documented "domain hosts allow/deny" parameters

(This used to be commit adf3119245148d517913efb549e8b88d5ba66b39)

1 files changed, 43 insertions, 7 deletions

diff --git a/docs/manpages/smb.conf.5 b/docs/manpages/smb.conf.5
index 92afa04aa5..5e9e31d524 100644
--- a/docs/manpages/smb.conf.5
+++ b/docs/manpages/smb.conf.5
@@ -353,16 +353,24 @@ dfree command
 
 dns proxy
 
+domain allow hosts
+
 domain controller
 
-domain sid
+domain deny hosts
 
 domain group
 
+domain hosts allow
+
+domain hosts deny
+
 domain logons
 
 domain master
 
+domain sid
+
 encrypt passwords
 
 getwd cache
@@ -1259,17 +1267,33 @@ NT Domain groups is presently known.
 .B Example:
  	 domain groups = 776 1024/7 777
 
-.SS domain sid (G)
+.SS domain hosts allow (G)
+A synonym for this parameter is 'domain allow hosts'.
 
-Specifies the SID when using Samba as a Logon Server for NT Workstations.
-The format of SIDs supported by samba at present is S-1-N-nnn-nnn-nnn-nnn-nnn.
-The number N indicates the number of sub-authorities (nnn).
+This parameter is a comma delimited set of hosts which are permitted to access
+a Domain. 
+
+Note that access still requires suitable user-level passwords for the Domain.
+See 'allow hosts' for a description of the syntax of this parameter.
 
 .B Default:
-	 domain sid = none
+ 	none (i.e., all hosts permitted login access to the domain)
 
 .B Example:
- 	 domain sid = S-1-5-21-123-456-789-123
+ 	domain hosts allow = 150.203.5. myhost.mynet.edu.au
+
+.SS domain hosts deny (G)
+A synonym for this parameter is 'domain deny hosts'.
+
+The opposite of 'domain hosts deny' - hosts listed here are NOT permitted
+to Login to the Domain from those NT Workstations.  Where the lists conflict,
+the 'allow' list takes precedence.
+
+.B Default:
+ 	none (i.e., no hosts specifically excluded login access to the domain)
+
+.B Example:
+  	domain hosts deny = guest_wksta 150.203.4. badhost.mynet.edu.au
 
 .SS domain logons (G)
 
@@ -1292,6 +1316,18 @@ broadcast-isolated subnet.
 .B Default:
  	domain master = no
 
+.SS domain sid (G)
+
+Specifies the SID when using Samba as a Logon Server for NT Workstations.
+The format of SIDs supported by samba at present is S-1-N-nnn-nnn-nnn-nnn-nnn.
+The number N indicates the number of sub-authorities (nnn).
+
+.B Default:
+	 domain sid = none
+
+.B Example:
+ 	 domain sid = S-1-5-21-123-456-789-123
+
 .SS dont descend (S)
 There are certain directories on some systems (eg., the /proc tree under
 Linux) that are either not of interest to clients or are infinitely deep