From f95fb5fe3941a0ef916ac85c6ccf4aecf17aaf39 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Thu, 19 Apr 2001 21:33:44 +0000 Subject: large sync up with 2.2 (This used to be commit 96523293da19df201703fed6130f1ff9ba25324b) --- docs/htmldocs/smb.conf.5.html | 4084 ++++++++++++++++++++++++++++++----------- 1 file changed, 2980 insertions(+), 1104 deletions(-) (limited to 'docs/htmldocs/smb.conf.5.html') diff --git a/docs/htmldocs/smb.conf.5.html b/docs/htmldocs/smb.conf.5.html index 71f05fc1dc..2197fe195f 100644 --- a/docs/htmldocs/smb.conf.5.html +++ b/docs/htmldocs/smb.conf.5.html @@ -134,7 +134,7 @@ CLASS="EMPHASIS" to the user of the service. Some housekeeping options are also specifiable.

Sections are either filespace services (used by the +>Sections are either file share services (used by the client as an extension of their native file systems) or printable services (used by the client to access print services on the host running the server).

parameters in this section apply to the server as a whole, or are defaults for sections which do not specifically define certain items. See the notes - under paraMETERS for more information.

paraMETRS

PARAMETERS

parameters define the specific attributes of sections.

%h

the internet hostname that Samba is running +>the Internet hostname that Samba is running on.

%M

the internet name of the client machine. +>the Internet name of the client machine.

NOTE ABOUT USERNAME/PASSWORD VALIDATION

There are a number of ways in which a user can connect - to a service. The server follows the following steps in determining + to a service. The server uses the following steps in determining if it will allow a connection to a specified service. If all the - steps fail then the connection request is rejected. If one of the - steps pass then the following steps are not checked.

If the service is marked "guest only = yes" then steps 1 to 5 are skipped.

COMPLETE LIST OF SERVICE PARAMETERS

Here is a list of all service parameters. See the section of +>Here is a list of all service parameters. See the section on each parameter for details. Note that some are synonyms.

EXPLANATION OF EACH PARAMETER

smbd(8) under special circumstances decribed below.

under special circumstances described below.

Normally, a Samba server requires that UNIX users are created for all users accessing files on this server. For sites @@ -3309,10 +4233,9 @@ CLASS="PARAMETER" > and attempts to authenticate the given user with the given password. If the - authentication succeeds then smbdsmbd attempts to find a UNIX user in the UNIX password database to map the Windows user into. If this lookup fails, and add user script is set then smbd is set then smbd will call the specified script argument to be the user name to create.

If this script successfully creates the user then smbdIf this script successfully creates the user then smbd + will continue on as though the UNIX user already existed. In this way, UNIX users are dynamically created to match existing Windows NT accounts.

See also , password server, , +

addprinter command (G)

With the introduction of MS-RPC based printing + support for Windows NT/2000 clients in Samba 2.2, The MS Add + Printer Wizard (APW) icon is now also available in the + "Printers..." folder displayed a share listing. The APW + allows for printers to be add remotely to a Samba or Windows + NT/2000 print server.

For a Samba host this means that the printer must be + physically added to underlying printing system. The addprinter command defines a script to be run which + will perform the necessary operations for adding the printer + to the print system and to add the appropriate service definition + to the smb.conf file in order that it can be + shared by smbd(8) + .

The addprinter command is + automatically invoked with the following parameter (in + order:

  • printer name

  • share name

  • port name

  • driver name

  • location

  • Windows 9x driver location +

All parameters are filled in from the PRINTER_INFO_2 structure sent + by the Windows NT/2000 client with one exception. The "Windows 9x + driver location" parameter is included for backwards compatibility + only. The remaining fields in the structure are generated from answers + to the APW questions.

Once the addprinter command has + been executed, smbd will reparse the smb.conf to determine if the share defined by the APW + exists. If the sharename is still invalid, then smbd + will return an ACCESS_DENIED error to the client.

See also deleteprinter command, printing, + show add + printer wizard

Default: none

Example: addprinter command = /usr/bin/addprinter +

admin users (S)

Synonym for

This option only takes effect when the security option is set to - serversecurity option is set to + server or domaindomain. If it is set to no, then attempts to connect to a resource from a domain or workgroup other than the one which smbd is running @@ -3490,7 +4578,7 @@ CLASS="COMMAND" > will announce itself as, to a network neighborhood browse list. By default this is set to Windows NT. The valid options - are : "NT" (which is a synonym for "NT Server"), "NT Server", + are : "NT Server" (which can also be written as "NT"), "NT Workstation", "Win95" or "WfW" meaning Windows NT Server, Windows NT Workstation, Windows 95 and Windows for Workgroups respectively. Do not change this parameter unless you have a @@ -3510,7 +4598,7 @@ CLASS="COMMAND" >

annouce version (G)
auto services (G)

This is a list of services that you want to be - automatically added to the browse lists. This is most useful - for homes and printers services that would otherwise not be - visible.

Note that if you just want all printers in your - printcap file loaded then the This is a synonym for the load printerspreload option is easier.

Default: no auto services

Example: auto services = fred lp colorlp

.

NAME MANGLING.

Default: case sensitive = no

. This will output the code page. The default for USA MS-DOS, Windows 95, and Windows NT releases is code page 437. The default for western - european releases of the above operating systems is code page 850.

This parameter tells , code page directory

Default:

codingsystem (G)
code page directory (G)

This parameter is used to determine how incoming - Shift-JIS Japanese characters are mapped from the incoming Define the location of the various client code page + files.

See also client code pageclient + code page +>

Default: code page directory = ${prefix}/lib/codepages +

Example: code page directory = /usr/share/samba/codepages +

codingsystem (G)

This parameter is used to determine how incoming + Shift-JIS Japanese characters are mapped from the incoming client code page used by the client, into file names in the UNIX filesystem. Only useful if

Default: coding system = <empty value> +

Default: noneno value

Example:

debug timestamp (G)

Samba 2.2 debug log messages are timestamped - by default. If you are running at a high debug level these timestamps - can be distracting. This boolean parameter allows timestamping - to be turned off.

Default: debug timestamp = yes

debug pid (G)
debug timestamp (G)

Samba 2.2 debug log messages are timestamped + by default. If you are running at a high debug level these timestamps + can be distracting. This boolean parameter allows timestamping + to be turned off.

Default: debug timestamp = yes

debug uid (G)
debug level (G)debuglevel (G)

The value of the parameter (an integer) allows @@ -4823,7 +5946,7 @@ NAME="DEFAULTCASE" >

See the section on NAME MANGLING" NAME MANGLING. Also note the parameter.

Default: default case = lower

Example:

			default service = pub
+CLASS="PROGRAMLISTING"
+>[global]
+	default service = pub
         
-			[pub]
-				path = /%S
-

delete readonly (S)

This parameter allows readonly files to be deleted. + This is not normal DOS semantics, but is allowed by UNIX.

This option may be useful for running applications such + as rcs, where UNIX file ownership prevents changing file + permissions, and DOS semantics prevent deletion of a read only file.

Default: delete readonly = no

smbd(8) under special circumstances - decribed below.

Normally, a Samba server requires that UNIX users are created for all users accessing files on this server. For sites @@ -5077,21 +6224,99 @@ CLASS="COMMAND" >

delete readonly (S)
deleteprinter command (G)

This parameter allows readonly files to be deleted. - This is not normal DOS semantics, but is allowed by UNIX.

With the introduction of MS-RPC based printer + support for Windows NT/2000 clients in Samba 2.2, it is now + possible to delete printer at run time by issuing the + DeletePrinter() RPC call.

This option may be useful for running applications such - as rcs, where UNIX file ownership prevents changing file - permissions, and DOS semantics prevent deletion of a read only file.

For a Samba host this means that the printer must be + physically deleted from underlying printing system. The deleteprinter command defines a script to be run which + will perform the necessary operations for removing the printer + from the print system and from smb.conf. +

Default: The deleteprinter command is + automatically called with only one parameter: "printer name".

Once the deleteprinter command has + been executed, delete readonly = nosmbd will reparse the smb.conf to associated printer no longer exists. + If the sharename is still valid, then smbd + will return an ACCESS_DENIED error to the client.

See also addprinter command, printing, + show add + printer wizard

Default: none

Example: deleteprinter command = /usr/bin/removeprinter +

./. The script should return two - integers in ascii. The first should be the total disk space in blocks, + integers in ASCII. The first should be the total disk space in blocks, and the second should be the number of available blocks. An optional third return value can give the block size in bytes. The default blocksize is 1024 bytes.

If domain logons = yes + , then the default behavior is to enable the domain + master parameter. If domain logons is + not enabled (the default setting), then neither will domain + master be enabled by default.

Default: domain master = nodomain master = auto

dos filemode (S)

The default behavior in Samba is to provide + UNIX-like behavor where only the owner of a file/directory is + able to change the permissions on it. However, this behavior + is often confusing to DOS/Windows users. Enabling this parameter + allows a user who has write access to the file (by whatever + means) to modify the permissions on it. Note that a user + belonging to the group owning the file will not be allowed to + change permissions if the group is only granted read access. + Ownership of the file/directory is not changed, only the permissions + are modified.

Default: dos filemode = no

dos filetime resolution (S)
enhanced browsing (G)

This option enables a couple of enhancements to + cross-subnet browse propogation that have been added in Samba + but which are not standard in Microsoft implementations. + These enhancements are currently only available in + the HEAD Samba CVS tree (not Samba 2.2.x).

The first enhancement to browse propogation consists of a regular + wildcard query to a Samba WINS server for all Domain Master Browsers, + followed by a browse synchronisation with each of the returned + DMBs. The second enhancement consists of a regular randomised browse + synchronisation with all currently known DMBs.

You may wish to disable this option if you have a problem with empty + workgroups not disappearing from browse lists. Due to the restrictions + of the browse protocols these enhancements can cause a empty workgroup + to stay around forever which can be annoying.

In general you should leave this option enabled as it makes + cross-subnet browse propogation much more reliable.

Default: enhanced browsing = yes

enumports command (G)

The concept of a "port" is fairly foreign + to UNIX hosts. Under Windows NT/2000 print servers, a port + is associated with a port monitor and generally takes the form of + a local port (i.e. LPT1:, COM1:, FILE:) or a remote port + (i.e. LPD Port Monitor, etc...). By default, Samba has only one + port defined--"Samba Printer Port". Under + Windows NT/2000, all printers must have a valid port name. + If you wish to have a list of ports displayed (smbd + does not use a port name for anything) other than + the default "Samba Printer Port", you + can define enumports command to point to + a program which should generate a list of ports, one per line, + to standard output. This listing will then be used in response + to the level 1 and 2 EnumPorts() RPC.

Default: no enumports command

Example: enumports command = /usr/bin/listports +

exec (S)

However, Unix time semantics mean that the create time reported by Samba will be updated whenever a file is created or - deleted in the directory. NMAKE therefore finds all object files - in the object directory bar the last one built are out of date - compared to the directory and rebuilds them. Enabling this option + or deleted in the directory. NMAKE finds all object files in + the object directory. The timestamp of the last one built is then + compared to the timestamp of the object dircetory. If the + directory's timestamp if newer, then all object files + will be rebuilt. Enabling this option ensures directories always predate their contents and an NMAKE build will proceed as expected.

always be set on a - file by Samba. This is done by bitwise 'OR'ing these bits onto + file created by Samba. This is done by bitwise 'OR'ing these bits onto the mode bits of a file that is being created or having its permissions changed. The default for this parameter is (in octal) 000. The modes in this parameter are bitwise 'OR'ed onto the file @@ -6164,7 +7523,8 @@ CLASS="COMMAND" >force directory security mode (S)force directory + security mode (S)

This parameter controls what UNIX permission bits @@ -6189,7 +7549,7 @@ CLASS="PARAMETER" > parameter. To allow a user to modify all the user/group/world permissions on a - directory, with restrictions set this parameter to 000.

This can be very useful.

In Samba 2.0.5 and above this parameter also causes the primary group of the forced user to be used as the primary group @@ -6508,7 +7866,7 @@ CLASS="CONSTANT" >

Default: getwd cache = Nogetwd cache = yes

(see below). Whatever privileges this - ser has will be available to any client connecting to the guest service. + user has will be available to any client connecting to the guest service. Typically this user will exist in the password file, but will not have a valid login. The user account "ftp" is often a good choice for this parameter. If a username is specified in a given service, @@ -6589,7 +7947,7 @@ NAME="GUESTOK" CLASS="CONSTANT" >yes for - a service, then no password is equired to connect to the service. + a service, then no password is required to connect to the service. Privileges will be those of the yes for a service, then only guest connections to the service are permitted. - This parameter will have no affect if

Default: homedir map = auto.homehomedir map = <empty string>

Example:

hosts allow (S)
host msdfs (G)

A synonym for this parameter is This boolean parameter is only available + if Samba has been configured and compiled with the --with-msdfs option. If set to yes, + Samba will act as a Dfs server, and allow Dfs-aware clients + to browse Dfs trees hosted on the server.

See also the msdfs root share level parameter. For + more information on setting up a Dfs tree on Samba, + refer to msdfs_setup.html. +

Default: host msdfs = no

hosts allow (S)

A synonym for this parameter is allow hosts

The "mask" parameters can either be a bit length (such as 24 for a C class network) or a full netmask in dotted - decmal form.

The "IP" parameters above can either be a full dotted decimal IP address or a hostname which will be looked up via - the OSes normal hostname resolution mechanisms.

For example, the following line:

.

Default: all active interfaces except 127.0.0.1 + that are broadcast capable

Default: keepalive = 0keepalive = 300

Example: keepalive = 60keepalive = 600

kernel oplocks (G)

For UNIXs that support kernel based For UNIXes that support kernel based

lanman auth (G)

This parameter determines whether or not smbd will + attempt to authentication users using the LANMAN password hash. + If disabled, only clients which support NT password hashes (e.g. Windows + NT/2000 clients, smbclient, etc... but not Windows 95/98 or the MS DOS + network client) will be able to connect to the Samba host.

Default : lanman auth = yes

level2 oplocks (S)

Once one of the clients which have a read-only oplock @@ -7510,8 +8932,7 @@ NAME="LEVEL2OPLOCKS" delete any read-ahead caches.

It is recommended that this parameter be turned on - to speed access to shared executables (and also to test - the code :-).

For more discussions on level2 oplocks see the CIFS spec.

Default: level2 oplocks = Falselevel2 oplocks = yes

Example: lm announce = truelm announce = yes

Default: lock directory = /tmp/sambalock directory = ${prefix}/var/locks

Example: lock directory = /usr/local/samba/var/lockslock directory = /var/run/samba/locks

If locking = no, all lock and unlock requests - will appear to succeed and all lock queries will indicate that the - queried lock is clear.

, all lock and unlock + requests will appear to succeed and all lock queries will report + that the file in question is available for locking.

If log file (G)

This options allows you to override the name +>This option allows you to override the name of the Samba log file (also known as the debug file).

This option takes the standard substitutions, allowing @@ -7960,7 +9381,7 @@ CLASS="USERINPUT" >

logon home = \\%L\%U\profilelogon home = \\%N\%U\profile

This tells Samba to return the above string, with @@ -8372,8 +9793,11 @@ CLASS="PARAMETER" >lpq command as the PATH may not be - available to the server.

as the $PATH + may not be available to the server.

See also the

Example: lpq command = /usr/bin/lpq %plpq command = /usr/bin/lpq -P%p

Scripts executed in this way will be deleted upon - completion, permissions permitting.

If the script generates output, output will be sent to the file specified by the parameter (see above).

Note that some shells are unable to interpret scripts - containing carriage-return-linefeed instead of linefeed as + containing CR/LF instead of CR as the end-of-line marker. Magic scripts must be executable NAME MANGLING

Default: mangle case = no

;1 off the ends of filenames on some CDROMS (only visible - under some UNIXs). To do this use a map of (*;1 *;).

Default:

mangling char (S)

This controls what character is used as - the magic character in name mangling. The default is a '~' - but this may interfere with some software. Use this option to set - it to whatever you prefer.

Default: mangling char = ~

Example: mangling char = ^

mangled stack (G)
mangling char (S)

This controls what character is used as + the magic character in name mangling. The default is a '~' + but this may interfere with some software. Use this option to set + it to whatever you prefer.

Default: mangling char = ~

Example: mangling char = ^

map archive (S)
guest account. Note that this can cause problems as it means that any user incorrectly typing - their password will be silently logged on as a "guest" - and + their password will be silently logged on as "guest" - and will not know the reason they cannot access files they think they should - there will have been no message given to them that they got their password wrong. Helpdesk services will @@ -9303,6 +10733,163 @@ CLASS="COMMAND" >
max print jobs (S)

This parameter limits the maximum number of + jobs allowable in a Samba printer queue at any given moment. + If this number is exceeded, smbd(8) will remote "Out of Space" to the client. + See all total + print jobs. +

Default: max print jobs = 1000

Example: max print jobs = 5000

max protocol (G)

The value of the parameter (a string) is the highest + protocol level that will be supported by the server.

Possible values are :

  • CORE: Earliest version. No + concept of user names.

  • COREPLUS: Slight improvements on + CORE for efficiency.

  • LANMAN1: First modern version of the protocol. Long filename + support.

  • LANMAN2: Updates to Lanman1 protocol. +

  • NT1: Current up to date version of + the protocol. Used by Windows NT. Known as CIFS.

Normally this option should not be set as the automatic + negotiation phase in the SMB protocol takes care of choosing + the appropriate protocol.

See also min + protocol

Default: max protocol = NT1

Example: max protocol = LANMAN1

max smbd processes (G)

This parameter limits the maximum number of + smbd(8) + processes concurrently running on a system and is intended + as a stop gap to prevent degrading service to clients in the event + that the server has insufficient resources to handle more than this + number of connections. Remember that under normal operating + conditions, each user will have an smbd associated with him or her + to handle connections to all shares from a given host. +

Default: max smbd processes = 0 ## no limit

Example: max smbd processes = 1000

max ttl (G)
min print space (S)
min passwd length (G)

This sets the minimum amount of free disk - space that must be available before a user will be able to spool - a print job. It is specified in kilobytes. The default is 0, which - means a user can always spool a print job.

See also the Synonym for printing - parameter.

Default: min print space = 0

Example: min print space = 2000

min passwd length (G)

Synonym for min password lengthmin password length.

This option sets the minimum length in characters - of a plaintext password than smbd will accept when performing + of a plaintext password that smbd will accept when performing UNIX password changing.

See also

min print space (S)

This sets the minimum amount of free disk + space that must be available before a user will be able to spool + a print job. It is specified in kilobytes. The default is 0, which + means a user can always spool a print job.

See also the printing + parameter.

Default: min print space = 0

Example: min print space = 2000

min protocol (G)

The value of the parameter (a string) is the + lowest SMB protocol dialect than Samba will support. Please refer + to the max protocol + parameter for a list of valid protocol names and a brief description + of each. You may also wish to refer to the C source code in + source/smbd/negprot.c for a listing of known protocol + dialects supported by clients.

If you are viewing this parameter as a security measure, you should + also refer to the lanman + auth parameter. Otherwise, you should never need + to change this parameter.

Default : min protocol = CORE

Example : min protocol = NT1 # disable DOS + clients

min wins ttl (G)
msdfs root (S)

This boolean parameter is only available if + Samba is configured and compiled with the --with-msdfs option. If set to yes>, + Samba treats the share as a Dfs root and allows clients to browse + the distributed file system tree rooted at the share directory. + Dfs links are specified in the share directory by symbolic + links of the form msdfs:serverA\shareA,serverB\shareB + and so on. For more information on setting up a Dfs tree + on Samba, refer to msdfs_setup.html + .

See also host msdfs +

Default: msdfs root = no

name resolve order (G)

This option is used by the programs in the Samba - suite to determine what naming services and in what order to resolve - host names to IP addresses. The option takes a space separated - string of different name resolution options.

The options are :"lmhosts", "host", "wins" and "bcast". They cause names to be resolved as follows :

You should not need to ever disable this parameter.

Default: nt support = yesnt smb support = yes

ole locking compatibility (G)

This parameter allows an administrator to turn - off the byte range lock manipulation that is done within Samba to - give compatibility for OLE applications. Windows OLE applications - use byte range locking as a form of inter-process communication, by - locking ranges of bytes around the 2^32 region of a file range. This - can cause certain UNIX lock managers to crash or otherwise cause - problems. Setting this parameter to no means you - trust your UNIX lock manager to handle such cases correctly.

Default: ole locking compatibility = yes

only guest (S)

A synonym for guest only.

only user (S)
user - list will be allowed. By default this option is disabled so a client - can supply a username to be used by the server.

user list and is only really + useful in shave level + security.

Note that this also means Samba won't try to deduce usernames from the service name. This can be annoying for @@ -10066,70 +11725,44 @@ CLASS="COMMAND" >

oplocks (S)
ole locking compatibility (G)

This boolean option tells smbd whether to - issue oplocks (opportunistic locks) to file open requests on this - share. The oplock code can dramatically (approx. 30% or more) improve - the speed of access to files on Samba servers. It allows the clients - to aggressively cache files ocally and you may want to disable this - option for unreliable network environments (it is turned on by - default in Windows NT Servers). For more information see the file - Speed.txt in the Samba docs/ - directory.

This parameter allows an administrator to turn + off the byte range lock manipulation that is done within Samba to + give compatibility for OLE applications. Windows OLE applications + use byte range locking as a form of inter-process communication, by + locking ranges of bytes around the 2^32 region of a file range. This + can cause certain UNIX lock managers to crash or otherwise cause + problems. Setting this parameter to no means you + trust your UNIX lock manager to handle such cases correctly.

Oplocks may be selectively turned off on certain files on - a per share basis. See the veto oplock filesDefault: ole locking compatibility = yes

parameter. On some systems - oplocks are recognized by the underlying operating system. This - allows data synchronization between all access to oplocked files, - whether it be via Samba or NFS or a local UNIX process. See the - kernel oplocks parameter for details.

only guest (S)

See also the kernel - oplocks and A synonym for level2 oplocks guest only parameters.

Default: oplocks = yes

.

This is a tuning parameter added due to bugs in both Windows 9x and WinNT. If Samba responds to a client too quickly when that client issues an SMB that can cause an oplock - break request, then the client redirector can fail and not respond + break request, then the network client can fail and not respond to the break request. This tuning parameter (which is set in milliseconds) is the amount of time Samba will wait before sending an oplock break request to such (broken) clients.

Default: oplock break wait time = 10oplock break wait time = 0

os level (G)
oplocks (S)

This integer value controls what level Samba - advertises itself as for browse elections. The value of this - parameter determines whether nmbd(8)This boolean option tells smbd whether to + issue oplocks (opportunistic locks) to file open requests on this + share. The oplock code can dramatically (approx. 30% or more) improve + the speed of access to files on Samba servers. It allows the clients + to aggressively cache files locally and you may want to disable this + option for unreliable network environments (it is turned on by + default in Windows NT Servers). For more information see the file + Speed.txt in the Samba docs/ - has a chance of becoming a local master browser for the

Oplocks may be selectively turned off on certain files with a + share. See the WORKGROUP veto oplock files parameter. On some systems + oplocks are recognized by the underlying operating system. This + allows data synchronization between all access to oplocked files, + whether it be via Samba or NFS or a local UNIX process. See the + kernel oplocks parameter for details.

See also the kernel + oplocks and level2 oplocks in the local broadcast area. The default is - zero, which means parameters.

Default: nmbd will lose elections to - Windows machines. See oplocks = yes

os level (G)

This integer value controls what level Samba + advertises itself as for browse elections. The value of this + parameter determines whether nmbd(8) + has a chance of becoming a local master browser for the WORKGROUP in the local broadcast area.

Note :By default, Samba will win + a local master browsing election over all Microsoft operating + systems except a Windows NT 4.0/2000 Domain Controller. This + means that a misconfigured Samba host can effectively isolate + a subnet for browsing purposes. See BROWSING.txt in the - Samba BROWSING.txt + in the Samba docs/ directory for details.

directory + for details.

Default:

os2 driver map (G)

The parameter is used to define the absolute + path to a file containing a mapping of Windows NT printer driver + names to OS/2 printer driver names. The format is:

<nt driver name> = <os2 driver + name>.<device name>

For example, a valid entry using the HP LaserJet 5 + printer driver woudl appear as HP LaserJet 5L = LASERJET.HP + LaserJet 5L.

The need for the file is due to the printer driver namespace + problem described in the Samba + Printing HOWTO. For more details on OS/2 clients, please + refer to the OS2-Client-HOWTO + containing in the Samba documentation.

Default: os2 driver map = <empty string> +

panic action (G)

If the send string in any part of the chat sequence is a fullstop ".", then no string is sent. Similarly, - is the expect string is a fullstop then no string is expected.

Note that if the

Default: passwd chat = *old*password* %o\n *new* - password* %n\n *new*password* %n\n *changed*passwd chat = *new*password* %n\n + *new*password* %n\n *changed*

Example: passwd chat debug = no

Example: passwd chat debug = yes

This parameter defines the maximum number of characters that may be upper case in passwords.

you can get Samba to do all its username/password validation via a remote server.

This options sets the name of the password server to use. +>This option sets the name of the password server to use. It must be a NetBIOS name, so if the machine's NetBIOS name is - different from its internet name then you may have to add its NetBIOS + different from its Internet name then you may have to add its NetBIOS name to the lmhosts file which is stored in the same directory as the

The password server much be a machine capable of using - the "LM1.2X002" or the "LM NT 0.12" protocol, and it must be in + the "LM1.2X002" or the "NT LM 0.12" protocol, and it must be in user level security mode.

, which means the Samba server will use the incoming - client as the passwordserver. If you use this then you better - trust your clients, and you better restrict them with hosts allow!

If the domain, then the list of machines in this option must be a list of Primary or Backup Domain controllers for the - Domain or the character '*', as the Samba server is cryptographicly - in that domain, and will use cryptographicly authenticated RPC calls + Domain or the character '*', as the Samba server is effectively + in that domain, and will use cryptographically authenticated RPC calls to authenticate the user logging on. The advantage of using security = domain

posix locking (S)

The smbd(8) + daemon maintains an database of file locks obtained by SMB clients. + The default behavior is to map this internal database to POSIX + locks. This means that file locks obtained by SMB clients are + consistent with those seen by POSIX compliant applications accessing + the files via a non-SMB method (e.g. NFS or local file access). + You should never need to disable this parameter.

Default: posix locking = yes

postexec (S)

Default: preferred master = nopreferred master = auto

preload

Synonym for This is a list of services that you want to be + automatically added to the browse lists. This is most useful + for homes and printers services that would otherwise not be + visible.

Note that if you just want all printers in your + printcap file loaded then the auto servicesload printers.

option is easier.

Default: no preloaded services

Example: preload = fred lp colorlp

derault case +>default case See the section on NAME - MANGLING" for a fuller discussion.

Note that printing may fail on some UNIXs from the +>Note that printing may fail on some UNIXes from the nobody

printer admin (S)

This is a list of users that can do anything to - printers via the remote administration interfaces offered by MSRPC - (usually using a NT workstation). Note that the root user always - has admin rights.

Default: printer admin = <empty string> -

Example: printer admin = admin, @staff

printcap name (G)
printer (S)
printer admin (S)

This parameter specifies the name of the printer - to which print jobs spooled through a printable service will be sent.

If specified in the [global] section, the printer - name given will be used for any printable service that does - not have its own printer name specified.

This is a list of users that can do anything to + printers via the remote administration interfaces offered by MS-RPC + (usually using a NT workstation). Note that the root user always + has admin rights.

Default: none (but may be lp - on many systems)

Default: printer admin = <empty string> +

Example: printer name = laserwriterprinter admin = admin, @staff

printer driver (S)

Note :This is a depreciated + parameter and will be removed in the next major release + following version 2.2. Please see the instructions in + PRINTER_DRIVER2.txt in the docs + of the Samba distribution for more information + on the new method of loading printer drivers onto a Samba server. +

This option allows you to control the string that clients receive when they ask the server for the printer driver - associated with a printer. If you are using Windows95 or WindowsNT + associated with a printer. If you are using Windows95 or Windows NT then you can use this to automate the setup of printers on your system.

option set and the client will give you a list of printer drivers. The appropriate strings are - shown in a scrollbox after you have chosen the printer manufacturer.

See also printer driver file (G)

Note :This is a depreciated + parameter and will be removed in the next major release + following version 2.2. Please see the instructions in + PRINTER_DRIVER2.txt in the docs + of the Samba distribution for more information + on the new method of loading printer drivers onto a Samba server. +

This parameter tells Samba where the printer driver definition file, used when serving drivers to Windows 95 clients, is to be found. If this is not set, the default is :

printer driver location (S)

Note :This is a depreciated + parameter and will be removed in the next major release + following version 2.2. Please see the instructions in + PRINTER_DRIVER2.txt in the docs + of the Samba distribution for more information + on the new method of loading printer drivers onto a Samba server. +

This parameter tells clients of a particular printer share where to find the printer driver files for the automatic installation of drivers for Windows 95 machines. If Samba is set up @@ -11673,12 +13483,40 @@ NAME="PRINTERNAME" >printer name (S)

This parameter specifies the name of the printer + to which print jobs spooled through a printable service will be sent.

If specified in the [global] section, the printer + name given will be used for any printable service that does + not have its own printer name specified.

Default: none (but may be lp + on many systems)

Example: printer name = laserwriter

printer (S)

Synonym for printer printer name.

private dir(G)
protocol (G)

The Synonym for private dirmax protocol parameter - allows an administator to define a directory path used to hold the - various databases Samba will use to store things like a the machine - trust account information when acting as a domain member (i.e. where - the secrets.tdb file will be located), where the passdb.tbd file - will stored in the case of using the experiemental tdbsam support, - etc...

Default: private dir = <compile time location - of smbpasswd>

Example: private dir = /etc/smbprivate

.

protocol (G)

The value of the parameter (a string) is the highest - protocol level that will be supported by the server.

Possible values are :

  • CORE: Earliest version. No - concept of user names.

  • COREPLUS: Slight improvements on - CORE for efficiency.

  • LANMAN1: First modern version of the protocol. Long filename - support.

  • LANMAN2: Updates to Lanman1 protocol. -

  • NT1: Current up to date version of - the protocol. Used by Windows NT. Known as CIFS.

Normally this option should not be set as the automatic - negotiation phase in the SMB protocol takes care of choosing - the appropriate protocol.

Default: protocol = NT1

Example: protocol = LANMAN1

public (S)
public (S)

Synonym for

This parameter makes the use of macro expansions that rely - on the username (%U, %G, etc) consistant. NT 4.0 + on the username (%U, %G, etc) consistent. NT 4.0 likes to use anonymous connections when refreshing the share list, and this is a way to work around that.

.

Default: root postexec = <empty string> +

parameter except that the command is run as root. This - is useful for mounting filesystems - (such as cdroms) after a connection is closed.

See also .

Default: root preexec = <empty string> +

.

Default: root preexec close = no

The different settings will now be explained.

.

.

shared mem size (G)

It specifies the size of the shared memory (in - bytes) to use between smbd(8) - processes. This parameter defaults to one megabyte of shared - memory. It is possible that if you have a large erver with many - files open simultaneously that you may need to increase this - parameter. Signs that this parameter is set too low are users - reporting strange problems trying to save files (locking errors) - and error messages in the smbd log looking like ERROR - smb_shm_alloc : alloc of XX bytes failed.

If your OS refuses the size that Samba asks for then - Samba will try a smaller size, reducing by a factor of 0.8 until - the OS accepts it.

Default: shared mem size = 1048576

Example: shared mem size = 5242880 ; Set to 5mb for a - large number of files.

short preserve case (S)
smb passwd file (G)
show add printer wizard (G)

This option sets the path to the encrypted - smbpasswd file. By default the path to the smbpasswd file - is compiled into Samba.

With the introduction of MS-RPC based printing support + for Windows NT/2000 client in Samba 2.2, a "Printers..." folder will + appear on Samba hosts in the share listing. Normally this folder will + contain an icon for the MS Add Printer Wizard (APW). However, it is + possible to disable this feature regardless of the level of privilege + of the connected user.

Default: smb passwd file= <compiled - default>Under normal circumstances, the Windows NT/2000 client will + open a handle on the printer server with OpenPrinterEx() asking for + Administrator privileges. If the user does not have administrative + access on the print server (i.e is not root or a member of the + printer admin group), the OpenPrinterEx() + call fails and the clients another open call with a request for + a lower privilege level. This should succeed, however the APW + icon will not be displayed.

Disabling the show add printer wizard + parameter will always cause the OpenPrinterEx() on the server + to fail. Thus the APW icon will never be displayed. Note :This does not prevent the same user from having + administrative privilege on an individual printer.

See also addprinter + command, deleteprinter command, printer admin

Example: Default :smb passwd file = /usr/samba/private/smbpasswd - show add printer wizard = yes

smbrun (G)
smb passwd file (G)

This sets the full path to the smbrun - binary. This defaults to the value in the Makefile.

You must get this path right for many services - to work correctly.

You should not need to change this parameter so - long as Samba is installed correctly.

This option sets the path to the encrypted + smbpasswd file. By default the path to the smbpasswd file + is compiled into Samba.

Default: smbrun=<compiled default> +>smb passwd file = ${prefix}/private/smbpasswd

Example: smbrun = /usr/local/samba/bin/smbrun +>smb passwd file = /etc/samba/smbpasswd

LOG_DEBUG.

This paramter sets the threshold for sending messages +>This parameter sets the threshold for sending messages to syslog. Only messages with debug level less than this value will be sent to syslog.

total print jobs (G)

This parameter accepts an integer value which defines + a limit on the maximum number of print jobs that will be accepted + system wide at any given time. If a print job is submitted + by a client which will exceed this number, then smbd will return an + error indicating that no space is available on the server. The + default value of 0 means that no such limit exists. This parameter + can be used to prevent a server from exceeding its capacity and is + designed as a printing throttle. See also + max print jobs. +

Default: total print jobs = 0

Example: total print jobs = 5000

unix password sync (G)
unix realname (G)

This boolean parameter when set causes samba - to supply the real name field from the unix password file to - the client. This isuseful for setting up mail clients and WWW - browsers on systems used by more than one person.

Default: unix realname = no

update encrypted (G)

Note that searching though a groups database can take - quite some time, snd some clients may time out during the + quite some time, and some clients may time out during the search.

See the section Default: The guest account if a guest service, - else the name of the service.

Examples:

If this parameter is set to non-zero the behavior changes. This parameter is a number that specifies the number of uppercase - combinations to try whilst trying to determine the UNIX user name. The + combinations to try while trying to determine the UNIX user name. The higher the number the more combinations will be tried, but the slower the discovery of usernames will be. Use this parameter when you have strange usernames on your UNIX machine, such as

winbind cache time
valid chars (G)

NOTE: this parameter is only - available in Samba 3.0.

This parameter specifies the number of seconds the - winbindd(8) daemon will cache - user and group information before querying a Windows NT server - again.

The option allows you to specify additional + characters that should be considered valid by the server in + filenames. This is particularly useful for national character + sets, such as adding u-umlaut or a-ring.

Default: winbind cache type = 15

winbind gid
The option takes a list of characters in either integer + or character form with spaces between them. If you give two + characters with a colon between them then it will be taken as + an lowercase:uppercase pair.

NOTE: this parameter is only - available in Samba 3.0.

If you have an editor capable of entering the characters + into the config file then it is probably easiest to use this + method. Otherwise you can specify the characters in octal, + decimal or hexadecimal form using the usual C notation.

The winbind gid parameter specifies the range of group - ids that are allocated by the winbindd(8) daemon. This range of group ids should have no - existing local or nis groups within it as strange conflicts can - occur otherwise.

For example to add the single character 'Z' to the charset + (which is a pointless thing to do as it's already there) you could + do one of the following

Default: winbind gid = <empty string> -

Example: winbind gid = 10000-20000

winbind uid

NOTE: this parameter is only - available in Samba 3.0.

The winbind gid parameter specifies the range of group - ids that are allocated by the winbindd(8) daemon. This range of ids should have no - existing local or nis users within it as strange conflicts can - occur otherwise.

Default: winbind uid = <empty string> -

Example: winbind uid = 10000-20000

valid chars (G)

The option allows you to specify additional - characters that should be considered valid by the server in - filenames. This is particularly useful for national character - sets, such as adding u-umlaut or a-ring.

The option takes a list of characters in either integer - or character form with spaces between them. If you give two - characters with a colon between them then it will be taken as - an lowercase:uppercase pair.

If you have an editor capable of entering the characters - into the config file then it is probably easiest to use this - method. Otherwise you can specify the characters in octal, - decimal or hexadecimal form using the usual C notation.

For example to add the single character 'Z' to the charset - (which is a pointless thing to do as it's already there) you could - do one of the following

		valid chars = Z
-		valid chars = z:Z
-		valid chars = 0132:0172
-		
		valid chars = Z
+		valid chars = z:Z
+		valid chars = 0132:0172
+

The last two examples above actually add two characters, @@ -15603,6 +17297,49 @@ CLASS="COMMAND" >

vfs object (S)

This parameter specifies a shared object file that + is used for Samba VFS I/O operations. By default, normal + disk I/O operations are used but these can be overloaded + with a VFS object. The Samba VFS layer is new to Samba 2.2 and + must be enabled at compile time with --with-vfs.

Default : no value

vfs options (S)

This parameter allows parameters to be passed + to the vfs layer at initialisation time. The Samba VFS layer + is new to Samba 2.2 and must be enabled at compile time + with --with-vfs. See also vfs object.

Default : no value

volume (S)
wins proxy (G)
winbind cache time

This is a boolean that controls if NOTE: this parameter is only + available in Samba 3.0.

This parameter specifies the number of seconds the + nmbd(8) will respond to broadcast name - queries on behalf of other hosts. You may need to set this - to yes for some older clients.

winbindd(8) daemon will cache + user and group information before querying a Windows NT server + again.

Default: wins proxy = nowinbind cache type = 15

wins server (G)
winbind gid

This specifies the IP address (or DNS name: IP - address for preference) of the WINS server that NOTE: this parameter is only + available in Samba 3.0.

The winbind gid parameter specifies the range of group + ids that are allocated by the nmbd(8) should register with. If you have a WINS server on - your network then you should set this to the WINS server's IP.

winbindd(8) daemon. This range of group ids should have no + existing local or nis groups within it as strange conflicts can + occur otherwise.

You should point this at your WINS server if you have a - multi-subnetted network.

Default: winbind gid = <empty string> +

Example: winbind gid = 10000-20000

winbind separator

NOTE. You need to set up Samba to point - to a WINS server if you have multiple subnets and wish cross-subnet - browsing to work correctly.

NOTE: this parameter is only + available in Samba 3.0.

See the documentation file This parameter allows an admin to define the character + used when listing a username of the form of DOMAIN + \user. This parameter + is only applicable when using the BROWSING.txt - in the docs/ directory of your Samba source distribution.

pam_winbind.so + and nss_winbind.so modules for UNIX services. +

Default: Example: winbind separator = \

Example: winbind separator = +

winbind uid

not enabledNOTE: this parameter is only + available in Samba 3.0.

The winbind gid parameter specifies the range of group + ids that are allocated by the winbindd(8) daemon. This range of ids should have no + existing local or nis users within it as strange conflicts can + occur otherwise.

Default: winbind uid = <empty string> +

Example: wins server = 192.9.200.1winbind uid = 10000-20000

wins proxy (G)

This is a boolean that controls if nmbd(8) will respond to broadcast name + queries on behalf of other hosts. You may need to set this + to yes for some older clients.

Default: wins proxy = no

wins server (G)

This specifies the IP address (or DNS name: IP + address for preference) of the WINS server that nmbd(8) should register with. If you have a WINS server on + your network then you should set this to the WINS server's IP.

You should point this at your WINS server if you have a + multi-subnetted network.

NOTE. You need to set up Samba to point + to a WINS server if you have multiple subnets and wish cross-subnet + browsing to work correctly.

See the documentation file BROWSING.txt + in the docs/ directory of your Samba source distribution.

Default: not enabled

Example: wins server = 192.9.200.1

wins support (G)
This controls what workgroup your server will appear to be in when queried by clients. Note that this parameter also controls the Domain name used with the security=domain
write cache size (S)

If this integer parameter is set to non-zero value, + Samba will create an in-memory cache for each oplocked file + (it does not do this for + non-oplocked files). All writes that the client does not request + to be flushed directly to disk will be stored in this cache if possible. + The cache is flushed onto disk when a write comes in whose offset + would not fit into the cache or when the file is closed by the client. + Reads for the file are also served from this cache if the data is stored + within it.

This cache allows Samba to batch client writes into a more + efficient write size for RAID disks (ie. writes may be tuned to + be the RAID stripe size) and can improve performance on systems + where the disk subsystem is a bottleneck but there is free + memory for userspace programs.

The integer parameter specifies the size of this cache + (per oplocked file) in bytes.

Default: write cache size = 0

Example: write cache size = 262144

for a 256k cache size per file.

write list (S)
write cache size (S)

This integer parameter (new with Samba 2.0.7) - if set to non-zero causes Samba to create an in-memory cache for - each oplocked file (it does not do this for - non-oplocked files). All writes that the client does not request - to be flushed directly to disk will be stored in this cache if possible. - The cache is flushed onto disk when a write comes in whose offset - would not fit into the cache or when the file is closed by the client. - Reads for the file are also served from this cache if the data is stored - within it.

This cache allows Samba to batch client writes into a more - efficient write size for RAID disks (ie. writes may be tuned to - be the RAID stripe size) and can improve performance on systems - where the disk subsystem is a bottleneck but there is free - memory for userspace programs.

The integer parameter specifies the size of this cache - (per oplocked file) in bytes.

Default: write cache size = 0

Example: write cache size = 262144

for a 256k cache size per file.

write ok (S)

WARNINGS

VERSION

SEE ALSO

AUTHOR