This commit was manufactured by cvs2svn to create branch 'SAMBA_3_0'.(This used to be commit 381649916ecbaddefbb6ee0e6137b7cc73eb54b1)

15 files changed, 428 insertions, 0 deletions

diff --git a/docs/docbook/smbdotconf/logon/abortshutdownscript.xml b/docs/docbook/smbdotconf/logon/abortshutdownscript.xml
new file mode 100644
index 0000000000..e9a7dba792
--- /dev/null
+++ b/docs/docbook/smbdotconf/logon/abortshutdownscript.xml
@@ -0,0 +1,18 @@
+<samba:parameter name="abort shutdown script"
+                 context="G"
+                 advanced="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+	<para><emphasis>This parameter only exists in the HEAD cvs branch</emphasis>
+	This a full path name to a script called by <citerefentry><refentrytitle>smbd</refentrytitle>
+	<manvolnum>8</manvolnum></citerefentry> that
+	should stop a shutdown procedure issued by the <link linkend="SHUTDOWNSCRIPT">
+	<parameter moreinfo="none">shutdown script</parameter></link>.</para>
+		
+	<para>This command will be run as user.</para>
+
+	<para>Default: <emphasis>None</emphasis>.</para>
+
+	<para>Example: <command moreinfo="none">abort shutdown script = /sbin/shutdown -c</command></para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/logon/addgroupscript.xml b/docs/docbook/smbdotconf/logon/addgroupscript.xml
new file mode 100644
index 0000000000..25906d0889
--- /dev/null
+++ b/docs/docbook/smbdotconf/logon/addgroupscript.xml
@@ -0,0 +1,17 @@
+<samba:parameter name="add group script"
+                 context="G"
+                 advanced="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+	<para>This is the full pathname to a script that will be run
+	<emphasis>AS ROOT</emphasis> by <citerefentry>
+	<refentrytitle>smbd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+	when a new group is requested. It will expand any <parameter
+	moreinfo="none">%g</parameter> to the group name passed. This
+	script is only useful for installations using the Windows NT
+	domain administration tools. The script is free to create a
+	group with an arbitrary name to circumvent unix group name
+	restrictions. In that case the script must print the numeric gid
+	of the created group on stdout.</para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/logon/addmachinescript.xml b/docs/docbook/smbdotconf/logon/addmachinescript.xml
new file mode 100644
index 0000000000..7aef54d8b0
--- /dev/null
+++ b/docs/docbook/smbdotconf/logon/addmachinescript.xml
@@ -0,0 +1,21 @@
+<samba:parameter name="add machine script"
+                 context="G"
+                 advanced="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+	<para>This is the full pathname to a script that will  be run by
+	<citerefentry><refentrytitle>smbd</refentrytitle>
+	<manvolnum>8</manvolnum></citerefentry> when a machine is added
+	to it's domain using the administrator username and password
+	method. </para>
+
+	<para>This option is only required when using sam back-ends tied
+	to the Unix uid method of RID calculation such as smbpasswd. 
+	This option is only available in Samba 3.0.</para>
+
+	<para>Default: <command moreinfo="none">add machine script = &lt;empty string&gt;</command></para>	
+
+	<para>Example: <command moreinfo="none">add machine script = /usr/sbin/adduser -n -g 
+	machines -c Machine -d /dev/null -s /bin/false %u</command></para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/logon/adduserscript.xml b/docs/docbook/smbdotconf/logon/adduserscript.xml
new file mode 100644
index 0000000000..34d3e7ea58
--- /dev/null
+++ b/docs/docbook/smbdotconf/logon/adduserscript.xml
@@ -0,0 +1,50 @@
+<samba:parameter name="add user script"
+                 context="G"
+                 advanced="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+	<para>This is the full pathname to a script that will 
+	be run <emphasis>AS ROOT</emphasis> by <citerefentry><refentrytitle>smbd</refentrytitle>
+	<manvolnum>8</manvolnum></citerefentry> under special circumstances described below.</para>
+
+	<para>Normally, a Samba server requires that UNIX users are 
+	created for all users accessing files on this server. For sites 
+	that use Windows NT account databases as their primary user database 
+	creating these users and keeping the user list in sync with the 
+	Windows NT PDC is an onerous task. This option allows <ulink url="smbd.8.html">smbd</ulink> to create the required UNIX users 
+	<emphasis>ON DEMAND</emphasis> when a user accesses the Samba server.</para>
+
+	<para>In order to use this option, <citerefentry><refentrytitle>smbd</refentrytitle>
+	<manvolnum>8</manvolnum></citerefentry> must <emphasis>NOT</emphasis> be set to <parameter moreinfo="none">security = share</parameter>
+	and <parameter moreinfo="none">add user script</parameter>
+	must be set to a full pathname for a script that will create a UNIX 
+	user given one argument of <parameter moreinfo="none">%u</parameter>, which expands into 
+	the UNIX user name to create.</para>
+
+	<para>When the Windows user attempts to access the Samba server, 
+	at login (session setup in the SMB protocol) time, <citerefentry><refentrytitle>smbd</refentrytitle>
+	<manvolnum>8</manvolnum></citerefentry> contacts the <parameter moreinfo="none">password server</parameter> and 
+	attempts to authenticate the given user with the given password. If the 
+	authentication succeeds then <command moreinfo="none">smbd</command> 
+	attempts to find a UNIX user in the UNIX password database to map the 
+	Windows user into. If this lookup fails, and <parameter moreinfo="none">add user script
+	</parameter> is set then <command moreinfo="none">smbd</command> will
+	call the specified script <emphasis>AS ROOT</emphasis>, expanding 
+	any <parameter moreinfo="none">%u</parameter> argument to be the user name to create.</para>
+
+	<para>If this script successfully creates the user then <command moreinfo="none">smbd
+	</command> will continue on as though the UNIX user
+	already existed. In this way, UNIX users are dynamically created to
+	match existing Windows NT accounts.</para>
+
+	<para>See also <link linkend="SECURITY"><parameter moreinfo="none">
+	security</parameter></link>, <link linkend="PASSWORDSERVER">
+	<parameter moreinfo="none">password server</parameter></link>, 
+	<link linkend="DELETEUSERSCRIPT"><parameter moreinfo="none">delete user 
+	script</parameter></link>.</para>
+
+	<para>Default: <command moreinfo="none">add user script = &lt;empty string&gt;</command></para>	
+
+	<para>Example: <command moreinfo="none">add user script = /usr/local/samba/bin/add_user %u</command></para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/logon/addusertogroupscript.xml b/docs/docbook/smbdotconf/logon/addusertogroupscript.xml
new file mode 100644
index 0000000000..ed17b9c0d9
--- /dev/null
+++ b/docs/docbook/smbdotconf/logon/addusertogroupscript.xml
@@ -0,0 +1,18 @@
+<samba:parameter name="add user to group script"
+                 context="G"
+                 advanced="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+	<para>Full path to the script that will be called when 
+	a user is added to a group using the Windows NT domain administration 
+	tools. It will be run by <citerefentry><refentrytitle>smbd</refentrytitle>
+	<manvolnum>8</manvolnum></citerefentry>	<emphasis>AS ROOT</emphasis>. 
+	Any <parameter moreinfo="none">%g</parameter> will be replaced with the group name and 
+	any <parameter moreinfo="none">%u</parameter> will be replaced with the user name.
+	</para>
+
+	<para>Default: <command moreinfo="none">add user to group script = </command></para>
+
+	<para>Example: <command moreinfo="none">add user to group script = /usr/sbin/adduser %u %g</command></para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/logon/deletegroupscript.xml b/docs/docbook/smbdotconf/logon/deletegroupscript.xml
new file mode 100644
index 0000000000..2e78c6ae7d
--- /dev/null
+++ b/docs/docbook/smbdotconf/logon/deletegroupscript.xml
@@ -0,0 +1,13 @@
+<samba:parameter name="delete group script"
+                 context="G"
+                 advanced="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+	<para>This is the full pathname to a script that will 
+	be run <emphasis>AS ROOT</emphasis> <citerefentry><refentrytitle>smbd</refentrytitle>
+	<manvolnum>8</manvolnum></citerefentry> when a group is requested to be deleted. 
+	It will expand any <parameter moreinfo="none">%g</parameter> to the group name passed.  
+	This script is only useful for installations using the Windows NT domain administration tools.
+	</para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/logon/deleteuserfromgroupscript.xml b/docs/docbook/smbdotconf/logon/deleteuserfromgroupscript.xml
new file mode 100644
index 0000000000..76594c75d8
--- /dev/null
+++ b/docs/docbook/smbdotconf/logon/deleteuserfromgroupscript.xml
@@ -0,0 +1,18 @@
+<samba:parameter name="delete user from group script"
+                 context="G"
+                 advanced="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+	<para>Full path to the script that will be called when 
+	a user is removed from a group using the Windows NT domain administration 
+	tools. It will be run by <citerefentry><refentrytitle>smbd</refentrytitle>
+	<manvolnum>8</manvolnum></citerefentry> <emphasis>AS ROOT</emphasis>. 
+	Any <parameter moreinfo="none">%g</parameter> will be replaced with the group name and 
+	any <parameter moreinfo="none">%u</parameter> will be replaced with the user name.
+	</para>
+
+	<para>Default: <command moreinfo="none">delete user from group script = </command></para>
+
+	<para>Example: <command moreinfo="none">delete user from group script = /usr/sbin/deluser %u %g</command></para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/logon/deleteuserscript.xml b/docs/docbook/smbdotconf/logon/deleteuserscript.xml
new file mode 100644
index 0000000000..233844555b
--- /dev/null
+++ b/docs/docbook/smbdotconf/logon/deleteuserscript.xml
@@ -0,0 +1,22 @@
+<samba:parameter name="delete user script"
+                 context="G"
+                 advanced="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+	<para>This is the full pathname to a script that will 
+	be run by <citerefentry><refentrytitle>smbd</refentrytitle>
+	<manvolnum>8</manvolnum></citerefentry> when managing users 
+	with remote RPC (NT) tools.
+	</para>
+
+	<para>This script is called when a remote client removes a user
+	from the server, normally using 'User Manager for Domains' or
+	<command moreinfo="none">rpcclient</command>.</para>
+
+	<para>This script should delete the given UNIX username.</para>
+
+	<para>Default: <command moreinfo="none">delete user script = &lt;empty string&gt;</command></para>
+
+	<para>Example: <command moreinfo="none">delete user script = /usr/local/samba/bin/del_user %u</command></para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/logon/domainlogons.xml b/docs/docbook/smbdotconf/logon/domainlogons.xml
new file mode 100644
index 0000000000..e45621e553
--- /dev/null
+++ b/docs/docbook/smbdotconf/logon/domainlogons.xml
@@ -0,0 +1,15 @@
+<samba:parameter name="domain logons"
+                 context="G"
+                 advanced="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+	<para>If set to <constant>yes</constant>, the Samba server will serve 
+	Windows 95/98 Domain logons for the <link linkend="WORKGROUP">
+	<parameter moreinfo="none">workgroup</parameter></link> it is in. Samba 2.2
+	has limited capability to act as a domain controller for Windows 
+	NT 4 Domains.  For more details on setting up this feature see 
+	the Samba-PDC-HOWTO included in the Samba documentation.</para>
+		
+	<para>Default: <command moreinfo="none">domain logons = no</command></para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/logon/logondrive.xml b/docs/docbook/smbdotconf/logon/logondrive.xml
new file mode 100644
index 0000000000..8c6be709bf
--- /dev/null
+++ b/docs/docbook/smbdotconf/logon/logondrive.xml
@@ -0,0 +1,18 @@
+<samba:parameter name="logon drive"
+                 context="G"
+                 advanced="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+	<para>This parameter specifies the local path to 
+	which the home directory will be connected (see <link linkend="LOGONHOME">
+	<parameter moreinfo="none">logon home</parameter></link>) 
+	and is only used by NT Workstations. </para>
+
+	<para>Note that this option is only useful if Samba is set up as a
+	logon server.</para>
+
+	<para>Default: <command moreinfo="none">logon drive = z:</command></para>
+
+	<para>Example: <command moreinfo="none">logon drive = h:</command></para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/logon/logonhome.xml b/docs/docbook/smbdotconf/logon/logonhome.xml
new file mode 100644
index 0000000000..05c69524c2
--- /dev/null
+++ b/docs/docbook/smbdotconf/logon/logonhome.xml
@@ -0,0 +1,45 @@
+<samba:parameter name="logon home"
+                 context="G"
+                 advanced="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+	<para>This parameter specifies the home directory 
+	location when a Win95/98 or NT Workstation logs into a Samba PDC.  
+	It allows you to do </para>
+		
+	<para><prompt moreinfo="none">C:\&gt;</prompt>
+	<userinput moreinfo="none">NET USE H: /HOME</userinput>
+	</para>
+
+	<para>from a command prompt, for example.</para>
+
+	<para>This option takes the standard substitutions, allowing 
+	you to have separate logon scripts for each user or machine.</para>
+
+	<para>This parameter can be used with Win9X workstations to ensure 
+	that roaming profiles are stored in a subdirectory of the user's 
+	home directory.  This is done in the following way:</para>
+
+	<para><command moreinfo="none">logon home = \\%N\%U\profile</command></para>
+
+	<para>This tells Samba to return the above string, with 
+	substitutions made when a client requests the info, generally 
+	in a NetUserGetInfo request.  Win9X clients truncate the info to
+	\\server\share when a user does <command moreinfo="none">net use /home</command>
+	but use the whole string when dealing with profiles.</para>
+
+	<para>Note that in prior versions of Samba, the <link linkend="LOGONPATH">
+	<parameter moreinfo="none">logon path</parameter></link> was returned rather than 
+	<parameter moreinfo="none">logon home</parameter>.  This broke <command 
+	moreinfo="none">net use /home</command> but allowed profiles outside the home directory.  
+	The current implementation is correct, and can be used for profiles if you use 
+	the above trick.</para>
+
+	<para>This option is only useful if Samba is set up as a logon 
+	server.</para>
+
+	<para>Default: <command moreinfo="none">logon home = &quot;\\%N\%U&quot;</command></para>
+
+	<para>Example: <command moreinfo="none">logon home = &quot;\\remote_smb_server\%U&quot;</command></para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/logon/logonpath.xml b/docs/docbook/smbdotconf/logon/logonpath.xml
new file mode 100644
index 0000000000..9abcf0d702
--- /dev/null
+++ b/docs/docbook/smbdotconf/logon/logonpath.xml
@@ -0,0 +1,49 @@
+<samba:parameter name="logon path"
+                 context="G"
+                 advanced="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+	<para>This parameter specifies the home directory 
+	where roaming profiles (NTuser.dat etc files for Windows NT) are 
+	stored.  Contrary to previous versions of these manual pages, it has 
+	nothing to do with Win 9X roaming profiles.  To find out how to 
+	handle roaming profiles for Win 9X system, see the <link linkend="LOGONHOME">
+	<parameter moreinfo="none">logon home</parameter></link> parameter.</para>
+
+	<para>This option takes the standard substitutions, allowing you 
+	to have separate logon scripts for each user or machine.  It also 
+	specifies the directory from which the &quot;Application Data&quot;, 
+	(<filename moreinfo="none">desktop</filename>, <filename moreinfo="none">start menu</filename>,
+	<filename moreinfo="none">network neighborhood</filename>, <filename moreinfo="none">programs</filename> 
+	and other folders, and their contents, are loaded and displayed on 
+	your Windows NT client.</para>
+
+	<para>The share and the path must be readable by the user for 
+	the preferences and directories to be loaded onto the Windows NT
+	client. The share must be writeable when the user logs in for the first
+	time, in order that the Windows NT client can create the NTuser.dat
+	and other directories.</para>
+
+	<para>Thereafter, the directories and any of the contents can, 
+	if required, be made read-only.  It is not advisable that the 
+	NTuser.dat file be made read-only - rename it to NTuser.man to 
+	achieve the desired effect (a <emphasis>MAN</emphasis>datory 
+	profile). </para>
+
+	<para>Windows clients can sometimes maintain a connection to 
+	the [homes] share, even though there is no user logged in.  
+	Therefore, it is vital that the logon path does not include a 
+	reference to the homes share (i.e. setting this parameter to
+	\%N\%U\profile_path will cause problems).</para>
+
+	<para>This option takes the standard substitutions, allowing 
+	you to have separate logon scripts for each user or machine.</para>
+
+	<para>Note that this option is only useful if Samba is set up 
+	as a logon server.</para>
+
+	<para>Default: <command moreinfo="none">logon path = \\%N\%U\profile</command></para>
+
+	<para>Example: <command moreinfo="none">logon path = \\PROFILESERVER\PROFILE\%U</command></para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/logon/logonscript.xml b/docs/docbook/smbdotconf/logon/logonscript.xml
new file mode 100644
index 0000000000..65b6253c0c
--- /dev/null
+++ b/docs/docbook/smbdotconf/logon/logonscript.xml
@@ -0,0 +1,44 @@
+<samba:parameter name="logon script"
+                 context="G"
+                 advanced="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+	<para>This parameter specifies the batch file (.bat) or 
+	NT command file (.cmd) to be downloaded and run on a machine when 
+	a user successfully logs in.  The file must contain the DOS 
+	style CR/LF line endings. Using a DOS-style editor to create the 
+	file is recommended.</para>
+		
+	<para>The script must be a relative path to the [netlogon] 
+	service.  If the [netlogon] service specifies a <link linkend="PATH">
+	<parameter moreinfo="none">path</parameter></link> of <filename 
+	moreinfo="none">/usr/local/samba/netlogon</filename>, and <command 
+	moreinfo="none">logon script = STARTUP.BAT</command>, then 
+	the file that will be downloaded is:</para>
+
+	<para><filename moreinfo="none">/usr/local/samba/netlogon/STARTUP.BAT</filename></para>
+
+	<para>The contents of the batch file are entirely your choice.  A 
+	suggested command would be to add <command moreinfo="none">NET TIME \\SERVER /SET 
+	/YES</command>, to force every machine to synchronize clocks with 
+	the same time server.  Another use would be to add <command moreinfo="none">NET USE 
+	U: \\SERVER\UTILS</command> for commonly used utilities, or <command moreinfo="none">
+	NET USE Q: \\SERVER\ISO9001_QA</command> for example.</para>
+
+	<para>Note that it is particularly important not to allow write 
+	access to the [netlogon] share, or to grant users write permission 
+	on the batch files in a secure environment, as this would allow 
+	the batch files to be arbitrarily modified and security to be 
+	breached.</para>
+
+	<para>This option takes the standard substitutions, allowing you 
+	to have separate logon scripts for each user or machine.</para>
+
+	<para>This option is only useful if Samba is set up as a logon 
+	server.</para>
+
+	<para>Default: <emphasis>no logon script defined</emphasis></para>
+
+	<para>Example: <command moreinfo="none">logon script = scripts\%U.bat</command></para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/logon/setprimarygroupscript.xml b/docs/docbook/smbdotconf/logon/setprimarygroupscript.xml
new file mode 100644
index 0000000000..c19c307417
--- /dev/null
+++ b/docs/docbook/smbdotconf/logon/setprimarygroupscript.xml
@@ -0,0 +1,21 @@
+<samba:parameter name="set primary group script"
+                 context="G"
+                 advanced="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+
+	<para>Thanks to the Posix subsystem in NT a Windows User has a
+	primary group in addition to the auxiliary groups.  This script
+	sets the primary group in the unix userdatase when an
+	administrator sets the primary group from the windows user
+	manager or when fetching a SAM with <command>net rpc
+	vampire</command>. <parameter>%u</parameter> will be replaced
+	with the user whose primary group is to be set. 
+	<parameter>%g</parameter> will be replaced with the group to
+	set.</para>
+
+	<para>Default: <emphasis>No default value</emphasis></para>
+
+	<para>Example: <command>set primary group script = /usr/sbin/usermod -g '%g' '%u'</command></para>
+</listitem>
+</samba:parameter>
diff --git a/docs/docbook/smbdotconf/logon/shutdownscript.xml b/docs/docbook/smbdotconf/logon/shutdownscript.xml
new file mode 100644
index 0000000000..0eaffea747
--- /dev/null
+++ b/docs/docbook/smbdotconf/logon/shutdownscript.xml
@@ -0,0 +1,59 @@
+<samba:parameter name="shutdown script"
+                 context="G"
+                 advanced="1" developer="1"
+                 xmlns:samba="http://samba.org/common">
+<listitem>
+	<para><emphasis>This parameter only exists in the HEAD cvs branch</emphasis>
+	This a full path name to a script called by <citerefentry><refentrytitle>smbd</refentrytitle>                                                    
+        <manvolnum>8</manvolnum></citerefentry> that should start a shutdown procedure.</para>
+
+	<para>This command will be run as the user connected to the server.</para>
+
+	<para>%m %t %r %f parameters are expanded:</para>
+	
+	<itemizedlist>
+		<listitem>
+			<para><parameter moreinfo="none">%m</parameter> will be substituted with the
+			shutdown message sent to the server.</para>
+		</listitem>
+		
+		<listitem>
+			<para><parameter moreinfo="none">%t</parameter> will be substituted with the
+			number of seconds to wait before effectively starting the
+			shutdown procedure.</para>
+		</listitem>
+		
+		<listitem>
+			<para><parameter moreinfo="none">%r</parameter> will be substituted with the
+			switch <emphasis>-r</emphasis>. It means reboot after shutdown
+			for NT.</para>
+		</listitem>
+		
+		<listitem>
+			<para><parameter moreinfo="none">%f</parameter> will be substituted with the
+			switch <emphasis>-f</emphasis>. It means force the shutdown
+			even if applications do not respond for NT.</para>
+		</listitem>
+	</itemizedlist>
+
+	<para>Default: <emphasis>None</emphasis>.</para>
+
+	<para>Example: <command moreinfo="none">abort shutdown script = /usr/local/samba/sbin/shutdown %m %t %r %f</command></para>
+
+	<para>Shutdown script example:
+<programlisting format="linespecific">
+#!/bin/bash
+		
+$time=0
+let &quot;time/60&quot;
+let &quot;time++&quot;
+
+/sbin/shutdown $3 $4 +$time $1 &amp;
+</programlisting>
+Shutdown does not return so we need to launch it in background.
+</para>
+
+	<para>See also <link linkend="ABORTSHUTDOWNSCRIPT">
+	<parameter moreinfo="none">abort shutdown script</parameter></link>.</para>
+</listitem>
+</samba:parameter>