From e4840f0db911eaf3aee1195030c6efca70d78f14 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Thu, 6 Dec 2001 07:37:58 +0000 Subject: merge from 2.2 (This used to be commit c5ee06b7c8fc9f1fec679acc7d7f47f333707456) --- docs/docbook/manpages/nmbd.8.sgml | 21 +- docs/docbook/manpages/rpcclient.1.sgml | 2 +- docs/docbook/manpages/smb.conf.5.sgml | 413 +++++++++++++++++++++++--------- docs/docbook/manpages/smbcontrol.1.sgml | 2 +- docs/docbook/manpages/smbd.8.sgml | 19 +- docs/docbook/manpages/smbpasswd.8.sgml | 17 ++ docs/docbook/manpages/winbindd.8.sgml | 9 + 7 files changed, 343 insertions(+), 140 deletions(-) (limited to 'docs/docbook/manpages') diff --git a/docs/docbook/manpages/nmbd.8.sgml b/docs/docbook/manpages/nmbd.8.sgml index 2d873a1e40..edfa9b4fca 100644 --- a/docs/docbook/manpages/nmbd.8.sgml +++ b/docs/docbook/manpages/nmbd.8.sgml @@ -24,7 +24,7 @@ -V -d <debug level> -H <lmhosts file> - -l <log file> + -l <log directory> -n <primary netbios name> -p <port number> -s <configuration file> @@ -162,17 +162,14 @@ - -l <log file> - The -l parameter specifies a path - and base filename into which operational data from - the running nmbd server will - be logged. The actual log file name is generated by - appending the extension ".nmb" to the specified base - name. For example, if the name specified was "log" - then the file log.nmb would contain the debugging data. - - The default log file path is compiled into Samba as - part of the build process. Common defaults are + -l <log directory> + The -l parameter specifies a directory + into which the "log.nmbd" log file will be created + for operational data from the running + nmbd server. + + The default log directory is compiled into Samba + as part of the build process. Common defaults are /usr/local/samba/var/log.nmb, /usr/samba/var/log.nmb or /var/log/log.nmb. diff --git a/docs/docbook/manpages/rpcclient.1.sgml b/docs/docbook/manpages/rpcclient.1.sgml index 6093d6dc42..f32e2f9ece 100644 --- a/docs/docbook/manpages/rpcclient.1.sgml +++ b/docs/docbook/manpages/rpcclient.1.sgml @@ -135,7 +135,7 @@ -U username[%password] Sets the SMB username or username and password. - If %password is not specified, The user will be prompted. The + If %password is not specified, the user will be prompted. The client will first check the USER environment variable, then the LOGNAME variable and if either exists, the string is uppercased. If these environmental variables are not diff --git a/docs/docbook/manpages/smb.conf.5.sgml b/docs/docbook/manpages/smb.conf.5.sgml index b3be01677b..a7328e7cf6 100644 --- a/docs/docbook/manpages/smb.conf.5.sgml +++ b/docs/docbook/manpages/smb.conf.5.sgml @@ -436,8 +436,8 @@ %a the architecture of the remote machine. Only some are recognized, and those may not be - 100% reliable. It currently recognizes Samba, WfWg, - WinNT and Win95. Anything else will be known as + 100% reliable. It currently recognizes Samba, WfWg, Win95, + WinNT and Win2k. Anything else will be known as "UNKNOWN". If it gets it wrong then sending a level 3 log to samba@samba.org should allow it to be fixed. @@ -636,6 +636,14 @@ kernel oplocks lanman auth large readwrite + + ldap admin dn + ldap filter + ldap port + ldap server + ldap ssl + ldap suffix + lm announce lm interval load printers @@ -671,7 +679,6 @@ netbios name netbios scope nis homedir - nt acl support nt pipe support nt smb support null passwords @@ -710,6 +717,7 @@ socket address socket options source environment + ssl ssl CA certDir ssl CA certFile @@ -717,6 +725,9 @@ ssl client cert ssl client key ssl compatibility + ssl egd socket + ssl entropy bytes + ssl entropy file ssl hosts ssl hosts resign ssl require clientcert @@ -724,6 +735,7 @@ ssl server cert ssl server key ssl version + stat cache stat cache size strip dot @@ -737,6 +749,7 @@ total print jobs unix password sync update encrypted + use mmap use rhosts username level username map @@ -831,6 +844,7 @@ max print jobs min print space msdfs root + nt acl support only guest only user oplock contention limit @@ -863,6 +877,7 @@ set directory short preserve case status + strict allocate strict locking strict sync sync always @@ -2331,8 +2346,8 @@ workgroup it is in. Samba 2.2 also has limited capability to act as a domain controller for Windows NT 4 Domains. For more details on setting up this feature see - the file DOMAINS.txt in the Samba documentation directory docs/ - shipped with the source code. + the Samba-PDC-HOWTO included in the htmldocs/ + directory shipped with the source code. Default: domain logons = no @@ -2636,12 +2651,6 @@ mode after the mask set in the create mask parameter is applied. - Note that by default this parameter does not apply to permissions - set by Windows NT/2000 ACL editors. If the administrator wishes to enforce - this mask on access control lists also, they need to set the restrict acl with - mask to true. - See also the parameter create mask for details on masking mode bits on files. @@ -2670,12 +2679,6 @@ mask in the parameter directory mask is applied. - Note that by default this parameter does not apply to permissions - set by Windows NT/2000 ACL editors. If the administrator wishes to enforce - this mask on access control lists also, they need to set the restrict acl with - mask to true. - See also the parameter directory mask for details on masking mode bits on created directories. @@ -3388,6 +3391,150 @@ + + ldap admin dn (G) + This parameter is only available if Samba has been + configure to include the --with-ldapsam option + at compile time. This option should be considered experimental and + under active development. + + + + The ldap admin dn defines the Distinguished + Name (DN) name used by Samba to contact the ldap + server when retreiving user account information. The ldap + admin dn is used in conjunction with the admin dn password + stored in the private/secrets.tdb file. See the + smbpasswd(8) man + page for more information on how to accmplish this. + + + + Default : none + + + + + + + + ldap filter (G) + This parameter is only available if Samba has been + configure to include the --with-ldapsam option + at compile time. This option should be considered experimental and + under active development. + + + + This parameter specifies the RFC 2254 compliant LDAP search filter. + The default is to match the login name with the uid + attribute for all entries matching the sambaAccount + objectclass. Note that this filter should only return one entry. + + + + Default : ldap filter = (&(uid=%u)(objectclass=sambaAccount)) + + + + + + + + ldap port (G) + This parameter is only available if Samba has been + configure to include the --with-ldapsam option + at compile time. This option should be considered experimental and + under active development. + + + + This option is used to control the tcp port number used to contact + the ldap server. + The default is to use the stand LDAP port 389. + + + Default : ldap port = 389 + + + + + + + + ldap server (G) + This parameter is only available if Samba has been + configure to include the --with-ldapsam option + at compile time. This option should be considered experimental and + under active development. + + + + This parameter should contains the FQDN of the ldap directory + server which should be queried to locate user account information. + + + + + Default : ldap server = localhost + + + + + + + + ldap ssl (G) + This parameter is only available if Samba has been + configure to include the --with-ldapsam option + at compile time. This option should be considered experimental and + under active development. + + + + This option is used to define whether or not Samba should + use SSL when connecting to the ldap + server. This is NOT related to + Samba SSL support which is enabled by specifying the + --with-ssl option to the configure + script (see ssl). + + + + The ldap ssl can be set to one of three values: + (a) on - Always use SSL when contacting the + ldap server, (b) off - + Never use SSL when querying the directory, or (c) start + tls - Use the LDAPv3 StartTLS extended operation + (RFC2830) for communicating with the directory server. + + + + Default : ldap ssl = off + + + + + + + + ldap suffix (G) + This parameter is only available if Samba has been + configure to include the --with-ldapsam option + at compile time. This option should be considered experimental and + under active development. + + + + + Default : none + + + + + + + @@ -4615,7 +4762,7 @@ msdfs root (S) This boolean parameter is only available if Samba is configured and compiled with the - --with-msdfs option. If set to yes>, + --with-msdfs option. If set to yes, Samba treats the share as a Dfs root and allows clients to browse the distributed file system tree rooted at the share directory. Dfs links are specified in the share directory by symbolic @@ -4654,7 +4801,7 @@ , NIS, or DNS lookups. This method of name resolution is operating system depended for instance on IRIX or Solaris this may be controlled by the /etc/nsswitch.conf - file). Note that this method is only used if the NetBIOS name + file. Note that this method is only used if the NetBIOS name type being queried is the 0x20 (server) name type, otherwise it is ignored. @@ -4768,10 +4915,12 @@ - nt acl support (G) + nt acl support (S) This boolean parameter controls whether smbd(8) will attempt to map - UNIX permissions into Windows NT access control lists. + UNIX permissions into Windows NT access control lists. + This parameter was formally a global parameter in releases + prior to 2.2.2. Default: nt acl support = yes @@ -5080,7 +5229,7 @@ If the pam password change parameter is set to true, the chat pairs - may be matched in any order, and sucess is determined by the PAM result, + may be matched in any order, and success is determined by the PAM result, not any particular output. The \n macro is ignored for PAM conversions. @@ -5202,7 +5351,7 @@ made - the password as is and the password in all-lower case. Default: password level = 0 - Example: password level = 4 + Example: password level = 4 @@ -5511,8 +5660,9 @@ and %f will be replaced by the appropriate spool file name, and all occurrences of %p will be replaced by the appropriate printer name. The - spool file name is generated automatically by the server, the printer - name is discussed below. + spool file name is generated automatically by the server. The + %J macro can be used to access the job + name as transmitted by the client. The print command MUST contain at least one occurrence of %s or %f @@ -5551,7 +5701,7 @@ or PLP : print command = lpr -r -P%p %s - For printing = SYS or HPUX : + For printing = SYSV or HPUX : print command = lp -c -d%p %s; rm %s For printing = SOFTQ : @@ -5803,7 +5953,7 @@ lprm command if specified in the [global] section. - Currently eight printing styles are supported. They are + Currently nine printing styles are supported. They are BSD, AIX, LPRNG, PLP, SYSV, HPUX, @@ -6076,34 +6226,6 @@ - - restrict acl with mask (S) - This is a boolean parameter. If set to false (default), then - creation of files with access control lists (ACLS) and modification of ACLs - using the Windows NT/2000 ACL editor will be applied directly to the file - or directory. - - If set to true, then all requests to set an ACL on a file will have the - parameters create mask, - force create mode - applied before setting the ACL, and all requests to set an ACL on a directory will - have the parameters directory - mask, force - directory mode applied before setting the ACL. - - - See also create mask, - force create mode, - directory mask, - force directory mode - - - Default: restrict acl with mask = no - - - - - restrict anonymous (G) @@ -6253,7 +6375,7 @@ security = server or security = domain . - In versions of Samba prior to 2..0, the default was + In versions of Samba prior to 2.0.0, the default was security = share mainly because that was the only option at one stage. @@ -6787,10 +6909,6 @@ system and the configure option --with-ssl was given at configure time. - Note that for export control reasons - this code is NOT enabled by default in any - current binary version of Samba. - This variable enables or disables the entire SSL mode. If it is set to no, the SSL-enabled Samba behaves exactly like the non-SSL Samba. If set to yes, @@ -6812,10 +6930,6 @@ system and the configure option --with-ssl was given at configure time. - Note that for export control reasons - this code is NOT enabled by default in any - current binary version of Samba. - This variable defines where to look up the Certification Authorities. The given directory should contain one file for each CA that Samba will trust. The file name must be the hash @@ -6838,10 +6952,6 @@ system and the configure option --with-ssl was given at configure time. - Note that for export control reasons - this code is NOT enabled by default in any - current binary version of Samba. - This variable is a second way to define the trusted CAs. The certificates of the trusted CAs are collected in one big file and this variable points to the file. You will probably @@ -6865,10 +6975,6 @@ system and the configure option --with-ssl was given at configure time. - Note that for export control reasons - this code is NOT enabled by default in any - current binary version of Samba. - This variable defines the ciphers that should be offered during SSL negotiation. You should not set this variable unless you know what you are doing. @@ -6883,10 +6989,6 @@ system and the configure option --with-ssl was given at configure time. - Note that for export control reasons - this code is NOT enabled by default in any - current binary version of Samba. - The certificate in this file is used by smbclient(1) if it exists. It's needed if the server requires a client certificate. @@ -6905,10 +7007,6 @@ system and the configure option --with-ssl was given at configure time. - Note that for export control reasons - this code is NOT enabled by default in any - current binary version of Samba. - This is the private key for smbclient(1). It's only needed if the client should have a certificate. @@ -6927,18 +7025,77 @@ system and the configure option --with-ssl was given at configure time. - Note that for export control reasons - this code is NOT enabled by default in any - current binary version of Samba. - - This variable defines whether SSLeay should be configured + This variable defines whether OpenSSL should be configured for bug compatibility with other SSL implementations. This is probably not desirable because currently no clients with SSL - implementations other than SSLeay exist. + implementations other than OpenSSL exist. Default: ssl compatibility = no + + + + ssl egd socket (G) + This variable is part of SSL-enabled Samba. This + is only available if the SSL libraries have been compiled on your + system and the configure option --with-ssl was + given at configure time. + + + This option is used to define the location of the communiation socket of + an EGD or PRNGD daemon, from which entropy can be retrieved. This option + can be used instead of or together with the ssl entropy file + directive. 255 bytes of entropy will be retrieved from the daemon. + + + Default: none + + + + + + ssl entropy bytes (G) + This variable is part of SSL-enabled Samba. This + is only available if the SSL libraries have been compiled on your + system and the configure option --with-ssl was + given at configure time. + + + This parameter is used to define the number of bytes which should + be read from the ssl entropy + file If a -1 is specified, the entire file will + be read. + + + Default: ssl entropy bytes = 255 + + + + + + + ssl entropy file (G) + This variable is part of SSL-enabled Samba. This + is only available if the SSL libraries have been compiled on your + system and the configure option --with-ssl was + given at configure time. + + + This parameter is used to specify a file from which processes will + read "random bytes" on startup. In order to seed the internal pseudo + random number generator, entropy must be provided. On system with a + /dev/urandom device file, the processes + will retrieve its entropy from the kernel. On systems without kernel + entropy support, a file can be supplied that will be read on startup + and that will be used to seed the PRNG. + + + Default: none + + + @@ -6956,10 +7113,6 @@ system and the configure option --with-ssl was given at configure time. - Note that for export control reasons - this code is NOT enabled by default in any - current binary version of Samba. - These two variables define whether Samba will go into SSL mode or not. If none of them is defined, Samba will allow only SSL connections. If the @@ -6993,10 +7146,6 @@ system and the configure option --with-ssl was given at configure time. - Note that for export control reasons - this code is NOT enabled by default in any - current binary version of Samba. - If this variable is set to yes, the server will not tolerate connections from clients that don't have a valid certificate. The directory/file given in --with-ssl was given at configure time. - Note that for export control reasons - this code is NOT enabled by default in any - current binary version of Samba. - If this variable is set to yes, the smbclient(1) will request a certificate from the server. Same as @@ -7047,10 +7192,6 @@ system and the configure option --with-ssl was given at configure time. - Note that for export control reasons - this code is NOT enabled by default in any - current binary version of Samba. - This is the file containing the server's certificate. The server must have a certificate. The file may also contain the server's private key. See later for @@ -7069,10 +7210,6 @@ system and the configure option --with-ssl was given at configure time. - Note that for export control reasons - this code is NOT enabled by default in any - current binary version of Samba. - This file contains the private key of the server. If this variable is not defined, the key is looked up in the certificate file (it may be appended to the certificate). @@ -7093,10 +7230,6 @@ system and the configure option --with-ssl was given at configure time. - Note that for export control reasons - this code is NOT enabled by default in any - current binary version of Samba. - This enumeration variable defines the versions of the SSL protocol that will be used. ssl2or3 allows dynamic negotiation of SSL v2 or v3, ssl2 results @@ -7149,6 +7282,30 @@ + + strict allocate (S) + This is a boolean that controls the handling of + disk space allocation in the server. When this is set to yes + the server will change from UNIX behaviour of not committing real + disk storage blocks when a file is extended to the Windows behaviour + of actually forcing the disk system to allocate real storage blocks + when a file is created or extended to be a given size. In UNIX + terminology this means that Samba will stop creating sparse files. + This can be slow on some systems. + + When strict allocate is no the server does sparse + disk block allocation when a file is extended. + + Setting this to yes can help Samba return + out of quota messages on systems that are restricting the disk quota + of users. + + Default: strict allocate = no + + + + + strict locking (S) This is a boolean that controls the handling of @@ -7434,6 +7591,24 @@ + + use mmap (G) + This global parameter determines if the tdb internals of Samba can + depend on mmap working correctly on the running system. Samba requires a coherent + mmap/read-write system memory cache. Currently only HPUX does not have such a + coherent cache, and so this parameter is set to false by + default on HPUX. On all other systems this parameter should be left alone. This + parameter is provided to help the Samba developers track down problems with + the tdb internal code. + + + Default: use mmap = yes + + + + + + use rhosts (G) If this global parameter is true, it specifies @@ -7811,16 +7986,16 @@ Default: No files or directories are vetoed. - Examples: - ; Veto any files containing the word Security, - ; any ending in .tmp, and any directory containing the - ; word root. - veto files = /*Security*/*.tmp/*root*/ +Examples: +; Veto any files containing the word Security, +; any ending in .tmp, and any directory containing the +; word root. +veto files = /*Security*/*.tmp/*root*/ - ; Veto the Apple specific files that a NetAtalk server - ; creates. - veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/ - +; Veto the Apple specific files that a NetAtalk server +; creates. +veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/ + diff --git a/docs/docbook/manpages/smbcontrol.1.sgml b/docs/docbook/manpages/smbcontrol.1.sgml index 7904634ab2..05e05f4a6a 100644 --- a/docs/docbook/manpages/smbcontrol.1.sgml +++ b/docs/docbook/manpages/smbcontrol.1.sgml @@ -70,7 +70,7 @@ message-type - One of: close-share, + One of: close-share, debug, force-election, ping , profile, diff --git a/docs/docbook/manpages/smbd.8.sgml b/docs/docbook/manpages/smbd.8.sgml index 05958b83de..cdb3d51fa8 100644 --- a/docs/docbook/manpages/smbd.8.sgml +++ b/docs/docbook/manpages/smbd.8.sgml @@ -22,7 +22,7 @@ -h -V -d <debug level> - -l <log file> + -l <log directory> -p <port number> -O <socket option> -s <configuration file> @@ -148,16 +148,21 @@ - -l <log file> - If specified, log file - specifies a log filename into which informational and debug - messages from the running server will be logged. The log + -l <log directory> + If specified, + log directory + specifies a log directory into which the "log.smbd" log + file will be created for informational and debug + messages from the running server. The log file generated is never removed by the server although its size may be controlled by the max log size option in the - smb.conf(5) file. The default log - file name is specified at compile time. + smb.conf(5) file. + + + The default log directory is specified at + compile time. diff --git a/docs/docbook/manpages/smbpasswd.8.sgml b/docs/docbook/manpages/smbpasswd.8.sgml index e757a0c67c..098e874cc8 100644 --- a/docs/docbook/manpages/smbpasswd.8.sgml +++ b/docs/docbook/manpages/smbpasswd.8.sgml @@ -28,6 +28,7 @@ -U username[%password] -h -s + -w pass username @@ -342,6 +343,22 @@ + + + -w password + This parameter is only available is Samba + has been configured to use the experiemental + --with-ldapsam option. The -w + switch is used to specify the password to be used with the + ldap admin + dn. Note that the password is stored in + the private/secrets.tdb and is keyed off + of the admin's DN. This means that if the value of ldap + admin dn ever changes, the password will beed to be + manually updated as well. + + + diff --git a/docs/docbook/manpages/winbindd.8.sgml b/docs/docbook/manpages/winbindd.8.sgml index 6a1ecd59fd..af851657f3 100644 --- a/docs/docbook/manpages/winbindd.8.sgml +++ b/docs/docbook/manpages/winbindd.8.sgml @@ -42,6 +42,15 @@ can be used to resolve user and group information from a Windows NT server. The service can also provide authentication services via an associated PAM module. + + + The pam_winbind module in the 2.2.2 release only + supports the auth and account + module-types. The latter is simply + performs a getpwnam() to verify that the system can obtain a uid for the + user. If the libnss_winbind library has been correctly + installed, this should always suceed. + The following nsswitch databases are implemented by the winbindd service: -- cgit