ><P
 785 >The client's netbios name and any previously
 786                 used user names are checked against the supplied password, if
 787                 they match then the connection is allowed as the corresponding
 788                 user.</P
 789 ></LI
 790 ><LI
 791 ><P
 792 >If the client has previously validated a
 793                 username/password pair with the server and the client has passed
 794                 the validation token then that username is used. </P
 795 ></LI
 796 ><LI
 797 ><P
 798 >If a "user = " field is given in the
 799                 <TT
 800 CLASS="FILENAME"
 801 >smb.conf</TT
 802 > file for the service and the client
 803                 has supplied a password, and that password matches (according to
 804                 the UNIX system's password checking) with one of the usernames
 805                 from the "user=" field then the connection is made as
 806                 the username in the "user=" line. If one
 807                 of the username in the "user=" list begins with a
 808                 '@' then that name expands to a list of names in
 809                 the group of the same name.</P
 810 ></LI
 811 ><LI
 812 ><P
 813 >If the service is a guest service then a
 814                 connection is made as the username given in the "guest
 815                 account =" for the service, irrespective of the
 816                 supplied password.</P
 817 ></LI
 818 ></OL
 819 ></DIV
 820 ><DIV
 821 CLASS="REFSECT1"
 822 ><A
 823 NAME="AEN253"
 824 ></A
 825 ><H2
 826 >COMPLETE LIST OF GLOBAL PARAMETERS</H2
 827 ><P
 828 >Here is a list of all global parameters. See the section of
 829         each parameter for details.  Note that some are synonyms.</P
 830 ><P
 831 ></P
 832 ><UL
 833 ><LI
 834 ><P
 835 ><A
 836 HREF="#ADDUSERSCRIPT"
 837 ><TT
 838 CLASS="PARAMETER"
 839 ><I
 840 >add user script</I
 841 ></TT
 842 ></A
 843 ></P
 844 ></LI
 845 ><LI
 846 ><P
 847 ><A
 848 HREF="#ADDPRINTERCOMMAND"
 849 ><TT
 850 CLASS="PARAMETER"
 851 ><I
 852 >addprinter command</I
 853 ></TT
 854 ></A
 855 ></P
 856 ></LI
 857 ><LI
 858 ><P
 859 ><A
 860 HREF="#ALLOWTRUSTEDDOMAINS"
 861 ><TT
 862 CLASS="PARAMETER"
 863 ><I
 864 >allow trusted domains</I
 865 ></TT
 866 ></A
 867 ></P
 868 ></LI
 869 ><LI
 870 ><P
 871 ><A
 872 HREF="#ANNOUNCEAS"
 873 ><TT
 874 CLASS="PARAMETER"
 875 ><I
 876 >announce as</I
 877 ></TT
 878 ></A
 879 ></P
 880 ></LI
 881 ><LI
 882 ><P
 883 ><A
 884 HREF="#ANNOUNCEVERSION"
 885 ><TT
 886 CLASS="PARAMETER"
 887 ><I
 888 >announce version</I
 889 ></TT
 890 ></A
 891 ></P
 892 ></LI
 893 ><LI
 894 ><P
 895 ><A
 896 HREF="#AUTOSERVICES"
 897 ><TT
 898 CLASS="PARAMETER"
 899 ><I
 900 >auto services</I
 901 ></TT
 902 ></A
 903 ></P
 904 ></LI
 905 ><LI
 906 ><P
 907 ><A
 908 HREF="#BINDINTERFACESONLY"
 909 ><TT
 910 CLASS="PARAMETER"
 911 ><I
 912 >bind interfaces only</I
 913 ></TT
 914 ></A
 915 ></P
 916 ></LI
 917 ><LI
 918 ><P
 919 ><A
 920 HREF="#BROWSELIST"
 921 ><TT
 922 CLASS="PARAMETER"
 923 ><I
 924 >browse list</I
 925 ></TT
 926 ></A
 927 ></P
 928 ></LI
 929 ><LI
 930 ><P
 931 ><A
 932 HREF="#CHANGENOTIFYTIMEOUT"
 933 ><TT
 934 CLASS="PARAMETER"
 935 ><I
 936 >change notify timeout</I
 937 ></TT
 938 ></A
 939 ></P
 940 ></LI
 941 ><LI
 942 ><P
 943 ><A
 944 HREF="#CHARACTERSET"
 945 ><TT
 946 CLASS="PARAMETER"
 947 ><I
 948 >character set</I
 949 ></TT
 950 ></A
 951 ></P
 952 ></LI
 953 ><LI
 954 ><P
 955 ><A
 956 HREF="#CLIENTCODEPAGE"
 957 ><TT
 958 CLASS="PARAMETER"
 959 ><I
 960 >client code page</I
 961 ></TT
 962 ></A
 963 ></P
 964 ></LI
 965 ><LI
 966 ><P
 967 ><A
 968 HREF="#CODEPAGEDIRECTORY"
 969 ><TT
 970 CLASS="PARAMETER"
 971 ><I
 972 >code page directory</I
 973 ></TT
 974 ></A
 975 ></P
 976 ></LI
 977 ><LI
 978 ><P
 979 ><A
 980 HREF="#CODINGSYSTEM"
 981 ><TT
 982 CLASS="PARAMETER"
 983 ><I
 984 >coding system</I
 985 ></TT
 986 ></A
 987 ></P
 988 ></LI
 989 ><LI
 990 ><P
 991 ><A
 992 HREF="#CONFIGFILE"
 993 ><TT
 994 CLASS="PARAMETER"
 995 ><I
 996 >config file</I
 997 ></TT
 998 ></A
 999 ></P
1000 ></LI
1001 ><LI
1002 ><P
1003 ><A
1004 HREF="#DEADTIME"
1005 ><TT
1006 CLASS="PARAMETER"
1007 ><I
1008 >deadtime</I
1009 ></TT
1010 ></A
1011 ></P
1012 ></LI
1013 ><LI
1014 ><P
1015 ><A
1016 HREF="#DEBUGHIRESTIMESTAMP"
1017 ><TT
1018 CLASS="PARAMETER"
1019 ><I
1020 >debug hires timestamp</I
1021 ></TT
1022 ></A
1023 ></P
1024 ></LI
1025 ><LI
1026 ><P
1027 ><A
1028 HREF="#DEBUGPID"
1029 ><TT
1030 CLASS="PARAMETER"
1031 ><I
1032 >debug pid</I
1033 ></TT
1034 ></A
1035 ></P
1036 ></LI
1037 ><LI
1038 ><P
1039 ><A
1040 HREF="#DEBUGTIMESTAMP"
1041 ><TT
1042 CLASS="PARAMETER"
1043 ><I
1044 >debug timestamp</I
1045 ></TT
1046 ></A
1047 ></P
1048 ></LI
1049 ><LI
1050 ><P
1051 ><A
1052 HREF="#DEBUGUID"
1053 ><TT
1054 CLASS="PARAMETER"
1055 ><I
1056 >debug uid</I
1057 ></TT
1058 ></A
1059 ></P
1060 ></LI
1061 ><LI
1062 ><P
1063 ><A
1064 HREF="#DEBUGLEVEL"
1065 ><TT
1066 CLASS="PARAMETER"
1067 ><I
1068 >debuglevel</I
1069 ></TT
1070 ></A
1071 ></P
1072 ></LI
1073 ><LI
1074 ><P
1075 ><A
1076 HREF="#DEFAULT"
1077 ><TT
1078 CLASS="PARAMETER"
1079 ><I
1080 >default</I
1081 ></TT
1082 ></A
1083 ></P
1084 ></LI
1085 ><LI
1086 ><P
1087 ><A
1088 HREF="#DEFAULTSERVICE"
1089 ><TT
1090 CLASS="PARAMETER"
1091 ><I
1092 >default service</I
1093 ></TT
1094 ></A
1095 ></P
1096 ></LI
1097 ><LI
1098 ><P
1099 ><A
1100 HREF="#DELETEUSERSCRIPT"
1101 ><TT
1102 CLASS="PARAMETER"
1103 ><I
1104 >delete user script</I
1105 ></TT
1106 ></A
1107 ></P
1108 ></LI
1109 ><LI
1110 ><P
1111 ><A
1112 HREF="#DELETEPRINTERCOMMAND"
1113 ><TT
1114 CLASS="PARAMETER"
1115 ><I
1116 >deleteprinter command</I
1117 ></TT
1118 ></A
1119 ></P
1120 ></LI
1121 ><LI
1122 ><P
1123 ><A
1124 HREF="#DFREECOMMAND"
1125 ><TT
1126 CLASS="PARAMETER"
1127 ><I
1128 >dfree command</I
1129 ></TT
1130 ></A
1131 ></P
1132 ></LI
1133 ><LI
1134 ><P
1135 ><A
1136 HREF="#DNSPROXY"
1137 ><TT
1138 CLASS="PARAMETER"
1139 ><I
1140 >dns proxy</I
1141 ></TT
1142 ></A
1143 ></P
1144 ></LI
1145 ><LI
1146 ><P
1147 ><A
1148 HREF="#DOMAINADMINGROUP"
1149 ><TT
1150 CLASS="PARAMETER"
1151 ><I
1152 >domain admin group</I
1153 ></TT
1154 ></A
1155 ></P
1156 ></LI
1157 ><LI
1158 ><P
1159 ><A
1160 HREF="#DOMAINADMINUSERS"
1161 ><TT
1162 CLASS="PARAMETER"
1163 ><I
1164 >domain admin users</I
1165 ></TT
1166 ></A
1167 ></P
1168 ></LI
1169 ><LI
1170 ><P
1171 ><A
1172 HREF="#DOMAINGROUPS"
1173 ><TT
1174 CLASS="PARAMETER"
1175 ><I
1176 >domain groups</I
1177 ></TT
1178 ></A
1179 ></P
1180 ></LI
1181 ><LI
1182 ><P
1183 ><A
1184 HREF="#DOMAINGUESTGROUP"
1185 ><TT
1186 CLASS="PARAMETER"
1187 ><I
1188 >domain guest group</I
1189 ></TT
1190 ></A
1191 ></P
1192 ></LI
1193 ><LI
1194 ><P
1195 ><A
1196 HREF="#DOMAINGUESTUSERS"
1197 ><TT
1198 CLASS="PARAMETER"
1199 ><I
1200 >domain guest users</I
1201 ></TT
1202 ></A
1203 ></P
1204 ></LI
1205 ><LI
1206 ><P
1207 ><A
1208 HREF="#DOMAINLOGONS"
1209 ><TT
1210 CLASS="PARAMETER"
1211 ><I
1212 >domain logons</I
1213 ></TT
1214 ></A
1215 ></P
1216 ></LI
1217 ><LI
1218 ><P
1219 ><A
1220 HREF="#DOMAINMASTER"
1221 ><TT
1222 CLASS="PARAMETER"
1223 ><I
1224 >domain master</I
1225 ></TT
1226 ></A
1227 ></P
1228 ></LI
1229 ><LI
1230 ><P
1231 ><A
1232 HREF="#ENCRYPTPASSWORDS"
1233 ><TT
1234 CLASS="PARAMETER"
1235 ><I
1236 >encrypt passwords</I
1237 ></TT
1238 ></A
1239 ></P
1240 ></LI
1241 ><LI
1242 ><P
1243 ><A
1244 HREF="#ENHANCEDBROWSING"
1245 ><TT
1246 CLASS="PARAMETER"
1247 ><I
1248 >enhanced browsing</I
1249 ></TT
1250 ></A
1251 ></P
1252 ></LI
1253 ><LI
1254 ><P
1255 ><A
1256 HREF="#ENUMPORTSCOMMAND"
1257 ><TT
1258 CLASS="PARAMETER"
1259 ><I
1260 >enumports command</I
1261 ></TT
1262 ></A
1263 ></P
1264 ></LI
1265 ><LI
1266 ><P
1267 ><A
1268 HREF="#GETWDCACHE"
1269 ><TT
1270 CLASS="PARAMETER"
1271 ><I
1272 >getwd cache</I
1273 ></TT
1274 ></A
1275 ></P
1276 ></LI
1277 ><LI
1278 ><P
1279 ><A
1280 HREF="#HIDELOCALUSERS"
1281 ><TT
1282 CLASS="PARAMETER"
1283 ><I
1284 >hide local users</I
1285 ></TT
1286 ></A
1287 ></P
1288 ></LI
1289 ><LI
1290 ><P
1291 ><A
1292 HREF="#HOMEDIRMAP"
1293 ><TT
1294 CLASS="PARAMETER"
1295 ><I
1296 >homedir map</I
1297 ></TT
1298 ></A
1299 ></P
1300 ></LI
1301 ><LI
1302 ><P
1303 ><A
1304 HREF="#HOSTMSDFS"
1305 ><TT
1306 CLASS="PARAMETER"
1307 ><I
1308 >host msdfs</I
1309 ></TT
1310 ></A
1311 ></P
1312 ></LI
1313 ><LI
1314 ><P
1315 ><A
1316 HREF="#HOSTSEQUIV"
1317 ><TT
1318 CLASS="PARAMETER"
1319 ><I
1320 >hosts equiv</I
1321 ></TT
1322 ></A
1323 ></P
1324 ></LI
1325 ><LI
1326 ><P
1327 ><A
1328 HREF="#INTERFACES"
1329 ><TT
1330 CLASS="PARAMETER"
1331 ><I
1332 >interfaces</I
1333 ></TT
1334 ></A
1335 ></P
1336 ></LI
1337 ><LI
1338 ><P
1339 ><A
1340 HREF="#KEEPALIVE"
1341 ><TT
1342 CLASS="PARAMETER"
1343 ><I
1344 >keepalive</I
1345 ></TT
1346 ></A
1347 ></P
1348 ></LI
1349 ><LI
1350 ><P
1351 ><A
1352 HREF="#KERNELOPLOCKS"
1353 ><TT
1354 CLASS="PARAMETER"
1355 ><I
1356 >kernel oplocks</I
1357 ></TT
1358 ></A
1359 ></P
1360 ></LI
1361 ><LI
1362 ><P
1363 ><A
1364 HREF="#LANMANAUTH"
1365 ><TT
1366 CLASS="PARAMETER"
1367 ><I
1368 >lanman auth</I
1369 ></TT
1370 ></A
1371 ></P
1372 ></LI
1373 ><LI
1374 ><P
1375 ><A
1376 HREF="#LMANNOUNCE"
1377 ><TT
1378 CLASS="PARAMETER"
1379 ><I
1380 >lm announce</I
1381 ></TT
1382 ></A
1383 ></P
1384 ></LI
1385 ><LI
1386 ><P
1387 ><A
1388 HREF="#LMINTERVAL"
1389 ><TT
1390 CLASS="PARAMETER"
1391 ><I
1392 >lm interval</I
1393 ></TT
1394 ></A
1395 ></P
1396 ></LI
1397 ><LI
1398 ><P
1399 ><A
1400 HREF="#LOADPRINTERS"
1401 ><TT
1402 CLASS="PARAMETER"
1403 ><I
1404 >load printers</I
1405 ></TT
1406 ></A
1407 ></P
1408 ></LI
1409 ><LI
1410 ><P
1411 ><A
1412 HREF="#LOCALMASTER"
1413 ><TT
1414 CLASS="PARAMETER"
1415 ><I
1416 >local master</I
1417 ></TT
1418 ></A
1419 ></P
1420 ></LI
1421 ><LI
1422 ><P
1423 ><A
1424 HREF="#LOCKDIR"
1425 ><TT
1426 CLASS="PARAMETER"
1427 ><I
1428 >lock dir</I
1429 ></TT
1430 ></A
1431 ></P
1432 ></LI
1433 ><LI
1434 ><P
1435 ><A
1436 HREF="#LOCKDIRECTORY"
1437 ><TT
1438 CLASS="PARAMETER"
1439 ><I
1440 >lock directory</I
1441 ></TT
1442 ></A
1443 ></P
1444 ></LI
1445 ><LI
1446 ><P
1447 ><A
1448 HREF="#LOGFILE"
1449 ><TT
1450 CLASS="PARAMETER"
1451 ><I
1452 >log file</I
1453 ></TT
1454 ></A
1455 ></P
1456 ></LI
1457 ><LI
1458 ><P
1459 ><A
1460 HREF="#LOGLEVEL"
1461 ><TT
1462 CLASS="PARAMETER"
1463 ><I
1464 >log level</I
1465 ></TT
1466 ></A
1467 ></P
1468 ></LI
1469 ><LI
1470 ><P
1471 ><A
1472 HREF="#LOGONDRIVE"
1473 ><TT
1474 CLASS="PARAMETER"
1475 ><I
1476 >logon drive</I
1477 ></TT
1478 ></A
1479 ></P
1480 ></LI
1481 ><LI
1482 ><P
1483 ><A
1484 HREF="#LOGONHOME"
1485 ><TT
1486 CLASS="PARAMETER"
1487 ><I
1488 >logon home</I
1489 ></TT
1490 ></A
1491 ></P
1492 ></LI
1493 ><LI
1494 ><P
1495 ><A
1496 HREF="#LOGONPATH"
1497 ><TT
1498 CLASS="PARAMETER"
1499 ><I
1500 >logon path</I
1501 ></TT
1502 ></A
1503 ></P
1504 ></LI
1505 ><LI
1506 ><P
1507 ><A
1508 HREF="#LOGONSCRIPT"
1509 ><TT
1510 CLASS="PARAMETER"
1511 ><I
1512 >logon script</I
1513 ></TT
1514 ></A
1515 ></P
1516 ></LI
1517 ><LI
1518 ><P
1519 ><A
1520 HREF="#LPQCACHETIME"
1521 ><TT
1522 CLASS="PARAMETER"
1523 ><I
1524 >lpq cache time</I
1525 ></TT
1526 ></A
1527 ></P
1528 ></LI
1529 ><LI
1530 ><P
1531 ><A
1532 HREF="#MACHINEPASSWORDTIMEOUT"
1533 ><TT
1534 CLASS="PARAMETER"
1535 ><I
1536 >machine password timeout</I
1537 ></TT
1538 ></A
1539 ></P
1540 ></LI
1541 ><LI
1542 ><P
1543 ><A
1544 HREF="#MANGLEDSTACK"
1545 ><TT
1546 CLASS="PARAMETER"
1547 ><I
1548 >mangled stack</I
1549 ></TT
1550 ></A
1551 ></P
1552 ></LI
1553 ><LI
1554 ><P
1555 ><A
1556 HREF="#MAPTOGUEST"
1557 ><TT
1558 CLASS="PARAMETER"
1559 ><I
1560 >map to guest</I
1561 ></TT
1562 ></A
1563 ></P
1564 ></LI
1565 ><LI
1566 ><P
1567 ><A
1568 HREF="#MAXDISKSIZE"
1569 ><TT
1570 CLASS="PARAMETER"
1571 ><I
1572 >max disk size</I
1573 ></TT
1574 ></A
1575 ></P
1576 ></LI
1577 ><LI
1578 ><P
1579 ><A
1580 HREF="#MAXLOGSIZE"
1581 ><TT
1582 CLASS="PARAMETER"
1583 ><I
1584 >max log size</I
1585 ></TT
1586 ></A
1587 ></P
1588 ></LI
1589 ><LI
1590 ><P
1591 ><A
1592 HREF="#MAXMUX"
1593 ><TT
1594 CLASS="PARAMETER"
1595 ><I
1596 >max mux</I
1597 ></TT
1598 ></A
1599 ></P
1600 ></LI
1601 ><LI
1602 ><P
1603 ><A
1604 HREF="#MAXOPENFILES"
1605 ><TT
1606 CLASS="PARAMETER"
1607 ><I
1608 >max open files</I
1609 ></TT
1610 ></A
1611 ></P
1612 ></LI
1613 ><LI
1614 ><P
1615 ><A
1616 HREF="#MAXPROTOCOL"
1617 ><TT
1618 CLASS="PARAMETER"
1619 ><I
1620 >max protocol</I
1621 ></TT
1622 ></A
1623 ></P
1624 ></LI
1625 ><LI
1626 ><P
1627 ><A
1628 HREF="#MAXSMBDPROCESSES"
1629 ><TT
1630 CLASS="PARAMETER"
1631 ><I
1632 >max smbd processes</I
1633 ></TT
1634 ></A
1635 ></P
1636 ></LI
1637 ><LI
1638 ><P
1639 ><A
1640 HREF="#MAXTTL"
1641 ><TT
1642 CLASS="PARAMETER"
1643 ><I
1644 >max ttl</I
1645 ></TT
1646 ></A
1647 ></P
1648 ></LI
1649 ><LI
1650 ><P
1651 ><A
1652 HREF="#MAXWINSTTL"
1653 ><TT
1654 CLASS="PARAMETER"
1655 ><I
1656 >max wins ttl</I
1657 ></TT
1658 ></A
1659 ></P
1660 ></LI
1661 ><LI
1662 ><P
1663 ><A
1664 HREF="#MAXXMIT"
1665 ><TT
1666 CLASS="PARAMETER"
1667 ><I
1668 >max xmit</I
1669 ></TT
1670 ></A
1671 ></P
1672 ></LI
1673 ><LI
1674 ><P
1675 ><A
1676 HREF="#MESSAGECOMMAND"
1677 ><TT
1678 CLASS="PARAMETER"
1679 ><I
1680 >message command</I
1681 ></TT
1682 ></A
1683 ></P
1684 ></LI
1685 ><LI
1686 ><P
1687 ><A
1688 HREF="#MINPASSWDLENGTH"
1689 ><TT
1690 CLASS="PARAMETER"
1691 ><I
1692 >min passwd length</I
1693 ></TT
1694 ></A
1695 ></P
1696 ></LI
1697 ><LI
1698 ><P
1699 ><A
1700 HREF="#MINPASSWORDLENGTH"
1701 ><TT
1702 CLASS="PARAMETER"
1703 ><I
1704 >min password length</I
1705 ></TT
1706 ></A
1707 ></P
1708 ></LI
1709 ><LI
1710 ><P
1711 ><A
1712 HREF="#MINPROTOCOL"
1713 ><TT
1714 CLASS="PARAMETER"
1715 ><I
1716 >min protocol</I
1717 ></TT
1718 ></A
1719 ></P
1720 ></LI
1721 ><LI
1722 ><P
1723 ><A
1724 HREF="#MINWINSTTL"
1725 ><TT
1726 CLASS="PARAMETER"
1727 ><I
1728 >min wins ttl</I
1729 ></TT
1730 ></A
1731 ></P
1732 ></LI
1733 ><LI
1734 ><P
1735 ><A
1736 HREF="#NAMERESOLVEORDER"
1737 ><TT
1738 CLASS="PARAMETER"
1739 ><I
1740 >name resolve order</I
1741 ></TT
1742 ></A
1743 ></P
1744 ></LI
1745 ><LI
1746 ><P
1747 ><A
1748 HREF="#NETBIOSALIASES"
1749 ><TT
1750 CLASS="PARAMETER"
1751 ><I
1752 >netbios aliases</I
1753 ></TT
1754 ></A
1755 ></P
1756 ></LI
1757 ><LI
1758 ><P
1759 ><A
1760 HREF="#NETBIOSNAME"
1761 ><TT
1762 CLASS="PARAMETER"
1763 ><I
1764 >netbios name</I
1765 ></TT
1766 ></A
1767 ></P
1768 ></LI
1769 ><LI
1770 ><P
1771 ><A
1772 HREF="#NETBIOSSCOPE"
1773 ><TT
1774 CLASS="PARAMETER"
1775 ><I
1776 >netbios scope</I
1777 ></TT
1778 ></A
1779 ></P
1780 ></LI
1781 ><LI
1782 ><P
1783 ><A
1784 HREF="#NISHOMEDIR"
1785 ><TT
1786 CLASS="PARAMETER"
1787 ><I
1788 >nis homedir</I
1789 ></TT
1790 ></A
1791 ></P
1792 ></LI
1793 ><LI
1794 ><P
1795 ><A
1796 HREF="#NTACLSUPPORT"
1797 ><TT
1798 CLASS="PARAMETER"
1799 ><I
1800 >nt acl support</I
1801 ></TT
1802 ></A
1803 ></P
1804 ></LI
1805 ><LI
1806 ><P
1807 ><A
1808 HREF="#NTPIPESUPPORT"
1809 ><TT
1810 CLASS="PARAMETER"
1811 ><I
1812 >nt pipe support</I
1813 ></TT
1814 ></A
1815 ></P
1816 ></LI
1817 ><LI
1818 ><P
1819 ><A
1820 HREF="#NTSMBSUPPORT"
1821 ><TT
1822 CLASS="PARAMETER"
1823 ><I
1824 >nt smb support</I
1825 ></TT
1826 ></A
1827 ></P
1828 ></LI
1829 ><LI
1830 ><P
1831 ><A
1832 HREF="#NULLPASSWORDS"
1833 ><TT
1834 CLASS="PARAMETER"
1835 ><I
1836 >null passwords</I
1837 ></TT
1838 ></A
1839 ></P
1840 ></LI
1841 ><LI
1842 ><P
1843 ><A
1844 HREF="#OPLOCKBREAKWAITTIME"
1845 ><TT
1846 CLASS="PARAMETER"
1847 ><I
1848 >oplock break wait time</I
1849 ></TT
1850 ></A
1851 ></P
1852 ></LI
1853 ><LI
1854 ><P
1855 ><A
1856 HREF="#OSLEVEL"
1857 ><TT
1858 CLASS="PARAMETER"
1859 ><I
1860 >os level</I
1861 ></TT
1862 ></A
1863 ></P
1864 ></LI
1865 ><LI
1866 ><P
1867 ><A
1868 HREF="#OS2DRIVERMAP"
1869 ><TT
1870 CLASS="PARAMETER"
1871 ><I
1872 >os2 driver map</I
1873 ></TT
1874 ></A
1875 ></P
1876 ></LI
1877 ><LI
1878 ><P
1879 ><A
1880 HREF="#PANICACTION"
1881 ><TT
1882 CLASS="PARAMETER"
1883 ><I
1884 >panic action</I
1885 ></TT
1886 ></A
1887 ></P
1888 ></LI
1889 ><LI
1890 ><P
1891 ><A
1892 HREF="#PASSWDCHAT"
1893 ><TT
1894 CLASS="PARAMETER"
1895 ><I
1896 >passwd chat</I
1897 ></TT
1898 ></A
1899 ></P
1900 ></LI
1901 ><LI
1902 ><P
1903 ><A
1904 HREF="#PASSWDCHATDEBUG"
1905 ><TT
1906 CLASS="PARAMETER"
1907 ><I
1908 >passwd chat debug</I
1909 ></TT
1910 ></A
1911 ></P
1912 ></LI
1913 ><LI
1914 ><P
1915 ><A
1916 HREF="#PASSWDPROGRAM"
1917 ><TT
1918 CLASS="PARAMETER"
1919 ><I
1920 >passwd program</I
1921 ></TT
1922 ></A
1923 ></P
1924 ></LI
1925 ><LI
1926 ><P
1927 ><A
1928 HREF="#PASSWORDLEVEL"
1929 ><TT
1930 CLASS="PARAMETER"
1931 ><I
1932 >password level</I
1933 ></TT
1934 ></A
1935 ></P
1936 ></LI
1937 ><LI
1938 ><P
1939 ><A
1940 HREF="#PASSWORDSERVER"
1941 ><TT
1942 CLASS="PARAMETER"
1943 ><I
1944 >password server</I
1945 ></TT
1946 ></A
1947 ></P
1948 ></LI
1949 ><LI
1950 ><P
1951 ><A
1952 HREF="#PREFEREDMASTER"
1953 ><TT
1954 CLASS="PARAMETER"
1955 ><I
1956 >prefered master</I
1957 ></TT
1958 ></A
1959 ></P
1960 ></LI
1961 ><LI
1962 ><P
1963 ><A
1964 HREF="#PREFERREDMASTER"
1965 ><TT
1966 CLASS="PARAMETER"
1967 ><I
1968 >preferred master</I
1969 ></TT
1970 ></A
1971 ></P
1972 ></LI
1973 ><LI
1974 ><P
1975 ><A
1976 HREF="#PRELOAD"
1977 ><TT
1978 CLASS="PARAMETER"
1979 ><I
1980 >preload</I
1981 ></TT
1982 ></A
1983 ></P
1984 ></LI
1985 ><LI
1986 ><P
1987 ><A
1988 HREF="#PRINTCAP"
1989 ><TT
1990 CLASS="PARAMETER"
1991 ><I
1992 >printcap</I
1993 ></TT
1994 ></A
1995 ></P
1996 ></LI
1997 ><LI
1998 ><P
1999 ><A
2000 HREF="#PRINTCAPNAME"
2001 ><TT
2002 CLASS="PARAMETER"
2003 ><I
2004 >printcap name</I
2005 ></TT
2006 ></A
2007 ></P
2008 ></LI
2009 ><LI
2010 ><P
2011 ><A
2012 HREF="#PRINTERDRIVERFILE"
2013 ><TT
2014 CLASS="PARAMETER"
2015 ><I
2016 >printer driver file</I
2017 ></TT
2018 ></A
2019 ></P
2020 ></LI
2021 ><LI
2022 ><P
2023 ><A
2024 HREF="#PROTOCOL"
2025 ><TT
2026 CLASS="PARAMETER"
2027 ><I
2028 >protocol</I
2029 ></TT
2030 ></A
2031 ></P
2032 ></LI
2033 ><LI
2034 ><P
2035 ><A
2036 HREF="#READBMPX"
2037 ><TT
2038 CLASS="PARAMETER"
2039 ><I
2040 >read bmpx</I
2041 ></TT
2042 ></A
2043 ></P
2044 ></LI
2045 ><LI
2046 ><P
2047 ><A
2048 HREF="#READRAW"
2049 ><TT
2050 CLASS="PARAMETER"
2051 ><I
2052 >read raw</I
2053 ></TT
2054 ></A
2055 ></P
2056 ></LI
2057 ><LI
2058 ><P
2059 ><A
2060 HREF="#READSIZE"
2061 ><TT
2062 CLASS="PARAMETER"
2063 ><I
2064 >read size</I
2065 ></TT
2066 ></A
2067 ></P
2068 ></LI
2069 ><LI
2070 ><P
2071 ><A
2072 HREF="#REMOTEANNOUNCE"
2073 ><TT
2074 CLASS="PARAMETER"
2075 ><I
2076 >remote announce</I
2077 ></TT
2078 ></A
2079 ></P
2080 ></LI
2081 ><LI
2082 ><P
2083 ><A
2084 HREF="#REMOTEBROWSESYNC"
2085 ><TT
2086 CLASS="PARAMETER"
2087 ><I
2088 >remote browse sync</I
2089 ></TT
2090 ></A
2091 ></P
2092 ></LI
2093 ><LI
2094 ><P
2095 ><A
2096 HREF="#RESTRICTANONYMOUS"
2097 ><TT
2098 CLASS="PARAMETER"
2099 ><I
2100 >restrict anonymous</I
2101 ></TT
2102 ></A
2103 ></P
2104 ></LI
2105 ><LI
2106 ><P
2107 ><A
2108 HREF="#ROOT"
2109 ><TT
2110 CLASS="PARAMETER"
2111 ><I
2112 >root</I
2113 ></TT
2114 ></A
2115 ></P
2116 ></LI
2117 ><LI
2118 ><P
2119 ><A
2120 HREF="#ROOTDIR"
2121 ><TT
2122 CLASS="PARAMETER"
2123 ><I
2124 >root dir</I
2125 ></TT
2126 ></A
2127 ></P
2128 ></LI
2129 ><LI
2130 ><P
2131 ><A
2132 HREF="#ROOTDIRECTORY"
2133 ><TT
2134 CLASS="PARAMETER"
2135 ><I
2136 >root directory</I
2137 ></TT
2138 ></A
2139 ></P
2140 ></LI
2141 ><LI
2142 ><P
2143 ><A
2144 HREF="#SECURITY"
2145 ><TT
2146 CLASS="PARAMETER"
2147 ><I
2148 >security</I
2149 ></TT
2150 ></A
2151 ></P
2152 ></LI
2153 ><LI
2154 ><P
2155 ><A
2156 HREF="#SERVERSTRING"
2157 ><TT
2158 CLASS="PARAMETER"
2159 ><I
2160 >server string</I
2161 ></TT
2162 ></A
2163 ></P
2164 ></LI
2165 ><LI
2166 ><P
2167 ><A
2168 HREF="#SHOWADDPRINTERWIZARD"
2169 ><TT
2170 CLASS="PARAMETER"
2171 ><I
2172 >show add printer wizard</I
2173 ></TT
2174 ></A
2175 ></P
2176 ></LI
2177 ><LI
2178 ><P
2179 ><A
2180 HREF="#SMBPASSWDFILE"
2181 ><TT
2182 CLASS="PARAMETER"
2183 ><I
2184 >smb passwd file</I
2185 ></TT
2186 ></A
2187 ></P
2188 ></LI
2189 ><LI
2190 ><P
2191 ><A
2192 HREF="#SOCKETADDRESS"
2193 ><TT
2194 CLASS="PARAMETER"
2195 ><I
2196 >socket address</I
2197 ></TT
2198 ></A
2199 ></P
2200 ></LI
2201 ><LI
2202 ><P
2203 ><A
2204 HREF="#SOCKETOPTIONS"
2205 ><TT
2206 CLASS="PARAMETER"
2207 ><I
2208 >socket options</I
2209 ></TT
2210 ></A
2211 ></P
2212 ></LI
2213 ><LI
2214 ><P
2215 ><A
2216 HREF="#SOURCEENVIRONMENT"
2217 ><TT
2218 CLASS="PARAMETER"
2219 ><I
2220 >source environment</I
2221 ></TT
2222 ></A
2223 ></P
2224 ></LI
2225 ><LI
2226 ><P
2227 ><A
2228 HREF="#SSL"
2229 ><TT
2230 CLASS="PARAMETER"
2231 ><I
2232 >ssl</I
2233 ></TT
2234 ></A
2235 ></P
2236 ></LI
2237 ><LI
2238 ><P
2239 ><A
2240 HREF="#SSLCACERTDIR"
2241 ><TT
2242 CLASS="PARAMETER"
2243 ><I
2244 >ssl CA certDir</I
2245 ></TT
2246 ></A
2247 ></P
2248 ></LI
2249 ><LI
2250 ><P
2251 ><A
2252 HREF="#SSLCACERTFILE"
2253 ><TT
2254 CLASS="PARAMETER"
2255 ><I
2256 >ssl CA certFile</I
2257 ></TT
2258 ></A
2259 ></P
2260 ></LI
2261 ><LI
2262 ><P
2263 ><A
2264 HREF="#SSLCIPHERS"
2265 ><TT
2266 CLASS="PARAMETER"
2267 ><I
2268 >ssl ciphers</I
2269 ></TT
2270 ></A
2271 ></P
2272 ></LI
2273 ><LI
2274 ><P
2275 ><A
2276 HREF="#SSLCLIENTCERT"
2277 ><TT
2278 CLASS="PARAMETER"
2279 ><I
2280 >ssl client cert</I
2281 ></TT
2282 ></A
2283 ></P
2284 ></LI
2285 ><LI
2286 ><P
2287 ><A
2288 HREF="#SSLCLIENTKEY"
2289 ><TT
2290 CLASS="PARAMETER"
2291 ><I
2292 >ssl client key</I
2293 ></TT
2294 ></A
2295 ></P
2296 ></LI
2297 ><LI
2298 ><P
2299 ><A
2300 HREF="#SSLCOMPATIBILITY"
2301 ><TT
2302 CLASS="PARAMETER"
2303 ><I
2304 >ssl compatibility</I
2305 ></TT
2306 ></A
2307 ></P
2308 ></LI
2309 ><LI
2310 ><P
2311 ><A
2312 HREF="#SSLHOSTS"
2313 ><TT
2314 CLASS="PARAMETER"
2315 ><I
2316 >ssl hosts</I
2317 ></TT
2318 ></A
2319 ></P
2320 ></LI
2321 ><LI
2322 ><P
2323 ><A
2324 HREF="#SSLHOSTSRESIGN"
2325 ><TT
2326 CLASS="PARAMETER"
2327 ><I
2328 >ssl hosts resign</I
2329 ></TT
2330 ></A
2331 ></P
2332 ></LI
2333 ><LI
2334 ><P
2335 ><A
2336 HREF="#SSLREQUIRECLIENTCERT"
2337 ><TT
2338 CLASS="PARAMETER"
2339 ><I
2340 >ssl require clientcert</I
2341 ></TT
2342 ></A
2343 ></P
2344 ></LI
2345 ><LI
2346 ><P
2347 ><A
2348 HREF="#SSLREQUIRESERVERCERT"
2349 ><TT
2350 CLASS="PARAMETER"
2351 ><I
2352 >ssl require servercert</I
2353 ></TT
2354 ></A
2355 ></P
2356 ></LI
2357 ><LI
2358 ><P
2359 ><A
2360 HREF="#SSLSERVERCERT"
2361 ><TT
2362 CLASS="PARAMETER"
2363 ><I
2364 >ssl server cert</I
2365 ></TT
2366 ></A
2367 ></P
2368 ></LI
2369 ><LI
2370 ><P
2371 ><A
2372 HREF="#SSLSERVERKEY"
2373 ><TT
2374 CLASS="PARAMETER"
2375 ><I
2376 >ssl server key</I
2377 ></TT
2378 ></A
2379 ></P
2380 ></LI
2381 ><LI
2382 ><P
2383 ><A
2384 HREF="#SSLVERSION"
2385 ><TT
2386 CLASS="PARAMETER"
2387 ><I
2388 >ssl version</I
2389 ></TT
2390 ></A
2391 ></P
2392 ></LI
2393 ><LI
2394 ><P
2395 ><A
2396 HREF="#STATCACHE"
2397 ><TT
2398 CLASS="PARAMETER"
2399 ><I
2400 >stat cache</I
2401 ></TT
2402 ></A
2403 ></P
2404 ></LI
2405 ><LI
2406 ><P
2407 ><A
2408 HREF="#STATCACHESIZE"
2409 ><TT
2410 CLASS="PARAMETER"
2411 ><I
2412 >stat cache size</I
2413 ></TT
2414 ></A
2415 ></P
2416 ></LI
2417 ><LI
2418 ><P
2419 ><A
2420 HREF="#STRIPDOT"
2421 ><TT
2422 CLASS="PARAMETER"
2423 ><I
2424 >strip dot</I
2425 ></TT
2426 ></A
2427 ></P
2428 ></LI
2429 ><LI
2430 ><P
2431 ><A
2432 HREF="#SYSLOG"
2433 ><TT
2434 CLASS="PARAMETER"
2435 ><I
2436 >syslog</I
2437 ></TT
2438 ></A
2439 ></P
2440 ></LI
2441 ><LI
2442 ><P
2443 ><A
2444 HREF="#SYSLOGONLY"
2445 ><TT
2446 CLASS="PARAMETER"
2447 ><I
2448 >syslog only</I
2449 ></TT
2450 ></A
2451 ></P
2452 ></LI
2453 ><LI
2454 ><P
2455 ><A
2456 HREF="#TEMPLATEHOMEDIR"
2457 ><TT
2458 CLASS="PARAMETER"
2459 ><I
2460 >template homedir</I
2461 ></TT
2462 ></A
2463 ></P
2464 ></LI
2465 ><LI
2466 ><P
2467 ><A
2468 HREF="#TEMPLATESHELL"
2469 ><TT
2470 CLASS="PARAMETER"
2471 ><I
2472 >template shell</I
2473 ></TT
2474 ></A
2475 ></P
2476 ></LI
2477 ><LI
2478 ><P
2479 ><A
2480 HREF="#TIMEOFFSET"
2481 ><TT
2482 CLASS="PARAMETER"
2483 ><I
2484 >time offset</I
2485 ></TT
2486 ></A
2487 ></P
2488 ></LI
2489 ><LI
2490 ><P
2491 ><A
2492 HREF="#TIMESERVER"
2493 ><TT
2494 CLASS="PARAMETER"
2495 ><I
2496 >time server</I
2497 ></TT
2498 ></A
2499 ></P
2500 ></LI
2501 ><LI
2502 ><P
2503 ><A
2504 HREF="#TIMESTAMPLOGS"
2505 ><TT
2506 CLASS="PARAMETER"
2507 ><I
2508 >timestamp logs</I
2509 ></TT
2510 ></A
2511 ></P
2512 ></LI
2513 ><LI
2514 ><P
2515 ><A
2516 HREF="#TOTALPRINTJOBS"
2517 ><TT
2518 CLASS="PARAMETER"
2519 ><I
2520 >total print jobs</I
2521 ></TT
2522 ></A
2523 ></P
2524 ></LI
2525 ><LI
2526 ><P
2527 ><A
2528 HREF="#UNIXPASSWORDSYNC"
2529 ><TT
2530 CLASS="PARAMETER"
2531 ><I
2532 >unix password sync</I
2533 ></TT
2534 ></A
2535 ></P
2536 ></LI
2537 ><LI
2538 ><P
2539 ><A
2540 HREF="#UPDATEENCRYPTED"
2541 ><TT
2542 CLASS="PARAMETER"
2543 ><I
2544 >update encrypted</I
2545 ></TT
2546 ></A
2547 ></P
2548 ></LI
2549 ><LI
2550 ><P
2551 ><A
2552 HREF="#USERHOSTS"
2553 ><TT
2554 CLASS="PARAMETER"
2555 ><I
2556 >use rhosts</I
2557 ></TT
2558 ></A
2559 ></P
2560 ></LI
2561 ><LI
2562 ><P
2563 ><A
2564 HREF="#USERNAMELEVEL"
2565 ><TT
2566 CLASS="PARAMETER"
2567 ><I
2568 >username level</I
2569 ></TT
2570 ></A
2571 ></P
2572 ></LI
2573 ><LI
2574 ><P
2575 ><A
2576 HREF="#USERNAMEMAP"
2577 ><TT
2578 CLASS="PARAMETER"
2579 ><I
2580 >username map</I
2581 ></TT
2582 ></A
2583 ></P
2584 ></LI
2585 ><LI
2586 ><P
2587 ><A
2588 HREF="#UTMPDIRECTORY"
2589 ><TT
2590 CLASS="PARAMETER"
2591 ><I
2592 >utmp directory</I
2593 ></TT
2594 ></A
2595 ></P
2596 ></LI
2597 ><LI
2598 ><P
2599 ><A
2600 HREF="#VALIDCHARS"
2601 ><TT
2602 CLASS="PARAMETER"
2603 ><I
2604 >valid chars</I
2605 ></TT
2606 ></A
2607 ></P
2608 ></LI
2609 ><LI
2610 ><P
2611 ><A
2612 HREF="#WINBINDCACHETIME"
2613 ><TT
2614 CLASS="PARAMETER"
2615 ><I
2616 >winbind cache time</I
2617 ></TT
2618 ></A
2619 ></P
2620 ></LI
2621 ><LI
2622 ><P
2623 ><A
2624 HREF="#WINBINDGID"
2625 ><TT
2626 CLASS="PARAMETER"
2627 ><I
2628 >winbind gid</I
2629 ></TT
2630 ></A
2631 ></P
2632 ></LI
2633 ><LI
2634 ><P
2635 ><A
2636 HREF="#WINBINDSEPARATOR"
2637 ><TT
2638 CLASS="PARAMETER"
2639 ><I
2640 >winbind separator</I
2641 ></TT
2642 ></A
2643 ></P
2644 ></LI
2645 ><LI
2646 ><P
2647 ><A
2648 HREF="#WINBINDUID"
2649 ><TT
2650 CLASS="PARAMETER"
2651 ><I
2652 >winbind uid</I
2653 ></TT
2654 ></A
2655 ></P
2656 ></LI
2657 ><LI
2658 ><P
2659 ><A
2660 HREF="#WINSHOOK"
2661 ><TT
2662 CLASS="PARAMETER"
2663 ><I
2664 >wins hook</I
2665 ></TT
2666 ></A
2667 ></P
2668 ></LI
2669 ><LI
2670 ><P
2671 ><A
2672 HREF="#WINSPROXY"
2673 ><TT
2674 CLASS="PARAMETER"
2675 ><I
2676 >wins proxy</I
2677 ></TT
2678 ></A
2679 ></P
2680 ></LI
2681 ><LI
2682 ><P
2683 ><A
2684 HREF="#WINSSERVER"
2685 ><TT
2686 CLASS="PARAMETER"
2687 ><I
2688 >wins server</I
2689 ></TT
2690 ></A
2691 ></P
2692 ></LI
2693 ><LI
2694 ><P
2695 ><A
2696 HREF="#WINSSUPPORT"
2697 ><TT
2698 CLASS="PARAMETER"
2699 ><I
2700 >wins support</I
2701 ></TT
2702 ></A
2703 ></P
2704 ></LI
2705 ><LI
2706 ><P
2707 ><A
2708 HREF="#WORKGROUP"
2709 ><TT
2710 CLASS="PARAMETER"
2711 ><I
2712 >workgroup</I
2713 ></TT
2714 ></A
2715 ></P
2716 ></LI
2717 ><LI
2718 ><P
2719 ><A
2720 HREF="#WRITERAW"
2721 ><TT
2722 CLASS="PARAMETER"
2723 ><I
2724 >write raw</I
2725 ></TT
2726 ></A
2727 ></P
2728 ></LI
2729 ></UL
2730 ></DIV
2731 ><DIV
2732 CLASS="REFSECT1"
2733 ><A
2734 NAME="AEN889"
2735 ></A
2736 ><H2
2737 >COMPLETE LIST OF SERVICE PARAMETERS</H2
2738 ><P
2739 >Here is a list of all service parameters. See the section on
2740         each parameter for details. Note that some are synonyms.</P
2741 ><P
2742 ></P
2743 ><UL
2744 ><LI
2745 ><P
2746 ><A
2747 HREF="#ADMINUSERS"
2748 ><TT
2749 CLASS="PARAMETER"
2750 ><I
2751 >admin users</I
2752 ></TT
2753 ></A
2754 ></P
2755 ></LI
2756 ><LI
2757 ><P
2758 ><A
2759 HREF="#ALLOWHOSTS"
2760 ><TT
2761 CLASS="PARAMETER"
2762 ><I
2763 >allow hosts</I
2764 ></TT
2765 ></A
2766 ></P
2767 ></LI
2768 ><LI
2769 ><P
2770 ><A
2771 HREF="#AVAILABLE"
2772 ><TT
2773 CLASS="PARAMETER"
2774 ><I
2775 >available</I
2776 ></TT
2777 ></A
2778 ></P
2779 ></LI
2780 ><LI
2781 ><P
2782 ><A
2783 HREF="#BLOCKINGLOCKS"
2784 ><TT
2785 CLASS="PARAMETER"
2786 ><I
2787 >blocking locks</I
2788 ></TT
2789 ></A
2790 ></P
2791 ></LI
2792 ><LI
2793 ><P
2794 ><A
2795 HREF="#BROWSABLE"
2796 ><TT
2797 CLASS="PARAMETER"
2798 ><I
2799 >browsable</I
2800 ></TT
2801 ></A
2802 ></P
2803 ></LI
2804 ><LI
2805 ><P
2806 ><A
2807 HREF="#BROWSEABLE"
2808 ><TT
2809 CLASS="PARAMETER"
2810 ><I
2811 >browseable</I
2812 ></TT
2813 ></A
2814 ></P
2815 ></LI
2816 ><LI
2817 ><P
2818 ><A
2819 HREF="#CASESENSITIVE"
2820 ><TT
2821 CLASS="PARAMETER"
2822 ><I
2823 >case sensitive</I
2824 ></TT
2825 ></A
2826 ></P
2827 ></LI
2828 ><LI
2829 ><P
2830 ><A
2831 HREF="#CASESIGNAMES"
2832 ><TT
2833 CLASS="PARAMETER"
2834 ><I
2835 >casesignames</I
2836 ></TT
2837 ></A
2838 ></P
2839 ></LI
2840 ><LI
2841 ><P
2842 ><A
2843 HREF="#COMMENT"
2844 ><TT
2845 CLASS="PARAMETER"
2846 ><I
2847 >comment</I
2848 ></TT
2849 ></A
2850 ></P
2851 ></LI
2852 ><LI
2853 ><P
2854 ><A
2855 HREF="#COPY"
2856 ><TT
2857 CLASS="PARAMETER"
2858 ><I
2859 >copy</I
2860 ></TT
2861 ></A
2862 ></P
2863 ></LI
2864 ><LI
2865 ><P
2866 ><A
2867 HREF="#CREATEMASK"
2868 ><TT
2869 CLASS="PARAMETER"
2870 ><I
2871 >create mask</I
2872 ></TT
2873 ></A
2874 ></P
2875 ></LI
2876 ><LI
2877 ><P
2878 ><A
2879 HREF="#CREATEMODE"
2880 ><TT
2881 CLASS="PARAMETER"
2882 ><I
2883 >create mode</I
2884 ></TT
2885 ></A
2886 ></P
2887 ></LI
2888 ><LI
2889 ><P
2890 ><A
2891 HREF="#DEFAULTCASE"
2892 ><TT
2893 CLASS="PARAMETER"
2894 ><I
2895 >default case</I
2896 ></TT
2897 ></A
2898 ></P
2899 ></LI
2900 ><LI
2901 ><P
2902 ><A
2903 HREF="#DELETEREADONLY"
2904 ><TT
2905 CLASS="PARAMETER"
2906 ><I
2907 >delete readonly</I
2908 ></TT
2909 ></A
2910 ></P
2911 ></LI
2912 ><LI
2913 ><P
2914 ><A
2915 HREF="#DELETEVETOFILES"
2916 ><TT
2917 CLASS="PARAMETER"
2918 ><I
2919 >delete veto files</I
2920 ></TT
2921 ></A
2922 ></P
2923 ></LI
2924 ><LI
2925 ><P
2926 ><A
2927 HREF="#DENYHOSTS"
2928 ><TT
2929 CLASS="PARAMETER"
2930 ><I
2931 >deny hosts</I
2932 ></TT
2933 ></A
2934 ></P
2935 ></LI
2936 ><LI
2937 ><P
2938 ><A
2939 HREF="#DIRECTORY"
2940 ><TT
2941 CLASS="PARAMETER"
2942 ><I
2943 >directory</I
2944 ></TT
2945 ></A
2946 ></P
2947 ></LI
2948 ><LI
2949 ><P
2950 ><A
2951 HREF="#DIRECTORYMASK"
2952 ><TT
2953 CLASS="PARAMETER"
2954 ><I
2955 >directory mask</I
2956 ></TT
2957 ></A
2958 ></P
2959 ></LI
2960 ><LI
2961 ><P
2962 ><A
2963 HREF="#DIRECTORYMODE"
2964 ><TT
2965 CLASS="PARAMETER"
2966 ><I
2967 >directory mode</I
2968 ></TT
2969 ></A
2970 ></P
2971 ></LI
2972 ><LI
2973 ><P
2974 ><A
2975 HREF="#DIRECTORYSECURITYMASK"
2976 ><TT
2977 CLASS="PARAMETER"
2978 ><I
2979 >directory security mask</I
2980 ></TT
2981 ></A
2982 ></P
2983 ></LI
2984 ><LI
2985 ><P
2986 ><A
2987 HREF="#DONTDESCEND"
2988 ><TT
2989 CLASS="PARAMETER"
2990 ><I
2991 >dont descend</I
2992 ></TT
2993 ></A
2994 ></P
2995 ></LI
2996 ><LI
2997 ><P
2998 ><A
2999 HREF="#DOSFILEMODE"
3000 ><TT
3001 CLASS="PARAMETER"
3002 ><I
3003 >dos filemode</I
3004 ></TT
3005 ></A
3006 ></P
3007 ></LI
3008 ><LI
3009 ><P
3010 ><A
3011 HREF="#DOSFILETIMERESOLUTION"
3012 ><TT
3013 CLASS="PARAMETER"
3014 ><I
3015 >dos filetime resolution</I
3016 ></TT
3017 ></A
3018 ></P
3019 ></LI
3020 ><LI
3021 ><P
3022 ><A
3023 HREF="#DOSFILETIMES"
3024 ><TT
3025 CLASS="PARAMETER"
3026 ><I
3027 >dos filetimes</I
3028 ></TT
3029 ></A
3030 ></P
3031 ></LI
3032 ><LI
3033 ><P
3034 ><A
3035 HREF="#EXEC"
3036 ><TT
3037 CLASS="PARAMETER"
3038 ><I
3039 >exec</I
3040 ></TT
3041 ></A
3042 ></P
3043 ></LI
3044 ><LI
3045 ><P
3046 ><A
3047 HREF="#FAKEDIRECTORYCREATETIMES"
3048 ><TT
3049 CLASS="PARAMETER"
3050 ><I
3051 >fake directory create times</I
3052 ></TT
3053 ></A
3054 ></P
3055 ></LI
3056 ><LI
3057 ><P
3058 ><A
3059 HREF="#FAKEOPLOCKS"
3060 ><TT
3061 CLASS="PARAMETER"
3062 ><I
3063 >fake oplocks</I
3064 ></TT
3065 ></A
3066 ></P
3067 ></LI
3068 ><LI
3069 ><P
3070 ><A
3071 HREF="#FOLLOWSYMLINKS"
3072 ><TT
3073 CLASS="PARAMETER"
3074 ><I
3075 >follow symlinks</I
3076 ></TT
3077 ></A
3078 ></P
3079 ></LI
3080 ><LI
3081 ><P
3082 ><A
3083 HREF="#FORCECREATEMODE"
3084 ><TT
3085 CLASS="PARAMETER"
3086 ><I
3087 >force create mode</I
3088 ></TT
3089 ></A
3090 ></P
3091 ></LI
3092 ><LI
3093 ><P
3094 ><A
3095 HREF="#FORCEDIRECTORYMODE"
3096 ><TT
3097 CLASS="PARAMETER"
3098 ><I
3099 >force directory mode</I
3100 ></TT
3101 ></A
3102 ></P
3103 ></LI
3104 ><LI
3105 ><P
3106 ><A
3107 HREF="#FORCEDIRECTORYSECURITYMODE"
3108 ><TT
3109 CLASS="PARAMETER"
3110 ><I
3111 >force directory security mode</I
3112 ></TT
3113 ></A
3114 ></P
3115 ></LI
3116 ><LI
3117 ><P
3118 ><A
3119 HREF="#FORCEGROUP"
3120 ><TT
3121 CLASS="PARAMETER"
3122 ><I
3123 >force group</I
3124 ></TT
3125 ></A
3126 ></P
3127 ></LI
3128 ><LI
3129 ><P
3130 ><A
3131 HREF="#FORCESECURITYMODE"
3132 ><TT
3133 CLASS="PARAMETER"
3134 ><I
3135 >force security mode</I
3136 ></TT
3137 ></A
3138 ></P
3139 ></LI
3140 ><LI
3141 ><P
3142 ><A
3143 HREF="#FORCEUSER"
3144 ><TT
3145 CLASS="PARAMETER"
3146 ><I
3147 >force user</I
3148 ></TT
3149 ></A
3150 ></P
3151 ></LI
3152 ><LI
3153 ><P
3154 ><A
3155 HREF="#FSTYPE"
3156 ><TT
3157 CLASS="PARAMETER"
3158 ><I
3159 >fstype</I
3160 ></TT
3161 ></A
3162 ></P
3163 ></LI
3164 ><LI
3165 ><P
3166 ><A
3167 HREF="#GROUP"
3168 ><TT
3169 CLASS="PARAMETER"
3170 ><I
3171 >group</I
3172 ></TT
3173 ></A
3174 ></P
3175 ></LI
3176 ><LI
3177 ><P
3178 ><A
3179 HREF="#GUESTACCOUNT"
3180 ><TT
3181 CLASS="PARAMETER"
3182 ><I
3183 >guest account</I
3184 ></TT
3185 ></A
3186 ></P
3187 ></LI
3188 ><LI
3189 ><P
3190 ><A
3191 HREF="#GUESTOK"
3192 ><TT
3193 CLASS="PARAMETER"
3194 ><I
3195 >guest ok</I
3196 ></TT
3197 ></A
3198 ></P
3199 ></LI
3200 ><LI
3201 ><P
3202 ><A
3203 HREF="#GUESTONLY"
3204 ><TT
3205 CLASS="PARAMETER"
3206 ><I
3207 >guest only</I
3208 ></TT
3209 ></A
3210 ></P
3211 ></LI
3212 ><LI
3213 ><P
3214 ><A
3215 HREF="#HIDEDOTFILES"
3216 ><TT
3217 CLASS="PARAMETER"
3218 ><I
3219 >hide dot files</I
3220 ></TT
3221 ></A
3222 ></P
3223 ></LI
3224 ><LI
3225 ><P
3226 ><A
3227 HREF="#HIDEFILES"
3228 ><TT
3229 CLASS="PARAMETER"
3230 ><I
3231 >hide files</I
3232 ></TT
3233 ></A
3234 ></P
3235 ></LI
3236 ><LI
3237 ><P
3238 ><A
3239 HREF="#HOSTSALLOW"
3240 ><TT
3241 CLASS="PARAMETER"
3242 ><I
3243 >hosts allow</I
3244 ></TT
3245 ></A
3246 ></P
3247 ></LI
3248 ><LI
3249 ><P
3250 ><A
3251 HREF="#HOSTSDENY"
3252 ><TT
3253 CLASS="PARAMETER"
3254 ><I
3255 >hosts deny</I
3256 ></TT
3257 ></A
3258 ></P
3259 ></LI
3260 ><LI
3261 ><P
3262 ><A
3263 HREF="#INCLUDE"
3264 ><TT
3265 CLASS="PARAMETER"
3266 ><I
3267 >include</I
3268 ></TT
3269 ></A
3270 ></P
3271 ></LI
3272 ><LI
3273 ><P
3274 ><A
3275 HREF="#INHERITPERMISSIONS"
3276 ><TT
3277 CLASS="PARAMETER"
3278 ><I
3279 >inherit permissions</I
3280 ></TT
3281 ></A
3282 ></P
3283 ></LI
3284 ><LI
3285 ><P
3286 ><A
3287 HREF="#INVALIDUSERS"
3288 ><TT
3289 CLASS="PARAMETER"
3290 ><I
3291 >invalid users</I
3292 ></TT
3293 ></A
3294 ></P
3295 ></LI
3296 ><LI
3297 ><P
3298 ><A
3299 HREF="#LEVEL2OPLOCKS"
3300 ><TT
3301 CLASS="PARAMETER"
3302 ><I
3303 >level2 oplocks</I
3304 ></TT
3305 ></A
3306 ></P
3307 ></LI
3308 ><LI
3309 ><P
3310 ><A
3311 HREF="#LOCKING"
3312 ><TT
3313 CLASS="PARAMETER"
3314 ><I
3315 >locking</I
3316 ></TT
3317 ></A
3318 ></P
3319 ></LI
3320 ><LI
3321 ><P
3322 ><A
3323 HREF="#LPPAUSECOMMAND"
3324 ><TT
3325 CLASS="PARAMETER"
3326 ><I
3327 >lppause command</I
3328 ></TT
3329 ></A
3330 ></P
3331 ></LI
3332 ><LI
3333 ><P
3334 ><A
3335 HREF="#LPQCOMMAND"
3336 ><TT
3337 CLASS="PARAMETER"
3338 ><I
3339 >lpq command</I
3340 ></TT
3341 ></A
3342 ></P
3343 ></LI
3344 ><LI
3345 ><P
3346 ><A
3347 HREF="#LPRESUMECOMMAND"
3348 ><TT
3349 CLASS="PARAMETER"
3350 ><I
3351 >lpresume command</I
3352 ></TT
3353 ></A
3354 ></P
3355 ></LI
3356 ><LI
3357 ><P
3358 ><A
3359 HREF="#LPRMCOMMAND"
3360 ><TT
3361 CLASS="PARAMETER"
3362 ><I
3363 >lprm command</I
3364 ></TT
3365 ></A
3366 ></P
3367 ></LI
3368 ><LI
3369 ><P
3370 ><A
3371 HREF="#MAGICOUTPUT"
3372 ><TT
3373 CLASS="PARAMETER"
3374 ><I
3375 >magic output</I
3376 ></TT
3377 ></A
3378 ></P
3379 ></LI
3380 ><LI
3381 ><P
3382 ><A
3383 HREF="#MAGICSCRIPT"
3384 ><TT
3385 CLASS="PARAMETER"
3386 ><I
3387 >magic script</I
3388 ></TT
3389 ></A
3390 ></P
3391 ></LI
3392 ><LI
3393 ><P
3394 ><A
3395 HREF="#MANGLECASE"
3396 ><TT
3397 CLASS="PARAMETER"
3398 ><I
3399 >mangle case</I
3400 ></TT
3401 ></A
3402 ></P
3403 ></LI
3404 ><LI
3405 ><P
3406 ><A
3407 HREF="#MANGLEDMAP"
3408 ><TT
3409 CLASS="PARAMETER"
3410 ><I
3411 >mangled map</I
3412 ></TT
3413 ></A
3414 ></P
3415 ></LI
3416 ><LI
3417 ><P
3418 ><A
3419 HREF="#MANGLEDNAMES"
3420 ><TT
3421 CLASS="PARAMETER"
3422 ><I
3423 >mangled names</I
3424 ></TT
3425 ></A
3426 ></P
3427 ></LI
3428 ><LI
3429 ><P
3430 ><A
3431 HREF="#MANGLINGCHAR"
3432 ><TT
3433 CLASS="PARAMETER"
3434 ><I
3435 >mangling char</I
3436 ></TT
3437 ></A
3438 ></P
3439 ></LI
3440 ><LI
3441 ><P
3442 ><A
3443 HREF="#MAPARCHIVE"
3444 ><TT
3445 CLASS="PARAMETER"
3446 ><I
3447 >map archive</I
3448 ></TT
3449 ></A
3450 ></P
3451 ></LI
3452 ><LI
3453 ><P
3454 ><A
3455 HREF="#MAPHIDDEN"
3456 ><TT
3457 CLASS="PARAMETER"
3458 ><I
3459 >map hidden</I
3460 ></TT
3461 ></A
3462 ></P
3463 ></LI
3464 ><LI
3465 ><P
3466 ><A
3467 HREF="#MAPSYSTEM"
3468 ><TT
3469 CLASS="PARAMETER"
3470 ><I
3471 >map system</I
3472 ></TT
3473 ></A
3474 ></P
3475 ></LI
3476 ><LI
3477 ><P
3478 ><A
3479 HREF="#MAXCONNECTIONS"
3480 ><TT
3481 CLASS="PARAMETER"
3482 ><I
3483 >max connections</I
3484 ></TT
3485 ></A
3486 ></P
3487 ></LI
3488 ><LI
3489 ><P
3490 ><A
3491 HREF="#MAXPRINTJOBS"
3492 ><TT
3493 CLASS="PARAMETER"
3494 ><I
3495 >max print jobs</I
3496 ></TT
3497 ></A
3498 ></P
3499 ></LI
3500 ><LI
3501 ><P
3502 ><A
3503 HREF="#MINPRINTSPACE"
3504 ><TT
3505 CLASS="PARAMETER"
3506 ><I
3507 >min print space</I
3508 ></TT
3509 ></A
3510 ></P
3511 ></LI
3512 ><LI
3513 ><P
3514 ><A
3515 HREF="#MSDFSROOT"
3516 ><TT
3517 CLASS="PARAMETER"
3518 ><I
3519 >msdfs root</I
3520 ></TT
3521 ></A
3522 ></P
3523 ></LI
3524 ><LI
3525 ><P
3526 ><A
3527 HREF="#ONLYGUEST"
3528 ><TT
3529 CLASS="PARAMETER"
3530 ><I
3531 >only guest</I
3532 ></TT
3533 ></A
3534 ></P
3535 ></LI
3536 ><LI
3537 ><P
3538 ><A
3539 HREF="#ONLYUSER"
3540 ><TT
3541 CLASS="PARAMETER"
3542 ><I
3543 >only user</I
3544 ></TT
3545 ></A
3546 ></P
3547 ></LI
3548 ><LI
3549 ><P
3550 ><A
3551 HREF="#OPLOCKCONTENTIONLIMIT"
3552 ><TT
3553 CLASS="PARAMETER"
3554 ><I
3555 >oplock contention limit</I
3556 ></TT
3557 ></A
3558 ></P
3559 ></LI
3560 ><LI
3561 ><P
3562 ><A
3563 HREF="#OPLOCKS"
3564 ><TT
3565 CLASS="PARAMETER"
3566 ><I
3567 >oplocks</I
3568 ></TT
3569 ></A
3570 ></P
3571 ></LI
3572 ><LI
3573 ><P
3574 ><A
3575 HREF="#PATH"
3576 ><TT
3577 CLASS="PARAMETER"
3578 ><I
3579 >path</I
3580 ></TT
3581 ></A
3582 ></P
3583 ></LI
3584 ><LI
3585 ><P
3586 ><A
3587 HREF="#POSIXLOCKING"
3588 ><TT
3589 CLASS="PARAMETER"
3590 ><I
3591 >posix locking</I
3592 ></TT
3593 ></A
3594 ></P
3595 ></LI
3596 ><LI
3597 ><P
3598 ><A
3599 HREF="#POSTEXEC"
3600 ><TT
3601 CLASS="PARAMETER"
3602 ><I
3603 >postexec</I
3604 ></TT
3605 ></A
3606 ></P
3607 ></LI
3608 ><LI
3609 ><P
3610 ><A
3611 HREF="#POSTSCRIPT"
3612 ><TT
3613 CLASS="PARAMETER"
3614 ><I
3615 >postscript</I
3616 ></TT
3617 ></A
3618 ></P
3619 ></LI
3620 ><LI
3621 ><P
3622 ><A
3623 HREF="#PREEXEC"
3624 ><TT
3625 CLASS="PARAMETER"
3626 ><I
3627 >preexec</I
3628 ></TT
3629 ></A
3630 ></P
3631 ></LI
3632 ><LI
3633 ><P
3634 ><A
3635 HREF="#PREEXECCLOSE"
3636 ><TT
3637 CLASS="PARAMETER"
3638 ><I
3639 >preexec close</I
3640 ></TT
3641 ></A
3642 ></P
3643 ></LI
3644 ><LI
3645 ><P
3646 ><A
3647 HREF="#PRESERVECASE"
3648 ><TT
3649 CLASS="PARAMETER"
3650 ><I
3651 >preserve case</I
3652 ></TT
3653 ></A
3654 ></P
3655 ></LI
3656 ><LI
3657 ><P
3658 ><A
3659 HREF="#PRINTCOMMAND"
3660 ><TT
3661 CLASS="PARAMETER"
3662 ><I
3663 >print command</I
3664 ></TT
3665 ></A
3666 ></P
3667 ></LI
3668 ><LI
3669 ><P
3670 ><A
3671 HREF="#PRINTOK"
3672 ><TT
3673 CLASS="PARAMETER"
3674 ><I
3675 >print ok</I
3676 ></TT
3677 ></A
3678 ></P
3679 ></LI
3680 ><LI
3681 ><P
3682 ><A
3683 HREF="#PRINTABLE"
3684 ><TT
3685 CLASS="PARAMETER"
3686 ><I
3687 >printable</I
3688 ></TT
3689 ></A
3690 ></P
3691 ></LI
3692 ><LI
3693 ><P
3694 ><A
3695 HREF="#PRINTER"
3696 ><TT
3697 CLASS="PARAMETER"
3698 ><I
3699 >printer</I
3700 ></TT
3701 ></A
3702 ></P
3703 ></LI
3704 ><LI
3705 ><P
3706 ><A
3707 HREF="#PRINTERADMIN"
3708 ><TT
3709 CLASS="PARAMETER"
3710 ><I
3711 >printer admin</I
3712 ></TT
3713 ></A
3714 ></P
3715 ></LI
3716 ><LI
3717 ><P
3718 ><A
3719 HREF="#PRINTERDRIVER"
3720 ><TT
3721 CLASS="PARAMETER"
3722 ><I
3723 >printer driver</I
3724 ></TT
3725 ></A
3726 ></P
3727 ></LI
3728 ><LI
3729 ><P
3730 ><A
3731 HREF="#PRINTERDRIVERLOCATION"
3732 ><TT
3733 CLASS="PARAMETER"
3734 ><I
3735 >printer driver location</I
3736 ></TT
3737 ></A
3738 ></P
3739 ></LI
3740 ><LI
3741 ><P
3742 ><A
3743 HREF="#PRINTERNAME"
3744 ><TT
3745 CLASS="PARAMETER"
3746 ><I
3747 >printer name</I
3748 ></TT
3749 ></A
3750 ></P
3751 ></LI
3752 ><LI
3753 ><P
3754 ><A
3755 HREF="#PRINTING"
3756 ><TT
3757 CLASS="PARAMETER"
3758 ><I
3759 >printing</I
3760 ></TT
3761 ></A
3762 ></P
3763 ></LI
3764 ><LI
3765 ><P
3766 ><A
3767 HREF="#PUBLIC"
3768 ><TT
3769 CLASS="PARAMETER"
3770 ><I
3771 >public</I
3772 ></TT
3773 ></A
3774 ></P
3775 ></LI
3776 ><LI
3777 ><P
3778 ><A
3779 HREF="#QUEUEPAUSECOMMAND"
3780 ><TT
3781 CLASS="PARAMETER"
3782 ><I
3783 >queuepause command</I
3784 ></TT
3785 ></A
3786 ></P
3787 ></LI
3788 ><LI
3789 ><P
3790 ><A
3791 HREF="#QUEUERESUMECOMMAND"
3792 ><TT
3793 CLASS="PARAMETER"
3794 ><I
3795 >queueresume command</I
3796 ></TT
3797 ></A
3798 ></P
3799 ></LI
3800 ><LI
3801 ><P
3802 ><A
3803 HREF="#READLIST"
3804 ><TT
3805 CLASS="PARAMETER"
3806 ><I
3807 >read list</I
3808 ></TT
3809 ></A
3810 ></P
3811 ></LI
3812 ><LI
3813 ><P
3814 ><A
3815 HREF="#READONLY"
3816 ><TT
3817 CLASS="PARAMETER"
3818 ><I
3819 >read only</I
3820 ></TT
3821 ></A
3822 ></P
3823 ></LI
3824 ><LI
3825 ><P
3826 ><A
3827 HREF="#ROOTPOSTEXEC"
3828 ><TT
3829 CLASS="PARAMETER"
3830 ><I
3831 >root postexec</I
3832 ></TT
3833 ></A
3834 ></P
3835 ></LI
3836 ><LI
3837 ><P
3838 ><A
3839 HREF="#ROOTPREEXEC"
3840 ><TT
3841 CLASS="PARAMETER"
3842 ><I
3843 >root preexec</I
3844 ></TT
3845 ></A
3846 ></P
3847 ></LI
3848 ><LI
3849 ><P
3850 ><A
3851 HREF="#ROOTPREEXECCLOSE"
3852 ><TT
3853 CLASS="PARAMETER"
3854 ><I
3855 >root preexec close</I
3856 ></TT
3857 ></A
3858 ></P
3859 ></LI
3860 ><LI
3861 ><P
3862 ><A
3863 HREF="#SECURITYMASK"
3864 ><TT
3865 CLASS="PARAMETER"
3866 ><I
3867 >security mask</I
3868 ></TT
3869 ></A
3870 ></P
3871 ></LI
3872 ><LI
3873 ><P
3874 ><A
3875 HREF="#SETDIRECTORY"
3876 ><TT
3877 CLASS="PARAMETER"
3878 ><I
3879 >set directory</I
3880 ></TT
3881 ></A
3882 ></P
3883 ></LI
3884 ><LI
3885 ><P
3886 ><A
3887 HREF="#SHAREMODES"
3888 ><TT
3889 CLASS="PARAMETER"
3890 ><I
3891 >share modes</I
3892 ></TT
3893 ></A
3894 ></P
3895 ></LI
3896 ><LI
3897 ><P
3898 ><A
3899 HREF="#SHORTPRESERVECASE"
3900 ><TT
3901 CLASS="PARAMETER"
3902 ><I
3903 >short preserve case</I
3904 ></TT
3905 ></A
3906 ></P
3907 ></LI
3908 ><LI
3909 ><P
3910 ><A
3911 HREF="#STATUS"
3912 ><TT
3913 CLASS="PARAMETER"
3914 ><I
3915 >status</I
3916 ></TT
3917 ></A
3918 ></P
3919 ></LI
3920 ><LI
3921 ><P
3922 ><A
3923 HREF="#STRICTLOCKING"
3924 ><TT
3925 CLASS="PARAMETER"
3926 ><I
3927 >strict locking</I
3928 ></TT
3929 ></A
3930 ></P
3931 ></LI
3932 ><LI
3933 ><P
3934 ><A
3935 HREF="#STRICTSYNC"
3936 ><TT
3937 CLASS="PARAMETER"
3938 ><I
3939 >strict sync</I
3940 ></TT
3941 ></A
3942 ></P
3943 ></LI
3944 ><LI
3945 ><P
3946 ><A
3947 HREF="#SYNCALWAYS"
3948 ><TT
3949 CLASS="PARAMETER"
3950 ><I
3951 >sync always</I
3952 ></TT
3953 ></A
3954 ></P
3955 ></LI
3956 ><LI
3957 ><P
3958 ><A
3959 HREF="#USER"
3960 ><TT
3961 CLASS="PARAMETER"
3962 ><I
3963 >user</I
3964 ></TT
3965 ></A
3966 ></P
3967 ></LI
3968 ><LI
3969 ><P
3970 ><A
3971 HREF="#USERNAME"
3972 ><TT
3973 CLASS="PARAMETER"
3974 ><I
3975 >username</I
3976 ></TT
3977 ></A
3978 ></P
3979 ></LI
3980 ><LI
3981 ><P
3982 ><A
3983 HREF="#USERS"
3984 ><TT
3985 CLASS="PARAMETER"
3986 ><I
3987 >users</I
3988 ></TT
3989 ></A
3990 ></P
3991 ></LI
3992 ><LI
3993 ><P
3994 ><A
3995 HREF="#UTMP"
3996 ><TT
3997 CLASS="PARAMETER"
3998 ><I
3999 >utmp</I
4000 ></TT
4001 ></A
4002 ></P
4003 ></LI
4004 ><LI
4005 ><P
4006 ><A
4007 HREF="#VALIDUSERS"
4008 ><TT
4009 CLASS="PARAMETER"
4010 ><I
4011 >valid users</I
4012 ></TT
4013 ></A
4014 ></P
4015 ></LI
4016 ><LI
4017 ><P
4018 ><A
4019 HREF="#VETOFILES"
4020 ><TT
4021 CLASS="PARAMETER"
4022 ><I
4023 >veto files</I
4024 ></TT
4025 ></A
4026 ></P
4027 ></LI
4028 ><LI
4029 ><P
4030 ><A
4031 HREF="#VETOOPLOCKFILES"
4032 ><TT
4033 CLASS="PARAMETER"
4034 ><I
4035 >veto oplock files</I
4036 ></TT
4037 ></A
4038 ></P
4039 ></LI
4040 ><LI
4041 ><P
4042 ><A
4043 HREF="#VFSOBJECT"
4044 ><TT
4045 CLASS="PARAMETER"
4046 ><I
4047 >vfs object</I
4048 ></TT
4049 ></A
4050 ></P
4051 ></LI
4052 ><LI
4053 ><P
4054 ><A
4055 HREF="#VFSOPTIONS"
4056 ><TT
4057 CLASS="PARAMETER"
4058 ><I
4059 >vfs options</I
4060 ></TT
4061 ></A
4062 ></P
4063 ></LI
4064 ><LI
4065 ><P
4066 ><A
4067 HREF="#VOLUME"
4068 ><TT
4069 CLASS="PARAMETER"
4070 ><I
4071 >volume</I
4072 ></TT
4073 ></A
4074 ></P
4075 ></LI
4076 ><LI
4077 ><P
4078 ><A
4079 HREF="#WIDELINKS"
4080 ><TT
4081 CLASS="PARAMETER"
4082 ><I
4083 >wide links</I
4084 ></TT
4085 ></A
4086 ></P
4087 ></LI
4088 ><LI
4089 ><P
4090 ><A
4091 HREF="#WRITABLE"
4092 ><TT
4093 CLASS="PARAMETER"
4094 ><I
4095 >writable</I
4096 ></TT
4097 ></A
4098 ></P
4099 ></LI
4100 ><LI
4101 ><P
4102 ><A
4103 HREF="#WRITECACHESIZE"
4104 ><TT
4105 CLASS="PARAMETER"
4106 ><I
4107 >write cache size</I
4108 ></TT
4109 ></A
4110 ></P
4111 ></LI
4112 ><LI
4113 ><P
4114 ><A
4115 HREF="#WRITELIST"
4116 ><TT
4117 CLASS="PARAMETER"
4118 ><I
4119 >write list</I
4120 ></TT
4121 ></A
4122 ></P
4123 ></LI
4124 ><LI
4125 ><P
4126 ><A
4127 HREF="#WRITEOK"
4128 ><TT
4129 CLASS="PARAMETER"
4130 ><I
4131 >write ok</I
4132 ></TT
4133 ></A
4134 ></P
4135 ></LI
4136 ><LI
4137 ><P
4138 ><A
4139 HREF="#WRITEABLE"
4140 ><TT
4141 CLASS="PARAMETER"
4142 ><I
4143 >writeable</I
4144 ></TT
4145 ></A
4146 ></P
4147 ></LI
4148 ></UL
4149 ></DIV
4150 ><DIV
4151 CLASS="REFSECT1"
4152 ><A
4153 NAME="AEN1361"
4154 ></A
4155 ><H2
4156 >EXPLANATION OF EACH PARAMETER</H2
4157 ><P
4158 ></P
4159 ><DIV
4160 CLASS="VARIABLELIST"
4161 ><DL
4162 ><DT
4163 ><A
4164 NAME="ADDUSERSCRIPT"
4165 ></A
4166 >add user script (G)</DT
4167 ><DD
4168 ><P
4169 >This is the full pathname to a script that will
4170                 be run <I
4171 CLASS="EMPHASIS"
4172 >AS ROOT</I
4173 > by <A
4174 HREF="smbd.8.html"
4175 TARGET="_top"
4176 >smbd(8)
4177                 </A
4178 > under special circumstances described below.</P
4179 ><P
4180 >Normally, a Samba server requires that UNIX users are
4181                 created for all users accessing files on this server. For sites
4182                 that use Windows NT account databases as their primary user database
4183                 creating these users and keeping the user list in sync with the
4184                 Windows NT PDC is an onerous task. This option allows <A
4185 HREF="smbd.8.html"
4186 TARGET="_top"
4187 >smbd</A
4188 > to create the required UNIX users
4189                 <I
4190 CLASS="EMPHASIS"
4191 >ON DEMAND</I
4192 > when a user accesses the Samba server.</P
4193 ><P
4194 >In order to use this option, <A
4195 HREF="smbd.8.html"
4196 TARGET="_top"
4197 >smbd</A
4198 >
4199                 must be set to <TT
4200 CLASS="PARAMETER"
4201 ><I
4202 >security=server</I
4203 ></TT
4204 > or <TT
4205 CLASS="PARAMETER"
4206 ><I
4207 >               security=domain</I
4208 ></TT
4209 > and <TT
4210 CLASS="PARAMETER"
4211 ><I
4212 >add user script</I
4213 ></TT
4214 >
4215                 must be set to a full pathname for a script that will create a UNIX
4216                 user given one argument of <TT
4217 CLASS="PARAMETER"
4218 ><I
4219 >%u</I
4220 ></TT
4221 >, which expands into
4222                 the UNIX user name to create.</P
4223 ><P
4224 >When the Windows user attempts to access the Samba server,
4225                 at login (session setup in the SMB protocol) time, <A
4226 HREF="smbd.8.html"
4227 TARGET="_top"
4228 >               smbd</A
4229 > contacts the <TT
4230 CLASS="PARAMETER"
4231 ><I
4232 >password server</I
4233 ></TT
4234 > and
4235                 attempts to authenticate the given user with the given password. If the
4236                 authentication succeeds then <B
4237 CLASS="COMMAND"
4238 >smbd</B
4239 >
4240                 attempts to find a UNIX user in the UNIX password database to map the
4241                 Windows user into. If this lookup fails, and <TT
4242 CLASS="PARAMETER"
4243 ><I
4244 >add user script
4245                 </I
4246 ></TT
4247 > is set then <B
4248 CLASS="COMMAND"
4249 >smbd</B
4250 > will
4251                 call the specified script <I
4252 CLASS="EMPHASIS"
4253 >AS ROOT</I
4254 >, expanding
4255                 any <TT
4256 CLASS="PARAMETER"
4257 ><I
4258 >%u</I
4259 ></TT
4260 > argument to be the user name to create.</P
4261 ><P
4262 >If this script successfully creates the user then <B
4263 CLASS="COMMAND"
4264 >smbd
4265                 </B
4266 > will continue on as though the UNIX user
4267                 already existed. In this way, UNIX users are dynamically created to
4268                 match existing Windows NT accounts.</P
4269 ><P
4270 >See also <A
4271 HREF="#SECURITY"
4272 ><TT
4273 CLASS="PARAMETER"
4274 ><I
4275 >               security</I
4276 ></TT
4277 ></A
4278 >, <A
4279 HREF="#PASSWORDSERVER"
4280 >               <TT
4281 CLASS="PARAMETER"
4282 ><I
4283 >password server</I
4284 ></TT
4285 ></A
4286 >,
4287                 <A
4288 HREF="#DELETEUSERSCRIPT"
4289 ><TT
4290 CLASS="PARAMETER"
4291 ><I
4292 >delete user
4293                 script</I
4294 ></TT
4295 ></A
4296 >.</P
4297 ><P
4298 >Default: <B
4299 CLASS="COMMAND"
4300 >add user script = &lt;empty string&gt;
4301                 </B
4302 ></P
4303 ><P
4304 >Example: <B
4305 CLASS="COMMAND"
4306 >add user script = /usr/local/samba/bin/add_user
4307                 %u</B
4308 ></P
4309 ></DD
4310 ><DT
4311 ><A
4312 NAME="ADDPRINTERCOMMAND"
4313 ></A
4314 >addprinter command (G)</DT
4315 ><DD
4316 ><P
4317 >With the introduction of MS-RPC based printing
4318                 support for Windows NT/2000 clients in Samba 2.2, The MS Add
4319                 Printer Wizard (APW) icon is now also available in the
4320                 "Printers..." folder displayed a share listing.  The APW
4321                 allows for printers to be add remotely to a Samba or Windows
4322                 NT/2000 print server.</P
4323 ><P
4324 >For a Samba host this means that the printer must be
4325                 physically added to underlying printing system.  The <TT
4326 CLASS="PARAMETER"
4327 ><I
4328 >               addprinter command</I
4329 ></TT
4330 > defines a script to be run which
4331                 will perform the necessary operations for adding the printer
4332                 to the print system and to add the appropriate service definition
4333                 to the  <TT
4334 CLASS="FILENAME"
4335 >smb.conf</TT
4336 > file in order that it can be
4337                 shared by <A
4338 HREF="smbd.8.html"
4339 TARGET="_top"
4340 ><B
4341 CLASS="COMMAND"
4342 >smbd(8)</B
4343 >
4344                 </A
4345 >.</P
4346 ><P
4347 >The <TT
4348 CLASS="PARAMETER"
4349 ><I
4350 >addprinter command</I
4351 ></TT
4352 > is
4353                 automatically invoked with the following parameter (in
4354                 order:</P
4355 ><P
4356 ></P
4357 ><UL
4358 ><LI
4359 ><P
4360 ><TT
4361 CLASS="PARAMETER"
4362 ><I
4363 >printer name</I
4364 ></TT
4365 ></P
4366 ></LI
4367 ><LI
4368 ><P
4369 ><TT
4370 CLASS="PARAMETER"
4371 ><I
4372 >share name</I
4373 ></TT
4374 ></P
4375 ></LI
4376 ><LI
4377 ><P
4378 ><TT
4379 CLASS="PARAMETER"
4380 ><I
4381 >port name</I
4382 ></TT
4383 ></P
4384 ></LI
4385 ><LI
4386 ><P
4387 ><TT
4388 CLASS="PARAMETER"
4389 ><I
4390 >driver name</I
4391 ></TT
4392 ></P
4393 ></LI
4394 ><LI
4395 ><P
4396 ><TT
4397 CLASS="PARAMETER"
4398 ><I
4399 >location</I
4400 ></TT
4401 ></P
4402 ></LI
4403 ><LI
4404 ><P
4405 ><TT
4406 CLASS="PARAMETER"
4407 ><I
4408 >Windows 9x driver location</I
4409 ></TT
4410 >
4411                         </P
4412 ></LI
4413 ></UL
4414 ><P
4415 >All parameters are filled in from the PRINTER_INFO_2 structure sent
4416                 by the Windows NT/2000 client with one exception.  The "Windows 9x
4417                 driver location" parameter is included for backwards compatibility
4418                 only.  The remaining fields in the structure are generated from answers
4419                 to the APW questions.</P
4420 ><P
4421 >Once the <TT
4422 CLASS="PARAMETER"
4423 ><I
4424 >addprinter command</I
4425 ></TT
4426 > has
4427                 been executed, <B
4428 CLASS="COMMAND"
4429 >smbd</B
4430 > will reparse the <TT
4431 CLASS="FILENAME"
4432 >               smb.conf</TT
4433 > to determine if the share defined by the APW
4434                 exists.  If the sharename is still invalid, then <B
4435 CLASS="COMMAND"
4436 >smbd
4437                 </B
4438 > will return an ACCESS_DENIED error to the client.</P
4439 ><P
4440 >See also <A
4441 HREF="#DELETEPRINTERCOMMAND"
4442 ><TT
4443 CLASS="PARAMETER"
4444 ><I
4445 >               deleteprinter command</I
4446 ></TT
4447 ></A
4448 >, <A
4449 HREF="#PRINTING"
4450 ><TT
4451 CLASS="PARAMETER"
4452 ><I
4453 >printing</I
4454 ></TT
4455 ></A
4456 >,
4457                 <A
4458 HREF="#SHOWADDPRINTERWIZARD"
4459 ><TT
4460 CLASS="PARAMETER"
4461 ><I
4462 >show add
4463                 printer wizard</I
4464 ></TT
4465 ></A
4466 ></P
4467 ><P
4468 >Default: <I
4469 CLASS="EMPHASIS"
4470 >none</I
4471 ></P
4472 ><P
4473 >Example: <B
4474 CLASS="COMMAND"
4475 >addprinter command = /usr/bin/addprinter
4476                 </B
4477 ></P
4478 ></DD
4479 ><DT
4480 ><A
4481 NAME="ADMINUSERS"
4482 ></A
4483 >admin users (S)</DT
4484 ><DD
4485 ><P
4486 >This is a list of users who will be granted
4487                 administrative privileges on the share. This means that they
4488                 will do all file operations as the super-user (root).</P
4489 ><P
4490 >You should use this option very carefully, as any user in
4491                 this list will be able to do anything they like on the share,
4492                 irrespective of file permissions.</P
4493 ><P
4494 >Default: <I
4495 CLASS="EMPHASIS"
4496 >no admin users</I
4497 ></P
4498 ><P
4499 >Example: <B
4500 CLASS="COMMAND"
4501 >admin users = jason</B
4502 ></P
4503 ></DD
4504 ><DT
4505 ><A
4506 NAME="ALLOWHOSTS"
4507 ></A
4508 >allow hosts (S)</DT
4509 ><DD
4510 ><P
4511 >Synonym for <A
4512 HREF="#HOSTSALLOW"
4513 >               <TT
4514 CLASS="PARAMETER"
4515 ><I
4516 >hosts allow</I
4517 ></TT
4518 ></A
4519 >.</P
4520 ></DD
4521 ><DT
4522 ><A
4523 NAME="ALLOWTRUSTEDDOMAINS"
4524 ></A
4525 >allow trusted domains (G)</DT
4526 ><DD
4527 ><P
4528 >This option only takes effect when the <A
4529 HREF="#SECURITY"
4530 ><TT
4531 CLASS="PARAMETER"
4532 ><I
4533 >security</I
4534 ></TT
4535 ></A
4536 > option is set to
4537                 <TT
4538 CLASS="CONSTANT"
4539 >server</TT
4540 > or <TT
4541 CLASS="CONSTANT"
4542 >domain</TT
4543 >.
4544                 If it is set to no, then attempts to connect to a resource from
4545                 a domain or workgroup other than the one which smbd is running
4546                 in will fail, even if that domain is trusted by the remote server
4547                 doing the authentication.</P
4548 ><P
4549 >This is useful if you only want your Samba server to
4550                 serve resources to users in the domain it is a member of. As
4551                 an example, suppose that there are two domains DOMA and DOMB.  DOMB
4552                 is trusted by DOMA, which contains the Samba server.  Under normal
4553                 circumstances, a user with an account in DOMB can then access the
4554                 resources of a UNIX account with the same account name on the
4555                 Samba server even if they do not have an account in DOMA.  This
4556                 can make implementing a security boundary difficult.</P
4557 ><P
4558 >Default: <B
4559 CLASS="COMMAND"
4560 >allow trusted domains = yes</B
4561 ></P
4562 ></DD
4563 ><DT
4564 ><A
4565 NAME="ANNOUNCEAS"
4566 ></A
4567 >announce as (G)</DT
4568 ><DD
4569 ><P
4570 >This specifies what type of server
4571                 <A
4572 HREF="nmbd.8.html"
4573 TARGET="_top"
4574 ><B
4575 CLASS="COMMAND"
4576 >nmbd</B
4577 ></A
4578 >
4579                 will announce itself as, to a network neighborhood browse
4580                 list. By default this is set to Windows NT. The valid options
4581                 are : "NT Server" (which can also be written as "NT"),
4582                 "NT Workstation", "Win95" or "WfW" meaning Windows NT Server,
4583                 Windows NT Workstation, Windows 95 and Windows for Workgroups
4584                 respectively. Do not change this parameter unless you have a
4585                 specific need to stop Samba appearing as an NT server as this
4586                 may prevent Samba servers from participating as browser servers
4587                 correctly.</P
4588 ><P
4589 >Default: <B
4590 CLASS="COMMAND"
4591 >announce as = NT Server</B
4592 ></P
4593 ><P
4594 >Example: <B
4595 CLASS="COMMAND"
4596 >announce as = Win95</B
4597 ></P
4598 ></DD
4599 ><DT
4600 ><A
4601 NAME="ANNOUNCEVERSION"
4602 ></A
4603 >annouce version (G)</DT
4604 ><DD
4605 ><P
4606 >This specifies the major and minor version numbers
4607                 that nmbd will use when announcing itself as a server. The default
4608                 is 4.2.  Do not change this parameter unless you have a specific
4609                 need to set a Samba server to be a downlevel server.</P
4610 ><P
4611 >Default: <B
4612 CLASS="COMMAND"
4613 >announce version = 4.2</B
4614 ></P
4615 ><P
4616 >Example: <B
4617 CLASS="COMMAND"
4618 >announce version = 2.0</B
4619 ></P
4620 ></DD
4621 ><DT
4622 ><A
4623 NAME="AUTOSERVICES"
4624 ></A
4625 >auto services (G)</DT
4626 ><DD
4627 ><P
4628 >This is a synonym for the <A
4629 HREF="#PRELOAD"
4630 >               <TT
4631 CLASS="PARAMETER"
4632 ><I
4633 >preload</I
4634 ></TT
4635 ></A
4636 >.</P
4637 ></DD
4638 ><DT
4639 ><A
4640 NAME="AVAILABLE"
4641 ></A
4642 >available (S)</DT
4643 ><DD
4644 ><P
4645 >This parameter lets you "turn off" a service. If
4646                 <TT
4647 CLASS="PARAMETER"
4648 ><I
4649 >available = no</I
4650 ></TT
4651 >, then <I
4652 CLASS="EMPHASIS"
4653 >ALL</I
4654 >
4655                 attempts to connect to the service will fail. Such failures are
4656                 logged.</P
4657 ><P
4658 >Default: <B
4659 CLASS="COMMAND"
4660 >available = yes</B
4661 ></P
4662 ></DD
4663 ><DT
4664 ><A
4665 NAME="BINDINTERFACESONLY"
4666 ></A
4667 >bind interfaces only (G)</DT
4668 ><DD
4669 ><P
4670 >This global parameter allows the Samba admin
4671                 to limit what interfaces on a machine will serve smb requests. If
4672                 affects file service <A
4673 HREF="smbd.8.html"
4674 TARGET="_top"
4675 >smbd(8)</A
4676 > and
4677                 name service <A
4678 HREF="nmbd.8.html"
4679 TARGET="_top"
4680 >nmbd(8)</A
4681 > in slightly
4682                 different ways.</P
4683 ><P
4684 >For name service it causes <B
4685 CLASS="COMMAND"
4686 >nmbd</B
4687 > to bind
4688                 to ports 137 and 138 on the interfaces listed in the <A
4689 HREF="#INTERFACES"
4690 >interfaces</A
4691 > parameter. <B
4692 CLASS="COMMAND"
4693 >nmbd
4694                 </B
4695 > also binds to the "all addresses" interface (0.0.0.0)
4696                 on ports 137 and 138 for the purposes of reading broadcast messages.
4697                 If this option is not set then <B
4698 CLASS="COMMAND"
4699 >nmbd</B
4700 > will service
4701                 name requests on all of these sockets. If <TT
4702 CLASS="PARAMETER"
4703 ><I
4704 >bind interfaces
4705                 only</I
4706 ></TT
4707 > is set then <B
4708 CLASS="COMMAND"
4709 >nmbd</B
4710 > will check the
4711                 source address of any packets coming in on the broadcast sockets
4712                 and discard any that don't match the broadcast addresses of the
4713                 interfaces in the <TT
4714 CLASS="PARAMETER"
4715 ><I
4716 >interfaces</I
4717 ></TT
4718 > parameter list.
4719                 As unicast packets are received on the other sockets it allows
4720                 <B
4721 CLASS="COMMAND"
4722 >nmbd</B
4723 > to refuse to serve names to machines that
4724                 send packets that arrive through any interfaces not listed in the
4725                 <TT
4726 CLASS="PARAMETER"
4727 ><I
4728 >interfaces</I
4729 ></TT
4730 > list.  IP Source address spoofing
4731                 does defeat this simple check, however so it must not be used
4732                 seriously as a security feature for <B
4733 CLASS="COMMAND"
4734 >nmbd</B
4735 >.</P
4736 ><P
4737 >For file service it causes <A
4738 HREF="smbd.8.html"
4739 TARGET="_top"
4740 >smbd(8)</A
4741 >
4742                 to bind only to the interface list given in the <A
4743 HREF="#INTERFACES"
4744 >               interfaces</A
4745 > parameter. This restricts the networks that
4746                 <B
4747 CLASS="COMMAND"
4748 >smbd</B
4749 > will serve to packets coming in those
4750                 interfaces.  Note that you should not use this parameter for machines
4751                 that are serving PPP or other intermittent or non-broadcast network
4752                 interfaces as it will not cope with non-permanent interfaces.</P
4753 ><P
4754 >If <TT
4755 CLASS="PARAMETER"
4756 ><I
4757 >bind interfaces only</I
4758 ></TT
4759 > is set then
4760                 unless the network address <I
4761 CLASS="EMPHASIS"
4762 >127.0.0.1</I
4763 > is added
4764                 to the <TT
4765 CLASS="PARAMETER"
4766 ><I
4767 >interfaces</I
4768 ></TT
4769 > parameter list <A
4770 HREF="smbpasswd.8.html"
4771 TARGET="_top"
4772 ><B
4773 CLASS="COMMAND"
4774 >smbpasswd(8)</B
4775 ></A
4776 >
4777                 and <A
4778 HREF="swat.8.html"
4779 TARGET="_top"
4780 ><B
4781 CLASS="COMMAND"
4782 >swat(8)</B
4783 ></A
4784 > may
4785                 not work as expected due to the reasons covered below.</P
4786 ><P
4787 >To change a users SMB password, the <B
4788 CLASS="COMMAND"
4789 >smbpasswd</B
4790 >
4791                 by default connects to the <I
4792 CLASS="EMPHASIS"
4793 >localhost - 127.0.0.1</I
4794 >
4795                 address as an SMB client to issue the password change request. If
4796                 <TT
4797 CLASS="PARAMETER"
4798 ><I
4799 >bind interfaces only</I
4800 ></TT
4801 > is set then unless the
4802                 network address <I
4803 CLASS="EMPHASIS"
4804 >127.0.0.1</I
4805 > is added to the
4806                 <TT
4807 CLASS="PARAMETER"
4808 ><I
4809 >interfaces</I
4810 ></TT
4811 > parameter list then <B
4812 CLASS="COMMAND"
4813 >               smbpasswd</B
4814 > will fail to connect in it's default mode.
4815                 <B
4816 CLASS="COMMAND"
4817 >smbpasswd</B
4818 > can be forced to use the primary IP interface
4819                 of the local host by using its <A
4820 HREF="smbpasswd.8.html#minusr"
4821 TARGET="_top"
4822 >               <TT
4823 CLASS="PARAMETER"
4824 ><I
4825 >-r <TT
4826 CLASS="REPLACEABLE"
4827 ><I
4828 >remote machine</I
4829 ></TT
4830 ></I
4831 ></TT
4832 >
4833                 </A
4834 > parameter, with <TT
4835 CLASS="REPLACEABLE"
4836 ><I
4837 >remote machine</I
4838 ></TT
4839 > set
4840                 to the IP name of the primary interface of the local host.</P
4841 ><P
4842 >The <B
4843 CLASS="COMMAND"
4844 >swat</B
4845 > status page tries to connect with
4846                 <B
4847 CLASS="COMMAND"
4848 >smbd</B
4849 > and <B
4850 CLASS="COMMAND"
4851 >nmbd</B
4852 > at the address
4853                 <I
4854 CLASS="EMPHASIS"
4855 >127.0.0.1</I
4856 > to determine if they are running.
4857                 Not adding <I
4858 CLASS="EMPHASIS"
4859 >127.0.0.1</I
4860 >  will cause <B
4861 CLASS="COMMAND"
4862 >               smbd</B
4863 > and <B
4864 CLASS="COMMAND"
4865 >nmbd</B
4866 > to always show
4867                 "not running" even if they really are.  This can prevent <B
4868 CLASS="COMMAND"
4869 >               swat</B
4870 > from starting/stopping/restarting <B
4871 CLASS="COMMAND"
4872 >smbd</B
4873 >
4874                 and <B
4875 CLASS="COMMAND"
4876 >nmbd</B
4877 >.</P
4878 ><P
4879 >Default: <B
4880 CLASS="COMMAND"
4881 >bind interfaces only = no</B
4882 ></P
4883 ></DD
4884 ><DT
4885 ><A
4886 NAME="BLOCKINGLOCKS"
4887 ></A
4888 >blocking locks (S)</DT
4889 ><DD
4890 ><P
4891 >This parameter controls the behavior of <A
4892 HREF="smbd.8.html"
4893 TARGET="_top"
4894 >smbd(8)</A
4895 > when given a request by a client
4896                 to obtain a byte range lock on a region of an open file, and the
4897                 request has a time limit associated with it.</P
4898 ><P
4899 >If this parameter is set and the lock range requested
4900                 cannot be immediately satisfied, Samba 2.2 will internally
4901                 queue the lock request, and periodically attempt to obtain
4902                 the lock until the timeout period expires.</P
4903 ><P
4904 >If this parameter is set to <TT
4905 CLASS="CONSTANT"
4906 >False</TT
4907 >, then
4908                 Samba 2.2 will behave as previous versions of Samba would and
4909                 will fail the lock request immediately if the lock range
4910                 cannot be obtained.</P
4911 ><P
4912 >Default: <B
4913 CLASS="COMMAND"
4914 >blocking locks = yes</B
4915 ></P
4916 ></DD
4917 ><DT
4918 ><A
4919 NAME="BROWSABLE"
4920 ></A
4921 >browsable (S)</DT
4922 ><DD
4923 ><P
4924 >See the <A
4925 HREF="#BROWSEABLE"
4926 ><TT
4927 CLASS="PARAMETER"
4928 ><I
4929 >               browseable</I
4930 ></TT
4931 ></A
4932 >.</P
4933 ></DD
4934 ><DT
4935 ><A
4936 NAME="BROWSELIST"
4937 ></A
4938 >browse list (G)</DT
4939 ><DD
4940 ><P
4941 >This controls whether <A
4942 HREF="smbd.8.html"
4943 TARGET="_top"
4944 >               <B
4945 CLASS="COMMAND"
4946 >smbd(8)</B
4947 ></A
4948 > will serve a browse list to
4949                 a client doing a <B
4950 CLASS="COMMAND"
4951 >NetServerEnum</B
4952 > call. Normally
4953                 set to <TT
4954 CLASS="CONSTANT"
4955 >true</TT
4956 >. You should never need to change
4957                 this.</P
4958 ><P
4959 >Default: <B
4960 CLASS="COMMAND"
4961 >browse list = yes</B
4962 ></P
4963 ></DD
4964 ><DT
4965 ><A
4966 NAME="BROWSEABLE"
4967 ></A
4968 >browseable (S)</DT
4969 ><DD
4970 ><P
4971 >This controls whether this share is seen in
4972                 the list of available shares in a net view and in the browse list.</P
4973 ><P
4974 >Default: <B
4975 CLASS="COMMAND"
4976 >browseable = yes</B
4977 ></P
4978 ></DD
4979 ><DT
4980 ><A
4981 NAME="CASESENSITIVE"
4982 ></A
4983 >case sensitive (S)</DT
4984 ><DD
4985 ><P
4986 >See the discussion in the section <A
4987 HREF="#AEN201"
4988 >NAME MANGLING</A
4989 >.</P
4990 ><P
4991 >Default: <B
4992 CLASS="COMMAND"
4993 >case sensitive = no</B
4994 ></P
4995 ></DD
4996 ><DT
4997 ><A
4998 NAME="CASESIGNAMES"
4999 ></A
5000 >casesignames (S)</DT
5001 ><DD
5002 ><P
5003 >Synonym for <A
5004 HREF="#CASESENSITIVE"
5005 >case
5006                 sensitive</A
5007 >.</P
5008 ></DD
5009 ><DT
5010 ><A
5011 NAME="CHANGENOTIFYTIMEOUT"
5012 ></A
5013 >change notify timeout (G)</DT
5014 ><DD
5015 ><P
5016 >This SMB allows a client to tell a server to
5017                 "watch" a particular directory for any changes and only reply to
5018                 the SMB request when a change has occurred. Such constant scanning of
5019                 a directory is expensive under UNIX, hence an <A
5020 HREF="smbd.8.html"
5021 TARGET="_top"
5022 >               <B
5023 CLASS="COMMAND"
5024 >smbd(8)</B
5025 ></A
5026 > daemon only performs such a scan
5027                 on each requested directory once every <TT
5028 CLASS="PARAMETER"
5029 ><I
5030 >change notify
5031                 timeout</I
5032 ></TT
5033 > seconds.</P
5034 ><P
5035 >Default: <B
5036 CLASS="COMMAND"
5037 >change notify timeout = 60</B
5038 ></P
5039 ><P
5040 >Example: <B
5041 CLASS="COMMAND"
5042 >change notify timeout = 300</B
5043 ></P
5044 ><P
5045 >Would change the scan time to every 5 minutes.</P
5046 ></DD
5047 ><DT
5048 ><A
5049 NAME="CHARACTERSET"
5050 ></A
5051 >character set (G)</DT
5052 ><DD
5053 ><P
5054 >This allows a smbd to map incoming filenames
5055                 from a DOS Code page (see the <A
5056 HREF="#CLIENTCODEPAGE"
5057 >client
5058                 code page</A
5059 > parameter) to several built in UNIX character sets.
5060                 The built in code page translations are:</P
5061 ><P
5062 ></P
5063 ><UL
5064 ><LI
5065 ><P
5066 ><TT
5067 CLASS="CONSTANT"
5068 >ISO8859-1</TT
5069 > : Western European
5070                         UNIX character set. The parameter <TT
5071 CLASS="PARAMETER"
5072 ><I
5073 >client code page</I
5074 ></TT
5075 >
5076                         <I
5077 CLASS="EMPHASIS"
5078 >MUST</I
5079 > be set to code page 850 if the
5080                         <TT
5081 CLASS="PARAMETER"
5082 ><I
5083 >character set</I
5084 ></TT
5085 > parameter is set to
5086                         <TT
5087 CLASS="CONSTANT"
5088 >ISO8859-1</TT
5089 > in order for the conversion to the
5090                         UNIX character set to be done correctly.</P
5091 ></LI
5092 ><LI
5093 ><P
5094 ><TT
5095 CLASS="CONSTANT"
5096 >ISO8859-2</TT
5097 > : Eastern European
5098                         UNIX character set. The parameter <TT
5099 CLASS="PARAMETER"
5100 ><I
5101 >client code page
5102                         </I
5103 ></TT
5104 > <I
5105 CLASS="EMPHASIS"
5106 >MUST</I
5107 > be set to code page 852 if
5108                         the <TT
5109 CLASS="PARAMETER"
5110 ><I
5111 > character set</I
5112 ></TT
5113 > parameter is set
5114                         to <TT
5115 CLASS="CONSTANT"
5116 >ISO8859-2</TT
5117 > in order for the conversion
5118                         to the UNIX character set to be done correctly. </P
5119 ></LI
5120 ><LI
5121 ><P
5122 ><TT
5123 CLASS="CONSTANT"
5124 >ISO8859-5</TT
5125 > : Russian Cyrillic
5126                         UNIX character set. The parameter <TT
5127 CLASS="PARAMETER"
5128 ><I
5129 >client code page
5130                         </I
5131 ></TT
5132 > <I
5133 CLASS="EMPHASIS"
5134 >MUST</I
5135 > be set to code page
5136                         866 if the <TT
5137 CLASS="PARAMETER"
5138 ><I
5139 >character set </I
5140 ></TT
5141 > parameter is
5142                         set to <TT
5143 CLASS="CONSTANT"
5144 >ISO8859-5</TT
5145 > in order for the conversion
5146                         to the UNIX character set to be done correctly. </P
5147 ></LI
5148 ><LI
5149 ><P
5150 ><TT
5151 CLASS="CONSTANT"
5152 >ISO8859-7</TT
5153 > : Greek UNIX
5154                         character set. The parameter <TT
5155 CLASS="PARAMETER"
5156 ><I
5157 >client code page
5158                         </I
5159 ></TT
5160 > <I
5161 CLASS="EMPHASIS"
5162 >MUST</I
5163 > be set to code page
5164                         737 if the <TT
5165 CLASS="PARAMETER"
5166 ><I
5167 >character set</I
5168 ></TT
5169 > parameter is
5170                         set to <TT
5171 CLASS="CONSTANT"
5172 >ISO8859-7</TT
5173 > in order for the conversion
5174                         to the UNIX character set to be done correctly.</P
5175 ></LI
5176 ><LI
5177 ><P
5178 ><TT
5179 CLASS="CONSTANT"
5180 >KOI8-R</TT
5181 > : Alternate mapping
5182                         for Russian Cyrillic UNIX character set. The parameter
5183                         <TT
5184 CLASS="PARAMETER"
5185 ><I
5186 >client code page</I
5187 ></TT
5188 > <I
5189 CLASS="EMPHASIS"
5190 >MUST</I
5191 >
5192                         be set to code page 866 if the <TT
5193 CLASS="PARAMETER"
5194 ><I
5195 >character set</I
5196 ></TT
5197 >
5198                         parameter is set to <TT
5199 CLASS="CONSTANT"
5200 >KOI8-R</TT
5201 > in order for the
5202                         conversion to the UNIX character set to be done correctly.</P
5203 ></LI
5204 ></UL
5205 ><P
5206 ><I
5207 CLASS="EMPHASIS"
5208 >BUG</I
5209 >. These MSDOS code page to UNIX character
5210                 set mappings should be dynamic, like the loading of MS DOS code pages,
5211                 not static.</P
5212 ><P
5213 >Normally this parameter is not set, meaning no filename
5214                 translation is done.</P
5215 ><P
5216 >Default: <B
5217 CLASS="COMMAND"
5218 >character set = &lt;empty string&gt;</B
5219 ></P
5220 ><P
5221 >Example: <B
5222 CLASS="COMMAND"
5223 >character set = ISO8859-1</B
5224 ></P
5225 ></DD
5226 ><DT
5227 ><A
5228 NAME="CLIENTCODEPAGE"
5229 ></A
5230 >client code page (G)</DT
5231 ><DD
5232 ><P
5233 >This parameter specifies the DOS code page
5234                 that the clients accessing Samba are using. To determine what code
5235                 page a Windows or DOS client is using, open a DOS command prompt
5236                 and type the command <B
5237 CLASS="COMMAND"
5238 >chcp</B
5239 >. This will output
5240                 the code page. The default for USA MS-DOS, Windows 95, and
5241                 Windows NT releases is code page 437. The default for western
5242                 European releases of the above operating systems is code page 850.</P
5243 ><P
5244 >This parameter tells <A
5245 HREF="smbd.8.html"
5246 TARGET="_top"
5247 >smbd(8)</A
5248 >
5249                 which of the <TT
5250 CLASS="FILENAME"
5251 >codepage.<TT
5252 CLASS="REPLACEABLE"
5253 ><I
5254 >XXX</I
5255 ></TT
5256 >
5257                 </TT
5258 > files to dynamically load on startup. These files,
5259                 described more fully in the manual page <A
5260 HREF="make_smbcodepage.1.html"
5261 TARGET="_top"
5262 >               <B
5263 CLASS="COMMAND"
5264 >make_smbcodepage(1)</B
5265 ></A
5266 >, tell <B
5267 CLASS="COMMAND"
5268 >               smbd</B
5269 > how to map lower to upper case characters to provide
5270                 the case insensitivity of filenames that Windows clients expect.</P
5271 ><P
5272 >Samba currently ships with the following code page files :</P
5273 ><P
5274 ></P
5275 ><UL
5276 ><LI
5277 ><P
5278 >Code Page 437 - MS-DOS Latin US</P
5279 ></LI
5280 ><LI
5281 ><P
5282 >Code Page 737 - Windows '95 Greek</P
5283 ></LI
5284 ><LI
5285 ><P
5286 >Code Page 850 - MS-DOS Latin 1</P
5287 ></LI
5288 ><LI
5289 ><P
5290 >Code Page 852 - MS-DOS Latin 2</P
5291 ></LI
5292 ><LI
5293 ><P
5294 >Code Page 861 - MS-DOS Icelandic</P
5295 ></LI
5296 ><LI
5297 ><P
5298 >Code Page 866 - MS-DOS Cyrillic</P
5299 ></LI
5300 ><LI
5301 ><P
5302 >Code Page 932 - MS-DOS Japanese SJIS</P
5303 ></LI
5304 ><LI
5305 ><P
5306 >Code Page 936 - MS-DOS Simplified Chinese</P
5307 ></LI
5308 ><LI
5309 ><P
5310 >Code Page 949 - MS-DOS Korean Hangul</P
5311 ></LI
5312 ><LI
5313 ><P
5314 >Code Page 950 - MS-DOS Traditional Chinese</P
5315 ></LI
5316 ></UL
5317 ><P
5318 >Thus this parameter may have any of the values 437, 737, 850, 852,
5319                 861, 932, 936, 949, or 950.  If you don't find the codepage you need,
5320                 read the comments in one of the other codepage files and the
5321                 <B
5322 CLASS="COMMAND"
5323 >make_smbcodepage(1)</B
5324 > man page and write one. Please
5325                 remember to donate it back to the Samba user community.</P
5326 ><P
5327 >This parameter co-operates with the <TT
5328 CLASS="PARAMETER"
5329 ><I
5330 >valid
5331                 chars</I
5332 ></TT
5333 > parameter in determining what characters are
5334                 valid in filenames and how capitalization is done. If you set both
5335                 this parameter and the <TT
5336 CLASS="PARAMETER"
5337 ><I
5338 >valid chars</I
5339 ></TT
5340 > parameter
5341                 the <TT
5342 CLASS="PARAMETER"
5343 ><I
5344 >client code page</I
5345 ></TT
5346 > parameter
5347                 <I
5348 CLASS="EMPHASIS"
5349 >MUST</I
5350 > be set before the <TT
5351 CLASS="PARAMETER"
5352 ><I
5353 >valid
5354                 chars</I
5355 ></TT
5356 > parameter in the <TT
5357 CLASS="FILENAME"
5358 >smb.conf</TT
5359 >
5360                 file. The <TT
5361 CLASS="PARAMETER"
5362 ><I
5363 >valid chars</I
5364 ></TT
5365 > string will then
5366                 augment the character settings in the <TT
5367 CLASS="PARAMETER"
5368 ><I
5369 >client code page</I
5370 ></TT
5371 >
5372                 parameter.</P
5373 ><P
5374 >If not set, <TT
5375 CLASS="PARAMETER"
5376 ><I
5377 >client code page</I
5378 ></TT
5379 > defaults
5380                 to 850.</P
5381 ><P
5382 >See also : <A
5383 HREF="#VALIDCHARS"
5384 ><TT
5385 CLASS="PARAMETER"
5386 ><I
5387 >valid
5388                 chars</I
5389 ></TT
5390 ></A
5391 >, <A
5392 HREF="#CODEPAGEDIRECTORY"
5393 >               <TT
5394 CLASS="PARAMETER"
5395 ><I
5396 >code page directory</I
5397 ></TT
5398 ></A
5399 ></P
5400 ><P
5401 >Default: <B
5402 CLASS="COMMAND"
5403 >client code page = 850</B
5404 ></P
5405 ><P
5406 >Example: <B
5407 CLASS="COMMAND"
5408 >client code page = 936</B
5409 ></P
5410 ></DD
5411 ><DT
5412 ><A
5413 NAME="CODEPAGEDIRECTORY"
5414 ></A
5415 >code page directory (G)</DT
5416 ><DD
5417 ><P
5418 >Define the location of the various client code page
5419                 files.</P
5420 ><P
5421 >See also <A
5422 HREF="#CLIENTCODEPAGE"
5423 ><TT
5424 CLASS="PARAMETER"
5425 ><I
5426 >client
5427                 code page</I
5428 ></TT
5429 ></A
5430 ></P
5431 ><P
5432 >Default: <B
5433 CLASS="COMMAND"
5434 >code page directory = ${prefix}/lib/codepages
5435                 </B
5436 ></P
5437 ><P
5438 >Example: <B
5439 CLASS="COMMAND"
5440 >code page directory = /usr/share/samba/codepages
5441                 </B
5442 ></P
5443 ></DD
5444 ><DT
5445 ><A
5446 NAME="CODINGSYSTEM"
5447 ></A
5448 >codingsystem (G)</DT
5449 ><DD
5450 ><P
5451 >This parameter is used to determine how incoming
5452                 Shift-JIS Japanese characters are mapped from the incoming <A
5453 HREF="#CLIENTCODEPAGE"
5454 ><TT
5455 CLASS="PARAMETER"
5456 ><I
5457 >client code page</I
5458 ></TT
5459 >
5460                 </A
5461 > used by the client, into file names in the UNIX filesystem.
5462                 Only useful if <TT
5463 CLASS="PARAMETER"
5464 ><I
5465 >client code page</I
5466 ></TT
5467 > is set to
5468                 932 (Japanese Shift-JIS).  The options are :</P
5469 ><P
5470 ></P
5471 ><UL
5472 ><LI
5473 ><P
5474 ><TT
5475 CLASS="CONSTANT"
5476 >SJIS</TT
5477 >  - Shift-JIS. Does no
5478                         conversion of the incoming filename.</P
5479 ></LI
5480 ><LI
5481 ><P
5482 ><TT
5483 CLASS="CONSTANT"
5484 >JIS8, J8BB, J8BH, J8@B,
5485                         J8@J, J8@H </TT
5486 > - Convert from incoming Shift-JIS to eight
5487                         bit JIS code with different shift-in, shift out codes.</P
5488 ></LI
5489 ><LI
5490 ><P
5491 ><TT
5492 CLASS="CONSTANT"
5493 >JIS7, J7BB, J7BH, J7@B, J7@J,
5494                         J7@H </TT
5495 > - Convert from incoming Shift-JIS to seven bit
5496                         JIS code with different shift-in, shift out codes.</P
5497 ></LI
5498 ><LI
5499 ><P
5500 ><TT
5501 CLASS="CONSTANT"
5502 >JUNET, JUBB, JUBH, JU@B, JU@J, JU@H </TT
5503 >
5504                         - Convert from incoming Shift-JIS to JUNET code with different shift-in,
5505                         shift out codes.</P
5506 ></LI
5507 ><LI
5508 ><P
5509 ><TT
5510 CLASS="CONSTANT"
5511 >EUC</TT
5512 > - Convert an incoming
5513                         Shift-JIS character to EUC code.</P
5514 ></LI
5515 ><LI
5516 ><P
5517 ><TT
5518 CLASS="CONSTANT"
5519 >HEX</TT
5520 > - Convert an incoming
5521                         Shift-JIS character to a 3 byte hex representation, i.e.
5522                         <TT
5523 CLASS="CONSTANT"
5524 >:AB</TT
5525 >.</P
5526 ></LI
5527 ><LI
5528 ><P
5529 ><TT
5530 CLASS="CONSTANT"
5531 >CAP</TT
5532 > - Convert an incoming
5533                         Shift-JIS character to the 3 byte hex representation used by
5534                         the Columbia AppleTalk Program (CAP), i.e. <TT
5535 CLASS="CONSTANT"
5536 >:AB</TT
5537 >.
5538                         This is used for compatibility between Samba and CAP.</P
5539 ></LI
5540 ></UL
5541 ><P
5542 >Default: <B
5543 CLASS="COMMAND"
5544 >coding system = &lt;empty value&gt;</B
5545 >
5546                 </P
5547 ></DD
5548 ><DT
5549 ><A
5550 NAME="COMMENT"
5551 ></A
5552 >comment (S)</DT
5553 ><DD
5554 ><P
5555 >This is a text field that is seen next to a share
5556                 when a client does a queries the server, either via the network
5557                 neighborhood or via <B
5558 CLASS="COMMAND"
5559 >net view</B
5560 > to list what shares
5561                 are available.</P
5562 ><P
5563 >If you want to set the string that is displayed next to the
5564                 machine name then see the <A
5565 HREF="#SERVERSTRING"
5566 ><TT
5567 CLASS="PARAMETER"
5568 ><I
5569 >               server string</I
5570 ></TT
5571 ></A
5572 > parameter.</P
5573 ><P
5574 >Default: <I
5575 CLASS="EMPHASIS"
5576 >No comment string</I
5577 ></P
5578 ><P
5579 >Example: <B
5580 CLASS="COMMAND"
5581 >comment = Fred's Files</B
5582 ></P
5583 ></DD
5584 ><DT
5585 ><A
5586 NAME="CONFIGFILE"
5587 ></A
5588 >config file (G)</DT
5589 ><DD
5590 ><P
5591 >This allows you to override the config file
5592                 to use, instead of the default (usually <TT
5593 CLASS="FILENAME"
5594 >smb.conf</TT
5595 >).
5596                 There is a chicken and egg problem here as this option is set
5597                 in the config file!</P
5598 ><P
5599 >For this reason, if the name of the config file has changed
5600                 when the parameters are loaded then it will reload them from
5601                 the new config file.</P
5602 ><P
5603 >This option takes the usual substitutions, which can
5604                 be very useful.</P
5605 ><P
5606 >If the config file doesn't exist then it won't be loaded
5607                 (allowing you to special case the config files of just a few
5608                 clients).</P
5609 ><P
5610 >Example: <B
5611 CLASS="COMMAND"
5612 >config file = /usr/local/samba/lib/smb.conf.%m
5613                 </B
5614 ></P
5615 ></DD
5616 ><DT
5617 ><A
5618 NAME="COPY"
5619 ></A
5620 >copy (S)</DT
5621 ><DD
5622 ><P
5623 >This parameter allows you to "clone" service
5624                 entries. The specified service is simply duplicated under the
5625                 current service's name. Any parameters specified in the current
5626                 section will override those in the section being copied.</P
5627 ><P
5628 >This feature lets you set up a 'template' service and
5629                 create similar services easily. Note that the service being
5630                 copied must occur earlier in the configuration file than the
5631                 service doing the copying.</P
5632 ><P
5633 >Default: <I
5634 CLASS="EMPHASIS"
5635 >no value</I
5636 ></P
5637 ><P
5638 >Example: <B
5639 CLASS="COMMAND"
5640 >copy = otherservice</B
5641 ></P
5642 ></DD
5643 ><DT
5644 ><A
5645 NAME="CREATEMASK"
5646 ></A
5647 >create mask (S)</DT
5648 ><DD
5649 ><P
5650 >A synonym for this parameter is
5651                 <A
5652 HREF="#CREATEMODE"
5653 ><TT
5654 CLASS="PARAMETER"
5655 ><I
5656 >create mode</I
5657 ></TT
5658 >
5659                 </A
5660 >.</P
5661 ><P
5662 >When a file is created, the necessary permissions are
5663                 calculated according to the mapping from DOS modes to UNIX
5664                 permissions, and the resulting UNIX mode is then bit-wise 'AND'ed
5665                 with this parameter. This parameter may be thought of as a bit-wise
5666                 MASK for the UNIX modes of a file. Any bit <I
5667 CLASS="EMPHASIS"
5668 >not</I
5669 >
5670                 set here will be removed from the modes set on a file when it is
5671                 created.</P
5672 ><P
5673 >The default value of this parameter removes the
5674                 'group' and 'other' write and execute bits from the UNIX modes.</P
5675 ><P
5676 >Following this Samba will bit-wise 'OR' the UNIX mode created
5677                 from this parameter with the value of the <A
5678 HREF="#FORCECREATEMODE"
5679 ><TT
5680 CLASS="PARAMETER"
5681 ><I
5682 >force create mode</I
5683 ></TT
5684 ></A
5685 >
5686                 parameter which is set to 000 by default.</P
5687 ><P
5688 >This parameter does not affect directory modes. See the
5689                 parameter <A
5690 HREF="#DIRECTORYMODE"
5691 ><TT
5692 CLASS="PARAMETER"
5693 ><I
5694 >directory mode
5695                 </I
5696 ></TT
5697 ></A
5698 > for details.</P
5699 ><P
5700 >See also the <A
5701 HREF="#FORCECREATEMODE"
5702 ><TT
5703 CLASS="PARAMETER"
5704 ><I
5705 >force
5706                 create mode</I
5707 ></TT
5708 ></A
5709 > parameter for forcing particular mode
5710                 bits to be set on created files. See also the <A
5711 HREF="#DIRECTORYMODE"
5712 >               <TT
5713 CLASS="PARAMETER"
5714 ><I
5715 >directory mode"</I
5716 ></TT
5717 ></A
5718 > parameter for masking
5719                 mode bits on created directories.  See also the <A
5720 HREF="#INHERITPERMISSIONS"
5721 >               <TT
5722 CLASS="PARAMETER"
5723 ><I
5724 >inherit permissions</I
5725 ></TT
5726 ></A
5727 > parameter.</P
5728 ><P
5729 >Default: <B
5730 CLASS="COMMAND"
5731 >create mask = 0744</B
5732 ></P
5733 ><P
5734 >Example: <B
5735 CLASS="COMMAND"
5736 >create mask = 0775</B
5737 ></P
5738 ></DD
5739 ><DT
5740 ><A
5741 NAME="CREATEMODE"
5742 ></A
5743 >create mode (S)</DT
5744 ><DD
5745 ><P
5746 >This is a synonym for <A
5747 HREF="#CREATEMASK"
5748 ><TT
5749 CLASS="PARAMETER"
5750 ><I
5751 >               create mask</I
5752 ></TT
5753 ></A
5754 >.</P
5755 ></DD
5756 ><DT
5757 ><A
5758 NAME="DEADTIME"
5759 ></A
5760 >deadtime (G)</DT
5761 ><DD
5762 ><P
5763 >The value of the parameter (a decimal integer)
5764                 represents the number of minutes of inactivity before a connection
5765                 is considered dead, and it is disconnected. The deadtime only takes
5766                 effect if the number of open files is zero.</P
5767 ><P
5768 >This is useful to stop a server's resources being
5769                 exhausted by a large number of inactive connections.</P
5770 ><P
5771 >Most clients have an auto-reconnect feature when a
5772                 connection is broken so in most cases this parameter should be
5773                 transparent to users.</P
5774 ><P
5775 >Using this parameter with a timeout of a few minutes
5776                 is recommended for most systems.</P
5777 ><P
5778 >A deadtime of zero indicates that no auto-disconnection
5779                 should be performed.</P
5780 ><P
5781 >Default: <B
5782 CLASS="COMMAND"
5783 >deadtime = 0</B
5784 ></P
5785 ><P
5786 >Example: <B
5787 CLASS="COMMAND"
5788 >deadtime = 15</B
5789 ></P
5790 ></DD
5791 ><DT
5792 ><A
5793 NAME="DEBUGHIRESTIMESTAMP"
5794 ></A
5795 >debug hires timestamp (G)</DT
5796 ><DD
5797 ><P
5798 >Sometimes the timestamps in the log messages
5799                 are needed with a resolution of higher that seconds, this
5800                 boolean parameter adds microsecond resolution to the timestamp
5801                 message header when turned on.</P
5802 ><P
5803 >Note that the parameter <A
5804 HREF="#DEBUGTIMESTAMP"
5805 ><TT
5806 CLASS="PARAMETER"
5807 ><I
5808 >               debug timestamp</I
5809 ></TT
5810 ></A
5811 > must be on for this to have an
5812                 effect.</P
5813 ><P
5814 >Default: <B
5815 CLASS="COMMAND"
5816 >debug hires timestamp = no</B
5817 ></P
5818 ></DD
5819 ><DT
5820 ><A
5821 NAME="DEBUGPID"
5822 ></A
5823 >debug pid (G)</DT
5824 ><DD
5825 ><P
5826 >When using only one log file for more then one
5827                 forked smbd-process there may be hard to follow which process
5828                 outputs which message. This boolean parameter is adds the process-id
5829                 to the timestamp message headers in the logfile when turned on.</P
5830 ><P
5831 >Note that the parameter <A
5832 HREF="#DEBUGTIMESTAMP"
5833 ><TT
5834 CLASS="PARAMETER"
5835 ><I
5836 >               debug timestamp</I
5837 ></TT
5838 ></A
5839 > must be on for this to have an
5840                 effect.</P
5841 ><P
5842 >Default: <B
5843 CLASS="COMMAND"
5844 >debug pid = no</B
5845 ></P
5846 ></DD
5847 ><DT
5848 ><A
5849 NAME="DEBUGTIMESTAMP"
5850 ></A
5851 >debug timestamp (G)</DT
5852 ><DD
5853 ><P
5854 >Samba 2.2 debug log messages are timestamped
5855                 by default. If you are running at a high <A
5856 HREF="#DEBUGLEVEL"
5857 >               <TT
5858 CLASS="PARAMETER"
5859 ><I
5860 >debug level</I
5861 ></TT
5862 ></A
5863 > these timestamps
5864                 can be distracting. This boolean parameter allows timestamping
5865                 to be turned off.</P
5866 ><P
5867 >Default: <B
5868 CLASS="COMMAND"
5869 >debug timestamp = yes</B
5870 ></P
5871 ></DD
5872 ><DT
5873 ><A
5874 NAME="DEBUGUID"
5875 ></A
5876 >debug uid (G)</DT
5877 ><DD
5878 ><P
5879 >Samba is sometimes run as root and sometime
5880                 run as the connected user, this boolean parameter inserts the
5881                 current euid, egid, uid and gid to the timestamp message headers
5882                 in the log file if turned on.</P
5883 ><P
5884 >Note that the parameter <A
5885 HREF="#DEBUGTIMESTAMP"
5886 ><TT
5887 CLASS="PARAMETER"
5888 ><I
5889 >               debug timestamp</I
5890 ></TT
5891 ></A
5892 > must be on for this to have an
5893                 effect.</P
5894 ><P
5895 >Default: <B
5896 CLASS="COMMAND"
5897 >debug uid = no</B
5898 ></P
5899 ></DD
5900 ><DT
5901 ><A
5902 NAME="DEBUGLEVEL"
5903 ></A
5904 >debuglevel (G)</DT
5905 ><DD
5906 ><P
5907 >The value of the parameter (an integer) allows
5908                 the debug level (logging level) to be specified in the
5909                 <TT
5910 CLASS="FILENAME"
5911 >smb.conf</TT
5912 > file. This is to give greater
5913                 flexibility in the configuration of the system.</P
5914 ><P
5915 >The default will be the debug level specified on
5916                 the command line or level zero if none was specified.</P
5917 ><P
5918 >Example: <B
5919 CLASS="COMMAND"
5920 >debug level = 3</B
5921 ></P
5922 ></DD
5923 ><DT
5924 ><A
5925 NAME="DEFAULT"
5926 ></A
5927 >default (G)</DT
5928 ><DD
5929 ><P
5930 >A synonym for <A
5931 HREF="#DEFAULTSERVICE"
5932 ><TT
5933 CLASS="PARAMETER"
5934 ><I
5935 >               default service</I
5936 ></TT
5937 ></A
5938 >.</P
5939 ></DD
5940 ><DT
5941 ><A
5942 NAME="DEFAULTCASE"
5943 ></A
5944 >default case (S)</DT
5945 ><DD
5946 ><P
5947 >See the section on <A
5948 HREF="#AEN201"
5949 >               NAME MANGLING</A
5950 >. Also note the <A
5951 HREF="#SHORTPRESERVECASE"
5952 >               <TT
5953 CLASS="PARAMETER"
5954 ><I
5955 >short preserve case"</I
5956 ></TT
5957 ></A
5958 > parameter.</P
5959 ><P
5960 >Default: <B
5961 CLASS="COMMAND"
5962 >default case = lower</B
5963 ></P
5964 ></DD
5965 ><DT
5966 ><A
5967 NAME="DEFAULTSERVICE"
5968 ></A
5969 >default service (G)</DT
5970 ><DD
5971 ><P
5972 >This parameter specifies the name of a service
5973                 which will be connected to if the service actually requested cannot
5974                 be found. Note that the square brackets are <I
5975 CLASS="EMPHASIS"
5976 >NOT</I
5977 >
5978                 given in the parameter value (see example below).</P
5979 ><P
5980 >There is no default value for this parameter. If this
5981                 parameter is not given, attempting to connect to a nonexistent
5982                 service results in an error.</P
5983 ><P
5984 >Typically the default service would be a <A
5985 HREF="#GUESTOK"
5986 >               <TT
5987 CLASS="PARAMETER"
5988 ><I
5989 >guest ok</I
5990 ></TT
5991 ></A
5992 >, <A
5993 HREF="#READONLY"
5994 >               <TT
5995 CLASS="PARAMETER"
5996 ><I
5997 >read-only</I
5998 ></TT
5999 ></A
6000 > service.</P
6001 ><P
6002 >Also note that the apparent service name will be changed
6003                 to equal that of the requested service, this is very useful as it
6004                 allows you to use macros like <TT
6005 CLASS="PARAMETER"
6006 ><I
6007 >%S</I
6008 ></TT
6009 > to make
6010                 a wildcard service.</P
6011 ><P
6012 >Note also that any "_" characters in the name of the service
6013                 used in the default service will get mapped to a "/". This allows for
6014                 interesting things.</P
6015 ><P
6016 >Example:</P
6017 ><P
6018 ><PRE
6019 CLASS="PROGRAMLISTING"
6020 >[global]
6021         default service = pub
6022
6023 [pub]
6024         path = /%S
6025                 </PRE
6026 ></P
6027 ></DD
6028 ><DT
6029 ><A
6030 NAME="DELETEREADONLY"
6031 ></A
6032 >delete readonly (S)</DT
6033 ><DD
6034 ><P
6035 >This parameter allows readonly files to be deleted.
6036                 This is not normal DOS semantics, but is allowed by UNIX.</P
6037 ><P
6038 >This option may be useful for running applications such
6039                 as rcs, where UNIX file ownership prevents changing file
6040                 permissions, and DOS semantics prevent deletion of a read only file.</P
6041 ><P
6042 >Default: <B
6043 CLASS="COMMAND"
6044 >delete readonly = no</B
6045 ></P
6046 ></DD
6047 ><DT
6048 ><A
6049 NAME="DELETEUSERSCRIPT"
6050 ></A
6051 >delete user script (G)</DT
6052 ><DD
6053 ><P
6054 >This is the full pathname to a script that will
6055                 be run <I
6056 CLASS="EMPHASIS"
6057 >AS ROOT</I
6058 > by <A
6059 HREF="smbd.8.html"
6060 TARGET="_top"
6061 >               <B
6062 CLASS="COMMAND"
6063 >smbd(8)</B
6064 ></A
6065 > under special circumstances
6066                 described below.</P
6067 ><P
6068 >Normally, a Samba server requires that UNIX users are
6069                 created for all users accessing files on this server. For sites
6070                 that use Windows NT account databases as their primary user database
6071                 creating these users and keeping the user list in sync with the
6072                 Windows NT PDC is an onerous task. This option allows <B
6073 CLASS="COMMAND"
6074 >               smbd</B
6075 > to delete the required UNIX users <I
6076 CLASS="EMPHASIS"
6077 >ON
6078                 DEMAND</I
6079 > when a user accesses the Samba server and the
6080                 Windows NT user no longer exists.</P
6081 ><P
6082 >In order to use this option, <B
6083 CLASS="COMMAND"
6084 >smbd</B
6085 > must be
6086                 set to <TT
6087 CLASS="PARAMETER"
6088 ><I
6089 >security=domain</I
6090 ></TT
6091 > and <TT
6092 CLASS="PARAMETER"
6093 ><I
6094 >delete
6095                 user script</I
6096 ></TT
6097 > must be set to a full pathname for a script
6098                 that will delete a UNIX user given one argument of <TT
6099 CLASS="PARAMETER"
6100 ><I
6101 >%u
6102                 </I
6103 ></TT
6104 >, which expands into the UNIX user name to delete.
6105                 <I
6106 CLASS="EMPHASIS"
6107 >NOTE</I
6108 > that this is different to the <A
6109 HREF="#ADDUSERSCRIPT"
6110 ><TT
6111 CLASS="PARAMETER"
6112 ><I
6113 >add user script</I
6114 ></TT
6115 ></A
6116 >
6117                 which will work with the <TT
6118 CLASS="PARAMETER"
6119 ><I
6120 >security=server</I
6121 ></TT
6122 > option
6123                 as well as <TT
6124 CLASS="PARAMETER"
6125 ><I
6126 >security=domain</I
6127 ></TT
6128 >. The reason for this
6129                 is only when Samba is a domain member does it get the information
6130                 on an attempted user logon that a user no longer exists. In the
6131                 <TT
6132 CLASS="PARAMETER"
6133 ><I
6134 >security=server</I
6135 ></TT
6136 > mode a missing user
6137                 is treated the same as an invalid password logon attempt. Deleting
6138                 the user in this circumstance would not be a good idea.</P
6139 ><P
6140 >When the Windows user attempts to access the Samba server,
6141                 at <I
6142 CLASS="EMPHASIS"
6143 >login</I
6144 > (session setup in the SMB protocol)
6145                 time, <B
6146 CLASS="COMMAND"
6147 >smbd</B
6148 > contacts the <A
6149 HREF="#PASSWORDSERVER"
6150 >               <TT
6151 CLASS="PARAMETER"
6152 ><I
6153 >password server</I
6154 ></TT
6155 ></A
6156 > and attempts to authenticate
6157                 the given user with the given password. If the authentication fails
6158                 with the specific Domain error code meaning that the user no longer
6159                 exists then <B
6160 CLASS="COMMAND"
6161 >smbd</B
6162 > attempts to find a UNIX user in
6163                 the UNIX password database that matches the Windows user account. If
6164                 this lookup succeeds, and <TT
6165 CLASS="PARAMETER"
6166 ><I
6167 >delete user script</I
6168 ></TT
6169 > is
6170                 set then <B
6171 CLASS="COMMAND"
6172 >smbd</B
6173 > will all the specified script
6174                 <I
6175 CLASS="EMPHASIS"
6176 >AS ROOT</I
6177 >, expanding any <TT
6178 CLASS="PARAMETER"
6179 ><I
6180 >%u</I
6181 ></TT
6182 >
6183                 argument to be the user name to delete.</P
6184 ><P
6185 >This script should delete the given UNIX username. In this way,
6186                 UNIX users are dynamically deleted to match existing Windows NT
6187                 accounts.</P
6188 ><P
6189 >See also <A
6190 HREF="#SECURITYEQUALSDOMAIN"
6191 >security=domain</A
6192 >,
6193                 <A
6194 HREF="#PASSWORDSERVER"
6195 ><TT
6196 CLASS="PARAMETER"
6197 ><I
6198 >password server</I
6199 ></TT
6200 >
6201                 </A
6202 >, <A
6203 HREF="#ADDUSERSCRIPT"
6204 ><TT
6205 CLASS="PARAMETER"
6206 ><I
6207 >add user script</I
6208 ></TT
6209 >
6210                 </A
6211 >.</P
6212 ><P
6213 >Default: <B
6214 CLASS="COMMAND"
6215 >delete user script = &lt;empty string&gt;
6216                 </B
6217 ></P
6218 ><P
6219 >Example: <B
6220 CLASS="COMMAND"
6221 >delete user script = /usr/local/samba/bin/del_user
6222                 %u</B
6223 ></P
6224 ></DD
6225 ><DT
6226 ><A
6227 NAME="DELETEPRINTERCOMMAND"
6228 ></A
6229 >deleteprinter command (G)</DT
6230 ><DD
6231 ><P
6232 >With the introduction of MS-RPC based printer
6233                 support for Windows NT/2000 clients in Samba 2.2, it is now
6234                 possible to delete printer at run time by issuing the
6235                 DeletePrinter() RPC call.</P
6236 ><P
6237 >For a Samba host this means that the printer must be
6238                 physically deleted from underlying printing system.  The <TT
6239 CLASS="PARAMETER"
6240 ><I
6241 >               deleteprinter command</I
6242 ></TT
6243 > defines a script to be run which
6244                 will perform the necessary operations for removing the printer
6245                 from the print system and from <TT
6246 CLASS="FILENAME"
6247 >smb.conf</TT
6248 >.
6249                 </P
6250 ><P
6251 >The <TT
6252 CLASS="PARAMETER"
6253 ><I
6254 >deleteprinter command</I
6255 ></TT
6256 > is
6257                 automatically called with only one parameter: <TT
6258 CLASS="PARAMETER"
6259 ><I
6260 >               "printer name"</I
6261 ></TT
6262 >.</P
6263 ><P
6264 >Once the <TT
6265 CLASS="PARAMETER"
6266 ><I
6267 >deleteprinter command</I
6268 ></TT
6269 > has
6270                 been executed, <B
6271 CLASS="COMMAND"
6272 >smbd</B
6273 > will reparse the <TT
6274 CLASS="FILENAME"
6275 >               smb.conf</TT
6276 > to associated printer no longer exists.
6277                 If the sharename is still valid, then <B
6278 CLASS="COMMAND"
6279 >smbd
6280                 </B
6281 > will return an ACCESS_DENIED error to the client.</P
6282 ><P
6283 >See also <A
6284 HREF="#ADDPRINTERCOMMAND"
6285 ><TT
6286 CLASS="PARAMETER"
6287 ><I
6288 >               addprinter command</I
6289 ></TT
6290 ></A
6291 >, <A
6292 HREF="#PRINTING"
6293 ><TT
6294 CLASS="PARAMETER"
6295 ><I
6296 >printing</I
6297 ></TT
6298 ></A
6299 >,
6300                 <A
6301 HREF="#SHOWADDPRINTERWIZARD"
6302 ><TT
6303 CLASS="PARAMETER"
6304 ><I
6305 >show add
6306                 printer wizard</I
6307 ></TT
6308 ></A
6309 ></P
6310 ><P
6311 >Default: <I
6312 CLASS="EMPHASIS"
6313 >none</I
6314 ></P
6315 ><P
6316 >Example: <B
6317 CLASS="COMMAND"
6318 >deleteprinter command = /usr/bin/removeprinter
6319                 </B
6320 ></P
6321 ></DD
6322 ><DT
6323 ><A
6324 NAME="DELETEVETOFILES"
6325 ></A
6326 >delete veto files (S)</DT
6327 ><DD
6328 ><P
6329 >This option is used when Samba is attempting to
6330                 delete a directory that contains one or more vetoed directories
6331                 (see the <A
6332 HREF="#VETOFILES"
6333 ><TT
6334 CLASS="PARAMETER"
6335 ><I
6336 >veto files</I
6337 ></TT
6338 ></A
6339 >
6340                 option).  If this option is set to False (the default) then if a vetoed
6341                 directory contains any non-vetoed files or directories then the
6342                 directory delete will fail. This is usually what you want.</P
6343 ><P
6344 >If this option is set to <TT
6345 CLASS="CONSTANT"
6346 >True</TT
6347 >, then Samba
6348                 will attempt to recursively delete any files and directories within
6349                 the vetoed directory. This can be useful for integration with file
6350                 serving systems such as NetAtalk which create meta-files within
6351                 directories you might normally veto DOS/Windows users from seeing
6352                 (e.g. <TT
6353 CLASS="FILENAME"
6354 >.AppleDouble</TT
6355 >)</P
6356 ><P
6357 >Setting <B
6358 CLASS="COMMAND"
6359 >delete veto files = yes</B
6360 > allows these
6361                 directories to be  transparently deleted when the parent directory
6362                 is deleted (so long as the user has permissions to do so).</P
6363 ><P
6364 >See also the <A
6365 HREF="#VETOFILES"
6366 ><TT
6367 CLASS="PARAMETER"
6368 ><I
6369 >veto
6370                 files</I
6371 ></TT
6372 ></A
6373 > parameter.</P
6374 ><P
6375 >Default: <B
6376 CLASS="COMMAND"
6377 >delete veto files = no</B
6378 ></P
6379 ></DD
6380 ><DT
6381 ><A
6382 NAME="DENYHOSTS"
6383 ></A
6384 >deny hosts (S)</DT
6385 ><DD
6386 ><P
6387 >Synonym for <A
6388 HREF="#HOSTSDENY"
6389 ><TT
6390 CLASS="PARAMETER"
6391 ><I
6392 >hosts
6393                 deny</I
6394 ></TT
6395 ></A
6396 >.</P
6397 ></DD
6398 ><DT
6399 ><A
6400 NAME="DFREECOMMAND"
6401 ></A
6402 >dfree command (G)</DT
6403 ><DD
6404 ><P
6405 >The <TT
6406 CLASS="PARAMETER"
6407 ><I
6408 >dfree command</I
6409 ></TT
6410 > setting should
6411                 only be used on systems where a problem occurs with the internal
6412                 disk space calculations. This has been known to happen with Ultrix,
6413                 but may occur with other operating systems. The symptom that was
6414                 seen was an error of "Abort Retry Ignore" at the end of each
6415                 directory listing.</P
6416 ><P
6417 >This setting allows the replacement of the internal routines to
6418                 calculate the total disk space and amount available with an external
6419                 routine. The example below gives a possible script that might fulfill
6420                 this function.</P
6421 ><P
6422 >The external program will be passed a single parameter indicating
6423                 a directory in the filesystem being queried. This will typically consist
6424                 of the string <TT
6425 CLASS="FILENAME"
6426 >./</TT
6427 >. The script should return two
6428                 integers in ASCII. The first should be the total disk space in blocks,
6429                 and the second should be the number of available blocks. An optional
6430                 third return value can give the block size in bytes. The default
6431                 blocksize is 1024 bytes.</P
6432 ><P
6433 >Note: Your script should <I
6434 CLASS="EMPHASIS"
6435 >NOT</I
6436 > be setuid or
6437                 setgid and should be owned by (and writeable only by) root!</P
6438 ><P
6439 >Default: <I
6440 CLASS="EMPHASIS"
6441 >By default internal routines for
6442                 determining the disk capacity and remaining space will be used.
6443                 </I
6444 ></P
6445 ><P
6446 >Example: <B
6447 CLASS="COMMAND"
6448 >dfree command = /usr/local/samba/bin/dfree
6449                 </B
6450 ></P
6451 ><P
6452 >Where the script dfree (which must be made executable) could be:</P
6453 ><P
6454 ><PRE
6455 CLASS="PROGRAMLISTING"
6456 >
6457                 #!/bin/sh
6458                 df $1 | tail -1 | awk '{print $2" "$4}'
6459                 </PRE
6460 ></P
6461 ><P
6462 >or perhaps (on Sys V based systems):</P
6463 ><P
6464 ><PRE
6465 CLASS="PROGRAMLISTING"
6466 >
6467                 #!/bin/sh
6468                 /usr/bin/df -k $1 | tail -1 | awk '{print $3" "$5}'
6469                 </PRE
6470 ></P
6471 ><P
6472 >Note that you may have to replace the command names
6473                 with full path names on some systems.</P
6474 ></DD
6475 ><DT
6476 ><A
6477 NAME="DIRECTORY"
6478 ></A
6479 >directory (S)</DT
6480 ><DD
6481 ><P
6482 >Synonym for <A
6483 HREF="#PATH"
6484 ><TT
6485 CLASS="PARAMETER"
6486 ><I
6487 >path
6488                 </I
6489 ></TT
6490 ></A
6491 >.</P
6492 ></DD
6493 ><DT
6494 ><A
6495 NAME="DIRECTORYMASK"
6496 ></A
6497 >directory mask (S)</DT
6498 ><DD
6499 ><P
6500 >This parameter is the octal modes which are
6501                 used when converting DOS modes to UNIX modes when creating UNIX
6502                 directories.</P
6503 ><P
6504 >When a directory is created, the necessary permissions are
6505                 calculated according to the mapping from DOS modes to UNIX permissions,
6506                 and the resulting UNIX mode is then bit-wise 'AND'ed with this
6507                 parameter. This parameter may be thought of as a bit-wise MASK for
6508                 the UNIX modes of a directory. Any bit <I
6509 CLASS="EMPHASIS"
6510 >not</I
6511 > set
6512                 here will be removed from the modes set on a directory when it is
6513                 created.</P
6514 ><P
6515 >The default value of this parameter removes the 'group'
6516                 and 'other' write bits from the UNIX mode, allowing only the
6517                 user who owns the directory to modify it.</P
6518 ><P
6519 >Following this Samba will bit-wise 'OR' the UNIX mode
6520                 created from this parameter with the value of the <A
6521 HREF="#FORCEDIRECTORYMODE"
6522 ><TT
6523 CLASS="PARAMETER"
6524 ><I
6525 >force directory mode
6526                 </I
6527 ></TT
6528 ></A
6529 > parameter. This parameter is set to 000 by
6530                 default (i.e. no extra mode bits are added).</P
6531 ><P
6532 >See the <A
6533 HREF="#FORCEDIRECTORYMODE"
6534 ><TT
6535 CLASS="PARAMETER"
6536 ><I
6537 >force
6538                 directory mode</I
6539 ></TT
6540 ></A
6541 > parameter to cause particular mode
6542                 bits to always be set on created directories.</P
6543 ><P
6544 >See also the <A
6545 HREF="#CREATEMODE"
6546 ><TT
6547 CLASS="PARAMETER"
6548 ><I
6549 >create mode
6550                 </I
6551 ></TT
6552 ></A
6553 > parameter for masking mode bits on created files,
6554                 and the <A
6555 HREF="#DIRECTORYSECURITYMASK"
6556 ><TT
6557 CLASS="PARAMETER"
6558 ><I
6559 >directory
6560                 security mask</I
6561 ></TT
6562 ></A
6563 > parameter.</P
6564 ><P
6565 >Also refer to the <A
6566 HREF="#INHERITPERMISSIONS"
6567 ><TT
6568 CLASS="PARAMETER"
6569 ><I
6570 >               inherit permissions</I
6571 ></TT
6572 ></A
6573 > parameter.</P
6574 ><P
6575 >Default: <B
6576 CLASS="COMMAND"
6577 >directory mask = 0755</B
6578 ></P
6579 ><P
6580 >Example: <B
6581 CLASS="COMMAND"
6582 >directory mask = 0775</B
6583 ></P
6584 ></DD
6585 ><DT
6586 ><A
6587 NAME="DIRECTORYMODE"
6588 ></A
6589 >directory mode (S)</DT
6590 ><DD
6591 ><P
6592 >Synonym for <A
6593 HREF="#DIRECTORYMASK"
6594 ><TT
6595 CLASS="PARAMETER"
6596 ><I
6597 >               directory mask</I
6598 ></TT
6599 ></A
6600 ></P
6601 ></DD
6602 ><DT
6603 ><A
6604 NAME="DIRECTORYSECURITYMASK"
6605 ></A
6606 >directory security mask (S)</DT
6607 ><DD
6608 ><P
6609 >This parameter controls what UNIX permission bits
6610                 can be modified when a Windows NT client is manipulating the UNIX
6611                 permission on a directory using the native NT security dialog
6612                 box.</P
6613 ><P
6614 >This parameter is applied as a mask (AND'ed with) to
6615                 the changed permission bits, thus preventing any bits not in
6616                 this mask from being modified. Essentially, zero bits in this
6617                 mask may be treated as a set of bits the user is not allowed
6618                 to change.</P
6619 ><P
6620 >If not set explicitly this parameter is set to the same
6621                 value as the <A
6622 HREF="#DIRECTORYMASK"
6623 ><TT
6624 CLASS="PARAMETER"
6625 ><I
6626 >directory
6627                 mask</I
6628 ></TT
6629 ></A
6630 > parameter. To allow a user to
6631                 modify all the user/group/world permissions on a directory, set
6632                 this parameter to 0777.</P
6633 ><P
6634 ><I
6635 CLASS="EMPHASIS"
6636 >Note</I
6637 > that users who can access the
6638                 Samba server through other means can easily bypass this restriction,
6639                 so it is primarily useful for standalone "appliance" systems.
6640                 Administrators of most normal systems will probably want to set
6641                 it to 0777.</P
6642 ><P
6643 >See also the <A
6644 HREF="#FORCEDIRECTORYSECURITYMODE"
6645 ><TT
6646 CLASS="PARAMETER"
6647 ><I
6648 >               force directory security mode</I
6649 ></TT
6650 ></A
6651 >, <A
6652 HREF="#SECURITYMASK"
6653 ><TT
6654 CLASS="PARAMETER"
6655 ><I
6656 >security mask</I
6657 ></TT
6658 ></A
6659 >,
6660                 <A
6661 HREF="#FORCESECURITYMODE"
6662 ><TT
6663 CLASS="PARAMETER"
6664 ><I
6665 >force security mode
6666                 </I
6667 ></TT
6668 ></A
6669 > parameters.</P
6670 ><P
6671 >Default: <B
6672 CLASS="COMMAND"
6673 >directory security mask = &lt;same as
6674                 directory mask&gt;</B
6675 ></P
6676 ><P
6677 >Example: <B
6678 CLASS="COMMAND"
6679 >directory security mask = 0777</B
6680 ></P
6681 ></DD
6682 ><DT
6683 ><A
6684 NAME="DNSPROXY"
6685 ></A
6686 >dns proxy (G)</DT
6687 ><DD
6688 ><P
6689 >Specifies that <A
6690 HREF="nmbd.8.html"
6691 TARGET="_top"
6692 >nmbd(8)</A
6693 >
6694                 when acting as a WINS server and finding that a NetBIOS name has not
6695                 been registered, should treat the NetBIOS name word-for-word as a DNS
6696                 name and do a lookup with the DNS server for that name on behalf of
6697                 the name-querying client.</P
6698 ><P
6699 >Note that the maximum length for a NetBIOS name is 15
6700                 characters, so the DNS name (or DNS alias) can likewise only be
6701                 15 characters, maximum.</P
6702 ><P
6703 ><B
6704 CLASS="COMMAND"
6705 >nmbd</B
6706 > spawns a second copy of itself to do the
6707                 DNS name lookup requests, as doing a name lookup is a blocking
6708                 action.</P
6709 ><P
6710 >See also the parameter <A
6711 HREF="#WINSSUPPORT"
6712 ><TT
6713 CLASS="PARAMETER"
6714 ><I
6715 >               wins support</I
6716 ></TT
6717 ></A
6718 >.</P
6719 ><P
6720 >Default: <B
6721 CLASS="COMMAND"
6722 >dns proxy = yes</B
6723 ></P
6724 ></DD
6725 ><DT
6726 ><A
6727 NAME="DOMAINADMINGROUP"
6728 ></A
6729 >domain admin group (G)</DT
6730 ><DD
6731 ><P
6732 >This is an <I
6733 CLASS="EMPHASIS"
6734 >EXPERIMENTAL</I
6735 > parameter
6736                 that is part of the unfinished Samba NT Domain Controller Code. It may
6737                 be removed in a later release. To work with the latest code builds
6738                 that may have more support for Samba NT Domain Controller functionality
6739                 please subscribe to the mailing list <A
6740 HREF="mailto:samba-ntdom@samba.org"
6741 TARGET="_top"
6742 >samba-ntdom</A
6743 > available by
6744                 visiting the web page at <A
6745 HREF="http://lists.samba.org/"
6746 TARGET="_top"
6747 >               http://lists.samba.org/</A
6748 >.</P
6749 ></DD
6750 ><DT
6751 ><A
6752 NAME="DOMAINADMINUSERS"
6753 ></A
6754 >domain admin users (G)</DT
6755 ><DD
6756 ><P
6757 >This is an <I
6758 CLASS="EMPHASIS"
6759 >EXPERIMENTAL</I
6760 > parameter
6761                 that is part of the unfinished Samba NT Domain Controller Code. It may
6762                 be removed in a later release. To work with the latest code builds
6763                 that may have more support for Samba NT Domain Controller functionality
6764                 please subscribe to the mailing list <A
6765 HREF="mailto:samba-ntdom@samba.org"
6766 TARGET="_top"
6767 >samba-ntdom</A
6768 > available by
6769                 visiting the web page at <A
6770 HREF="http://lists.samba.org/"
6771 TARGET="_top"
6772 >               http://lists.samba.org/</A
6773 >.</P
6774 ></DD
6775 ><DT
6776 ><A
6777 NAME="DOMAINGROUPS"
6778 ></A
6779 >domain groups (G)</DT
6780 ><DD
6781 ><P
6782 >This is an <I
6783 CLASS="EMPHASIS"
6784 >EXPERIMENTAL</I
6785 > parameter
6786                 that is part of the unfinished Samba NT Domain Controller Code. It may
6787                 be removed in a later release. To work with the latest code builds
6788                 that may have more support for Samba NT Domain Controller functionality
6789                 please subscribe to the mailing list <A
6790 HREF="mailto:samba-ntdom@samba.org"
6791 TARGET="_top"
6792 >samba-ntdom</A
6793 > available by
6794                 visiting the web page at <A
6795 HREF="http://lists.samba.org/"
6796 TARGET="_top"
6797 >               http://lists.samba.org/</A
6798 >.</P
6799 ></DD
6800 ><DT
6801 ><A
6802 NAME="DOMAINGUESTGROUP"
6803 ></A
6804 >domain guest group (G)</DT
6805 ><DD
6806 ><P
6807 >This is an <I
6808 CLASS="EMPHASIS"
6809 >EXPERIMENTAL</I
6810 > parameter
6811                 that is part of the unfinished Samba NT Domain Controller Code. It may
6812                 be removed in a later release. To work with the latest code builds
6813                 that may have more support for Samba NT Domain Controller functionality
6814                 please subscribe to the mailing list <A
6815 HREF="mailto:samba-ntdom@samba.org"
6816 TARGET="_top"
6817 >samba-ntdom</A
6818 > available by
6819                 visiting the web page at <A
6820 HREF="http://lists.samba.org/"
6821 TARGET="_top"
6822 >               http://lists.samba.org/</A
6823 >.</P
6824 ></DD
6825 ><DT
6826 ><A
6827 NAME="DOMAINGUESTUSERS"
6828 ></A
6829 >domain guest users (G)</DT
6830 ><DD
6831 ><P
6832 >This is an <I
6833 CLASS="EMPHASIS"
6834 >EXPERIMENTAL</I
6835 > parameter
6836                 that is part of the unfinished Samba NT Domain Controller Code. It may
6837                 be removed in a later release. To work with the latest code builds
6838                 that may have more support for Samba NT Domain Controller functionality
6839                 please subscribe to the mailing list <A
6840 HREF="mailto:samba-ntdom@samba.org"
6841 TARGET="_top"
6842 >samba-ntdom</A
6843 > available by
6844                 visiting the web page at <A
6845 HREF="http://lists.samba.org/"
6846 TARGET="_top"
6847 >               http://lists.samba.org/</A
6848 >.</P
6849 ></DD
6850 ><DT
6851 ><A
6852 NAME="DOMAINLOGONS"
6853 ></A
6854 >domain logons (G)</DT
6855 ><DD
6856 ><P
6857 >If set to true, the Samba server will serve
6858                 Windows 95/98 Domain logons for the <A
6859 HREF="#WORKGROUP"
6860 >               <TT
6861 CLASS="PARAMETER"
6862 ><I
6863 >workgroup</I
6864 ></TT
6865 ></A
6866 > it is in. Samba 2.2 also
6867                 has limited capability to act as a domain controller for Windows
6868                 NT 4 Domains.  For more details on setting up this feature see
6869                 the file DOMAINS.txt in the Samba documentation directory <TT
6870 CLASS="FILENAME"
6871 >docs/
6872                 </TT
6873 > shipped with the source code.</P
6874 ><P
6875 >Default: <B
6876 CLASS="COMMAND"
6877 >domain logons = no</B
6878 ></P
6879 ></DD
6880 ><DT
6881 ><A
6882 NAME="DOMAINMASTER"
6883 ></A
6884 >domain master (G)</DT
6885 ><DD
6886 ><P
6887 >Tell <A
6888 HREF="nmbd.8.html"
6889 TARGET="_top"
6890 ><B
6891 CLASS="COMMAND"
6892 >               nmbd(8)</B
6893 ></A
6894 > to enable WAN-wide browse list
6895                 collation. Setting this option causes <B
6896 CLASS="COMMAND"
6897 >nmbd</B
6898 > to
6899                 claim a special domain specific NetBIOS name that identifies
6900                 it as a domain master browser for its given <A
6901 HREF="#WORKGROUP"
6902 >               <TT
6903 CLASS="PARAMETER"
6904 ><I
6905 >workgroup</I
6906 ></TT
6907 ></A
6908 >. Local master browsers
6909                 in the same <TT
6910 CLASS="PARAMETER"
6911 ><I
6912 >workgroup</I
6913 ></TT
6914 > on broadcast-isolated
6915                 subnets will give this <B
6916 CLASS="COMMAND"
6917 >nmbd</B
6918 > their local browse lists,
6919                 and then ask <A
6920 HREF="smbd.8.html"
6921 TARGET="_top"
6922 ><B
6923 CLASS="COMMAND"
6924 >smbd(8)</B
6925 ></A
6926 >
6927                 for a complete copy of the browse list for the whole wide area
6928                 network.  Browser clients will then contact their local master browser,
6929                 and will receive the domain-wide browse list, instead of just the list
6930                 for their broadcast-isolated subnet.</P
6931 ><P
6932 >Note that Windows NT Primary Domain Controllers expect to be
6933                 able to claim this <TT
6934 CLASS="PARAMETER"
6935 ><I
6936 >workgroup</I
6937 ></TT
6938 > specific special
6939                 NetBIOS name that identifies them as domain master browsers for
6940                 that <TT
6941 CLASS="PARAMETER"
6942 ><I
6943 >workgroup</I
6944 ></TT
6945 > by default (i.e. there is no
6946                 way to prevent a Windows NT PDC from attempting to do this). This
6947                 means that if this parameter is set and <B
6948 CLASS="COMMAND"
6949 >nmbd</B
6950 > claims
6951                 the special name for a <TT
6952 CLASS="PARAMETER"
6953 ><I
6954 >workgroup</I
6955 ></TT
6956 > before a Windows
6957                 NT PDC is able to do so then cross subnet browsing will behave
6958                 strangely and may fail.</P
6959 ><P
6960 >If <A
6961 HREF="#DOMAINLOGONS"
6962 ><B
6963 CLASS="COMMAND"
6964 >domain logons = yes</B
6965 >
6966                 </A
6967 >, then the default behavior is to enable the <TT
6968 CLASS="PARAMETER"
6969 ><I
6970 >domain
6971                 master</I
6972 ></TT
6973 > parameter.  If <TT
6974 CLASS="PARAMETER"
6975 ><I
6976 >domain logons</I
6977 ></TT
6978 > is
6979                 not enabled (the default setting), then neither will <TT
6980 CLASS="PARAMETER"
6981 ><I
6982 >domain
6983                 master</I
6984 ></TT
6985 > be enabled by default.</P
6986 ><P
6987 >Default: <B
6988 CLASS="COMMAND"
6989 >domain master = auto</B
6990 ></P
6991 ></DD
6992 ><DT
6993 ><A
6994 NAME="DONTDESCEND"
6995 ></A
6996 >dont descend (S)</DT
6997 ><DD
6998 ><P
6999 >There are certain directories on some systems
7000                 (e.g., the <TT
7001 CLASS="FILENAME"
7002 >/proc</TT
7003 > tree under Linux) that are either not
7004                 of interest to clients or are infinitely deep (recursive). This
7005                 parameter allows you to specify a comma-delimited list of directories
7006                 that the server should always show as empty.</P
7007 ><P
7008 >Note that Samba can be very fussy about the exact format
7009                 of the "dont descend" entries. For example you may need <TT
7010 CLASS="FILENAME"
7011 >               ./proc</TT
7012 > instead of just <TT
7013 CLASS="FILENAME"
7014 >/proc</TT
7015 >.
7016                 Experimentation is the best policy :-)  </P
7017 ><P
7018 >Default: <I
7019 CLASS="EMPHASIS"
7020 >none (i.e., all directories are OK
7021                 to descend)</I
7022 ></P
7023 ><P
7024 >Example: <B
7025 CLASS="COMMAND"
7026 >dont descend = /proc,/dev</B
7027 ></P
7028 ></DD
7029 ><DT
7030 ><A
7031 NAME="DOSFILEMODE"
7032 ></A
7033 >dos filemode (S)</DT
7034 ><DD
7035 ><P
7036 > The default behavior in Samba is to provide
7037                 UNIX-like behavor where only the owner of a file/directory is
7038                 able to change the permissions on it.  However, this behavior
7039                 is often confusing to  DOS/Windows users.  Enabling this parameter
7040                 allows a user who has write access to the file (by whatever
7041                 means) to modify the permissions on it.  Note that a user
7042                 belonging to the group owning the file will not be allowed to
7043                 change permissions if the group is only granted read access.
7044                 Ownership of the file/directory is not changed, only the permissions
7045                 are modified.</P
7046 ><P
7047 >Default: <B
7048 CLASS="COMMAND"
7049 >dos filemode = no</B
7050 ></P
7051 ></DD
7052 ><DT
7053 ><A
7054 NAME="DOSFILETIMERESOLUTION"
7055 ></A
7056 >dos filetime resolution (S)</DT
7057 ><DD
7058 ><P
7059 >Under the DOS and Windows FAT filesystem, the finest
7060                 granularity on time resolution is two seconds. Setting this parameter
7061                 for a share causes Samba to round the reported time down to the
7062                 nearest two second boundary when a query call that requires one second
7063                 resolution is made to <A
7064 HREF="smbd.8.html"
7065 TARGET="_top"
7066 ><B
7067 CLASS="COMMAND"
7068 >smbd(8)</B
7069 >
7070                 </A
7071 >.</P
7072 ><P
7073 >This option is mainly used as a compatibility option for Visual
7074                 C++ when used against Samba shares. If oplocks are enabled on a
7075                 share, Visual C++ uses two different time reading calls to check if a
7076                 file has changed since it was last read. One of these calls uses a
7077                 one-second granularity, the other uses a two second granularity. As
7078                 the two second call rounds any odd second down, then if the file has a
7079                 timestamp of an odd number of seconds then the two timestamps will not
7080                 match and Visual C++ will keep reporting the file has changed. Setting
7081                 this option causes the two timestamps to match, and Visual C++ is
7082                 happy.</P
7083 ><P
7084 >Default: <B
7085 CLASS="COMMAND"
7086 >dos filetime resolution = no</B
7087 ></P
7088 ></DD
7089 ><DT
7090 ><A
7091 NAME="DOSFILETIMES"
7092 ></A
7093 >dos filetimes (S)</DT
7094 ><DD
7095 ><P
7096 >Under DOS and Windows, if a user can write to a
7097                 file they can change the timestamp on it. Under POSIX semantics,
7098                 only the owner of the file or root may change the timestamp. By
7099                 default, Samba runs with POSIX semantics and refuses to change the
7100                 timestamp on a file if the user <B
7101 CLASS="COMMAND"
7102 >smbd</B
7103 > is acting
7104                 on behalf of is not the file owner. Setting this option to <TT
7105 CLASS="CONSTANT"
7106 >               True</TT
7107 > allows DOS semantics and smbd will change the file
7108                 timestamp as DOS requires.</P
7109 ><P
7110 >Default: <B
7111 CLASS="COMMAND"
7112 >dos filetimes = no</B
7113 ></P
7114 ></DD
7115 ><DT
7116 ><A
7117 NAME="ENCRYPTPASSWORDS"
7118 ></A
7119 >encrypt passwords (G)</DT
7120 ><DD
7121 ><P
7122 >This boolean controls whether encrypted passwords
7123                 will be negotiated with the client. Note that Windows NT 4.0 SP3 and
7124                 above and also Windows 98 will by default expect encrypted passwords
7125                 unless a registry entry is changed. To use encrypted passwords in
7126                 Samba see the file ENCRYPTION.txt in the Samba documentation
7127                 directory <TT
7128 CLASS="FILENAME"
7129 >docs/</TT
7130 > shipped with the source code.</P
7131 ><P
7132 >In order for encrypted passwords to work correctly
7133                 <A
7134 HREF="smbd.8.html"
7135 TARGET="_top"
7136 ><B
7137 CLASS="COMMAND"
7138 >smbd(8)</B
7139 ></A
7140 > must either
7141                 have access to a local <A
7142 HREF="smbpasswd.5.html"
7143 TARGET="_top"
7144 ><TT
7145 CLASS="FILENAME"
7146 >smbpasswd(5)
7147                 </TT
7148 ></A
7149 > file (see the <A
7150 HREF="smbpasswd.8.html"
7151 TARGET="_top"
7152 ><B
7153 CLASS="COMMAND"
7154 >               smbpasswd(8)</B
7155 ></A
7156 > program for information on how to set up
7157                 and maintain this file), or set the <A
7158 HREF="#SECURITY"
7159 >security=[serve|domain]</A
7160 > parameter which
7161                 causes <B
7162 CLASS="COMMAND"
7163 >smbd</B
7164 > to authenticate against another
7165                 server.</P
7166 ><P
7167 >Default: <B
7168 CLASS="COMMAND"
7169 >encrypt passwords = no</B
7170 ></P
7171 ></DD
7172 ><DT
7173 ><A
7174 NAME="ENHANCEDBROWSING"
7175 ></A
7176 >enhanced browsing (G)</DT
7177 ><DD
7178 ><P
7179 >This option enables a couple of enhancements to
7180                 cross-subnet browse propogation that have been added in Samba
7181                 but which are not standard in Microsoft implementations.
7182                 <I
7183 CLASS="EMPHASIS"
7184 >These enhancements are currently only available in
7185                 the HEAD Samba CVS tree (not Samba 2.2.x).</I
7186 ></P
7187 ><P
7188 >The first enhancement to browse propogation consists of a regular
7189                 wildcard query to a Samba WINS server for all Domain Master Browsers,
7190                 followed by a browse synchronisation with each of the returned
7191                 DMBs. The second enhancement consists of a regular randomised browse
7192                 synchronisation with all currently known DMBs.</P
7193 ><P
7194 >You may wish to disable this option if you have a problem with empty
7195                 workgroups not disappearing from browse lists. Due to the restrictions
7196                 of the browse protocols these enhancements can cause a empty workgroup
7197                 to stay around forever which can be annoying.</P
7198 ><P
7199 >In general you should leave this option enabled as it makes
7200                 cross-subnet browse propogation much more reliable.</P
7201 ><P
7202 >Default: <B
7203 CLASS="COMMAND"
7204 >enhanced browsing = yes</B
7205 ></P
7206 ></DD
7207 ><DT
7208 ><A
7209 NAME="ENUMPORTSCOMMAND"
7210 ></A
7211 >enumports command (G)</DT
7212 ><DD
7213 ><P
7214 >The concept of a "port" is fairly foreign
7215                 to UNIX hosts.  Under Windows NT/2000 print servers, a port
7216                 is associated with a port monitor and generally takes the form of
7217                 a local port (i.e. LPT1:, COM1:, FILE:) or a remote port
7218                 (i.e. LPD Port Monitor, etc...).  By default, Samba has only one
7219                 port defined--<TT
7220 CLASS="CONSTANT"
7221 >"Samba Printer Port"</TT
7222 >.  Under
7223                 Windows NT/2000, all printers must have a valid port name.
7224                 If you wish to have a list of ports displayed (<B
7225 CLASS="COMMAND"
7226 >smbd
7227                 </B
7228 > does not use a port name for anything) other than
7229                 the default <TT
7230 CLASS="CONSTANT"
7231 >"Samba Printer Port"</TT
7232 >, you
7233                 can define <TT
7234 CLASS="PARAMETER"
7235 ><I
7236 >enumports command</I
7237 ></TT
7238 > to point to
7239                 a program which should generate a list of ports, one per line,
7240                 to standard output.  This listing will then be used in response
7241                 to the level 1 and 2 EnumPorts() RPC.</P
7242 ><P
7243 >Default: <I
7244 CLASS="EMPHASIS"
7245 >no enumports command</I
7246 ></P
7247 ><P
7248 >Example: <B
7249 CLASS="COMMAND"
7250 >enumports command = /usr/bin/listports
7251                 </B
7252 ></P
7253 ></DD
7254 ><DT
7255 ><A
7256 NAME="EXEC"
7257 ></A
7258 >exec (S)</DT
7259 ><DD
7260 ><P
7261 >This is a synonym for <A
7262 HREF="#PREEXEC"
7263 >               <TT
7264 CLASS="PARAMETER"
7265 ><I
7266 >preexec</I
7267 ></TT
7268 ></A
7269 >.</P
7270 ></DD
7271 ><DT
7272 ><A
7273 NAME="FAKEDIRECTORYCREATETIMES"
7274 ></A
7275 >fake directory create times (S)</DT
7276 ><DD
7277 ><P
7278 >NTFS and Windows VFAT file systems keep a create
7279                 time for all files and directories. This is not the same as the
7280                 ctime - status change time - that Unix keeps, so Samba by default
7281                 reports the earliest of the various times Unix does keep. Setting
7282                 this parameter for a share causes Samba to always report midnight
7283                 1-1-1980 as the create time for directories.</P
7284 ><P
7285 >This option is mainly used as a compatibility option for
7286                 Visual C++ when used against Samba shares. Visual C++ generated
7287                 makefiles have the object directory as a dependency for each object
7288                 file, and a make rule to create the directory. Also, when NMAKE
7289                 compares timestamps it uses the creation time when examining a
7290                 directory. Thus the object directory will be created if it does not
7291                 exist, but once it does exist it will always have an earlier
7292                 timestamp than the object files it contains.</P
7293 ><P
7294 >However, Unix time semantics mean that the create time
7295                 reported by Samba will be updated whenever a file is created or
7296                 or deleted in the directory.  NMAKE finds all object files in
7297                 the object directory.  The timestamp of the last one built is then
7298                 compared to the timestamp of the object dircetory.  If the
7299                 directory's timestamp if newer, then all object files
7300                 will be rebuilt.  Enabling this option
7301                 ensures directories always predate their contents and an NMAKE build
7302                 will proceed as expected.</P
7303 ><P
7304 >Default: <B
7305 CLASS="COMMAND"
7306 >fake directory create times = no</B
7307 ></P
7308 ></DD
7309 ><DT
7310 ><A
7311 NAME="FAKEOPLOCKS"
7312 ></A
7313 >fake oplocks (S)</DT
7314 ><DD
7315 ><P
7316 >Oplocks are the way that SMB clients get permission
7317                 from a server to locally cache file operations. If a server grants
7318                 an oplock (opportunistic lock) then the client is free to assume
7319                 that it is the only one accessing the file and it will aggressively
7320                 cache file data. With some oplock types the client may even cache
7321                 file open/close operations. This can give enormous performance benefits.
7322                 </P
7323 ><P
7324 >When you set <B
7325 CLASS="COMMAND"
7326 >fake oplocks = yes</B
7327 >, <A
7328 HREF="smbd.8.html"
7329 TARGET="_top"
7330 ><B
7331 CLASS="COMMAND"
7332 >smbd(8)</B
7333 ></A
7334 > will
7335                 always grant oplock requests no matter how many clients are using
7336                 the file.</P
7337 ><P
7338 >It is generally much better to use the real <A
7339 HREF="#OPLOCKS"
7340 ><TT
7341 CLASS="PARAMETER"
7342 ><I
7343 >oplocks</I
7344 ></TT
7345 ></A
7346 > support rather
7347                 than this parameter.</P
7348 ><P
7349 >If you enable this option on all read-only shares or
7350                 shares that you know will only be accessed from one client at a
7351                 time such as physically read-only media like CDROMs, you will see
7352                 a big performance improvement on many operations. If you enable
7353                 this option on shares where multiple clients may be accessing the
7354                 files read-write at the same time you can get data corruption. Use
7355                 this option carefully!</P
7356 ><P
7357 >Default: <B
7358 CLASS="COMMAND"
7359 >fake oplocks = no</B
7360 ></P
7361 ></DD
7362 ><DT
7363 ><A
7364 NAME="FOLLOWSYMLINKS"
7365 ></A
7366 >follow symlinks (S)</DT
7367 ><DD
7368 ><P
7369 >This parameter allows the Samba administrator
7370                 to stop <A
7371 HREF="smbd.8.html"
7372 TARGET="_top"
7373 ><B
7374 CLASS="COMMAND"
7375 >smbd(8)</B
7376 ></A
7377 >
7378                 from following symbolic links in a particular share. Setting this
7379                 parameter to <TT
7380 CLASS="CONSTANT"
7381 >no</TT
7382 > prevents any file or directory
7383                 that is a symbolic link from being followed (the user will get an
7384                 error).  This option is very useful to stop users from adding a
7385                 symbolic link to <TT
7386 CLASS="FILENAME"
7387 >/etc/passwd</TT
7388 > in their home
7389                 directory for instance.  However it will slow filename lookups
7390                 down slightly.</P
7391 ><P
7392 >This option is enabled (i.e. <B
7393 CLASS="COMMAND"
7394 >smbd</B
7395 > will
7396                 follow symbolic links) by default.</P
7397 ><P
7398 >Default: <B
7399 CLASS="COMMAND"
7400 >follow symlinks = yes</B
7401 ></P
7402 ></DD
7403 ><DT
7404 ><A
7405 NAME="FORCECREATEMODE"
7406 ></A
7407 >force create mode (S)</DT
7408 ><DD
7409 ><P
7410 >This parameter specifies a set of UNIX mode bit
7411                 permissions that will <I
7412 CLASS="EMPHASIS"
7413 >always</I
7414 > be set on a
7415                 file created by Samba. This is done by bitwise 'OR'ing these bits onto
7416                 the mode bits of a file that is being created or having its
7417                 permissions changed. The default for this parameter is (in octal)
7418                 000. The modes in this parameter are bitwise 'OR'ed onto the file
7419                 mode after the mask set in the <TT
7420 CLASS="PARAMETER"
7421 ><I
7422 >create mask</I
7423 ></TT
7424 >
7425                 parameter is applied.</P
7426 ><P
7427 >See also the parameter <A
7428 HREF="#CREATEMASK"
7429 ><TT
7430 CLASS="PARAMETER"
7431 ><I
7432 >create
7433                 mask</I
7434 ></TT
7435 ></A
7436 > for details on masking mode bits on files.</P
7437 ><P
7438 >See also the <A
7439 HREF="#INHERITPERMISSIONS"
7440 ><TT
7441 CLASS="PARAMETER"
7442 ><I
7443 >inherit
7444                 permissions</I
7445 ></TT
7446 ></A
7447 > parameter.</P
7448 ><P
7449 >Default: <B
7450 CLASS="COMMAND"
7451 >force create mode = 000</B
7452 ></P
7453 ><P
7454 >Example: <B
7455 CLASS="COMMAND"
7456 >force create mode = 0755</B
7457 ></P
7458 ><P
7459 >would force all created files to have read and execute
7460                 permissions set for 'group' and 'other' as well as the
7461                 read/write/execute bits set for the 'user'.</P
7462 ></DD
7463 ><DT
7464 ><A
7465 NAME="FORCEDIRECTORYMODE"
7466 ></A
7467 >force directory mode (S)</DT
7468 ><DD
7469 ><P
7470 >This parameter specifies a set of UNIX mode bit
7471                 permissions that will <I
7472 CLASS="EMPHASIS"
7473 >always</I
7474 > be set on a directory
7475                 created by Samba. This is done by bitwise 'OR'ing these bits onto the
7476                 mode bits of a directory that is being created. The default for this
7477                 parameter is (in octal) 0000 which will not add any extra permission
7478                 bits to a created directory. This operation is done after the mode
7479                 mask in the parameter <TT
7480 CLASS="PARAMETER"
7481 ><I
7482 >directory mask</I
7483 ></TT
7484 > is
7485                 applied.</P
7486 ><P
7487 >See also the parameter <A
7488 HREF="#DIRECTORYMASK"
7489 ><TT
7490 CLASS="PARAMETER"
7491 ><I
7492 >               directory mask</I
7493 ></TT
7494 ></A
7495 > for details on masking mode bits
7496                 on created directories.</P
7497 ><P
7498 >See also the <A
7499 HREF="#INHERITPERMISSIONS"
7500 ><TT
7501 CLASS="PARAMETER"
7502 ><I
7503 >               inherit permissions</I
7504 ></TT
7505 ></A
7506 > parameter.</P
7507 ><P
7508 >Default: <B
7509 CLASS="COMMAND"
7510 >force directory mode = 000</B
7511 ></P
7512 ><P
7513 >Example: <B
7514 CLASS="COMMAND"
7515 >force directory mode = 0755</B
7516 ></P
7517 ><P
7518 >would force all created directories to have read and execute
7519                 permissions set for 'group' and 'other' as well as the
7520                 read/write/execute bits set for the 'user'.</P
7521 ></DD
7522 ><DT
7523 ><A
7524 NAME="FORCEDIRECTORYSECURITYMODE"
7525 ></A
7526 >force directory
7527                 security mode (S)</DT
7528 ><DD
7529 ><P
7530 >This parameter controls what UNIX permission bits
7531                 can be modified when a Windows NT client is manipulating the UNIX
7532                 permission on a directory using the native NT security dialog box.</P
7533 ><P
7534 >This parameter is applied as a mask (OR'ed with) to the
7535                 changed permission bits, thus forcing any bits in this mask that
7536                 the user may have modified to be on. Essentially, one bits in this
7537                 mask may be treated as a set of bits that, when modifying security
7538                 on a directory, the user has always set to be 'on'.</P
7539 ><P
7540 >If not set explicitly this parameter is set to the same
7541                 value as the <A
7542 HREF="#FORCEDIRECTORYMODE"
7543 ><TT
7544 CLASS="PARAMETER"
7545 ><I
7546 >force
7547                 directory mode</I
7548 ></TT
7549 ></A
7550 > parameter. To allow
7551                 a user to modify all the user/group/world permissions on a
7552                 directory without restrictions, set this parameter to 000.</P
7553 ><P
7554 ><I
7555 CLASS="EMPHASIS"
7556 >Note</I
7557 > that users who can access the
7558                 Samba server through other means can easily bypass this restriction,
7559                 so it is primarily useful for standalone "appliance" systems.
7560                 Administrators of most normal systems will probably want to set
7561                 it to 0000.</P
7562 ><P
7563 >See also the <A
7564 HREF="#DIRECTORYSECURITYMASK"
7565 ><TT
7566 CLASS="PARAMETER"
7567 ><I
7568 >               directory security mask</I
7569 ></TT
7570 ></A
7571 >, <A
7572 HREF="#SECURITYMASK"
7573 >               <TT
7574 CLASS="PARAMETER"
7575 ><I
7576 >security mask</I
7577 ></TT
7578 ></A
7579 >,
7580                 <A
7581 HREF="#FORCESECURITYMODE"
7582 ><TT
7583 CLASS="PARAMETER"
7584 ><I
7585 >force security mode
7586                 </I
7587 ></TT
7588 ></A
7589 > parameters.</P
7590 ><P
7591 >Default: <B
7592 CLASS="COMMAND"
7593 >force directory security mode = &lt;same as
7594                 force directory mode&gt;</B
7595 ></P
7596 ><P
7597 >Example: <B
7598 CLASS="COMMAND"
7599 >force directory security mode = 0</B
7600 ></P
7601 ></DD
7602 ><DT
7603 ><A
7604 NAME="FORCEGROUP"
7605 ></A
7606 >force group (S)</DT
7607 ><DD
7608 ><P
7609 >This specifies a UNIX group name that will be
7610                 assigned as the default primary group for all users connecting
7611                 to this service. This is useful for sharing files by ensuring
7612                 that all access to files on service will use the named group for
7613                 their permissions checking. Thus, by assigning permissions for this
7614                 group to the files and directories within this service the Samba
7615                 administrator can restrict or allow sharing of these files.</P
7616 ><P
7617 >In Samba 2.0.5 and above this parameter has extended
7618                 functionality in the following way. If the group name listed here
7619                 has a '+' character prepended to it then the current user accessing
7620                 the share only has the primary group default assigned to this group
7621                 if they are already assigned as a member of that group. This allows
7622                 an administrator to decide that only users who are already in a
7623                 particular group will create files with group ownership set to that
7624                 group. This gives a finer granularity of ownership assignment. For
7625                 example, the setting <TT
7626 CLASS="FILENAME"
7627 >force group = +sys</TT
7628 > means
7629                 that only users who are already in group sys will have their default
7630                 primary group assigned to sys when accessing this Samba share. All
7631                 other users will retain their ordinary primary group.</P
7632 ><P
7633 >If the <A
7634 HREF="#FORCEUSER"
7635 ><TT
7636 CLASS="PARAMETER"
7637 ><I
7638 >force user
7639                 </I
7640 ></TT
7641 ></A
7642 > parameter is also set the group specified in
7643                 <TT
7644 CLASS="PARAMETER"
7645 ><I
7646 >force group</I
7647 ></TT
7648 > will override the primary group
7649                 set in <TT
7650 CLASS="PARAMETER"
7651 ><I
7652 >force user</I
7653 ></TT
7654 >.</P
7655 ><P
7656 >See also <A
7657 HREF="#FORCEUSER"
7658 ><TT
7659 CLASS="PARAMETER"
7660 ><I
7661 >force
7662                 user</I
7663 ></TT
7664 ></A
7665 >.</P
7666 ><P
7667 >Default: <I
7668 CLASS="EMPHASIS"
7669 >no forced group</I
7670 ></P
7671 ><P
7672 >Example: <B
7673 CLASS="COMMAND"
7674 >force group = agroup</B
7675 ></P
7676 ></DD
7677 ><DT
7678 ><A
7679 NAME="FORCESECURITYMODE"
7680 ></A
7681 >force security mode (S)</DT
7682 ><DD
7683 ><P
7684 >This parameter controls what UNIX permission
7685                 bits can be modified when a Windows NT client is manipulating
7686                 the UNIX permission on a file using the native NT security dialog
7687                 box.</P
7688 ><P
7689 >This parameter is applied as a mask (OR'ed with) to the
7690                 changed permission bits, thus forcing any bits in this mask that
7691                 the user may have modified to be on. Essentially, one bits in this
7692                 mask may be treated as a set of bits that, when modifying security
7693                 on a file, the user has always set to be 'on'.</P
7694 ><P
7695 >If not set explicitly this parameter is set to the same
7696                 value as the <A
7697 HREF="#FORCECREATEMODE"
7698 ><TT
7699 CLASS="PARAMETER"
7700 ><I
7701 >force
7702                 create mode</I
7703 ></TT
7704 ></A
7705 > parameter. To allow a user to
7706                 modify all the user/group/world permissions on a file, with no
7707                 restrictions set this parameter to 000.</P
7708 ><P
7709 ><I
7710 CLASS="EMPHASIS"
7711 >Note</I
7712 > that users who can access
7713                 the Samba server through other means can easily bypass this restriction,
7714                 so it is primarily useful for standalone "appliance" systems.
7715                 Administrators of most normal systems will probably want to set
7716                 it to 0000.</P
7717 ><P
7718 >See also the <A
7719 HREF="#FORCEDIRECTORYSECURITYMODE"
7720 ><TT
7721 CLASS="PARAMETER"
7722 ><I
7723 >               force directory security mode</I
7724 ></TT
7725 ></A
7726 >,
7727                 <A
7728 HREF="#DIRECTORYSECURITYMASK"
7729 ><TT
7730 CLASS="PARAMETER"
7731 ><I
7732 >directory security
7733                 mask</I
7734 ></TT
7735 ></A
7736 >, <A
7737 HREF="#SECURITYMASK"
7738 ><TT
7739 CLASS="PARAMETER"
7740 ><I
7741 >               security mask</I
7742 ></TT
7743 ></A
7744 > parameters.</P
7745 ><P
7746 >Default: <B
7747 CLASS="COMMAND"
7748 >force security mode = &lt;same as force
7749                 create mode&gt;</B
7750 ></P
7751 ><P
7752 >Example: <B
7753 CLASS="COMMAND"
7754 >force security mode = 0</B
7755 ></P
7756 ></DD
7757 ><DT
7758 ><A
7759 NAME="FORCEUSER"
7760 ></A
7761 >force user (S)</DT
7762 ><DD
7763 ><P
7764 >This specifies a UNIX user name that will be
7765                 assigned as the default user for all users connecting to this service.
7766                 This is useful for sharing files. You should also use it carefully
7767                 as using it incorrectly can cause security problems.</P
7768 ><P
7769 >This user name only gets used once a connection is established.
7770                 Thus clients still need to connect as a valid user and supply a
7771                 valid password. Once connected, all file operations will be performed
7772                 as the "forced user", no matter what username the client connected
7773                 as.  This can be very useful.</P
7774 ><P
7775 >In Samba 2.0.5 and above this parameter also causes the
7776                 primary group of the forced user to be used as the primary group
7777                 for all file activity. Prior to 2.0.5 the primary group was left
7778                 as the primary group of the connecting user (this was a bug).</P
7779 ><P
7780 >See also <A
7781 HREF="#FORCEGROUP"
7782 ><TT
7783 CLASS="PARAMETER"
7784 ><I
7785 >force group
7786                 </I
7787 ></TT
7788 ></A
7789 ></P
7790 ><P
7791 >Default: <I
7792 CLASS="EMPHASIS"
7793 >no forced user</I
7794 ></P
7795 ><P
7796 >Example: <B
7797 CLASS="COMMAND"
7798 >force user = auser</B
7799 ></P
7800 ></DD
7801 ><DT
7802 ><A
7803 NAME="FSTYPE"
7804 ></A
7805 >fstype (S)</DT
7806 ><DD
7807 ><P
7808 >This parameter allows the administrator to
7809                 configure the string that specifies the type of filesystem a share
7810                 is using that is reported by <A
7811 HREF="smbd.8.html"
7812 TARGET="_top"
7813 ><B
7814 CLASS="COMMAND"
7815 >smbd(8)
7816                 </B
7817 ></A
7818 > when a client queries the filesystem type
7819                 for a share. The default type is <TT
7820 CLASS="CONSTANT"
7821 >NTFS</TT
7822 > for
7823                 compatibility with Windows NT but this can be changed to other
7824                 strings such as <TT
7825 CLASS="CONSTANT"
7826 >Samba</TT
7827 > or <TT
7828 CLASS="CONSTANT"
7829 >FAT
7830                 </TT
7831 > if required.</P
7832 ><P
7833 >Default: <B
7834 CLASS="COMMAND"
7835 >fstype = NTFS</B
7836 ></P
7837 ><P
7838 >Example: <B
7839 CLASS="COMMAND"
7840 >fstype = Samba</B
7841 ></P
7842 ></DD
7843 ><DT
7844 ><A
7845 NAME="GETWDCACHE"
7846 ></A
7847 >getwd cache (G)</DT
7848 ><DD
7849 ><P
7850 >This is a tuning option. When this is enabled a
7851                 caching algorithm will be used to reduce the time taken for getwd()
7852                 calls. This can have a significant impact on performance, especially
7853                 when the <A
7854 HREF="#WIDELINKS"
7855 ><TT
7856 CLASS="PARAMETER"
7857 ><I
7858 >wide links</I
7859 ></TT
7860 >
7861                 </A
7862 >parameter is set to <TT
7863 CLASS="CONSTANT"
7864 >False</TT
7865 >.</P
7866 ><P
7867 >Default: <B
7868 CLASS="COMMAND"
7869 >getwd cache = yes</B
7870 ></P
7871 ></DD
7872 ><DT
7873 ><A
7874 NAME="GROUP"
7875 ></A
7876 >group (S)</DT
7877 ><DD
7878 ><P
7879 >Synonym for <A
7880 HREF="#FORCEGROUP"
7881 ><TT
7882 CLASS="PARAMETER"
7883 ><I
7884 >force
7885                 group</I
7886 ></TT
7887 ></A
7888 >.</P
7889 ></DD
7890 ><DT
7891 ><A
7892 NAME="GUESTACCOUNT"
7893 ></A
7894 >guest account (S)</DT
7895 ><DD
7896 ><P
7897 >This is a username which will be used for access
7898                 to services which are specified as <A
7899 HREF="#GUESTOK"
7900 ><TT
7901 CLASS="PARAMETER"
7902 ><I
7903 >               guest ok</I
7904 ></TT
7905 ></A
7906 > (see below). Whatever privileges this
7907                 user has will be available to any client connecting to the guest service.
7908                 Typically this user will exist in the password file, but will not
7909                 have a valid login. The user account "ftp" is often a good choice
7910                 for this parameter. If a username is specified in a given service,
7911                 the specified username overrides this one.</P
7912 ><P
7913 >One some systems the default guest account "nobody" may not
7914                 be able to print. Use another account in this case. You should test
7915                 this by trying to log in as your guest user (perhaps by using the
7916                 <B
7917 CLASS="COMMAND"
7918 >su -</B
7919 > command) and trying to print using the
7920                 system print command such as <B
7921 CLASS="COMMAND"
7922 >lpr(1)</B
7923 > or <B
7924 CLASS="COMMAND"
7925 >               lp(1)</B
7926 >.</P
7927 ><P
7928 >Default: <I
7929 CLASS="EMPHASIS"
7930 >specified at compile time, usually
7931                 "nobody"</I
7932 ></P
7933 ><P
7934 >Example: <B
7935 CLASS="COMMAND"
7936 >guest account = ftp</B
7937 ></P
7938 ></DD
7939 ><DT
7940 ><A
7941 NAME="GUESTOK"
7942 ></A
7943 >guest ok (S)</DT
7944 ><DD
7945 ><P
7946 >If this parameter is <TT
7947 CLASS="CONSTANT"
7948 >yes</TT
7949 > for
7950                 a service, then no password is required to connect to the service.
7951                 Privileges will be those of the <A
7952 HREF="#GUESTACCOUNT"
7953 ><TT
7954 CLASS="PARAMETER"
7955 ><I
7956 >               guest account</I
7957 ></TT
7958 ></A
7959 >.</P
7960 ><P
7961 >See the section below on <A
7962 HREF="#SECURITY"
7963 ><TT
7964 CLASS="PARAMETER"
7965 ><I
7966 >               security</I
7967 ></TT
7968 ></A
7969 > for more information about this option.
7970                 </P
7971 ><P
7972 >Default: <B
7973 CLASS="COMMAND"
7974 >guest ok = no</B
7975 ></P
7976 ></DD
7977 ><DT
7978 ><A
7979 NAME="GUESTONLY"
7980 ></A
7981 >guest only (S)</DT
7982 ><DD
7983 ><P
7984 >If this parameter is <TT
7985 CLASS="CONSTANT"
7986 >yes</TT
7987 > for
7988                 a service, then only guest connections to the service are permitted.
7989                 This parameter will have no effect if <A
7990 HREF="#GUESTOK"
7991 >               <TT
7992 CLASS="PARAMETER"
7993 ><I
7994 >guest ok</I
7995 ></TT
7996 ></A
7997 > is not set for the service.</P
7998 ><P
7999 >See the section below on <A
8000 HREF="#SECURITY"
8001 ><TT
8002 CLASS="PARAMETER"
8003 ><I
8004 >               security</I
8005 ></TT
8006 ></A
8007 > for more information about this option.
8008                 </P
8009 ><P
8010 >Default: <B
8011 CLASS="COMMAND"
8012 >guest only = no</B
8013 ></P
8014 ></DD
8015 ><DT
8016 ><A
8017 NAME="HIDEDOTFILES"
8018 ></A
8019 >hide dot files (S)</DT
8020 ><DD
8021 ><P
8022 >This is a boolean parameter that controls whether
8023                 files starting with a dot appear as hidden files.</P
8024 ><P
8025 >Default: <B
8026 CLASS="COMMAND"
8027 >hide dot files = yes</B
8028 ></P
8029 ></DD
8030 ><DT
8031 ><A
8032 NAME="HIDEFILES"
8033 ></A
8034 >hide files(S)</DT
8035 ><DD
8036 ><P
8037 >This is a list of files or directories that are not
8038                 visible but are accessible.  The DOS 'hidden' attribute is applied
8039                 to any files or directories that match.</P
8040 ><P
8041 >Each entry in the list must be separated by a '/',
8042                 which allows spaces to be included in the entry.  '*'
8043                 and '?' can be used to specify multiple files or directories
8044                 as in DOS wildcards.</P
8045 ><P
8046 >Each entry must be a Unix path, not a DOS path and must
8047                 not include the Unix directory separator '/'.</P
8048 ><P
8049 >Note that the case sensitivity option is applicable
8050                 in hiding files.</P
8051 ><P
8052 >Setting this parameter will affect the performance of Samba,
8053                 as it will be forced to check all files and directories for a match
8054                 as they are scanned.</P
8055 ><P
8056 >See also <A
8057 HREF="#HIDEDOTFILES"
8058 ><TT
8059 CLASS="PARAMETER"
8060 ><I
8061 >hide
8062                 dot files</I
8063 ></TT
8064 ></A
8065 >, <A
8066 HREF="#VETOFILES"
8067 ><TT
8068 CLASS="PARAMETER"
8069 ><I
8070 >               veto files</I
8071 ></TT
8072 ></A
8073 > and <A
8074 HREF="#CASESENSITIVE"
8075 >               <TT
8076 CLASS="PARAMETER"
8077 ><I
8078 >case sensitive</I
8079 ></TT
8080 ></A
8081 >.</P
8082 ><P
8083 >Default: <I
8084 CLASS="EMPHASIS"
8085 >no file are hidden</I
8086 ></P
8087 ><P
8088 >Example: <B
8089 CLASS="COMMAND"
8090 >hide files =
8091                 /.*/DesktopFolderDB/TrashFor%m/resource.frk/</B
8092 ></P
8093 ><P
8094 >The above example is based on files that the Macintosh
8095                 SMB client (DAVE) available from <A
8096 HREF="http://www.thursby.com"
8097 TARGET="_top"
8098 >
8099                 Thursby</A
8100 > creates for internal use, and also still hides
8101                 all files beginning with a dot.</P
8102 ></DD
8103 ><DT
8104 ><A
8105 NAME="HIDELOCALUSERS"
8106 ></A
8107 >hide local users(G)</DT
8108 ><DD
8109 ><P
8110 >This parameter toggles the hiding of local UNIX
8111                 users (root, wheel, floppy, etc) from remote clients.</P
8112 ><P
8113 >Default: <B
8114 CLASS="COMMAND"
8115 >hide local users = no</B
8116 ></P
8117 ></DD
8118 ><DT
8119 ><A
8120 NAME="HOMEDIRMAP"
8121 ></A
8122 >homedir map (G)</DT
8123 ><DD
8124 ><P
8125 >If<A
8126 HREF="#NISHOMEDIR"
8127 ><TT
8128 CLASS="PARAMETER"
8129 ><I
8130 >nis homedir
8131                 </I
8132 ></TT
8133 ></A
8134 > is <TT
8135 CLASS="CONSTANT"
8136 >True</TT
8137 >, and <A
8138 HREF="smbd.8.html"
8139 TARGET="_top"
8140 ><B
8141 CLASS="COMMAND"
8142 >smbd(8)</B
8143 ></A
8144 > is also acting
8145                 as a Win95/98 <TT
8146 CLASS="PARAMETER"
8147 ><I
8148 >logon server</I
8149 ></TT
8150 > then this parameter
8151                 specifies the NIS (or YP) map from which the server for the user's
8152                 home directory should be extracted.  At present, only the Sun
8153                 auto.home map format is understood. The form of the map is:</P
8154 ><P
8155 ><B
8156 CLASS="COMMAND"
8157 >username       server:/some/file/system</B
8158 ></P
8159 ><P
8160 >and the program will extract the servername from before
8161                 the first ':'.  There should probably be a better parsing system
8162                 that copes with different map formats and also Amd (another
8163                 automounter) maps.</P
8164 ><P
8165 ><I
8166 CLASS="EMPHASIS"
8167 >NOTE :</I
8168 >A working NIS client is required on
8169                 the system for this option to work.</P
8170 ><P
8171 >See also <A
8172 HREF="#NISHOMEDIR"
8173 ><TT
8174 CLASS="PARAMETER"
8175 ><I
8176 >nis homedir</I
8177 ></TT
8178 >
8179                 </A
8180 >, <A
8181 HREF="#DOMAINLOGONS"
8182 ><TT
8183 CLASS="PARAMETER"
8184 ><I
8185 >domain logons</I
8186 ></TT
8187 >
8188                 </A
8189 >.</P
8190 ><P
8191 >Default: <B
8192 CLASS="COMMAND"
8193 >homedir map = &lt;empty string&gt;</B
8194 ></P
8195 ><P
8196 >Example: <B
8197 CLASS="COMMAND"
8198 >homedir map = amd.homedir</B
8199 ></P
8200 ></DD
8201 ><DT
8202 ><A
8203 NAME="HOSTMSDFS"
8204 ></A
8205 >host msdfs (G)</DT
8206 ><DD
8207 ><P
8208 >This boolean parameter is only available
8209                 if Samba has been configured and compiled with the <B
8210 CLASS="COMMAND"
8211 >               --with-msdfs</B
8212 > option. If set to <TT
8213 CLASS="CONSTANT"
8214 >yes</TT
8215 >,
8216                 Samba will act as a Dfs server, and  allow Dfs-aware clients
8217                 to browse Dfs trees hosted on the server.</P
8218 ><P
8219 >See also the <A
8220 HREF="#MSDFSROOT"
8221 ><TT
8222 CLASS="PARAMETER"
8223 ><I
8224 >               msdfs root</I
8225 ></TT
8226 ></A
8227 > share  level  parameter.  For
8228                 more  information  on  setting  up a Dfs tree on Samba,
8229                 refer to <A
8230 HREF="msdfs_setup.html"
8231 TARGET="_top"
8232 >msdfs_setup.html</A
8233 >.
8234                 </P
8235 ><P
8236 >Default: <B
8237 CLASS="COMMAND"
8238 >host msdfs = no</B
8239 ></P
8240 ></DD
8241 ><DT
8242 ><A
8243 NAME="HOSTSALLOW"
8244 ></A
8245 >hosts allow (S)</DT
8246 ><DD
8247 ><P
8248 >A synonym for this parameter is <TT
8249 CLASS="PARAMETER"
8250 ><I
8251 >allow
8252                 hosts</I
8253 ></TT
8254 >.</P
8255 ><P
8256 >This parameter is a comma, space, or tab delimited
8257                 set of hosts which are permitted to access a service.</P
8258 ><P
8259 >If specified in the [global] section then it will
8260                 apply to all services, regardless of whether the individual
8261                 service has a different setting.</P
8262 ><P
8263 >You can specify the hosts by name or IP number. For
8264                 example, you could restrict access to only the hosts on a
8265                 Class C subnet with something like <B
8266 CLASS="COMMAND"
8267 >allow hosts = 150.203.5.
8268                 </B
8269 >. The full syntax of the list is described in the man
8270                 page <TT
8271 CLASS="FILENAME"
8272 >hosts_access(5)</TT
8273 >. Note that this man
8274                 page may not be present on your system, so a brief description will
8275                 be given here also.</P
8276 ><P
8277 >Note that the localhost address 127.0.0.1 will always
8278                 be allowed access unless specifically denied by a <A
8279 HREF="#HOSTSDENY"
8280 ><TT
8281 CLASS="PARAMETER"
8282 ><I
8283 >hosts deny</I
8284 ></TT
8285 ></A
8286 > option.</P
8287 ><P
8288 >You can also specify hosts by network/netmask pairs and
8289                 by netgroup names if your system supports netgroups. The
8290                 <I
8291 CLASS="EMPHASIS"
8292 >EXCEPT</I
8293 > keyword can also be used to limit a
8294                 wildcard list. The following examples may provide some help:</P
8295 ><P
8296 >Example 1: allow all IPs in 150.203.*.*; except one</P
8297 ><P
8298 ><B
8299 CLASS="COMMAND"
8300 >hosts allow = 150.203. EXCEPT 150.203.6.66</B
8301 ></P
8302 ><P
8303 >Example 2: allow hosts that match the given network/netmask</P
8304 ><P
8305 ><B
8306 CLASS="COMMAND"
8307 >hosts allow = 150.203.15.0/255.255.255.0</B
8308 ></P
8309 ><P
8310 >Example 3: allow a couple of hosts</P
8311 ><P
8312 ><B
8313 CLASS="COMMAND"
8314 >hosts allow = lapland, arvidsjaur</B
8315 ></P
8316 ><P
8317 >Example 4: allow only hosts in NIS netgroup "foonet", but
8318                 deny access from one particular host</P
8319 ><P
8320 ><B
8321 CLASS="COMMAND"
8322 >hosts allow = @foonet</B
8323 ></P
8324 ><P
8325 ><B
8326 CLASS="COMMAND"
8327 >hosts deny = pirate</B
8328 ></P
8329 ><P
8330 >Note that access still requires suitable user-level passwords.</P
8331 ><P
8332 >See <A
8333 HREF="testparm.1.html"
8334 TARGET="_top"
8335 ><B
8336 CLASS="COMMAND"
8337 >testparm(1)</B
8338 >
8339                 </A
8340 > for a way of testing your host access to see if it does
8341                 what you expect.</P
8342 ><P
8343 >Default: <I
8344 CLASS="EMPHASIS"
8345 >none (i.e., all hosts permitted access)
8346                 </I
8347 ></P
8348 ><P
8349 >Example: <B
8350 CLASS="COMMAND"
8351 >allow hosts = 150.203.5. myhost.mynet.edu.au
8352                 </B
8353 ></P
8354 ></DD
8355 ><DT
8356 ><A
8357 NAME="HOSTSDENY"
8358 ></A
8359 >hosts deny (S)</DT
8360 ><DD
8361 ><P
8362 >The opposite of <TT
8363 CLASS="PARAMETER"
8364 ><I
8365 >hosts allow</I
8366 ></TT
8367 >
8368                 - hosts listed here are <I
8369 CLASS="EMPHASIS"
8370 >NOT</I
8371 > permitted access to
8372                 services unless the specific services have their own lists to override
8373                 this one. Where the lists conflict, the <TT
8374 CLASS="PARAMETER"
8375 ><I
8376 >allow</I
8377 ></TT
8378 >
8379                 list takes precedence.</P
8380 ><P
8381 >Default: <I
8382 CLASS="EMPHASIS"
8383 >none (i.e., no hosts specifically excluded)
8384                 </I
8385 ></P
8386 ><P
8387 >Example: <B
8388 CLASS="COMMAND"
8389 >hosts deny = 150.203.4. badhost.mynet.edu.au
8390                 </B
8391 ></P
8392 ></DD
8393 ><DT
8394 ><A
8395 NAME="HOSTSEQUIV"
8396 ></A
8397 >hosts equiv (G)</DT
8398 ><DD
8399 ><P
8400 >If this global parameter is a non-null string,
8401                 it specifies the name of a file to read for the names of hosts
8402                 and users who will be allowed access without specifying a password.
8403                 </P
8404 ><P
8405 >This is not be confused with <A
8406 HREF="#HOSTSALLOW"
8407 >               <TT
8408 CLASS="PARAMETER"
8409 ><I
8410 >hosts allow</I
8411 ></TT
8412 ></A
8413 > which is about hosts
8414                 access to services and is more useful for guest services. <TT
8415 CLASS="PARAMETER"
8416 ><I
8417 >               hosts equiv</I
8418 ></TT
8419 > may be useful for NT clients which will
8420                 not supply passwords to samba.</P
8421 ><P
8422 ><I
8423 CLASS="EMPHASIS"
8424 >NOTE :</I
8425 > The use of <TT
8426 CLASS="PARAMETER"
8427 ><I
8428 >hosts equiv
8429                 </I
8430 ></TT
8431 > can be a major security hole. This is because you are
8432                 trusting the PC to supply the correct username. It is very easy to
8433                 get a PC to supply a false username. I recommend that the
8434                 <TT
8435 CLASS="PARAMETER"
8436 ><I
8437 >hosts equiv</I
8438 ></TT
8439 > option be only used if you really
8440                 know what you are doing, or perhaps on a home network where you trust
8441                 your spouse and kids. And only if you <I
8442 CLASS="EMPHASIS"
8443 >really</I
8444 > trust
8445                 them :-).</P
8446 ><P
8447 >Default: <I
8448 CLASS="EMPHASIS"
8449 >no host equivalences</I
8450 ></P
8451 ><P
8452 >Example: <B
8453 CLASS="COMMAND"
8454 >hosts equiv = /etc/hosts.equiv</B
8455 ></P
8456 ></DD
8457 ><DT
8458 ><A
8459 NAME="INCLUDE"
8460 ></A
8461 >include (G)</DT
8462 ><DD
8463 ><P
8464 >This allows you to include one config file
8465                 inside another.  The file is included literally, as though typed
8466                 in place.</P
8467 ><P
8468 >It takes the standard substitutions, except <TT
8469 CLASS="PARAMETER"
8470 ><I
8471 >%u
8472                 </I
8473 ></TT
8474 >, <TT
8475 CLASS="PARAMETER"
8476 ><I
8477 >%P</I
8478 ></TT
8479 > and <TT
8480 CLASS="PARAMETER"
8481 ><I
8482 >%S</I
8483 ></TT
8484 >.
8485                 </P
8486 ><P
8487 >Default: <I
8488 CLASS="EMPHASIS"
8489 >no file included</I
8490 ></P
8491 ><P
8492 >Example: <B
8493 CLASS="COMMAND"
8494 >include = /usr/local/samba/lib/admin_smb.conf
8495                 </B
8496 ></P
8497 ></DD
8498 ><DT
8499 ><A
8500 NAME="INHERITPERMISSIONS"
8501 ></A
8502 >inherit permissions (S)</DT
8503 ><DD
8504 ><P
8505 >The permissions on new files and directories
8506                 are normally governed by <A
8507 HREF="#CREATEMASK"
8508 ><TT
8509 CLASS="PARAMETER"
8510 ><I
8511 >               create mask</I
8512 ></TT
8513 ></A
8514 >, <A
8515 HREF="#DIRECTORYMASK"
8516 >               <TT
8517 CLASS="PARAMETER"
8518 ><I
8519 >directory mask</I
8520 ></TT
8521 ></A
8522 >, <A
8523 HREF="#FORCECREATEMODE"
8524 ><TT
8525 CLASS="PARAMETER"
8526 ><I
8527 >force create mode</I
8528 ></TT
8529 >
8530                 </A
8531 > and <A
8532 HREF="#FORCEDIRECTORYMODE"
8533 ><TT
8534 CLASS="PARAMETER"
8535 ><I
8536 >force
8537                 directory mode</I
8538 ></TT
8539 ></A
8540 > but the boolean inherit
8541                 permissions parameter overrides this.</P
8542 ><P
8543 >New directories inherit the mode of the parent directory,
8544                 including bits such as setgid.</P
8545 ><P
8546 >New files inherit their read/write bits from the parent
8547                 directory.  Their execute bits continue to be determined by
8548                 <A
8549 HREF="#MAPARCHIVE"
8550 ><TT
8551 CLASS="PARAMETER"
8552 ><I
8553 >map archive</I
8554 ></TT
8555 >
8556                 </A
8557 >, <A
8558 HREF="#MAPHIDDEN"
8559 ><TT
8560 CLASS="PARAMETER"
8561 ><I
8562 >map hidden</I
8563 ></TT
8564 >
8565                 </A
8566 > and <A
8567 HREF="#MAPSYSTEM"
8568 ><TT
8569 CLASS="PARAMETER"
8570 ><I
8571 >map system</I
8572 ></TT
8573 >
8574                 </A
8575 > as usual.</P
8576 ><P
8577 >Note that the setuid bit is <I
8578 CLASS="EMPHASIS"
8579 >never</I
8580 > set via
8581                 inheritance (the code explicitly prohibits this).</P
8582 ><P
8583 >This can be particularly useful on large systems with
8584                 many users, perhaps several thousand,to allow a single [homes]
8585                 share to be used flexibly by each user.</P
8586 ><P
8587 >See also <A
8588 HREF="#CREATEMASK"
8589 ><TT
8590 CLASS="PARAMETER"
8591 ><I
8592 >create mask
8593                 </I
8594 ></TT
8595 ></A
8596 >, <A
8597 HREF="#DIRECTORYMASK"
8598 ><TT
8599 CLASS="PARAMETER"
8600 ><I
8601 >               directory mask</I
8602 ></TT
8603 ></A
8604 >, <A
8605 HREF="#FORCECREATEMODE"
8606 >               <TT
8607 CLASS="PARAMETER"
8608 ><I
8609 >force create mode</I
8610 ></TT
8611 ></A
8612 > and <A
8613 HREF="#FORCEDIRECTORYMODE"
8614 ><TT
8615 CLASS="PARAMETER"
8616 ><I
8617 >force directory mode</I
8618 ></TT
8619 >
8620                 </A
8621 >.</P
8622 ><P
8623 >Default: <B
8624 CLASS="COMMAND"
8625 >inherit permissions = no</B
8626 ></P
8627 ></DD
8628 ><DT
8629 ><A
8630 NAME="INTERFACES"
8631 ></A
8632 >interfaces (G)</DT
8633 ><DD
8634 ><P
8635 >This option allows you to override the default
8636                 network interfaces list that Samba will use for browsing, name
8637                 registration and other NBT traffic. By default Samba will query
8638                 the kernel for the list of all active interfaces and use any
8639                 interfaces except 127.0.0.1 that are broadcast capable.</P
8640 ><P
8641 >The option takes a list of interface strings. Each string
8642                 can be in any of the following forms:</P
8643 ><P
8644 ></P
8645 ><UL
8646 ><LI
8647 ><P
8648 >a network interface name (such as eth0).
8649                         This may include shell-like wildcards so eth* will match
8650                         any interface starting with the substring "eth"</P
8651 ></LI
8652 ><LI
8653 ><P
8654 >an IP address. In this case the netmask is
8655                         determined from the list of interfaces obtained from the
8656                         kernel</P
8657 ></LI
8658 ><LI
8659 ><P
8660 >an IP/mask pair. </P
8661 ></LI
8662 ><LI
8663 ><P
8664 >a broadcast/mask pair.</P
8665 ></LI
8666 ></UL
8667 ><P
8668 >The "mask" parameters can either be a bit length (such
8669                 as 24 for a C class network) or a full netmask in dotted
8670                 decimal form.</P
8671 ><P
8672 >The "IP" parameters above can either be a full dotted
8673                 decimal IP address or a hostname which will be looked up via
8674                 the OS's normal hostname resolution mechanisms.</P
8675 ><P
8676 >For example, the following line:</P
8677 ><P
8678 ><B
8679 CLASS="COMMAND"
8680 >interfaces = eth0 192.168.2.10/24 192.168.3.10/255.255.255.0
8681                 </B
8682 ></P
8683 ><P
8684 >would configure three network interfaces corresponding
8685                 to the eth0 device and IP addresses 192.168.2.10 and 192.168.3.10.
8686                 The netmasks of the latter two interfaces would be set to 255.255.255.0.</P
8687 ><P
8688 >See also <A
8689 HREF="#BINDINTERFACESONLY"
8690 ><TT
8691 CLASS="PARAMETER"
8692 ><I
8693 >bind
8694                 interfaces only</I
8695 ></TT
8696 ></A
8697 >.</P
8698 ><P
8699 >Default: <I
8700 CLASS="EMPHASIS"
8701 >all active interfaces except 127.0.0.1
8702                 that are broadcast capable</I
8703 ></P
8704 ></DD
8705 ><DT
8706 ><A
8707 NAME="INVALIDUSERS"
8708 ></A
8709 >invalid users (S)</DT
8710 ><DD
8711 ><P
8712 >This is a list of users that should not be allowed
8713                 to login to this service. This is really a <I
8714 CLASS="EMPHASIS"
8715 >paranoid</I
8716 >
8717                 check to absolutely ensure an improper setting does not breach
8718                 your security.</P
8719 ><P
8720 >A name starting with a '@' is interpreted as an NIS
8721                 netgroup first (if your system supports NIS), and then as a UNIX
8722                 group if the name was not found in the NIS netgroup database.</P
8723 ><P
8724 >A name starting with '+' is interpreted only
8725                 by looking in the UNIX group database. A name starting with
8726                 '&#38;' is interpreted only by looking in the NIS netgroup database
8727                 (this requires NIS to be working on your system). The characters
8728                 '+' and '&#38;' may be used at the start of the name in either order
8729                 so the value <TT
8730 CLASS="PARAMETER"
8731 ><I
8732 >+&amp;group</I
8733 ></TT
8734 > means check the
8735                 UNIX group database, followed by the NIS netgroup database, and
8736                 the value <TT
8737 CLASS="PARAMETER"
8738 ><I
8739 >&#38;+group"</I
8740 ></TT
8741 > means check the NIS
8742                 netgroup database, followed by the UNIX group database (the
8743                 same as the '@' prefix).</P
8744 ><P
8745 >The current servicename is substituted for <TT
8746 CLASS="PARAMETER"
8747 ><I
8748 >%S</I
8749 ></TT
8750 >.
8751                 This is useful in the [homes] section.</P
8752 ><P
8753 >See also <A
8754 HREF="#VALIDUSERS"
8755 ><TT
8756 CLASS="PARAMETER"
8757 ><I
8758 >valid users
8759                 </I
8760 ></TT
8761 ></A
8762 >.</P
8763 ><P
8764 >Default: <I
8765 CLASS="EMPHASIS"
8766 >no invalid users</I
8767 ></P
8768 ><P
8769 >Example: <B
8770 CLASS="COMMAND"
8771 >invalid users = root fred admin @wheel
8772                 </B
8773 ></P
8774 ></DD
8775 ><DT
8776 ><A
8777 NAME="KEEPALIVE"
8778 ></A
8779 >keepalive (G)</DT
8780 ><DD
8781 ><P
8782 >The value of the parameter (an integer) represents
8783                 the number of seconds between <TT
8784 CLASS="PARAMETER"
8785 ><I
8786 >keepalive</I
8787 ></TT
8788 >
8789                 packets. If this parameter is zero, no keepalive packets will be
8790                 sent. Keepalive packets, if sent, allow the server to tell whether
8791                 a client is still present and responding.</P
8792 ><P
8793 >Keepalives should, in general, not be needed if the socket
8794                 being used has the SO_KEEPALIVE attribute set on it (see <A
8795 HREF="#SOCKETOPTIONS"
8796 ><TT
8797 CLASS="PARAMETER"
8798 ><I
8799 >socket options</I
8800 ></TT
8801 ></A
8802 >).
8803                 Basically you should only use this option if you strike difficulties.</P
8804 ><P
8805 >Default: <B
8806 CLASS="COMMAND"
8807 >keepalive = 300</B
8808 ></P
8809 ><P
8810 >Example: <B
8811 CLASS="COMMAND"
8812 >keepalive = 600</B
8813 ></P
8814 ></DD
8815 ><DT
8816 ><A
8817 NAME="KERNELOPLOCKS"
8818 ></A
8819 >kernel oplocks (G)</DT
8820 ><DD
8821 ><P
8822 >For UNIXes that support kernel based <A
8823 HREF="#OPLOCKS"
8824 ><TT
8825 CLASS="PARAMETER"
8826 ><I
8827 >oplocks</I
8828 ></TT
8829 ></A
8830 >
8831                 (currently only IRIX and the Linux 2.4 kernel), this parameter
8832                 allows the use of them to be turned on or off.</P
8833 ><P
8834 >Kernel oplocks support allows Samba <TT
8835 CLASS="PARAMETER"
8836 ><I
8837 >oplocks
8838                 </I
8839 ></TT
8840 > to be broken whenever a local UNIX process or NFS operation
8841                 accesses a file that <A
8842 HREF="smbd.8.html"
8843 TARGET="_top"
8844 ><B
8845 CLASS="COMMAND"
8846 >smbd(8)</B
8847 >
8848                 </A
8849 > has oplocked. This allows complete data consistency between
8850                 SMB/CIFS, NFS and local file access (and is a <I
8851 CLASS="EMPHASIS"
8852 >very</I
8853 >
8854                 cool feature :-).</P
8855 ><P
8856 >This parameter defaults to <TT
8857 CLASS="CONSTANT"
8858 >on</TT
8859 > on systems
8860                 that have the support, and <TT
8861 CLASS="CONSTANT"
8862 >off</TT
8863 > on systems that
8864                 don't. You should never need to touch this parameter.</P
8865 ><P
8866 >See also the <A
8867 HREF="#OPLOCKS"
8868 ><TT
8869 CLASS="PARAMETER"
8870 ><I
8871 >oplocks</I
8872 ></TT
8873 >
8874                 </A
8875 > and <A
8876 HREF="#LEVEL2OPLOCKS"
8877 ><TT
8878 CLASS="PARAMETER"
8879 ><I
8880 >level2 oplocks
8881                 </I
8882 ></TT
8883 ></A
8884 > parameters.</P
8885 ><P
8886 >Default: <B
8887 CLASS="COMMAND"
8888 >kernel oplocks = yes</B
8889 ></P
8890 ></DD
8891 ><DT
8892 ><A
8893 NAME="LANMANAUTH"
8894 ></A
8895 >lanman auth (G)</DT
8896 ><DD
8897 ><P
8898 >This parameter determines whether or not smbd will
8899                 attempt to authentication users using the LANMAN password hash.
8900                 If disabled, only clients which support NT password hashes (e.g. Windows
8901                 NT/2000 clients, smbclient, etc... but not Windows 95/98 or the MS DOS
8902                 network client) will be able to connect to the Samba host.</P
8903 ><P
8904 >Default : <B
8905 CLASS="COMMAND"
8906 >lanman auth = yes</B
8907 ></P
8908 ></DD
8909 ><DT
8910 ><A
8911 NAME="LEVEL2OPLOCKS"
8912 ></A
8913 >level2 oplocks (S)</DT
8914 ><DD
8915 ><P
8916 >This parameter controls whether Samba supports
8917                 level2 (read-only) oplocks on a share.</P
8918 ><P
8919 >Level2, or read-only oplocks allow Windows NT clients
8920                 that have an oplock on a file to downgrade from a read-write oplock
8921                 to a read-only oplock once a second client opens the file (instead
8922                 of releasing all oplocks on a second open, as in traditional,
8923                 exclusive oplocks). This allows all openers of the file that
8924                 support level2 oplocks to cache the file for read-ahead only (ie.
8925                 they may not cache writes or lock requests) and increases performance
8926                 for many accesses of files that are not commonly written (such as
8927                 application .EXE files).</P
8928 ><P
8929 >Once one of the clients which have a read-only oplock
8930                 writes to the file all clients are notified (no reply is needed
8931                 or waited for) and told to break their oplocks to "none" and
8932                 delete any read-ahead caches.</P
8933 ><P
8934 >It is recommended that this parameter be turned on
8935                 to speed access to shared executables.</P
8936 ><P
8937 >For more discussions on level2 oplocks see the CIFS spec.</P
8938 ><P
8939 >Currently, if <A
8940 HREF="#KERNELOPLOCKS"
8941 ><TT
8942 CLASS="PARAMETER"
8943 ><I
8944 >kernel
8945                 oplocks</I
8946 ></TT
8947 ></A
8948 > are supported then level2 oplocks are
8949                 not granted (even if this parameter is set to <TT
8950 CLASS="CONSTANT"
8951 >yes</TT
8952 >).
8953                 Note also, the <A
8954 HREF="#OPLOCKS"
8955 ><TT
8956 CLASS="PARAMETER"
8957 ><I
8958 >oplocks</I
8959 ></TT
8960 >
8961                 </A
8962 > parameter must be set to "true" on this share in order for
8963                 this parameter to have any effect.</P
8964 ><P
8965 >See also the <A
8966 HREF="#OPLOCKS"
8967 ><TT
8968 CLASS="PARAMETER"
8969 ><I
8970 >oplocks</I
8971 ></TT
8972 >
8973                 </A
8974 > and <A
8975 HREF="#OPLOCKS"
8976 ><TT
8977 CLASS="PARAMETER"
8978 ><I
8979 >kernel oplocks</I
8980 ></TT
8981 >
8982                 </A
8983 > parameters.</P
8984 ><P
8985 >Default: <B
8986 CLASS="COMMAND"
8987 >level2 oplocks = yes</B
8988 ></P
8989 ></DD
8990 ><DT
8991 ><A
8992 NAME="LMANNOUNCE"
8993 ></A
8994 >lm announce (G)</DT
8995 ><DD
8996 ><P
8997 >This parameter determines if <A
8998 HREF="nmbd.8.html"
8999 TARGET="_top"
9000 >               <B
9001 CLASS="COMMAND"
9002 >nmbd(8)</B
9003 ></A
9004 > will produce Lanman announce
9005                 broadcasts that are needed by OS/2 clients in order for them to see
9006                 the Samba server in their browse list. This parameter can have three
9007                 values, <TT
9008 CLASS="CONSTANT"
9009 >true</TT
9010 >, <TT
9011 CLASS="CONSTANT"
9012 >false</TT
9013 >, or
9014                 <TT
9015 CLASS="CONSTANT"
9016 >auto</TT
9017 >. The default is <TT
9018 CLASS="CONSTANT"
9019 >auto</TT
9020 >.
9021                 If set to <TT
9022 CLASS="CONSTANT"
9023 >false</TT
9024 > Samba will never produce these
9025                 broadcasts. If set to <TT
9026 CLASS="CONSTANT"
9027 >true</TT
9028 > Samba will produce
9029                 Lanman announce broadcasts at a frequency set by the parameter
9030                 <TT
9031 CLASS="PARAMETER"
9032 ><I
9033 >lm interval</I
9034 ></TT
9035 >. If set to <TT
9036 CLASS="CONSTANT"
9037 >auto</TT
9038 >
9039                 Samba will not send Lanman announce broadcasts by default but will
9040                 listen for them. If it hears such a broadcast on the wire it will
9041                 then start sending them at a frequency set by the parameter
9042                 <TT
9043 CLASS="PARAMETER"
9044 ><I
9045 >lm interval</I
9046 ></TT
9047 >.</P
9048 ><P
9049 >See also <A
9050 HREF="#LMINTERVAL"
9051 ><TT
9052 CLASS="PARAMETER"
9053 ><I
9054 >lm interval
9055                 </I
9056 ></TT
9057 ></A
9058 >.</P
9059 ><P
9060 >Default: <B
9061 CLASS="COMMAND"
9062 >lm announce = auto</B
9063 ></P
9064 ><P
9065 >Example: <B
9066 CLASS="COMMAND"
9067 >lm announce = yes</B
9068 ></P
9069 ></DD
9070 ><DT
9071 ><A
9072 NAME="LMINTERVAL"
9073 ></A
9074 >lm interval (G)</DT
9075 ><DD
9076 ><P
9077 >If Samba is set to produce Lanman announce
9078                 broadcasts needed by OS/2 clients (see the <A
9079 HREF="#LMANNOUNCE"
9080 >               <TT
9081 CLASS="PARAMETER"
9082 ><I
9083 >lm announce</I
9084 ></TT
9085 ></A
9086 > parameter) then this
9087                 parameter defines the frequency in seconds with which they will be
9088                 made.  If this is set to zero then no Lanman announcements will be
9089                 made despite the setting of the <TT
9090 CLASS="PARAMETER"
9091 ><I
9092 >lm announce</I
9093 ></TT
9094 >
9095                 parameter.</P
9096 ><P
9097 >See also <A
9098 HREF="#LMANNOUNCE"
9099 ><TT
9100 CLASS="PARAMETER"
9101 ><I
9102 >lm
9103                 announce</I
9104 ></TT
9105 ></A
9106 >.</P
9107 ><P
9108 >Default: <B
9109 CLASS="COMMAND"
9110 >lm interval = 60</B
9111 ></P
9112 ><P
9113 >Example: <B
9114 CLASS="COMMAND"
9115 >lm interval = 120</B
9116 ></P
9117 ></DD
9118 ><DT
9119 ><A
9120 NAME="LOADPRINTERS"
9121 ></A
9122 >load printers (G)</DT
9123 ><DD
9124 ><P
9125 >A boolean variable that controls whether all
9126                 printers in the printcap will be loaded for browsing by default.
9127                 See the <A
9128 HREF="#AEN78"
9129 >printers</A
9130 > section for
9131                 more details.</P
9132 ><P
9133 >Default: <B
9134 CLASS="COMMAND"
9135 >load printers = yes</B
9136 ></P
9137 ></DD
9138 ><DT
9139 ><A
9140 NAME="LOCALMASTER"
9141 ></A
9142 >local master (G)</DT
9143 ><DD
9144 ><P
9145 >This option allows <A
9146 HREF="nmbd.8.html"
9147 TARGET="_top"
9148 ><B
9149 CLASS="COMMAND"
9150 >               nmbd(8)</B
9151 ></A
9152 > to try and become a local master browser
9153                 on a subnet. If set to <TT
9154 CLASS="CONSTANT"
9155 >False</TT
9156 > then <B
9157 CLASS="COMMAND"
9158 >               nmbd</B
9159 > will not attempt to become a local master browser
9160                 on a subnet and will also lose in all browsing elections. By
9161                 default this value is set to true. Setting this value to true doesn't
9162                 mean that Samba will <I
9163 CLASS="EMPHASIS"
9164 >become</I
9165 > the local master
9166                 browser on a subnet, just that <B
9167 CLASS="COMMAND"
9168 >nmbd</B
9169 > will <I
9170 CLASS="EMPHASIS"
9171 >               participate</I
9172 > in elections for local master browser.</P
9173 ><P
9174 >Setting this value to False will cause <B
9175 CLASS="COMMAND"
9176 >nmbd</B
9177 >
9178                 <I
9179 CLASS="EMPHASIS"
9180 >never</I
9181 > to become a local master browser.</P
9182 ><P
9183 >Default: <B
9184 CLASS="COMMAND"
9185 >local master = yes</B
9186 ></P
9187 ></DD
9188 ><DT
9189 ><A
9190 NAME="LOCKDIR"
9191 ></A
9192 >lock dir (G)</DT
9193 ><DD
9194 ><P
9195 >Synonym for <A
9196 HREF="#LOCKDIRECTORY"
9197 ><TT
9198 CLASS="PARAMETER"
9199 ><I
9200 >               lock directory</I
9201 ></TT
9202 ></A
9203 >.</P
9204 ></DD
9205 ><DT
9206 ><A
9207 NAME="LOCKDIRECTORY"
9208 ></A
9209 >lock directory (G)</DT
9210 ><DD
9211 ><P
9212 >This option specifies the directory where lock
9213                 files will be placed.  The lock files are used to implement the
9214                 <A
9215 HREF="#MAXCONNECTIONS"
9216 ><TT
9217 CLASS="PARAMETER"
9218 ><I
9219 >max connections</I
9220 ></TT
9221 >
9222                 </A
9223 > option.</P
9224 ><P
9225 >Default: <B
9226 CLASS="COMMAND"
9227 >lock directory = ${prefix}/var/locks</B
9228 ></P
9229 ><P
9230 >Example: <B
9231 CLASS="COMMAND"
9232 >lock directory = /var/run/samba/locks</B
9233 >
9234                 </P
9235 ></DD
9236 ><DT
9237 ><A
9238 NAME="LOCKING"
9239 ></A
9240 >locking (S)</DT
9241 ><DD
9242 ><P
9243 >This controls whether or not locking will be
9244                 performed by the server in response to lock requests from the
9245                 client.</P
9246 ><P
9247 >If <B
9248 CLASS="COMMAND"
9249 >locking = no</B
9250 >, all lock and unlock
9251                 requests will appear to succeed and all lock queries will report
9252                 that the file in question is available for locking.</P
9253 ><P
9254 >If <B
9255 CLASS="COMMAND"
9256 >locking = yes</B
9257 >, real locking will be performed
9258                 by the server.</P
9259 ><P
9260 >This option <I
9261 CLASS="EMPHASIS"
9262 >may</I
9263 > be useful for read-only
9264                 filesystems which <I
9265 CLASS="EMPHASIS"
9266 >may</I
9267 > not need locking (such as
9268                 cdrom drives), although setting this parameter of <TT
9269 CLASS="CONSTANT"
9270 >no</TT
9271 >
9272                 is not really recommended even in this case.</P
9273 ><P
9274 >Be careful about disabling locking either globally or in a
9275                 specific service, as lack of locking may result in data corruption.
9276                 You should never need to set this parameter.</P
9277 ><P
9278 >Default: <B
9279 CLASS="COMMAND"
9280 >locking = yes</B
9281 ></P
9282 ></DD
9283 ><DT
9284 ><A
9285 NAME="LOGFILE"
9286 ></A
9287 >log file (G)</DT
9288 ><DD
9289 ><P
9290 >This option allows you to override the name
9291                 of the Samba log file (also known as the debug file).</P
9292 ><P
9293 >This option takes the standard substitutions, allowing
9294                 you to have separate log files for each user or machine.</P
9295 ><P
9296 >Example: <B
9297 CLASS="COMMAND"
9298 >log file = /usr/local/samba/var/log.%m
9299                 </B
9300 ></P
9301 ></DD
9302 ><DT
9303 ><A
9304 NAME="LOGLEVEL"
9305 ></A
9306 >log level (G)</DT
9307 ><DD
9308 ><P
9309 >Synonym for <A
9310 HREF="#DEBUGLEVEL"
9311 ><TT
9312 CLASS="PARAMETER"
9313 ><I
9314 >               debug level</I
9315 ></TT
9316 ></A
9317 >.</P
9318 ></DD
9319 ><DT
9320 ><A
9321 NAME="LOGONDRIVE"
9322 ></A
9323 >logon drive (G)</DT
9324 ><DD
9325 ><P
9326 >This parameter specifies the local path to
9327                 which the home directory will be connected (see <A
9328 HREF="#LOGONHOME"
9329 ><TT
9330 CLASS="PARAMETER"
9331 ><I
9332 >logon home</I
9333 ></TT
9334 ></A
9335 >)
9336                 and is only used by NT Workstations. </P
9337 ><P
9338 >Note that this option is only useful if Samba is set up as a
9339                 logon server.</P
9340 ><P
9341 >Default: <B
9342 CLASS="COMMAND"
9343 >logon drive = z:</B
9344 ></P
9345 ><P
9346 >Example: <B
9347 CLASS="COMMAND"
9348 >logon drive = h:</B
9349 ></P
9350 ></DD
9351 ><DT
9352 ><A
9353 NAME="LOGONHOME"
9354 ></A
9355 >logon home (G)</DT
9356 ><DD
9357 ><P
9358 >This parameter specifies the home directory
9359                 location when a Win95/98 or NT Workstation logs into a Samba PDC.
9360                 It allows you to do </P
9361 ><P
9362 ><TT
9363 CLASS="PROMPT"
9364 >C:\&#62; </TT
9365 ><TT
9366 CLASS="USERINPUT"
9367 ><B
9368 >NET USE H: /HOME</B
9369 ></TT
9370 >
9371                 </P
9372 ><P
9373 >from a command prompt, for example.</P
9374 ><P
9375 >This option takes the standard substitutions, allowing
9376                 you to have separate logon scripts for each user or machine.</P
9377 ><P
9378 >This parameter can be used with Win9X workstations to ensure
9379                 that roaming profiles are stored in a subdirectory of the user's
9380                 home directory.  This is done in the following way:</P
9381 ><P
9382 ><B
9383 CLASS="COMMAND"
9384 >logon home = \\%N\%U\profile</B
9385 ></P
9386 ><P
9387 >This tells Samba to return the above string, with
9388                 substitutions made when a client requests the info, generally
9389                 in a NetUserGetInfo request.  Win9X clients truncate the info to
9390                 \\server\share when a user does <B
9391 CLASS="COMMAND"
9392 >net use /home"</B
9393 >
9394                 but use the whole string when dealing with profiles.</P
9395 ><P
9396 >Note that in prior versions of Samba, the <A
9397 HREF="#LOGONPATH"
9398 >               <TT
9399 CLASS="PARAMETER"
9400 ><I
9401 >logon path</I
9402 ></TT
9403 ></A
9404 > was returned rather than
9405                 <TT
9406 CLASS="PARAMETER"
9407 ><I
9408 >logon home</I
9409 ></TT
9410 >.  This broke <B
9411 CLASS="COMMAND"
9412 >net use
9413                 /home</B
9414 > but allowed profiles outside the home directory.
9415                 The current implementation is correct, and can be used for
9416                 profiles if you use the above trick.</P
9417 ><P
9418 >This option is only useful if Samba is set up as a logon
9419                 server.</P
9420 ><P
9421 >Default: <B
9422 CLASS="COMMAND"
9423 >logon home = "\\%N\%U"</B
9424 ></P
9425 ><P
9426 >Example: <B
9427 CLASS="COMMAND"
9428 >logon home = "\\remote_smb_server\%U"</B
9429 >
9430                 </P
9431 ></DD
9432 ><DT
9433 ><A
9434 NAME="LOGONPATH"
9435 ></A
9436 >logon path (G)</DT
9437 ><DD
9438 ><P
9439 >This parameter specifies the home directory
9440                 where roaming profiles (NTuser.dat etc files for Windows NT) are
9441                 stored.  Contrary to previous versions of these manual pages, it has
9442                 nothing to do with Win 9X roaming profiles.  To find out how to
9443                 handle roaming profiles for Win 9X system, see the <A
9444 HREF="#LOGONHOME"
9445 >               <TT
9446 CLASS="PARAMETER"
9447 ><I
9448 >logon home</I
9449 ></TT
9450 ></A
9451 > parameter.</P
9452 ><P
9453 >This option takes the standard substitutions, allowing you
9454                 to have separate logon scripts for each user or machine.  It also
9455                 specifies the directory from which the "Application Data",
9456                 (<TT
9457 CLASS="FILENAME"
9458 >desktop</TT
9459 >, <TT
9460 CLASS="FILENAME"
9461 >start menu</TT
9462 >,
9463                 <TT
9464 CLASS="FILENAME"
9465 >network neighborhood</TT
9466 >, <TT
9467 CLASS="FILENAME"
9468 >programs</TT
9469 >
9470                 and other folders, and their contents, are loaded and displayed on
9471                 your Windows NT client.</P
9472 ><P
9473 >The share and the path must be readable by the user for
9474                 the preferences and directories to be loaded onto the Windows NT
9475                 client.  The share must be writeable when the logs in for the first
9476                 time, in order that the Windows NT client can create the NTuser.dat
9477                 and other directories.</P
9478 ><P
9479 >Thereafter, the directories and any of the contents can,
9480                 if required, be made read-only.  It is not advisable that the
9481                 NTuser.dat file be made read-only - rename it to NTuser.man to
9482                 achieve the desired effect (a <I
9483 CLASS="EMPHASIS"
9484 >MAN</I
9485 >datory
9486                 profile). </P
9487 ><P
9488 >Windows clients can sometimes maintain a connection to
9489                 the [homes] share, even though there is no user logged in.
9490                 Therefore, it is vital that the logon path does not include a
9491                 reference to the homes share (i.e. setting this parameter to
9492                 \%N\%U\profile_path will cause problems).</P
9493 ><P
9494 >This option takes the standard substitutions, allowing
9495                 you to have separate logon scripts for each user or machine.</P
9496 ><P
9497 >Note that this option is only useful if Samba is set up
9498                 as a logon server.</P
9499 ><P
9500 >Default: <B
9501 CLASS="COMMAND"
9502 >logon path = \\%N\%U\profile</B
9503 ></P
9504 ><P
9505 >Example: <B
9506 CLASS="COMMAND"
9507 >logon path = \\PROFILESERVER\PROFILE\%U</B
9508 ></P
9509 ></DD
9510 ><DT
9511 ><A
9512 NAME="LOGONSCRIPT"
9513 ></A
9514 >logon script (G)</DT
9515 ><DD
9516 ><P
9517 >This parameter specifies the batch file (.bat) or
9518                 NT command file (.cmd) to be downloaded and run on a machine when
9519                 a user successfully logs in.  The file must contain the DOS
9520                 style cr/lf line endings. Using a DOS-style editor to create the
9521                 file is recommended.</P
9522 ><P
9523 >The script must be a relative path to the [netlogon]
9524                 service.  If the [netlogon] service specifies a <A
9525 HREF="#PATH"
9526 >               <TT
9527 CLASS="PARAMETER"
9528 ><I
9529 >path</I
9530 ></TT
9531 ></A
9532 > of <TT
9533 CLASS="FILENAME"
9534 >/usr/local/samba/netlogon
9535                 </TT
9536 >, and <B
9537 CLASS="COMMAND"
9538 >logon script = STARTUP.BAT</B
9539 >, then
9540                 the file that will be downloaded is:</P
9541 ><P
9542 ><TT
9543 CLASS="FILENAME"
9544 >/usr/local/samba/netlogon/STARTUP.BAT</TT
9545 ></P
9546 ><P
9547 >The contents of the batch file is entirely your choice.  A
9548                 suggested command would be to add <B
9549 CLASS="COMMAND"
9550 >NET TIME \\SERVER /SET
9551                 /YES</B
9552 >, to force every machine to synchronize clocks with
9553                 the same time server.  Another use would be to add <B
9554 CLASS="COMMAND"
9555 >NET USE
9556                 U: \\SERVER\UTILS</B
9557 > for commonly used utilities, or <B
9558 CLASS="COMMAND"
9559 >               NET USE Q: \\SERVER\ISO9001_QA</B
9560 > for example.</P
9561 ><P
9562 >Note that it is particularly important not to allow write
9563                 access to the [netlogon] share, or to grant users write permission
9564                 on the batch files in a secure environment, as this would allow
9565                 the batch files to be arbitrarily modified and security to be
9566                 breached.</P
9567 ><P
9568 >This option takes the standard substitutions, allowing you
9569                 to have separate logon scripts for each user or machine.</P
9570 ><P
9571 >This option is only useful if Samba is set up as a logon
9572                 server.</P
9573 ><P
9574 >Default: <I
9575 CLASS="EMPHASIS"
9576 >no logon script defined</I
9577 ></P
9578 ><P
9579 >Example: <B
9580 CLASS="COMMAND"
9581 >logon script = scripts\%U.bat</B
9582 ></P
9583 ></DD
9584 ><DT
9585 ><A
9586 NAME="LPPAUSECOMMAND"
9587 ></A
9588 >lppause command (S)</DT
9589 ><DD
9590 ><P
9591 >This parameter specifies the command to be
9592                 executed on the server host in order to stop printing or spooling
9593                 a specific print job.</P
9594 ><P
9595 >This command should be a program or script which takes
9596                 a printer name and job number to pause the print job. One way
9597                 of implementing this is by using job priorities, where jobs
9598                 having a too low priority won't be sent to the printer.</P
9599 ><P
9600 >If a <TT
9601 CLASS="PARAMETER"
9602 ><I
9603 >%p</I
9604 ></TT
9605 > is given then the printername
9606                 is put in its place. A <TT
9607 CLASS="PARAMETER"
9608 ><I
9609 >%j</I
9610 ></TT
9611 > is replaced with
9612                 the job number (an integer).  On HPUX (see <TT
9613 CLASS="PARAMETER"
9614 ><I
9615 >printing=hpux
9616                 </I
9617 ></TT
9618 >), if the <TT
9619 CLASS="PARAMETER"
9620 ><I
9621 >-p%p</I
9622 ></TT
9623 > option is added
9624                 to the lpq command, the job will show up with the correct status, i.e.
9625                 if the job priority is lower than the set fence priority it will
9626                 have the PAUSED status, whereas if  the priority is equal or higher it
9627                 will have the SPOOLED or PRINTING status.</P
9628 ><P
9629 >Note that it is good practice to include the absolute path
9630                 in the lppause command as the PATH may not be available to the server.</P
9631 ><P
9632 >See also the <A
9633 HREF="#PRINTING"
9634 ><TT
9635 CLASS="PARAMETER"
9636 ><I
9637 >printing
9638                 </I
9639 ></TT
9640 ></A
9641 > parameter.</P
9642 ><P
9643 >Default: Currently no default value is given to
9644                 this string, unless the value of the <TT
9645 CLASS="PARAMETER"
9646 ><I
9647 >printing</I
9648 ></TT
9649 >
9650                 parameter is <TT
9651 CLASS="CONSTANT"
9652 >SYSV</TT
9653 >, in which case the default is :</P
9654 ><P
9655 ><B
9656 CLASS="COMMAND"
9657 >lp -i %p-%j -H hold</B
9658 ></P
9659 ><P
9660 >or if the value of the <TT
9661 CLASS="PARAMETER"
9662 ><I
9663 >printing</I
9664 ></TT
9665 > parameter
9666                 is <TT
9667 CLASS="CONSTANT"
9668 >SOFTQ</TT
9669 >, then the default is:</P
9670 ><P
9671 ><B
9672 CLASS="COMMAND"
9673 >qstat -s -j%j -h</B
9674 ></P
9675 ><P
9676 >Example for HPUX: <B
9677 CLASS="COMMAND"
9678 >lppause command = /usr/bin/lpalt
9679                 %p-%j -p0</B
9680 ></P
9681 ></DD
9682 ><DT
9683 ><A
9684 NAME="LPQCACHETIME"
9685 ></A
9686 >lpq cache time (G)</DT
9687 ><DD
9688 ><P
9689 >This controls how long lpq info will be cached
9690                 for to prevent the <B
9691 CLASS="COMMAND"
9692 >lpq</B
9693 > command being called too
9694                 often. A separate cache is kept for each variation of the <B
9695 CLASS="COMMAND"
9696 >               lpq</B
9697 > command used by the system, so if you use different
9698                 <B
9699 CLASS="COMMAND"
9700 >lpq</B
9701 > commands for different users then they won't
9702                 share cache information.</P
9703 ><P
9704 >The cache files are stored in <TT
9705 CLASS="FILENAME"
9706 >/tmp/lpq.xxxx</TT
9707 >
9708                 where xxxx is a hash of the <B
9709 CLASS="COMMAND"
9710 >lpq</B
9711 > command in use.</P
9712 ><P
9713 >The default is 10 seconds, meaning that the cached results
9714                 of a previous identical <B
9715 CLASS="COMMAND"
9716 >lpq</B
9717 > command will be used
9718                 if the cached data is less than 10 seconds old. A large value may
9719                 be advisable if your <B
9720 CLASS="COMMAND"
9721 >lpq</B
9722 > command is very slow.</P
9723 ><P
9724 >A value of 0 will disable caching completely.</P
9725 ><P
9726 >See also the <A
9727 HREF="#PRINTING"
9728 ><TT
9729 CLASS="PARAMETER"
9730 ><I
9731 >printing
9732                 </I
9733 ></TT
9734 ></A
9735 > parameter.</P
9736 ><P
9737 >Default: <B
9738 CLASS="COMMAND"
9739 >lpq cache time = 10</B
9740 ></P
9741 ><P
9742 >Example: <B
9743 CLASS="COMMAND"
9744 >lpq cache time = 30</B
9745 ></P
9746 ></DD
9747 ><DT
9748 ><A
9749 NAME="LPQCOMMAND"
9750 ></A
9751 >lpq command (S)</DT
9752 ><DD
9753 ><P
9754 >This parameter specifies the command to be
9755                 executed on the server host in order to obtain <B
9756 CLASS="COMMAND"
9757 >lpq
9758                 </B
9759 >-style printer status information.</P
9760 ><P
9761 >This command should be a program or script which
9762                 takes a printer name as its only parameter and outputs printer
9763                 status information.</P
9764 ><P
9765 >Currently eight styles of printer status information
9766                 are supported; BSD, AIX, LPRNG, PLP, SYSV, HPUX, QNX and SOFTQ.
9767                 This covers most UNIX systems. You control which type is expected
9768                 using the <TT
9769 CLASS="PARAMETER"
9770 ><I
9771 >printing =</I
9772 ></TT
9773 > option.</P
9774 ><P
9775 >Some clients (notably Windows for Workgroups) may not
9776                 correctly send the connection number for the printer they are
9777                 requesting status information about. To get around this, the
9778                 server reports on the first printer service connected to by the
9779                 client. This only happens if the connection number sent is invalid.</P
9780 ><P
9781 >If a <TT
9782 CLASS="PARAMETER"
9783 ><I
9784 >%p</I
9785 ></TT
9786 > is given then the printername
9787                 is put in its place. Otherwise it is placed at the end of the
9788                 command.</P
9789 ><P
9790 >Note that it is good practice to include the absolute path
9791                 in the <TT
9792 CLASS="PARAMETER"
9793 ><I
9794 >lpq command</I
9795 ></TT
9796 > as the <TT
9797 CLASS="ENVAR"
9798 >$PATH
9799                 </TT
9800 > may not be available to the server.</P
9801 ><P
9802 >See also the <A
9803 HREF="#PRINTING"
9804 ><TT
9805 CLASS="PARAMETER"
9806 ><I
9807 >printing
9808                 </I
9809 ></TT
9810 ></A
9811 > parameter.</P
9812 ><P
9813 >Default: <I
9814 CLASS="EMPHASIS"
9815 >depends on the setting of <TT
9816 CLASS="PARAMETER"
9817 ><I
9818 >               printing</I
9819 ></TT
9820 ></I
9821 ></P
9822 ><P
9823 >Example: <B
9824 CLASS="COMMAND"
9825 >lpq command = /usr/bin/lpq -P%p</B
9826 ></P
9827 ></DD
9828 ><DT
9829 ><A
9830 NAME="LPRESUMECOMMAND"
9831 ></A
9832 >lpresume command (S)</DT
9833 ><DD
9834 ><P
9835 >This parameter specifies the command to be
9836                 executed on the server host in order to restart or continue
9837                 printing or spooling a specific print job.</P
9838 ><P
9839 >This command should be a program or script which takes
9840                 a printer name and job number to resume the print job. See
9841                 also the <A
9842 HREF="#LPPAUSECOMMAND"
9843 ><TT
9844 CLASS="PARAMETER"
9845 ><I
9846 >lppause command
9847                 </I
9848 ></TT
9849 ></A
9850 > parameter.</P
9851 ><P
9852 >If a <TT
9853 CLASS="PARAMETER"
9854 ><I
9855 >%p</I
9856 ></TT
9857 > is given then the printername
9858                 is put in its place. A <TT
9859 CLASS="PARAMETER"
9860 ><I
9861 >%j</I
9862 ></TT
9863 > is replaced with
9864                 the job number (an integer).</P
9865 ><P
9866 >Note that it is good practice to include the absolute path
9867                 in the <TT
9868 CLASS="PARAMETER"
9869 ><I
9870 >lpresume command</I
9871 ></TT
9872 > as the PATH may not
9873                 be available to the server.</P
9874 ><P
9875 >See also the <A
9876 HREF="#PRINTING"
9877 ><TT
9878 CLASS="PARAMETER"
9879 ><I
9880 >printing
9881                 </I
9882 ></TT
9883 ></A
9884 > parameter.</P
9885 ><P
9886 >Default: Currently no default value is given
9887                 to this string, unless the value of the <TT
9888 CLASS="PARAMETER"
9889 ><I
9890 >printing</I
9891 ></TT
9892 >
9893                 parameter is <TT
9894 CLASS="CONSTANT"
9895 >SYSV</TT
9896 >, in which case the default is :</P
9897 ><P
9898 ><B
9899 CLASS="COMMAND"
9900 >lp -i %p-%j -H resume</B
9901 ></P
9902 ><P
9903 >or if the value of the <TT
9904 CLASS="PARAMETER"
9905 ><I
9906 >printing</I
9907 ></TT
9908 > parameter
9909                 is <TT
9910 CLASS="CONSTANT"
9911 >SOFTQ</TT
9912 >, then the default is:</P
9913 ><P
9914 ><B
9915 CLASS="COMMAND"
9916 >qstat -s -j%j -r</B
9917 ></P
9918 ><P
9919 >Example for HPUX: <B
9920 CLASS="COMMAND"
9921 >lpresume command = /usr/bin/lpalt
9922                 %p-%j -p2</B
9923 ></P
9924 ></DD
9925 ><DT
9926 ><A
9927 NAME="LPRMCOMMAND"
9928 ></A
9929 >lprm command (S)</DT
9930 ><DD
9931 ><P
9932 >This parameter specifies the command to be
9933                 executed on the server host in order to delete a print job.</P
9934 ><P
9935 >This command should be a program or script which takes
9936                 a printer name and job number, and deletes the print job.</P
9937 ><P
9938 >If a <TT
9939 CLASS="PARAMETER"
9940 ><I
9941 >%p</I
9942 ></TT
9943 > is given then the printername
9944                 is put in its place. A <TT
9945 CLASS="PARAMETER"
9946 ><I
9947 >%j</I
9948 ></TT
9949 > is replaced with
9950                 the job number (an integer).</P
9951 ><P
9952 >Note that it is good practice to include the absolute
9953                 path in the <TT
9954 CLASS="PARAMETER"
9955 ><I
9956 >lprm command</I
9957 ></TT
9958 > as the PATH may not be
9959                 available to the server.</P
9960 ><P
9961 >See also the <A
9962 HREF="#PRINTING"
9963 ><TT
9964 CLASS="PARAMETER"
9965 ><I
9966 >printing
9967                 </I
9968 ></TT
9969 ></A
9970 > parameter.</P
9971 ><P
9972 >Default: <I
9973 CLASS="EMPHASIS"
9974 >depends on the setting of <TT
9975 CLASS="PARAMETER"
9976 ><I
9977 >printing
9978                 </I
9979 ></TT
9980 ></I
9981 ></P
9982 ><P
9983 >Example 1: <B
9984 CLASS="COMMAND"
9985 >lprm command = /usr/bin/lprm -P%p %j
9986                 </B
9987 ></P
9988 ><P
9989 >Example 2: <B
9990 CLASS="COMMAND"
9991 >lprm command = /usr/bin/cancel %p-%j
9992                 </B
9993 ></P
9994 ></DD
9995 ><DT
9996 ><A
9997 NAME="MACHINEPASSWORDTIMEOUT"
9998 ></A
9999 >machine password timeout (G)</DT
10000 ><DD
10001 ><P
10002 >If a Samba server is a member of an Windows
10003                 NT Domain (see the <A
10004 HREF="#SECURITYEQUALSDOMAIN"
10005 >security=domain</A
10006 >)
10007                 parameter) then periodically a running <A
10008 HREF="smbd.8.html"
10009 TARGET="_top"
10010 >               smbd(8)</A
10011 > process will try and change the MACHINE ACCOUNT
10012                 PASSWORD stored in the TDB called <TT
10013 CLASS="FILENAME"
10014 >private/secrets.tdb
10015                 </TT
10016 >.  This parameter specifies how often this password
10017                 will be changed, in seconds. The default is one week (expressed in
10018                 seconds), the same as a Windows NT Domain member server.</P
10019 ><P
10020 >See also <A
10021 HREF="smbpasswd.8.html"
10022 TARGET="_top"
10023 ><B
10024 CLASS="COMMAND"
10025 >smbpasswd(8)
10026                 </B
10027 ></A
10028 >, and the <A
10029 HREF="#SECURITYEQUALSDOMAIN"
10030 >               security=domain</A
10031 >) parameter.</P
10032 ><P
10033 >Default: <B
10034 CLASS="COMMAND"
10035 >machine password timeout = 604800</B
10036 ></P
10037 ></DD
10038 ><DT
10039 ><A
10040 NAME="MAGICOUTPUT"
10041 ></A
10042 >magic output (S)</DT
10043 ><DD
10044 ><P
10045 >This parameter specifies the name of a file
10046                 which will contain output created by a magic script (see the
10047                 <A
10048 HREF="#MAGICSCRIPT"
10049 ><TT
10050 CLASS="PARAMETER"
10051 ><I
10052 >magic script</I
10053 ></TT
10054 ></A
10055 >
10056                 parameter below).</P
10057 ><P
10058 >Warning: If two clients use the same <TT
10059 CLASS="PARAMETER"
10060 ><I
10061 >magic script
10062                 </I
10063 ></TT
10064 > in the same directory the output file content
10065                 is undefined.</P
10066 ><P
10067 >Default: <B
10068 CLASS="COMMAND"
10069 >magic output = &lt;magic script name&gt;.out
10070                 </B
10071 ></P
10072 ><P
10073 >Example: <B
10074 CLASS="COMMAND"
10075 >magic output = myfile.txt</B
10076 ></P
10077 ></DD
10078 ><DT
10079 ><A
10080 NAME="MAGICSCRIPT"
10081 ></A
10082 >magic script (S)</DT
10083 ><DD
10084 ><P
10085 >This parameter specifies the name of a file which,
10086                 if opened, will be executed by the server when the file is closed.
10087                 This allows a UNIX script to be sent to the Samba host and
10088                 executed on behalf of the connected user.</P
10089 ><P
10090 >Scripts executed in this way will be deleted upon
10091                 completion assuming that the user has the appripriate level
10092                 of priviledge and the ile permissions allow the deletion.</P
10093 ><P
10094 >If the script generates output, output will be sent to
10095                 the file specified by the <A
10096 HREF="#MAGICOUTPUT"
10097 ><TT
10098 CLASS="PARAMETER"
10099 ><I
10100 >               magic output</I
10101 ></TT
10102 ></A
10103 > parameter (see above).</P
10104 ><P
10105 >Note that some shells are unable to interpret scripts
10106                 containing CR/LF instead of CR as
10107                 the end-of-line marker. Magic scripts must be executable
10108                 <I
10109 CLASS="EMPHASIS"
10110 >as is</I
10111 > on the host, which for some hosts and
10112                 some shells will require filtering at the DOS end.</P
10113 ><P
10114 >Magic scripts are <I
10115 CLASS="EMPHASIS"
10116 >EXPERIMENTAL</I
10117 > and
10118                 should <I
10119 CLASS="EMPHASIS"
10120 >NOT</I
10121 > be relied upon.</P
10122 ><P
10123 >Default: <I
10124 CLASS="EMPHASIS"
10125 >None. Magic scripts disabled.</I
10126 ></P
10127 ><P
10128 >Example: <B
10129 CLASS="COMMAND"
10130 >magic script = user.csh</B
10131 ></P
10132 ></DD
10133 ><DT
10134 ><A
10135 NAME="MANGLECASE"
10136 ></A
10137 >mangle case (S)</DT
10138 ><DD
10139 ><P
10140 >See the section on <A
10141 HREF="#AEN201"
10142 >               NAME MANGLING</A
10143 ></P
10144 ><P
10145 >Default: <B
10146 CLASS="COMMAND"
10147 >mangle case = no</B
10148 ></P
10149 ></DD
10150 ><DT
10151 ><A
10152 NAME="MANGLEDMAP"
10153 ></A
10154 >mangled map (S)</DT
10155 ><DD
10156 ><P
10157 >This is for those who want to directly map UNIX
10158                 file names which can not be represented on Windows/DOS.  The mangling
10159                 of names is not always what is needed.  In particular you may have
10160                 documents with file extensions that differ between DOS and UNIX.
10161                 For example, under UNIX it is common to use <TT
10162 CLASS="FILENAME"
10163 >.html</TT
10164 >
10165                 for HTML files, whereas under Windows/DOS <TT
10166 CLASS="FILENAME"
10167 >.htm</TT
10168 >
10169                 is more commonly used.</P
10170 ><P
10171 >So to map <TT
10172 CLASS="FILENAME"
10173 >html</TT
10174 > to <TT
10175 CLASS="FILENAME"
10176 >htm</TT
10177 >
10178                 you would use:</P
10179 ><P
10180 ><B
10181 CLASS="COMMAND"
10182 >mangled map = (*.html *.htm)</B
10183 ></P
10184 ><P
10185 >One very useful case is to remove the annoying <TT
10186 CLASS="FILENAME"
10187 >;1
10188                 </TT
10189 > off the ends of filenames on some CDROMS (only visible
10190                 under some UNIXes). To do this use a map of (*;1 *;).</P
10191 ><P
10192 >Default: <I
10193 CLASS="EMPHASIS"
10194 >no mangled map</I
10195 ></P
10196 ><P
10197 >Example: <B
10198 CLASS="COMMAND"
10199 >mangled map = (*;1 *;)</B
10200 ></P
10201 ></DD
10202 ><DT
10203 ><A
10204 NAME="MANGLEDNAMES"
10205 ></A
10206 >mangled names (S)</DT
10207 ><DD
10208 ><P
10209 >This controls whether non-DOS names under UNIX
10210                 should be mapped to DOS-compatible names ("mangled") and made visible,
10211                 or whether non-DOS names should simply be ignored.</P
10212 ><P
10213 >See the section on <A
10214 HREF="#AEN201"
10215 >               NAME MANGLING</A
10216 > for details on how to control the mangling process.</P
10217 ><P
10218 >If mangling is used then the mangling algorithm is as follows:</P
10219 ><P
10220 ></P
10221 ><UL
10222 ><LI
10223 ><P
10224 >The first (up to) five alphanumeric characters
10225                         before the rightmost dot of the filename are preserved, forced
10226                         to upper case, and appear as the first (up to) five characters
10227                         of the mangled name.</P
10228 ></LI
10229 ><LI
10230 ><P
10231 >A tilde "~" is appended to the first part of the mangled
10232                         name, followed by a two-character unique sequence, based on the
10233                         original root name (i.e., the original filename minus its final
10234                         extension). The final extension is included in the hash calculation
10235                         only if it contains any upper case characters or is longer than three
10236                         characters.</P
10237 ><P
10238 >Note that the character to use may be specified using
10239                         the <A
10240 HREF="#MANGLINGCHAR"
10241 ><TT
10242 CLASS="PARAMETER"
10243 ><I
10244 >mangling char</I
10245 ></TT
10246 >
10247                         </A
10248 > option, if you don't like '~'.</P
10249 ></LI
10250 ><LI
10251 ><P
10252 >The first three alphanumeric characters of the final
10253                         extension are preserved, forced to upper case and appear as the
10254                         extension of the mangled name. The final extension is defined as that
10255                         part of the original filename after the rightmost dot. If there are no
10256                         dots in the filename, the mangled name will have no extension (except
10257                         in the case of "hidden files" - see below).</P
10258 ></LI
10259 ><LI
10260 ><P
10261 >Files whose UNIX name begins with a dot will be
10262                         presented as DOS hidden files. The mangled name will be created as
10263                         for other filenames, but with the leading dot removed and "___" as
10264                         its extension regardless of actual original extension (that's three
10265                         underscores).</P
10266 ></LI
10267 ></UL
10268 ><P
10269 >The two-digit hash value consists of upper case
10270                 alphanumeric characters.</P
10271 ><P
10272 >This algorithm can cause name collisions only if files
10273                 in a directory share the same first five alphanumeric characters.
10274                 The probability of such a clash is 1/1300.</P
10275 ><P
10276 >The name mangling (if enabled) allows a file to be
10277                 copied between UNIX directories from Windows/DOS while retaining
10278                 the long UNIX filename. UNIX files can be renamed to a new extension
10279                 from Windows/DOS and will retain the same basename. Mangled names
10280                 do not change between sessions.</P
10281 ><P
10282 >Default: <B
10283 CLASS="COMMAND"
10284 >mangled names = yes</B
10285 ></P
10286 ></DD
10287 ><DT
10288 ><A
10289 NAME="MANGLEDSTACK"
10290 ></A
10291 >mangled stack (G)</DT
10292 ><DD
10293 ><P
10294 >This parameter controls the number of mangled names
10295                 that should be cached in the Samba server <A
10296 HREF="smbd.8.html"
10297 TARGET="_top"
10298 >               smbd(8)</A
10299 >.</P
10300 ><P
10301 >This stack is a list of recently mangled base names
10302                 (extensions are only maintained if they are longer than 3 characters
10303                 or contains upper case characters).</P
10304 ><P
10305 >The larger this value, the more likely it is that mangled
10306                 names can be successfully converted to correct long UNIX names.
10307                 However, large stack sizes will slow most directory access. Smaller
10308                 stacks save memory in the server (each stack element costs 256 bytes).
10309                 </P
10310 ><P
10311 >It is not possible to absolutely guarantee correct long
10312                 file names, so be prepared for some surprises!</P
10313 ><P
10314 >Default: <B
10315 CLASS="COMMAND"
10316 >mangled stack = 50</B
10317 ></P
10318 ><P
10319 >Example: <B
10320 CLASS="COMMAND"
10321 >mangled stack = 100</B
10322 ></P
10323 ></DD
10324 ><DT
10325 ><A
10326 NAME="MANGLINGCHAR"
10327 ></A
10328 >mangling char (S)</DT
10329 ><DD
10330 ><P
10331 >This controls what character is used as
10332                 the <I
10333 CLASS="EMPHASIS"
10334 >magic</I
10335 > character in <A
10336 HREF="#AEN201"
10337 >name mangling</A
10338 >. The default is a '~'
10339                 but this may interfere with some software. Use this option to set
10340                 it to whatever you prefer.</P
10341 ><P
10342 >Default: <B
10343 CLASS="COMMAND"
10344 >mangling char = ~</B
10345 ></P
10346 ><P
10347 >Example: <B
10348 CLASS="COMMAND"
10349 >mangling char = ^</B
10350 ></P
10351 ></DD
10352 ><DT
10353 ><A
10354 NAME="MAPARCHIVE"
10355 ></A
10356 >map archive (S)</DT
10357 ><DD
10358 ><P
10359 >This controls whether the DOS archive attribute
10360                 should be mapped to the UNIX owner execute bit.  The DOS archive bit
10361                 is set when a file has been modified since its last backup.  One
10362                 motivation for this option it to keep Samba/your PC from making
10363                 any file it touches from becoming executable under UNIX.  This can
10364                 be quite annoying for shared source code, documents, etc...</P
10365 ><P
10366 >Note that this requires the <TT
10367 CLASS="PARAMETER"
10368 ><I
10369 >create mask</I
10370 ></TT
10371 >
10372                 parameter to be set such that owner execute bit is not masked out
10373                 (i.e. it must include 100). See the parameter <A
10374 HREF="#CREATEMASK"
10375 >               <TT
10376 CLASS="PARAMETER"
10377 ><I
10378 >create mask</I
10379 ></TT
10380 ></A
10381 > for details.</P
10382 ><P
10383 >Default: <B
10384 CLASS="COMMAND"
10385 >map archive = yes</B
10386 ></P
10387 ></DD
10388 ><DT
10389 ><A
10390 NAME="MAPHIDDEN"
10391 ></A
10392 >map hidden (S)</DT
10393 ><DD
10394 ><P
10395 >This controls whether DOS style hidden files
10396                 should be mapped to the UNIX world execute bit.</P
10397 ><P
10398 >Note that this requires the <TT
10399 CLASS="PARAMETER"
10400 ><I
10401 >create mask</I
10402 ></TT
10403 >
10404                 to be set such that the world execute bit is not masked out (i.e.
10405                 it must include 001). See the parameter <A
10406 HREF="#CREATEMASK"
10407 >               <TT
10408 CLASS="PARAMETER"
10409 ><I
10410 >create mask</I
10411 ></TT
10412 ></A
10413 > for details.</P
10414 ><P
10415 >Default: <B
10416 CLASS="COMMAND"
10417 >map hidden = no</B
10418 ></P
10419 ></DD
10420 ><DT
10421 ><A
10422 NAME="MAPSYSTEM"
10423 ></A
10424 >map system (S)</DT
10425 ><DD
10426 ><P
10427 >This controls whether DOS style system files
10428                 should be mapped to the UNIX group execute bit.</P
10429 ><P
10430 >Note that this requires the <TT
10431 CLASS="PARAMETER"
10432 ><I
10433 >create mask</I
10434 ></TT
10435 >
10436                 to be set such that the group execute bit is not masked out (i.e.
10437                 it must include 010). See the parameter <A
10438 HREF="#CREATEMASK"
10439 >               <TT
10440 CLASS="PARAMETER"
10441 ><I
10442 >create mask</I
10443 ></TT
10444 ></A
10445 > for details.</P
10446 ><P
10447 >Default: <B
10448 CLASS="COMMAND"
10449 >map system = no</B
10450 ></P
10451 ></DD
10452 ><DT
10453 ><A
10454 NAME="MAPTOGUEST"
10455 ></A
10456 >map to guest (G)</DT
10457 ><DD
10458 ><P
10459 >This parameter is only useful in <A
10460 HREF="#SECURITY"
10461 >               security</A
10462 > modes other than <TT
10463 CLASS="PARAMETER"
10464 ><I
10465 >security=share</I
10466 ></TT
10467 >
10468                 - i.e. <TT
10469 CLASS="CONSTANT"
10470 >user</TT
10471 >, <TT
10472 CLASS="CONSTANT"
10473 >server</TT
10474 >,
10475                 and <TT
10476 CLASS="CONSTANT"
10477 >domain</TT
10478 >.</P
10479 ><P
10480 >This parameter can take three different values, which tell
10481                 <A
10482 HREF="smbd.8.html"
10483 TARGET="_top"
10484 >smbd(8)</A
10485 > what to do with user
10486                 login requests that don't match a valid UNIX user in some way.</P
10487 ><P
10488 >The three settings are :</P
10489 ><P
10490 ></P
10491 ><UL
10492 ><LI
10493 ><P
10494 ><TT
10495 CLASS="CONSTANT"
10496 >Never</TT
10497 > - Means user login
10498                         requests with an invalid password are rejected. This is the
10499                         default.</P
10500 ></LI
10501 ><LI
10502 ><P
10503 ><TT
10504 CLASS="CONSTANT"
10505 >Bad User</TT
10506 > - Means user
10507                         logins with an invalid password are rejected, unless the username
10508                         does not exist, in which case it is treated as a guest login and
10509                         mapped into the <A
10510 HREF="#GUESTACCOUNT"
10511 ><TT
10512 CLASS="PARAMETER"
10513 ><I
10514 >                       guest account</I
10515 ></TT
10516 ></A
10517 >.</P
10518 ></LI
10519 ><LI
10520 ><P
10521 ><TT
10522 CLASS="CONSTANT"
10523 >Bad Password</TT
10524 > - Means user logins
10525                         with an invalid password are treated as a guest login and mapped
10526                         into the <A
10527 HREF="#GUESTACCOUNT"
10528 >guest account</A
10529 >. Note that
10530                         this can cause problems as it means that any user incorrectly typing
10531                         their password will be silently logged on as "guest" - and
10532                         will not know the reason they cannot access files they think
10533                         they should - there will have been no message given to them
10534                         that they got their password wrong. Helpdesk services will
10535                         <I
10536 CLASS="EMPHASIS"
10537 >hate</I
10538 > you if you set the <TT
10539 CLASS="PARAMETER"
10540 ><I
10541 >map to
10542                         guest</I
10543 ></TT
10544 > parameter this way :-).</P
10545 ></LI
10546 ></UL
10547 ><P
10548 >Note that this parameter is needed to set up "Guest"
10549                 share services when using <TT
10550 CLASS="PARAMETER"
10551 ><I
10552 >security</I
10553 ></TT
10554 > modes other than
10555                 share. This is because in these modes the name of the resource being
10556                 requested is <I
10557 CLASS="EMPHASIS"
10558 >not</I
10559 > sent to the server until after
10560                 the server has successfully authenticated the client so the server
10561                 cannot make authentication decisions at the correct time (connection
10562                 to the share) for "Guest" shares.</P
10563 ><P
10564 >For people familiar with the older Samba releases, this
10565                 parameter maps to the old compile-time setting of the <TT
10566 CLASS="CONSTANT"
10567 >               GUEST_SESSSETUP</TT
10568 > value in local.h.</P
10569 ><P
10570 >Default: <B
10571 CLASS="COMMAND"
10572 >map to guest = Never</B
10573 ></P
10574 ><P
10575 >Example: <B
10576 CLASS="COMMAND"
10577 >map to guest = Bad User</B
10578 ></P
10579 ></DD
10580 ><DT
10581 ><A
10582 NAME="MAXCONNECTIONS"
10583 ></A
10584 >max connections (S)</DT
10585 ><DD
10586 ><P
10587 >This option allows the number of simultaneous
10588                 connections to a service to be limited. If <TT
10589 CLASS="PARAMETER"
10590 ><I
10591 >max connections
10592                 </I
10593 ></TT
10594 > is greater than 0 then connections will be refused if
10595                 this number of connections to the service are already open. A value
10596                 of zero mean an unlimited number of connections may be made.</P
10597 ><P
10598 >Record lock files are used to implement this feature. The
10599                 lock files will be stored in the directory specified by the <A
10600 HREF="#LOCKDIRECTORY"
10601 ><TT
10602 CLASS="PARAMETER"
10603 ><I
10604 >lock directory</I
10605 ></TT
10606 ></A
10607 >
10608                 option.</P
10609 ><P
10610 >Default: <B
10611 CLASS="COMMAND"
10612 >max connections = 0</B
10613 ></P
10614 ><P
10615 >Example: <B
10616 CLASS="COMMAND"
10617 >max connections = 10</B
10618 ></P
10619 ></DD
10620 ><DT
10621 ><A
10622 NAME="MAXDISKSIZE"
10623 ></A
10624 >max disk size (G)</DT
10625 ><DD
10626 ><P
10627 >This option allows you to put an upper limit
10628                 on the apparent size of disks. If you set this option to 100
10629                 then all shares will appear to be not larger than 100 MB in
10630                 size.</P
10631 ><P
10632 >Note that this option does not limit the amount of
10633                 data you can put on the disk. In the above case you could still
10634                 store much more than 100 MB on the disk, but if a client ever asks
10635                 for the amount of free disk space or the total disk size then the
10636                 result will be bounded by the amount specified in <TT
10637 CLASS="PARAMETER"
10638 ><I
10639 >max
10640                 disk size</I
10641 ></TT
10642 >.</P
10643 ><P
10644 >This option is primarily useful to work around bugs
10645                 in some pieces of software that can't handle very large disks,
10646                 particularly disks over 1GB in size.</P
10647 ><P
10648 >A <TT
10649 CLASS="PARAMETER"
10650 ><I
10651 >max disk size</I
10652 ></TT
10653 > of 0 means no limit.</P
10654 ><P
10655 >Default: <B
10656 CLASS="COMMAND"
10657 >max disk size = 0</B
10658 ></P
10659 ><P
10660 >Example: <B
10661 CLASS="COMMAND"
10662 >max disk size = 1000</B
10663 ></P
10664 ></DD
10665 ><DT
10666 ><A
10667 NAME="MAXLOGSIZE"
10668 ></A
10669 >max log size (G)</DT
10670 ><DD
10671 ><P
10672 >This option (an integer in kilobytes) specifies
10673                 the max size the log file should grow to. Samba periodically checks
10674                 the size and if it is exceeded it will rename the file, adding
10675                 a <TT
10676 CLASS="FILENAME"
10677 >.old</TT
10678 > extension.</P
10679 ><P
10680 >A size of 0 means no limit.</P
10681 ><P
10682 >Default: <B
10683 CLASS="COMMAND"
10684 >max log size = 5000</B
10685 ></P
10686 ><P
10687 >Example: <B
10688 CLASS="COMMAND"
10689 >max log size = 1000</B
10690 ></P
10691 ></DD
10692 ><DT
10693 ><A
10694 NAME="MAXMUX"
10695 ></A
10696 >max mux (G)</DT
10697 ><DD
10698 ><P
10699 >This option controls the maximum number of
10700                 outstanding simultaneous SMB operations that samba tells the client
10701                 it will allow. You should never need to set this parameter.</P
10702 ><P
10703 >Default: <B
10704 CLASS="COMMAND"
10705 >max mux = 50</B
10706 ></P
10707 ></DD
10708 ><DT
10709 ><A
10710 NAME="MAXOPENFILES"
10711 ></A
10712 >max open files (G)</DT
10713 ><DD
10714 ><P
10715 >This parameter limits the maximum number of
10716                 open files that one <A
10717 HREF="smbd.8.html"
10718 TARGET="_top"
10719 >smbd(8)</A
10720 > file
10721                 serving process may have open for a client at any one time. The
10722                 default for this parameter is set very high (10,000) as Samba uses
10723                 only one bit per unopened file.</P
10724 ><P
10725 >The limit of the number of open files is usually set
10726                 by the UNIX per-process file descriptor limit rather than
10727                 this parameter so you should never need to touch this parameter.</P
10728 ><P
10729 >Default: <B
10730 CLASS="COMMAND"
10731 >max open files = 10000</B
10732 ></P
10733 ></DD
10734 ><DT
10735 ><A
10736 NAME="MAXPRINTJOBS"
10737 ></A
10738 >max print jobs (S)</DT
10739 ><DD
10740 ><P
10741 >This parameter limits the maximum number of
10742                 jobs allowable in a Samba printer queue at any given moment.
10743                 If this number is exceeded, <A
10744 HREF="smbd.8.html"
10745 TARGET="_top"
10746 ><B
10747 CLASS="COMMAND"
10748 >               smbd(8)</B
10749 ></A
10750 > will remote "Out of Space" to the client.
10751                 See all <A
10752 HREF="#TOTALPRINTJOBS"
10753 ><TT
10754 CLASS="PARAMETER"
10755 ><I
10756 >total
10757                 print jobs</I
10758 ></TT
10759 ></A
10760 >.
10761                 </P
10762 ><P
10763 >Default: <B
10764 CLASS="COMMAND"
10765 >max print jobs = 1000</B
10766 ></P
10767 ><P
10768 >Example: <B
10769 CLASS="COMMAND"
10770 >max print jobs = 5000</B
10771 ></P
10772 ></DD
10773 ><DT
10774 ><A
10775 NAME="MAXPROTOCOL"
10776 ></A
10777 >max protocol (G)</DT
10778 ><DD
10779 ><P
10780 >The value of the parameter (a string) is the highest
10781                 protocol level that will be supported by the server.</P
10782 ><P
10783 >Possible values are :</P
10784 ><P
10785 ></P
10786 ><UL
10787 ><LI
10788 ><P
10789 ><TT
10790 CLASS="CONSTANT"
10791 >CORE</TT
10792 >: Earliest version. No
10793                         concept of user names.</P
10794 ></LI
10795 ><LI
10796 ><P
10797 ><TT
10798 CLASS="CONSTANT"
10799 >COREPLUS</TT
10800 >: Slight improvements on
10801                         CORE for efficiency.</P
10802 ></LI
10803 ><LI
10804 ><P
10805 ><TT
10806 CLASS="CONSTANT"
10807 >LANMAN1</TT
10808 >: First <I
10809 CLASS="EMPHASIS"
10810 >                       modern</I
10811 > version of the protocol. Long filename
10812                         support.</P
10813 ></LI
10814 ><LI
10815 ><P
10816 ><TT
10817 CLASS="CONSTANT"
10818 >LANMAN2</TT
10819 >: Updates to Lanman1 protocol.
10820                         </P
10821 ></LI
10822 ><LI
10823 ><P
10824 ><TT
10825 CLASS="CONSTANT"
10826 >NT1</TT
10827 >: Current up to date version of
10828                         the protocol. Used by Windows NT. Known as CIFS.</P
10829 ></LI
10830 ></UL
10831 ><P
10832 >Normally this option should not be set as the automatic
10833                 negotiation phase in the SMB protocol takes care of choosing
10834                 the appropriate protocol.</P
10835 ><P
10836 >See also <A
10837 HREF="#MINPROTOCOL"
10838 ><TT
10839 CLASS="PARAMETER"
10840 ><I
10841 >min
10842                 protocol</I
10843 ></TT
10844 ></A
10845 ></P
10846 ><P
10847 >Default: <B
10848 CLASS="COMMAND"
10849 >max protocol = NT1</B
10850 ></P
10851 ><P
10852 >Example: <B
10853 CLASS="COMMAND"
10854 >max protocol = LANMAN1</B
10855 ></P
10856 ></DD
10857 ><DT
10858 ><A
10859 NAME="MAXSMBDPROCESSES"
10860 ></A
10861 >max smbd processes (G)</DT
10862 ><DD
10863 ><P
10864 >This parameter limits the maximum number of
10865                 <A
10866 HREF="smbd.8.html"
10867 TARGET="_top"
10868 ><B
10869 CLASS="COMMAND"
10870 >smbd(8)</B
10871 ></A
10872 >
10873                 processes concurrently running on a system and is intended
10874                 as a stop gap to prevent degrading service to clients in the event
10875                 that the server has insufficient resources to handle more than this
10876                 number of connections.  Remember that under normal operating
10877                 conditions, each user will have an smbd associated with him or her
10878                 to handle connections to all shares from a given host.
10879                 </P
10880 ><P
10881 >Default: <B
10882 CLASS="COMMAND"
10883 >max smbd processes = 0</B
10884 >   ## no limit</P
10885 ><P
10886 >Example: <B
10887 CLASS="COMMAND"
10888 >max smbd processes = 1000</B
10889 ></P
10890 ></DD
10891 ><DT
10892 ><A
10893 NAME="MAXTTL"
10894 ></A
10895 >max ttl (G)</DT
10896 ><DD
10897 ><P
10898 >This option tells <A
10899 HREF="nmbd.8.html"
10900 TARGET="_top"
10901 >nmbd(8)</A
10902 >
10903                 what the default 'time to live' of NetBIOS names should be (in seconds)
10904                 when <B
10905 CLASS="COMMAND"
10906 >nmbd</B
10907 > is requesting a name using either a
10908                 broadcast packet or from a WINS server. You should never need to
10909                 change this parameter. The default is 3 days.</P
10910 ><P
10911 >Default: <B
10912 CLASS="COMMAND"
10913 >max ttl = 259200</B
10914 ></P
10915 ></DD
10916 ><DT
10917 ><A
10918 NAME="MAXWINSTTL"
10919 ></A
10920 >max wins ttl (G)</DT
10921 ><DD
10922 ><P
10923 >This option tells <A
10924 HREF="nmbd.8.html"
10925 TARGET="_top"
10926 >nmbd(8)
10927                 </A
10928 > when acting as a WINS server (<A
10929 HREF="#WINSSUPPORT"
10930 >               <TT
10931 CLASS="PARAMETER"
10932 ><I
10933 >wins support=yes</I
10934 ></TT
10935 ></A
10936 >) what the maximum
10937                 'time to live' of NetBIOS names that <B
10938 CLASS="COMMAND"
10939 >nmbd</B
10940 >
10941                 will grant will be (in seconds). You should never need to change this
10942                 parameter.  The default is 6 days (518400 seconds).</P
10943 ><P
10944 >See also the <A
10945 HREF="#MINWINSTTL"
10946 ><TT
10947 CLASS="PARAMETER"
10948 ><I
10949 >min
10950                 wins ttl"</I
10951 ></TT
10952 ></A
10953 > parameter.</P
10954 ><P
10955 >Default: <B
10956 CLASS="COMMAND"
10957 >max wins ttl = 518400</B
10958 ></P
10959 ></DD
10960 ><DT
10961 ><A
10962 NAME="MAXXMIT"
10963 ></A
10964 >max xmit (G)</DT
10965 ><DD
10966 ><P
10967 >This option controls the maximum packet size
10968                 that will be negotiated by Samba. The default is 65535, which
10969                 is the maximum. In some cases you may find you get better performance
10970                 with a smaller value. A value below 2048 is likely to cause problems.
10971                 </P
10972 ><P
10973 >Default: <B
10974 CLASS="COMMAND"
10975 >max xmit = 65535</B
10976 ></P
10977 ><P
10978 >Example: <B
10979 CLASS="COMMAND"
10980 >max xmit = 8192</B
10981 ></P
10982 ></DD
10983 ><DT
10984 ><A
10985 NAME="MESSAGECOMMAND"
10986 ></A
10987 >message command (G)</DT
10988 ><DD
10989 ><P
10990 >This specifies what command to run when the
10991                 server receives a WinPopup style message.</P
10992 ><P
10993 >This would normally be a command that would
10994                 deliver the message somehow. How this is to be done is
10995                 up to your imagination.</P
10996 ><P
10997 >An example is:</P
10998 ><P
10999 ><B
11000 CLASS="COMMAND"
11001 >message command = csh -c 'xedit %s;rm %s' &#38;</B
11002 >
11003                 </P
11004 ><P
11005 >This delivers the message using <B
11006 CLASS="COMMAND"
11007 >xedit</B
11008 >, then
11009                 removes it afterwards. <I
11010 CLASS="EMPHASIS"
11011 >NOTE THAT IT IS VERY IMPORTANT
11012                 THAT THIS COMMAND RETURN IMMEDIATELY</I
11013 >. That's why I
11014                 have the '&#38;' on the end. If it doesn't return immediately then
11015                 your PCs may freeze when sending messages (they should recover
11016                 after 30secs, hopefully).</P
11017 ><P
11018 >All messages are delivered as the global guest user.
11019                 The command takes the standard substitutions, although <TT
11020 CLASS="PARAMETER"
11021 ><I
11022 >               %u</I
11023 ></TT
11024 > won't work (<TT
11025 CLASS="PARAMETER"
11026 ><I
11027 >%U</I
11028 ></TT
11029 > may be better
11030                 in this case).</P
11031 ><P
11032 >Apart from the standard substitutions, some additional
11033                 ones apply. In particular:</P
11034 ><P
11035 ></P
11036 ><UL
11037 ><LI
11038 ><P
11039 ><TT
11040 CLASS="PARAMETER"
11041 ><I
11042 >%s</I
11043 ></TT
11044 > = the filename containing
11045                         the message.</P
11046 ></LI
11047 ><LI
11048 ><P
11049 ><TT
11050 CLASS="PARAMETER"
11051 ><I
11052 >%t</I
11053 ></TT
11054 > = the destination that
11055                         the message was sent to (probably the server name).</P
11056 ></LI
11057 ><LI
11058 ><P
11059 ><TT
11060 CLASS="PARAMETER"
11061 ><I
11062 >%f</I
11063 ></TT
11064 > = who the message
11065                         is from.</P
11066 ></LI
11067 ></UL
11068 ><P
11069 >You could make this command send mail, or whatever else
11070                 takes your fancy. Please let us know of any really interesting
11071                 ideas you have.</P
11072 ><P
11073 >Here's a way of sending the messages as mail to root:</P
11074 ><P
11075 ><B
11076 CLASS="COMMAND"
11077 >message command = /bin/mail -s 'message from %f on
11078                 %m' root &lt; %s; rm %s</B
11079 ></P
11080 ><P
11081 >If you don't have a message command then the message
11082                 won't be delivered and Samba will tell the sender there was
11083                 an error. Unfortunately WfWg totally ignores the error code
11084                 and carries on regardless, saying that the message was delivered.
11085                 </P
11086 ><P
11087 >If you want to silently delete it then try:</P
11088 ><P
11089 ><B
11090 CLASS="COMMAND"
11091 >message command = rm %s</B
11092 ></P
11093 ><P
11094 >Default: <I
11095 CLASS="EMPHASIS"
11096 >no message command</I
11097 ></P
11098 ><P
11099 >Example: <B
11100 CLASS="COMMAND"
11101 >message command = csh -c 'xedit %s;
11102                 rm %s' &#38;</B
11103 ></P
11104 ></DD
11105 ><DT
11106 ><A
11107 NAME="MINPASSWDLENGTH"
11108 ></A
11109 >min passwd length (G)</DT
11110 ><DD
11111 ><P
11112 >Synonym for <A
11113 HREF="#MINPASSWORDLENGTH"
11114 >               <TT
11115 CLASS="PARAMETER"
11116 ><I
11117 >min password length</I
11118 ></TT
11119 ></A
11120 >.</P
11121 ></DD
11122 ><DT
11123 ><A
11124 NAME="MINPASSWORDLENGTH"
11125 ></A
11126 >min password length (G)</DT
11127 ><DD
11128 ><P
11129 >This option sets the minimum length in characters
11130                 of a plaintext password that <B
11131 CLASS="COMMAND"
11132 >smbd</B
11133 > will accept when performing
11134                 UNIX password changing.</P
11135 ><P
11136 >See also <A
11137 HREF="#UNIXPASSWORDSYNC"
11138 ><TT
11139 CLASS="PARAMETER"
11140 ><I
11141 >unix
11142                 password sync</I
11143 ></TT
11144 ></A
11145 >, <A
11146 HREF="#PASSWDPROGRAM"
11147 >               <TT
11148 CLASS="PARAMETER"
11149 ><I
11150 >passwd program</I
11151 ></TT
11152 ></A
11153 > and <A
11154 HREF="#PASSWDCHATDEBUG"
11155 ><TT
11156 CLASS="PARAMETER"
11157 ><I
11158 >passwd chat debug</I
11159 ></TT
11160 >
11161                 </A
11162 >.</P
11163 ><P
11164 >Default: <B
11165 CLASS="COMMAND"
11166 >min password length = 5</B
11167 ></P
11168 ></DD
11169 ><DT
11170 ><A
11171 NAME="MINPRINTSPACE"
11172 ></A
11173 >min print space (S)</DT
11174 ><DD
11175 ><P
11176 >This sets the minimum amount of free disk
11177                 space that must be available before a user will be able to spool
11178                 a print job. It is specified in kilobytes. The default is 0, which
11179                 means a user can always spool a print job.</P
11180 ><P
11181 >See also the <A
11182 HREF="#PRINTING"
11183 ><TT
11184 CLASS="PARAMETER"
11185 ><I
11186 >printing
11187                 </I
11188 ></TT
11189 ></A
11190 > parameter.</P
11191 ><P
11192 >Default: <B
11193 CLASS="COMMAND"
11194 >min print space = 0</B
11195 ></P
11196 ><P
11197 >Example: <B
11198 CLASS="COMMAND"
11199 >min print space = 2000</B
11200 ></P
11201 ></DD
11202 ><DT
11203 ><A
11204 NAME="MINPROTOCOL"
11205 ></A
11206 >min protocol (G)</DT
11207 ><DD
11208 ><P
11209 >The value of the parameter (a string) is the
11210                 lowest SMB protocol dialect than Samba will support.  Please refer
11211                 to the <A
11212 HREF="#MAXPROTOCOL"
11213 ><TT
11214 CLASS="PARAMETER"
11215 ><I
11216 >max protocol</I
11217 ></TT
11218 ></A
11219 >
11220                 parameter for a list of valid protocol names and a brief description
11221                 of each.  You may also wish to refer to the C source code in
11222                 <TT
11223 CLASS="FILENAME"
11224 >source/smbd/negprot.c</TT
11225 > for a listing of known protocol
11226                 dialects supported by clients.</P
11227 ><P
11228 >If you are viewing this parameter as a security measure, you should
11229                 also refer to the <A
11230 HREF="#LANMANAUTH"
11231 ><TT
11232 CLASS="PARAMETER"
11233 ><I
11234 >lanman
11235                 auth</I
11236 ></TT
11237 ></A
11238 > parameter.  Otherwise, you should never need
11239                 to change this parameter.</P
11240 ><P
11241 >Default : <B
11242 CLASS="COMMAND"
11243 >min protocol = CORE</B
11244 ></P
11245 ><P
11246 >Example : <B
11247 CLASS="COMMAND"
11248 >min protocol = NT1</B
11249 >  # disable DOS
11250                 clients</P
11251 ></DD
11252 ><DT
11253 ><A
11254 NAME="MINWINSTTL"
11255 ></A
11256 >min wins ttl (G)</DT
11257 ><DD
11258 ><P
11259 >This option tells <A
11260 HREF="nmbd.8.html"
11261 TARGET="_top"
11262 >nmbd(8)</A
11263 >
11264                 when acting as a WINS server (<A
11265 HREF="#WINSSUPPORT"
11266 ><TT
11267 CLASS="PARAMETER"
11268 ><I
11269 >               wins support = yes</I
11270 ></TT
11271 ></A
11272 >) what the minimum 'time to live'
11273                 of NetBIOS names that <B
11274 CLASS="COMMAND"
11275 >nmbd</B
11276 > will grant will be (in
11277                 seconds). You should never need to change this parameter.  The default
11278                 is 6 hours (21600 seconds).</P
11279 ><P
11280 >Default: <B
11281 CLASS="COMMAND"
11282 >min wins ttl = 21600</B
11283 ></P
11284 ></DD
11285 ><DT
11286 ><A
11287 NAME="MSDFSROOT"
11288 ></A
11289 >msdfs root (S)</DT
11290 ><DD
11291 ><P
11292 >This boolean parameter is only available if
11293                 Samba is configured  and  compiled with the <B
11294 CLASS="COMMAND"
11295 >               --with-msdfs</B
11296 > option.  If set to <TT
11297 CLASS="CONSTANT"
11298 >yes&#62;</TT
11299 >,
11300                 Samba treats the share as a Dfs root and  allows clients to browse
11301                 the distributed file system tree rooted at the share directory.
11302                 Dfs links are specified  in  the share directory by symbolic
11303                 links of the form <TT
11304 CLASS="FILENAME"
11305 >msdfs:serverA\shareA,serverB\shareB
11306                 </TT
11307 > and so on.  For more information on setting up a Dfs tree
11308                 on Samba,  refer to <A
11309 HREF="msdfs_setup.html"
11310 TARGET="_top"
11311 >msdfs_setup.html
11312                 </A
11313 >.</P
11314 ><P
11315 >See also <A
11316 HREF="#HOSTMSDFS"
11317 ><TT
11318 CLASS="PARAMETER"
11319 ><I
11320 >host msdfs
11321                 </I
11322 ></TT
11323 ></A
11324 ></P
11325 ><P
11326 >Default: <B
11327 CLASS="COMMAND"
11328 >msdfs root = no</B
11329 ></P
11330 ></DD
11331 ><DT
11332 ><A
11333 NAME="NAMERESOLVEORDER"
11334 ></A
11335 >name resolve order (G)</DT
11336 ><DD
11337 ><P
11338 >This option is used by the programs in the Samba
11339                 suite to determine what naming services to use and in what order
11340                 to resolve host names to IP addresses. The option takes a space
11341                 separated string of name resolution options.</P
11342 ><P
11343 >The options are :"lmhosts", "host", "wins" and "bcast". They
11344                 cause names to be resolved as follows :</P
11345 ><P
11346 ></P
11347 ><UL
11348 ><LI
11349 ><P
11350 ><TT
11351 CLASS="CONSTANT"
11352 >lmhosts</TT
11353 > : Lookup an IP
11354                         address in the Samba lmhosts file. If the line in lmhosts has
11355                         no name type attached to the NetBIOS name (see the <A
11356 HREF="lmhosts.5.html"
11357 TARGET="_top"
11358 >lmhosts(5)</A
11359 > for details) then
11360                         any name type matches for lookup.</P
11361 ></LI
11362 ><LI
11363 ><P
11364 ><TT
11365 CLASS="CONSTANT"
11366 >host</TT
11367 > : Do a standard host
11368                         name to IP address resolution, using the system <TT
11369 CLASS="FILENAME"
11370 >/etc/hosts
11371                         </TT
11372 >, NIS, or DNS lookups. This method of name resolution
11373                         is operating system depended for instance on IRIX or Solaris this
11374                         may be controlled by the <TT
11375 CLASS="FILENAME"
11376 >/etc/nsswitch.conf</TT
11377 >
11378                         file).  Note that this method is only used if the NetBIOS name
11379                         type being queried is the 0x20 (server) name type, otherwise
11380                         it is ignored.</P
11381 ></LI
11382 ><LI
11383 ><P
11384 ><TT
11385 CLASS="CONSTANT"
11386 >wins</TT
11387 > : Query a name with
11388                         the IP address listed in the <A
11389 HREF="#WINSSERVER"
11390 ><TT
11391 CLASS="PARAMETER"
11392 ><I
11393 >                       wins server</I
11394 ></TT
11395 ></A
11396 > parameter.  If no WINS server has
11397                         been specified this method will be ignored.</P
11398 ></LI
11399 ><LI
11400 ><P
11401 ><TT
11402 CLASS="CONSTANT"
11403 >bcast</TT
11404 > : Do a broadcast on
11405                         each of the known local interfaces listed in the <A
11406 HREF="#INTERFACES"
11407 ><TT
11408 CLASS="PARAMETER"
11409 ><I
11410 >interfaces</I
11411 ></TT
11412 ></A
11413 >
11414                         parameter. This is the least reliable of the name resolution
11415                         methods as it depends on the target host being on a locally
11416                         connected subnet.</P
11417 ></LI
11418 ></UL
11419 ><P
11420 >Default: <B
11421 CLASS="COMMAND"
11422 >name resolve order = lmhosts host wins bcast
11423                 </B
11424 ></P
11425 ><P
11426 >Example: <B
11427 CLASS="COMMAND"
11428 >name resolve order = lmhosts bcast host
11429                 </B
11430 ></P
11431 ><P
11432 >This will cause the local lmhosts file to be examined
11433                 first, followed by a broadcast attempt, followed by a normal
11434                 system hostname lookup.</P
11435 ></DD
11436 ><DT
11437 ><A
11438 NAME="NETBIOSALIASES"
11439 ></A
11440 >netbios aliases (G)</DT
11441 ><DD
11442 ><P
11443 >This is a list of NetBIOS names that <A
11444 HREF="nmbd.8.html"
11445 TARGET="_top"
11446 >nmbd(8)</A
11447 > will advertise as additional
11448                 names by which the Samba server is known. This allows one machine
11449                 to appear in browse lists under multiple names. If a machine is
11450                 acting as a browse server or logon server none
11451                 of these names will be advertised as either browse server or logon
11452                 servers, only the primary name of the machine will be advertised
11453                 with these capabilities.</P
11454 ><P
11455 >See also <A
11456 HREF="#NETBIOSNAME"
11457 ><TT
11458 CLASS="PARAMETER"
11459 ><I
11460 >netbios
11461                 name</I
11462 ></TT
11463 ></A
11464 >.</P
11465 ><P
11466 >Default: <I
11467 CLASS="EMPHASIS"
11468 >empty string (no additional names)</I
11469 ></P
11470 ><P
11471 >Example: <B
11472 CLASS="COMMAND"
11473 >netbios aliases = TEST TEST1 TEST2</B
11474 ></P
11475 ></DD
11476 ><DT
11477 ><A
11478 NAME="NETBIOSNAME"
11479 ></A
11480 >netbios name (G)</DT
11481 ><DD
11482 ><P
11483 >This sets the NetBIOS name by which a Samba
11484                 server is known. By default it is the same as the first component
11485                 of the host's DNS name. If a machine is a browse server or
11486                 logon server this name (or the first component
11487                 of the hosts DNS name) will be the name that these services are
11488                 advertised under.</P
11489 ><P
11490 >See also <A
11491 HREF="#NETBIOSALIASES"
11492 ><TT
11493 CLASS="PARAMETER"
11494 ><I
11495 >netbios
11496                 aliases</I
11497 ></TT
11498 ></A
11499 >.</P
11500 ><P
11501 >Default: <I
11502 CLASS="EMPHASIS"
11503 >machine DNS name</I
11504 ></P
11505 ><P
11506 >Example: <B
11507 CLASS="COMMAND"
11508 >netbios name = MYNAME</B
11509 ></P
11510 ></DD
11511 ><DT
11512 ><A
11513 NAME="NETBIOSSCOPE"
11514 ></A
11515 >netbios scope (G)</DT
11516 ><DD
11517 ><P
11518 >This sets the NetBIOS scope that Samba will
11519                 operate under. This should not be set unless every machine
11520                 on your LAN also sets this value.</P
11521 ></DD
11522 ><DT
11523 ><A
11524 NAME="NISHOMEDIR"
11525 ></A
11526 >nis homedir (G)</DT
11527 ><DD
11528 ><P
11529 >Get the home share server from a NIS map. For
11530                 UNIX systems that use an automounter, the user's home directory
11531                 will often be mounted on a workstation on demand from a remote
11532                 server. </P
11533 ><P
11534 >When the Samba logon server is not the actual home directory
11535                 server, but is mounting the home directories via NFS then two
11536                 network hops would be required to access the users home directory
11537                 if the logon server told the client to use itself as the SMB server
11538                 for home directories (one over SMB and one over NFS). This can
11539                 be very slow.</P
11540 ><P
11541 >This option allows Samba to return the home share as
11542                 being on a different server to the logon server and as
11543                 long as a Samba daemon is running on the home directory server,
11544                 it will be mounted on the Samba client directly from the directory
11545                 server. When Samba is returning the home share to the client, it
11546                 will consult the NIS map specified in <A
11547 HREF="#HOMEDIRMAP"
11548 >               <TT
11549 CLASS="PARAMETER"
11550 ><I
11551 >homedir map</I
11552 ></TT
11553 ></A
11554 > and return the server
11555                 listed there.</P
11556 ><P
11557 >Note that for this option to work there must be a working
11558                 NIS system and the Samba server with this option must also
11559                 be a logon server.</P
11560 ><P
11561 >Default: <B
11562 CLASS="COMMAND"
11563 >nis homedir = no</B
11564 ></P
11565 ></DD
11566 ><DT
11567 ><A
11568 NAME="NTACLSUPPORT"
11569 ></A
11570 >nt acl support (G)</DT
11571 ><DD
11572 ><P
11573 >This boolean parameter controls whether
11574                 <A
11575 HREF="smbd.8.html"
11576 TARGET="_top"
11577 >smbd(8)</A
11578 > will attempt to map
11579                 UNIX permissions into Windows NT access control lists.</P
11580 ><P
11581 >Default: <B
11582 CLASS="COMMAND"
11583 >nt acl support = yes</B
11584 ></P
11585 ></DD
11586 ><DT
11587 ><A
11588 NAME="NTPIPESUPPORT"
11589 ></A
11590 >nt pipe support (G)</DT
11591 ><DD
11592 ><P
11593 >This boolean parameter controls whether
11594                 <A
11595 HREF="smbd.8.html"
11596 TARGET="_top"
11597 >smbd(8)</A
11598 > will allow Windows NT
11599                 clients to connect to the NT SMB specific <TT
11600 CLASS="CONSTANT"
11601 >IPC$</TT
11602 >
11603                 pipes. This is a developer debugging option and can be left
11604                 alone.</P
11605 ><P
11606 >Default: <B
11607 CLASS="COMMAND"
11608 >nt pipe support = yes</B
11609 ></P
11610 ></DD
11611 ><DT
11612 ><A
11613 NAME="NTSMBSUPPORT"
11614 ></A
11615 >nt smb support (G)</DT
11616 ><DD
11617 ><P
11618 >This boolean parameter controls whether <A
11619 HREF="smbd.8.html"
11620 TARGET="_top"
11621 >smbd(8)</A
11622 > will negotiate NT specific SMB
11623                 support with Windows NT clients. Although this is a developer
11624                 debugging option and should be left alone, benchmarking has discovered
11625                 that Windows NT clients give faster performance with this option
11626                 set to <TT
11627 CLASS="CONSTANT"
11628 >no</TT
11629 >. This is still being investigated.
11630                 If this option is set to <TT
11631 CLASS="CONSTANT"
11632 >no</TT
11633 > then Samba offers
11634                 exactly the same SMB calls that versions prior to Samba 2.0 offered.
11635                 This information may be of use if any users are having problems
11636                 with NT SMB support.</P
11637 ><P
11638 >You should not need to ever disable this parameter.</P
11639 ><P
11640 >Default: <B
11641 CLASS="COMMAND"
11642 >nt smb support = yes</B
11643 ></P
11644 ></DD
11645 ><DT
11646 ><A
11647 NAME="NULLPASSWORDS"
11648 ></A
11649 >null passwords (G)</DT
11650 ><DD
11651 ><P
11652 >Allow or disallow client access to accounts
11653                 that have null passwords. </P
11654 ><P
11655 >See also <A
11656 HREF="smbpasswd.5.html"
11657 TARGET="_top"
11658 >smbpasswd (5)</A
11659 >.</P
11660 ><P
11661 >Default: <B
11662 CLASS="COMMAND"
11663 >null passwords = no</B
11664 ></P
11665 ></DD
11666 ><DT
11667 ><A
11668 NAME="ONLYUSER"
11669 ></A
11670 >only user (S)</DT
11671 ><DD
11672 ><P
11673 >This is a boolean option that controls whether
11674                 connections with usernames not in the <TT
11675 CLASS="PARAMETER"
11676 ><I
11677 >user</I
11678 ></TT
11679 >
11680                 list will be allowed. By default this option is disabled so that a
11681                 client can supply a username to be used by the server.  Enabling
11682                 this parameter will force the server to only user the login
11683                 names from the <TT
11684 CLASS="PARAMETER"
11685 ><I
11686 >user</I
11687 ></TT
11688 > list and is only really
11689                 useful in <A
11690 HREF="#SECURITYEQUALSSHARE"
11691 >shave level</A
11692 >
11693                 security.</P
11694 ><P
11695 >Note that this also means Samba won't try to deduce
11696                 usernames from the service name. This can be annoying for
11697                 the [homes] section. To get around this you could use <B
11698 CLASS="COMMAND"
11699 >user =
11700                 %S</B
11701 > which means your <TT
11702 CLASS="PARAMETER"
11703 ><I
11704 >user</I
11705 ></TT
11706 > list
11707                 will be just the service name, which for home directories is the
11708                 name of the user.</P
11709 ><P
11710 >See also the <A
11711 HREF="#USER"
11712 ><TT
11713 CLASS="PARAMETER"
11714 ><I
11715 >user</I
11716 ></TT
11717 >
11718                 </A
11719 > parameter.</P
11720 ><P
11721 >Default: <B
11722 CLASS="COMMAND"
11723 >only user = no</B
11724 ></P
11725 ></DD
11726 ><DT
11727 ><A
11728 NAME="OLELOCKINGCOMPATIBILITY"
11729 ></A
11730 >ole locking compatibility (G)</DT
11731 ><DD
11732 ><P
11733 >This parameter allows an administrator to turn
11734                 off the byte range lock manipulation that is done within Samba to
11735                 give compatibility for OLE applications. Windows OLE applications
11736                 use byte range locking as a form of inter-process communication, by
11737                 locking ranges of bytes around the 2^32 region of a file range. This
11738                 can cause certain UNIX lock managers to crash or otherwise cause
11739                 problems. Setting this parameter to <TT
11740 CLASS="CONSTANT"
11741 >no</TT
11742 > means you
11743                 trust your UNIX lock manager to handle such cases correctly.</P
11744 ><P
11745 >Default: <B
11746 CLASS="COMMAND"
11747 >ole locking compatibility = yes</B
11748 ></P
11749 ></DD
11750 ><DT
11751 ><A
11752 NAME="ONLYGUEST"
11753 ></A
11754 >only guest (S)</DT
11755 ><DD
11756 ><P
11757 >A synonym for <A
11758 HREF="#GUESTONLY"
11759 ><TT
11760 CLASS="PARAMETER"
11761 ><I
11762 >               guest only</I
11763 ></TT
11764 ></A
11765 >.</P
11766 ></DD
11767 ><DT
11768 ><A
11769 NAME="OPLOCKBREAKWAITTIME"
11770 ></A
11771 >oplock break wait time (G)</DT
11772 ><DD
11773 ><P
11774 >This is a tuning parameter added due to bugs in
11775                 both Windows 9x and WinNT. If Samba responds to a client too
11776                 quickly when that client issues an SMB that can cause an oplock
11777                 break request, then the network client can fail and not respond
11778                 to the break request. This tuning parameter (which is set in milliseconds)
11779                 is the amount of time Samba will wait before sending an oplock break
11780                 request to such (broken) clients.</P
11781 ><P
11782 ><I
11783 CLASS="EMPHASIS"
11784 >DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ
11785                 AND UNDERSTOOD THE SAMBA OPLOCK CODE</I
11786 >.</P
11787 ><P
11788 >Default: <B
11789 CLASS="COMMAND"
11790 >oplock break wait time = 0</B
11791 ></P
11792 ></DD
11793 ><DT
11794 ><A
11795 NAME="OPLOCKCONTENTIONLIMIT"
11796 ></A
11797 >oplock contention limit (S)</DT
11798 ><DD
11799 ><P
11800 >This is a <I
11801 CLASS="EMPHASIS"
11802 >very</I
11803 > advanced
11804                 <A
11805 HREF="smbd.8.html"
11806 TARGET="_top"
11807 >smbd(8)</A
11808 > tuning option to
11809                 improve the efficiency of the granting of oplocks under multiple
11810                 client contention for the same file.</P
11811 ><P
11812 >In brief it specifies a number, which causes smbd not to
11813                 grant an oplock even when requested if the approximate number of
11814                 clients contending for an oplock on the same file goes over this
11815                 limit. This causes <B
11816 CLASS="COMMAND"
11817 >smbd</B
11818 > to behave in a similar
11819                 way to Windows NT.</P
11820 ><P
11821 ><I
11822 CLASS="EMPHASIS"
11823 >DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ
11824                 AND UNDERSTOOD THE SAMBA OPLOCK CODE</I
11825 >.</P
11826 ><P
11827 >Default: <B
11828 CLASS="COMMAND"
11829 >oplock contention limit = 2</B
11830 ></P
11831 ></DD
11832 ><DT
11833 ><A
11834 NAME="OPLOCKS"
11835 ></A
11836 >oplocks (S)</DT
11837 ><DD
11838 ><P
11839 >This boolean option tells smbd whether to
11840                 issue oplocks (opportunistic locks) to file open requests on this
11841                 share. The oplock code can dramatically (approx. 30% or more) improve
11842                 the speed of access to files on Samba servers. It allows the clients
11843                 to aggressively cache files locally and you may want to disable this
11844                 option for unreliable network environments (it is turned on by
11845                 default in Windows NT Servers).  For more information see the file
11846                 <TT
11847 CLASS="FILENAME"
11848 >Speed.txt</TT
11849 > in the Samba <TT
11850 CLASS="FILENAME"
11851 >docs/</TT
11852 >
11853                 directory.</P
11854 ><P
11855 >Oplocks may be selectively turned off on certain files with a
11856                 share. See the <A
11857 HREF="#VETOOPLOCKFILES"
11858 ><TT
11859 CLASS="PARAMETER"
11860 ><I
11861 >               veto oplock files</I
11862 ></TT
11863 ></A
11864 > parameter. On some systems
11865                 oplocks are recognized by the underlying operating system. This
11866                 allows data synchronization between all access to oplocked files,
11867                 whether it be via Samba or NFS or a local UNIX process. See the
11868                 <TT
11869 CLASS="PARAMETER"
11870 ><I
11871 >kernel oplocks</I
11872 ></TT
11873 > parameter for details.</P
11874 ><P
11875 >See also the <A
11876 HREF="#KERNELOPLOCKS"
11877 ><TT
11878 CLASS="PARAMETER"
11879 ><I
11880 >kernel
11881                 oplocks</I
11882 ></TT
11883 ></A
11884 > and <A
11885 HREF="#LEVEL2OPLOCKS"
11886 ><TT
11887 CLASS="PARAMETER"
11888 ><I
11889 >               level2 oplocks</I
11890 ></TT
11891 ></A
11892 > parameters.</P
11893 ><P
11894 >Default: <B
11895 CLASS="COMMAND"
11896 >oplocks = yes</B
11897 ></P
11898 ></DD
11899 ><DT
11900 ><A
11901 NAME="OSLEVEL"
11902 ></A
11903 >os level (G)</DT
11904 ><DD
11905 ><P
11906 >This integer value controls what level Samba
11907                 advertises itself as for browse elections. The value of this
11908                 parameter determines whether <A
11909 HREF="nmbd.8.html"
11910 TARGET="_top"
11911 >nmbd(8)</A
11912 >
11913                 has a chance of becoming a local master browser for the <TT
11914 CLASS="PARAMETER"
11915 ><I
11916 >               WORKGROUP</I
11917 ></TT
11918 > in the local broadcast area.</P
11919 ><P
11920 ><I
11921 CLASS="EMPHASIS"
11922 >Note :</I
11923 >By default, Samba will win
11924                 a local master browsing election over all Microsoft operating
11925                 systems except a Windows NT 4.0/2000 Domain Controller.  This
11926                 means that a misconfigured Samba host can effectively isolate
11927                 a subnet for browsing purposes.  See <TT
11928 CLASS="FILENAME"
11929 >BROWSING.txt
11930                 </TT
11931 > in the Samba <TT
11932 CLASS="FILENAME"
11933 >docs/</TT
11934 > directory
11935                 for details.</P
11936 ><P
11937 >Default: <B
11938 CLASS="COMMAND"
11939 >os level = 20</B
11940 ></P
11941 ><P
11942 >Example: <B
11943 CLASS="COMMAND"
11944 >os level = 65 </B
11945 ></P
11946 ></DD
11947 ><DT
11948 ><A
11949 NAME="OS2DRIVERMAP"
11950 ></A
11951 >os2 driver map (G)</DT
11952 ><DD
11953 ><P
11954 >The parameter is used to define the absolute
11955                 path to a file containing a mapping of Windows NT printer driver
11956                 names to OS/2 printer driver names.  The format is:</P
11957 ><P
11958 >&lt;nt driver name&gt; = &lt;os2 driver
11959                 name&gt;.&lt;device name&gt;</P
11960 ><P
11961 >For example, a valid entry using the HP LaserJet 5
11962                 printer driver woudl appear as <B
11963 CLASS="COMMAND"
11964 >HP LaserJet 5L = LASERJET.HP
11965                 LaserJet 5L</B
11966 >.</P
11967 ><P
11968 >The need for the file is due to the printer driver namespace
11969                 problem described in the <A
11970 HREF="printer_driver2.html"
11971 TARGET="_top"
11972 >Samba
11973                 Printing HOWTO</A
11974 >.  For more details on OS/2 clients, please
11975                 refer to the <A
11976 HREF="OS2-Client-HOWTO.html"
11977 TARGET="_top"
11978 >OS2-Client-HOWTO
11979                 </A
11980 > containing in the Samba documentation.</P
11981 ><P
11982 >Default: <B
11983 CLASS="COMMAND"
11984 >os2 driver map = &lt;empty string&gt;
11985                 </B
11986 ></P
11987 ></DD
11988 ><DT
11989 ><A
11990 NAME="PANICACTION"
11991 ></A
11992 >panic action (G)</DT
11993 ><DD
11994 ><P
11995 >This is a Samba developer option that allows a
11996                 system command to be called when either <A
11997 HREF="smbd.8.html"
11998 TARGET="_top"
11999 >               smbd(8)</A
12000 > or <A
12001 HREF="nmbd.8.html"
12002 TARGET="_top"
12003 >nmbd(8)</A
12004 >
12005                 crashes. This is usually used to draw attention to the fact that
12006                 a problem occurred.</P
12007 ><P
12008 >Default: <B
12009 CLASS="COMMAND"
12010 >panic action = &lt;empty string&gt;</B
12011 ></P
12012 ><P
12013 >Example: <B
12014 CLASS="COMMAND"
12015 >panic action = "/bin/sleep 90000"</B
12016 ></P
12017 ></DD
12018 ><DT
12019 ><A
12020 NAME="PASSWDCHAT"
12021 ></A
12022 >passwd chat (G)</DT
12023 ><DD
12024 ><P
12025 >This string controls the <I
12026 CLASS="EMPHASIS"
12027 >"chat"</I
12028 >
12029                 conversation that takes places between <A
12030 HREF="smbd.8.html"
12031 TARGET="_top"
12032 >smbd</A
12033 > and the local password changing
12034                 program to change the users password. The string describes a
12035                 sequence of response-receive pairs that <A
12036 HREF="smbd.8.html"
12037 TARGET="_top"
12038 >               smbd(8)</A
12039 > uses to determine what to send to the
12040                 <A
12041 HREF="#PASSWDPROGRAM"
12042 ><TT
12043 CLASS="PARAMETER"
12044 ><I
12045 >passwd program</I
12046 ></TT
12047 >
12048                 </A
12049 > and what to expect back. If the expected output is not
12050                 received then the password is not changed.</P
12051 ><P
12052 >This chat sequence is often quite site specific, depending
12053                 on what local methods are used for password control (such as NIS
12054                 etc).</P
12055 ><P
12056 >The string can contain the macros <TT
12057 CLASS="PARAMETER"
12058 ><I
12059 >%o</I
12060 ></TT
12061 >
12062                 and <TT
12063 CLASS="PARAMETER"
12064 ><I
12065 >%n</I
12066 ></TT
12067 > which are substituted for the old
12068                 and new passwords respectively. It can also contain the standard
12069                 macros <TT
12070 CLASS="CONSTANT"
12071 >\n</TT
12072 >, <TT
12073 CLASS="CONSTANT"
12074 >\r</TT
12075 >, <TT
12076 CLASS="CONSTANT"
12077 >               \t</TT
12078 > and <TT
12079 CLASS="CONSTANT"
12080 >%s</TT
12081 > to give line-feed,
12082                 carriage-return, tab and space.</P
12083 ><P
12084 >The string can also contain a '*' which matches
12085                 any sequence of characters.</P
12086 ><P
12087 >Double quotes can be used to collect strings with spaces
12088                 in them into a single string.</P
12089 ><P
12090 >If the send string in any part of the chat sequence
12091                 is a fullstop ".",  then no string is sent. Similarly,
12092                 if the expect string is a fullstop then no string is expected.</P
12093 ><P
12094 >Note that if the <A
12095 HREF="#UNIXPASSWORDSYNC"
12096 ><TT
12097 CLASS="PARAMETER"
12098 ><I
12099 >unix
12100                 password sync</I
12101 ></TT
12102 ></A
12103 > parameter is set to true, then this
12104                 sequence is called <I
12105 CLASS="EMPHASIS"
12106 >AS ROOT</I
12107 > when the SMB password
12108                 in the smbpasswd file is being changed, without access to the old
12109                 password cleartext. In this case the old password cleartext is set
12110                 to "" (the empty string).</P
12111 ><P
12112 >See also <A
12113 HREF="#UNIXPASSWORDSYNC"
12114 ><TT
12115 CLASS="PARAMETER"
12116 ><I
12117 >unix password
12118                 sync</I
12119 ></TT
12120 ></A
12121 >, <A
12122 HREF="#PASSWDPROGRAM"
12123 ><TT
12124 CLASS="PARAMETER"
12125 ><I
12126 >               passwd program</I
12127 ></TT
12128 ></A
12129 > and <A
12130 HREF="#PASSWDCHATDEBUG"
12131 >               <TT
12132 CLASS="PARAMETER"
12133 ><I
12134 >passwd chat debug</I
12135 ></TT
12136 ></A
12137 >.</P
12138 ><P
12139 >Default: <B
12140 CLASS="COMMAND"
12141 >passwd chat = *new*password* %n\n
12142                 *new*password* %n\n *changed*</B
12143 ></P
12144 ><P
12145 >Example: <B
12146 CLASS="COMMAND"
12147 >passwd chat = "*Enter OLD password*" %o\n
12148                 "*Enter NEW password*" %n\n "*Reenter NEW password*" %n\n "*Password
12149                 changed*"</B
12150 ></P
12151 ></DD
12152 ><DT
12153 ><A
12154 NAME="PASSWDCHATDEBUG"
12155 ></A
12156 >passwd chat debug (G)</DT
12157 ><DD
12158 ><P
12159 >This boolean specifies if the passwd chat script
12160                 parameter is run in <I
12161 CLASS="EMPHASIS"
12162 >debug</I
12163 > mode. In this mode the
12164                 strings passed to and received from the passwd chat are printed
12165                 in the <A
12166 HREF="smbd.8.html"
12167 TARGET="_top"
12168 >smbd(8)</A
12169 > log with a
12170                 <A
12171 HREF="#DEBUGLEVEL"
12172 ><TT
12173 CLASS="PARAMETER"
12174 ><I
12175 >debug level</I
12176 ></TT
12177 ></A
12178 >
12179                 of 100. This is a dangerous option as it will allow plaintext passwords
12180                 to be seen in the <B
12181 CLASS="COMMAND"
12182 >smbd</B
12183 > log. It is available to help
12184                 Samba admins debug their <TT
12185 CLASS="PARAMETER"
12186 ><I
12187 >passwd chat</I
12188 ></TT
12189 > scripts
12190                 when calling the <TT
12191 CLASS="PARAMETER"
12192 ><I
12193 >passwd program</I
12194 ></TT
12195 > and should
12196                 be turned off after this has been done. This parameter is off by
12197                 default.</P
12198 ><P
12199 >See also &#60;<A
12200 HREF="#PASSWDCHAT"
12201 ><TT
12202 CLASS="PARAMETER"
12203 ><I
12204 >passwd chat</I
12205 ></TT
12206 >
12207                 </A
12208 >, <A
12209 HREF="#PASSWDPROGRAM"
12210 ><TT
12211 CLASS="PARAMETER"
12212 ><I
12213 >passwd program</I
12214 ></TT
12215 >
12216                 </A
12217 >.</P
12218 ><P
12219 >Default: <B
12220 CLASS="COMMAND"
12221 >passwd chat debug = no</B
12222 ></P
12223 ></DD
12224 ><DT
12225 ><A
12226 NAME="PASSWDPROGRAM"
12227 ></A
12228 >passwd program (G)</DT
12229 ><DD
12230 ><P
12231 >The name of a program that can be used to set
12232                 UNIX user passwords.  Any occurrences of <TT
12233 CLASS="PARAMETER"
12234 ><I
12235 >%u</I
12236 ></TT
12237 >
12238                 will be replaced with the user name. The user name is checked for
12239                 existence before calling the password changing program.</P
12240 ><P
12241 >Also note that many passwd programs insist in <I
12242 CLASS="EMPHASIS"
12243 >reasonable
12244                 </I
12245 > passwords, such as a minimum length, or the inclusion
12246                 of mixed case chars and digits. This can pose a problem as some clients
12247                 (such as Windows for Workgroups) uppercase the password before sending
12248                 it.</P
12249 ><P
12250 ><I
12251 CLASS="EMPHASIS"
12252 >Note</I
12253 > that if the <TT
12254 CLASS="PARAMETER"
12255 ><I
12256 >unix
12257                 password sync</I
12258 ></TT
12259 > parameter is set to <TT
12260 CLASS="CONSTANT"
12261 >True
12262                 </TT
12263 > then this program is called <I
12264 CLASS="EMPHASIS"
12265 >AS ROOT</I
12266 >
12267                 before the SMB password in the <A
12268 HREF="smbpasswd.5.html"
12269 TARGET="_top"
12270 >smbpasswd(5)
12271                 </A
12272 > file is changed. If this UNIX password change fails, then
12273                 <B
12274 CLASS="COMMAND"
12275 >smbd</B
12276 > will fail to change the SMB password also
12277                 (this is by design).</P
12278 ><P
12279 >If the <TT
12280 CLASS="PARAMETER"
12281 ><I
12282 >unix password sync</I
12283 ></TT
12284 > parameter
12285                 is set this parameter <I
12286 CLASS="EMPHASIS"
12287 >MUST USE ABSOLUTE PATHS</I
12288 >
12289                 for <I
12290 CLASS="EMPHASIS"
12291 >ALL</I
12292 > programs called, and must be examined
12293                 for security implications. Note that by default <TT
12294 CLASS="PARAMETER"
12295 ><I
12296 >unix
12297                 password sync</I
12298 ></TT
12299 > is set to <TT
12300 CLASS="CONSTANT"
12301 >False</TT
12302 >.</P
12303 ><P
12304 >See also <A
12305 HREF="#UNIXPASSWORDSYNC"
12306 ><TT
12307 CLASS="PARAMETER"
12308 ><I
12309 >unix
12310                 password sync</I
12311 ></TT
12312 ></A
12313 >.</P
12314 ><P
12315 >Default: <B
12316 CLASS="COMMAND"
12317 >passwd program = /bin/passwd</B
12318 ></P
12319 ><P
12320 >Example: <B
12321 CLASS="COMMAND"
12322 >passwd program = /sbin/npasswd %u</B
12323 >
12324                 </P
12325 ></DD
12326 ><DT
12327 ><A
12328 NAME="PASSWORDLEVEL"
12329 ></A
12330 >password level (G)</DT
12331 ><DD
12332 ><P
12333 >Some client/server combinations have difficulty
12334                 with mixed-case passwords.  One offending client is Windows for
12335                 Workgroups, which for some reason forces passwords to upper
12336                 case when using the LANMAN1 protocol, but leaves them alone when
12337                 using COREPLUS!  Another problem child is the Windows 95/98
12338                 family of operating systems.  These clients upper case clear
12339                 text passwords even when NT LM 0.12 selected by the protocol
12340                 negotiation request/response.</P
12341 ><P
12342 >This parameter defines the maximum number of characters
12343                 that may be upper case in passwords.</P
12344 ><P
12345 >For example, say the password given was "FRED". If <TT
12346 CLASS="PARAMETER"
12347 ><I
12348 >               password level</I
12349 ></TT
12350 > is set to 1, the following combinations
12351                 would be tried if "FRED" failed:</P
12352 ><P
12353 >"Fred", "fred", "fRed", "frEd","freD"</P
12354 ><P
12355 >If <TT
12356 CLASS="PARAMETER"
12357 ><I
12358 >password level</I
12359 ></TT
12360 > was set to 2,
12361                 the following combinations would also be tried: </P
12362 ><P
12363 >"FRed", "FrEd", "FreD", "fREd", "fReD", "frED", ..</P
12364 ><P
12365 >And so on.</P
12366 ><P
12367 >The higher value this parameter is set to the more likely
12368                 it is that a mixed case password will be matched against a single
12369                 case password. However, you should be aware that use of this
12370                 parameter reduces security and increases the time taken to
12371                 process a new connection.</P
12372 ><P
12373 >A value of zero will cause only two attempts to be
12374                 made - the password as is and the password in all-lower case.</P
12375 ><P
12376 >Default: <B
12377 CLASS="COMMAND"
12378 >password level = 0</B
12379 ></P
12380 ><P
12381 >Example: <B
12382 CLASS="COMMAND"
12383 >password level = 4</B
12384 ></P
12385 ></DD
12386 ><DT
12387 ><A
12388 NAME="PASSWORDSERVER"
12389 ></A
12390 >password server (G)</DT
12391 ><DD
12392 ><P
12393 >By specifying the name of another SMB server (such
12394                 as a WinNT box) with this option, and using <B
12395 CLASS="COMMAND"
12396 >security = domain
12397                 </B
12398 > or <B
12399 CLASS="COMMAND"
12400 >security = server</B
12401 > you can get Samba
12402                 to do all its username/password validation via a remote server.</P
12403 ><P
12404 >This option sets the name of the password server to use.
12405                 It must be a NetBIOS name, so if the machine's NetBIOS name is
12406                 different from its Internet name then you may have to add its NetBIOS
12407                 name to the lmhosts  file which is stored in the same directory
12408                 as the <TT
12409 CLASS="FILENAME"
12410 >smb.conf</TT
12411 > file.</P
12412 ><P
12413 >The name of the password server is looked up using the
12414                 parameter <A
12415 HREF="#NAMERESOLVEORDER"
12416 ><TT
12417 CLASS="PARAMETER"
12418 ><I
12419 >name
12420                 resolve order</I
12421 ></TT
12422 ></A
12423 > and so may resolved
12424                 by any method and order described in that parameter.</P
12425 ><P
12426 >The password server much be a machine capable of using
12427                 the "LM1.2X002" or the "NT LM 0.12" protocol, and it must be in
12428                 user level security mode.</P
12429 ><P
12430 ><I
12431 CLASS="EMPHASIS"
12432 >NOTE:</I
12433 > Using a password server
12434                 means your UNIX box (running Samba) is only as secure as your
12435                 password server. <I
12436 CLASS="EMPHASIS"
12437 >DO NOT CHOOSE A PASSWORD SERVER THAT
12438                 YOU DON'T COMPLETELY TRUST</I
12439 >.</P
12440 ><P
12441 >Never point a Samba server at itself for password
12442                 serving. This will cause a loop and could lock up your Samba
12443                 server!</P
12444 ><P
12445 >The name of the password server takes the standard
12446                 substitutions, but probably the only useful one is <TT
12447 CLASS="PARAMETER"
12448 ><I
12449 >%m
12450                 </I
12451 ></TT
12452 >, which means the Samba server will use the incoming
12453                 client as the password server. If you use this then you better
12454                 trust your clients, and you had better restrict them with hosts allow!</P
12455 ><P
12456 >If the <TT
12457 CLASS="PARAMETER"
12458 ><I
12459 >security</I
12460 ></TT
12461 > parameter is set to
12462                 <TT
12463 CLASS="CONSTANT"
12464 >domain</TT
12465 >, then the list of machines in this
12466                 option must be a list of Primary or Backup Domain controllers for the
12467                 Domain or the character '*', as the Samba server is effectively
12468                 in that domain, and will use cryptographically authenticated RPC calls
12469                 to authenticate the user logging on. The advantage of using <B
12470 CLASS="COMMAND"
12471 >               security = domain</B
12472 > is that if you list several hosts in the
12473                 <TT
12474 CLASS="PARAMETER"
12475 ><I
12476 >password server</I
12477 ></TT
12478 > option then <B
12479 CLASS="COMMAND"
12480 >smbd
12481                 </B
12482 > will try each in turn till it finds one that responds. This
12483                 is useful in case your primary server goes down.</P
12484 ><P
12485 >If the <TT
12486 CLASS="PARAMETER"
12487 ><I
12488 >password server</I
12489 ></TT
12490 > option is set
12491                 to the character '*', then Samba will attempt to auto-locate the
12492                 Primary or Backup Domain controllers to authenticate against by
12493                 doing a query for the name <TT
12494 CLASS="CONSTANT"
12495 >WORKGROUP&lt;1C&gt;</TT
12496 >
12497                 and then contacting each server returned in the list of IP
12498                 addresses from the name resolution source. </P
12499 ><P
12500 >If the <TT
12501 CLASS="PARAMETER"
12502 ><I
12503 >security</I
12504 ></TT
12505 > parameter is
12506                 set to <TT
12507 CLASS="CONSTANT"
12508 >server</TT
12509 >, then there are different
12510                 restrictions that <B
12511 CLASS="COMMAND"
12512 >security = domain</B
12513 > doesn't
12514                 suffer from:</P
12515 ><P
12516 ></P
12517 ><UL
12518 ><LI
12519 ><P
12520 >You may list several password servers in
12521                         the <TT
12522 CLASS="PARAMETER"
12523 ><I
12524 >password server</I
12525 ></TT
12526 > parameter, however if an
12527                         <B
12528 CLASS="COMMAND"
12529 >smbd</B
12530 > makes a connection to a password server,
12531                         and then the password server fails, no more users will be able
12532                         to be authenticated from this <B
12533 CLASS="COMMAND"
12534 >smbd</B
12535 >.  This is a
12536                         restriction of the SMB/CIFS protocol when in <B
12537 CLASS="COMMAND"
12538 >security=server
12539                         </B
12540 > mode and cannot be fixed in Samba.</P
12541 ></LI
12542 ><LI
12543 ><P
12544 >If you are using a Windows NT server as your
12545                         password server then you will have to ensure that your users
12546                         are able to login from the Samba server, as when in <B
12547 CLASS="COMMAND"
12548 >                       security=server</B
12549 >  mode the network logon will appear to
12550                         come from there rather than from the users workstation.</P
12551 ></LI
12552 ></UL
12553 ><P
12554 >See also the <A
12555 HREF="#SECURITY"
12556 ><TT
12557 CLASS="PARAMETER"
12558 ><I
12559 >security
12560                 </I
12561 ></TT
12562 ></A
12563 > parameter.</P
12564 ><P
12565 >Default: <B
12566 CLASS="COMMAND"
12567 >password server = &lt;empty string&gt;</B
12568 >
12569                 </P
12570 ><P
12571 >Example: <B
12572 CLASS="COMMAND"
12573 >password server = NT-PDC, NT-BDC1, NT-BDC2
12574                 </B
12575 ></P
12576 ><P
12577 >Example: <B
12578 CLASS="COMMAND"
12579 >password server = *</B
12580 ></P
12581 ></DD
12582 ><DT
12583 ><A
12584 NAME="PATH"
12585 ></A
12586 >path (S)</DT
12587 ><DD
12588 ><P
12589 >This parameter specifies a directory to which
12590                 the user of the service is to be given access. In the case of
12591                 printable services, this is where print data will spool prior to
12592                 being submitted to the host for printing.</P
12593 ><P
12594 >For a printable service offering guest access, the service
12595                 should be readonly and the path should be world-writeable and
12596                 have the sticky bit set. This is not mandatory of course, but
12597                 you probably won't get the results you expect if you do
12598                 otherwise.</P
12599 ><P
12600 >Any occurrences of <TT
12601 CLASS="PARAMETER"
12602 ><I
12603 >%u</I
12604 ></TT
12605 > in the path
12606                 will be replaced with the UNIX username that the client is using
12607                 on this connection. Any occurrences of <TT
12608 CLASS="PARAMETER"
12609 ><I
12610 >%m</I
12611 ></TT
12612 >
12613                 will be replaced by the NetBIOS name of the machine they are
12614                 connecting from. These replacements are very useful for setting
12615                 up pseudo home directories for users.</P
12616 ><P
12617 >Note that this path will be based on <A
12618 HREF="#ROOTDIR"
12619 >               <TT
12620 CLASS="PARAMETER"
12621 ><I
12622 >root dir</I
12623 ></TT
12624 ></A
12625 > if one was specified.</P
12626 ><P
12627 >Default: <I
12628 CLASS="EMPHASIS"
12629 >none</I
12630 ></P
12631 ><P
12632 >Example: <B
12633 CLASS="COMMAND"
12634 >path = /home/fred</B
12635 ></P
12636 ></DD
12637 ><DT
12638 ><A
12639 NAME="POSIXLOCKING"
12640 ></A
12641 >posix locking (S)</DT
12642 ><DD
12643 ><P
12644 >The <A
12645 HREF="smbd.8.html"
12646 TARGET="_top"
12647 ><B
12648 CLASS="COMMAND"
12649 >smbd(8)</B
12650 ></A
12651 >
12652                 daemon maintains an database of file locks obtained by SMB clients.
12653                 The default behavior is to map this internal database to POSIX
12654                 locks.  This means that file locks obtained by SMB clients are
12655                 consistent with those seen by POSIX compliant applications accessing
12656                 the files via a non-SMB method (e.g. NFS or local file access).
12657                 You should never need to disable this parameter.</P
12658 ><P
12659 >Default: <B
12660 CLASS="COMMAND"
12661 >posix locking = yes</B
12662 ></P
12663 ></DD
12664 ><DT
12665 ><A
12666 NAME="POSTEXEC"
12667 ></A
12668 >postexec (S)</DT
12669 ><DD
12670 ><P
12671 >This option specifies a command to be run
12672                 whenever the service is disconnected. It takes the usual
12673                 substitutions. The command may be run as the root on some
12674                 systems.</P
12675 ><P
12676 >An interesting example may be do unmount server
12677                 resources:</P
12678 ><P
12679 ><B
12680 CLASS="COMMAND"
12681 >postexec = /etc/umount /cdrom</B
12682 ></P
12683 ><P
12684 >See also <A
12685 HREF="#PREEXEC"
12686 ><TT
12687 CLASS="PARAMETER"
12688 ><I
12689 >preexec</I
12690 ></TT
12691 >
12692                 </A
12693 >.</P
12694 ><P
12695 >Default: <I
12696 CLASS="EMPHASIS"
12697 >none (no command executed)</I
12698 >
12699                 </P
12700 ><P
12701 >Example: <B
12702 CLASS="COMMAND"
12703 >postexec = echo \"%u disconnected from %S
12704                 from %m (%I)\" &gt;&gt; /tmp/log</B
12705 ></P
12706 ></DD
12707 ><DT
12708 ><A
12709 NAME="POSTSCRIPT"
12710 ></A
12711 >postscript (S)</DT
12712 ><DD
12713 ><P
12714 >This parameter forces a printer to interpret
12715                 the print files as postscript. This is done by adding a <TT
12716 CLASS="CONSTANT"
12717 >%!
12718                 </TT
12719 > to the start of print output.</P
12720 ><P
12721 >This is most useful when you have lots of PCs that persist
12722                 in putting a control-D at the start of print jobs, which then
12723                 confuses your printer.</P
12724 ><P
12725 >Default: <B
12726 CLASS="COMMAND"
12727 >postscript = no</B
12728 ></P
12729 ></DD
12730 ><DT
12731 ><A
12732 NAME="PREEXEC"
12733 ></A
12734 >preexec (S)</DT
12735 ><DD
12736 ><P
12737 >This option specifies a command to be run whenever
12738                 the service is connected to. It takes the usual substitutions.</P
12739 ><P
12740 >An interesting example is to send the users a welcome
12741                 message every time they log in. Maybe a message of the day? Here
12742                 is an example:</P
12743 ><P
12744 ><B
12745 CLASS="COMMAND"
12746 >preexec = csh -c 'echo \"Welcome to %S!\" |
12747                  /usr/local/samba/bin/smbclient -M %m -I %I' &#38; </B
12748 ></P
12749 ><P
12750 >Of course, this could get annoying after a while :-)</P
12751 ><P
12752 >See also <A
12753 HREF="#PREEXECCLOSE"
12754 ><TT
12755 CLASS="PARAMETER"
12756 ><I
12757 >preexec close
12758                 </I
12759 ></TT
12760 ></A
12761 > and <A
12762 HREF="#POSTEXEC"
12763 ><TT
12764 CLASS="PARAMETER"
12765 ><I
12766 >postexec
12767                 </I
12768 ></TT
12769 ></A
12770 >.</P
12771 ><P
12772 >Default: <I
12773 CLASS="EMPHASIS"
12774 >none (no command executed)</I
12775 ></P
12776 ><P
12777 >Example: <B
12778 CLASS="COMMAND"
12779 >preexec = echo \"%u connected to %S from %m
12780                 (%I)\" &gt;&gt; /tmp/log</B
12781 ></P
12782 ></DD
12783 ><DT
12784 ><A
12785 NAME="PREEXECCLOSE"
12786 ></A
12787 >preexec close (S)</DT
12788 ><DD
12789 ><P
12790 >This boolean option controls whether a non-zero
12791                 return code from <A
12792 HREF="#PREEXEC"
12793 ><TT
12794 CLASS="PARAMETER"
12795 ><I
12796 >preexec
12797                 </I
12798 ></TT
12799 ></A
12800 > should close the service being connected to.</P
12801 ><P
12802 >Default: <B
12803 CLASS="COMMAND"
12804 >preexec close = no</B
12805 ></P
12806 ></DD
12807 ><DT
12808 ><A
12809 NAME="PREFERREDMASTER"
12810 ></A
12811 >preferred master (G)</DT
12812 ><DD
12813 ><P
12814 >This boolean parameter controls if <A
12815 HREF="nmbd.8.html"
12816 TARGET="_top"
12817 >nmbd(8)</A
12818 > is a preferred master browser
12819                 for its workgroup.</P
12820 ><P
12821 >If this is set to true, on startup, <B
12822 CLASS="COMMAND"
12823 >nmbd</B
12824 >
12825                 will force an election, and it will have a slight advantage in
12826                 winning the election.  It is recommended that this parameter is
12827                 used in conjunction with <B
12828 CLASS="COMMAND"
12829 ><A
12830 HREF="#DOMAINMASTER"
12831 ><TT
12832 CLASS="PARAMETER"
12833 ><I
12834 >               domain master</I
12835 ></TT
12836 ></A
12837 > = yes</B
12838 >, so that <B
12839 CLASS="COMMAND"
12840 >               nmbd</B
12841 > can guarantee becoming a domain master.</P
12842 ><P
12843 >Use this option with caution, because if there are several
12844                 hosts (whether Samba servers, Windows 95 or NT) that are preferred
12845                 master browsers on the same subnet, they will each periodically
12846                 and continuously attempt to become the local master browser.
12847                 This will result in unnecessary broadcast traffic and reduced browsing
12848                 capabilities.</P
12849 ><P
12850 >See also <A
12851 HREF="#OSLEVEL"
12852 ><TT
12853 CLASS="PARAMETER"
12854 ><I
12855 >os level</I
12856 ></TT
12857 >
12858                 </A
12859 >.</P
12860 ><P
12861 >Default: <B
12862 CLASS="COMMAND"
12863 >preferred master = auto</B
12864 ></P
12865 ></DD
12866 ><DT
12867 ><A
12868 NAME="PREFEREDMASTER"
12869 ></A
12870 >prefered master (G)</DT
12871 ><DD
12872 ><P
12873 >Synonym for <A
12874 HREF="#PREFERREDMASTER"
12875 ><TT
12876 CLASS="PARAMETER"
12877 ><I
12878 >               preferred master</I
12879 ></TT
12880 ></A
12881 > for people who cannot spell :-).</P
12882 ></DD
12883 ><DT
12884 ><A
12885 NAME="PRELOAD"
12886 ></A
12887 >preload</DT
12888 ><DD
12889 ><P
12890 >This is a list of services that you want to be
12891                 automatically added to the browse lists. This is most useful
12892                 for homes and printers services that would otherwise not be
12893                 visible.</P
12894 ><P
12895 >Note that if you just want all printers in your
12896                 printcap file loaded then the <A
12897 HREF="#LOADPRINTERS"
12898 >               <TT
12899 CLASS="PARAMETER"
12900 ><I
12901 >load printers</I
12902 ></TT
12903 ></A
12904 > option is easier.</P
12905 ><P
12906 >Default: <I
12907 CLASS="EMPHASIS"
12908 >no preloaded services</I
12909 ></P
12910 ><P
12911 >Example: <B
12912 CLASS="COMMAND"
12913 >preload = fred lp colorlp</B
12914 ></P
12915 ></DD
12916 ><DT
12917 ><A
12918 NAME="PRESERVECASE"
12919 ></A
12920 >preserve case (S)</DT
12921 ><DD
12922 ><P
12923 > This controls if new filenames are created
12924                 with the case that the client passes, or if they are forced to
12925                 be the <A
12926 HREF="#DEFAULTCASE"
12927 ><TT
12928 CLASS="PARAMETER"
12929 ><I
12930 >default case
12931                 </I
12932 ></TT
12933 ></A
12934 >.</P
12935 ><P
12936 >Default: <B
12937 CLASS="COMMAND"
12938 >preserve case = yes</B
12939 ></P
12940 ><P
12941 >See the section on <A
12942 HREF="#AEN201"
12943 >NAME
12944                 MANGLING</A
12945 > for a fuller discussion.</P
12946 ></DD
12947 ><DT
12948 ><A
12949 NAME="PRINTCOMMAND"
12950 ></A
12951 >print command (S)</DT
12952 ><DD
12953 ><P
12954 >After a print job has finished spooling to
12955                 a service, this command will be used via a <B
12956 CLASS="COMMAND"
12957 >system()</B
12958 >
12959                 call to process the spool file. Typically the command specified will
12960                 submit the spool file to the host's printing subsystem, but there
12961                 is no requirement that this be the case. The server will not remove
12962                 the spool file, so whatever command you specify should remove the
12963                 spool file when it has been processed, otherwise you will need to
12964                 manually remove old spool files.</P
12965 ><P
12966 >The print command is simply a text string. It will be used
12967                 verbatim, with two exceptions: All occurrences of <TT
12968 CLASS="PARAMETER"
12969 ><I
12970 >%s
12971                 </I
12972 ></TT
12973 > and <TT
12974 CLASS="PARAMETER"
12975 ><I
12976 >%f</I
12977 ></TT
12978 > will be replaced by the
12979                 appropriate spool file name, and all occurrences of <TT
12980 CLASS="PARAMETER"
12981 ><I
12982 >%p
12983                 </I
12984 ></TT
12985 > will be replaced by the appropriate printer name. The
12986                 spool file name is generated automatically by the server, the printer
12987                 name is discussed below.</P
12988 ><P
12989 >The print command <I
12990 CLASS="EMPHASIS"
12991 >MUST</I
12992 > contain at least
12993                 one occurrence of <TT
12994 CLASS="PARAMETER"
12995 ><I
12996 >%s</I
12997 ></TT
12998 > or <TT
12999 CLASS="PARAMETER"
13000 ><I
13001 >%f
13002                 </I
13003 ></TT
13004 > - the <TT
13005 CLASS="PARAMETER"
13006 ><I
13007 >%p</I
13008 ></TT
13009 > is optional. At the time
13010                 a job is submitted, if no printer name is supplied the <TT
13011 CLASS="PARAMETER"
13012 ><I
13013 >%p
13014                 </I
13015 ></TT
13016 > will be silently removed from the printer command.</P
13017 ><P
13018 >If specified in the [global] section, the print command given
13019                 will be used for any printable service that does not have its own
13020                 print command specified.</P
13021 ><P
13022 >If there is neither a specified print command for a
13023                 printable service nor a global print command, spool files will
13024                 be created but not processed and (most importantly) not removed.</P
13025 ><P
13026 >Note that printing may fail on some UNIXes from the
13027                 <TT
13028 CLASS="CONSTANT"
13029 >nobody</TT
13030 > account. If this happens then create
13031                 an alternative guest account that can print and set the <A
13032 HREF="#GUESTACCOUNT"
13033 ><TT
13034 CLASS="PARAMETER"
13035 ><I
13036 >guest account</I
13037 ></TT
13038 ></A
13039 >
13040                 in the [global] section.</P
13041 ><P
13042 >You can form quite complex print commands by realizing
13043                 that they are just passed to a shell. For example the following
13044                 will log a print job, print the file, then remove it. Note that
13045                 ';' is the usual separator for command in shell scripts.</P
13046 ><P
13047 ><B
13048 CLASS="COMMAND"
13049 >print command = echo Printing %s &gt;&gt;
13050                 /tmp/print.log; lpr -P %p %s; rm %s</B
13051 ></P
13052 ><P
13053 >You may have to vary this command considerably depending
13054                 on how you normally print files on your system. The default for
13055                 the parameter varies depending on the setting of the <A
13056 HREF="#PRINTING"
13057 >               <TT
13058 CLASS="PARAMETER"
13059 ><I
13060 >printing</I
13061 ></TT
13062 ></A
13063 > parameter.</P
13064 ><P
13065 >Default: For <B
13066 CLASS="COMMAND"
13067 >printing= BSD, AIX, QNX, LPRNG
13068                 or PLP :</B
13069 ></P
13070 ><P
13071 ><B
13072 CLASS="COMMAND"
13073 >print command = lpr -r -P%p %s</B
13074 ></P
13075 ><P
13076 >For <B
13077 CLASS="COMMAND"
13078 >printing= SYS or HPUX :</B
13079 ></P
13080 ><P
13081 ><B
13082 CLASS="COMMAND"
13083 >print command = lp -c -d%p %s; rm %s</B
13084 ></P
13085 ><P
13086 >For <B
13087 CLASS="COMMAND"
13088 >printing=SOFTQ :</B
13089 ></P
13090 ><P
13091 ><B
13092 CLASS="COMMAND"
13093 >print command = lp -d%p -s %s; rm %s</B
13094 ></P
13095 ><P
13096 >Example: <B
13097 CLASS="COMMAND"
13098 >print command = /usr/local/samba/bin/myprintscript
13099                 %p %s</B
13100 ></P
13101 ></DD
13102 ><DT
13103 ><A
13104 NAME="PRINTOK"
13105 ></A
13106 >print ok (S)</DT
13107 ><DD
13108 ><P
13109 >Synonym for <A
13110 HREF="#PRINTABLE"
13111 >               <TT
13112 CLASS="PARAMETER"
13113 ><I
13114 >printable</I
13115 ></TT
13116 ></A
13117 >.</P
13118 ></DD
13119 ><DT
13120 ><A
13121 NAME="PRINTABLE"
13122 ></A
13123 >printable (S)</DT
13124 ><DD
13125 ><P
13126 >If this parameter is <TT
13127 CLASS="CONSTANT"
13128 >yes</TT
13129 >, then
13130                 clients may open, write to and submit spool files on the directory
13131                 specified for the service. </P
13132 ><P
13133 >Note that a printable service will ALWAYS allow writing
13134                 to the service path (user privileges permitting) via the spooling
13135                 of print data. The <A
13136 HREF="#WRITEABLE"
13137 ><TT
13138 CLASS="PARAMETER"
13139 ><I
13140 >writeable
13141                 </I
13142 ></TT
13143 ></A
13144 > parameter controls only non-printing access to
13145                 the resource.</P
13146 ><P
13147 >Default: <B
13148 CLASS="COMMAND"
13149 >printable = no</B
13150 ></P
13151 ></DD
13152 ><DT
13153 ><A
13154 NAME="PRINTCAP"
13155 ></A
13156 >printcap (G)</DT
13157 ><DD
13158 ><P
13159 >Synonym for    <A
13160 HREF="#PRINTCAPNAME"
13161 ><TT
13162 CLASS="PARAMETER"
13163 ><I
13164 >               printcap name</I
13165 ></TT
13166 ></A
13167 >.</P
13168 ></DD
13169 ><DT
13170 ><A
13171 NAME="PRINTCAPNAME"
13172 ></A
13173 >printcap name (G)</DT
13174 ><DD
13175 ><P
13176 >This parameter may be used to override the
13177                 compiled-in default printcap name used by the server (usually <TT
13178 CLASS="FILENAME"
13179 >               /etc/printcap</TT
13180 >). See the discussion of the <A
13181 HREF="#AEN78"
13182 >[printers]</A
13183 > section above for reasons
13184                 why you might want to do this.</P
13185 ><P
13186 >On System V systems that use <B
13187 CLASS="COMMAND"
13188 >lpstat</B
13189 > to
13190                 list available printers you can use <B
13191 CLASS="COMMAND"
13192 >printcap name = lpstat
13193                 </B
13194 > to automatically obtain lists of available printers. This
13195                 is the default for systems that define SYSV at configure time in
13196                 Samba (this includes most System V based systems). If <TT
13197 CLASS="PARAMETER"
13198 ><I
13199 >               printcap name</I
13200 ></TT
13201 > is set to <B
13202 CLASS="COMMAND"
13203 >lpstat</B
13204 > on
13205                 these systems then Samba will launch <B
13206 CLASS="COMMAND"
13207 >lpstat -v</B
13208 > and
13209                 attempt to parse the output to obtain a printer list.</P
13210 ><P
13211 >A minimal printcap file would look something like this:</P
13212 ><P
13213 ><PRE
13214 CLASS="PROGRAMLISTING"
13215 >               print1|My Printer 1
13216                 print2|My Printer 2
13217                 print3|My Printer 3
13218                 print4|My Printer 4
13219                 print5|My Printer 5
13220                 </PRE
13221 ></P
13222 ><P
13223 >where the '|' separates aliases of a printer. The fact
13224                 that the second alias has a space in it gives a hint to Samba
13225                 that it's a comment.</P
13226 ><P
13227 ><I
13228 CLASS="EMPHASIS"
13229 >NOTE</I
13230 >: Under AIX the default printcap
13231                 name is <TT
13232 CLASS="FILENAME"
13233 >/etc/qconfig</TT
13234 >. Samba will assume the
13235                 file is in AIX <TT
13236 CLASS="FILENAME"
13237 >qconfig</TT
13238 > format if the string
13239                 <TT
13240 CLASS="FILENAME"
13241 >qconfig</TT
13242 > appears in the printcap filename.</P
13243 ><P
13244 >Default: <B
13245 CLASS="COMMAND"
13246 >printcap name = /etc/printcap</B
13247 ></P
13248 ><P
13249 >Example: <B
13250 CLASS="COMMAND"
13251 >printcap name = /etc/myprintcap</B
13252 ></P
13253 ></DD
13254 ><DT
13255 ><A
13256 NAME="PRINTERADMIN"
13257 ></A
13258 >printer admin (S)</DT
13259 ><DD
13260 ><P
13261 >This is a list of users that can do anything to
13262                 printers via the remote administration interfaces offered by MS-RPC
13263                 (usually using a NT workstation). Note that the root user always
13264                 has admin rights.</P
13265 ><P
13266 >Default: <B
13267 CLASS="COMMAND"
13268 >printer admin = &lt;empty string&gt;</B
13269 >
13270                 </P
13271 ><P
13272 >Example: <B
13273 CLASS="COMMAND"
13274 >printer admin = admin, @staff</B
13275 ></P
13276 ></DD
13277 ><DT
13278 ><A
13279 NAME="PRINTERDRIVER"
13280 ></A
13281 >printer driver (S)</DT
13282 ><DD
13283 ><P
13284 ><I
13285 CLASS="EMPHASIS"
13286 >Note :</I
13287 >This is a depreciated
13288                 parameter and will be removed in the next major release
13289                 following version 2.2.  Please see the instructions in
13290                 <TT
13291 CLASS="FILENAME"
13292 >PRINTER_DRIVER2.txt</TT
13293 > in the <TT
13294 CLASS="FILENAME"
13295 >docs
13296                 </TT
13297 > of the Samba distribution for more information
13298                 on the new method of loading printer drivers onto a Samba server.
13299                 </P
13300 ><P
13301 >This option allows you to control the string
13302                 that clients receive when they ask the server for the printer driver
13303                 associated with a printer. If you are using Windows95 or Windows NT
13304                 then you can use this to automate the setup of printers on your
13305                 system.</P
13306 ><P
13307 >You need to set this parameter to the exact string (case
13308                 sensitive) that describes the appropriate printer driver for your
13309                 system. If you don't know the exact string to use then you should
13310                 first try with no <A
13311 HREF="#PRINTERDRIVER"
13312 ><TT
13313 CLASS="PARAMETER"
13314 ><I
13315 >               printer driver</I
13316 ></TT
13317 ></A
13318 > option set and the client will
13319                 give you a list of printer drivers. The appropriate strings are
13320                 shown in a scroll box after you have chosen the printer manufacturer.</P
13321 ><P
13322 >See also <A
13323 HREF="#PRINTERDRIVERFILE"
13324 ><TT
13325 CLASS="PARAMETER"
13326 ><I
13327 >printer
13328                 driver file</I
13329 ></TT
13330 ></A
13331 >.</P
13332 ><P
13333 >Example: <B
13334 CLASS="COMMAND"
13335 >printer driver = HP LaserJet 4L</B
13336 ></P
13337 ></DD
13338 ><DT
13339 ><A
13340 NAME="PRINTERDRIVERFILE"
13341 ></A
13342 >printer driver file (G)</DT
13343 ><DD
13344 ><P
13345 ><I
13346 CLASS="EMPHASIS"
13347 >Note :</I
13348 >This is a depreciated
13349                 parameter and will be removed in the next major release
13350                 following version 2.2.  Please see the instructions in
13351                 <TT
13352 CLASS="FILENAME"
13353 >PRINTER_DRIVER2.txt</TT
13354 > in the <TT
13355 CLASS="FILENAME"
13356 >docs
13357                 </TT
13358 > of the Samba distribution for more information
13359                 on the new method of loading printer drivers onto a Samba server.
13360                 </P
13361 ><P
13362 >This parameter tells Samba where the printer driver
13363                 definition file, used when serving drivers to Windows 95 clients, is
13364                 to be found. If this is not set, the default is :</P
13365 ><P
13366 ><TT
13367 CLASS="FILENAME"
13368 ><TT
13369 CLASS="REPLACEABLE"
13370 ><I
13371 >SAMBA_INSTALL_DIRECTORY</I
13372 ></TT
13373 >
13374                 /lib/printers.def</TT
13375 ></P
13376 ><P
13377 >This file is created from Windows 95 <TT
13378 CLASS="FILENAME"
13379 >msprint.inf
13380                 </TT
13381 > files found on the Windows 95 client system. For more
13382                 details on setting up serving of printer drivers to Windows 95
13383                 clients, see the documentation file in the <TT
13384 CLASS="FILENAME"
13385 >docs/</TT
13386 >
13387                 directory, <TT
13388 CLASS="FILENAME"
13389 >PRINTER_DRIVER.txt</TT
13390 >.</P
13391 ><P
13392 >See also <A
13393 HREF="#PRINTERDRIVERLOCATION"
13394 ><TT
13395 CLASS="PARAMETER"
13396 ><I
13397 >               printer driver location</I
13398 ></TT
13399 ></A
13400 >.</P
13401 ><P
13402 >Default: <I
13403 CLASS="EMPHASIS"
13404 >None (set in compile).</I
13405 ></P
13406 ><P
13407 >Example: <B
13408 CLASS="COMMAND"
13409 >printer driver file =
13410                 /usr/local/samba/printers/drivers.def</B
13411 ></P
13412 ></DD
13413 ><DT
13414 ><A
13415 NAME="PRINTERDRIVERLOCATION"
13416 ></A
13417 >printer driver location (S)</DT
13418 ><DD
13419 ><P
13420 ><I
13421 CLASS="EMPHASIS"
13422 >Note :</I
13423 >This is a depreciated
13424                 parameter and will be removed in the next major release
13425                 following version 2.2.  Please see the instructions in
13426                 <TT
13427 CLASS="FILENAME"
13428 >PRINTER_DRIVER2.txt</TT
13429 > in the <TT
13430 CLASS="FILENAME"
13431 >docs
13432                 </TT
13433 > of the Samba distribution for more information
13434                 on the new method of loading printer drivers onto a Samba server.
13435                 </P
13436 ><P
13437 >This parameter tells clients of a particular printer
13438                 share where to find the printer driver files for the automatic
13439                 installation of drivers for Windows 95 machines. If Samba is set up
13440                 to serve printer drivers to Windows 95 machines, this should be set to</P
13441 ><P
13442 ><B
13443 CLASS="COMMAND"
13444 >\\MACHINE\PRINTER$</B
13445 ></P
13446 ><P
13447 >Where MACHINE is the NetBIOS name of your Samba server,
13448                 and PRINTER$ is a share you set up for serving printer driver
13449                 files. For more details on setting this up see the documentation
13450                 file in the <TT
13451 CLASS="FILENAME"
13452 >docs/</TT
13453 > directory, <TT
13454 CLASS="FILENAME"
13455 >               PRINTER_DRIVER.txt</TT
13456 >.</P
13457 ><P
13458 >See also <A
13459 HREF="#PRINTERDRIVERFILE"
13460 ><TT
13461 CLASS="PARAMETER"
13462 ><I
13463 >               printer driver file</I
13464 ></TT
13465 ></A
13466 >.</P
13467 ><P
13468 >Default: <B
13469 CLASS="COMMAND"
13470 >none</B
13471 ></P
13472 ><P
13473 >Example: <B
13474 CLASS="COMMAND"
13475 >printer driver location = \\MACHINE\PRINTER$
13476                 </B
13477 ></P
13478 ></DD
13479 ><DT
13480 ><A
13481 NAME="PRINTERNAME"
13482 ></A
13483 >printer name (S)</DT
13484 ><DD
13485 ><P
13486 >This parameter specifies the name of the printer
13487                 to which print jobs spooled through a printable service will be sent.</P
13488 ><P
13489 >If specified in the [global] section, the printer
13490                 name given will be used for any printable service that does
13491                 not have its own printer name specified.</P
13492 ><P
13493 >Default: <I
13494 CLASS="EMPHASIS"
13495 >none (but may be <TT
13496 CLASS="CONSTANT"
13497 >lp</TT
13498 >
13499                 on many systems)</I
13500 ></P
13501 ><P
13502 >Example: <B
13503 CLASS="COMMAND"
13504 >printer name = laserwriter</B
13505 ></P
13506 ></DD
13507 ><DT
13508 ><A
13509 NAME="PRINTER"
13510 ></A
13511 >printer (S)</DT
13512 ><DD
13513 ><P
13514 >Synonym for <A
13515 HREF="#PRINTERNAME"
13516 ><TT
13517 CLASS="PARAMETER"
13518 ><I
13519 >               printer name</I
13520 ></TT
13521 ></A
13522 >.</P
13523 ></DD
13524 ><DT
13525 ><A
13526 NAME="PRINTING"
13527 ></A
13528 >printing (S)</DT
13529 ><DD
13530 ><P
13531 >This parameters controls how printer status
13532                 information is interpreted on your system. It also affects the
13533                 default values for the <TT
13534 CLASS="PARAMETER"
13535 ><I
13536 >print command</I
13537 ></TT
13538 >,
13539                 <TT
13540 CLASS="PARAMETER"
13541 ><I
13542 >lpq command</I
13543 ></TT
13544 >, <TT
13545 CLASS="PARAMETER"
13546 ><I
13547 >lppause command
13548                 </I
13549 ></TT
13550 >, <TT
13551 CLASS="PARAMETER"
13552 ><I
13553 >lpresume command</I
13554 ></TT
13555 >, and
13556                 <TT
13557 CLASS="PARAMETER"
13558 ><I
13559 >lprm command</I
13560 ></TT
13561 > if specified in the
13562                 [global]f&#62; section.</P
13563 ><P
13564 >Currently eight printing styles are supported. They are
13565                 <TT
13566 CLASS="CONSTANT"
13567 >BSD</TT
13568 >, <TT
13569 CLASS="CONSTANT"
13570 >AIX</TT
13571 >,
13572                 <TT
13573 CLASS="CONSTANT"
13574 >LPRNG</TT
13575 >, <TT
13576 CLASS="CONSTANT"
13577 >PLP</TT
13578 >,
13579                 <TT
13580 CLASS="CONSTANT"
13581 >SYSV</TT
13582 >, <TT
13583 CLASS="CONSTANT"
13584 >HPUX</TT
13585 >,
13586                 <TT
13587 CLASS="CONSTANT"
13588 >QNX</TT
13589 >, <TT
13590 CLASS="CONSTANT"
13591 >SOFTQ</TT
13592 >,
13593                 and <TT
13594 CLASS="CONSTANT"
13595 >CUPS</TT
13596 >.</P
13597 ><P
13598 >To see what the defaults are for the other print
13599                 commands when using the various options use the <A
13600 HREF="testparm.1.html"
13601 TARGET="_top"
13602 >testparm(1)</A
13603 > program.</P
13604 ><P
13605 >This option can be set on a per printer basis</P
13606 ><P
13607 >See also the discussion in the <A
13608 HREF="#AEN78"
13609 >               [printers]</A
13610 > section.</P
13611 ></DD
13612 ><DT
13613 ><A
13614 NAME="PROTOCOL"
13615 ></A
13616 >protocol (G)</DT
13617 ><DD
13618 ><P
13619 >Synonym for <A
13620 HREF="#MAXPROTOCOL"
13621 >               <TT
13622 CLASS="PARAMETER"
13623 ><I
13624 >max protocol</I
13625 ></TT
13626 ></A
13627 >.</P
13628 ></DD
13629 ><DT
13630 ><A
13631 NAME="PUBLIC"
13632 ></A
13633 >public (S)</DT
13634 ><DD
13635 ><P
13636 >Synonym for <A
13637 HREF="#GUESTOK"
13638 ><TT
13639 CLASS="PARAMETER"
13640 ><I
13641 >guest
13642                 ok</I
13643 ></TT
13644 ></A
13645 >.</P
13646 ></DD
13647 ><DT
13648 ><A
13649 NAME="QUEUEPAUSECOMMAND"
13650 ></A
13651 >queuepause command (S)</DT
13652 ><DD
13653 ><P
13654 >This parameter specifies the command to be
13655                 executed on the server host in order to pause the printerqueue.</P
13656 ><P
13657 >This command should be a program or script which takes
13658                 a printer name as its only parameter and stops the printerqueue,
13659                 such that no longer jobs are submitted to the printer.</P
13660 ><P
13661 >This command is not supported by Windows for Workgroups,
13662                 but can be issued from the Printer's window under Windows 95
13663                 and NT.</P
13664 ><P
13665 >If a <TT
13666 CLASS="PARAMETER"
13667 ><I
13668 >%p</I
13669 ></TT
13670 > is given then the printername
13671                 is put in its place. Otherwise it is placed at the end of the command.
13672                 </P
13673 ><P
13674 >Note that it is good practice to include the absolute
13675                 path in the command as the PATH may not be available to the
13676                 server.</P
13677 ><P
13678 >Default: <I
13679 CLASS="EMPHASIS"
13680 >depends on the setting of <TT
13681 CLASS="PARAMETER"
13682 ><I
13683 >printing
13684                 </I
13685 ></TT
13686 ></I
13687 ></P
13688 ><P
13689 >Example: <B
13690 CLASS="COMMAND"
13691 >queuepause command = disable %p</B
13692 ></P
13693 ></DD
13694 ><DT
13695 ><A
13696 NAME="QUEUERESUMECOMMAND"
13697 ></A
13698 >queueresume command (S)</DT
13699 ><DD
13700 ><P
13701 >This parameter specifies the command to be
13702                 executed on the server host in order to resume the printerqueue. It
13703                 is the command to undo the behavior that is caused by the
13704                 previous parameter (<A
13705 HREF="#QUEUEPAUSECOMMAND"
13706 ><TT
13707 CLASS="PARAMETER"
13708 ><I
13709 >               queuepause command</I
13710 ></TT
13711 ></A
13712 >).</P
13713 ><P
13714 >This command should be a program or script which takes
13715                 a printer name as its only parameter and resumes the printerqueue,
13716                 such that queued jobs are resubmitted to the printer.</P
13717 ><P
13718 >This command is not supported by Windows for Workgroups,
13719                 but can be issued from the Printer's window under Windows 95
13720                 and NT.</P
13721 ><P
13722 >If a <TT
13723 CLASS="PARAMETER"
13724 ><I
13725 >%p</I
13726 ></TT
13727 > is given then the printername
13728                 is put in its place. Otherwise it is placed at the end of the
13729                 command.</P
13730 ><P
13731 >Note that it is good practice to include the absolute
13732                 path in the command as the PATH may not be available to the
13733                 server.</P
13734 ><P
13735 >Default: <I
13736 CLASS="EMPHASIS"
13737 >depends on the setting of <A
13738 HREF="#PRINTING"
13739 ><TT
13740 CLASS="PARAMETER"
13741 ><I
13742 >printing</I
13743 ></TT
13744 ></A
13745 ></I
13746 >
13747                 </P
13748 ><P
13749 >Example: <B
13750 CLASS="COMMAND"
13751 >queuepause command = enable %p
13752                 </B
13753 ></P
13754 ></DD
13755 ><DT
13756 ><A
13757 NAME="READBMPX"
13758 ></A
13759 >read bmpx (G)</DT
13760 ><DD
13761 ><P
13762 >This boolean parameter controls whether <A
13763 HREF="smbd.8.html"
13764 TARGET="_top"
13765 >smbd(8)</A
13766 > will support the "Read
13767                 Block Multiplex" SMB. This is now rarely used and defaults to
13768                 <TT
13769 CLASS="CONSTANT"
13770 >no</TT
13771 >. You should never need to set this
13772                 parameter.</P
13773 ><P
13774 >Default: <B
13775 CLASS="COMMAND"
13776 >read bmpx = no</B
13777 ></P
13778 ></DD
13779 ><DT
13780 ><A
13781 NAME="READLIST"
13782 ></A
13783 >read list (S)</DT
13784 ><DD
13785 ><P
13786 >This is a list of users that are given read-only
13787                 access to a service. If the connecting user is in this list then
13788                 they will not be given write access, no matter what the <A
13789 HREF="#WRITEABLE"
13790 ><TT
13791 CLASS="PARAMETER"
13792 ><I
13793 >writeable</I
13794 ></TT
13795 ></A
13796 >
13797                 option is set to. The list can include group names using the
13798                 syntax described in the <A
13799 HREF="#INVALIDUSERS"
13800 ><TT
13801 CLASS="PARAMETER"
13802 ><I
13803 >               invalid users</I
13804 ></TT
13805 ></A
13806 > parameter.</P
13807 ><P
13808 >See also the <A
13809 HREF="#WRITELIST"
13810 ><TT
13811 CLASS="PARAMETER"
13812 ><I
13813 >               write list</I
13814 ></TT
13815 ></A
13816 > parameter and the <A
13817 HREF="#INVALIDUSERS"
13818 ><TT
13819 CLASS="PARAMETER"
13820 ><I
13821 >invalid users</I
13822 ></TT
13823 >
13824                 </A
13825 > parameter.</P
13826 ><P
13827 >Default: <B
13828 CLASS="COMMAND"
13829 >read list = &lt;empty string&gt;</B
13830 ></P
13831 ><P
13832 >Example: <B
13833 CLASS="COMMAND"
13834 >read list = mary, @students</B
13835 ></P
13836 ></DD
13837 ><DT
13838 ><A
13839 NAME="READONLY"
13840 ></A
13841 >read only (S)</DT
13842 ><DD
13843 ><P
13844 >Note that this is an inverted synonym for <A
13845 HREF="#WRITEABLE"
13846 ><TT
13847 CLASS="PARAMETER"
13848 ><I
13849 >writeable</I
13850 ></TT
13851 ></A
13852 >.</P
13853 ></DD
13854 ><DT
13855 ><A
13856 NAME="READRAW"
13857 ></A
13858 >read raw (G)</DT
13859 ><DD
13860 ><P
13861 >This parameter controls whether or not the server
13862                 will support the raw read SMB requests when transferring data
13863                 to clients.</P
13864 ><P
13865 >If enabled, raw reads allow reads of 65535 bytes in
13866                 one packet. This typically provides a major performance benefit.
13867                 </P
13868 ><P
13869 >However, some clients either negotiate the allowable
13870                 block size incorrectly or are incapable of supporting larger block
13871                 sizes, and for these clients you may need to disable raw reads.</P
13872 ><P
13873 >In general this parameter should be viewed as a system tuning
13874                 tool and left severely alone. See also <A
13875 HREF="#WRITERAW"
13876 >               <TT
13877 CLASS="PARAMETER"
13878 ><I
13879 >write raw</I
13880 ></TT
13881 ></A
13882 >.</P
13883 ><P
13884 >Default: <B
13885 CLASS="COMMAND"
13886 >read raw = yes</B
13887 ></P
13888 ></DD
13889 ><DT
13890 ><A
13891 NAME="READSIZE"
13892 ></A
13893 >read size (G)</DT
13894 ><DD
13895 ><P
13896 >The option <TT
13897 CLASS="PARAMETER"
13898 ><I
13899 >read size</I
13900 ></TT
13901 >
13902                 affects the overlap of disk reads/writes with network reads/writes.
13903                 If the amount of data being transferred in several of the SMB
13904                 commands (currently SMBwrite, SMBwriteX and SMBreadbraw) is larger
13905                 than this value then the server begins writing the data before it
13906                 has received the whole packet from the network, or in the case of
13907                 SMBreadbraw, it begins writing to the network before all the data
13908                 has been read from disk.</P
13909 ><P
13910 >This overlapping works best when the speeds of disk and
13911                 network access are similar, having very little effect when the
13912                 speed of one is much greater than the other.</P
13913 ><P
13914 >The default value is 16384, but very little experimentation
13915                 has been done yet to determine the optimal value, and it is likely
13916                 that the best value will vary greatly between systems anyway.
13917                 A value over 65536 is pointless and will cause you to allocate
13918                 memory unnecessarily.</P
13919 ><P
13920 >Default: <B
13921 CLASS="COMMAND"
13922 >read size = 16384</B
13923 ></P
13924 ><P
13925 >Example: <B
13926 CLASS="COMMAND"
13927 >read size = 8192</B
13928 ></P
13929 ></DD
13930 ><DT
13931 ><A
13932 NAME="REMOTEANNOUNCE"
13933 ></A
13934 >remote announce (G)</DT
13935 ><DD
13936 ><P
13937 >This option allows you to setup <A
13938 HREF="nmbd.8.html"
13939 TARGET="_top"
13940 >nmbd(8)</A
13941 > to periodically announce itself
13942                 to arbitrary IP addresses with an arbitrary workgroup name.</P
13943 ><P
13944 >This is useful if you want your Samba server to appear
13945                 in a remote workgroup for which the normal browse propagation
13946                 rules don't work. The remote workgroup can be anywhere that you
13947                 can send IP packets to.</P
13948 ><P
13949 >For example:</P
13950 ><P
13951 ><B
13952 CLASS="COMMAND"
13953 >remote announce = 192.168.2.255/SERVERS
13954                 192.168.4.255/STAFF</B
13955 ></P
13956 ><P
13957 >the above line would cause nmbd to announce itself
13958                 to the two given IP addresses using the given workgroup names.
13959                 If you leave out the workgroup name then the one given in
13960                 the <A
13961 HREF="#WORKGROUP"
13962 ><TT
13963 CLASS="PARAMETER"
13964 ><I
13965 >workgroup</I
13966 ></TT
13967 ></A
13968 >
13969                 parameter is used instead.</P
13970 ><P
13971 >The IP addresses you choose would normally be the broadcast
13972                 addresses of the remote networks, but can also be the IP addresses
13973                 of known browse masters if your network config is that stable.</P
13974 ><P
13975 >See the documentation file <TT
13976 CLASS="FILENAME"
13977 >BROWSING.txt</TT
13978 >
13979                 in the <TT
13980 CLASS="FILENAME"
13981 >docs/</TT
13982 > directory.</P
13983 ><P
13984 >Default: <B
13985 CLASS="COMMAND"
13986 >remote announce = &lt;empty string&gt;
13987                 </B
13988 ></P
13989 ></DD
13990 ><DT
13991 ><A
13992 NAME="REMOTEBROWSESYNC"
13993 ></A
13994 >remote browse sync (G)</DT
13995 ><DD
13996 ><P
13997 >This option allows you to setup <A
13998 HREF="nmbd.8.html"
13999 TARGET="_top"
14000 >nmbd(8)</A
14001 > to periodically request
14002                 synchronization of browse lists with the master browser of a samba
14003                 server that is on a remote segment. This option will allow you to
14004                 gain browse lists for multiple workgroups across routed networks. This
14005                 is done in a manner that does not work with any non-samba servers.</P
14006 ><P
14007 >This is useful if you want your Samba server and all local
14008                 clients to appear in a remote workgroup for which the normal browse
14009                 propagation rules don't work. The remote workgroup can be anywhere
14010                 that you can send IP packets to.</P
14011 ><P
14012 >For example:</P
14013 ><P
14014 ><B
14015 CLASS="COMMAND"
14016 >remote browse sync = 192.168.2.255 192.168.4.255
14017                 </B
14018 ></P
14019 ><P
14020 >the above line would cause <B
14021 CLASS="COMMAND"
14022 >nmbd</B
14023 > to request
14024                 the master browser on the specified subnets or addresses to
14025                 synchronize their browse lists with the local server.</P
14026 ><P
14027 >The IP addresses you choose would normally be the broadcast
14028                 addresses of the remote networks, but can also be the IP addresses
14029                 of known browse masters if your network config is that stable. If
14030                 a machine IP address is given Samba makes NO attempt to validate
14031                 that the remote machine is available, is listening, nor that it
14032                 is in fact the browse master on it's segment.</P
14033 ><P
14034 >Default: <B
14035 CLASS="COMMAND"
14036 >remote browse sync = &lt;empty string&gt;
14037                 </B
14038 ></P
14039 ></DD
14040 ><DT
14041 ><A
14042 NAME="RESTRICTANONYMOUS"
14043 ></A
14044 >restrict anonymous (G)</DT
14045 ><DD
14046 ><P
14047 >This is a boolean parameter.  If it is true, then
14048                 anonymous access to the server will be restricted, namely in the
14049                 case where the server is expecting the client to send a username,
14050                 but it doesn't.  Setting it to true will force these anonymous
14051                 connections to be denied, and the client will be required to always
14052                 supply a username and password when connecting. Use of this parameter
14053                 is only recommended for homogeneous NT client environments.</P
14054 ><P
14055 >This parameter makes the use of macro expansions that rely
14056                 on the username (%U, %G, etc) consistent.  NT 4.0
14057                 likes to use anonymous connections when refreshing the share list,
14058                 and this is a way to work around that.</P
14059 ><P
14060 >When restrict anonymous is true, all anonymous connections
14061                 are denied no matter what they are for.  This can effect the ability
14062                 of a machine to access the samba Primary Domain Controller to revalidate
14063                 it's machine account after someone else has logged on the client
14064                 interactively.  The NT client will display a message saying that
14065                 the machine's account in  the domain doesn't exist or the password is
14066                 bad.  The best way to deal  with this is to reboot NT client machines
14067                 between interactive logons,  using "Shutdown and Restart", rather
14068                 than "Close all programs and logon as a different user".</P
14069 ><P
14070 >Default: <B
14071 CLASS="COMMAND"
14072 >restrict anonymous = no</B
14073 ></P
14074 ></DD
14075 ><DT
14076 ><A
14077 NAME="ROOT"
14078 ></A
14079 >root (G)</DT
14080 ><DD
14081 ><P
14082 >Synonym for <A
14083 HREF="#ROOTDIRECTORY"
14084 >               <TT
14085 CLASS="PARAMETER"
14086 ><I
14087 >root directory"</I
14088 ></TT
14089 ></A
14090 >.</P
14091 ></DD
14092 ><DT
14093 ><A
14094 NAME="ROOTDIR"
14095 ></A
14096 >root dir (G)</DT
14097 ><DD
14098 ><P
14099 >Synonym for <A
14100 HREF="#ROOTDIRECTORY"
14101 >               <TT
14102 CLASS="PARAMETER"
14103 ><I
14104 >root directory"</I
14105 ></TT
14106 ></A
14107 >.</P
14108 ></DD
14109 ><DT
14110 ><A
14111 NAME="ROOTDIRECTORY"
14112 ></A
14113 >root directory (G)</DT
14114 ><DD
14115 ><P
14116 >The server will <B
14117 CLASS="COMMAND"
14118 >chroot()</B
14119 > (i.e.
14120                 Change it's root directory) to this directory on startup. This is
14121                 not strictly necessary for secure operation. Even without it the
14122                 server will deny access to files not in one of the service entries.
14123                 It may also check for, and deny access to, soft links to other
14124                 parts of the filesystem, or attempts to use ".." in file names
14125                 to access other directories (depending on the setting of the <A
14126 HREF="#WIDELINKS"
14127 ><TT
14128 CLASS="PARAMETER"
14129 ><I
14130 >wide links</I
14131 ></TT
14132 ></A
14133 >
14134                 parameter).</P
14135 ><P
14136 >Adding a <TT
14137 CLASS="PARAMETER"
14138 ><I
14139 >root directory</I
14140 ></TT
14141 > entry other
14142                 than "/" adds an extra level of security, but at a price. It
14143                 absolutely ensures that no access is given to files not in the
14144                 sub-tree specified in the <TT
14145 CLASS="PARAMETER"
14146 ><I
14147 >root directory</I
14148 ></TT
14149 >
14150                 option, <I
14151 CLASS="EMPHASIS"
14152 >including</I
14153 > some files needed for
14154                 complete operation of the server. To maintain full operability
14155                 of the server you will need to mirror some system files
14156                 into the <TT
14157 CLASS="PARAMETER"
14158 ><I
14159 >root directory</I
14160 ></TT
14161 > tree. In particular
14162                 you will need to mirror <TT
14163 CLASS="FILENAME"
14164 >/etc/passwd</TT
14165 > (or a
14166                 subset of it), and any binaries or configuration files needed for
14167                 printing (if required). The set of files that must be mirrored is
14168                 operating system dependent.</P
14169 ><P
14170 >Default: <B
14171 CLASS="COMMAND"
14172 >root directory = /</B
14173 ></P
14174 ><P
14175 >Example: <B
14176 CLASS="COMMAND"
14177 >root directory = /homes/smb</B
14178 ></P
14179 ></DD
14180 ><DT
14181 ><A
14182 NAME="ROOTPOSTEXEC"
14183 ></A
14184 >root postexec (S)</DT
14185 ><DD
14186 ><P
14187 >This is the same as the <TT
14188 CLASS="PARAMETER"
14189 ><I
14190 >postexec</I
14191 ></TT
14192 >
14193                 parameter except that the command is run as root. This
14194                 is useful for unmounting filesystems
14195                 (such as cdroms) after a connection is closed.</P
14196 ><P
14197 >See also <A
14198 HREF="#POSTEXEC"
14199 ><TT
14200 CLASS="PARAMETER"
14201 ><I
14202 >               postexec</I
14203 ></TT
14204 ></A
14205 >.</P
14206 ><P
14207 >Default: <B
14208 CLASS="COMMAND"
14209 >root postexec = &lt;empty string&gt;
14210                 </B
14211 ></P
14212 ></DD
14213 ><DT
14214 ><A
14215 NAME="ROOTPREEXEC"
14216 ></A
14217 >root preexec (S)</DT
14218 ><DD
14219 ><P
14220 >This is the same as the <TT
14221 CLASS="PARAMETER"
14222 ><I
14223 >preexec</I
14224 ></TT
14225 >
14226                 parameter except that the command is run as root. This
14227                 is useful for mounting filesystems (such as cdroms) after a
14228                 connection is closed.</P
14229 ><P
14230 >See also <A
14231 HREF="#PREEXEC"
14232 ><TT
14233 CLASS="PARAMETER"
14234 ><I
14235 >               preexec</I
14236 ></TT
14237 ></A
14238 > and <A
14239 HREF="#PREEXECCLOSE"
14240 >               <TT
14241 CLASS="PARAMETER"
14242 ><I
14243 >preexec close</I
14244 ></TT
14245 ></A
14246 >.</P
14247 ><P
14248 >Default: <B
14249 CLASS="COMMAND"
14250 >root preexec = &lt;empty string&gt;
14251                 </B
14252 ></P
14253 ></DD
14254 ><DT
14255 ><A
14256 NAME="ROOTPREEXECCLOSE"
14257 ></A
14258 >root preexec close (S)</DT
14259 ><DD
14260 ><P
14261 >This is the same as the <TT
14262 CLASS="PARAMETER"
14263 ><I
14264 >preexec close
14265                 </I
14266 ></TT
14267 > parameter except that the command is run as root.</P
14268 ><P
14269 >See also <A
14270 HREF="#PREEXEC"
14271 ><TT
14272 CLASS="PARAMETER"
14273 ><I
14274 >               preexec</I
14275 ></TT
14276 ></A
14277 > and <A
14278 HREF="#PREEXECCLOSE"
14279 >               <TT
14280 CLASS="PARAMETER"
14281 ><I
14282 >preexec close</I
14283 ></TT
14284 ></A
14285 >.</P
14286 ><P
14287 >Default: <B
14288 CLASS="COMMAND"
14289 >root preexec close = no</B
14290 ></P
14291 ></DD
14292 ><DT
14293 ><A
14294 NAME="SECURITY"
14295 ></A
14296 >security (G)</DT
14297 ><DD
14298 ><P
14299 >This option affects how clients respond to
14300                 Samba and is one of the most important settings in the <TT
14301 CLASS="FILENAME"
14302 >               smb.conf</TT
14303 > file.</P
14304 ><P
14305 >The option sets the "security mode bit" in replies to
14306                 protocol negotiations with <A
14307 HREF="smbd.8.html"
14308 TARGET="_top"
14309 >smbd(8)
14310                 </A
14311 > to turn share level security on or off. Clients decide
14312                 based on this bit whether (and how) to transfer user and password
14313                 information to the server.</P
14314 ><P
14315 >The default is <B
14316 CLASS="COMMAND"
14317 >security = user</B
14318 >, as this is
14319                 the most common setting needed when talking to Windows 98 and
14320                 Windows NT.</P
14321 ><P
14322 >The alternatives are <B
14323 CLASS="COMMAND"
14324 >security = share</B
14325 >,
14326                 <B
14327 CLASS="COMMAND"
14328 >security = server</B
14329 > or <B
14330 CLASS="COMMAND"
14331 >security=domain
14332                 </B
14333 >.</P
14334 ><P
14335 >In versions of Samba prior to 2..0, the default was
14336                 <B
14337 CLASS="COMMAND"
14338 >security = share</B
14339 > mainly because that was
14340                 the only option at one stage.</P
14341 ><P
14342 >There is a bug in WfWg that has relevance to this
14343                 setting. When in user or server level security a WfWg client
14344                 will totally ignore the password you type in the "connect
14345                 drive" dialog box. This makes it very difficult (if not impossible)
14346                 to connect to a Samba service as anyone except the user that
14347                 you are logged into WfWg as.</P
14348 ><P
14349 >If your PCs use usernames that are the same as their
14350                 usernames on the UNIX machine then you will want to use
14351                 <B
14352 CLASS="COMMAND"
14353 >security = user</B
14354 >. If you mostly use usernames
14355                 that don't exist on the UNIX box then use <B
14356 CLASS="COMMAND"
14357 >security =
14358                 share</B
14359 >.</P
14360 ><P
14361 >You should also use <B
14362 CLASS="COMMAND"
14363 >security = share</B
14364 > if you
14365                 want to mainly setup shares without a password (guest shares). This
14366                 is commonly used for a shared printer server. It is more difficult
14367                 to setup guest shares with <B
14368 CLASS="COMMAND"
14369 >security = user</B
14370 >, see
14371                 the <A
14372 HREF="#MAPTOGUEST"
14373 ><TT
14374 CLASS="PARAMETER"
14375 ><I
14376 >map to guest</I
14377 ></TT
14378 >
14379                 </A
14380 >parameter for details.</P
14381 ><P
14382 >It is possible to use <B
14383 CLASS="COMMAND"
14384 >smbd</B
14385 > in a <I
14386 CLASS="EMPHASIS"
14387 >               hybrid mode</I
14388 > where it is offers both user and share
14389                 level security under different <A
14390 HREF="#NETBIOSALIASES"
14391 >               <TT
14392 CLASS="PARAMETER"
14393 ><I
14394 >NetBIOS aliases</I
14395 ></TT
14396 ></A
14397 >. </P
14398 ><P
14399 >The different settings will now be explained.</P
14400 ><P
14401 ><A
14402 NAME="SECURITYEQUALSSHARE"
14403 ></A
14404 ><I
14405 CLASS="EMPHASIS"
14406 >SECURITY = SHARE
14407                 </I
14408 ></P
14409 ><P
14410 >When clients connect to a share level security server then
14411                 need not log onto the server with a valid username and password before
14412                 attempting to connect to a shared resource (although modern clients
14413                 such as Windows 95/98 and Windows NT will send a logon request with
14414                 a username but no password when talking to a <B
14415 CLASS="COMMAND"
14416 >security = share
14417                 </B
14418 > server). Instead, the clients send authentication information
14419                 (passwords) on a per-share basis, at the time they attempt to connect
14420                 to that share.</P
14421 ><P
14422 >Note that <B
14423 CLASS="COMMAND"
14424 >smbd</B
14425 > <I
14426 CLASS="EMPHASIS"
14427 >ALWAYS</I
14428 >
14429                 uses a valid UNIX user to act on behalf of the client, even in
14430                 <B
14431 CLASS="COMMAND"
14432 >security = share</B
14433 > level security.</P
14434 ><P
14435 >As clients are not required to send a username to the server
14436                 in share level security, <B
14437 CLASS="COMMAND"
14438 >smbd</B
14439 > uses several
14440                 techniques to determine the correct UNIX user to use on behalf
14441                 of the client.</P
14442 ><P
14443 >A list of possible UNIX usernames to match with the given
14444                 client password is constructed using the following methods :</P
14445 ><P
14446 ></P
14447 ><UL
14448 ><LI
14449 ><P
14450 >If the <A
14451 HREF="#GUESTONLY"
14452 ><TT
14453 CLASS="PARAMETER"
14454 ><I
14455 >guest
14456                         only</I
14457 ></TT
14458 ></A
14459 > parameter is set, then all the other
14460                         stages are missed and only the <A
14461 HREF="#GUESTACCOUNT"
14462 >                       <TT
14463 CLASS="PARAMETER"
14464 ><I
14465 >guest account</I
14466 ></TT
14467 ></A
14468 > username is checked.
14469                         </P
14470 ></LI
14471 ><LI
14472 ><P
14473 >Is a username is sent with the share connection
14474                         request, then this username (after mapping - see <A
14475 HREF="#USERNAMEMAP"
14476 ><TT
14477 CLASS="PARAMETER"
14478 ><I
14479 >username map</I
14480 ></TT
14481 ></A
14482 >),
14483                         is added as a potential username.</P
14484 ></LI
14485 ><LI
14486 ><P
14487 >If the client did a previous <I
14488 CLASS="EMPHASIS"
14489 >logon
14490                         </I
14491 > request (the SessionSetup SMB call) then the
14492                         username sent in this SMB will be added as a potential username.
14493                         </P
14494 ></LI
14495 ><LI
14496 ><P
14497 >The name of the service the client requested is
14498                         added as a potential username.</P
14499 ></LI
14500 ><LI
14501 ><P
14502 >The NetBIOS name of the client is added to
14503                         the list as a potential username.</P
14504 ></LI
14505 ><LI
14506 ><P
14507 >Any users on the <A
14508 HREF="#USER"
14509 ><TT
14510 CLASS="PARAMETER"
14511 ><I
14512 >                       user</I
14513 ></TT
14514 ></A
14515 > list are added as potential usernames.
14516                         </P
14517 ></LI
14518 ></UL
14519 ><P
14520 >If the <TT
14521 CLASS="PARAMETER"
14522 ><I
14523 >guest only</I
14524 ></TT
14525 > parameter is
14526                 not set, then this list is then tried with the supplied password.
14527                 The first user for whom the password matches will be used as the
14528                 UNIX user.</P
14529 ><P
14530 >If the <TT
14531 CLASS="PARAMETER"
14532 ><I
14533 >guest only</I
14534 ></TT
14535 > parameter is
14536                 set, or no username can be determined then if the share is marked
14537                 as available to the <TT
14538 CLASS="PARAMETER"
14539 ><I
14540 >guest account</I
14541 ></TT
14542 >, then this
14543                 guest user will be used, otherwise access is denied.</P
14544 ><P
14545 >Note that it can be <I
14546 CLASS="EMPHASIS"
14547 >very</I
14548 > confusing
14549                 in share-level security as to which UNIX username will eventually
14550                 be used in granting access.</P
14551 ><P
14552 >See also the section <A
14553 HREF="#AEN234"
14554 >               NOTE ABOUT USERNAME/PASSWORD VALIDATION</A
14555 >.</P
14556 ><P
14557 ><A
14558 NAME="SECURITYEQUALSUSER"
14559 ></A
14560 ><I
14561 CLASS="EMPHASIS"
14562 >SECURIYT = USER
14563                 </I
14564 ></P
14565 ><P
14566 >This is the default security setting in Samba 2.2.
14567                 With user-level security a client must first "log=on" with a
14568                 valid username and password (which can be mapped using the <A
14569 HREF="#USERNAMEMAP"
14570 ><TT
14571 CLASS="PARAMETER"
14572 ><I
14573 >username map</I
14574 ></TT
14575 ></A
14576 >
14577                 parameter). Encrypted passwords (see the <A
14578 HREF="#ENCRYPTPASSWORDS"
14579 >               <TT
14580 CLASS="PARAMETER"
14581 ><I
14582 >encrypted passwords</I
14583 ></TT
14584 ></A
14585 > parameter) can also
14586                 be used in this security mode. Parameters such as <A
14587 HREF="#USER"
14588 >               <TT
14589 CLASS="PARAMETER"
14590 ><I
14591 >user</I
14592 ></TT
14593 ></A
14594 > and <A
14595 HREF="#GUESTONLY"
14596 >               <TT
14597 CLASS="PARAMETER"
14598 ><I
14599 >guest only</I
14600 ></TT
14601 ></A
14602 > if set        are then applied and
14603                 may change the UNIX user to use on this connection, but only after
14604                 the user has been successfully authenticated.</P
14605 ><P
14606 ><I
14607 CLASS="EMPHASIS"
14608 >Note</I
14609 > that the name of the resource being
14610                 requested is <I
14611 CLASS="EMPHASIS"
14612 >not</I
14613 > sent to the server until after
14614                 the server has successfully authenticated the client. This is why
14615                 guest shares don't work in user level security without allowing
14616                 the server to automatically map unknown users into the <A
14617 HREF="#GUESTACCOUNT"
14618 ><TT
14619 CLASS="PARAMETER"
14620 ><I
14621 >guest account</I
14622 ></TT
14623 ></A
14624 >.
14625                 See the <A
14626 HREF="#MAPTOGUEST"
14627 ><TT
14628 CLASS="PARAMETER"
14629 ><I
14630 >map to guest</I
14631 ></TT
14632 >
14633                 </A
14634 > parameter for details on doing this.</P
14635 ><P
14636 >See also the section <A
14637 HREF="#AEN234"
14638 >               NOTE ABOUT USERNAME/PASSWORD VALIDATION</A
14639 >.</P
14640 ><P
14641 ><A
14642 NAME="SECURITYEQUALSSERVER"
14643 ></A
14644 ><I
14645 CLASS="EMPHASIS"
14646 >SECURITY = SERVER
14647                 </I
14648 ></P
14649 ><P
14650 >In this mode Samba will try to validate the username/password
14651                 by passing it to another SMB server, such as an NT box. If this
14652                 fails it will revert to <B
14653 CLASS="COMMAND"
14654 >security = user</B
14655 >, but note
14656                 that if encrypted passwords have been negotiated then Samba cannot
14657                 revert back to checking the UNIX password file, it must have a valid
14658                 <TT
14659 CLASS="FILENAME"
14660 >smbpasswd</TT
14661 > file to check users against. See the
14662                 documentation file in the <TT
14663 CLASS="FILENAME"
14664 >docs/</TT
14665 > directory
14666                 <TT
14667 CLASS="FILENAME"
14668 >ENCRYPTION.txt</TT
14669 > for details on how to set this
14670                 up.</P
14671 ><P
14672 ><I
14673 CLASS="EMPHASIS"
14674 >Note</I
14675 > that from the clients point of
14676                 view <B
14677 CLASS="COMMAND"
14678 >security = server</B
14679 > is the same as <B
14680 CLASS="COMMAND"
14681 >               security = user</B
14682 >.  It only affects how the server deals
14683                 with the authentication, it does not in any way affect what the
14684                 client sees.</P
14685 ><P
14686 ><I
14687 CLASS="EMPHASIS"
14688 >Note</I
14689 > that the name of the resource being
14690                 requested is <I
14691 CLASS="EMPHASIS"
14692 >not</I
14693 > sent to the server until after
14694                 the server has successfully authenticated the client. This is why
14695                 guest shares don't work in user level security without allowing
14696                 the server to automatically map unknown users into the <A
14697 HREF="#GUESTACCOUNT"
14698 ><TT
14699 CLASS="PARAMETER"
14700 ><I
14701 >guest account</I
14702 ></TT
14703 ></A
14704 >.
14705                 See the <A
14706 HREF="#MAPTOGUEST"
14707 ><TT
14708 CLASS="PARAMETER"
14709 ><I
14710 >map to guest</I
14711 ></TT
14712 >
14713                 </A
14714 > parameter for details on doing this.</P
14715 ><P
14716 >See also the section <A
14717 HREF="#AEN234"
14718 >               NOTE ABOUT USERNAME/PASSWORD VALIDATION</A
14719 >.</P
14720 ><P
14721 >See also the <A
14722 HREF="#PASSWORDSERVER"
14723 ><TT
14724 CLASS="PARAMETER"
14725 ><I
14726 >password
14727                 server</I
14728 ></TT
14729 ></A
14730 > parameter and the <A
14731 HREF="#ENCRYPTPASSWORDS"
14732 ><TT
14733 CLASS="PARAMETER"
14734 ><I
14735 >encrypted passwords</I
14736 ></TT
14737 >
14738                 </A
14739 > parameter.</P
14740 ><P
14741 ><A
14742 NAME="SECURITYEQUALSDOMAIN"
14743 ></A
14744 ><I
14745 CLASS="EMPHASIS"
14746 >SECURITY = DOMAIN
14747                 </I
14748 ></P
14749 ><P
14750 >This mode will only work correctly if <A
14751 HREF="smbpasswd.8.html"
14752 TARGET="_top"
14753 >smbpasswd(8)</A
14754 > has been used to add this
14755                 machine into a Windows NT Domain. It expects the <A
14756 HREF="#ENCRYPTPASSWORDS"
14757 ><TT
14758 CLASS="PARAMETER"
14759 ><I
14760 >encrypted passwords</I
14761 ></TT
14762 >
14763                 </A
14764 > parameter to be set to <TT
14765 CLASS="CONSTANT"
14766 >true</TT
14767 >. In this
14768                 mode Samba will try to validate the username/password by passing
14769                 it to a Windows NT Primary or Backup Domain Controller, in exactly
14770                 the same way that a Windows NT Server would do.</P
14771 ><P
14772 ><I
14773 CLASS="EMPHASIS"
14774 >Note</I
14775 > that a valid UNIX user must still
14776                 exist as well as the account on the Domain Controller to allow
14777                 Samba to have a valid UNIX account to map file access to.</P
14778 ><P
14779 ><I
14780 CLASS="EMPHASIS"
14781 >Note</I
14782 > that from the clients point
14783                 of view <B
14784 CLASS="COMMAND"
14785 >security = domain</B
14786 > is the same as <B
14787 CLASS="COMMAND"
14788 >security = user
14789                 </B
14790 >. It only affects how the server deals with the authentication,
14791                 it does not in any way affect what the client sees.</P
14792 ><P
14793 ><I
14794 CLASS="EMPHASIS"
14795 >Note</I
14796 > that the name of the resource being
14797                 requested is <I
14798 CLASS="EMPHASIS"
14799 >not</I
14800 > sent to the server until after
14801                 the server has successfully authenticated the client. This is why
14802                 guest shares don't work in user level security without allowing
14803                 the server to automatically map unknown users into the <A
14804 HREF="#GUESTACCOUNT"
14805 ><TT
14806 CLASS="PARAMETER"
14807 ><I
14808 >guest account</I
14809 ></TT
14810 ></A
14811 >.
14812                 See the <A
14813 HREF="#MAPTOGUEST"
14814 ><TT
14815 CLASS="PARAMETER"
14816 ><I
14817 >map to guest</I
14818 ></TT
14819 >
14820                 </A
14821 > parameter for details on doing this.</P
14822 ><P
14823 ><I
14824 CLASS="EMPHASIS"
14825 >BUG:</I
14826 > There is currently a bug in the
14827                 implementation of <B
14828 CLASS="COMMAND"
14829 >security = domain</B
14830 > with respect
14831                 to multi-byte character set usernames. The communication with a
14832                 Domain Controller must be done in UNICODE and Samba currently
14833                 does not widen multi-byte user names to UNICODE correctly, thus
14834                 a multi-byte username will not be recognized correctly at the
14835                 Domain Controller. This issue will be addressed in a future release.</P
14836 ><P
14837 >See also the section <A
14838 HREF="#AEN234"
14839 >               NOTE ABOUT USERNAME/PASSWORD VALIDATION</A
14840 >.</P
14841 ><P
14842 >See also the <A
14843 HREF="#PASSWORDSERVER"
14844 ><TT
14845 CLASS="PARAMETER"
14846 ><I
14847 >password
14848                 server</I
14849 ></TT
14850 ></A
14851 > parameter and the <A
14852 HREF="#ENCRYPTPASSWORDS"
14853 ><TT
14854 CLASS="PARAMETER"
14855 ><I
14856 >encrypted passwords</I
14857 ></TT
14858 >
14859                 </A
14860 > parameter.</P
14861 ><P
14862 >Default: <B
14863 CLASS="COMMAND"
14864 >security = USER</B
14865 ></P
14866 ><P
14867 >Example: <B
14868 CLASS="COMMAND"
14869 >security = DOMAIN</B
14870 ></P
14871 ></DD
14872 ><DT
14873 ><A
14874 NAME="SECURITYMASK"
14875 ></A
14876 >security mask (S)</DT
14877 ><DD
14878 ><P
14879 >This parameter controls what UNIX permission
14880                 bits can be modified when a Windows NT client is manipulating
14881                 the UNIX permission on a file using the native NT security
14882                 dialog box.</P
14883 ><P
14884 >This parameter is applied as a mask (AND'ed with) to
14885                 the changed permission bits, thus preventing any bits not in
14886                 this mask from being modified. Essentially, zero bits in this
14887                 mask may be treated as a set of bits the user is not allowed
14888                 to change.</P
14889 ><P
14890 >If not set explicitly this parameter is set to the same
14891                 value as the <A
14892 HREF="#CREATEMASK"
14893 ><TT
14894 CLASS="PARAMETER"
14895 ><I
14896 >create mask
14897                 </I
14898 ></TT
14899 ></A
14900 > parameter. To allow a user to modify all the
14901                 user/group/world permissions on a file, set this parameter to
14902                 0777.</P
14903 ><P
14904 ><I
14905 CLASS="EMPHASIS"
14906 >Note</I
14907 > that users who can access the
14908                 Samba server through other means can easily bypass this
14909                 restriction, so it is primarily useful for standalone
14910                 "appliance" systems.  Administrators of most normal systems will
14911                 probably want to set it to 0777.</P
14912 ><P
14913 >See also the <A
14914 HREF="#FORCEDIRECTORYSECURITYMODE"
14915 >               <TT
14916 CLASS="PARAMETER"
14917 ><I
14918 >force directory security mode</I
14919 ></TT
14920 ></A
14921 >,
14922                 <A
14923 HREF="#DIRECTORYSECURITYMASK"
14924 ><TT
14925 CLASS="PARAMETER"
14926 ><I
14927 >directory
14928                 security mask</I
14929 ></TT
14930 ></A
14931 >, <A
14932 HREF="#FORCESECURITYMODE"
14933 >               <TT
14934 CLASS="PARAMETER"
14935 ><I
14936 >force security mode</I
14937 ></TT
14938 ></A
14939 > parameters.</P
14940 ><P
14941 >Default: <B
14942 CLASS="COMMAND"
14943 >security mask = &lt;same as create mask&gt;
14944                 </B
14945 ></P
14946 ><P
14947 >Example: <B
14948 CLASS="COMMAND"
14949 >security mask = 0777</B
14950 ></P
14951 ></DD
14952 ><DT
14953 ><A
14954 NAME="SERVERSTRING"
14955 ></A
14956 >server string (G)</DT
14957 ><DD
14958 ><P
14959 >This controls what string will show up in the
14960                 printer comment box in print manager and next to the IPC connection
14961                 in <B
14962 CLASS="COMMAND"
14963 >net view"</B
14964 >. It can be any string that you wish
14965                 to show to your users.</P
14966 ><P
14967 >It also sets what will appear in browse lists next
14968                 to the machine name.</P
14969 ><P
14970 >A <TT
14971 CLASS="PARAMETER"
14972 ><I
14973 >%v</I
14974 ></TT
14975 > will be replaced with the Samba
14976                 version number.</P
14977 ><P
14978 >A <TT
14979 CLASS="PARAMETER"
14980 ><I
14981 >%h</I
14982 ></TT
14983 > will be replaced with the
14984                 hostname.</P
14985 ><P
14986 >Default: <B
14987 CLASS="COMMAND"
14988 >server string = Samba %v</B
14989 ></P
14990 ><P
14991 >Example: <B
14992 CLASS="COMMAND"
14993 >server string = University of GNUs Samba
14994                 Server</B
14995 ></P
14996 ></DD
14997 ><DT
14998 ><A
14999 NAME="SETDIRECTORY"
15000 ></A
15001 >set directory (S)</DT
15002 ><DD
15003 ><P
15004 >If <B
15005 CLASS="COMMAND"
15006 >set directory = no</B
15007 >, then
15008                 users of the service may not use the setdir command to change
15009                 directory.</P
15010 ><P
15011 >The <B
15012 CLASS="COMMAND"
15013 >setdir</B
15014 > command is only implemented
15015                 in the Digital Pathworks client. See the Pathworks documentation
15016                 for details.</P
15017 ><P
15018 >Default: <B
15019 CLASS="COMMAND"
15020 >set directory = no</B
15021 ></P
15022 ></DD
15023 ><DT
15024 ><A
15025 NAME="SHAREMODES"
15026 ></A
15027 >share modes (S)</DT
15028 ><DD
15029 ><P
15030 >This enables or disables the honoring of
15031                 the <TT
15032 CLASS="PARAMETER"
15033 ><I
15034 >share modes</I
15035 ></TT
15036 > during a file open. These
15037                 modes are used by clients to gain exclusive read or write access
15038                 to a file.</P
15039 ><P
15040 >These open modes are not directly supported by UNIX, so
15041                 they are simulated using shared memory, or lock files if your
15042                 UNIX doesn't support shared memory (almost all do).</P
15043 ><P
15044 >The share modes that are enabled by this option are
15045                 <TT
15046 CLASS="CONSTANT"
15047 >DENY_DOS</TT
15048 >, <TT
15049 CLASS="CONSTANT"
15050 >DENY_ALL</TT
15051 >,
15052                 <TT
15053 CLASS="CONSTANT"
15054 >DENY_READ</TT
15055 >, <TT
15056 CLASS="CONSTANT"
15057 >DENY_WRITE</TT
15058 >,
15059                 <TT
15060 CLASS="CONSTANT"
15061 >DENY_NONE</TT
15062 > and <TT
15063 CLASS="CONSTANT"
15064 >DENY_FCB</TT
15065 >.
15066                 </P
15067 ><P
15068 >This option gives full share compatibility and enabled
15069                 by default.</P
15070 ><P
15071 >You should <I
15072 CLASS="EMPHASIS"
15073 >NEVER</I
15074 > turn this parameter
15075                 off as many Windows applications will break if you do so.</P
15076 ><P
15077 >Default: <B
15078 CLASS="COMMAND"
15079 >share modes = yes</B
15080 ></P
15081 ></DD
15082 ><DT
15083 ><A
15084 NAME="SHORTPRESERVECASE"
15085 ></A
15086 >short preserve case (S)</DT
15087 ><DD
15088 ><P
15089 >This boolean parameter controls if new files
15090                 which conform to 8.3 syntax, that is all in upper case and of
15091                 suitable length, are created upper case, or if they are forced
15092                 to be the <A
15093 HREF="#DEFAULTCASE"
15094 ><TT
15095 CLASS="PARAMETER"
15096 ><I
15097 >default case
15098                 </I
15099 ></TT
15100 ></A
15101 >. This  option can be use with <A
15102 HREF="#PRESERVECASE"
15103 ><B
15104 CLASS="COMMAND"
15105 >preserve case = yes</B
15106 >
15107                 </A
15108 > to permit long filenames to retain their case, while short
15109                 names are lowered. </P
15110 ><P
15111 >See the section on <A
15112 HREF="#AEN201"
15113 >               NAME MANGLING</A
15114 >.</P
15115 ><P
15116 >Default: <B
15117 CLASS="COMMAND"
15118 >short preserve case = yes</B
15119 ></P
15120 ></DD
15121 ><DT
15122 ><A
15123 NAME="SHOWADDPRINTERWIZARD"
15124 ></A
15125 >show add printer wizard (G)</DT
15126 ><DD
15127 ><P
15128 >With the introduction of MS-RPC based printing support
15129                 for Windows NT/2000 client in Samba 2.2, a "Printers..." folder will
15130                 appear on Samba hosts in the share listing.  Normally this folder will
15131                 contain an icon for the MS Add Printer Wizard (APW).  However, it is
15132                 possible to disable this feature regardless of the level of privilege
15133                 of the connected user.</P
15134 ><P
15135 >Under normal circumstances, the Windows NT/2000 client will
15136                 open a handle on the printer server with OpenPrinterEx() asking for
15137                 Administrator privileges.  If the user does not have administrative
15138                 access on the print server (i.e is not root or a member of the
15139                 <TT
15140 CLASS="PARAMETER"
15141 ><I
15142 >printer admin</I
15143 ></TT
15144 > group), the OpenPrinterEx()
15145                 call fails and the clients another open call with a request for
15146                 a lower privilege level.  This should succeed, however the APW
15147                 icon will not be displayed.</P
15148 ><P
15149 >Disabling the <TT
15150 CLASS="PARAMETER"
15151 ><I
15152 >show add printer wizard</I
15153 ></TT
15154 >
15155                 parameter will always cause the OpenPrinterEx() on the server
15156                 to fail.  Thus the APW icon will never be displayed. <I
15157 CLASS="EMPHASIS"
15158 >               Note :</I
15159 >This does not prevent the same user from having
15160                 administrative privilege on an individual printer.</P
15161 ><P
15162 >See also <A
15163 HREF="#ADDPRINTERCOMMAND"
15164 ><TT
15165 CLASS="PARAMETER"
15166 ><I
15167 >addprinter
15168                 command</I
15169 ></TT
15170 ></A
15171 >, <A
15172 HREF="#DELETEPRINTERCOMMAND"
15173 >               <TT
15174 CLASS="PARAMETER"
15175 ><I
15176 >deleteprinter command</I
15177 ></TT
15178 ></A
15179 >, <A
15180 HREF="#PRINTERADMIN"
15181 ><TT
15182 CLASS="PARAMETER"
15183 ><I
15184 >printer admin</I
15185 ></TT
15186 ></A
15187 ></P
15188 ><P
15189 >Default :<B
15190 CLASS="COMMAND"
15191 >show add printer wizard = yes</B
15192 ></P
15193 ></DD
15194 ><DT
15195 ><A
15196 NAME="SMBPASSWDFILE"
15197 ></A
15198 >smb passwd file (G)</DT
15199 ><DD
15200 ><P
15201 >This option sets the path to the encrypted
15202                 smbpasswd file.  By default the path to the smbpasswd file
15203                 is compiled into Samba.</P
15204 ><P
15205 >Default: <B
15206 CLASS="COMMAND"
15207 >smb passwd file = ${prefix}/private/smbpasswd
15208                 </B
15209 ></P
15210 ><P
15211 >Example: <B
15212 CLASS="COMMAND"
15213 >smb passwd file = /etc/samba/smbpasswd
15214                 </B
15215 ></P
15216 ></DD
15217 ><DT
15218 ><A
15219 NAME="SOCKETADDRESS"
15220 ></A
15221 >socket address (G)</DT
15222 ><DD
15223 ><P
15224 >This option allows you to control what
15225                 address Samba will listen for connections on. This is used to
15226                 support multiple virtual interfaces on the one server, each
15227                 with a different configuration.</P
15228 ><P
15229 >By default samba will accept connections on any
15230                 address.</P
15231 ><P
15232 >Example: <B
15233 CLASS="COMMAND"
15234 >socket address = 192.168.2.20</B
15235 >
15236                 </P
15237 ></DD
15238 ><DT
15239 ><A
15240 NAME="SOCKETOPTIONS"
15241 ></A
15242 >socket options (G)</DT
15243 ><DD
15244 ><P
15245 >This option allows you to set socket options
15246                 to be used when talking with the client.</P
15247 ><P
15248 >Socket options are controls on the networking layer
15249                 of the operating systems which allow the connection to be
15250                 tuned.</P
15251 ><P
15252 >This option will typically be used to tune your Samba
15253                 server for optimal performance for your local network. There is
15254                 no way that Samba can know what the optimal parameters are for
15255                 your net, so you must experiment and choose them yourself. We
15256                 strongly suggest you read the appropriate documentation for your
15257                 operating system first (perhaps <B
15258 CLASS="COMMAND"
15259 >man setsockopt</B
15260 >
15261                 will help).</P
15262 ><P
15263 >You may find that on some systems Samba will say
15264                 "Unknown socket option" when you supply an option. This means you
15265                 either incorrectly  typed it or you need to add an include file
15266                 to includes.h for your OS.  If the latter is the case please
15267                 send the patch to <A
15268 HREF="mailto:samba@samba.org"
15269 TARGET="_top"
15270 >               samba@samba.org</A
15271 >.</P
15272 ><P
15273 >Any of the supported socket options may be combined
15274                 in any way you like, as long as your OS allows it.</P
15275 ><P
15276 >This is the list of socket options currently settable
15277                 using this option:</P
15278 ><P
15279 ></P
15280 ><UL
15281 ><LI
15282 ><P
15283 >SO_KEEPALIVE</P
15284 ></LI
15285 ><LI
15286 ><P
15287 >SO_REUSEADDR</P
15288 ></LI
15289 ><LI
15290 ><P
15291 >SO_BROADCAST</P
15292 ></LI
15293 ><LI
15294 ><P
15295 >TCP_NODELAY</P
15296 ></LI
15297 ><LI
15298 ><P
15299 >IPTOS_LOWDELAY</P
15300 ></LI
15301 ><LI
15302 ><P
15303 >IPTOS_THROUGHPUT</P
15304 ></LI
15305 ><LI
15306 ><P
15307 >SO_SNDBUF *</P
15308 ></LI
15309 ><LI
15310 ><P
15311 >SO_RCVBUF *</P
15312 ></LI
15313 ><LI
15314 ><P
15315 >SO_SNDLOWAT *</P
15316 ></LI
15317 ><LI
15318 ><P
15319 >SO_RCVLOWAT *</P
15320 ></LI
15321 ></UL
15322 ><P
15323 >Those marked with a <I
15324 CLASS="EMPHASIS"
15325 >'*'</I
15326 > take an integer
15327                 argument. The others can optionally take a 1 or 0 argument to enable
15328                 or disable the option, by default they will be enabled if you
15329                 don't specify 1 or 0.</P
15330 ><P
15331 >To specify an argument use the syntax SOME_OPTION=VALUE
15332                 for example <B
15333 CLASS="COMMAND"
15334 >SO_SNDBUF=8192</B
15335 >. Note that you must
15336                 not have any spaces before or after the = sign.</P
15337 ><P
15338 >If you are on a local network then a sensible option
15339                 might be</P
15340 ><P
15341 ><B
15342 CLASS="COMMAND"
15343 >socket options = IPTOS_LOWDELAY</B
15344 ></P
15345 ><P
15346 >If you have a local network then you could try:</P
15347 ><P
15348 ><B
15349 CLASS="COMMAND"
15350 >socket options = IPTOS_LOWDELAY TCP_NODELAY</B
15351 ></P
15352 ><P
15353 >If you are on a wide area network then perhaps try
15354                 setting IPTOS_THROUGHPUT. </P
15355 ><P
15356 >Note that several of the options may cause your Samba
15357                 server to fail completely. Use these options with caution!</P
15358 ><P
15359 >Default: <B
15360 CLASS="COMMAND"
15361 >socket options = TCP_NODELAY</B
15362 ></P
15363 ><P
15364 >Example: <B
15365 CLASS="COMMAND"
15366 >socket options = IPTOS_LOWDELAY</B
15367 ></P
15368 ></DD
15369 ><DT
15370 ><A
15371 NAME="SOURCEENVIRONMENT"
15372 ></A
15373 >source environment (G)</DT
15374 ><DD
15375 ><P
15376 >This parameter causes Samba to set environment
15377                 variables as per the content of the file named.</P
15378 ><P
15379 >If the value of this parameter starts with a "|" character
15380                 then Samba will treat that value as a pipe command to open and
15381                 will set the environment variables from the output of the pipe.</P
15382 ><P
15383 >The contents of the file or the output of the pipe should
15384                 be formatted as the output of the standard Unix <B
15385 CLASS="COMMAND"
15386 >env(1)
15387                 </B
15388 > command. This is of the form :</P
15389 ><P
15390 >Example environment entry:</P
15391 ><P
15392 ><B
15393 CLASS="COMMAND"
15394 >SAMBA_NETBIOS_NAME=myhostname</B
15395 ></P
15396 ><P
15397 >Default: <I
15398 CLASS="EMPHASIS"
15399 >No default value</I
15400 ></P
15401 ><P
15402 >Examples: <B
15403 CLASS="COMMAND"
15404 >source environment = |/etc/smb.conf.sh
15405                 </B
15406 ></P
15407 ><P
15408 >Example: <B
15409 CLASS="COMMAND"
15410 >source environment =
15411                 /usr/local/smb_env_vars</B
15412 ></P
15413 ></DD
15414 ><DT
15415 ><A
15416 NAME="SSL"
15417 ></A
15418 >ssl (G)</DT
15419 ><DD
15420 ><P
15421 >This variable is part of SSL-enabled Samba. This
15422                 is only available if the SSL libraries have been compiled on your
15423                 system and the configure option <B
15424 CLASS="COMMAND"
15425 >--with-ssl</B
15426 > was
15427                 given at configure time.</P
15428 ><P
15429 ><I
15430 CLASS="EMPHASIS"
15431 >Note</I
15432 > that for export control reasons
15433                 this code is <I
15434 CLASS="EMPHASIS"
15435 >NOT</I
15436 > enabled by default in any
15437                 current binary version of Samba.</P
15438 ><P
15439 >This variable enables or disables the entire SSL mode. If
15440                 it is set to <TT
15441 CLASS="CONSTANT"
15442 >no</TT
15443 >, the SSL enabled samba behaves
15444                 exactly like the non-SSL samba. If set to <TT
15445 CLASS="CONSTANT"
15446 >yes</TT
15447 >,
15448                 it depends on the variables <A
15449 HREF="#SSLHOSTS"
15450 ><TT
15451 CLASS="PARAMETER"
15452 ><I
15453 >               ssl hosts</I
15454 ></TT
15455 ></A
15456 > and <A
15457 HREF="#SSLHOSTSRESIGN"
15458 >               <TT
15459 CLASS="PARAMETER"
15460 ><I
15461 >ssl hosts resign</I
15462 ></TT
15463 ></A
15464 > whether an SSL
15465                 connection will be required.</P
15466 ><P
15467 >Default: <B
15468 CLASS="COMMAND"
15469 >ssl=no</B
15470 ></P
15471 ></DD
15472 ><DT
15473 ><A
15474 NAME="SSLCACERTDIR"
15475 ></A
15476 >ssl CA certDir (G)</DT
15477 ><DD
15478 ><P
15479 >This variable is part of SSL-enabled Samba. This
15480                 is only available if the SSL libraries have been compiled on your
15481                 system and the configure option <B
15482 CLASS="COMMAND"
15483 >--with-ssl</B
15484 > was
15485                 given at configure time.</P
15486 ><P
15487 ><I
15488 CLASS="EMPHASIS"
15489 >Note</I
15490 > that for export control reasons
15491                 this code is <I
15492 CLASS="EMPHASIS"
15493 >NOT</I
15494 > enabled by default in any
15495                 current binary version of Samba.</P
15496 ><P
15497 >This variable defines where to look up the Certification
15498                 Authorities. The given directory should contain one file for
15499                 each CA that samba will trust.  The file name must be the hash
15500                 value over the "Distinguished Name" of the CA. How this directory
15501                 is set up is explained later in this document. All files within the
15502                 directory that don't fit into this naming scheme are ignored. You
15503                 don't need this variable if you don't verify client certificates.</P
15504 ><P
15505 >Default: <B
15506 CLASS="COMMAND"
15507 >ssl CA certDir = /usr/local/ssl/certs
15508                 </B
15509 ></P
15510 ></DD
15511 ><DT
15512 ><A
15513 NAME="SSLCACERTFILE"
15514 ></A
15515 >ssl CA certFile (G)</DT
15516 ><DD
15517 ><P
15518 >This variable is part of SSL-enabled Samba. This
15519                 is only available if the SSL libraries have been compiled on your
15520                 system and the configure option <B
15521 CLASS="COMMAND"
15522 >--with-ssl</B
15523 > was
15524                 given at configure time.</P
15525 ><P
15526 ><I
15527 CLASS="EMPHASIS"
15528 >Note</I
15529 > that for export control reasons
15530                 this code is <I
15531 CLASS="EMPHASIS"
15532 >NOT</I
15533 > enabled by default in any
15534                 current binary version of Samba.</P
15535 ><P
15536 >This variable is a second way to define the trusted CAs.
15537                 The certificates of the trusted CAs are collected in one big
15538                 file and this variable points to the file. You will probably
15539                 only use one of the two ways to define your CAs. The first choice is
15540                 preferable if you have many CAs or want to be flexible, the second
15541                 is preferable if you only have one CA and want to keep things
15542                 simple (you won't need to create the hashed file names). You
15543                 don't need this variable if you don't verify client certificates.</P
15544 ><P
15545 >Default: <B
15546 CLASS="COMMAND"
15547 >ssl CA certFile = /usr/local/ssl/certs/trustedCAs.pem
15548                 </B
15549 ></P
15550 ></DD
15551 ><DT
15552 ><A
15553 NAME="SSLCIPHERS"
15554 ></A
15555 >ssl ciphers (G)</DT
15556 ><DD
15557 ><P
15558 >This variable is part of SSL-enabled Samba. This
15559                 is only available if the SSL libraries have been compiled on your
15560                 system and the configure option <B
15561 CLASS="COMMAND"
15562 >--with-ssl</B
15563 > was
15564                 given at configure time.</P
15565 ><P
15566 ><I
15567 CLASS="EMPHASIS"
15568 >Note</I
15569 > that for export control reasons
15570                 this code is <I
15571 CLASS="EMPHASIS"
15572 >NOT</I
15573 > enabled by default in any
15574                 current binary version of Samba.</P
15575 ><P
15576 >This variable defines the ciphers that should be offered
15577                 during SSL negotiation. You should not set this variable unless
15578                 you know what you are doing.</P
15579 ></DD
15580 ><DT
15581 ><A
15582 NAME="SSLCLIENTCERT"
15583 ></A
15584 >ssl client cert (G)</DT
15585 ><DD
15586 ><P
15587 >This variable is part of SSL-enabled Samba. This
15588                 is only available if the SSL libraries have been compiled on your
15589                 system and the configure option <B
15590 CLASS="COMMAND"
15591 >--with-ssl</B
15592 > was
15593                 given at configure time.</P
15594 ><P
15595 ><I
15596 CLASS="EMPHASIS"
15597 >Note</I
15598 > that for export control reasons
15599                 this code is <I
15600 CLASS="EMPHASIS"
15601 >NOT</I
15602 > enabled by default in any
15603                 current binary version of Samba.</P
15604 ><P
15605 >The certificate in this file is used by <A
15606 HREF="smbclient.1.html"
15607 TARGET="_top"
15608 >               <B
15609 CLASS="COMMAND"
15610 >smbclient(1)</B
15611 ></A
15612 > if it exists. It's needed
15613                 if the server requires a client certificate.</P
15614 ><P
15615 >Default: <B
15616 CLASS="COMMAND"
15617 >ssl client cert = /usr/local/ssl/certs/smbclient.pem
15618                 </B
15619 ></P
15620 ></DD
15621 ><DT
15622 ><A
15623 NAME="SSLCLIENTKEY"
15624 ></A
15625 >ssl client key (G)</DT
15626 ><DD
15627 ><P
15628 >This variable is part of SSL-enabled Samba. This
15629                 is only available if the SSL libraries have been compiled on your
15630                 system and the configure option <B
15631 CLASS="COMMAND"
15632 >--with-ssl</B
15633 > was
15634                 given at configure time.</P
15635 ><P
15636 ><I
15637 CLASS="EMPHASIS"
15638 >Note</I
15639 > that for export control reasons
15640                 this code is <I
15641 CLASS="EMPHASIS"
15642 >NOT</I
15643 > enabled by default in any
15644                 current binary version of Samba.</P
15645 ><P
15646 >This is the private key for <A
15647 HREF="smbclient.1.html"
15648 TARGET="_top"
15649 >               <B
15650 CLASS="COMMAND"
15651 >smbclient(1)</B
15652 ></A
15653 >. It's only needed if the
15654                 client should have a certificate. </P
15655 ><P
15656 >Default: <B
15657 CLASS="COMMAND"
15658 >ssl client key = /usr/local/ssl/private/smbclient.pem
15659                 </B
15660 ></P
15661 ></DD
15662 ><DT
15663 ><A
15664 NAME="SSLCOMPATIBILITY"
15665 ></A
15666 >ssl compatibility (G)</DT
15667 ><DD
15668 ><P
15669 >This variable is part of SSL-enabled Samba. This
15670                 is only available if the SSL libraries have been compiled on your
15671                 system and the configure option <B
15672 CLASS="COMMAND"
15673 >--with-ssl</B
15674 > was
15675                 given at configure time.</P
15676 ><P
15677 ><I
15678 CLASS="EMPHASIS"
15679 >Note</I
15680 > that for export control reasons
15681                 this code is <I
15682 CLASS="EMPHASIS"
15683 >NOT</I
15684 > enabled by default in any
15685                 current binary version of Samba.</P
15686 ><P
15687 >This variable defines whether SSLeay should be configured
15688                 for bug compatibility with other SSL implementations. This is
15689                 probably not desirable because currently no clients with SSL
15690                 implementations other than SSLeay exist.</P
15691 ><P
15692 >Default: <B
15693 CLASS="COMMAND"
15694 >ssl compatibility = no</B
15695 ></P
15696 ></DD
15697 ><DT
15698 ><A
15699 NAME="SSLHOSTS"
15700 ></A
15701 >ssl hosts (G)</DT
15702 ><DD
15703 ><P
15704 >See <A
15705 HREF="#SSLHOSTSRESIGN"
15706 ><TT
15707 CLASS="PARAMETER"
15708 ><I
15709 >               ssl hosts resign</I
15710 ></TT
15711 ></A
15712 >.</P
15713 ></DD
15714 ><DT
15715 ><A
15716 NAME="SSLHOSTSRESIGN"
15717 ></A
15718 >ssl hosts resign (G)</DT
15719 ><DD
15720 ><P
15721 >This variable is part of SSL-enabled Samba. This
15722                 is only available if the SSL libraries have been compiled on your
15723                 system and the configure option <B
15724 CLASS="COMMAND"
15725 >--with-ssl</B
15726 > was
15727                 given at configure time.</P
15728 ><P
15729 ><I
15730 CLASS="EMPHASIS"
15731 >Note</I
15732 > that for export control reasons
15733                 this code is <I
15734 CLASS="EMPHASIS"
15735 >NOT</I
15736 > enabled by default in any
15737                 current binary version of Samba.</P
15738 ><P
15739 >These two variables define whether samba will go
15740                 into SSL mode or not. If none of them is defined, samba will
15741                 allow only SSL connections. If the <A
15742 HREF="#SSLHOSTS"
15743 >               <TT
15744 CLASS="PARAMETER"
15745 ><I
15746 >ssl hosts</I
15747 ></TT
15748 ></A
15749 > variable lists
15750                 hosts (by IP-address, IP-address range, net group or name),
15751                 only these hosts will be forced into SSL mode. If the <TT
15752 CLASS="PARAMETER"
15753 ><I
15754 >               ssl hosts resign</I
15755 ></TT
15756 > variable lists hosts, only these
15757                 hosts will NOT be forced into SSL mode. The syntax for these two
15758                 variables is the same as for the <A
15759 HREF="#HOSTSALLOW"
15760 ><TT
15761 CLASS="PARAMETER"
15762 ><I
15763 >               hosts allow</I
15764 ></TT
15765 ></A
15766 > and <A
15767 HREF="#HOSTSDENY"
15768 >               <TT
15769 CLASS="PARAMETER"
15770 ><I
15771 >hosts deny</I
15772 ></TT
15773 ></A
15774 > pair of variables, only
15775                 that the subject of the decision is different: It's not the access
15776                 right but whether SSL is used or not. </P
15777 ><P
15778 >The example below requires SSL connections from all hosts
15779                 outside the local net (which is 192.168.*.*).</P
15780 ><P
15781 >Default: <B
15782 CLASS="COMMAND"
15783 >ssl hosts = &lt;empty string&gt;</B
15784 ></P
15785 ><P
15786 ><B
15787 CLASS="COMMAND"
15788 >ssl hosts resign = &lt;empty string&gt;</B
15789 ></P
15790 ><P
15791 >Example: <B
15792 CLASS="COMMAND"
15793 >ssl hosts resign = 192.168.</B
15794 ></P
15795 ></DD
15796 ><DT
15797 ><A
15798 NAME="SSLREQUIRECLIENTCERT"
15799 ></A
15800 >ssl require clientcert (G)</DT
15801 ><DD
15802 ><P
15803 >This variable is part of SSL-enabled Samba. This
15804                 is only available if the SSL libraries have been compiled on your
15805                 system and the configure option <B
15806 CLASS="COMMAND"
15807 >--with-ssl</B
15808 > was
15809                 given at configure time.</P
15810 ><P
15811 ><I
15812 CLASS="EMPHASIS"
15813 >Note</I
15814 > that for export control reasons
15815                 this code is <I
15816 CLASS="EMPHASIS"
15817 >NOT</I
15818 > enabled by default in any
15819                 current binary version of Samba.</P
15820 ><P
15821 >If this variable is set to <TT
15822 CLASS="CONSTANT"
15823 >yes</TT
15824 >, the
15825                 server will not tolerate connections from clients that don't
15826                 have a valid certificate. The directory/file given in <A
15827 HREF="#SSLCACERTDIR"
15828 ><TT
15829 CLASS="PARAMETER"
15830 ><I
15831 >ssl CA certDir</I
15832 ></TT
15833 >
15834                 </A
15835 > and <A
15836 HREF="#SSLCACERTFILE"
15837 ><TT
15838 CLASS="PARAMETER"
15839 ><I
15840 >ssl CA certFile
15841                 </I
15842 ></TT
15843 ></A
15844 > will be used to look up the CAs that issued
15845                 the client's certificate. If the certificate can't be verified
15846                 positively, the connection will be terminated.  If this variable
15847                 is set to <TT
15848 CLASS="CONSTANT"
15849 >no</TT
15850 >, clients don't need certificates.
15851                 Contrary to web applications you really <I
15852 CLASS="EMPHASIS"
15853 >should</I
15854 >
15855                 require client certificates. In the web environment the client's
15856                 data is sensitive (credit card numbers) and the server must prove
15857                 to be trustworthy. In a file server environment the server's data
15858                 will be sensitive and the clients must prove to be trustworthy.</P
15859 ><P
15860 >Default: <B
15861 CLASS="COMMAND"
15862 >ssl require clientcert = no</B
15863 ></P
15864 ></DD
15865 ><DT
15866 ><A
15867 NAME="SSLREQUIRESERVERCERT"
15868 ></A
15869 >ssl require servercert (G)</DT
15870 ><DD
15871 ><P
15872 >This variable is part of SSL-enabled Samba. This
15873                 is only available if the SSL libraries have been compiled on your
15874                 system and the configure option <B
15875 CLASS="COMMAND"
15876 >--with-ssl</B
15877 > was
15878                 given at configure time.</P
15879 ><P
15880 ><I
15881 CLASS="EMPHASIS"
15882 >Note</I
15883 > that for export control reasons
15884                 this code is <I
15885 CLASS="EMPHASIS"
15886 >NOT</I
15887 > enabled by default in any
15888                 current binary version of Samba.</P
15889 ><P
15890 >If this variable is set to <TT
15891 CLASS="CONSTANT"
15892 >yes</TT
15893 >, the
15894                 <A
15895 HREF="smbclient.1.html"
15896 TARGET="_top"
15897 ><B
15898 CLASS="COMMAND"
15899 >smbclient(1)</B
15900 >
15901                 </A
15902 > will request a certificate from the server. Same as
15903                 <A
15904 HREF="#SSLREQUIRECLIENTCERT"
15905 ><TT
15906 CLASS="PARAMETER"
15907 ><I
15908 >ssl require
15909                 clientcert</I
15910 ></TT
15911 ></A
15912 > for the server.</P
15913 ><P
15914 >Default: <B
15915 CLASS="COMMAND"
15916 >ssl require servercert = no</B
15917 >
15918                 </P
15919 ></DD
15920 ><DT
15921 ><A
15922 NAME="SSLSERVERCERT"
15923 ></A
15924 >ssl server cert (G)</DT
15925 ><DD
15926 ><P
15927 >This variable is part of SSL-enabled Samba. This
15928                 is only available if the SSL libraries have been compiled on your
15929                 system and the configure option <B
15930 CLASS="COMMAND"
15931 >--with-ssl</B
15932 > was
15933                 given at configure time.</P
15934 ><P
15935 ><I
15936 CLASS="EMPHASIS"
15937 >Note</I
15938 > that for export control reasons
15939                 this code is <I
15940 CLASS="EMPHASIS"
15941 >NOT</I
15942 > enabled by default in any
15943                 current binary version of Samba.</P
15944 ><P
15945 >This is the file containing the server's certificate.
15946                 The server <I
15947 CLASS="EMPHASIS"
15948 >must</I
15949 > have a certificate. The
15950                 file may also contain the server's private key. See later for
15951                 how certificates and private keys are created.</P
15952 ><P
15953 >Default: <B
15954 CLASS="COMMAND"
15955 >ssl server cert = &lt;empty string&gt;
15956                 </B
15957 ></P
15958 ></DD
15959 ><DT
15960 ><A
15961 NAME="SSLSERVERKEY"
15962 ></A
15963 >ssl server key (G)</DT
15964 ><DD
15965 ><P
15966 >This variable is part of SSL-enabled Samba. This
15967                 is only available if the SSL libraries have been compiled on your
15968                 system and the configure option <B
15969 CLASS="COMMAND"
15970 >--with-ssl</B
15971 > was
15972                 given at configure time.</P
15973 ><P
15974 ><I
15975 CLASS="EMPHASIS"
15976 >Note</I
15977 > that for export control reasons
15978                 this code is <I
15979 CLASS="EMPHASIS"
15980 >NOT</I
15981 > enabled by default in any
15982                 current binary version of Samba.</P
15983 ><P
15984 >This file contains the private key of the server. If
15985                 this variable is not defined, the key is looked up in the
15986                 certificate file (it may be appended to the certificate).
15987                 The server <I
15988 CLASS="EMPHASIS"
15989 >must</I
15990 > have a private key
15991                 and the certificate <I
15992 CLASS="EMPHASIS"
15993 >must</I
15994 >
15995                 match this private key.</P
15996 ><P
15997 >Default: <B
15998 CLASS="COMMAND"
15999 >ssl server key = &lt;empty string&gt;
16000                 </B
16001 ></P
16002 ></DD
16003 ><DT
16004 ><A
16005 NAME="SSLVERSION"
16006 ></A
16007 >ssl version (G)</DT
16008 ><DD
16009 ><P
16010 >This variable is part of SSL-enabled Samba. This
16011                 is only available if the SSL libraries have been compiled on your
16012                 system and the configure option <B
16013 CLASS="COMMAND"
16014 >--with-ssl</B
16015 > was
16016                 given at configure time.</P
16017 ><P
16018 ><I
16019 CLASS="EMPHASIS"
16020 >Note</I
16021 > that for export control reasons
16022                 this code is <I
16023 CLASS="EMPHASIS"
16024 >NOT</I
16025 > enabled by default in any
16026                 current binary version of Samba.</P
16027 ><P
16028 >This enumeration variable defines the versions of the
16029                 SSL protocol that will be used. <TT
16030 CLASS="CONSTANT"
16031 >ssl2or3</TT
16032 > allows
16033                 dynamic negotiation of SSL v2 or v3, <TT
16034 CLASS="CONSTANT"
16035 >ssl2</TT
16036 > results
16037                 in SSL v2, <TT
16038 CLASS="CONSTANT"
16039 >ssl3</TT
16040 > results in SSL v3 and
16041                 <TT
16042 CLASS="CONSTANT"
16043 >tls1</TT
16044 > results in TLS v1. TLS (Transport Layer
16045                 Security) is the new standard for SSL.</P
16046 ><P
16047 >Default: <B
16048 CLASS="COMMAND"
16049 >ssl version = "ssl2or3"</B
16050 ></P
16051 ></DD
16052 ><DT
16053 ><A
16054 NAME="STATCACHE"
16055 ></A
16056 >stat cache (G)</DT
16057 ><DD
16058 ><P
16059 >This parameter determines if <A
16060 HREF="smbd.8.html"
16061 TARGET="_top"
16062 >smbd(8)</A
16063 > will use a cache in order to
16064                 speed up case insensitive name mappings. You should never need
16065                 to change this parameter.</P
16066 ><P
16067 >Default: <B
16068 CLASS="COMMAND"
16069 >stat cache = yes</B
16070 ></P
16071 ></DD
16072 ><DT
16073 ><A
16074 NAME="STATCACHESIZE"
16075 ></A
16076 >stat cache size (G)</DT
16077 ><DD
16078 ><P
16079 >This parameter determines the number of
16080                 entries in the <TT
16081 CLASS="PARAMETER"
16082 ><I
16083 >stat cache</I
16084 ></TT
16085 >.  You should
16086                 never need to change this parameter.</P
16087 ><P
16088 >Default: <B
16089 CLASS="COMMAND"
16090 >stat cache size = 50</B
16091 ></P
16092 ></DD
16093 ><DT
16094 ><A
16095 NAME="STATUS"
16096 ></A
16097 >status (G)</DT
16098 ><DD
16099 ><P
16100 >This enables or disables logging of connections
16101                 to a status file that <A
16102 HREF="smbstatus.1.html"
16103 TARGET="_top"
16104 >smbstatus(1)</A
16105 >
16106                 can read.</P
16107 ><P
16108 >With this disabled <B
16109 CLASS="COMMAND"
16110 >smbstatus</B
16111 > won't be able
16112                 to tell you what connections are active. You should never need to
16113                 change this parameter.</P
16114 ><P
16115 >Default: <B
16116 CLASS="COMMAND"
16117 >status = yes</B
16118 ></P
16119 ></DD
16120 ><DT
16121 ><A
16122 NAME="STRICTLOCKING"
16123 ></A
16124 >strict locking (S)</DT
16125 ><DD
16126 ><P
16127 >This is a boolean that controls the handling of
16128                 file locking in the server. When this is set to <TT
16129 CLASS="CONSTANT"
16130 >yes</TT
16131 >
16132                 the server will check every read and write access for file locks, and
16133                 deny access if locks exist. This can be slow on some systems.</P
16134 ><P
16135 >When strict locking is <TT
16136 CLASS="CONSTANT"
16137 >no</TT
16138 > the server does file
16139                 lock checks only when the client explicitly asks for them.</P
16140 ><P
16141 >Well behaved clients always ask for lock checks when it
16142                 is important, so in the vast majority of cases <B
16143 CLASS="COMMAND"
16144 >strict
16145                 locking = no</B
16146 > is preferable.</P
16147 ><P
16148 >Default: <B
16149 CLASS="COMMAND"
16150 >strict locking = no</B
16151 ></P
16152 ></DD
16153 ><DT
16154 ><A
16155 NAME="STRICTSYNC"
16156 ></A
16157 >strict sync (S)</DT
16158 ><DD
16159 ><P
16160 >Many Windows applications (including the Windows
16161                 98 explorer shell) seem to confuse flushing buffer contents to
16162                 disk with doing a sync to disk. Under UNIX, a sync call forces
16163                 the process to be suspended until the kernel has ensured that
16164                 all outstanding data in kernel disk buffers has been safely stored
16165                 onto stable storage. This is very slow and should only be done
16166                 rarely. Setting this parameter to <TT
16167 CLASS="CONSTANT"
16168 >no</TT
16169 > (the
16170                 default) means that smbd ignores the Windows applications requests for
16171                 a sync call. There is only a possibility of losing data if the
16172                 operating system itself that Samba is running on crashes, so there is
16173                 little danger in this default setting. In addition, this fixes many
16174                 performance problems that people have reported with the new Windows98
16175                 explorer shell file copies.</P
16176 ><P
16177 >See also the <A
16178 HREF="#SYNCALWAYS"
16179 ><TT
16180 CLASS="PARAMETER"
16181 ><I
16182 >sync
16183                 always&#62;</I
16184 ></TT
16185 ></A
16186 > parameter.</P
16187 ><P
16188 >Default: <B
16189 CLASS="COMMAND"
16190 >strict sync = no</B
16191 ></P
16192 ></DD
16193 ><DT
16194 ><A
16195 NAME="STRIPDOT"
16196 ></A
16197 >strip dot (G)</DT
16198 ><DD
16199 ><P
16200 >This is a boolean that controls whether to
16201                 strip trailing dots off UNIX filenames. This helps with some
16202                 CDROMs that have filenames ending in a single dot.</P
16203 ><P
16204 >Default: <B
16205 CLASS="COMMAND"
16206 >strip dot = no</B
16207 ></P
16208 ></DD
16209 ><DT
16210 ><A
16211 NAME="SYNCALWAYS"
16212 ></A
16213 >sync always (S)</DT
16214 ><DD
16215 ><P
16216 >This is a boolean parameter that controls
16217                 whether writes will always be written to stable storage before
16218                 the write call returns. If this is false then the server will be
16219                 guided by the client's request in each write call (clients can
16220                 set a bit indicating that a particular write should be synchronous).
16221                 If this is true then every write will be followed by a <B
16222 CLASS="COMMAND"
16223 >fsync()
16224                 </B
16225 > call to ensure the data is written to disk. Note that
16226                 the <TT
16227 CLASS="PARAMETER"
16228 ><I
16229 >strict sync</I
16230 ></TT
16231 > parameter must be set to
16232                 <TT
16233 CLASS="CONSTANT"
16234 >yes</TT
16235 > in order for this parameter to have
16236                 any affect.</P
16237 ><P
16238 >See also the <A
16239 HREF="#STRICTSYNC"
16240 ><TT
16241 CLASS="PARAMETER"
16242 ><I
16243 >strict
16244                 sync</I
16245 ></TT
16246 ></A
16247 > parameter.</P
16248 ><P
16249 >Default: <B
16250 CLASS="COMMAND"
16251 >sync always = no</B
16252 ></P
16253 ></DD
16254 ><DT
16255 ><A
16256 NAME="SYSLOG"
16257 ></A
16258 >syslog (G)</DT
16259 ><DD
16260 ><P
16261 >This parameter maps how Samba debug messages
16262                 are logged onto the system syslog logging levels. Samba debug
16263                 level zero maps onto syslog <TT
16264 CLASS="CONSTANT"
16265 >LOG_ERR</TT
16266 >, debug
16267                 level one maps onto <TT
16268 CLASS="CONSTANT"
16269 >LOG_WARNING</TT
16270 >, debug level
16271                 two maps onto <TT
16272 CLASS="CONSTANT"
16273 >LOG_NOTICE</TT
16274 >, debug level three
16275                 maps onto LOG_INFO. All higher levels are mapped to <TT
16276 CLASS="CONSTANT"
16277 >               LOG_DEBUG</TT
16278 >.</P
16279 ><P
16280 >This parameter sets the threshold for sending messages
16281                 to syslog.  Only messages with debug level less than this value
16282                 will be sent to syslog.</P
16283 ><P
16284 >Default: <B
16285 CLASS="COMMAND"
16286 >syslog = 1</B
16287 ></P
16288 ></DD
16289 ><DT
16290 ><A
16291 NAME="SYSLOGONLY"
16292 ></A
16293 >syslog only (G)</DT
16294 ><DD
16295 ><P
16296 >If this parameter is set then Samba debug
16297                 messages are logged into the system syslog only, and not to
16298                 the debug log files.</P
16299 ><P
16300 >Default: <B
16301 CLASS="COMMAND"
16302 >syslog only = no</B
16303 ></P
16304 ></DD
16305 ><DT
16306 ><A
16307 NAME="TEMPLATEHOMEDIR"
16308 ></A
16309 >template homedir (G)</DT
16310 ><DD
16311 ><P
16312 ><I
16313 CLASS="EMPHASIS"
16314 >NOTE:</I
16315 > this parameter is
16316                 only available in Samba 3.0.</P
16317 ><P
16318 >When filling out the user information for a Windows NT
16319                 user, the <A
16320 HREF="winbindd.8.html"
16321 TARGET="_top"
16322 >winbindd(8)</A
16323 > daemon
16324                 uses this parameter to fill in the home directory for that user.
16325                 If the string <TT
16326 CLASS="PARAMETER"
16327 ><I
16328 >%D</I
16329 ></TT
16330 > is present it is substituted
16331                 with the user's Windows NT domain name.  If the string <TT
16332 CLASS="PARAMETER"
16333 ><I
16334 >%U
16335                 </I
16336 ></TT
16337 > is present it is substituted with the user's Windows
16338                 NT user name.</P
16339 ><P
16340 >Default: <B
16341 CLASS="COMMAND"
16342 >template homedir = /home/%D/%U</B
16343 ></P
16344 ></DD
16345 ><DT
16346 ><A
16347 NAME="TEMPLATESHELL"
16348 ></A
16349 >template shell (G)</DT
16350 ><DD
16351 ><P
16352 ><I
16353 CLASS="EMPHASIS"
16354 >NOTE:</I
16355 > this parameter is
16356                 only available in Samba 3.0.</P
16357 ><P
16358 >When filling out the user information for a Windows NT
16359                 user, the <A
16360 HREF="winbindd.8.html"
16361 TARGET="_top"
16362 >winbindd(8)</A
16363 > daemon
16364                 uses this parameter to fill in the login shell for that user.</P
16365 ><P
16366 >Default: <B
16367 CLASS="COMMAND"
16368 >template shell = /bin/false</B
16369 ></P
16370 ></DD
16371 ><DT
16372 ><A
16373 NAME="TIMEOFFSET"
16374 ></A
16375 >time offset (G)</DT
16376 ><DD
16377 ><P
16378 >This parameter is a setting in minutes to add
16379                 to the normal GMT to local time conversion. This is useful if
16380                 you are serving a lot of PCs that have incorrect daylight
16381                 saving time handling.</P
16382 ><P
16383 >Default: <B
16384 CLASS="COMMAND"
16385 >time offset = 0</B
16386 ></P
16387 ><P
16388 >Example: <B
16389 CLASS="COMMAND"
16390 >time offset = 60</B
16391 ></P
16392 ></DD
16393 ><DT
16394 ><A
16395 NAME="TIMESERVER"
16396 ></A
16397 >time server (G)</DT
16398 ><DD
16399 ><P
16400 >This parameter determines if <A
16401 HREF="nmbd.8.html"
16402 TARGET="_top"
16403 >
16404                 nmbd(8)</A
16405 > advertises itself as a time server to Windows
16406                 clients.</P
16407 ><P
16408 >Default: <B
16409 CLASS="COMMAND"
16410 >time server = no</B
16411 ></P
16412 ></DD
16413 ><DT
16414 ><A
16415 NAME="TIMESTAMPLOGS"
16416 ></A
16417 >timestamp logs (G)</DT
16418 ><DD
16419 ><P
16420 >Synonym for <A
16421 HREF="#DEBUGTIMESTAMP"
16422 ><TT
16423 CLASS="PARAMETER"
16424 ><I
16425 >               debug timestamp</I
16426 ></TT
16427 ></A
16428 >.</P
16429 ></DD
16430 ><DT
16431 ><A
16432 NAME="TOTALPRINTJOBS"
16433 ></A
16434 >total print jobs (G)</DT
16435 ><DD
16436 ><P
16437 >This parameter accepts an integer value which defines
16438                 a limit on the maximum number of print jobs that will be accepted
16439                 system wide at any given time.  If a print job is submitted
16440                 by a client which will exceed this number, then smbd will return an
16441                 error indicating that no space is available on the server.  The
16442                 default value of 0 means that no such limit exists.  This parameter
16443                 can be used to prevent a server from exceeding its capacity and is
16444                 designed as a printing throttle.  See also
16445                 <A
16446 HREF="#MAXPRINTJOBS"
16447 ><TT
16448 CLASS="PARAMETER"
16449 ><I
16450 >max print jobs</I
16451 ></TT
16452 ></A
16453 >.
16454                 </P
16455 ><P
16456 >Default: <B
16457 CLASS="COMMAND"
16458 >total print jobs = 0</B
16459 ></P
16460 ><P
16461 >Example: <B
16462 CLASS="COMMAND"
16463 >total print jobs = 5000</B
16464 ></P
16465 ></DD
16466 ><DT
16467 ><A
16468 NAME="UNIXPASSWORDSYNC"
16469 ></A
16470 >unix password sync (G)</DT
16471 ><DD
16472 ><P
16473 >This boolean parameter controls whether Samba
16474                 attempts to synchronize the UNIX password with the SMB password
16475                 when the encrypted SMB password in the smbpasswd file is changed.
16476                 If this is set to true the program specified in the <TT
16477 CLASS="PARAMETER"
16478 ><I
16479 >passwd
16480                 program</I
16481 ></TT
16482 >parameter is called <I
16483 CLASS="EMPHASIS"
16484 >AS ROOT</I
16485 > -
16486                 to allow the new UNIX password to be set without access to the
16487                 old UNIX password (as the SMB password has change code has no
16488                 access to the old password cleartext, only the new).</P
16489 ><P
16490 >See also <A
16491 HREF="#PASSWDPROGRAM"
16492 ><TT
16493 CLASS="PARAMETER"
16494 ><I
16495 >passwd
16496                 program</I
16497 ></TT
16498 ></A
16499 >, <A
16500 HREF="#PASSWDCHAT"
16501 ><TT
16502 CLASS="PARAMETER"
16503 ><I
16504 >               passwd chat</I
16505 ></TT
16506 ></A
16507 >.</P
16508 ><P
16509 >Default: <B
16510 CLASS="COMMAND"
16511 >unix password sync = no</B
16512 ></P
16513 ></DD
16514 ><DT
16515 ><A
16516 NAME="UPDATEENCRYPTED"
16517 ></A
16518 >update encrypted (G)</DT
16519 ><DD
16520 ><P
16521 >This boolean parameter allows a user logging
16522                 on with a plaintext password to have their encrypted (hashed)
16523                 password in the smbpasswd file to be updated automatically as
16524                 they log on. This option allows a site to migrate from plaintext
16525                 password authentication (users authenticate with plaintext
16526                 password over the wire, and are checked against a UNIX account
16527                 database) to encrypted password authentication (the SMB
16528                 challenge/response authentication mechanism) without forcing
16529                 all users to re-enter their passwords via smbpasswd at the time the
16530                 change is made. This is a convenience option to allow the change over
16531                 to encrypted passwords to be made over a longer period. Once all users
16532                 have encrypted representations of their passwords in the smbpasswd
16533                 file this parameter should be set to <TT
16534 CLASS="CONSTANT"
16535 >no</TT
16536 >.</P
16537 ><P
16538 >In order for this parameter to work correctly the <A
16539 HREF="#ENCRYPTPASSWORDS"
16540 ><TT
16541 CLASS="PARAMETER"
16542 ><I
16543 >encrypt passwords</I
16544 ></TT
16545 >
16546                 </A
16547 > parameter must be set to <TT
16548 CLASS="CONSTANT"
16549 >no</TT
16550 > when
16551                 this parameter is set to <TT
16552 CLASS="CONSTANT"
16553 >yes</TT
16554 >.</P
16555 ><P
16556 >Note that even when this parameter is set a user
16557                 authenticating to <B
16558 CLASS="COMMAND"
16559 >smbd</B
16560 > must still enter a valid
16561                 password in order to connect correctly, and to update their hashed
16562                 (smbpasswd) passwords.</P
16563 ><P
16564 >Default: <B
16565 CLASS="COMMAND"
16566 >update encrypted = no</B
16567 ></P
16568 ></DD
16569 ><DT
16570 ><A
16571 NAME="USERHOSTS"
16572 ></A
16573 >use rhosts (G)</DT
16574 ><DD
16575 ><P
16576 >If this global parameter is a true, it specifies
16577                 that the UNIX users <TT
16578 CLASS="FILENAME"
16579 >.rhosts</TT
16580 > file in their home directory
16581                 will be read to find the names of hosts and users who will be allowed
16582                 access without specifying a password.</P
16583 ><P
16584 ><I
16585 CLASS="EMPHASIS"
16586 >NOTE:</I
16587 > The use of <TT
16588 CLASS="PARAMETER"
16589 ><I
16590 >use rhosts
16591                 </I
16592 ></TT
16593 > can be a major security hole. This is because you are
16594                 trusting the PC to supply the correct username. It is very easy to
16595                 get a PC to supply a false username. I recommend that the <TT
16596 CLASS="PARAMETER"
16597 ><I
16598 >               use rhosts</I
16599 ></TT
16600 > option be only used if you really know what
16601                 you are doing.</P
16602 ><P
16603 >Default: <B
16604 CLASS="COMMAND"
16605 >use rhosts = no</B
16606 ></P
16607 ></DD
16608 ><DT
16609 ><A
16610 NAME="USER"
16611 ></A
16612 >user (S)</DT
16613 ><DD
16614 ><P
16615 >Synonym for <A
16616 HREF="#USERNAME"
16617 ><TT
16618 CLASS="PARAMETER"
16619 ><I
16620 >               username</I
16621 ></TT
16622 ></A
16623 >.</P
16624 ></DD
16625 ><DT
16626 ><A
16627 NAME="USERS"
16628 ></A
16629 >users (S)</DT
16630 ><DD
16631 ><P
16632 >Synonym for <A
16633 HREF="#USERNAME"
16634 ><TT
16635 CLASS="PARAMETER"
16636 ><I
16637 >               username</I
16638 ></TT
16639 ></A
16640 >.</P
16641 ></DD
16642 ><DT
16643 ><A
16644 NAME="USERNAME"
16645 ></A
16646 >username (S)</DT
16647 ><DD
16648 ><P
16649 >Multiple users may be specified in a comma-delimited
16650                 list, in which case the supplied password will be tested against
16651                 each username in turn (left to right).</P
16652 ><P
16653 >The <TT
16654 CLASS="PARAMETER"
16655 ><I
16656 >username</I
16657 ></TT
16658 > line is needed only when
16659                 the PC is unable to supply its own username. This is the case
16660                 for the COREPLUS protocol or where your users have different WfWg
16661                 usernames to UNIX usernames. In both these cases you may also be
16662                 better using the \\server\share%user syntax instead.</P
16663 ><P
16664 >The <TT
16665 CLASS="PARAMETER"
16666 ><I
16667 >username</I
16668 ></TT
16669 > line is not a great
16670                 solution in many cases as it means Samba will try to validate
16671                 the supplied password against each of the usernames in the
16672                 <TT
16673 CLASS="PARAMETER"
16674 ><I
16675 >username</I
16676 ></TT
16677 > line in turn. This is slow and
16678                 a bad idea for lots of users in case of duplicate passwords.
16679                 You may get timeouts or security breaches using this parameter
16680                 unwisely.</P
16681 ><P
16682 >Samba relies on the underlying UNIX security. This
16683                 parameter does not restrict who can login, it just offers hints
16684                 to the Samba server as to what usernames might correspond to the
16685                 supplied password. Users can login as whoever they please and
16686                 they will be able to do no more damage than if they started a
16687                 telnet session. The daemon runs as the user that they log in as,
16688                 so they cannot do anything that user cannot do.</P
16689 ><P
16690 >To restrict a service to a particular set of users you
16691                 can use the <A
16692 HREF="#VALIDUSERS"
16693 ><TT
16694 CLASS="PARAMETER"
16695 ><I
16696 >valid users
16697                 </I
16698 ></TT
16699 ></A
16700 > parameter.</P
16701 ><P
16702 >If any of the usernames begin with a '@' then the name
16703                 will be looked up first in the yp netgroups list (if Samba
16704                 is compiled with netgroup support), followed by a lookup in
16705                 the UNIX groups database and will expand to a list of all users
16706                 in the group of that name.</P
16707 ><P
16708 >If any of the usernames begin with a '+' then the name
16709                 will be looked up only in the UNIX groups database and will
16710                 expand to a list of all users in the group of that name.</P
16711 ><P
16712 >If any of the usernames begin with a '&#38;'then the name
16713                 will be looked up only in the yp netgroups database (if Samba
16714                 is compiled with netgroup support) and will expand to a list
16715                 of all users in the netgroup group of that name.</P
16716 ><P
16717 >Note that searching though a groups database can take
16718                 quite some time, and some clients may time out during the
16719                 search.</P
16720 ><P
16721 >See the section <A
16722 HREF="#AEN234"
16723 >NOTE ABOUT
16724                 USERNAME/PASSWORD VALIDATION</A
16725 > for more information on how
16726                 this parameter determines access to the services.</P
16727 ><P
16728 >Default: <B
16729 CLASS="COMMAND"
16730 >The guest account if a guest service,
16731                 else &lt;empty string&gt;.</B
16732 ></P
16733 ><P
16734 >Examples:<B
16735 CLASS="COMMAND"
16736 >username = fred, mary, jack, jane,
16737                 @users, @pcgroup</B
16738 ></P
16739 ></DD
16740 ><DT
16741 ><A
16742 NAME="USERNAMELEVEL"
16743 ></A
16744 >username level (G)</DT
16745 ><DD
16746 ><P
16747 >This option helps Samba to try and 'guess' at
16748                 the real UNIX username, as many DOS clients send an all-uppercase
16749                 username. By default Samba tries all lowercase, followed by the
16750                 username with the first letter capitalized, and fails if the
16751                 username is not found on the UNIX machine.</P
16752 ><P
16753 >If this parameter is set to non-zero the behavior changes.
16754                 This parameter is a number that specifies the number of uppercase
16755                 combinations to try while trying to determine the UNIX user name. The
16756                 higher the number the more combinations will be tried, but the slower
16757                 the discovery of usernames will be. Use this parameter when you have
16758                 strange usernames on your UNIX machine, such as <TT
16759 CLASS="CONSTANT"
16760 >AstrangeUser
16761                 </TT
16762 >.</P
16763 ><P
16764 >Default: <B
16765 CLASS="COMMAND"
16766 >username level = 0</B
16767 ></P
16768 ><P
16769 >Example: <B
16770 CLASS="COMMAND"
16771 >username level = 5</B
16772 ></P
16773 ></DD
16774 ><DT
16775 ><A
16776 NAME="USERNAMEMAP"
16777 ></A
16778 >username map (G)</DT
16779 ><DD
16780 ><P
16781 >This option allows you to specify a file containing
16782                 a mapping of usernames from the clients to the server. This can be
16783                 used for several purposes. The most common is to map usernames
16784                 that users use on DOS or Windows machines to those that the UNIX
16785                 box uses. The other is to map multiple users to a single username
16786                 so that they can more easily share files.</P
16787 ><P
16788 >The map file is parsed line by line. Each line should
16789                 contain a single UNIX username on the left then a '=' followed
16790                 by a list of usernames on the right. The list of usernames on the
16791                 right may contain names of the form @group in which case they
16792                 will match any UNIX username in that group. The special client
16793                 name '*' is a wildcard and matches any name. Each line of the
16794                 map file may be up to 1023 characters long.</P
16795 ><P
16796 >The file is processed on each line by taking the
16797                 supplied username and comparing it with each username on the right
16798                 hand side of the '=' signs. If the supplied name matches any of
16799                 the names on the right hand side then it is replaced with the name
16800                 on the left. Processing then continues with the next line.</P
16801 ><P
16802 >If any line begins with a '#' or a ';' then it is
16803                 ignored</P
16804 ><P
16805 >If any line begins with an '!' then the processing
16806                 will stop after that line if a mapping was done by the line.
16807                 Otherwise mapping continues with every line being processed.
16808                 Using '!' is most useful when you have a wildcard mapping line
16809                 later in the file.</P
16810 ><P
16811 >For example to map from the name <TT
16812 CLASS="CONSTANT"
16813 >admin</TT
16814 >
16815                 or <TT
16816 CLASS="CONSTANT"
16817 >administrator</TT
16818 > to the UNIX name <TT
16819 CLASS="CONSTANT"
16820 >               root</TT
16821 > you would use:</P
16822 ><P
16823 ><B
16824 CLASS="COMMAND"
16825 >root = admin administrator</B
16826 ></P
16827 ><P
16828 >Or to map anyone in the UNIX group <TT
16829 CLASS="CONSTANT"
16830 >system</TT
16831 >
16832                 to the UNIX name <TT
16833 CLASS="CONSTANT"
16834 >sys</TT
16835 > you would use:</P
16836 ><P
16837 ><B
16838 CLASS="COMMAND"
16839 >sys = @system</B
16840 ></P
16841 ><P
16842 >You can have as many mappings as you like in a username
16843                 map file.</P
16844 ><P
16845 >If your system supports the NIS NETGROUP option then
16846                 the netgroup database is checked before the <TT
16847 CLASS="FILENAME"
16848 >/etc/group
16849                 </TT
16850 > database for matching groups.</P
16851 ><P
16852 >You can map Windows usernames that have spaces in them
16853                  by using double quotes around the name. For example:</P
16854 ><P
16855 ><B
16856 CLASS="COMMAND"
16857 >tridge = "Andrew Tridgell"</B
16858 ></P
16859 ><P
16860 >would map the windows username "Andrew Tridgell" to the
16861                 unix username "tridge".</P
16862 ><P
16863 >The following example would map mary and fred to the
16864                 unix user sys, and map the rest to guest. Note the use of the
16865                 '!' to tell Samba to stop processing if it gets a match on
16866                 that line.</P
16867 ><P
16868 ><PRE
16869 CLASS="PROGRAMLISTING"
16870 >               !sys = mary fred
16871                 guest = *
16872                 </PRE
16873 ></P
16874 ><P
16875 >Note that the remapping is applied to all occurrences
16876                 of usernames. Thus if you connect to \\server\fred and <TT
16877 CLASS="CONSTANT"
16878 >               fred</TT
16879 > is remapped to <TT
16880 CLASS="CONSTANT"
16881 >mary</TT
16882 > then you
16883                 will actually be connecting to \\server\mary and will need to
16884                 supply a password suitable for <TT
16885 CLASS="CONSTANT"
16886 >mary</TT
16887 > not
16888                 <TT
16889 CLASS="CONSTANT"
16890 >fred</TT
16891 >. The only exception to this is the
16892                 username passed to the <A
16893 HREF="#PASSWORDSERVER"
16894 ><TT
16895 CLASS="PARAMETER"
16896 ><I
16897 >               password server</I
16898 ></TT
16899 ></A
16900 > (if you have one). The password
16901                 server will receive whatever username the client supplies without
16902                 modification.</P
16903 ><P
16904 >Also note that no reverse mapping is done. The main effect
16905                 this has is with printing. Users who have been mapped may have
16906                 trouble deleting print jobs as PrintManager under WfWg will think
16907                 they don't own the print job.</P
16908 ><P
16909 >Default: <I
16910 CLASS="EMPHASIS"
16911 >no username map</I
16912 ></P
16913 ><P
16914 >Example: <B
16915 CLASS="COMMAND"
16916 >username map = /usr/local/samba/lib/users.map
16917                 </B
16918 ></P
16919 ></DD
16920 ><DT
16921 ><A
16922 NAME="UTMP"
16923 ></A
16924 >utmp (S)</DT
16925 ><DD
16926 ><P
16927 >This boolean parameter is only available if
16928                 Samba has been configured and compiled  with the option <B
16929 CLASS="COMMAND"
16930 >               --with-utmp</B
16931 >. If set to True then Samba will attempt
16932                 to add utmp or utmpx records (depending on the UNIX system) whenever a
16933                 connection is made to a Samba server. Sites may use this to record the
16934                 user connecting to a Samba share.</P
16935 ><P
16936 >See also the <A
16937 HREF="#UTMPDIRECTORY"
16938 ><TT
16939 CLASS="PARAMETER"
16940 ><I
16941 >               utmp directory</I
16942 ></TT
16943 ></A
16944 > parameter.</P
16945 ><P
16946 >Default: <B
16947 CLASS="COMMAND"
16948 >utmp = no</B
16949 ></P
16950 ></DD
16951 ><DT
16952 ><A
16953 NAME="UTMPDIRECTORY"
16954 ></A
16955 >utmp directory(G)</DT
16956 ><DD
16957 ><P
16958 >This parameter is only available if Samba has
16959                 been configured and compiled with the option <B
16960 CLASS="COMMAND"
16961 >               --with-utmp</B
16962 >. It specifies a directory pathname that is
16963                 used to store the utmp or utmpx files (depending on the UNIX system) that
16964                 record user connections to a Samba server. See also the <A
16965 HREF="#UTMP"
16966 >               <TT
16967 CLASS="PARAMETER"
16968 ><I
16969 >utmp</I
16970 ></TT
16971 ></A
16972 > parameter. By default this is
16973                 not set, meaning the system will use whatever utmp file the
16974                 native system is set to use (usually
16975                 <TT
16976 CLASS="FILENAME"
16977 >/var/run/utmp</TT
16978 > on Linux).</P
16979 ><P
16980 >Default: <I
16981 CLASS="EMPHASIS"
16982 >no utmp directory</I
16983 ></P
16984 ></DD
16985 ><DT
16986 ><A
16987 NAME="VALIDCHARS"
16988 ></A
16989 >valid chars (G)</DT
16990 ><DD
16991 ><P
16992 >The option allows you to specify additional
16993                 characters that should be considered valid by the server in
16994                 filenames. This is particularly useful for national character
16995                 sets, such as adding u-umlaut or a-ring.</P
16996 ><P
16997 >The option takes a list of characters in either integer
16998                 or character form with spaces between them. If you give two
16999                 characters with a colon between them then it will be taken as
17000                 an lowercase:uppercase pair.</P
17001 ><P
17002 >If you have an editor capable of entering the characters
17003                 into the config file then it is probably easiest to use this
17004                 method. Otherwise you can specify the characters in octal,
17005                 decimal or hexadecimal form using the usual C notation.</P
17006 ><P
17007 >For example to add the single character 'Z' to the charset
17008                 (which is a pointless thing to do as it's already there) you could
17009                 do one of the following</P
17010 ><P
17011 ><PRE
17012 CLASS="PROGRAMLISTING"
17013 >               valid chars = Z
17014                 valid chars = z:Z
17015                 valid chars = 0132:0172
17016                 </PRE
17017 ></P
17018 ><P
17019 >The last two examples above actually add two characters,
17020                 and alter the uppercase and lowercase mappings appropriately.</P
17021 ><P
17022 >Note that you <I
17023 CLASS="EMPHASIS"
17024 >MUST</I
17025 > specify this parameter
17026                 after the <TT
17027 CLASS="PARAMETER"
17028 ><I
17029 >client code page</I
17030 ></TT
17031 > parameter if you
17032                 have both set. If <TT
17033 CLASS="PARAMETER"
17034 ><I
17035 >client code page</I
17036 ></TT
17037 > is set after
17038                 the <TT
17039 CLASS="PARAMETER"
17040 ><I
17041 >valid chars</I
17042 ></TT
17043 > parameter the <TT
17044 CLASS="PARAMETER"
17045 ><I
17046 >valid
17047                 chars</I
17048 ></TT
17049 > settings will be overwritten.</P
17050 ><P
17051 >See also the <A
17052 HREF="#CLIENTCODEPAGE"
17053 ><TT
17054 CLASS="PARAMETER"
17055 ><I
17056 >client
17057                 code page</I
17058 ></TT
17059 ></A
17060 > parameter.</P
17061 ><P
17062 >Default: <I
17063 CLASS="EMPHASIS"
17064 >Samba defaults to using a reasonable set
17065                 of valid characters for English systems</I
17066 ></P
17067 ><P
17068 >Example: <B
17069 CLASS="COMMAND"
17070 >valid chars = 0345:0305 0366:0326 0344:0304
17071                 </B
17072 ></P
17073 ><P
17074 >The above example allows filenames to have the Swedish
17075                 characters in them.</P
17076 ><P
17077 ><I
17078 CLASS="EMPHASIS"
17079 >NOTE:</I
17080 > It is actually quite difficult to
17081                 correctly produce a <TT
17082 CLASS="PARAMETER"
17083 ><I
17084 >valid chars</I
17085 ></TT
17086 > line for
17087                 a particular system. To automate the process <A
17088 HREF="mailto:tino@augsburg.net"
17089 TARGET="_top"
17090 >tino@augsburg.net</A
17091 > has written
17092                 a package called <B
17093 CLASS="COMMAND"
17094 >validchars</B
17095 > which will automatically
17096                 produce a complete <TT
17097 CLASS="PARAMETER"
17098 ><I
17099 >valid chars</I
17100 ></TT
17101 > line for
17102                 a given client system. Look in the <TT
17103 CLASS="FILENAME"
17104 >examples/validchars/
17105                 </TT
17106 > subdirectory of your Samba source code distribution
17107                 for this package.</P
17108 ></DD
17109 ><DT
17110 ><A
17111 NAME="VALIDUSERS"
17112 ></A
17113 >valid users (S)</DT
17114 ><DD
17115 ><P
17116 >This is a list of users that should be allowed
17117                 to login to this service. Names starting with '@', '+' and  '&#38;'
17118                 are interpreted using the same rules as described in the
17119                 <TT
17120 CLASS="PARAMETER"
17121 ><I
17122 >invalid users</I
17123 ></TT
17124 > parameter.</P
17125 ><P
17126 >If this is empty (the default) then any user can login.
17127                 If a username is in both this list and the <TT
17128 CLASS="PARAMETER"
17129 ><I
17130 >invalid
17131                 users</I
17132 ></TT
17133 > list then access is denied for that user.</P
17134 ><P
17135 >The current servicename is substituted for <TT
17136 CLASS="PARAMETER"
17137 ><I
17138 >%S
17139                 </I
17140 ></TT
17141 >. This is useful in the [homes] section.</P
17142 ><P
17143 >See also <A
17144 HREF="#INVALIDUSERS"
17145 ><TT
17146 CLASS="PARAMETER"
17147 ><I
17148 >invalid users
17149                 </I
17150 ></TT
17151 ></A
17152 ></P
17153 ><P
17154 >Default: <I
17155 CLASS="EMPHASIS"
17156 >No valid users list (anyone can login)
17157                 </I
17158 ></P
17159 ><P
17160 >Example: <B
17161 CLASS="COMMAND"
17162 >valid users = greg, @pcusers</B
17163 ></P
17164 ></DD
17165 ><DT
17166 ><A
17167 NAME="VETOFILES"
17168 ></A
17169 >veto files(S)</DT
17170 ><DD
17171 ><P
17172 >This is a list of files and directories that
17173                 are neither visible nor accessible.  Each entry in the list must
17174                 be separated by a '/', which allows spaces to be included
17175                 in the entry. '*' and '?' can be used to specify multiple files
17176                 or directories as in DOS wildcards.</P
17177 ><P
17178 >Each entry must be a unix path, not a DOS path and
17179                 must <I
17180 CLASS="EMPHASIS"
17181 >not</I
17182 > include the  unix directory
17183                 separator '/'.</P
17184 ><P
17185 >Note that the <TT
17186 CLASS="PARAMETER"
17187 ><I
17188 >case sensitive</I
17189 ></TT
17190 > option
17191                 is applicable in vetoing files.</P
17192 ><P
17193 >One feature of the veto files parameter that it is important
17194                 to be aware of, is that if a directory contains nothing but files
17195                 that match the veto files parameter (which means that Windows/DOS
17196                 clients cannot ever see them) is deleted, the veto files within
17197                 that directory <I
17198 CLASS="EMPHASIS"
17199 >are automatically deleted</I
17200 > along
17201                 with it, if the user has UNIX permissions to do so.</P
17202 ><P
17203 >Setting this parameter will affect the performance
17204                 of Samba, as it will be forced to check all files and directories
17205                 for a match as they are scanned.</P
17206 ><P
17207 >See also <A
17208 HREF="#HIDEFILES"
17209 ><TT
17210 CLASS="PARAMETER"
17211 ><I
17212 >hide files
17213                 </I
17214 ></TT
17215 ></A
17216 > and <A
17217 HREF="#CASESENSITIVE"
17218 ><TT
17219 CLASS="PARAMETER"
17220 ><I
17221 >               case sensitive</I
17222 ></TT
17223 ></A
17224 >.</P
17225 ><P
17226 >Default: <I
17227 CLASS="EMPHASIS"
17228 >No files or directories are vetoed.
17229                 </I
17230 ></P
17231 ><P
17232 >Examples:<PRE
17233 CLASS="PROGRAMLISTING"
17234 >          ; Veto any files containing the word Security,
17235         ; any ending in .tmp, and any directory containing the
17236         ; word root.
17237                 veto files = /*Security*/*.tmp/*root*/
17238
17239                 ; Veto the Apple specific files that a NetAtalk server
17240         ; creates.
17241                 veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/
17242                 </PRE
17243 ></P
17244 ></DD
17245 ><DT
17246 ><A
17247 NAME="VETOOPLOCKFILES"
17248 ></A
17249 >veto oplock files (S)</DT
17250 ><DD
17251 ><P
17252 >This parameter is only valid when the <A
17253 HREF="#OPLOCKS"
17254 ><TT
17255 CLASS="PARAMETER"
17256 ><I
17257 >oplocks</I
17258 ></TT
17259 ></A
17260 >
17261                 parameter is turned on for a share. It allows the Samba administrator
17262                 to selectively turn off the granting of oplocks on selected files that
17263                 match a wildcarded list, similar to the wildcarded list used in the
17264                 <A
17265 HREF="#VETOFILES"
17266 ><TT
17267 CLASS="PARAMETER"
17268 ><I
17269 >veto files</I
17270 ></TT
17271 ></A
17272 >
17273                 parameter.</P
17274 ><P
17275 >Default: <I
17276 CLASS="EMPHASIS"
17277 >No files are vetoed for oplock
17278                 grants</I
17279 ></P
17280 ><P
17281 >You might want to do this on files that you know will
17282                 be heavily contended for by clients. A good example of this
17283                 is in the NetBench SMB benchmark program, which causes heavy
17284                 client contention for files ending in <TT
17285 CLASS="FILENAME"
17286 >.SEM</TT
17287 >.
17288                 To cause Samba not to grant oplocks on these files you would use
17289                 the line (either in the [global] section or in the section for
17290                 the particular NetBench share :</P
17291 ><P
17292 >Example: <B
17293 CLASS="COMMAND"
17294 >veto oplock files = /*;.SEM/
17295                 </B
17296 ></P
17297 ></DD
17298 ><DT
17299 ><A
17300 NAME="VFSOBJECT"
17301 ></A
17302 >vfs object (S)</DT
17303 ><DD
17304 ><P
17305 >This parameter specifies a shared object file that
17306                 is used for Samba VFS I/O operations.  By default, normal
17307                 disk I/O operations are used but these can be overloaded
17308                 with a VFS object.  The Samba VFS layer is new to Samba 2.2 and
17309                 must be enabled at compile time with --with-vfs.</P
17310 ><P
17311 >Default : <I
17312 CLASS="EMPHASIS"
17313 >no value</I
17314 ></P
17315 ></DD
17316 ><DT
17317 ><A
17318 NAME="VFSOPTIONS"
17319 ></A
17320 >vfs options (S)</DT
17321 ><DD
17322 ><P
17323 >This parameter allows parameters to be passed
17324                 to the vfs layer at initialisation time.  The Samba VFS layer
17325                 is new to Samba 2.2 and must be enabled at compile time
17326                 with --with-vfs.  See also <A
17327 HREF="#VFSOBJECT"
17328 ><TT
17329 CLASS="PARAMETER"
17330 ><I
17331 >               vfs object</I
17332 ></TT
17333 ></A
17334 >.</P
17335 ><P
17336 >Default : <I
17337 CLASS="EMPHASIS"
17338 >no value</I
17339 ></P
17340 ></DD
17341 ><DT
17342 ><A
17343 NAME="VOLUME"
17344 ></A
17345 >volume (S)</DT
17346 ><DD
17347 ><P
17348 > This allows you to override the volume label
17349                 returned for a share. Useful for CDROMs with installation programs
17350                 that insist on a particular volume label.</P
17351 ><P
17352 >Default: <I
17353 CLASS="EMPHASIS"
17354 >the name of the share</I
17355 ></P
17356 ></DD
17357 ><DT
17358 ><A
17359 NAME="WIDELINKS"
17360 ></A
17361 >wide links (S)</DT
17362 ><DD
17363 ><P
17364 >This parameter controls whether or not links
17365                 in the UNIX file system may be followed by the server. Links
17366                 that point to areas within the directory tree exported by the
17367                 server are always allowed; this parameter controls access only
17368                 to areas that are outside the directory tree being exported.</P
17369 ><P
17370 >Note that setting this parameter can have a negative
17371                 effect on your server performance due to the extra system calls
17372                 that Samba has to  do in order to perform the link checks.</P
17373 ><P
17374 >Default: <B
17375 CLASS="COMMAND"
17376 >wide links = yes</B
17377 ></P
17378 ></DD
17379 ><DT
17380 ><A
17381 NAME="WINBINDCACHETIME"
17382 ></A
17383 >winbind cache time</DT
17384 ><DD
17385 ><P
17386 ><I
17387 CLASS="EMPHASIS"
17388 >NOTE:</I
17389 > this parameter is only
17390                 available in Samba 3.0.</P
17391 ><P
17392 >This parameter specifies the number of seconds the
17393                 <A
17394 HREF="winbindd.8.html"
17395 TARGET="_top"
17396 >winbindd(8)</A
17397 > daemon will cache
17398                 user and group information before querying a Windows NT server
17399                 again.</P
17400 ><P
17401 >Default: <B
17402 CLASS="COMMAND"
17403 >winbind cache type = 15</B
17404 ></P
17405 ></DD
17406 ><DT
17407 ><A
17408 NAME="WINBINDGID"
17409 ></A
17410 >winbind gid</DT
17411 ><DD
17412 ><P
17413 ><I
17414 CLASS="EMPHASIS"
17415 >NOTE:</I
17416 > this parameter is only
17417                 available in Samba 3.0.</P
17418 ><P
17419 >The winbind gid parameter specifies the range of group
17420                 ids that are allocated by the <A
17421 HREF="winbindd.8.html"
17422 TARGET="_top"
17423 >               winbindd(8)</A
17424 > daemon.  This range of group ids should have no
17425                 existing local or nis groups within it as strange conflicts can
17426                 occur otherwise.</P
17427 ><P
17428 >Default: <B
17429 CLASS="COMMAND"
17430 >winbind gid = &lt;empty string&gt;
17431                 </B
17432 ></P
17433 ><P
17434 >Example: <B
17435 CLASS="COMMAND"
17436 >winbind gid = 10000-20000</B
17437 ></P
17438 ></DD
17439 ><DT
17440 ><A
17441 NAME="WINBINDSEPARATOR"
17442 ></A
17443 >winbind separator</DT
17444 ><DD
17445 ><P
17446 ><I
17447 CLASS="EMPHASIS"
17448 >NOTE:</I
17449 > this parameter is only
17450                 available in Samba 3.0.</P
17451 ><P
17452 >This parameter allows an admin to define the character
17453                 used when listing a username of the form of <TT
17454 CLASS="REPLACEABLE"
17455 ><I
17456 >DOMAIN
17457                 </I
17458 ></TT
17459 >\<TT
17460 CLASS="REPLACEABLE"
17461 ><I
17462 >user</I
17463 ></TT
17464 >.  This parameter
17465                 is only applicable when using the <TT
17466 CLASS="FILENAME"
17467 >pam_winbind.so</TT
17468 >
17469                 and <TT
17470 CLASS="FILENAME"
17471 >nss_winbind.so</TT
17472 > modules for UNIX services.
17473                 </P
17474 ><P
17475 >Example: <B
17476 CLASS="COMMAND"
17477 >winbind separator = \</B
17478 ></P
17479 ><P
17480 >Example: <B
17481 CLASS="COMMAND"
17482 >winbind separator = +</B
17483 ></P
17484 ></DD
17485 ><DT
17486 ><A
17487 NAME="WINBINDUID"
17488 ></A
17489 >winbind uid</DT
17490 ><DD
17491 ><P
17492 ><I
17493 CLASS="EMPHASIS"
17494 >NOTE:</I
17495 > this parameter is only
17496                 available in Samba 3.0.</P
17497 ><P
17498 >The winbind gid parameter specifies the range of group
17499                 ids that are allocated by the <A
17500 HREF="winbindd.8.html"
17501 TARGET="_top"
17502 >               winbindd(8)</A
17503 > daemon.  This range of ids should have no
17504                 existing local or nis users within it as strange conflicts can
17505                 occur otherwise.</P
17506 ><P
17507 >Default: <B
17508 CLASS="COMMAND"
17509 >winbind uid = &lt;empty string&gt;
17510                 </B
17511 ></P
17512 ><P
17513 >Example: <B
17514 CLASS="COMMAND"
17515 >winbind uid = 10000-20000</B
17516 ></P
17517 ></DD
17518 ><DT
17519 ><A
17520 NAME="WINSHOOK"
17521 ></A
17522 >wins hook (G)</DT
17523 ><DD
17524 ><P
17525 >When Samba is running as a WINS server this
17526                 allows you to call an external program for all changes to the
17527                 WINS database. The primary use for this option is to allow the
17528                 dynamic update of external name resolution databases such as
17529                 dynamic DNS.</P
17530 ><P
17531 >The wins hook parameter specifies the name of a script
17532                 or executable that will be called as follows:</P
17533 ><P
17534 ><B
17535 CLASS="COMMAND"
17536 >wins_hook operation name nametype ttl IP_list
17537                 </B
17538 ></P
17539 ><P
17540 ></P
17541 ><UL
17542 ><LI
17543 ><P
17544 >The first argument is the operation and is one
17545                         of "add", "delete", or "refresh". In most cases the operation can
17546                         be ignored as the rest of the parameters provide sufficient
17547                         information. Note that "refresh" may sometimes be called when the
17548                         name has not previously been added, in that case it should be treated
17549                         as an add.</P
17550 ></LI
17551 ><LI
17552 ><P
17553 >The second argument is the netbios name. If the
17554                         name is not a legal name then the wins hook is not called.
17555                         Legal names contain only  letters, digits, hyphens, underscores
17556                         and periods.</P
17557 ></LI
17558 ><LI
17559 ><P
17560 >The third argument is the netbios name
17561                         type as a 2 digit hexadecimal number. </P
17562 ></LI
17563 ><LI
17564 ><P
17565 >The fourth argument is the TTL (time to live)
17566                         for the name in seconds.</P
17567 ></LI
17568 ><LI
17569 ><P
17570 >The fifth and subsequent arguments are the IP
17571                         addresses currently registered for that name. If this list is
17572                         empty then the name should be deleted.</P
17573 ></LI
17574 ></UL
17575 ><P
17576 >An example script that calls the BIND dynamic DNS update
17577                 program <B
17578 CLASS="COMMAND"
17579 >nsupdate</B
17580 > is provided in the examples
17581                 directory of the Samba source code. </P
17582 ></DD
17583 ><DT
17584 ><A
17585 NAME="WINSPROXY"
17586 ></A
17587 >wins proxy (G)</DT
17588 ><DD
17589 ><P
17590 >This is a boolean that controls if <A
17591 HREF="nmbd.8.html"
17592 TARGET="_top"
17593 >nmbd(8)</A
17594 > will respond to broadcast name
17595                 queries on behalf of  other hosts. You may need to set this
17596                 to <TT
17597 CLASS="CONSTANT"
17598 >yes</TT
17599 > for some older clients.</P
17600 ><P
17601 >Default: <B
17602 CLASS="COMMAND"
17603 >wins proxy = no</B
17604 ></P
17605 ></DD
17606 ><DT
17607 ><A
17608 NAME="WINSSERVER"
17609 ></A
17610 >wins server (G)</DT
17611 ><DD
17612 ><P
17613 >This specifies the IP address (or DNS name: IP
17614                 address for preference) of the WINS server that <A
17615 HREF="nmbd.8.html"
17616 TARGET="_top"
17617 >               nmbd(8)</A
17618 > should register with. If you have a WINS server on
17619                 your network then you should set this to the WINS server's IP.</P
17620 ><P
17621 >You should point this at your WINS server if you have a
17622                 multi-subnetted network.</P
17623 ><P
17624 ><I
17625 CLASS="EMPHASIS"
17626 >NOTE</I
17627 >. You need to set up Samba to point
17628                 to a WINS server if you have multiple subnets and wish cross-subnet
17629                 browsing to work correctly.</P
17630 ><P
17631 >See the documentation file <TT
17632 CLASS="FILENAME"
17633 >BROWSING.txt</TT
17634 >
17635                 in the docs/ directory of your Samba source distribution.</P
17636 ><P
17637 >Default: <I
17638 CLASS="EMPHASIS"
17639 >not enabled</I
17640 ></P
17641 ><P
17642 >Example: <B
17643 CLASS="COMMAND"
17644 >wins server = 192.9.200.1</B
17645 ></P
17646 ></DD
17647 ><DT
17648 ><A
17649 NAME="WINSSUPPORT"
17650 ></A
17651 >wins support (G)</DT
17652 ><DD
17653 ><P
17654 >This boolean controls if the <A
17655 HREF="nmbd.8.html"
17656 TARGET="_top"
17657 >
17658                 nmbd(8)</A
17659 > process in Samba will act as a WINS server. You should
17660                 not set this to true unless you have a multi-subnetted network and
17661                 you wish a particular <B
17662 CLASS="COMMAND"
17663 >nmbd</B
17664 > to be your WINS server.
17665                 Note that you should <I
17666 CLASS="EMPHASIS"
17667 >NEVER</I
17668 > set this to true
17669                 on more than one machine in your network.</P
17670 ><P
17671 >Default: <B
17672 CLASS="COMMAND"
17673 >wins support = no</B
17674 ></P
17675 ></DD
17676 ><DT
17677 ><A
17678 NAME="WORKGROUP"
17679 ></A
17680 >workgroup (G)</DT
17681 ><DD
17682 ><P
17683 >This controls what workgroup your server will
17684                 appear to be in when queried by clients. Note that this parameter
17685                 also controls the Domain name used with the <A
17686 HREF="#SECURITYEQUALSDOMAIN"
17687 ><B
17688 CLASS="COMMAND"
17689 >security=domain</B
17690 ></A
17691 >
17692                 setting.</P
17693 ><P
17694 >Default: <I
17695 CLASS="EMPHASIS"
17696 >set at compile time to WORKGROUP</I
17697 ></P
17698 ><P
17699 >Example: <B
17700 CLASS="COMMAND"
17701 >workgroup = MYGROUP</B
17702 ></P
17703 ></DD
17704 ><DT
17705 ><A
17706 NAME="WRITABLE"
17707 ></A
17708 >writable (S)</DT
17709 ><DD
17710 ><P
17711 >Synonym for <A
17712 HREF="#WRITEABLE"
17713 ><TT
17714 CLASS="PARAMETER"
17715 ><I
17716 >               writeable</I
17717 ></TT
17718 ></A
17719 > for people who can't spell :-).</P
17720 ></DD
17721 ><DT
17722 ><A
17723 NAME="WRITECACHESIZE"
17724 ></A
17725 >write cache size (S)</DT
17726 ><DD
17727 ><P
17728 >If this integer parameter is set to non-zero value,
17729                 Samba will create an in-memory cache for each oplocked file
17730                 (it does <I
17731 CLASS="EMPHASIS"
17732 >not</I
17733 > do this for
17734                 non-oplocked files). All writes that the client does not request
17735                 to be flushed directly to disk will be stored in this cache if possible.
17736                 The cache is flushed onto disk when a write comes in whose offset
17737                 would not fit into the cache or when the file is closed by the client.
17738                 Reads for the file are also served from this cache if the data is stored
17739                 within it.</P
17740 ><P
17741 >This cache allows Samba to batch client writes into a more
17742                 efficient write size for RAID disks (ie. writes may be tuned to
17743                 be the RAID stripe size) and can improve performance on systems
17744                 where the disk subsystem is a bottleneck but there is free
17745                 memory for userspace programs.</P
17746 ><P
17747 >The integer parameter specifies the size of this cache
17748                 (per oplocked file) in bytes.</P
17749 ><P
17750 >Default: <B
17751 CLASS="COMMAND"
17752 >write cache size = 0</B
17753 ></P
17754 ><P
17755 >Example: <B
17756 CLASS="COMMAND"
17757 >write cache size = 262144</B
17758 ></P
17759 ><P
17760 >for a 256k cache size per file.</P
17761 ></DD
17762 ><DT
17763 ><A
17764 NAME="WRITELIST"
17765 ></A
17766 >write list (S)</DT
17767 ><DD
17768 ><P
17769 >This is a list of users that are given read-write
17770                 access to a service. If the connecting user is in this list then
17771                 they will be given write access, no matter what the <A
17772 HREF="#WRITEABLE"
17773 ><TT
17774 CLASS="PARAMETER"
17775 ><I
17776 >writeable</I
17777 ></TT
17778 ></A
17779 >
17780                 option is set to. The list can include group names using the
17781                 @group syntax.</P
17782 ><P
17783 >Note that if a user is in both the read list and the
17784                 write list then they will be given write access.</P
17785 ><P
17786 >See also the <A
17787 HREF="#READLIST"
17788 ><TT
17789 CLASS="PARAMETER"
17790 ><I
17791 >read list
17792                 </I
17793 ></TT
17794 ></A
17795 > option.</P
17796 ><P
17797 >Default: <B
17798 CLASS="COMMAND"
17799 >write list = &lt;empty string&gt;
17800                 </B
17801 ></P
17802 ><P
17803 >Example: <B
17804 CLASS="COMMAND"
17805 >write list = admin, root, @staff
17806                 </B
17807 ></P
17808 ></DD
17809 ><DT
17810 ><A
17811 NAME="WRITEOK"
17812 ></A
17813 >write ok (S)</DT
17814 ><DD
17815 ><P
17816 >Synonym for <A
17817 HREF="#WRITEABLE"
17818 ><TT
17819 CLASS="PARAMETER"
17820 ><I
17821 >               writeable</I
17822 ></TT
17823 ></A
17824 >.</P
17825 ></DD
17826 ><DT
17827 ><A
17828 NAME="WRITERAW"
17829 ></A
17830 >write raw (G)</DT
17831 ><DD
17832 ><P
17833 >This parameter controls whether or not the server
17834                 will support raw writes SMB's when transferring data from clients.
17835                 You should never need to change this parameter.</P
17836 ><P
17837 >Default: <B
17838 CLASS="COMMAND"
17839 >write raw = yes</B
17840 ></P
17841 ></DD
17842 ><DT
17843 ><A
17844 NAME="WRITEABLE"
17845 ></A
17846 >writeable (S)</DT
17847 ><DD
17848 ><P
17849 >An inverted synonym is <A
17850 HREF="#READONLY"
17851 >               <TT
17852 CLASS="PARAMETER"
17853 ><I
17854 >read only</I
17855 ></TT
17856 ></A
17857 >.</P
17858 ><P
17859 >If this parameter is <TT
17860 CLASS="CONSTANT"
17861 >no</TT
17862 >, then users
17863                 of a service may not create or modify files in the service's
17864                 directory.</P
17865 ><P
17866 >Note that a printable service (<B
17867 CLASS="COMMAND"
17868 >printable = yes</B
17869 >)
17870                 will <I
17871 CLASS="EMPHASIS"
17872 >ALWAYS</I
17873 > allow writing to the directory
17874                 (user privileges permitting), but only via spooling operations.</P
17875 ><P
17876 >Default: <B
17877 CLASS="COMMAND"
17878 >writeable = no</B
17879 ></P
17880 ></DD
17881 ></DL
17882 ></DIV
17883 ></DIV
17884 ><DIV
17885 CLASS="REFSECT1"
17886 ><A
17887 NAME="AEN5643"
17888 ></A
17889 ><H2
17890 >WARNINGS</H2
17891 ><P
17892 >Although the configuration file permits service names
17893         to contain spaces, your client software may not. Spaces will
17894         be ignored in comparisons anyway, so it shouldn't be a
17895         problem - but be aware of the possibility.</P
17896 ><P
17897 >On a similar note, many clients - especially DOS clients -
17898         limit service names to eight characters. <A
17899 HREF="smbd.8.html"
17900 TARGET="_top"
17901 >smbd(8)
17902         </A
17903 > has no such limitation, but attempts to connect from such
17904         clients will fail if they truncate the service names.  For this reason
17905         you should probably keep your service names down to eight characters
17906         in length.</P
17907 ><P
17908 >Use of the [homes] and [printers] special sections make life
17909         for an administrator easy, but the various combinations of default
17910         attributes can be tricky. Take extreme care when designing these
17911         sections. In particular, ensure that the permissions on spool
17912         directories are correct.</P
17913 ></DIV
17914 ><DIV
17915 CLASS="REFSECT1"
17916 ><A
17917 NAME="AEN5649"
17918 ></A
17919 ><H2
17920 >VERSION</H2
17921 ><P
17922 >This man page is correct for version 2.2 of
17923         the Samba suite.</P
17924 ></DIV
17925 ><DIV
17926 CLASS="REFSECT1"
17927 ><A
17928 NAME="AEN5652"
17929 ></A
17930 ><H2
17931 >SEE ALSO</H2
17932 ><P
17933 ><A
17934 HREF="samba.7.html"
17935 TARGET="_top"
17936 >samba(7)</A
17937 >,
17938         <A
17939 HREF="smbpasswd.8.html"
17940 TARGET="_top"
17941 ><B
17942 CLASS="COMMAND"
17943 >smbpasswd(8)</B
17944 ></A
17945 >,
17946         <A
17947 HREF="swat.8.html"
17948 TARGET="_top"
17949 ><B
17950 CLASS="COMMAND"
17951 >swat(8)</B
17952 ></A
17953 >,
17954         <A
17955 HREF="smbd.8.html"
17956 TARGET="_top"
17957 ><B
17958 CLASS="COMMAND"
17959 >smbd(8)</B
17960 ></A
17961 >,
17962         <A
17963 HREF="nmbd.8.html"
17964 TARGET="_top"
17965 ><B
17966 CLASS="COMMAND"
17967 >nmbd(8)</B
17968 ></A
17969 >,
17970         <A
17971 HREF="smbclient.1.html"
17972 TARGET="_top"
17973 ><B
17974 CLASS="COMMAND"
17975 >smbclient(1)</B
17976 ></A
17977 >,
17978         <A
17979 HREF="nmblookup.1.html"
17980 TARGET="_top"
17981 ><B
17982 CLASS="COMMAND"
17983 >nmblookup(1)</B
17984 ></A
17985 >,
17986         <A
17987 HREF="testparm.1.html"
17988 TARGET="_top"
17989 ><B
17990 CLASS="COMMAND"
17991 >testparm(1)</B
17992 ></A
17993 >,
17994         <A
17995 HREF="testprns.1.html"
17996 TARGET="_top"
17997 ><B
17998 CLASS="COMMAND"
17999 >testprns(1)</B
18000 ></A
18001 >
18002         </P
18003 ></DIV
18004 ><DIV
18005 CLASS="REFSECT1"
18006 ><A
18007 NAME="AEN5672"
18008 ></A
18009 ><H2
18010 >AUTHOR</H2
18011 ><P
18012 >The original Samba software and related utilities
18013         were created by Andrew Tridgell. Samba is now developed
18014         by the Samba Team as an Open Source project similar
18015         to the way the Linux kernel is developed.</P
18016 ><P
18017 >The original Samba man pages were written by Karl Auer.
18018         The man page sources were converted to YODL format (another
18019         excellent piece of Open Source software, available at
18020         <A
18021 HREF="ftp://ftp.icce.rug.nl/pub/unix/"
18022 TARGET="_top"
18023 >       ftp://ftp.icce.rug.nl/pub/unix/</A
18024 >) and updated for the Samba 2.0
18025         release by Jeremy Allison.  The conversion to DocBook for
18026         Samba 2.2 was done by Gerald Carter</P
18027 ></DIV
18028 ></BODY
18029 ></HTML
18030 >