Adding Buchan Milne's updates.

(This used to be commit d816c35c1d8db343c76a32a6d01952d2c192b092)

1 files changed, 191 insertions, 45 deletions

diff --git a/packaging/Mandrake/smb.conf b/packaging/Mandrake/smb.conf
index a14e90ec16..f68d48cb4b 100644
--- a/packaging/Mandrake/smb.conf
+++ b/packaging/Mandrake/smb.conf
@@ -1,3 +1,4 @@
+
 # This is the main Samba configuration file. You should read the
 # smb.conf(5) manual page in order to understand the options listed
 # here. Samba has a huge number of configurable options (perhaps too
@@ -14,32 +15,22 @@
 #======================= Global Settings =====================================
 [global]
 
+# 1. Server Naming Options:
 # workgroup = NT-Domain-Name or Workgroup-Name
    workgroup = MDKGROUP
 
+# netbios name is the name you will see in "Network Neighbourhood",
+# but defaults to your hostname
+;  netbios name = <name_of_this_server>
+
 # server string is the equivalent of the NT Description field
    server string = Samba Server %v
 
-# This option is important for security. It allows you to restrict
-# connections to machines which are on your local network. The
-# following example restricts access to two C class networks and
-# the "loopback" interface. For more examples of the syntax see
-# the smb.conf man page
-;   hosts allow = 192.168.1. 192.168.2. 127.
-
-# Enabling internationalization:
-# you can match a Windows code page with a UNIX character set.
-# Windows: 437 (US), 737 (GREEK), 850 (Latin1 - Western European),
-# 852 (Eastern Eu.), 861 (Icelandic), 932 (Cyrillic - Russian),
-# 936 (Japanese - Shift-JIS), 936 (Simpl. Chinese), 949 (Korean Hangul),
-# 950 (Trad. Chin.).
-# UNIX: ISO8859-1 (Western European), ISO8859-2 (Eastern Eu.),
-# ISO8859-5 (Russian Cyrillic), KOI8-R (Alt-Russ. Cyril.)
-# This is an example for french users:
-;   client code page = 850
-;   character set = ISO8859-1
-
+# Message command is run by samba when a "popup" message is sent to it.
+# The example below is for use with LinPopUp:
+; message command = /usr/bin/linpopup "%f" "%m" %s; rm %s
 
+# 2. Printing Options:
 # CHANGES TO ENABLE PRINTING ON ALL CUPS PRINTERS IN THE NETWORK
 # (as cups is now used in linux-mandrake 7.2 by default)
 # if you want to automatically load your printer list rather
@@ -52,11 +43,18 @@
 # bsd, sysv, plp, lprng, aix, hpux, qnx, cups
    printing = cups
 
-
-# Uncomment this if you want a guest account, you must add this to /etc/passwd
-# otherwise the user "nobody" is used
-;  guest account = pcguest
-
+# Samba 2.2 supports the Windows NT-style point-and-print feature. To
+# use this, you need to be able to upload print drivers to the samba
+# server. The printer admins (or root) may install drivers onto samba.
+# Note that this feature uses the print$ share, so you will need to 
+# enable it below.
+# This parameter works like domain admin group:
+# printer admin = @<group> <user>
+;   printer admin = @adm
+# This should work well for winbind:
+;   printer admin = @"Domain Admins"
+
+# 3. Logging Options:
 # this tells Samba to use a separate log file for each machine
 # that connects
    log file = /var/log/samba/log.%m
@@ -64,11 +62,29 @@
 # Put a capping on the size of the log files (in Kb).
    max log size = 50
 
+# Set the log (verbosity) level (0 <= log level <= 10)
+; log level = 3
+
+# 4. Security and Domain Membership Options:
+# This option is important for security. It allows you to restrict
+# connections to machines which are on your local network. The
+# following example restricts access to two C class networks and
+# the "loopback" interface. For more examples of the syntax see
+# the smb.conf man page. Do not enable this if (tcp/ip) name resolution does
+# not work for all the hosts in your network.
+;   hosts allow = 192.168.1. 192.168.2. 127.
+
+# Uncomment this if you want a guest account, you must add this to /etc/passwd
+# otherwise the user "nobody" is used
+;  guest account = pcguest
+
 # Security mode. Most people will want user level security. See
 # security_level.txt for details.
    security = user
-# Use password server option only with security = server
+# Use password server option only with security = server or security = domain
+# When using security = domain, you should use password server = *
 ;   password server = <NT-Server-Name>
+;   password server = *
 
 # Password Level allows matching of _n_ characters of the password for
 # all combinations of upper and lower case.
@@ -78,27 +94,69 @@
 # You may wish to use password encryption. Please read
 # ENCRYPTION.txt, Win95.txt and WinNT.txt in the Samba documentation.
 # Do not enable this option unless you have read those documents
-;  encrypt passwords = yes
-;  smb passwd file = /etc/samba/private/smbpasswd
+# Encrypted passwords are required for any use of samba in a Windows NT domain
+# The smbpasswd file is only required by a server doing authentication, thus
+# members of a domain do not need one.
+  encrypt passwords = yes
+  smb passwd file = /etc/samba/smbpasswd
 
 # The following are needed to allow password changing from Windows to
-# update the Linux sytsem password also.
+# also update the Linux system password.
 # NOTE: Use these with 'encrypt passwords' and 'smb passwd file' above.
 # NOTE2: You do NOT need these to allow workstations to change only
 #        the encrypted SMB passwords. They allow the Unix password
 #        to be kept in sync with the SMB password.
 ;  unix password sync = Yes
+# You either need to setup a passwd program and passwd chat, or
+# enable pam password change
+;  pam password change = yes
 ;  passwd program = /usr/bin/passwd %u
-;  passwd chat = *New*UNIX*password* %n\n *ReType*new*UNIX*password* %n\n *passwd:*all*authentication*tokens*updated*successfully*
+;  passwd chat = *New*UNIX*password* %n\n *ReType*new*UNIX*password* %n\n
+;*passwd:*all*authentication*tokens*updated*successfully*
 
 # Unix users can map to different SMB User names
-;  username map = /etc/smbusers
+;  username map = /etc/samba/smbusers
 
 # Using the following line enables you to customise your configuration
 # on a per machine basis. The %m gets replaced with the netbios name
 # of the machine that is connecting
-;   include = /etc/smb.conf.%m
+;   include = /etc/samba/smb.conf.%m
+
+# Options for using winbind. Winbind allows you to do all account and
+# authentication from a Windows or samba domain controller, creating
+# accounts on the fly, and maintaining a mapping of Windows RIDs to unix uid's 
+# and gid's. winbind uid and winbind gid are the only required parameters.
+#
+# winbind uid is the range of uid's winbind can use when mapping RIDs to uid's
+;  winbind uid = 10000-20000
+#
+# winbind gid is the range of uid's winbind can use when mapping RIDs to gid's
+;  winbind gid = 10000-20000
+#
+# winbind separator is the character a user must use between their domain
+# name and username, defaults to "\"
+;  winbind separator = +
+#
+# winbind use default domain allows you to have winbind return usernames
+# in the form user instead of DOMAIN+user for the domain listed in the
+# workgroup parameter.
+;  winbind use default domain = yes
+#
+# template homedir determines the home directory for winbind users, with 
+# %D expanding to their domain name and %U expanding to their username:
+;  template homedir = /home/%D/%U
+
+# When using winbind, you may want to have samba create home directories
+# on the fly for authenticated users. Ensure that /etc/pam.d/samba is
+# using 'service=system-auth-winbind' in pam_stack modules, and then
+# enable obedience of pam restrictions below:
+;  obey pam restrictions = yes
+
+#
+# template shell determines the shell users authenticated by winbind get
+;  template shell = /bin/bash
 
+# 5. Browser Control and Networking Options:
 # Most people will find that this option gives better performance.
 # See speed.txt and the manual pages for details
    socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
@@ -110,12 +168,11 @@
 
 # Configure remote browse list synchronisation here
 #  request announcement to, or browse list sync from:
-#	a specific host or from / to a whole subnet (see below)
+#       a specific host or from / to a whole subnet (see below)
 ;   remote browse sync = 192.168.3.25 192.168.5.255
 # Cause this host to announce itself to local subnets here
 ;   remote announce = 192.168.1.255 192.168.2.44
 
-# Browser Control Options:
 # set local master to no if you don't want Samba to become a master
 # browser on your network. Otherwise the normal election rules apply
 ;   local master = no
@@ -133,8 +190,9 @@
 # and gives it a slightly higher chance of winning the election
 ;   preferred master = yes
 
+# 6. Domain Control Options:
 # Enable this if you want Samba to be a domain logon server for 
-# Windows95 workstations. 
+# Windows95 workstations or Primary Domain Controller for WinNT and Win2k
 ;   domain logons = yes
 
 # if you enable domain logons then you may want a per-machine or
@@ -144,11 +202,51 @@
 # run a specific logon batch file per username
 ;   logon script = %U.bat
 
-# Where to store roving profiles (only for Win95 and WinNT)
+# Where to store roaming profiles for WinNT and Win2k
 #        %L substitutes for this servers netbios name, %U is username
 #        You must uncomment the [Profiles] share below
 ;   logon path = \\%L\Profiles\%U
 
+# Where to store roaming profiles for Win9x. Be careful with this as it also
+# impacts where Win2k finds it's /HOME share
+; logon home = \\%L\%U\.profile
+
+# The add user script is used by a domain member to add local user accounts
+# that have been authenticated by the domain controller, or by the domain
+# controller to add local machine accounts when adding machines to the domain.
+# The script must work from the command line when replacing the macros,
+# or the operation will fail. Check that groups exist if forcing a group.
+# Script for domain controller for adding machines:
+; add user script = /usr/sbin/useradd -d /dev/null -g machines -c 'Machine Account' -s /bin/false -M %u
+# Script for domain controller with LDAP backend for adding machines (please
+# configure in /etc/samba/smbldap_conf.pm first):
+; add user script = /usr/share/samba/scripts/smbldap-useradd.pl -w -d /dev/null -g machines -c 'Machine Account' -s /bin/false %u
+# Script for domain member for adding local accounts for authenticated users:
+; add user script = /usr/sbin/useradd -s /bin/false %u
+
+# Domain groups:
+# domain admin group is a list of unix users or groups who are made members
+# of the Domain Admin group
+; domain admin group = root @wheel
+#
+# domain guest groups is a list of unix users or groups who are made members
+# of the Domain Guests group
+; domain guest group = nobody @guest
+
+# LDAP configuration for Domain Controlling:
+# The account (dn) that samba uses to access the LDAP server
+# This account needs to have write access to the LDAP tree
+# You will need to give samba the password for this dn, by 
+# running 'smbpasswd -w mypassword'
+; ldap admin dn = cn=root,dc=mydomain,dc=com
+; ldap ssl = start_tls
+# start_tls should run on 389, but samba defaults incorrectly to 636
+; ldap port = 389
+; ldap suffix = dc=mydomain,dc=com
+; ldap server = ldap.mydomain.com
+
+
+# 7. Name Resolution Options:
 # All NetBIOS names must be resolved to IP Addresses
 # 'Name Resolve Order' allows the named resolution mechanism to be specified
 # the default order is "host lmhosts wins bcast". "host" means use the unix
@@ -167,12 +265,12 @@
 ;   wins support = yes
 
 # WINS Server - Tells the NMBD components of Samba to be a WINS Client
-#	Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
+#       Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
 ;   wins server = w.x.y.z
 
 # WINS Proxy - Tells Samba to answer name resolution queries on
 # behalf of a non WINS capable client, for this to work there must be
-# at least one	WINS Server on the network. The default is NO.
+# at least one  WINS Server on the network. The default is NO.
 ;   wins proxy = yes
 
 # DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
@@ -180,6 +278,7 @@
 # this has been changed in version 1.9.18 to no.
    dns proxy = no 
 
+# 8. File Naming Options:
 # Case Preservation can be handy - system default is _no_
 # NOTE: These can be set on a per share basis
 ;  preserve case = no
@@ -189,11 +288,31 @@
 # Be very careful with case sensitivity - it can break things!
 ;  case sensitive = no
 
+# Enabling internationalization:
+# you can match a Windows code page with a UNIX character set.
+# Windows: 437 (US), 737 (GREEK), 850 (Latin1 - Western European),
+# 852 (Eastern Eu.), 861 (Icelandic), 932 (Cyrillic - Russian),
+# 936 (Japanese - Shift-JIS), 936 (Simpl. Chinese), 949 (Korean Hangul),
+# 950 (Trad. Chin.).
+# UNIX: ISO8859-1 (Western European), ISO8859-2 (Eastern Eu.),
+# ISO8859-5 (Russian Cyrillic), KOI8-R (Alt-Russ. Cyril.)
+# This is an example for french users:
+;   client code page = 850
+;   character set = ISO8859-1
+
+
 #============================ Share Definitions ==============================
 [homes]
    comment = Home Directories
    browseable = no
    writable = yes
+# You can enable VFS recycle bin on a per share basis:
+# Uncomment the next 2 lines (make sure you create a
+# .recycle folder in the base of the share and ensure
+# all users will have write access to it. See
+# examples/VFS/recycle/REAME in samba-doc for details
+;   vfs object = /usr/lib/samba/vfs/recycle.so
+;   vfs options= /etc/samba/recycle.conf
 
 # Un-comment the following and create the netlogon directory for Domain Logons
 ; [netlogon]
@@ -201,11 +320,10 @@
 ;   path = /var/lib/samba/netlogon
 ;   guest ok = yes
 ;   writable = no
-;   share modes = no
 
 #Uncomment the following 2 lines if you would like your login scripts to
 #be created dynamically by ntlogon (check that you have it in the correct
-#locationn (the default of the ntlogon rpm available in contribs)
+#location (the default of the ntlogon rpm available in contribs)
 ;root preexec = /usr/bin/ntlogon -u %U -g %G -o %a -d /var/lib/samba/netlogon
 ;root postexec = rm -f /var/lib/samba/netlogon/%U.bat
 
@@ -236,10 +354,36 @@
 # =====================================
 # print command: see above for details.
 # =====================================
-   print command = lpr-cups -P %p -o raw %s -r	 # using client side printer drivers.
+   print command = lpr-cups -P %p -o raw %s -r   # using client side printer drivers.
 ;   print command = lpr-cups -P %p %s # using cups own drivers (use generic PostScript on clients).
-   lpq command = lpstat -o %p
-   lprm command = cancel %p-%j
+# The following two commands are the samba defaults for printing=cups
+# change them only if you need different options:
+;   lpq command = lpq -P %p
+;   lprm command = cancel %p-%j
+
+# This share is used for Windows NT-style point-and-print support.
+# To be able to install drivers, you need to be either root, or listed
+# in the printer admin parameter above. Note that you also need write access
+# to the directory and share definition to be able to upload the drivers.
+# For more information on this, please see the Printing Support Section of
+# /usr/share/doc/samba-<version>/docs/Samba-HOWTO-Collection.pdf 
+[print$]
+   path = /var/lib/samba/printers
+   browseable = yes
+   read only = yes
+   write list = @adm root
+
+# A useful application of samba is to make a PDF-generation service
+# To streamline this, install windows postscript drivers (preferably colour)
+# on the samba server, so that clients can automatically install them.
+
+[pdf-generator]
+   path = /var/tmp
+   guest ok = No
+   printable = Yes
+   comment = PDF Generator (only valid users)
+   #print command = /usr/share/samba/scripts/print-pdf file path win_path recipient IP &
+   print command = /usr/share/samba/scripts/print-pdf %s ~%u \\\\\\\\%L\\\\%u %m %I &
 
 # This one is useful for people to share files
 ;[tmp]
@@ -256,10 +400,13 @@
 ;   public = yes
 ;   writable = no
 ;   write list = @staff
+# Audited directory through experimental VFS audit.so module:
+# Uncomment next line.
+;   vfs object = /usr/lib/samba/vfs/audit.so
 
 # Other examples. 
 #
-# A private printer, usable only by fred. Spool data will be placed in fred's
+# A private printer, usable only by Fred. Spool data will be placed in Fred's
 # home directory. Note that fred must have write access to the spool directory,
 # wherever it is.
 ;[fredsprn]
@@ -271,7 +418,7 @@
 ;   writable = no
 ;   printable = yes
 
-# A private directory, usable only by fred. Note that fred requires write
+# A private directory, usable only by Fred. Note that Fred requires write
 # access to the directory.
 ;[fredsdir]
 ;   comment = Fred's Service
@@ -317,4 +464,3 @@
 ;   printable = no
 ;   create mask = 0765
 
-