diff options
Diffstat (limited to 'docs-xml/using_samba/appf.xml')
| -rw-r--r-- | docs-xml/using_samba/appf.xml | 250 |
1 files changed, 250 insertions, 0 deletions
diff --git a/docs-xml/using_samba/appf.xml b/docs-xml/using_samba/appf.xml new file mode 100644 index 0000000000..b4965f0d13 --- /dev/null +++ b/docs-xml/using_samba/appf.xml @@ -0,0 +1,250 @@ +<appendix label="F" id="SAMBA-AP-F"> +<title>Sample Configuration File</title> + + + + +<para> +<indexterm id="appf-idx-993481-0" class="startofrange"><primary>configuration files</primary><secondary>sample of</secondary></indexterm>This appendix gives an example of a production <filename>smb.conf</filename> file and looks at how many of the options are used in practice. The following is a slightly disguised version of one we used at a corporation with five Linux servers, five Windows for Workgroups clients and three NT Workstation clients:</para> + + +<programlisting># smb.conf -- File Server System for: 1 Example.COM BSC & Management Office +[globals] + workgroup = 1EG_BSC + interfaces = 10.10.1.14/24</programlisting> + + +<para>We provide this service on only one of the machine's interfaces. The <literal>interfaces</literal> option sets its address and netmask, where <literal>/24</literal> is the same as using the netmask 255.255.255.0:</para> + + +<programlisting>comment = Samba ver. %v + preexec = csh -c `echo /usr/samba/bin/smbclient \ + -M %m -I %I` &</programlisting> + + +<para>We use the <command>preexec</command> command to log information about all connections by machine name (<literal>%m</literal>) and IP address (<literal>%I)</literal>:</para> + + +<programlisting># smbstatus will output various info on current status + status = yes + browseable = yes + printing = bsd + + # the username that will be used for access to services + # specified with 'guest = ok' + guest account = samba</programlisting> + + +<para>The default guest account was <literal>nobody</literal>, uid -1, which produced log messages on one of our machines saying "your server is being unfriendly," so we created a specific Samba guest account for browsing and printing:</para> + + +<programlisting># superuser account - admin privilages to shares, with no + # restrictions + # WARNING - use this with care: files can be modified, + # regardless of file permissions + admin users = root + + # who is NOT allowed to connect to ANY service + invalid users = @wheel, mail, deamon, adt</programlisting> + + +<para>Daemons can't use Samba, only people. The <literal>invalid</literal> <literal>users</literal> option closes a security hole; it prevents intruders from breaking in by pretending to be a daemon process.</para> + + +<programlisting># hosts that are ALLOWED or DENIED from connecting to ANY service + hosts allow = 10.10.1. + hosts deny = 10.10.1.6 + + # where the lock files will be located + lock directory = /var/lock/samba/locks + + # debug log files + # %m = separate log for each NetBIOS name (each machine) + log file = /var/log/samba/log.%m + + # We send priority 0, 1 and 2 messages to the system logs + syslog = 2 + + # If a WinPopup message is sent to the server, + # redirect it to a user via e-mail + + message command = /bin/mail -s 'message from #% on %m' \ + pkelly < %s; rm %s + +# --------------------------------------------------- +# [globals] Performance Tuning +# --------------------------------------------------- + + # caching algorithm to reduce time doing getwd() calls. + getwd cache = yes + + socket options = TCP_NODELAY + + # tell the server whether the client is present and + # responding in seconds + keep alive = 60 + + # num minutes of inactivity before a connection is + # considered dead + dead time = 30 + + read prediction = yes + share modes = yes + max xmit = 17384 + read size = 512</programlisting> + + +<para>The <literal>share</literal> <literal>modes</literal>, <literal>max</literal>, <literal>xinit</literal>, and <literal>read</literal> <literal>size</literal> options are machine-specific (see <link linkend="SAMBA-AP-B">Appendix B</link>):</para> + + +<programlisting># locking is done by the server + locking = yes + + # control whether dos style attributes should be mapped + # to unix execute bits + map hidden = yes + map archive = yes + map system = yes</programlisting> + + +<para>The three <literal>map</literal> options will work only on shares with a create mode that includes the execute bits (0111). Our <literal>homes</literal> and <literal>printers</literal> shares won't honor them, but the [<literal>www]</literal> share will:</para> + + +<programlisting># --------------------------------------------------------- +# [globals] Security and Domain Logon Services +# --------------------------------------------------------- +# connections are made with UID and GID, not as shares + security = user + +# boolean variable that controls whether passwords +# will be encrypted + encrypt passwords = yes + passwd chat = "*New password:*" %n\r "*New password (again):*" %n\r \ "*Password changed*" + passwd program = /usr/bin/passwd %u + +# Always become the local master browser + domain master = yes + preferred master = yes + os level = 34 + +# For domain logons to work correctly. Samba acts as a +# primary domain controller. + domain logons = yes + +# Logon script to run for user off the server each time +# username (%U) logs in. Set the time, connect to shares, +# virus checks, etc. + logon script = scripts\%U.bat + +[netlogon] + comment = "Domain Logon Services" + path = /u/netlogon + writable = yes + create mode = 444 + guest ok = no + volume = "Network"</programlisting> + + +<para>This share, discussed in <link linkend="SAMBA-CH-6">Chapter 6</link>, is required for Samba to work smoothly in a Windows NT domain:</para> + + +<programlisting># ----------------------------------------------------------- +# [homes] User Home Directories +# ----------------------------------------------------------- +[homes] + comment = "Home Directory for : %u " + path = /u/users/%u</programlisting> + + +<para>The password file of the Samba server specifies each person's home directory as <emphasis>/home/</emphasis><replaceable>machine_name</replaceable><emphasis>/</emphasis><replaceable>person</replaceable>, which NFS converts to point to the actual physicl location under <emphasis>/u/users</emphasis>. The <literal>path</literal> option in the <literal>[homes]</literal> share tells Samba the actual (non-NFS) location:</para> + + +<programlisting>guest ok = no + read only = no + create mode = 644 + writable = yes + browseable = no + +# ----------------------------------------------------------- +# [printers] System Printers +# ----------------------------------------------------------- +[printers] + comment = "Printers" + path = /var/spool/lpd/samba + printcap name = /etc/printcap + printable = yes + public = no + writable = no + + lpq command = /usr/bin/lpq -P%p + lprm command = /usr/bin/lprm -P%p %j + lppause command = /usr/sbin/lpc stop %p + lpresume command = /usr/sbin/lpc start %p + + create mode = 0700 + + browseable = no + load printers = yes + +# ----------------------------------------------------------- +# Specific Descriptions: [programs] [data] [retail] +# ----------------------------------------------------------- +[programs] + comment = "Shared Programs %T" + volume = "programs"</programlisting> + + +<para>Shared Programs shows up in the Network Neighborhood, and <literal>programs</literal> is the volume name you specify when an installation program wants to know the label of the CD-ROM from which it thinks it's loading:</para> + + +<programlisting>path = /u/programs + public = yes + writeable = yes + printable = no + create mode = 664 +[cdrom] + comment = "Unix CDROM" + path = /u/cdrom + public = no + writeable = no + printable = no + volume = "cdrom" + +[data] + comment = "Data Directories %T" + path = /u/data + public = no + create mode = 770 + writeable = yes + volume = "data" + +[nt4] + comment = "NT4 Server" + path = /u/systems/nt4 + public = yes + create mode = 770 + writeable = yes + volume = "nt4_server" + +[www] + comment = "WWW System" + path = /usr/www/http + public = yes + create mode = 775 + writeable = yes + volume = "www_system"</programlisting> + + +<para>The <literal>[www]</literal> share is the directory used on the Unix server to serve web pages. Samba makes the directory available to local PC users so the art department can update web pages.</para> + + + + + + + + + + + +</appendix> |