Changeset 26 for trunk/samba/docs/htmldocs/manpages
- Timestamp:
- Apr 10, 2007, 5:27:38 AM (14 years ago)
- Location:
- trunk/samba/docs/htmldocs/manpages
- Files:
-
- 8 edited
-
index.html (modified) (1 diff)
-
net.8.html (modified) (5 diffs)
-
rpcclient.1.html (modified) (5 diffs)
-
smb.conf.5.html (modified) (154 diffs)
-
smbclient.1.html (modified) (7 diffs)
-
smbcquotas.1.html (modified) (4 diffs)
-
smbtree.1.html (modified) (2 diffs)
-
vfs_recycle.8.html (modified) (1 diff)
Legend:
- Unmodified
- Added
- Removed
-
trunk/samba/docs/htmldocs/manpages/index.html
r22 r26 68 68 </p></dd><dt><span class="term"><a href="vfs_netatalk.8.html" target="_top">vfs_netatalk(8)</a></span></dt><dd><p>hide .AppleDouble files from CIFS clients 69 69 </p></dd><dt><span class="term"><a href="vfs_prealloc.8.html" target="_top">vfs_prealloc(8)</a></span></dt><dd><p>preallocate matching files to a predetermined size 70 </p></dd><dt><span class="term"><a href="vfs_readahead.8.html" target="_top">vfs_readahead(8)</a></span></dt><dd><p>pre-load the kernel buffer cache 70 71 </p></dd><dt><span class="term"><a href="vfs_readonly.8.html" target="_top">vfs_readonly(8)</a></span></dt><dd><p>make a Samba share read only for a specified time period 71 72 </p></dd><dt><span class="term"><a href="vfs_recycle.8.html" target="_top">vfs_recycle(8)</a></span></dt><dd><p>Samba VFS recycle bin -
trunk/samba/docs/htmldocs/manpages/net.8.html
r1 r26 169 169 DN standard LDAP DN, and the attributes are a list of LDAP fields 170 170 to show in the result. 171 </p><p>Example: <strong class="userinput"><code>net ads dn 'CN=administrator,CN=Users,DC=my,DC=domain' SAMAccountName</code></strong></p></div><div class="refsect2" lang="en"><a name="id273042"></a><h3>ADS WORKGROUP</h3><p>Print out workgroup name for specified kerberos realm.</p></div><div class="refsect2" lang="en"><a name="id273052"></a><h3>USERSHARE</h3><p>Starting with version 3.0.23, a Samba server now supports the ability for 171 </p><p>Example: <strong class="userinput"><code>net ads dn 'CN=administrator,CN=Users,DC=my,DC=domain' SAMAccountName</code></strong></p></div><div class="refsect2" lang="en"><a name="id273042"></a><h3>ADS WORKGROUP</h3><p>Print out workgroup name for specified kerberos realm.</p></div><div class="refsect2" lang="en"><a name="id273052"></a><h3>SAM CREATEBUILTINGROUP <NAME></h3><p> 172 (Re)Create a BUILTIN group. 173 Only a wellknown set of BUILTIN groups can be created with this command. 174 This is the list of currently recognized group names: Administrators, 175 Users, Guests, Power Users, Account Operators, Server Operators, Print 176 Operators, Backup Operators, Replicator, RAS Servers, Pre-Windows 2000 177 ompatible Access. 178 179 This command requires a running Winbindd with idmap allocation properly 180 configured. The group gid will be allocated out of the winbindd range. 181 </p></div><div class="refsect2" lang="en"><a name="id273067"></a><h3>SAM CREATELOCALGROUP <NAME></h3><p> 182 Create a LOCAL group (also known as Alias). 183 184 This command requires a running Winbindd with idmap allocation properly 185 configured. The group gid will be allocated out of the winbindd range. 186 </p></div><div class="refsect2" lang="en"><a name="id273078"></a><h3>SAM MAPUNIXGROUP <NAME></h3><p> 187 Map an existing Unix group and make it a Domain Group, the domain group 188 will have the same name. 189 </p></div><div class="refsect2" lang="en"><a name="id273089"></a><h3>SAM ADDMEM <GROUP> <MEMBER></h3><p> 190 Add a member to a Local group. The group can be specified only by name, 191 the member can be specified by name or SID. 192 </p></div><div class="refsect2" lang="en"><a name="id273101"></a><h3>SAM DELMEM <GROUP> <MEMBER></h3><p> 193 Remove a member from a Local group. The group and the member must be 194 specified by name. 195 </p></div><div class="refsect2" lang="en"><a name="id273112"></a><h3>SAM LISTMEM <GROUP></h3><p> 196 List Local group members. The group must be specified by name. 197 </p></div><div class="refsect2" lang="en"><a name="id273123"></a><h3>SAM LIST <users|groups|localgroups|builtin|workstations> [verbose]</h3><p> 198 List the specified set of accounts by name. If verbose is specified, 199 the rid and description is also provided for each account. 200 </p></div><div class="refsect2" lang="en"><a name="id273135"></a><h3>SAM SHOW <NAME></h3><p> 201 Show the full DOMAIN\\NAME the SID and the type for the corrisponding 202 account. 203 </p></div><div class="refsect2" lang="en"><a name="id273145"></a><h3>SAM SET HOMEDIR <NAME> <DIRECTORY></h3><p> 204 Set the home directory for a user account. 205 </p></div><div class="refsect2" lang="en"><a name="id273156"></a><h3>SAM SET PROFILEPATH <NAME> <PATH></h3><p> 206 Set the profile path for a user account. 207 </p></div><div class="refsect2" lang="en"><a name="id273166"></a><h3>SAM SET COMMENT <NAME> <COMMENT></h3><p> 208 Set the comment for a user or group account. 209 </p></div><div class="refsect2" lang="en"><a name="id273177"></a><h3>SAM SET FULLNAME <NAME> <FULL NAME></h3><p> 210 Set the full name for a user account. 211 </p></div><div class="refsect2" lang="en"><a name="id273187"></a><h3>SAM SET LOGONSCRIPT <NAME> <SCRIPT></h3><p> 212 Set the logon script for a user account. 213 </p></div><div class="refsect2" lang="en"><a name="id273198"></a><h3>SAM SET HOMEDRIVE <NAME> <DRIVE></h3><p> 214 Set the home drive for a user account. 215 </p></div><div class="refsect2" lang="en"><a name="id273209"></a><h3>SAM SET WORKSTATIONS <NAME> <WORKSTATIONS></h3><p> 216 Set the workstations a user account is allowed to log in from. 217 </p></div><div class="refsect2" lang="en"><a name="id273219"></a><h3>SAM SET DISABLE <NAME></h3><p> 218 Set the "disabled" flag for a user account. 219 </p></div><div class="refsect2" lang="en"><a name="id273230"></a><h3>SAM SET PWNOTREQ <NAME></h3><p> 220 Set the "password not required" flag for a user account. 221 </p></div><div class="refsect2" lang="en"><a name="id273241"></a><h3>SAM SET AUTOLOCK <NAME></h3><p> 222 Set the "autolock" flag for a user account. 223 </p></div><div class="refsect2" lang="en"><a name="id273251"></a><h3>SAM SET PWNOEXP <NAME></h3><p> 224 Set the "password do not expire" flag for a user account. 225 </p></div><div class="refsect2" lang="en"><a name="id273262"></a><h3>SAM SET PWMUSTCHANGENOW <NAME> [yes|no]</h3><p> 226 Set or unset the "password must change" flag fro a user account. 227 </p></div><div class="refsect2" lang="en"><a name="id273273"></a><h3>SAM POLICY LIST</h3><p> 228 List the avilable account policies. 229 </p></div><div class="refsect2" lang="en"><a name="id273283"></a><h3>SAM POLICY SHOW <account policy></h3><p> 230 Show the account policy value. 231 </p></div><div class="refsect2" lang="en"><a name="id273293"></a><h3>SAM POLICY SET <account policy> <value></h3><p> 232 Set a value for the account policy. 233 Valid values can be: "forever", "never", "off", or a number. 234 </p></div><div class="refsect2" lang="en"><a name="id273305"></a><h3>SAM PROVISION</h3><p> 235 Only available if ldapsam:editposix is set and winbindd is running. 236 Properly populates the ldap tree with the basic accounts (Administrator) 237 and groups (Domain Users, Domain Admins, Domain Guests) on the ldap tree. 238 </p></div><div class="refsect2" lang="en"><a name="id273316"></a><h3>USERSHARE</h3><p>Starting with version 3.0.23, a Samba server now supports the ability for 172 239 non-root users to add user define shares to be exported using the "net usershare" 173 240 commands. … … 198 265 </p><table class="simplelist" border="0" summary="Simple list"><tr><td>net usershare add sharename path [comment] [acl] [guest_ok=[y|n]] - to add or change a user defined share.</td></tr><tr><td>net usershare delete sharename - to delete a user defined share.</td></tr><tr><td>net usershare info [-l|--long] [wildcard sharename] - to print info about a user defined share.</td></tr><tr><td>net usershare list [-l|--long] [wildcard sharename] - to list user defined shares.</td></tr></table><p> 199 266 200 </p><div class="refsect3" lang="en"><a name="id273 099"></a><h4>USERSHARE ADD <em class="replaceable"><code>sharename</code></em> <em class="replaceable"><code>path</code></em> <em class="replaceable"><code>[comment]</code></em> <em class="replaceable"><code>[acl]</code></em> <em class="replaceable"><code>[guest_ok=[y|n]]</code></em></h4><p>267 </p><div class="refsect3" lang="en"><a name="id273363"></a><h4>USERSHARE ADD <em class="replaceable"><code>sharename</code></em> <em class="replaceable"><code>path</code></em> <em class="replaceable"><code>[comment]</code></em> <em class="replaceable"><code>[acl]</code></em> <em class="replaceable"><code>[guest_ok=[y|n]]</code></em></h4><p> 201 268 Add or replace a new user defined share, with name "sharename". 202 269 </p><p> … … 235 302 at connect time so will see the change immediately, there is no need 236 303 to restart smbd on adding, deleting or changing a user defined share. 237 </div><div class="refsect3" lang="en"><a name="id273 157"></a><h4>USERSHARE DELETE <em class="replaceable"><code>sharename</code></em></h4><p>304 </div><div class="refsect3" lang="en"><a name="id273421"></a><h4>USERSHARE DELETE <em class="replaceable"><code>sharename</code></em></h4><p> 238 305 Deletes the user defined share by name. The Samba smbd daemon 239 306 immediately notices this change, although it will not disconnect 240 307 any users currently connected to the deleted share. 241 </p></div><div class="refsect3" lang="en"><a name="id273 171"></a><h4>USERSHARE INFO <em class="replaceable"><code>[-l|--long]</code></em> <em class="replaceable"><code>[wildcard sharename]</code></em></h4><p>308 </p></div><div class="refsect3" lang="en"><a name="id273435"></a><h4>USERSHARE INFO <em class="replaceable"><code>[-l|--long]</code></em> <em class="replaceable"><code>[wildcard sharename]</code></em></h4><p> 242 309 Get info on user defined shares owned by the current user matching the given pattern, or all users. 243 310 </p><p> … … 258 325 And is a list of the current settings of the user defined share that can be 259 326 modified by the "net usershare add" command. 260 </p></div><div class="refsect3" lang="en"><a name="id273 199"></a><h4>USERSHARE LIST <em class="replaceable"><code>[-l|--long]</code></em> <em class="replaceable"><code>wildcard sharename</code></em></h4><p>327 </p></div><div class="refsect3" lang="en"><a name="id273464"></a><h4>USERSHARE LIST <em class="replaceable"><code>[-l|--long]</code></em> <em class="replaceable"><code>wildcard sharename</code></em></h4><p> 261 328 List all the user defined shares owned by the current user matching the given pattern, or all users. 262 329 </p><p> … … 266 333 If the '-l' or '--long' option is also given, it includes the names of user defined 267 334 shares created by other users. 268 </p></div></div><div class="refsect2" lang="en"><a name="id273 224"></a><h3>HELP [COMMAND]</h3><p>Gives usage information for the specified command.</p></div></div><div class="refsect1" lang="en"><a name="id273235"></a><h2>VERSION</h2><p>This man page is complete for version 3.0 of the Samba269 suite.</p></div><div class="refsect1" lang="en"><a name="id273 246"></a><h2>AUTHOR</h2><p>The original Samba software and related utilities335 </p></div></div><div class="refsect2" lang="en"><a name="id273488"></a><h3>HELP [COMMAND]</h3><p>Gives usage information for the specified command.</p></div></div><div class="refsect1" lang="en"><a name="id273499"></a><h2>VERSION</h2><p>This man page is complete for version 3.0 of the Samba 336 suite.</p></div><div class="refsect1" lang="en"><a name="id273510"></a><h2>AUTHOR</h2><p>The original Samba software and related utilities 270 337 were created by Andrew Tridgell. Samba is now developed 271 338 by the Samba Team as an Open Source project similar -
trunk/samba/docs/htmldocs/manpages/rpcclient.1.html
r1 r26 44 44 accessing a service that does not require a password. </p><p>Unless a password is specified on the command line or 45 45 this parameter is specified, the client will request a 46 password.</p></dd><dt><span class="term">-k</span></dt><dd><p> 46 password.</p><p>If a password is specified on the command line and this 47 option is also defined the password on the command line will 48 be silently ingnored and no password will be used.</p></dd><dt><span class="term">-k</span></dt><dd><p> 47 49 Try to authenticate with kerberos. Only useful in 48 50 an Active Directory environment. … … 71 73 it in directly. </p></dd><dt><span class="term">-n <primary NetBIOS name></span></dt><dd><p>This option allows you to override 72 74 the NetBIOS name that Samba uses for itself. This is identical 73 to setting the <a class="indexterm" name="id2717 39"></a> parameter in the <code class="filename">smb.conf</code> file.75 to setting the <a class="indexterm" name="id271744"></a> parameter in the <code class="filename">smb.conf</code> file. 74 76 However, a command 75 77 line setting will take precedence over settings in … … 88 90 the <code class="filename">smb.conf</code> manual page for the list of valid 89 91 options. </p></dd><dt><span class="term">-h|--help</span></dt><dd><p>Print a summary of command line options. 90 </p></dd></dl></div></div><div class="refsect1" lang="en"><a name="id27182 5"></a><h2>COMMANDS</h2><div class="refsect2" lang="en"><a name="id271830"></a><h3>LSARPC</h3><div class="variablelist"><dl><dt><span class="term">lsaquery</span></dt><dd><p>Query info policy</p></dd><dt><span class="term">lookupsids</span></dt><dd><p>Resolve a list92 </p></dd></dl></div></div><div class="refsect1" lang="en"><a name="id271829"></a><h2>COMMANDS</h2><div class="refsect2" lang="en"><a name="id271835"></a><h3>LSARPC</h3><div class="variablelist"><dl><dt><span class="term">lsaquery</span></dt><dd><p>Query info policy</p></dd><dt><span class="term">lookupsids</span></dt><dd><p>Resolve a list 91 93 of SIDs to usernames. 92 94 </p></dd><dt><span class="term">lookupnames</span></dt><dd><p>Resolve a list 93 95 of usernames to SIDs. 94 </p></dd><dt><span class="term">enumtrusts</span></dt><dd><p>Enumerate trusted domains</p></dd><dt><span class="term">enumprivs</span></dt><dd><p>Enumerate privileges</p></dd><dt><span class="term">getdispname</span></dt><dd><p>Get the privilege name</p></dd><dt><span class="term">lsaenumsid</span></dt><dd><p>Enumerate the LSA SIDS</p></dd><dt><span class="term">lsaenumprivsaccount</span></dt><dd><p>Enumerate the privileges of an SID</p></dd><dt><span class="term">lsaenumacctrights</span></dt><dd><p>Enumerate the rights of an SID</p></dd><dt><span class="term">lsaenumacctwithright</span></dt><dd><p>Enumerate accounts with a right</p></dd><dt><span class="term">lsaaddacctrights</span></dt><dd><p>Add rights to an account</p></dd><dt><span class="term">lsaremoveacctrights</span></dt><dd><p>Remove rights from an account</p></dd><dt><span class="term">lsalookupprivvalue</span></dt><dd><p>Get a privilege value given its name</p></dd><dt><span class="term">lsaquerysecobj</span></dt><dd><p>Query LSA security object</p></dd></dl></div></div><div class="refsect2" lang="en"><a name="id27195 4"></a><h3>LSARPC-DS</h3><div class="variablelist"><dl><dt><span class="term">dsroledominfo</span></dt><dd><p>Get Primary Domain Information</p></dd></dl></div><p> </p><p><span class="emphasis"><em>DFS</em></span></p><div class="variablelist"><dl><dt><span class="term">dfsexist</span></dt><dd><p>Query DFS support</p></dd><dt><span class="term">dfsadd</span></dt><dd><p>Add a DFS share</p></dd><dt><span class="term">dfsremove</span></dt><dd><p>Remove a DFS share</p></dd><dt><span class="term">dfsgetinfo</span></dt><dd><p>Query DFS share info</p></dd><dt><span class="term">dfsenum</span></dt><dd><p>Enumerate dfs shares</p></dd></dl></div></div><div class="refsect2" lang="en"><a name="id272023"></a><h3>REG</h3><div class="variablelist"><dl><dt><span class="term">shutdown</span></dt><dd><p>Remote Shutdown</p></dd><dt><span class="term">abortshutdown</span></dt><dd><p>Abort Shutdown</p></dd></dl></div></div><div class="refsect2" lang="en"><a name="id272049"></a><h3>SRVSVC</h3><div class="variablelist"><dl><dt><span class="term">srvinfo</span></dt><dd><p>Server query info</p></dd><dt><span class="term">netshareenum</span></dt><dd><p>Enumerate shares</p></dd><dt><span class="term">netfileenum</span></dt><dd><p>Enumerate open files</p></dd><dt><span class="term">netremotetod</span></dt><dd><p>Fetch remote time of day</p></dd></dl></div></div><div class="refsect2" lang="en"><a name="id272091"></a><h3>SAMR</h3><div class="variablelist"><dl><dt><span class="term">queryuser</span></dt><dd><p>Query user info</p></dd><dt><span class="term">querygroup</span></dt><dd><p>Query group info</p></dd><dt><span class="term">queryusergroups</span></dt><dd><p>Query user groups</p></dd><dt><span class="term">querygroupmem</span></dt><dd><p>Query group membership</p></dd><dt><span class="term">queryaliasmem</span></dt><dd><p>Query alias membership</p></dd><dt><span class="term">querydispinfo</span></dt><dd><p>Query display info</p></dd><dt><span class="term">querydominfo</span></dt><dd><p>Query domain info</p></dd><dt><span class="term">enumdomusers</span></dt><dd><p>Enumerate domain users</p></dd><dt><span class="term">enumdomgroups</span></dt><dd><p>Enumerate domain groups</p></dd><dt><span class="term">enumalsgroups</span></dt><dd><p>Enumerate alias groups</p></dd><dt><span class="term">createdomuser</span></dt><dd><p>Create domain user</p></dd><dt><span class="term">samlookupnames</span></dt><dd><p>Look up names</p></dd><dt><span class="term">samlookuprids</span></dt><dd><p>Look up names</p></dd><dt><span class="term">deletedomuser</span></dt><dd><p>Delete domain user</p></dd><dt><span class="term">samquerysecobj</span></dt><dd><p>Query SAMR security object</p></dd><dt><span class="term">getdompwinfo</span></dt><dd><p>Retrieve domain password info</p></dd><dt><span class="term">lookupdomain</span></dt><dd><p>Look up domain</p></dd></dl></div></div><div class="refsect2" lang="en"><a name="id272237"></a><h3>SPOOLSS</h3><div class="variablelist"><dl><dt><span class="term">adddriver <arch> <config> [<version>]</span></dt><dd><p>96 </p></dd><dt><span class="term">enumtrusts</span></dt><dd><p>Enumerate trusted domains</p></dd><dt><span class="term">enumprivs</span></dt><dd><p>Enumerate privileges</p></dd><dt><span class="term">getdispname</span></dt><dd><p>Get the privilege name</p></dd><dt><span class="term">lsaenumsid</span></dt><dd><p>Enumerate the LSA SIDS</p></dd><dt><span class="term">lsaenumprivsaccount</span></dt><dd><p>Enumerate the privileges of an SID</p></dd><dt><span class="term">lsaenumacctrights</span></dt><dd><p>Enumerate the rights of an SID</p></dd><dt><span class="term">lsaenumacctwithright</span></dt><dd><p>Enumerate accounts with a right</p></dd><dt><span class="term">lsaaddacctrights</span></dt><dd><p>Add rights to an account</p></dd><dt><span class="term">lsaremoveacctrights</span></dt><dd><p>Remove rights from an account</p></dd><dt><span class="term">lsalookupprivvalue</span></dt><dd><p>Get a privilege value given its name</p></dd><dt><span class="term">lsaquerysecobj</span></dt><dd><p>Query LSA security object</p></dd></dl></div></div><div class="refsect2" lang="en"><a name="id271959"></a><h3>LSARPC-DS</h3><div class="variablelist"><dl><dt><span class="term">dsroledominfo</span></dt><dd><p>Get Primary Domain Information</p></dd></dl></div><p> </p><p><span class="emphasis"><em>DFS</em></span></p><div class="variablelist"><dl><dt><span class="term">dfsexist</span></dt><dd><p>Query DFS support</p></dd><dt><span class="term">dfsadd</span></dt><dd><p>Add a DFS share</p></dd><dt><span class="term">dfsremove</span></dt><dd><p>Remove a DFS share</p></dd><dt><span class="term">dfsgetinfo</span></dt><dd><p>Query DFS share info</p></dd><dt><span class="term">dfsenum</span></dt><dd><p>Enumerate dfs shares</p></dd></dl></div></div><div class="refsect2" lang="en"><a name="id272028"></a><h3>REG</h3><div class="variablelist"><dl><dt><span class="term">shutdown</span></dt><dd><p>Remote Shutdown</p></dd><dt><span class="term">abortshutdown</span></dt><dd><p>Abort Shutdown</p></dd></dl></div></div><div class="refsect2" lang="en"><a name="id272053"></a><h3>SRVSVC</h3><div class="variablelist"><dl><dt><span class="term">srvinfo</span></dt><dd><p>Server query info</p></dd><dt><span class="term">netshareenum</span></dt><dd><p>Enumerate shares</p></dd><dt><span class="term">netfileenum</span></dt><dd><p>Enumerate open files</p></dd><dt><span class="term">netremotetod</span></dt><dd><p>Fetch remote time of day</p></dd></dl></div></div><div class="refsect2" lang="en"><a name="id272095"></a><h3>SAMR</h3><div class="variablelist"><dl><dt><span class="term">queryuser</span></dt><dd><p>Query user info</p></dd><dt><span class="term">querygroup</span></dt><dd><p>Query group info</p></dd><dt><span class="term">queryusergroups</span></dt><dd><p>Query user groups</p></dd><dt><span class="term">querygroupmem</span></dt><dd><p>Query group membership</p></dd><dt><span class="term">queryaliasmem</span></dt><dd><p>Query alias membership</p></dd><dt><span class="term">querydispinfo</span></dt><dd><p>Query display info</p></dd><dt><span class="term">querydominfo</span></dt><dd><p>Query domain info</p></dd><dt><span class="term">enumdomusers</span></dt><dd><p>Enumerate domain users</p></dd><dt><span class="term">enumdomgroups</span></dt><dd><p>Enumerate domain groups</p></dd><dt><span class="term">enumalsgroups</span></dt><dd><p>Enumerate alias groups</p></dd><dt><span class="term">createdomuser</span></dt><dd><p>Create domain user</p></dd><dt><span class="term">samlookupnames</span></dt><dd><p>Look up names</p></dd><dt><span class="term">samlookuprids</span></dt><dd><p>Look up names</p></dd><dt><span class="term">deletedomuser</span></dt><dd><p>Delete domain user</p></dd><dt><span class="term">samquerysecobj</span></dt><dd><p>Query SAMR security object</p></dd><dt><span class="term">getdompwinfo</span></dt><dd><p>Retrieve domain password info</p></dd><dt><span class="term">lookupdomain</span></dt><dd><p>Look up domain</p></dd></dl></div></div><div class="refsect2" lang="en"><a name="id272241"></a><h3>SPOOLSS</h3><div class="variablelist"><dl><dt><span class="term">adddriver <arch> <config> [<version>]</span></dt><dd><p> 95 97 Execute an AddPrinterDriver() RPC to install the printer driver 96 98 information on the server. Note that the driver files should … … 177 179 <span><strong class="command">enumdrivers</strong></span> commands for obtaining a list of 178 180 of installed printers and drivers.</p></dd><dt><span class="term">addform</span></dt><dd><p>Add form</p></dd><dt><span class="term">setform</span></dt><dd><p>Set form</p></dd><dt><span class="term">getform</span></dt><dd><p>Get form</p></dd><dt><span class="term">deleteform</span></dt><dd><p>Delete form</p></dd><dt><span class="term">enumforms</span></dt><dd><p>Enumerate form</p></dd><dt><span class="term">setprinter</span></dt><dd><p>Set printer comment</p></dd><dt><span class="term">setprinterdata</span></dt><dd><p>Set REG_SZ printer data</p></dd><dt><span class="term">setprintername <printername> 179 <newprintername></span></dt><dd><p>Set printer name</p></dd><dt><span class="term">rffpcnex</span></dt><dd><p>Rffpcnex test</p></dd></dl></div></div><div class="refsect2" lang="en"><a name="id27261 2"></a><h3>NETLOGON</h3><div class="variablelist"><dl><dt><span class="term">logonctrl2</span></dt><dd><p>Logon Control 2</p></dd><dt><span class="term">logonctrl</span></dt><dd><p>Logon Control</p></dd><dt><span class="term">samsync</span></dt><dd><p>Sam Synchronisation</p></dd><dt><span class="term">samdeltas</span></dt><dd><p>Query Sam Deltas</p></dd><dt><span class="term">samlogon</span></dt><dd><p>Sam Logon</p></dd></dl></div></div><div class="refsect2" lang="en"><a name="id272673"></a><h3>GENERAL COMMANDS</h3><div class="variablelist"><dl><dt><span class="term">debuglevel</span></dt><dd><p>Set the current181 <newprintername></span></dt><dd><p>Set printer name</p></dd><dt><span class="term">rffpcnex</span></dt><dd><p>Rffpcnex test</p></dd></dl></div></div><div class="refsect2" lang="en"><a name="id272617"></a><h3>NETLOGON</h3><div class="variablelist"><dl><dt><span class="term">logonctrl2</span></dt><dd><p>Logon Control 2</p></dd><dt><span class="term">logonctrl</span></dt><dd><p>Logon Control</p></dd><dt><span class="term">samsync</span></dt><dd><p>Sam Synchronisation</p></dd><dt><span class="term">samdeltas</span></dt><dd><p>Query Sam Deltas</p></dd><dt><span class="term">samlogon</span></dt><dd><p>Sam Logon</p></dd></dl></div></div><div class="refsect2" lang="en"><a name="id272677"></a><h3>GENERAL COMMANDS</h3><div class="variablelist"><dl><dt><span class="term">debuglevel</span></dt><dd><p>Set the current 180 182 debug level used to log information.</p></dd><dt><span class="term">help (?)</span></dt><dd><p>Print a listing of all 181 183 known commands or extended help on a particular command. 182 184 </p></dd><dt><span class="term">quit (exit)</span></dt><dd><p>Exit <span><strong class="command">rpcclient 183 </strong></span>.</p></dd></dl></div></div></div><div class="refsect1" lang="en"><a name="id27271 4"></a><h2>BUGS</h2><p><span><strong class="command">rpcclient</strong></span> is designed as a developer testing tool185 </strong></span>.</p></dd></dl></div></div></div><div class="refsect1" lang="en"><a name="id272719"></a><h2>BUGS</h2><p><span><strong class="command">rpcclient</strong></span> is designed as a developer testing tool 184 186 and may not be robust in certain areas (such as command line parsing). 185 187 It has been known to generate a core dump upon failures when invalid … … 194 196 the developers are sending reports to Microsoft, and problems found 195 197 or reported to Microsoft are fixed in Service Packs, which may 196 result in incompatibilities.</p></div><div class="refsect1" lang="en"><a name="id2727 66"></a><h2>VERSION</h2><p>This man page is correct for version 3.0 of the Samba197 suite.</p></div><div class="refsect1" lang="en"><a name="id2727 76"></a><h2>AUTHOR</h2><p>The original Samba software and related utilities198 result in incompatibilities.</p></div><div class="refsect1" lang="en"><a name="id272770"></a><h2>VERSION</h2><p>This man page is correct for version 3.0 of the Samba 199 suite.</p></div><div class="refsect1" lang="en"><a name="id272781"></a><h2>AUTHOR</h2><p>The original Samba software and related utilities 198 200 were created by Andrew Tridgell. Samba is now developed 199 201 by the Samba Team as an Open Source project similar -
trunk/samba/docs/htmldocs/manpages/smb.conf.5.html
r22 r26 384 384 added to Samba's domain and a Unix account matching the machine's name appended with a "$" does not 385 385 already exist. 386 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>add machine script</code></em> = 386 </p><p>This option is very similar to the <a class="indexterm" name="id273163"></a>add user script, and likewise uses the %u 387 substitution for the account name. Do not use the %m 388 substitution. </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>add machine script</code></em> = 387 389 </em></span> 388 390 </p><p>Example: <span class="emphasis"><em><em class="parameter"><code>add machine script</code></em> = /usr/sbin/adduser -n -g machines -c Machine -d /var/lib/nobody -s /bin/false %u … … 452 454 </p></li></ul></div><p> 453 455 This parameter is only used for add file shares. To add printer shares, 454 see the <a class="indexterm" name="id2735 62"></a>addprinter command.456 see the <a class="indexterm" name="id273574"></a>addprinter command. 455 457 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>add share command</code></em> = 456 458 </em></span> … … 469 471 </p><p> 470 472 In order to use this option, <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> must <span class="emphasis"><em>NOT</em></span> be set to 471 <a class="indexterm" name="id2 73651"></a>security = share and <a class="indexterm" name="id273658"></a>add user script473 <a class="indexterm" name="id229350"></a>security = share and <a class="indexterm" name="id229357"></a>add user script 472 474 must be set to a full pathname for a script that will create a UNIX user given one argument of 473 475 <em class="parameter"><code>%u</code></em>, which expands into the UNIX user name to create. 474 476 </p><p> 475 477 When the Windows user attempts to access the Samba server, at login (session setup in 476 the SMB protocol) time, <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> contacts the <a class="indexterm" name="id2 73684"></a>password server478 the SMB protocol) time, <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> contacts the <a class="indexterm" name="id229383"></a>password server 477 479 and attempts to authenticate the given user with the given password. If the authentication 478 480 succeeds then <span><strong class="command">smbd</strong></span> attempts to find a UNIX user in the UNIX 479 481 password database to map the Windows user into. If this lookup fails, and 480 <a class="indexterm" name="id2 73699"></a>add user script is set then <span><strong class="command">smbd</strong></span> will482 <a class="indexterm" name="id229398"></a>add user script is set then <span><strong class="command">smbd</strong></span> will 481 483 call the specified script <span class="emphasis"><em>AS ROOT</em></span>, expanding any 482 484 <em class="parameter"><code>%u</code></em> argument to be the user name to create. … … 486 488 match existing Windows NT accounts. 487 489 </p><p> 488 See also <a class="indexterm" name="id273 737"></a>security, <a class="indexterm" name="id273744"></a>password server,489 <a class="indexterm" name="id273 751"></a>delete user script.490 See also <a class="indexterm" name="id273817"></a>security, <a class="indexterm" name="id273824"></a>password server, 491 <a class="indexterm" name="id273831"></a>delete user script. 490 492 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>add user script</code></em> = 491 493 </em></span> … … 508 510 will do all file operations as the super-user (root).</p><p>You should use this option very carefully, as any user in 509 511 this list will be able to do anything they like on the share, 510 irrespective of file permissions.</p><p>This parameter will not work with the <a class="indexterm" name="id273 891"></a>security = share in512 irrespective of file permissions.</p><p>This parameter will not work with the <a class="indexterm" name="id273971"></a>security = share in 511 513 Samba 3.0. This is by design.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>admin users</code></em> = 512 514 </em></span> … … 558 560 </em></span> 559 561 </p></dd><dt><span class="term"><a name="ALLOWTRUSTEDDOMAINS"></a>allow trusted domains (G)</span></dt><dd><p> 560 This option only takes effect when the <a class="indexterm" name="id274 144"></a>security option is set to562 This option only takes effect when the <a class="indexterm" name="id274224"></a>security option is set to 561 563 <code class="constant">server</code>,<code class="constant">domain</code> or <code class="constant">ads</code>. 562 564 If it is set to no, then attempts to connect to a resource from … … 593 595 </p></dd><dt><span class="term"><a name="AUTHMETHODS"></a>auth methods (G)</span></dt><dd><p> 594 596 This option allows the administrator to chose what authentication methods <span><strong class="command">smbd</strong></span> 595 will use when authenticating a user. This option defaults to sensible values based on <a class="indexterm" name="id2743 14"></a>security.597 will use when authenticating a user. This option defaults to sensible values based on <a class="indexterm" name="id274394"></a>security. 596 598 This should be considered a developer option and used only in rare circumstances. In the majority (if not all) 597 599 of production servers, the default setting should be adequate. … … 621 623 affects file service <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> and name service <a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> in a slightly different ways.</p><p> 622 624 For name service it causes <span><strong class="command">nmbd</strong></span> to bind to ports 137 and 138 on the 623 interfaces listed in the <a class="indexterm" name="id274 468"></a>interfaces parameter. <span><strong class="command">nmbd</strong></span>625 interfaces listed in the <a class="indexterm" name="id274548"></a>interfaces parameter. <span><strong class="command">nmbd</strong></span> 624 626 also binds to the "all addresses" interface (0.0.0.0) on ports 137 and 138 for the purposes of 625 627 reading broadcast messages. If this option is not set then <span><strong class="command">nmbd</strong></span> will 626 service name requests on all of these sockets. If <a class="indexterm" name="id274 489"></a>bind interfaces only is set then628 service name requests on all of these sockets. If <a class="indexterm" name="id274569"></a>bind interfaces only is set then 627 629 <span><strong class="command">nmbd</strong></span> will check the source address of any packets coming in on the 628 630 broadcast sockets and discard any that don't match the broadcast addresses of the interfaces in the 629 <a class="indexterm" name="id2745 03"></a>interfaces parameter list. As unicast packets are received on the other sockets it631 <a class="indexterm" name="id274583"></a>interfaces parameter list. As unicast packets are received on the other sockets it 630 632 allows <span><strong class="command">nmbd</strong></span> to refuse to serve names to machines that send packets that 631 arrive through any interfaces not listed in the <a class="indexterm" name="id2745 18"></a>interfaces list. IP Source address633 arrive through any interfaces not listed in the <a class="indexterm" name="id274598"></a>interfaces list. IP Source address 632 634 spoofing does defeat this simple check, however, so it must not be used seriously as a security feature for 633 635 <span><strong class="command">nmbd</strong></span>. 634 636 </p><p> 635 For file service it causes <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> to bind only to the interface list given in the <a class="indexterm" name="id274 544"></a>interfaces parameter. This restricts the networks that <span><strong class="command">smbd</strong></span> will637 For file service it causes <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> to bind only to the interface list given in the <a class="indexterm" name="id274624"></a>interfaces parameter. This restricts the networks that <span><strong class="command">smbd</strong></span> will 636 638 serve to packets coming in those interfaces. Note that you should not use this parameter for machines that 637 639 are serving PPP or other intermittent or non-broadcast network interfaces as it will not cope with 638 640 non-permanent interfaces. 639 641 </p><p> 640 If <a class="indexterm" name="id274 562"></a>bind interfaces only is set then unless the network address641 <span class="emphasis"><em>127.0.0.1</em></span> is added to the <a class="indexterm" name="id274 574"></a>interfaces parameter list642 If <a class="indexterm" name="id274642"></a>bind interfaces only is set then unless the network address 643 <span class="emphasis"><em>127.0.0.1</em></span> is added to the <a class="indexterm" name="id274654"></a>interfaces parameter list 642 644 <a href="smbpasswd.8.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(8)</span></a> and 643 645 <a href="swat.8.html"><span class="citerefentry"><span class="refentrytitle">swat</span>(8)</span></a> may not work as … … 646 648 To change a users SMB password, the <span><strong class="command">smbpasswd</strong></span> by default connects to the 647 649 <span class="emphasis"><em>localhost - 127.0.0.1</em></span> address as an SMB client to issue the password change request. If 648 <a class="indexterm" name="id2746 11"></a>bind interfaces only is set then unless the network address649 <span class="emphasis"><em>127.0.0.1</em></span> is added to the <a class="indexterm" name="id274 622"></a>interfaces parameter list then <span><strong class="command"> smbpasswd</strong></span> will fail to connect in it's default mode. <span><strong class="command">smbpasswd</strong></span> can be forced to use the primary IP interface of the local host by using650 <a class="indexterm" name="id274691"></a>bind interfaces only is set then unless the network address 651 <span class="emphasis"><em>127.0.0.1</em></span> is added to the <a class="indexterm" name="id274702"></a>interfaces parameter list then <span><strong class="command"> smbpasswd</strong></span> will fail to connect in it's default mode. <span><strong class="command">smbpasswd</strong></span> can be forced to use the primary IP interface of the local host by using 650 652 its <a href="smbpasswd.8.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(8)</span></a> <em class="parameter"><code>-r <em class="replaceable"><code>remote machine</code></em></code></em> parameter, with <em class="replaceable"><code>remote 651 653 machine</code></em> set to the IP name of the primary interface of the local host. … … 691 693 this.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>browse list</code></em> = yes 692 694 </em></span> 693 </p></dd><dt><span class="term"><a name="CASESIGNAMES"></a>casesignames</span></dt><dd><p>This parameter is a synonym for case sensitive.</p></dd><dt><span class="term"><a name="CASESENSITIVE"></a>case sensitive (S)</span></dt><dd><p>See the discussion in the section <a class="indexterm" name="id2750 01"></a>name mangling.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>case sensitive</code></em> = no695 </p></dd><dt><span class="term"><a name="CASESIGNAMES"></a>casesignames</span></dt><dd><p>This parameter is a synonym for case sensitive.</p></dd><dt><span class="term"><a name="CASESENSITIVE"></a>case sensitive (S)</span></dt><dd><p>See the discussion in the section <a class="indexterm" name="id275081"></a>name mangling.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>case sensitive</code></em> = no 694 696 </em></span> 695 697 </p></dd><dt><span class="term"><a name="CHANGENOTIFY"></a>change notify (S)</span></dt><dd><p>This parameter specifies whether Samba should reply … … 766 768 </p></dd><dt><span class="term"><a name="CLIENTSCHANNEL"></a>client schannel (G)</span></dt><dd><p> 767 769 This controls whether the client offers or even demands the use of the netlogon schannel. 768 <a class="indexterm" name="id275 474"></a>client schannel = no does not offer the schannel,769 <a class="indexterm" name="id275 481"></a>client schannel = auto offers the schannel but does not770 enforce it, and <a class="indexterm" name="id275 489"></a>client schannel = yes denies access770 <a class="indexterm" name="id275554"></a>client schannel = no does not offer the schannel, 771 <a class="indexterm" name="id275561"></a>client schannel = auto offers the schannel but does not 772 enforce it, and <a class="indexterm" name="id275569"></a>client schannel = yes denies access 771 773 if the server is not able to speak netlogon schannel. 772 774 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>client schannel</code></em> = auto … … 792 794 neighborhood or via <span><strong class="command">net view</strong></span> to list what shares 793 795 are available.</p><p>If you want to set the string that is displayed next to the 794 machine name then see the <a class="indexterm" name="id275 637"></a>server string parameter.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>comment</code></em> =796 machine name then see the <a class="indexterm" name="id275717"></a>server string parameter.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>comment</code></em> = 795 797 # No comment 796 798 </em></span> … … 827 829 </p><p> 828 830 Following this Samba will bit-wise 'OR' the UNIX mode created from this parameter with the value of the 829 <a class="indexterm" name="id275 845"></a>force create mode parameter which is set to 000 by default.830 </p><p> 831 This parameter does not affect directory masks. See the parameter <a class="indexterm" name="id275 856"></a>directory mask831 <a class="indexterm" name="id275925"></a>force create mode parameter which is set to 000 by default. 832 </p><p> 833 This parameter does not affect directory masks. See the parameter <a class="indexterm" name="id275936"></a>directory mask 832 834 for details. 833 835 </p><p> 834 836 Note that this parameter does not apply to permissions set by Windows NT/2000 ACL editors. If the 835 administrator wishes to enforce a mask on access control lists also, they need to set the <a class="indexterm" name="id275 868"></a>security mask.837 administrator wishes to enforce a mask on access control lists also, they need to set the <a class="indexterm" name="id275948"></a>security mask. 836 838 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>create mask</code></em> = 0744 837 839 </em></span> … … 845 847 </p><p> 846 848 For example, shares containing roaming profiles can have offline caching disabled using 847 <a class="indexterm" name="id27 5933"></a>csc policy = disable.849 <a class="indexterm" name="id276013"></a>csc policy = disable. 848 850 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>csc policy</code></em> = manual 849 851 </em></span> … … 851 853 </em></span> 852 854 </p></dd><dt><span class="term"><a name="CUPSOPTIONS"></a>cups options (S)</span></dt><dd><p> 853 This parameter is only applicable if <a class="indexterm" name="id27 5986"></a>printing is855 This parameter is only applicable if <a class="indexterm" name="id276066"></a>printing is 854 856 set to <code class="constant">cups</code>. Its value is a free form string of options 855 857 passed directly to the cups library. … … 870 872 </em></span> 871 873 </p></dd><dt><span class="term"><a name="CUPSSERVER"></a>cups server (G)</span></dt><dd><p> 872 This parameter is only applicable if <a class="indexterm" name="id276 069"></a>printing is set to <code class="constant">cups</code>.874 This parameter is only applicable if <a class="indexterm" name="id276149"></a>printing is set to <code class="constant">cups</code>. 873 875 </p><p> 874 876 If set, this option overrides the ServerName option in the CUPS <code class="filename">client.conf</code>. This is … … 899 901 boolean parameter adds microsecond resolution to the timestamp message header when turned on. 900 902 </p><p> 901 Note that the parameter <a class="indexterm" name="id2762 19"></a>debug timestamp must be on for this to have an effect.903 Note that the parameter <a class="indexterm" name="id276299"></a>debug timestamp must be on for this to have an effect. 902 904 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>debug hires timestamp</code></em> = no 903 905 </em></span> … … 907 909 logfile when turned on. 908 910 </p><p> 909 Note that the parameter <a class="indexterm" name="id276 272"></a>debug timestamp must be on for this to have an effect.911 Note that the parameter <a class="indexterm" name="id276352"></a>debug timestamp must be on for this to have an effect. 910 912 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>debug pid</code></em> = no 911 913 </em></span> 912 914 </p></dd><dt><span class="term"><a name="DEBUGPREFIXTIMESTAMP"></a>debug prefix timestamp (G)</span></dt><dd><p> 913 915 With this option enabled, the timestamp message header is prefixed to the debug message without the 914 filename and function information that is included with the <a class="indexterm" name="id2763 15"></a>debug timestamp916 filename and function information that is included with the <a class="indexterm" name="id276395"></a>debug timestamp 915 917 parameter. This gives timestamps to the messages without adding an additional line. 916 918 </p><p> 917 Note that this parameter overrides the <a class="indexterm" name="id276 326"></a>debug timestamp parameter.919 Note that this parameter overrides the <a class="indexterm" name="id276406"></a>debug timestamp parameter. 918 920 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>debug prefix timestamp</code></em> = no 919 921 </em></span> 920 922 </p></dd><dt><span class="term"><a name="TIMESTAMPLOGS"></a>timestamp logs</span></dt><dd><p>This parameter is a synonym for debug timestamp.</p></dd><dt><span class="term"><a name="DEBUGTIMESTAMP"></a>debug timestamp (G)</span></dt><dd><p> 921 923 Samba debug log messages are timestamped by default. If you are running at a high 922 <a class="indexterm" name="id276 388"></a>debug level these timestamps can be distracting. This924 <a class="indexterm" name="id276468"></a>debug level these timestamps can be distracting. This 923 925 boolean parameter allows timestamping to be turned off. 924 926 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>debug timestamp</code></em> = yes … … 928 930 current euid, egid, uid and gid to the timestamp message headers in the log file if turned on. 929 931 </p><p> 930 Note that the parameter <a class="indexterm" name="id276 434"></a>debug timestamp must be on for this to have an effect.932 Note that the parameter <a class="indexterm" name="id276514"></a>debug timestamp must be on for this to have an effect. 931 933 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>debug uid</code></em> = no 932 934 </em></span> 933 </p></dd><dt><span class="term"><a name="DEFAULTCASE"></a>default case (S)</span></dt><dd><p>See the section on <a class="indexterm" name="id276 474"></a>name mangling.934 Also note the <a class="indexterm" name="id276 481"></a>short preserve case parameter.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>default case</code></em> = lower935 </em></span> 936 </p></dd><dt><span class="term"><a name="DEFAULTDEVMODE"></a>default devmode (S)</span></dt><dd><p>This parameter is only applicable to <a class="indexterm" name="id276 522"></a>printable services.935 </p></dd><dt><span class="term"><a name="DEFAULTCASE"></a>default case (S)</span></dt><dd><p>See the section on <a class="indexterm" name="id276554"></a>name mangling. 936 Also note the <a class="indexterm" name="id276561"></a>short preserve case parameter.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>default case</code></em> = lower 937 </em></span> 938 </p></dd><dt><span class="term"><a name="DEFAULTDEVMODE"></a>default devmode (S)</span></dt><dd><p>This parameter is only applicable to <a class="indexterm" name="id276602"></a>printable services. 937 939 When smbd is serving Printer Drivers to Windows NT/2k/XP clients, each printer on the Samba 938 940 server has a Device Mode which defines things such as paper size and … … 963 965 parameter is not given, attempting to connect to a nonexistent 964 966 service results in an error.</p><p> 965 Typically the default service would be a <a class="indexterm" name="id276 633"></a>guest ok, <a class="indexterm" name="id276640"></a>read-only service.</p><p>Also note that the apparent service name will be changed to equal967 Typically the default service would be a <a class="indexterm" name="id276708"></a>guest ok, <a class="indexterm" name="id276716"></a>read-only service.</p><p>Also note that the apparent service name will be changed to equal 966 968 that of the requested service, this is very useful as it allows you to use macros like <em class="parameter"><code>%S</code></em> to make a wildcard service. 967 969 </p><p>Note also that any "_" characters in the name of the service … … 995 997 DeletePrinter() RPC call.</p><p>For a Samba host this means that the printer must be 996 998 physically deleted from underlying printing system. The 997 <a class="indexterm" name="id2768 11"></a>deleteprinter command defines a script to be run which999 <a class="indexterm" name="id276886"></a>deleteprinter command defines a script to be run which 998 1000 will perform the necessary operations for removing the printer 999 1001 from the print system and from <code class="filename">smb.conf</code>. 1000 </p><p>The <a class="indexterm" name="id276 828"></a>deleteprinter command is1001 automatically called with only one parameter: <a class="indexterm" name="id276 836"></a>printer name.1002 </p><p>Once the <a class="indexterm" name="id276 846"></a>deleteprinter command has1002 </p><p>The <a class="indexterm" name="id276904"></a>deleteprinter command is 1003 automatically called with only one parameter: <a class="indexterm" name="id276912"></a>printer name. 1004 </p><p>Once the <a class="indexterm" name="id276922"></a>deleteprinter command has 1003 1005 been executed, <span><strong class="command">smbd</strong></span> will reparse the <code class="filename"> 1004 1006 smb.conf</code> to associated printer no longer exists. … … 1030 1032 </p></li></ul></div><p> 1031 1033 This parameter is only used to remove file shares. To delete printer shares, 1032 see the <a class="indexterm" name="id277 034"></a>deleteprinter command.1034 see the <a class="indexterm" name="id277110"></a>deleteprinter command. 1033 1035 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>delete share command</code></em> = 1034 1036 </em></span> … … 1055 1057 </p></dd><dt><span class="term"><a name="DELETEVETOFILES"></a>delete veto files (S)</span></dt><dd><p>This option is used when Samba is attempting to 1056 1058 delete a directory that contains one or more vetoed directories 1057 (see the <a class="indexterm" name="id277 224"></a>veto files1059 (see the <a class="indexterm" name="id277300"></a>veto files 1058 1060 option). If this option is set to <code class="constant">no</code> (the default) then if a vetoed 1059 1061 directory contains any non-vetoed files or directories then the … … 1063 1065 serving systems such as NetAtalk which create meta-files within 1064 1066 directories you might normally veto DOS/Windows users from seeing 1065 (e.g. <code class="filename">.AppleDouble</code>)</p><p>Setting <a class="indexterm" name="id277 254"></a>delete veto files = yes allows these1067 (e.g. <code class="filename">.AppleDouble</code>)</p><p>Setting <a class="indexterm" name="id277330"></a>delete veto files = yes allows these 1066 1068 directories to be transparently deleted when the parent directory 1067 1069 is deleted (so long as the user has permissions to do so).</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>delete veto files</code></em> = no … … 1075 1077 This is a new parameter introduced in Samba version 3.0.21. It specifies in seconds the time that smbd will 1076 1078 cache the output of a disk free query. If set to zero (the default) no caching is done. This allows a heavily 1077 loaded server to prevent rapid spawning of <a class="indexterm" name="id2773 09"></a>dfree command scripts increasing the load.1079 loaded server to prevent rapid spawning of <a class="indexterm" name="id277385"></a>dfree command scripts increasing the load. 1078 1080 </p><p> 1079 1081 By default this parameter is zero, meaning no caching will be done. … … 1091 1093 </p><p> 1092 1094 In Samba version 3.0.21 this parameter has been changed to be a per-share parameter, and in addition the 1093 parameter <a class="indexterm" name="id277 376"></a>dfree cache time was added to allow the output of this script to be cached1095 parameter <a class="indexterm" name="id277452"></a>dfree cache time was added to allow the output of this script to be cached 1094 1096 for systems under heavy load. 1095 1097 </p><p> … … 1129 1131 and 'other' write bits from the UNIX mode, allowing only the 1130 1132 user who owns the directory to modify it.</p><p>Following this Samba will bit-wise 'OR' the UNIX mode 1131 created from this parameter with the value of the <a class="indexterm" name="id2775 04"></a>force directory mode parameter.1133 created from this parameter with the value of the <a class="indexterm" name="id277580"></a>force directory mode parameter. 1132 1134 This parameter is set to 000 by default (i.e. no extra mode bits are added).</p><p>Note that this parameter does not apply to permissions 1133 1135 set by Windows NT/2000 ACL editors. If the administrator wishes to enforce 1134 a mask on access control lists also, they need to set the <a class="indexterm" name="id2775 17"></a>directory security mask.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>directory mask</code></em> = 07551136 a mask on access control lists also, they need to set the <a class="indexterm" name="id277593"></a>directory security mask.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>directory mask</code></em> = 0755 1135 1137 </em></span> 1136 1138 </p><p>Example: <span class="emphasis"><em><em class="parameter"><code>directory mask</code></em> = 0775 … … 1141 1143 box.</p><p> 1142 1144 This parameter is applied as a mask (AND'ed with) to the changed permission bits, thus preventing any bits not 1143 in this mask from being modified. Make sure not to mix up this parameter with <a class="indexterm" name="id277 576"></a>force directory security mode, which works similar like this one but uses logical OR instead of AND.1145 in this mask from being modified. Make sure not to mix up this parameter with <a class="indexterm" name="id277652"></a>force directory security mode, which works similar like this one but uses logical OR instead of AND. 1144 1146 Essentially, zero bits in this mask may be treated as a set of bits the user is not allowed to change. 1145 1147 </p><p>If not set explicitly this parameter is set to 0777 … … 1175 1177 The default value is "LOCALE", which means automatically set, depending on the 1176 1178 current locale. The value should generally be the same as the value of the parameter 1177 <a class="indexterm" name="id277 728"></a>unix charset.1179 <a class="indexterm" name="id277804"></a>unix charset. 1178 1180 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>display charset</code></em> = "LOCALE" or "ASCII" (depending on the system) 1179 1181 </em></span> … … 1207 1209 If set to <code class="constant">yes</code>, the Samba server will 1208 1210 provide the netlogon service for Windows 9X network logons for the 1209 <a class="indexterm" name="id277 888"></a>workgroup it is in.1211 <a class="indexterm" name="id277964"></a>workgroup it is in. 1210 1212 This will also cause the Samba server to act as a domain 1211 1213 controller for NT4 style domain services. For more details on … … 1218 1220 WAN-wide browse list collation. Setting this option causes <span><strong class="command">nmbd</strong></span> to claim a 1219 1221 special domain specific NetBIOS name that identifies it as a domain master browser for its given 1220 <a class="indexterm" name="id27 7946"></a>workgroup. Local master browsers in the same <a class="indexterm" name="id277953"></a>workgroup on1222 <a class="indexterm" name="id278021"></a>workgroup. Local master browsers in the same <a class="indexterm" name="id278029"></a>workgroup on 1221 1223 broadcast-isolated subnets will give this <span><strong class="command">nmbd</strong></span> their local browse lists, 1222 1224 and then ask <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> for a … … 1225 1227 broadcast-isolated subnet. 1226 1228 </p><p> 1227 Note that Windows NT Primary Domain Controllers expect to be able to claim this <a class="indexterm" name="id27 7981"></a>workgroup specific special NetBIOS name that identifies them as domain master browsers for that1228 <a class="indexterm" name="id27 7988"></a>workgroup by default (i.e. there is no way to prevent a Windows NT PDC from attempting1229 Note that Windows NT Primary Domain Controllers expect to be able to claim this <a class="indexterm" name="id278056"></a>workgroup specific special NetBIOS name that identifies them as domain master browsers for that 1230 <a class="indexterm" name="id278064"></a>workgroup by default (i.e. there is no way to prevent a Windows NT PDC from attempting 1229 1231 to do this). This means that if this parameter is set and <span><strong class="command">nmbd</strong></span> claims the 1230 special name for a <a class="indexterm" name="id2780 03"></a>workgroup before a Windows NT PDC is able to do so then cross1232 special name for a <a class="indexterm" name="id278078"></a>workgroup before a Windows NT PDC is able to do so then cross 1231 1233 subnet browsing will behave strangely and may fail. 1232 1234 </p><p> 1233 If <a class="indexterm" name="id2780 14"></a>domain logons = yes, then the default behavior is to enable the1234 <a class="indexterm" name="id2780 21"></a>domain master parameter. If <a class="indexterm" name="id278029"></a>domain logons is not enabled (the1235 default setting), then neither will <a class="indexterm" name="id278 036"></a>domain master be enabled by default.1236 </p><p> 1237 When <a class="indexterm" name="id278 047"></a>domain logons = Yes the default setting for this parameter is1238 Yes, with the result that Samba will be a PDC. If <a class="indexterm" name="id278 055"></a>domain master = No,1235 If <a class="indexterm" name="id278090"></a>domain logons = yes, then the default behavior is to enable the 1236 <a class="indexterm" name="id278097"></a>domain master parameter. If <a class="indexterm" name="id278104"></a>domain logons is not enabled (the 1237 default setting), then neither will <a class="indexterm" name="id278112"></a>domain master be enabled by default. 1238 </p><p> 1239 When <a class="indexterm" name="id278123"></a>domain logons = Yes the default setting for this parameter is 1240 Yes, with the result that Samba will be a PDC. If <a class="indexterm" name="id278130"></a>domain master = No, 1239 1241 Samba will function as a BDC. In general, this parameter should be set to 'No' only on a BDC. 1240 1242 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>domain master</code></em> = auto … … 1342 1344 <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> must either 1343 1345 have access to a local <a href="smbpasswd.5.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(5)</span></a> file (see the <a href="smbpasswd.8.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(8)</span></a> program for information on how to set up 1344 and maintain this file), or set the <a class="indexterm" name="id2 29365"></a>security = [server|domain|ads] parameter which1346 and maintain this file), or set the <a class="indexterm" name="id278606"></a>security = [server|domain|ads] parameter which 1345 1347 causes <span><strong class="command">smbd</strong></span> to authenticate against another 1346 1348 server.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>encrypt passwords</code></em> = yes … … 1418 1420 file open/close operations. This can give enormous performance benefits. 1419 1421 </p><p>When you set <span><strong class="command">fake oplocks = yes</strong></span>, <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> will 1420 always grant oplock requests no matter how many clients are using the file.</p><p>It is generally much better to use the real <a class="indexterm" name="id2789 00"></a>oplocks support rather1422 always grant oplock requests no matter how many clients are using the file.</p><p>It is generally much better to use the real <a class="indexterm" name="id278911"></a>oplocks support rather 1421 1423 than this parameter.</p><p>If you enable this option on all read-only shares or 1422 1424 shares that you know will only be accessed from one client at a … … 1468 1470 </p><p> 1469 1471 This parameter is applied as a mask (OR'ed with) to the changed permission bits, thus forcing any bits in this 1470 mask that the user may have modified to be on. Make sure not to mix up this parameter with <a class="indexterm" name="id2791 43"></a>directory security mask, which works in a similar manner to this one, but uses a logical AND instead1472 mask that the user may have modified to be on. Make sure not to mix up this parameter with <a class="indexterm" name="id279154"></a>directory security mask, which works in a similar manner to this one, but uses a logical AND instead 1471 1473 of an OR. 1472 1474 </p><p> … … 1502 1504 primary group assigned to sys when accessing this Samba share. All 1503 1505 other users will retain their ordinary primary group.</p><p> 1504 If the <a class="indexterm" name="id2792 55"></a>force user parameter is also set the group specified in1506 If the <a class="indexterm" name="id279266"></a>force user parameter is also set the group specified in 1505 1507 <em class="parameter"><code>force group</code></em> will override the primary group 1506 1508 set in <em class="parameter"><code>force user</code></em>.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>force group</code></em> = … … 1536 1538 </p><p> 1537 1539 This parameter is applied as a mask (OR'ed with) to the changed permission bits, thus forcing any bits in this 1538 mask that the user may have modified to be on. Make sure not to mix up this parameter with <a class="indexterm" name="id27940 1"></a>security mask, which works similar like this one but uses logical AND instead of OR.1540 mask that the user may have modified to be on. Make sure not to mix up this parameter with <a class="indexterm" name="id279408"></a>security mask, which works similar like this one but uses logical AND instead of OR. 1539 1541 </p><p> 1540 1542 Essentially, one bits in this mask may be treated as a set of bits that, when modifying security on a file, … … 1604 1606 caching algorithm will be used to reduce the time taken for getwd() 1605 1607 calls. This can have a significant impact on performance, especially 1606 when the <a class="indexterm" name="id2798 05"></a>wide smbconfoptions parameter is set to <code class="constant">no</code>.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>getwd cache</code></em> = yes1608 when the <a class="indexterm" name="id279813"></a>wide smbconfoptions parameter is set to <code class="constant">no</code>.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>getwd cache</code></em> = yes 1607 1609 </em></span> 1608 1610 </p></dd><dt><span class="term"><a name="GUESTACCOUNT"></a>guest account (G)</span></dt><dd><p>This is a username which will be used for access 1609 to services which are specified as <a class="indexterm" name="id27985 0"></a>guest ok (see below). Whatever privileges this1611 to services which are specified as <a class="indexterm" name="id279857"></a>guest ok (see below). Whatever privileges this 1610 1612 user has will be available to any client connecting to the guest service. 1611 1613 This user must exist in the password file, but does not require … … 1626 1628 </p></dd><dt><span class="term"><a name="PUBLIC"></a>public</span></dt><dd><p>This parameter is a synonym for guest ok.</p></dd><dt><span class="term"><a name="GUESTOK"></a>guest ok (S)</span></dt><dd><p>If this parameter is <code class="constant">yes</code> for 1627 1629 a service, then no password is required to connect to the service. 1628 Privileges will be those of the <a class="indexterm" name="id2799 57"></a>guest account.</p><p>This paramater nullifies the benifits of setting1629 <a class="indexterm" name="id2799 68"></a>restrict anonymous = 21630 </p><p>See the section below on <a class="indexterm" name="id2799 79"></a>security for more information about this option.1630 Privileges will be those of the <a class="indexterm" name="id279965"></a>guest account.</p><p>This paramater nullifies the benifits of setting 1631 <a class="indexterm" name="id279976"></a>restrict anonymous = 2 1632 </p><p>See the section below on <a class="indexterm" name="id279986"></a>security for more information about this option. 1631 1633 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>guest ok</code></em> = no 1632 1634 </em></span> 1633 1635 </p></dd><dt><span class="term"><a name="ONLYGUEST"></a>only guest</span></dt><dd><p>This parameter is a synonym for guest only.</p></dd><dt><span class="term"><a name="GUESTONLY"></a>guest only (S)</span></dt><dd><p>If this parameter is <code class="constant">yes</code> for 1634 1636 a service, then only guest connections to the service are permitted. 1635 This parameter will have no effect if <a class="indexterm" name="id2800 44"></a>guest ok is not set for the service.</p><p>See the section below on <a class="indexterm" name="id280055"></a>security for more information about this option.1637 This parameter will have no effect if <a class="indexterm" name="id280052"></a>guest ok is not set for the service.</p><p>See the section below on <a class="indexterm" name="id280063"></a>security for more information about this option. 1636 1638 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>guest only</code></em> = no 1637 1639 </em></span> … … 1675 1677 </em></span> 1676 1678 </p></dd><dt><span class="term"><a name="HOMEDIRMAP"></a>homedir map (G)</span></dt><dd><p> 1677 If <a class="indexterm" name="id2803 03"></a>nis homedir is <code class="constant">yes</code>, and <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> is also acting as a Win95/98 <em class="parameter"><code>logon server</code></em>1679 If <a class="indexterm" name="id280310"></a>nis homedir is <code class="constant">yes</code>, and <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> is also acting as a Win95/98 <em class="parameter"><code>logon server</code></em> 1678 1680 then this parameter specifies the NIS (or YP) map from which the server for the user's home directory should be extracted. 1679 1681 At present, only the Sun auto.home map format is understood. The form of the map is: … … 1693 1695 Dfs trees hosted on the server. 1694 1696 </p><p> 1695 See also the <a class="indexterm" name="id28040 0"></a>msdfs root share level parameter. For more information on1697 See also the <a class="indexterm" name="id280408"></a>msdfs root share level parameter. For more information on 1696 1698 setting up a Dfs tree on Samba, refer to the MSFDS chapter in the book Samba3-HOWTO. 1697 1699 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>host msdfs</code></em> = yes … … 1705 1707 </p><p>Example: <span class="emphasis"><em><em class="parameter"><code>hostname lookups</code></em> = yes 1706 1708 </em></span> 1707 </p></dd><dt><span class="term"><a name="ALLOWHOSTS"></a>allow hosts</span></dt><dd><p>This parameter is a synonym for hosts allow.</p></dd><dt><span class="term"><a name="HOSTSALLOW"></a>hosts allow (S)</span></dt><dd><p>A synonym for this parameter is <a class="indexterm" name="id28052 1"></a>allow hosts.</p><p>This parameter is a comma, space, or tab delimited1709 </p></dd><dt><span class="term"><a name="ALLOWHOSTS"></a>allow hosts</span></dt><dd><p>This parameter is a synonym for hosts allow.</p></dd><dt><span class="term"><a name="HOSTSALLOW"></a>hosts allow (S)</span></dt><dd><p>A synonym for this parameter is <a class="indexterm" name="id280528"></a>allow hosts.</p><p>This parameter is a comma, space, or tab delimited 1708 1710 set of hosts which are permitted to access a service.</p><p>If specified in the [global] section then it will 1709 1711 apply to all services, regardless of whether the individual … … 1715 1717 page may not be present on your system, so a brief description will 1716 1718 be given here also.</p><p>Note that the localhost address 127.0.0.1 will always 1717 be allowed access unless specifically denied by a <a class="indexterm" name="id2805 59"></a>hosts deny option.</p><p>You can also specify hosts by network/netmask pairs and1719 be allowed access unless specifically denied by a <a class="indexterm" name="id280567"></a>hosts deny option.</p><p>You can also specify hosts by network/netmask pairs and 1718 1720 by netgroup names if your system supports netgroups. The 1719 1721 <span class="emphasis"><em>EXCEPT</em></span> keyword can also be used to limit a … … 1732 1734 In the event that it is necessary to deny all by default, use the keyword 1733 1735 ALL (or the netmask <code class="literal">0.0.0.0/0</code>) and then explicitly specify 1734 to the <a class="indexterm" name="id2807 36"></a>hosts allow = hosts allow parameter those hosts1736 to the <a class="indexterm" name="id280743"></a>hosts allow = hosts allow parameter those hosts 1735 1737 that should be permitted access. 1736 1738 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>hosts deny</code></em> = … … 1742 1744 The idmap alloc backend provides a plugin interface for Winbind to use 1743 1745 when allocating Unix uids/gids for Windows SIDs. This option is 1744 to be used in conjunction with the <a class="indexterm" name="id28079 0"></a>idmap domains1746 to be used in conjunction with the <a class="indexterm" name="id280797"></a>idmap domains 1745 1747 parameter and refers to the name of the idmap module which will provide 1746 1748 the id allocation functionality. Please refer to the man page … … 1748 1750 the allocation feature. The most common plugins are the tdb (<a href="idmap_tdb.8.html"><span class="citerefentry"><span class="refentrytitle">idmap_tdb</span>(8)</span></a>) 1749 1751 and ldap (<a href="idmap_ldap.8.html"><span class="citerefentry"><span class="refentrytitle">idmap_ldap</span>(8)</span></a>) libraries. 1750 </p><p>Also refer to the <a class="indexterm" name="id2808 19"></a>idmap alloc config option.1752 </p><p>Also refer to the <a class="indexterm" name="id280826"></a>idmap alloc config option. 1751 1753 </p><p><span class="emphasis"><em>No default</em></span></p><p>Example: <span class="emphasis"><em><em class="parameter"><code>idmap alloc backend</code></em> = tdb 1752 1754 </em></span> 1753 1755 </p></dd><dt><span class="term"><a name="IDMAPALLOCCONFIG"></a>idmap alloc config (G)</span></dt><dd><p> 1754 1756 The idmap alloc config prefix provides a means of managing settings 1755 for the backend defined by the <a class="indexterm" name="id2808 64"></a>idmap alloc backend1757 for the backend defined by the <a class="indexterm" name="id280871"></a>idmap alloc backend 1756 1758 parameter. Refer to the man page for each idmap plugin regarding 1757 1759 specific configuration details. … … 1760 1762 varying backends to store SID/uid/gid mapping tables. This 1761 1763 option is mutually exclusive with the newer and more flexible 1762 <a class="indexterm" name="id280 899"></a>idmap domains parameter. The main difference1764 <a class="indexterm" name="id280906"></a>idmap domains parameter. The main difference 1763 1765 between the "idmap backend" and the "idmap domains" 1764 1766 is that the former only allows on backend for all domains while the … … 1775 1777 </p></dd><dt><span class="term"><a name="IDMAPCONFIG"></a>idmap config (G)</span></dt><dd><p> 1776 1778 The idmap config prefix provides a means of managing each domain 1777 defined by the <a class="indexterm" name="id28101 1"></a>idmap domains option using Samba's1779 defined by the <a class="indexterm" name="id281018"></a>idmap domains option using Samba's 1778 1780 parameteric option support. The idmap config prefix should be 1779 1781 followed by the name of the domain, a colon, and a setting specific to … … 1789 1791 </p></dd><dt><span class="term">readonly = [yes|no]</span></dt><dd><p> 1790 1792 Mark the domain as readonly which means that no attempts to 1791 allocate a uid or gid (by the <a class="indexterm" name="id2810 58"></a>idmap alloc backend) for any user or group in that domain1793 allocate a uid or gid (by the <a class="indexterm" name="id281066"></a>idmap alloc backend) for any user or group in that domain 1792 1794 will be attempted. 1793 1795 </p></dd></dl></div><p> … … 1808 1810 The idmap domains option defines a list of Windows domains which will each 1809 1811 have a separately configured backend for managing Winbind's SID/uid/gid 1810 tables. This parameter is mutually exclusive with the older <a class="indexterm" name="id2811 26"></a>idmap backend option.1812 tables. This parameter is mutually exclusive with the older <a class="indexterm" name="id281133"></a>idmap backend option. 1811 1813 </p><p> 1812 1814 Values consist of the short domain name for Winbind's primary or collection … … 1814 1816 domain backend for any domain not explicitly listed. 1815 1817 </p><p> 1816 Refer to the <a class="indexterm" name="id28114 1"></a>idmap config for details about1818 Refer to the <a class="indexterm" name="id281149"></a>idmap config for details about 1817 1819 managing the SID/uid/gid backend for each domain. 1818 1820 </p><p><span class="emphasis"><em>No default</em></span></p><p>Example: <span class="emphasis"><em><em class="parameter"><code>idmap domains</code></em> = default AD CORP … … 1822 1824 SIDs. This range of group ids should have no 1823 1825 existing local or NIS groups within it as strange conflicts can 1824 occur otherwise.</p><p>See also the <a class="indexterm" name="id2812 14"></a>idmap backend, <a class="indexterm" name="id281221"></a>idmap domains, and <a class="indexterm" name="id281228"></a>idmap config options.1826 occur otherwise.</p><p>See also the <a class="indexterm" name="id281221"></a>idmap backend, <a class="indexterm" name="id281228"></a>idmap domains, and <a class="indexterm" name="id281235"></a>idmap config options. 1825 1827 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>idmap gid</code></em> = 1826 1828 </em></span> … … 1835 1837 allocated for use in mapping UNIX users to NT user SIDs. This 1836 1838 range of ids should have no existing local 1837 or NIS users within it as strange conflicts can occur otherwise.</p><p>See also the <a class="indexterm" name="id28134 0"></a>idmap backend, <a class="indexterm" name="id281347"></a>idmap domains, and <a class="indexterm" name="id281354"></a>idmap config options.1839 or NIS users within it as strange conflicts can occur otherwise.</p><p>See also the <a class="indexterm" name="id281348"></a>idmap backend, <a class="indexterm" name="id281355"></a>idmap domains, and <a class="indexterm" name="id281362"></a>idmap config options. 1838 1840 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>idmap uid</code></em> = 1839 1841 </em></span> … … 1867 1869 </em></span> 1868 1870 </p></dd><dt><span class="term"><a name="INHERITPERMISSIONS"></a>inherit permissions (S)</span></dt><dd><p> 1869 The permissions on new files and directories are normally governed by <a class="indexterm" name="id2815 48"></a>create mask,1870 <a class="indexterm" name="id2815 55"></a>directory mask, <a class="indexterm" name="id281562"></a>force create mode and <a class="indexterm" name="id281570"></a>force directory mode but the boolean inherit permissions parameter overrides this.1871 The permissions on new files and directories are normally governed by <a class="indexterm" name="id281556"></a>create mask, 1872 <a class="indexterm" name="id281563"></a>directory mask, <a class="indexterm" name="id281570"></a>force create mode and <a class="indexterm" name="id281577"></a>force directory mode but the boolean inherit permissions parameter overrides this. 1871 1873 </p><p>New directories inherit the mode of the parent directory, 1872 1874 including bits such as setgid.</p><p> 1873 1875 New files inherit their read/write bits from the parent directory. Their execute bits continue to be 1874 determined by <a class="indexterm" name="id2815 86"></a>map archive, <a class="indexterm" name="id281593"></a>map hidden and <a class="indexterm" name="id281600"></a>map system as usual.1876 determined by <a class="indexterm" name="id281593"></a>map archive, <a class="indexterm" name="id281600"></a>map hidden and <a class="indexterm" name="id281607"></a>map system as usual. 1875 1877 </p><p>Note that the setuid bit is <span class="emphasis"><em>never</em></span> set via 1876 1878 inheritance (the code explicitly prohibits this).</p><p>This can be particularly useful on large systems with … … 1923 1925 </em></span> 1924 1926 </p></dd><dt><span class="term"><a name="IPRINTSERVER"></a>iprint server (G)</span></dt><dd><p> 1925 This parameter is only applicable if <a class="indexterm" name="id2818 33"></a>printing is set to <code class="constant">iprint</code>.1927 This parameter is only applicable if <a class="indexterm" name="id281841"></a>printing is set to <code class="constant">iprint</code>. 1926 1928 </p><p> 1927 1929 If set, this option overrides the ServerName option in the CUPS <code class="filename">client.conf</code>. This is … … 1936 1938 sent. Keepalive packets, if sent, allow the server to tell whether 1937 1939 a client is still present and responding.</p><p>Keepalives should, in general, not be needed if the socket 1938 has the SO_KEEPALIVE attribute set on it by default. (see <a class="indexterm" name="id28191 2"></a>socket options).1940 has the SO_KEEPALIVE attribute set on it by default. (see <a class="indexterm" name="id281919"></a>socket options). 1939 1941 Basically you should only use this option if you strike difficulties.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>keepalive</code></em> = 300 1940 1942 </em></span> … … 1948 1950 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>kernel change notify</code></em> = yes 1949 1951 </em></span> 1950 </p></dd><dt><span class="term"><a name="KERNELOPLOCKS"></a>kernel oplocks (G)</span></dt><dd><p>For UNIXes that support kernel based <a class="indexterm" name="id2820 02"></a>oplocks1952 </p></dd><dt><span class="term"><a name="KERNELOPLOCKS"></a>kernel oplocks (G)</span></dt><dd><p>For UNIXes that support kernel based <a class="indexterm" name="id282010"></a>oplocks 1951 1953 (currently only IRIX and the Linux 2.4 kernel), this parameter 1952 1954 allows the use of them to be turned on or off.</p><p>Kernel oplocks support allows Samba <em class="parameter"><code>oplocks … … 1985 1987 </em></span> 1986 1988 </p></dd><dt><span class="term"><a name="LDAPADMINDN"></a>ldap admin dn (G)</span></dt><dd><p> 1987 The <a class="indexterm" name="id282 195"></a>ldap admin dn defines the Distinguished Name (DN) name used by Samba to contact1988 the ldap server when retreiving user account information. The <a class="indexterm" name="id2822 03"></a>ldap admin dn is used1989 The <a class="indexterm" name="id282202"></a>ldap admin dn defines the Distinguished Name (DN) name used by Samba to contact 1990 the ldap server when retreiving user account information. The <a class="indexterm" name="id282210"></a>ldap admin dn is used 1989 1991 in conjunction with the admin dn password stored in the <code class="filename">private/secrets.tdb</code> 1990 1992 file. See the <a href="smbpasswd.8.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(8)</span></a> 1991 1993 man page for more information on how to accomplish this. 1992 1994 </p><p> 1993 The <a class="indexterm" name="id2822 28"></a>ldap admin dn requires a fully specified DN. The <a class="indexterm" name="id282236"></a>ldap suffix is not appended to the <a class="indexterm" name="id282243"></a>ldap admin dn.1995 The <a class="indexterm" name="id282236"></a>ldap admin dn requires a fully specified DN. The <a class="indexterm" name="id282243"></a>ldap suffix is not appended to the <a class="indexterm" name="id282250"></a>ldap admin dn. 1994 1996 </p><p><span class="emphasis"><em>No default</em></span></p></dd><dt><span class="term"><a name="LDAPDELETEDN"></a>ldap delete dn (G)</span></dt><dd><p> This parameter specifies whether a delete 1995 1997 operation in the ldapsam deletes the complete entry or only the attributes … … 1999 2001 </p></dd><dt><span class="term"><a name="LDAPGROUPSUFFIX"></a>ldap group suffix (G)</span></dt><dd><p>This parameter specifies the suffix that is 2000 2002 used for groups when these are added to the LDAP directory. 2001 If this parameter is unset, the value of <a class="indexterm" name="id28231 1"></a>ldap suffix will be used instead. The suffix string is pre-pended to the2002 <a class="indexterm" name="id2823 19"></a>ldap suffix string so use a partial DN.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldap group suffix</code></em> =2003 If this parameter is unset, the value of <a class="indexterm" name="id282318"></a>ldap suffix will be used instead. The suffix string is pre-pended to the 2004 <a class="indexterm" name="id282326"></a>ldap suffix string so use a partial DN.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldap group suffix</code></em> = 2003 2005 </em></span> 2004 2006 </p><p>Example: <span class="emphasis"><em><em class="parameter"><code>ldap group suffix</code></em> = ou=Groups … … 2006 2008 </p></dd><dt><span class="term"><a name="LDAPIDMAPSUFFIX"></a>ldap idmap suffix (G)</span></dt><dd><p> 2007 2009 This parameters specifies the suffix that is used when storing idmap mappings. If this parameter 2008 is unset, the value of <a class="indexterm" name="id28237 2"></a>ldap suffix will be used instead. The suffix2009 string is pre-pended to the <a class="indexterm" name="id2823 79"></a>ldap suffix string so use a partial DN.2010 is unset, the value of <a class="indexterm" name="id282379"></a>ldap suffix will be used instead. The suffix 2011 string is pre-pended to the <a class="indexterm" name="id282387"></a>ldap suffix string so use a partial DN. 2010 2012 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldap idmap suffix</code></em> = 2011 2013 </em></span> … … 2014 2016 </p></dd><dt><span class="term"><a name="LDAPMACHINESUFFIX"></a>ldap machine suffix (G)</span></dt><dd><p> 2015 2017 It specifies where machines should be added to the ldap tree. If this parameter is unset, the value of 2016 <a class="indexterm" name="id28243 2"></a>ldap suffix will be used instead. The suffix string is pre-pended to the2017 <a class="indexterm" name="id2824 39"></a>ldap suffix string so use a partial DN.2018 <a class="indexterm" name="id282439"></a>ldap suffix will be used instead. The suffix string is pre-pended to the 2019 <a class="indexterm" name="id282447"></a>ldap suffix string so use a partial DN. 2018 2020 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldap machine suffix</code></em> = 2019 2021 </em></span> … … 2025 2027 change via SAMBA. 2026 2028 </p><p> 2027 The <a class="indexterm" name="id282 496"></a>ldap passwd sync can be set to one of three values:2029 The <a class="indexterm" name="id282504"></a>ldap passwd sync can be set to one of three values: 2028 2030 </p><div class="itemizedlist"><ul type="disc"><li><p><em class="parameter"><code>Yes</code></em> = Try 2029 2031 to update the LDAP, NT and LM passwords and update the pwdLastSet time.</p></li><li><p><em class="parameter"><code>No</code></em> = Update NT and … … 2043 2045 The value is specified in milliseconds, the maximum value is 5000 (5 seconds). 2044 2046 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldap replication sleep</code></em> = 1000 2047 </em></span> 2048 </p></dd><dt><span class="term"><a name="LDAPSAM:EDITPOSIX"></a>ldapsam:editposix (G)</span></dt><dd><p> 2049 Editposix is an option that leverages ldapsam:trusted to make it simpler to manage a domain controller 2050 eliminating the need to set up custom scripts to add and manage the posix users and groups. This option 2051 will instead directly manipulate the ldap tree to create, remove and modify user and group entries. 2052 This option also requires a running winbindd as it is used to allocate new uids/gids on user/group 2053 creation. The allocation range must be therefore configured. 2054 </p><p> 2055 To use this option, a basic ldap tree must be provided and the ldap suffix parameters must be properly 2056 configured. On virgin servers the default users and groups (Administrator, Guest, Domain Users, 2057 Domain Admins, Domain Guests) can be precreated with the command <span><strong class="command">net sam 2058 provision</strong></span>. To run this command the ldap server must be running, Winindd must be running and 2059 the smb.conf ldap options must be properly configured. 2060 2061 The tipical ldap setup used with the <a class="indexterm" name="id282650"></a>ldapsam:trusted = yes option 2062 is usually sufficient to use <a class="indexterm" name="id282658"></a>ldapsam:editposix = yes as well. 2063 </p><p> 2064 An example configuration can be the following: 2065 2066 </p><pre class="programlisting"> 2067 encrypt passwords = true 2068 passdb backend = ldapsam 2069 2070 ldapsam:trusted=yes 2071 ldapsam:editposix=yes 2072 2073 ldap admin dn = cn=admin,dc=samba,dc=org 2074 ldap delete dn = yes 2075 ldap group suffix = ou=groups 2076 ldap idmap suffix = ou=idmap 2077 ldap machine suffix = ou=computers 2078 ldap user suffix = ou=users 2079 ldap suffix = dc=samba,dc=org 2080 2081 idmap backend = ldap:"ldap://localhost" 2082 2083 idmap uid = 5000-50000 2084 idmap gid = 5000-50000 2085 </pre><p> 2086 2087 This configuration assume the ldap server have been loaded with a base tree like described 2088 in the following ldif: 2089 2090 </p><pre class="programlisting"> 2091 dn: dc=samba,dc=org 2092 objectClass: top 2093 objectClass: dcObject 2094 objectClass: organization 2095 o: samba.org 2096 dc: samba 2097 2098 dn: cn=admin,dc=samba,dc=org 2099 objectClass: simpleSecurityObject 2100 objectClass: organizationalRole 2101 cn: admin 2102 description: LDAP administrator 2103 userPassword: secret 2104 2105 dn: ou=users,dc=samba,dc=org 2106 objectClass: top 2107 objectClass: organizationalUnit 2108 ou: users 2109 2110 dn: ou=groups,dc=samba,dc=org 2111 objectClass: top 2112 objectClass: organizationalUnit 2113 ou: groups 2114 2115 dn: ou=idmap,dc=samba,dc=org 2116 objectClass: top 2117 objectClass: organizationalUnit 2118 ou: idmap 2119 2120 dn: ou=computers,dc=samba,dc=org 2121 objectClass: top 2122 objectClass: organizationalUnit 2123 ou: computers 2124 </pre><p> 2125 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldapsam:editposix</code></em> = no 2045 2126 </em></span> 2046 2127 </p></dd><dt><span class="term"><a name="LDAPSAM:TRUSTED"></a>ldapsam:trusted (G)</span></dt><dd><p> … … 2052 2133 are used to deal with user and group attributes lack such optimization. 2053 2134 </p><p> 2054 To make Samba scale well in large environments, the <a class="indexterm" name="id282 636"></a>ldapsam:trusted = yes2135 To make Samba scale well in large environments, the <a class="indexterm" name="id282732"></a>ldapsam:trusted = yes 2055 2136 option assumes that the complete user and group database that is relevant to Samba is stored in LDAP with the 2056 2137 standard posixAccount/posixGroup attributes. It further assumes that the Samba auxiliary object classes are 2057 2138 stored together with the POSIX data in the same LDAP object. If these assumptions are met, 2058 <a class="indexterm" name="id282 646"></a>ldapsam:trusted = yes can be activated and Samba can bypass the2139 <a class="indexterm" name="id282742"></a>ldapsam:trusted = yes can be activated and Samba can bypass the 2059 2140 NSS system to query user group memberships. Optimized LDAP queries can greatly speed up domain logon and 2060 2141 administration tasks. Depending on the size of the LDAP database a factor of 100 or more for common queries … … 2067 2148 Samba's previous SSL support which was enabled by specifying the 2068 2149 <span><strong class="command">--with-ssl</strong></span> option to the <code class="filename">configure</code> 2069 script.</p><p>The <a class="indexterm" name="id282 709"></a>ldap ssl can be set to one of three values:</p><div class="itemizedlist"><ul type="disc"><li><p><em class="parameter"><code>Off</code></em> = Never2150 script.</p><p>The <a class="indexterm" name="id282805"></a>ldap ssl can be set to one of three values:</p><div class="itemizedlist"><ul type="disc"><li><p><em class="parameter"><code>Off</code></em> = Never 2070 2151 use SSL when querying the directory.</p></li><li><p><em class="parameter"><code>Start_tls</code></em> = Use 2071 2152 the LDAPv3 StartTLS extended operation (RFC2830) for … … 2073 2154 on the ldaps port when contacting the <em class="parameter"><code>ldap server</code></em>. Only available when the 2074 2155 backwards-compatiblity <span><strong class="command">--with-ldapsam</strong></span> option is specified 2075 to configure. See <a class="indexterm" name="id282 765"></a>passdb backend</p></li></ul></div><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldap ssl</code></em> = start_tls2156 to configure. See <a class="indexterm" name="id282861"></a>passdb backend</p></li></ul></div><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldap ssl</code></em> = start_tls 2076 2157 </em></span> 2077 2158 </p></dd><dt><span class="term"><a name="LDAPSUFFIX"></a>ldap suffix (G)</span></dt><dd><p>Specifies the base for all ldap suffixes and for storing the sambaDomain object.</p><p> 2078 The ldap suffix will be appended to the values specified for the <a class="indexterm" name="id282 812"></a>ldap user suffix,2079 <a class="indexterm" name="id282 819"></a>ldap group suffix, <a class="indexterm" name="id282826"></a>ldap machine suffix, and the2080 <a class="indexterm" name="id282 833"></a>ldap idmap suffix. Each of these should be given only a DN relative to the2081 <a class="indexterm" name="id282 841"></a>ldap suffix.2159 The ldap suffix will be appended to the values specified for the <a class="indexterm" name="id282907"></a>ldap user suffix, 2160 <a class="indexterm" name="id282914"></a>ldap group suffix, <a class="indexterm" name="id282922"></a>ldap machine suffix, and the 2161 <a class="indexterm" name="id282929"></a>ldap idmap suffix. Each of these should be given only a DN relative to the 2162 <a class="indexterm" name="id282936"></a>ldap suffix. 2082 2163 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldap suffix</code></em> = 2083 2164 </em></span> … … 2092 2173 </p></dd><dt><span class="term"><a name="LDAPUSERSUFFIX"></a>ldap user suffix (G)</span></dt><dd><p> 2093 2174 This parameter specifies where users are added to the tree. If this parameter is unset, 2094 the value of <a class="indexterm" name="id28 2931"></a>ldap suffix will be used instead. The suffix2095 string is pre-pended to the <a class="indexterm" name="id28 2938"></a>ldap suffix string so use a partial DN.2175 the value of <a class="indexterm" name="id283024"></a>ldap suffix will be used instead. The suffix 2176 string is pre-pended to the <a class="indexterm" name="id283031"></a>ldap suffix string so use a partial DN. 2096 2177 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>ldap user suffix</code></em> = 2097 2178 </em></span> … … 2112 2193 delete any read-ahead caches.</p><p>It is recommended that this parameter be turned on to 2113 2194 speed access to shared executables.</p><p>For more discussions on level2 oplocks see the CIFS spec.</p><p> 2114 Currently, if <a class="indexterm" name="id283 016"></a>kernel oplocks are supported then2195 Currently, if <a class="indexterm" name="id283109"></a>kernel oplocks are supported then 2115 2196 level2 oplocks are not granted (even if this parameter is set to 2116 <code class="constant">yes</code>). Note also, the <a class="indexterm" name="id283 027"></a>oplocks2197 <code class="constant">yes</code>). Note also, the <a class="indexterm" name="id283120"></a>oplocks 2117 2198 parameter must be set to <code class="constant">yes</code> on this share in order for 2118 2199 this parameter to have any effect.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>level2 oplocks</code></em> = yes … … 2126 2207 broadcasts. If set to <code class="constant">yes</code> Samba will produce 2127 2208 Lanman announce broadcasts at a frequency set by the parameter 2128 <a class="indexterm" name="id2831 03"></a>lm interval. If set to <code class="constant">auto</code>2209 <a class="indexterm" name="id283196"></a>lm interval. If set to <code class="constant">auto</code> 2129 2210 Samba will not send Lanman announce broadcasts by default but will 2130 2211 listen for them. If it hears such a broadcast on the wire it will 2131 2212 then start sending them at a frequency set by the parameter 2132 <a class="indexterm" name="id283 115"></a>lm interval.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>lm announce</code></em> = auto2213 <a class="indexterm" name="id283208"></a>lm interval.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>lm announce</code></em> = auto 2133 2214 </em></span> 2134 2215 </p><p>Example: <span class="emphasis"><em><em class="parameter"><code>lm announce</code></em> = yes … … 2136 2217 </p></dd><dt><span class="term"><a name="LMINTERVAL"></a>lm interval (G)</span></dt><dd><p>If Samba is set to produce Lanman announce 2137 2218 broadcasts needed by OS/2 clients (see the 2138 <a class="indexterm" name="id283 167"></a>lm announce parameter) then this2219 <a class="indexterm" name="id283260"></a>lm announce parameter) then this 2139 2220 parameter defines the frequency in seconds with which they will be 2140 2221 made. If this is set to zero then no Lanman announcements will be 2141 made despite the setting of the <a class="indexterm" name="id283 176"></a>lm announce2222 made despite the setting of the <a class="indexterm" name="id283269"></a>lm announce 2142 2223 parameter.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>lm interval</code></em> = 60 2143 2224 </em></span> … … 2146 2227 </p></dd><dt><span class="term"><a name="LOADPRINTERS"></a>load printers (G)</span></dt><dd><p>A boolean variable that controls whether all 2147 2228 printers in the printcap will be loaded for browsing by default. 2148 See the <a class="indexterm" name="id283 229"></a>printers section for2229 See the <a class="indexterm" name="id283322"></a>printers section for 2149 2230 more details.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>load printers</code></em> = yes 2150 2231 </em></span> … … 2161 2242 </p></dd><dt><span class="term"><a name="LOCKDIR"></a>lock dir</span></dt><dd><p>This parameter is a synonym for lock directory.</p></dd><dt><span class="term"><a name="LOCKDIRECTORY"></a>lock directory (G)</span></dt><dd><p>This option specifies the directory where lock 2162 2243 files will be placed. The lock files are used to implement the 2163 <a class="indexterm" name="id283 380"></a>max connections option.2244 <a class="indexterm" name="id283473"></a>max connections option. 2164 2245 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>lock directory</code></em> = ${prefix}/var/locks 2165 2246 </em></span> … … 2178 2259 You should never need to set this parameter.</p><p><span class="emphasis"><em>No default</em></span></p></dd><dt><span class="term"><a name="LOCKSPINCOUNT"></a>lock spin count (G)</span></dt><dd><p>This parameter has been made inoperative in Samba 3.0.24. 2179 2260 The functionality it contolled is now controlled by the parameter 2180 <a class="indexterm" name="id2835 00"></a>lock spin time.2261 <a class="indexterm" name="id283593"></a>lock spin time. 2181 2262 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>lock spin count</code></em> = 0 2182 2263 </em></span> … … 2185 2266 be granted. This parameter has changed in default 2186 2267 value from Samba 3.0.23 from 10 to 200. The associated 2187 <a class="indexterm" name="id283 542"></a>lock spin count parameter is2268 <a class="indexterm" name="id283635"></a>lock spin count parameter is 2188 2269 no longer used in Samba 3.0.24. You should not need 2189 2270 to change the value of this parameter.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>lock spin time</code></em> = 200 … … 2206 2287 </p></dd><dt><span class="term"><a name="LOGONDRIVE"></a>logon drive (G)</span></dt><dd><p> 2207 2288 This parameter specifies the local path to which the home directory will be 2208 connected (see <a class="indexterm" name="id283 696"></a>logon home) and is only used by NT2289 connected (see <a class="indexterm" name="id283789"></a>logon home) and is only used by NT 2209 2290 Workstations. 2210 2291 </p><p> … … 2233 2314 <span><strong class="command">net use /home</strong></span> but use the whole string when dealing with profiles. 2234 2315 </p><p> 2235 Note that in prior versions of Samba, the <a class="indexterm" name="id2838 04"></a>logon path was returned rather than2316 Note that in prior versions of Samba, the <a class="indexterm" name="id283897"></a>logon path was returned rather than 2236 2317 <em class="parameter"><code>logon home</code></em>. This broke <span><strong class="command">net use /home</strong></span> 2237 2318 but allowed profiles outside the home directory. The current implementation is correct, and can be used for 2238 2319 profiles if you use the above trick. 2239 2320 </p><p> 2240 Disable this feature by setting <a class="indexterm" name="id283 828"></a>logon home = "" - using the empty string.2321 Disable this feature by setting <a class="indexterm" name="id283921"></a>logon home = "" - using the empty string. 2241 2322 </p><p> 2242 2323 This option is only useful if Samba is set up as a logon server. … … 2249 2330 stored. Contrary to previous versions of these manual pages, it has nothing to do with Win 9X roaming 2250 2331 profiles. To find out how to handle roaming profiles for Win 9X system, see the 2251 <a class="indexterm" name="id283 886"></a>logon home parameter.2332 <a class="indexterm" name="id283979"></a>logon home parameter. 2252 2333 </p><p> 2253 2334 This option takes the standard substitutions, allowing you to have separate logon scripts for each user or … … 2278 2359 </p></div><p>Note that this option is only useful if Samba is set up as a domain controller.</p><p> 2279 2360 Disable the use of roaming profiles by setting the value of this parameter to the empty string. For 2280 example, <a class="indexterm" name="id28 3964"></a>logon path = "". Take note that even if the default setting2361 example, <a class="indexterm" name="id284057"></a>logon path = "". Take note that even if the default setting 2281 2362 in the smb.conf file is the empty string, any value specified in the user account settings in the passdb 2282 2363 backend will over-ride the effect of setting this parameter to null. Disabling of all roaming profile use … … 2295 2376 </p><p> 2296 2377 The script must be a relative path to the <em class="parameter"><code>[netlogon]</code></em> service. If the [netlogon] 2297 service specifies a <a class="indexterm" name="id284 040"></a>path of <code class="filename">/usr/local/samba/netlogon</code>, and <a class="indexterm" name="id284054"></a>logon script = STARTUP.BAT, then the file that will be downloaded is:2378 service specifies a <a class="indexterm" name="id284133"></a>path of <code class="filename">/usr/local/samba/netlogon</code>, and <a class="indexterm" name="id284146"></a>logon script = STARTUP.BAT, then the file that will be downloaded is: 2298 2379 </p><pre class="programlisting"> 2299 2380 /usr/local/samba/netlogon/STARTUP.BAT … … 2335 2416 in the lppause command as the PATH may not be available to the server.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>lppause command</code></em> = 2336 2417 # Currently no default value is given to 2337 this string, unless the value of the <a class="indexterm" name="id284 207"></a>printing2418 this string, unless the value of the <a class="indexterm" name="id284300"></a>printing 2338 2419 parameter is <code class="constant">SYSV</code>, in which case the default is : 2339 2420 <span><strong class="command">lp -i %p-%j -H hold</strong></span> or if the value of the … … 2383 2464 printing or spooling a specific print job.</p><p>This command should be a program or script which takes 2384 2465 a printer name and job number to resume the print job. See 2385 also the <a class="indexterm" name="id284 484"></a>lppause command parameter.</p><p>If a <em class="parameter"><code>%p</code></em> is given then the printer name2466 also the <a class="indexterm" name="id284576"></a>lppause command parameter.</p><p>If a <em class="parameter"><code>%p</code></em> is given then the printer name 2386 2467 is put in its place. A <em class="parameter"><code>%j</code></em> is replaced with 2387 2468 the job number (an integer).</p><p>Note that it is good practice to include the absolute path 2388 2469 in the <em class="parameter"><code>lpresume command</code></em> as the PATH may not 2389 be available to the server.</p><p>See also the <a class="indexterm" name="id284 520"></a>printing parameter.</p><p>Default: Currently no default value is given2470 be available to the server.</p><p>See also the <a class="indexterm" name="id284613"></a>printing parameter.</p><p>Default: Currently no default value is given 2390 2471 to this string, unless the value of the <em class="parameter"><code>printing</code></em> 2391 2472 parameter is <code class="constant">SYSV</code>, in which case the default is :</p><p><span><strong class="command">lp -i %p-%j -H resume</strong></span></p><p>or if the value of the <em class="parameter"><code>printing</code></em> parameter … … 2410 2491 </em></span> 2411 2492 </p></dd><dt><span class="term"><a name="MACHINEPASSWORDTIMEOUT"></a>machine password timeout (G)</span></dt><dd><p> 2412 If a Samba server is a member of a Windows NT Domain (see the <a class="indexterm" name="id284 676"></a>security = domain parameter) then periodically a running smbd process will try and change2493 If a Samba server is a member of a Windows NT Domain (see the <a class="indexterm" name="id284769"></a>security = domain parameter) then periodically a running smbd process will try and change 2413 2494 the MACHINE ACCOUNT PASSWORD stored in the TDB called <code class="filename">private/secrets.tdb 2414 2495 </code>. This parameter specifies how often this password will be changed, in seconds. The default is one … … 2416 2497 </p><p> 2417 2498 See also <a href="smbpasswd.8.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(8)</span></a>, 2418 and the <a class="indexterm" name="id2847 02"></a>security = domain parameter.2499 and the <a class="indexterm" name="id284795"></a>security = domain parameter. 2419 2500 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>machine password timeout</code></em> = 604800 2420 2501 </em></span> 2421 2502 </p></dd><dt><span class="term"><a name="MAGICOUTPUT"></a>magic output (S)</span></dt><dd><p> 2422 2503 This parameter specifies the name of a file which will contain output created by a magic script (see the 2423 <a class="indexterm" name="id284 743"></a>magic script parameter below).2504 <a class="indexterm" name="id284836"></a>magic script parameter below). 2424 2505 </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>If two clients use the same <em class="parameter"><code>magic script 2425 2506 </code></em> in the same directory the output file content is undefined. … … 2434 2515 completion assuming that the user has the appropriate level 2435 2516 of privilege and the file permissions allow the deletion.</p><p>If the script generates output, output will be sent to 2436 the file specified by the <a class="indexterm" name="id284 817"></a>magic output2517 the file specified by the <a class="indexterm" name="id284910"></a>magic output 2437 2518 parameter (see above).</p><p>Note that some shells are unable to interpret scripts 2438 2519 containing CR/LF instead of CR as … … 2455 2536 you would use: 2456 2537 </p><p> 2457 <a class="indexterm" name="id28 4921"></a>mangled map = (*.html *.htm).2538 <a class="indexterm" name="id285014"></a>mangled map = (*.html *.htm). 2458 2539 </p><p> 2459 2540 One very useful case is to remove the annoying <code class="filename">;1</code> off … … 2467 2548 </p></dd><dt><span class="term"><a name="MANGLEDNAMES"></a>mangled names (S)</span></dt><dd><p>This controls whether non-DOS names under UNIX 2468 2549 should be mapped to DOS-compatible names ("mangled") and made visible, 2469 or whether non-DOS names should simply be ignored.</p><p>See the section on <a class="indexterm" name="id28 4988"></a>name mangling for2550 or whether non-DOS names should simply be ignored.</p><p>See the section on <a class="indexterm" name="id285081"></a>name mangling for 2470 2551 details on how to control the mangling process.</p><p>If mangling is used then the mangling algorithm is as follows:</p><div class="itemizedlist"><ul type="disc"><li><p>The first (up to) five alphanumeric characters 2471 2552 before the rightmost dot of the filename are preserved, forced … … 2477 2558 only if it contains any upper case characters or is longer than three 2478 2559 characters.</p><p>Note that the character to use may be specified using 2479 the <a class="indexterm" name="id285 022"></a>mangling char2560 the <a class="indexterm" name="id285115"></a>mangling char 2480 2561 option, if you don't like '~'.</p></li><li><p>Files whose UNIX name begins with a dot will be 2481 2562 presented as DOS hidden files. The mangled name will be created as … … 2501 2582 </em></span> 2502 2583 </p></dd><dt><span class="term"><a name="MANGLINGCHAR"></a>mangling char (S)</span></dt><dd><p>This controls what character is used as 2503 the <span class="emphasis"><em>magic</em></span> character in <a class="indexterm" name="id285 143"></a>name mangling. The2584 the <span class="emphasis"><em>magic</em></span> character in <a class="indexterm" name="id285236"></a>name mangling. The 2504 2585 default is a '~' but this may interfere with some software. Use this option to set 2505 2586 it to whatever you prefer. This is effective only when mangling method is hash.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>mangling char</code></em> = ~ … … 2534 2615 be quite annoying for shared source code, documents, etc... 2535 2616 </p><p> 2536 Note that this requires the <a class="indexterm" name="id285 296"></a>create mask parameter to be set such that owner2617 Note that this requires the <a class="indexterm" name="id285393"></a>create mask parameter to be set such that owner 2537 2618 execute bit is not masked out (i.e. it must include 100). See the parameter 2538 <a class="indexterm" name="id285 304"></a>create mask for details.2619 <a class="indexterm" name="id285401"></a>create mask for details. 2539 2620 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>map archive</code></em> = yes 2540 2621 </em></span> … … 2542 2623 This controls whether DOS style hidden files should be mapped to the UNIX world execute bit. 2543 2624 </p><p> 2544 Note that this requires the <a class="indexterm" name="id285 349"></a>create mask to be set such that the world execute2545 bit is not masked out (i.e. it must include 001). See the parameter <a class="indexterm" name="id285 357"></a>create mask2625 Note that this requires the <a class="indexterm" name="id285446"></a>create mask to be set such that the world execute 2626 bit is not masked out (i.e. it must include 001). See the parameter <a class="indexterm" name="id285454"></a>create mask 2546 2627 for details. 2547 2628 </p><p><span class="emphasis"><em>No default</em></span></p></dd><dt><span class="term"><a name="MAPREADONLY"></a>map read only (S)</span></dt><dd><p> … … 2549 2630 </p><p> 2550 2631 This parameter can take three different values, which tell <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> how to display the read only attribute on files, where either 2551 <a class="indexterm" name="id285 402"></a>store dos attributes is set to <code class="constant">No</code>, or no extended attribute is2552 present. If <a class="indexterm" name="id285 413"></a>store dos attributes is set to <code class="constant">yes</code> then this2632 <a class="indexterm" name="id285500"></a>store dos attributes is set to <code class="constant">No</code>, or no extended attribute is 2633 present. If <a class="indexterm" name="id285511"></a>store dos attributes is set to <code class="constant">yes</code> then this 2553 2634 parameter is <span class="emphasis"><em>ignored</em></span>. This is a new parameter introduced in Samba version 3.0.21. 2554 2635 </p><p>The three settings are :</p><div class="itemizedlist"><ul type="disc"><li><p> … … 2563 2644 </p></li><li><p> 2564 2645 <code class="constant">No</code> - The read only DOS attribute is unaffected by permissions, and can only be set by 2565 the <a class="indexterm" name="id285 470"></a>store dos attributes method. This may be useful for exporting mounted CDs.2646 the <a class="indexterm" name="id285568"></a>store dos attributes method. This may be useful for exporting mounted CDs. 2566 2647 </p></li></ul></div><p>Default: <span class="emphasis"><em><em class="parameter"><code>map read only</code></em> = yes 2567 2648 </em></span> … … 2569 2650 This controls whether DOS style system files should be mapped to the UNIX group execute bit. 2570 2651 </p><p> 2571 Note that this requires the <a class="indexterm" name="id285 516"></a>create mask to be set such that the group2652 Note that this requires the <a class="indexterm" name="id285613"></a>create mask to be set such that the group 2572 2653 execute bit is not masked out (i.e. it must include 010). See the parameter 2573 <a class="indexterm" name="id285 524"></a>create mask for details.2654 <a class="indexterm" name="id285621"></a>create mask for details. 2574 2655 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>map system</code></em> = no 2575 2656 </em></span> 2576 </p></dd><dt><span class="term"><a name="MAPTOGUEST"></a>map to guest (G)</span></dt><dd><p>This parameter is only useful in <a class="indexterm" name="id285 564"></a>SECURITY =2657 </p></dd><dt><span class="term"><a name="MAPTOGUEST"></a>map to guest (G)</span></dt><dd><p>This parameter is only useful in <a class="indexterm" name="id285661"></a>SECURITY = 2577 2658 security modes other than <em class="parameter"><code>security = share</code></em> 2578 2659 - i.e. <code class="constant">user</code>, <code class="constant">server</code>, … … 2584 2665 logins with an invalid password are rejected, unless the username 2585 2666 does not exist, in which case it is treated as a guest login and 2586 mapped into the <a class="indexterm" name="id285 625"></a>guest account.</p></li><li><p><code class="constant">Bad Password</code> - Means user logins2667 mapped into the <a class="indexterm" name="id285723"></a>guest account.</p></li><li><p><code class="constant">Bad Password</code> - Means user logins 2587 2668 with an invalid password are treated as a guest login and mapped 2588 into the <a class="indexterm" name="id285 642"></a>guest account. Note that2669 into the <a class="indexterm" name="id285740"></a>guest account. Note that 2589 2670 this can cause problems as it means that any user incorrectly typing 2590 2671 their password will be silently logged on as "guest" - and … … 2616 2697 will be refused if this number of connections to the service are already open. A value 2617 2698 of zero mean an unlimited number of connections may be made.</p><p>Record lock files are used to implement this feature. The lock files will be stored in 2618 the directory specified by the <a class="indexterm" name="id285 760"></a>lock directory option.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>max connections</code></em> = 02699 the directory specified by the <a class="indexterm" name="id285862"></a>lock directory option.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>max connections</code></em> = 0 2619 2700 </em></span> 2620 2701 </p><p>Example: <span class="emphasis"><em><em class="parameter"><code>max connections</code></em> = 10 … … 2707 2788 </em></span> 2708 2789 </p></dd><dt><span class="term"><a name="MAXWINSTTL"></a>max wins ttl (G)</span></dt><dd><p>This option tells <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> when acting as a WINS server 2709 (<a class="indexterm" name="id286 427"></a>wins support = yes) what the maximum2790 (<a class="indexterm" name="id286529"></a>wins support = yes) what the maximum 2710 2791 'time to live' of NetBIOS names that <span><strong class="command">nmbd</strong></span> 2711 2792 will grant will be (in seconds). You should never need to change this … … 2768 2849 </p></dd><dt><span class="term"><a name="MINPROTOCOL"></a>min protocol (G)</span></dt><dd><p>The value of the parameter (a string) is the 2769 2850 lowest SMB protocol dialect than Samba will support. Please refer 2770 to the <a class="indexterm" name="id286 749"></a>max protocol2851 to the <a class="indexterm" name="id286852"></a>max protocol 2771 2852 parameter for a list of valid protocol names and a brief description 2772 2853 of each. You may also wish to refer to the C source code in 2773 2854 <code class="filename">source/smbd/negprot.c</code> for a listing of known protocol 2774 2855 dialects supported by clients.</p><p>If you are viewing this parameter as a security measure, you should 2775 also refer to the <a class="indexterm" name="id286 768"></a>lanman auth parameter. Otherwise, you should never need2856 also refer to the <a class="indexterm" name="id286871"></a>lanman auth parameter. Otherwise, you should never need 2776 2857 to change this parameter.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>min protocol</code></em> = CORE 2777 2858 </em></span> … … 2779 2860 </em></span> 2780 2861 </p></dd><dt><span class="term"><a name="MINWINSTTL"></a>min wins ttl (G)</span></dt><dd><p>This option tells <a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> 2781 when acting as a WINS server (<a class="indexterm" name="id286 828"></a>wins support = yes) what the minimum 'time to live'2862 when acting as a WINS server (<a class="indexterm" name="id286931"></a>wins support = yes) what the minimum 'time to live' 2782 2863 of NetBIOS names that <span><strong class="command">nmbd</strong></span> will grant will be (in 2783 2864 seconds). You should never need to change this parameter. The default … … 2789 2870 this share, they are redirected to the proxied share using 2790 2871 the SMB-Dfs protocol.</p><p>Only Dfs roots can act as proxy shares. Take a look at the 2791 <a class="indexterm" name="id286 882"></a>msdfs root and <a class="indexterm" name="id286889"></a>host msdfs2872 <a class="indexterm" name="id286985"></a>msdfs root and <a class="indexterm" name="id286992"></a>host msdfs 2792 2873 options to find out how to set up a Dfs root share.</p><p><span class="emphasis"><em>No default</em></span></p><p>Example: <span class="emphasis"><em><em class="parameter"><code>msdfs proxy</code></em> = \\otherserver\someshare 2793 2874 </em></span> … … 2825 2906 _ldap._tcp.domain. 2826 2907 </p></li><li><p><code class="constant">wins</code> : Query a name with 2827 the IP address listed in the <a class="indexterm" name="id287 080"></a>WINSSERVER parameter. If no WINS server has2908 the IP address listed in the <a class="indexterm" name="id287183"></a>WINSSERVER parameter. If no WINS server has 2828 2909 been specified this method will be ignored.</p></li><li><p><code class="constant">bcast</code> : Do a broadcast on 2829 each of the known local interfaces listed in the <a class="indexterm" name="id287 097"></a>interfaces2910 each of the known local interfaces listed in the <a class="indexterm" name="id287200"></a>interfaces 2830 2911 parameter. This is the least reliable of the name resolution 2831 2912 methods as it depends on the target host being on a locally … … 2879 2960 server. When Samba is returning the home share to the client, it 2880 2961 will consult the NIS map specified in 2881 <a class="indexterm" name="id287 347"></a>homedir map and return the server2962 <a class="indexterm" name="id287449"></a>homedir map and return the server 2882 2963 listed there.</p><p>Note that for this option to work there must be a working 2883 2964 NIS system and the Samba server with this option must also … … 2918 2999 default behavior is to use PAM for clear text authentication only 2919 3000 and to ignore any account or session management. Note that Samba 2920 always ignores PAM for authentication in the case of <a class="indexterm" name="id287 633"></a>encrypt passwords = yes. The reason3001 always ignores PAM for authentication in the case of <a class="indexterm" name="id287735"></a>encrypt passwords = yes. The reason 2921 3002 is that PAM modules cannot support the challenge/response 2922 3003 authentication mechanism needed in the presence of SMB password encryption. … … 2929 3010 this parameter will force the server to only use the login 2930 3011 names from the <em class="parameter"><code>user</code></em> list and is only really 2931 useful in <a class="indexterm" name="id287 689"></a>security = share level security.</p><p>Note that this also means Samba won't try to deduce3012 useful in <a class="indexterm" name="id287791"></a>security = share level security.</p><p>Note that this also means Samba won't try to deduce 2932 3013 usernames from the service name. This can be annoying for 2933 3014 the [homes] section. To get around this you could use <span><strong class="command">user = … … 2977 3058 </p><p> 2978 3059 Oplocks may be selectively turned off on certain files with a share. See 2979 the <a class="indexterm" name="id28 7934"></a>veto oplock files parameter. On some systems3060 the <a class="indexterm" name="id288040"></a>veto oplock files parameter. On some systems 2980 3061 oplocks are recognized by the underlying operating system. This 2981 3062 allows data synchronization between all access to oplocked files, 2982 3063 whether it be via Samba or NFS or a local UNIX process. See the 2983 <a class="indexterm" name="id28 7943"></a>kernel oplocks parameter for details.3064 <a class="indexterm" name="id288049"></a>kernel oplocks parameter for details. 2984 3065 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>oplocks</code></em> = yes 2985 3066 </em></span> … … 2996 3077 </p></dd><dt><span class="term"><a name="OSLEVEL"></a>os level (G)</span></dt><dd><p> 2997 3078 This integer value controls what level Samba advertises itself as for browse elections. The value of this 2998 parameter determines whether <a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> has a chance of becoming a local master browser for the <a class="indexterm" name="id288 046"></a>workgroup in the local broadcast area.3079 parameter determines whether <a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> has a chance of becoming a local master browser for the <a class="indexterm" name="id288153"></a>workgroup in the local broadcast area. 2999 3080 </p><p><span class="emphasis"><em> 3000 3081 Note :</em></span>By default, Samba will win a local master browsing election over all Microsoft operating … … 3011 3092 flag for Samba. If enabled, then PAM will be used for password 3012 3093 changes when requested by an SMB client instead of the program listed in 3013 <a class="indexterm" name="id288 111"></a>passwd program.3094 <a class="indexterm" name="id288217"></a>passwd program. 3014 3095 It should be possible to enable this without changing your 3015 <a class="indexterm" name="id288 118"></a>passwd chat parameter for most setups.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>pam password change</code></em> = no3096 <a class="indexterm" name="id288224"></a>passwd chat parameter for most setups.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>pam password change</code></em> = no 3016 3097 </em></span> 3017 3098 </p></dd><dt><span class="term"><a name="PANICACTION"></a>panic action (G)</span></dt><dd><p>This is a Samba developer option that allows a … … 3039 3120 </p></li><li><p><span><strong class="command">tdbsam</strong></span> - The TDB based password storage 3040 3121 backend. Takes a path to the TDB as an optional argument (defaults to passdb.tdb 3041 in the <a class="indexterm" name="id288 295"></a>private dir directory.</p></li><li><p><span><strong class="command">ldapsam</strong></span> - The LDAP based passdb3122 in the <a class="indexterm" name="id288401"></a>private dir directory.</p></li><li><p><span><strong class="command">ldapsam</strong></span> - The LDAP based passdb 3042 3123 backend. Takes an LDAP URL as an optional argument (defaults to 3043 3124 <span><strong class="command">ldap://localhost</strong></span>)</p><p>LDAP connections should be secured where possible. This may be done using either 3044 Start-TLS (see <a class="indexterm" name="id288 325"></a>ldap ssl) or by3125 Start-TLS (see <a class="indexterm" name="id288431"></a>ldap ssl) or by 3045 3126 specifying <em class="parameter"><code>ldaps://</code></em> in 3046 3127 the URL argument. </p><p>Multiple servers may also be specified in double-quotes, if your … … 3069 3150 strings passed to and received from the passwd chat are printed 3070 3151 in the <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> log with a 3071 <a class="indexterm" name="id288 435"></a>debug level3152 <a class="indexterm" name="id288541"></a>debug level 3072 3153 of 100. This is a dangerous option as it will allow plaintext passwords 3073 3154 to be seen in the <span><strong class="command">smbd</strong></span> log. It is available to help … … 3075 3156 when calling the <em class="parameter"><code>passwd program</code></em> and should 3076 3157 be turned off after this has been done. This option has no effect if the 3077 <a class="indexterm" name="id288 462"></a>pam password change3158 <a class="indexterm" name="id288568"></a>pam password change 3078 3159 paramter is set. This parameter is off by default.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>passwd chat debug</code></em> = no 3079 3160 </em></span> … … 3087 3168 program to change the user's password. The string describes a 3088 3169 sequence of response-receive pairs that <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> uses to determine what to send to the 3089 <a class="indexterm" name="id288 559"></a>passwd program and what to expect back. If the expected output is not3170 <a class="indexterm" name="id288665"></a>passwd program and what to expect back. If the expected output is not 3090 3171 received then the password is not changed.</p><p>This chat sequence is often quite site specific, depending 3091 3172 on what local methods are used for password control (such as NIS 3092 etc).</p><p>Note that this parameter only is only used if the <a class="indexterm" name="id288 575"></a>unix password sync parameter is set to <code class="constant">yes</code>. This sequence is3173 etc).</p><p>Note that this parameter only is only used if the <a class="indexterm" name="id288681"></a>unix password sync parameter is set to <code class="constant">yes</code>. This sequence is 3093 3174 then called <span class="emphasis"><em>AS ROOT</em></span> when the SMB password in the 3094 3175 smbpasswd file is being changed, without access to the old password 3095 3176 cleartext. This means that root must be able to reset the user's password without 3096 3177 knowing the text of the previous password. In the presence of 3097 NIS/YP, this means that the <a class="indexterm" name="id288 592"></a>passwd program must3178 NIS/YP, this means that the <a class="indexterm" name="id288698"></a>passwd program must 3098 3179 be executed on the NIS master. 3099 3180 </p><p>The string can contain the macro <em class="parameter"><code>%n</code></em> which is substituted … … 3104 3185 in them into a single string.</p><p>If the send string in any part of the chat sequence is a full 3105 3186 stop ".", then no string is sent. Similarly, if the 3106 expect string is a full stop then no string is expected.</p><p>If the <a class="indexterm" name="id288 620"></a>pam password change parameter is set to <code class="constant">yes</code>, the3187 expect string is a full stop then no string is expected.</p><p>If the <a class="indexterm" name="id288726"></a>pam password change parameter is set to <code class="constant">yes</code>, the 3107 3188 chat pairs may be matched in any order, and success is determined by the PAM result, not any particular 3108 3189 output. The \n macro is ignored for PAM conversions. … … 3150 3231 made - the password as is and the password in all-lower case.</p><p>This parameter is used only when using plain-text passwords. It is 3151 3232 not at all used when encrypted passwords as in use (that is the default 3152 since samba-3.0.0). Use this only when <a class="indexterm" name="id288 846"></a>encrypt passwords = No.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>password level</code></em> = 03233 since samba-3.0.0). Use this only when <a class="indexterm" name="id288953"></a>encrypt passwords = No.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>password level</code></em> = 0 3153 3234 </em></span> 3154 3235 </p><p>Example: <span class="emphasis"><em><em class="parameter"><code>password level</code></em> = 4 … … 3166 3247 have no effect on password servers for Windows NT 4.0 domains or netbios 3167 3248 connections.</p><p>If parameter is a name, it is looked up using the 3168 parameter <a class="indexterm" name="id28 8918"></a>name resolve order and so may resolved3249 parameter <a class="indexterm" name="id289024"></a>name resolve order and so may resolved 3169 3250 by any method and order described in that parameter.</p><p>The password server must be a machine capable of using 3170 3251 the "LM1.2X002" or the "NT LM 0.12" protocol, and it must be in … … 3228 3309 will be replaced by the NetBIOS name of the machine they are 3229 3310 connecting from. These replacements are very useful for setting 3230 up pseudo home directories for users.</p><p>Note that this path will be based on <a class="indexterm" name="id289 202"></a>root dir3311 up pseudo home directories for users.</p><p>Note that this path will be based on <a class="indexterm" name="id289308"></a>root dir 3231 3312 if one was specified.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>path</code></em> = 3232 3313 </em></span> … … 3256 3337 </em></span> 3257 3338 </p></dd><dt><span class="term"><a name="PREEXECCLOSE"></a>preexec close (S)</span></dt><dd><p> 3258 This boolean option controls whether a non-zero return code from <a class="indexterm" name="id289 400"></a>preexec3339 This boolean option controls whether a non-zero return code from <a class="indexterm" name="id289506"></a>preexec 3259 3340 should close the service being connected to. 3260 3341 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>preexec close</code></em> = no … … 3267 3348 /usr/local/samba/bin/smbclient -M %m -I %I' & </strong></span> 3268 3349 </p><p>Of course, this could get annoying after a while :-)</p><p> 3269 See also <a class="indexterm" name="id289 484"></a>preexec close and <a class="indexterm" name="id289491"></a>postexec.3350 See also <a class="indexterm" name="id289590"></a>preexec close and <a class="indexterm" name="id289597"></a>postexec. 3270 3351 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>preexec</code></em> = 3271 3352 </em></span> … … 3277 3358 If this is set to <code class="constant">yes</code>, on startup, <span><strong class="command">nmbd</strong></span> will force 3278 3359 an election, and it will have a slight advantage in winning the election. It is recommended that this 3279 parameter is used in conjunction with <a class="indexterm" name="id289 588"></a>domain master = yes, so that3360 parameter is used in conjunction with <a class="indexterm" name="id289694"></a>domain master = yes, so that 3280 3361 <span><strong class="command">nmbd</strong></span> can guarantee becoming a domain master. 3281 3362 </p><p> … … 3297 3378 visible.</p><p> 3298 3379 Note that if you just want all printers in your 3299 printcap file loaded then the <a class="indexterm" name="id289 713"></a>load printers3380 printcap file loaded then the <a class="indexterm" name="id289819"></a>load printers 3300 3381 option is easier. 3301 3382 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>preload</code></em> = … … 3305 3386 </p></dd><dt><span class="term"><a name="PRESERVECASE"></a>preserve case (S)</span></dt><dd><p> 3306 3387 This controls if new filenames are created with the case that the client passes, or if 3307 they are forced to be the <a class="indexterm" name="id289 765"></a>default case.3388 they are forced to be the <a class="indexterm" name="id289871"></a>default case. 3308 3389 </p><p> 3309 3390 See the section on <a href="#NAMEMANGLINGSECT" title="NAME MANGLING">NAME MANGLING</a> for a fuller discussion. … … 3314 3395 specified for the service. </p><p>Note that a printable service will ALWAYS allow writing 3315 3396 to the service path (user privileges permitting) via the spooling 3316 of print data. The <a class="indexterm" name="id2 89950"></a>read only parameter controls only non-printing access to3397 of print data. The <a class="indexterm" name="id290056"></a>read only parameter controls only non-printing access to 3317 3398 the resource.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>printable</code></em> = no 3318 3399 </em></span> … … 3332 3413 </p><p> 3333 3414 To use the CUPS printing interface set <span><strong class="command">printcap name = cups </strong></span>. This should 3334 be supplemented by an addtional setting <a class="indexterm" name="id290 088"></a>printing = cups in the [global]3415 be supplemented by an addtional setting <a class="indexterm" name="id290194"></a>printing = cups in the [global] 3335 3416 section. <span><strong class="command">printcap name = cups</strong></span> will use the "dummy" printcap 3336 3417 created by CUPS, as specified in your CUPS configuration file. … … 3385 3466 be created but not processed and (most importantly) not removed.</p><p>Note that printing may fail on some UNIXes from the 3386 3467 <code class="constant">nobody</code> account. If this happens then create 3387 an alternative guest account that can print and set the <a class="indexterm" name="id290 300"></a>guest account3468 an alternative guest account that can print and set the <a class="indexterm" name="id290406"></a>guest account 3388 3469 in the [global] section.</p><p>You can form quite complex print commands by realizing 3389 3470 that they are just passed to a shell. For example the following … … 3392 3473 /tmp/print.log; lpr -P %p %s; rm %s</strong></span></p><p>You may have to vary this command considerably depending 3393 3474 on how you normally print files on your system. The default for 3394 the parameter varies depending on the setting of the <a class="indexterm" name="id290 326"></a>printing3475 the parameter varies depending on the setting of the <a class="indexterm" name="id290432"></a>printing 3395 3476 parameter.</p><p>Default: For <span><strong class="command">printing = BSD, AIX, QNX, LPRNG 3396 3477 or PLP :</strong></span></p><p><span><strong class="command">print command = lpr -r -P%p %s</strong></span></p><p>For <span><strong class="command">printing = SYSV or HPUX :</strong></span></p><p><span><strong class="command">print command = lp -c -d%p %s; rm %s</strong></span></p><p>For <span><strong class="command">printing = SOFTQ :</strong></span></p><p><span><strong class="command">print command = lp -d%p -s %s; rm %s</strong></span></p><p>For printing = CUPS : If SAMBA is compiled against 3397 libcups, then <a class="indexterm" name="id290 382"></a>printcap = cups3478 libcups, then <a class="indexterm" name="id290488"></a>printcap = cups 3398 3479 uses the CUPS API to 3399 3480 submit jobs, etc. Otherwise it maps to the System V … … 3427 3508 does not have its own printer name specified. 3428 3509 </p><p> 3429 The default value of the <a class="indexterm" name="id290 524"></a>printer name may be <code class="literal">lp</code> on many3510 The default value of the <a class="indexterm" name="id290630"></a>printer name may be <code class="literal">lp</code> on many 3430 3511 systems. 3431 3512 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>printer name</code></em> = none … … 3500 3581 executed on the server host in order to resume the printer queue. It 3501 3582 is the command to undo the behavior that is caused by the 3502 previous parameter (<a class="indexterm" name="id29 0915"></a>queuepause command).</p><p>This command should be a program or script which takes3583 previous parameter (<a class="indexterm" name="id291021"></a>queuepause command).</p><p>This command should be a program or script which takes 3503 3584 a printer name as its only parameter and resumes the printer queue, 3504 3585 such that queued jobs are resubmitted to the printer.</p><p>This command is not supported by Windows for Workgroups, … … 3520 3601 </p></dd><dt><span class="term"><a name="READLIST"></a>read list (S)</span></dt><dd><p> 3521 3602 This is a list of users that are given read-only access to a service. If the connecting user is in this list 3522 then they will not be given write access, no matter what the <a class="indexterm" name="id291 037"></a>read only option is set3523 to. The list can include group names using the syntax described in the <a class="indexterm" name="id291 045"></a>invalid users3603 then they will not be given write access, no matter what the <a class="indexterm" name="id291144"></a>read only option is set 3604 to. The list can include group names using the syntax described in the <a class="indexterm" name="id291151"></a>invalid users 3524 3605 parameter. 3525 </p><p>This parameter will not work with the <a class="indexterm" name="id291 056"></a>security = share in3606 </p><p>This parameter will not work with the <a class="indexterm" name="id291162"></a>security = share in 3526 3607 Samba 3.0. This is by design.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>read list</code></em> = 3527 3608 </em></span> 3528 3609 </p><p>Example: <span class="emphasis"><em><em class="parameter"><code>read list</code></em> = mary, @students 3529 3610 </em></span> 3530 </p></dd><dt><span class="term"><a name="READONLY"></a>read only (S)</span></dt><dd><p>An inverted synonym is <a class="indexterm" name="id291 107"></a>writeable.</p><p>If this parameter is <code class="constant">yes</code>, then users3611 </p></dd><dt><span class="term"><a name="READONLY"></a>read only (S)</span></dt><dd><p>An inverted synonym is <a class="indexterm" name="id291214"></a>writeable.</p><p>If this parameter is <code class="constant">yes</code>, then users 3531 3612 of a service may not create or modify files in the service's 3532 3613 directory.</p><p>Note that a printable service (<span><strong class="command">printable = yes</strong></span>) … … 3564 3645 the above line would cause <span><strong class="command">nmbd</strong></span> to announce itself 3565 3646 to the two given IP addresses using the given workgroup names. If you leave out the 3566 workgroup name then the one given in the <a class="indexterm" name="id291 305"></a>workgroup parameter3647 workgroup name then the one given in the <a class="indexterm" name="id291412"></a>workgroup parameter 3567 3648 is used instead. 3568 3649 </p><p> … … 3601 3682 is in fact the browse master on its segment. 3602 3683 </p><p> 3603 The <a class="indexterm" name="id291 402"></a>remote browse sync may be used on networks3684 The <a class="indexterm" name="id291509"></a>remote browse sync may be used on networks 3604 3685 where there is no WINS server, and may be used on disjoint networks where 3605 3686 each network has its own WINS server. … … 3663 3744 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 3664 3745 The security advantage of using restrict anonymous = 2 is removed 3665 by setting <a class="indexterm" name="id291 576"></a>guest ok = yes on any share.3746 by setting <a class="indexterm" name="id291682"></a>guest ok = yes on any share. 3666 3747 </p></div><p>Default: <span class="emphasis"><em><em class="parameter"><code>restrict anonymous</code></em> = 0 3667 3748 </em></span> … … 3673 3754 parts of the filesystem, or attempts to use ".." in file names 3674 3755 to access other directories (depending on the setting of the 3675 <a class="indexterm" name="id291 669"></a>wide smbconfoptions parameter).3756 <a class="indexterm" name="id291776"></a>wide smbconfoptions parameter). 3676 3757 </p><p>Adding a <em class="parameter"><code>root directory</code></em> entry other 3677 3758 than "/" adds an extra level of security, but at a price. It … … 3709 3790 </p><p> 3710 3791 This parameter is applied as a mask (AND'ed with) to the changed permission bits, thus preventing any bits not 3711 in this mask from being modified. Make sure not to mix up this parameter with <a class="indexterm" name="id291 883"></a>force security mode, which works in a manner similar to this one but uses a logical OR instead of an AND.3792 in this mask from being modified. Make sure not to mix up this parameter with <a class="indexterm" name="id291989"></a>force security mode, which works in a manner similar to this one but uses a logical OR instead of an AND. 3712 3793 </p><p> 3713 3794 Essentially, zero bits in this mask may be treated as a set of bits the user is not allowed to change. … … 3746 3827 is commonly used for a shared printer server. It is more difficult 3747 3828 to setup guest shares with <span><strong class="command">security = user</strong></span>, see 3748 the <a class="indexterm" name="id292 056"></a>map to guestparameter for details.</p><p>It is possible to use <span><strong class="command">smbd</strong></span> in a <span class="emphasis"><em>3829 the <a class="indexterm" name="id292166"></a>map to guestparameter for details.</p><p>It is possible to use <span><strong class="command">smbd</strong></span> in a <span class="emphasis"><em> 3749 3830 hybrid mode</em></span> where it is offers both user and share 3750 level security under different <a class="indexterm" name="id292 077"></a>NetBIOS aliases. </p><p>The different settings will now be explained.</p><p><a name="SECURITYEQUALSSHARE"></a><span class="emphasis"><em>SECURITY = SHARE</em></span></p><p>When clients connect to a share level security server they3831 level security under different <a class="indexterm" name="id292187"></a>NetBIOS aliases. </p><p>The different settings will now be explained.</p><p><a name="SECURITYEQUALSSHARE"></a><span class="emphasis"><em>SECURITY = SHARE</em></span></p><p>When clients connect to a share level security server they 3751 3832 need not log onto the server with a valid username and password before 3752 3833 attempting to connect to a shared resource (although modern clients … … 3761 3842 techniques to determine the correct UNIX user to use on behalf 3762 3843 of the client.</p><p>A list of possible UNIX usernames to match with the given 3763 client password is constructed using the following methods :</p><div class="itemizedlist"><ul type="disc"><li><p>If the <a class="indexterm" name="id292 153"></a>guest only parameter is set, then all the other3764 stages are missed and only the <a class="indexterm" name="id292 160"></a>guest account username is checked.3844 client password is constructed using the following methods :</p><div class="itemizedlist"><ul type="disc"><li><p>If the <a class="indexterm" name="id292262"></a>guest only parameter is set, then all the other 3845 stages are missed and only the <a class="indexterm" name="id292270"></a>guest account username is checked. 3765 3846 </p></li><li><p>Is a username is sent with the share connection 3766 request, then this username (after mapping - see <a class="indexterm" name="id292 175"></a>username map),3847 request, then this username (after mapping - see <a class="indexterm" name="id292284"></a>username map), 3767 3848 is added as a potential username. 3768 3849 </p></li><li><p>If the client did a previous <span class="emphasis"><em>logon … … 3773 3854 </p></li><li><p>The NetBIOS name of the client is added to 3774 3855 the list as a potential username. 3775 </p></li><li><p>Any users on the <a class="indexterm" name="id292 215"></a>user list are added as potential usernames.3856 </p></li><li><p>Any users on the <a class="indexterm" name="id292325"></a>user list are added as potential usernames. 3776 3857 </p></li></ul></div><p>If the <em class="parameter"><code>guest only</code></em> parameter is 3777 3858 not set, then this list is then tried with the supplied password. … … 3785 3866 NOTE ABOUT USERNAME/PASSWORD VALIDATION</a>.</p><p><a name="SECURITYEQUALSUSER"></a><span class="emphasis"><em>SECURITY = USER</em></span></p><p>This is the default security setting in Samba 3.0. 3786 3867 With user-level security a client must first "log-on" with a 3787 valid username and password (which can be mapped using the <a class="indexterm" name="id292 284"></a>username map3788 parameter). Encrypted passwords (see the <a class="indexterm" name="id292 292"></a>encrypted passwords parameter) can also3789 be used in this security mode. Parameters such as <a class="indexterm" name="id292 300"></a>user and <a class="indexterm" name="id292307"></a>guest only if set are then applied and3868 valid username and password (which can be mapped using the <a class="indexterm" name="id292394"></a>username map 3869 parameter). Encrypted passwords (see the <a class="indexterm" name="id292402"></a>encrypted passwords parameter) can also 3870 be used in this security mode. Parameters such as <a class="indexterm" name="id292409"></a>user and <a class="indexterm" name="id292416"></a>guest only if set are then applied and 3790 3871 may change the UNIX user to use on this connection, but only after 3791 3872 the user has been successfully authenticated.</p><p><span class="emphasis"><em>Note</em></span> that the name of the resource being … … 3793 3874 the server has successfully authenticated the client. This is why 3794 3875 guest shares don't work in user level security without allowing 3795 the server to automatically map unknown users into the <a class="indexterm" name="id292 326"></a>guest account.3796 See the <a class="indexterm" name="id292 334"></a>map to guest parameter for details on doing this.</p><p>See also the section <a href="#VALIDATIONSECT" title="NOTE ABOUT USERNAME/PASSWORD VALIDATION">NOTE ABOUT USERNAME/PASSWORD VALIDATION</a>.</p><p><a name="SECURITYEQUALSDOMAIN"></a><span class="emphasis"><em>SECURITY = DOMAIN</em></span></p><p>This mode will only work correctly if <a href="net.8.html"><span class="citerefentry"><span class="refentrytitle">net</span>(8)</span></a> has been used to add this3797 machine into a Windows NT Domain. It expects the <a class="indexterm" name="id292 372"></a>encrypted passwords3876 the server to automatically map unknown users into the <a class="indexterm" name="id292436"></a>guest account. 3877 See the <a class="indexterm" name="id292443"></a>map to guest parameter for details on doing this.</p><p>See also the section <a href="#VALIDATIONSECT" title="NOTE ABOUT USERNAME/PASSWORD VALIDATION">NOTE ABOUT USERNAME/PASSWORD VALIDATION</a>.</p><p><a name="SECURITYEQUALSDOMAIN"></a><span class="emphasis"><em>SECURITY = DOMAIN</em></span></p><p>This mode will only work correctly if <a href="net.8.html"><span class="citerefentry"><span class="refentrytitle">net</span>(8)</span></a> has been used to add this 3878 machine into a Windows NT Domain. It expects the <a class="indexterm" name="id292482"></a>encrypted passwords 3798 3879 parameter to be set to <code class="constant">yes</code>. In this 3799 3880 mode Samba will try to validate the username/password by passing … … 3809 3890 the server has successfully authenticated the client. This is why 3810 3891 guest shares don't work in user level security without allowing 3811 the server to automatically map unknown users into the <a class="indexterm" name="id292 422"></a>guest account.3812 See the <a class="indexterm" name="id292 429"></a>map to guest parameter for details on doing this.</p><p>See also the section <a href="#VALIDATIONSECT" title="NOTE ABOUT USERNAME/PASSWORD VALIDATION">3813 NOTE ABOUT USERNAME/PASSWORD VALIDATION</a>.</p><p>See also the <a class="indexterm" name="id292 450"></a>password server parameter and3814 the <a class="indexterm" name="id292 458"></a>encrypted passwords parameter.</p><p><a name="SECURITYEQUALSSERVER"></a><span class="emphasis"><em>SECURITY = SERVER</em></span></p><p>3892 the server to automatically map unknown users into the <a class="indexterm" name="id292532"></a>guest account. 3893 See the <a class="indexterm" name="id292539"></a>map to guest parameter for details on doing this.</p><p>See also the section <a href="#VALIDATIONSECT" title="NOTE ABOUT USERNAME/PASSWORD VALIDATION"> 3894 NOTE ABOUT USERNAME/PASSWORD VALIDATION</a>.</p><p>See also the <a class="indexterm" name="id292560"></a>password server parameter and 3895 the <a class="indexterm" name="id292567"></a>encrypted passwords parameter.</p><p><a name="SECURITYEQUALSSERVER"></a><span class="emphasis"><em>SECURITY = SERVER</em></span></p><p> 3815 3896 In this mode Samba will try to validate the username/password by passing it to another SMB server, such as an 3816 3897 NT box. If this fails it will revert to <span><strong class="command">security = user</strong></span>. It expects the 3817 <a class="indexterm" name="id292 484"></a>encrypted passwords parameter to be set to <code class="constant">yes</code>, unless the remote3898 <a class="indexterm" name="id292594"></a>encrypted passwords parameter to be set to <code class="constant">yes</code>, unless the remote 3818 3899 server does not support them. However note that if encrypted passwords have been negotiated then Samba cannot 3819 3900 revert back to checking the UNIX password file, it must have a valid <code class="filename">smbpasswd</code> file to check users against. See the chapter about the User Database in … … 3835 3916 the server has successfully authenticated the client. This is why 3836 3917 guest shares don't work in user level security without allowing 3837 the server to automatically map unknown users into the <a class="indexterm" name="id292 542"></a>guest account.3838 See the <a class="indexterm" name="id292 549"></a>map to guest parameter for details on doing this.</p><p>See also the section <a href="#VALIDATIONSECT" title="NOTE ABOUT USERNAME/PASSWORD VALIDATION">3839 NOTE ABOUT USERNAME/PASSWORD VALIDATION</a>.</p><p>See also the <a class="indexterm" name="id292 570"></a>password server parameter and the3840 <a class="indexterm" name="id292 577"></a>encrypted passwords parameter.</p><p><a name="SECURITYEQUALSADS"></a><span class="emphasis"><em>SECURITY = ADS</em></span></p><p>In this mode, Samba will act as a domain member in an ADS realm. To operate3918 the server to automatically map unknown users into the <a class="indexterm" name="id292651"></a>guest account. 3919 See the <a class="indexterm" name="id292658"></a>map to guest parameter for details on doing this.</p><p>See also the section <a href="#VALIDATIONSECT" title="NOTE ABOUT USERNAME/PASSWORD VALIDATION"> 3920 NOTE ABOUT USERNAME/PASSWORD VALIDATION</a>.</p><p>See also the <a class="indexterm" name="id292680"></a>password server parameter and the 3921 <a class="indexterm" name="id292687"></a>encrypted passwords parameter.</p><p><a name="SECURITYEQUALSADS"></a><span class="emphasis"><em>SECURITY = ADS</em></span></p><p>In this mode, Samba will act as a domain member in an ADS realm. To operate 3841 3922 in this mode, the machine running Samba will need to have Kerberos installed 3842 3923 and configured and Samba will need to be joined to the ADS realm using the … … 3848 3929 </p></dd><dt><span class="term"><a name="SERVERSCHANNEL"></a>server schannel (G)</span></dt><dd><p> 3849 3930 This controls whether the server offers or even demands the use of the netlogon schannel. 3850 <a class="indexterm" name="id292 653"></a>server schannel = no does not offer the schannel, <a class="indexterm" name="id292660"></a>server schannel = auto offers the schannel but does not enforce it, and <a class="indexterm" name="id292668"></a>server schannel = yes denies access if the client is not able to speak netlogon schannel.3931 <a class="indexterm" name="id292762"></a>server schannel = no does not offer the schannel, <a class="indexterm" name="id292770"></a>server schannel = auto offers the schannel but does not enforce it, and <a class="indexterm" name="id292777"></a>server schannel = yes denies access if the client is not able to speak netlogon schannel. 3851 3932 This is only the case for Windows NT4 before SP4. 3852 3933 </p><p> … … 3921 4002 </p></dd><dt><span class="term"><a name="SHORTPRESERVECASE"></a>short preserve case (S)</span></dt><dd><p> 3922 4003 This boolean parameter controls if new files which conform to 8.3 syntax, that is all in upper case and of 3923 suitable length, are created upper case, or if they are forced to be the <a class="indexterm" name="id293 202"></a>default case.3924 This option can be use with <a class="indexterm" name="id293 209"></a>preserve case = yes to permit long filenames4004 suitable length, are created upper case, or if they are forced to be the <a class="indexterm" name="id293312"></a>default case. 4005 This option can be use with <a class="indexterm" name="id293319"></a>preserve case = yes to permit long filenames 3925 4006 to retain their case, while short names are lowered. 3926 4007 </p><p>See the section on <a href="#NAMEMANGLINGSECT" title="NAME MANGLING">NAME MANGLING</a>.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>short preserve case</code></em> = yes … … 4022 4103 If this parameter is set Samba attempts to first read DOS attributes (SYSTEM, HIDDEN, ARCHIVE or 4023 4104 READ-ONLY) from a filesystem extended attribute, before mapping DOS attributes to UNIX permission bits (such 4024 as occurs with <a class="indexterm" name="id293 812"></a>map hidden and <a class="indexterm" name="id293818"></a>map readonly). When set, DOS4105 as occurs with <a class="indexterm" name="id293921"></a>map hidden and <a class="indexterm" name="id293928"></a>map readonly). When set, DOS 4025 4106 attributes will be stored onto an extended attribute in the UNIX filesystem, associated with the file or 4026 directory. For no other mapping to occur as a fall-back, the parameters <a class="indexterm" name="id293 827"></a>map hidden,4027 <a class="indexterm" name="id293 834"></a>map system, <a class="indexterm" name="id293841"></a>map archive and <a class="indexterm" name="id293848"></a>map readonly must be set to off. This parameter writes the DOS attributes as a string into the extended4107 directory. For no other mapping to occur as a fall-back, the parameters <a class="indexterm" name="id293937"></a>map hidden, 4108 <a class="indexterm" name="id293944"></a>map system, <a class="indexterm" name="id293951"></a>map archive and <a class="indexterm" name="id293958"></a>map readonly must be set to off. This parameter writes the DOS attributes as a string into the extended 4028 4109 attribute named "user.DOSATTRIB". This extended attribute is explicitly hidden from smbd clients requesting an 4029 4110 EA list. On Linux the filesystem must have been mounted with the mount option user_xattr in order for … … 4167 4248 in the smbpasswd file this parameter should be set to <code class="constant">no</code>. 4168 4249 </p><p> 4169 In order for this parameter to be operative the <a class="indexterm" name="id294 608"></a>encrypt passwords parameter must4170 be set to <code class="constant">no</code>. The default value of <a class="indexterm" name="id294 618"></a>encrypt passwords = Yes. Note: This must be set to <code class="constant">no</code> for this <a class="indexterm" name="id294629"></a>update encrypted to work.4250 In order for this parameter to be operative the <a class="indexterm" name="id294717"></a>encrypt passwords parameter must 4251 be set to <code class="constant">no</code>. The default value of <a class="indexterm" name="id294728"></a>encrypt passwords = Yes. Note: This must be set to <code class="constant">no</code> for this <a class="indexterm" name="id294739"></a>update encrypted to work. 4171 4252 </p><p> 4172 4253 Note that even when this parameter is set a user authenticating to <span><strong class="command">smbd</strong></span> … … 4237 4318 </em></span> 4238 4319 </p></dd><dt><span class="term"><a name="USERNAMEMAPSCRIPT"></a>username map script (G)</span></dt><dd><p>This script is a mutually exclusive alternative to the 4239 <a class="indexterm" name="id29 4901"></a>username map parameter. This parameter4320 <a class="indexterm" name="id295014"></a>username map parameter. This parameter 4240 4321 specifies and external program or script that must accept a single 4241 4322 command line option (the username transmitted in the authentication … … 4303 4384 <code class="constant">fred</code> is remapped to <code class="constant">mary</code> then you will actually be connecting to 4304 4385 \\server\mary and will need to supply a password suitable for <code class="constant">mary</code> not 4305 <code class="constant">fred</code>. The only exception to this is the username passed to the <a class="indexterm" name="id295 094"></a>password server (if you have one). The password server will receive whatever username the client4386 <code class="constant">fred</code>. The only exception to this is the username passed to the <a class="indexterm" name="id295207"></a>password server (if you have one). The password server will receive whatever username the client 4306 4387 supplies without modification. 4307 4388 </p><p> … … 4349 4430 telnet session. The daemon runs as the user that they log in as, 4350 4431 so they cannot do anything that user cannot do.</p><p>To restrict a service to a particular set of users you 4351 can use the <a class="indexterm" name="id295 255"></a>valid users parameter.</p><p>If any of the usernames begin with a '@' then the name4432 can use the <a class="indexterm" name="id295368"></a>valid users parameter.</p><p>If any of the usernames begin with a '@' then the name 4352 4433 will be looked up first in the NIS netgroups list (if Samba 4353 4434 is compiled with netgroup support), followed by a lookup in … … 4531 4612 unix directory separator '/'. 4532 4613 </p><p> 4533 Note that the <a class="indexterm" name="id29 5996"></a>case sensitive option is applicable in vetoing files.4614 Note that the <a class="indexterm" name="id296109"></a>case sensitive option is applicable in vetoing files. 4534 4615 </p><p> 4535 4616 One feature of the veto files parameter that it is important to be aware of is Samba's behaviour when 4536 4617 trying to delete a directory. If a directory that is to be deleted contains nothing but veto files this 4537 deletion will <span class="emphasis"><em>fail</em></span> unless you also set the <a class="indexterm" name="id296 012"></a>delete veto files4618 deletion will <span class="emphasis"><em>fail</em></span> unless you also set the <a class="indexterm" name="id296126"></a>delete veto files 4538 4619 parameter to <em class="parameter"><code>yes</code></em>. 4539 4620 </p><p> … … 4555 4636 </em></span> 4556 4637 </p></dd><dt><span class="term"><a name="VETOOPLOCKFILES"></a>veto oplock files (S)</span></dt><dd><p> 4557 This parameter is only valid when the <a class="indexterm" name="id296 075"></a>oplocks4638 This parameter is only valid when the <a class="indexterm" name="id296189"></a>oplocks 4558 4639 parameter is turned on for a share. It allows the Samba administrator 4559 4640 to selectively turn off the granting of oplocks on selected files that 4560 4641 match a wildcarded list, similar to the wildcarded list used in the 4561 <a class="indexterm" name="id296 084"></a>veto files parameter.4642 <a class="indexterm" name="id296197"></a>veto files parameter. 4562 4643 </p><p> 4563 4644 You might want to do this on files that you know will be heavily contended … … 4600 4681 again.</p><p> 4601 4682 This does not apply to authentication requests, these are always 4602 evaluated in real time unless the <a class="indexterm" name="id296 302"></a>winbind offline logon option has been enabled.4683 evaluated in real time unless the <a class="indexterm" name="id296416"></a>winbind offline logon option has been enabled. 4603 4684 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>winbind cache time</code></em> = 300 4604 4685 </em></span> … … 4697 4778 </p><p> 4698 4779 This parameter is not deprecated in favor of the newer idmap_nss backend. 4699 Refer to the <a class="indexterm" name="id296 873"></a>idmap domains smb.conf option and4780 Refer to the <a class="indexterm" name="id296986"></a>idmap domains smb.conf option and 4700 4781 the <a href="idmap_nss.8.html"><span class="citerefentry"><span class="refentrytitle">idmap_nss</span>(8)</span></a> man page for more information. 4701 4782 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>winbind trusted domains only</code></em> = no … … 4764 4845 appear to be in when queried by clients. Note that this parameter 4765 4846 also controls the Domain name used with 4766 the <a class="indexterm" name="id297 262"></a>security = domain4847 the <a class="indexterm" name="id297376"></a>security = domain 4767 4848 setting.</p><p>Default: <span class="emphasis"><em><em class="parameter"><code>workgroup</code></em> = WORKGROUP 4768 4849 </em></span> 4769 4850 </p><p>Example: <span class="emphasis"><em><em class="parameter"><code>workgroup</code></em> = MYGROUP 4770 4851 </em></span> 4771 </p></dd><dt><span class="term"><a name="WRITABLE"></a>writable</span></dt><dd><p>This parameter is a synonym for writeable.</p></dd><dt><span class="term"><a name="WRITEABLE"></a>writeable (S)</span></dt><dd><p>Inverted synonym for <a class="indexterm" name="id297 335"></a>read only.</p><p><span class="emphasis"><em>No default</em></span></p></dd><dt><span class="term"><a name="WRITECACHESIZE"></a>write cache size (S)</span></dt><dd><p>If this integer parameter is set to non-zero value,4852 </p></dd><dt><span class="term"><a name="WRITABLE"></a>writable</span></dt><dd><p>This parameter is a synonym for writeable.</p></dd><dt><span class="term"><a name="WRITEABLE"></a>writeable (S)</span></dt><dd><p>Inverted synonym for <a class="indexterm" name="id297449"></a>read only.</p><p><span class="emphasis"><em>No default</em></span></p></dd><dt><span class="term"><a name="WRITECACHESIZE"></a>write cache size (S)</span></dt><dd><p>If this integer parameter is set to non-zero value, 4772 4853 Samba will create an in-memory cache for each oplocked file 4773 4854 (it does <span class="emphasis"><em>not</em></span> do this for … … 4790 4871 This is a list of users that are given read-write access to a service. If the 4791 4872 connecting user is in this list then they will be given write access, no matter 4792 what the <a class="indexterm" name="id297 432"></a>read only option is set to. The list can4873 what the <a class="indexterm" name="id297549"></a>read only option is set to. The list can 4793 4874 include group names using the @group syntax. 4794 4875 </p><p> … … 4797 4878 </p><p> 4798 4879 By design, this parameter will not work with the 4799 <a class="indexterm" name="id297 448"></a>security = share in Samba 3.0.4880 <a class="indexterm" name="id297565"></a>security = share in Samba 3.0. 4800 4881 </p><p>Default: <span class="emphasis"><em><em class="parameter"><code>write list</code></em> = 4801 4882 </em></span> … … 4818 4899 </p><p>Example: <span class="emphasis"><em><em class="parameter"><code>wtmp directory</code></em> = /var/log/wtmp 4819 4900 </em></span> 4820 </p></dd></dl></div></div><div class="refsect1" lang="en"><a name="id297 581"></a><h2>WARNINGS</h2><p>4901 </p></dd></dl></div></div><div class="refsect1" lang="en"><a name="id297698"></a><h2>WARNINGS</h2><p> 4821 4902 Although the configuration file permits service names to contain spaces, your client software may not. 4822 4903 Spaces will be ignored in comparisons anyway, so it shouldn't be a problem - but be aware of the possibility. … … 4831 4912 care when designing these sections. In particular, ensure that the permissions on spool directories are 4832 4913 correct. 4833 </p></div><div class="refsect1" lang="en"><a name="id297 624"></a><h2>VERSION</h2><p>This man page is correct for version 3.0 of the Samba suite.</p></div><div class="refsect1" lang="en"><a name="id297635"></a><h2>SEE ALSO</h2><p>4834 <a href="samba.7.html"><span class="citerefentry"><span class="refentrytitle">samba</span>(7)</span></a>, <a href="smbpasswd.8.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(8)</span></a>, <a href="swat.8.html"><span class="citerefentry"><span class="refentrytitle">swat</span>(8)</span></a>, <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>, <a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a>, <a href="smbclient.1.html"><span class="citerefentry"><span class="refentrytitle">smbclient</span>(1)</span></a>, <a href="nmblookup.1.html"><span class="citerefentry"><span class="refentrytitle">nmblookup</span>(1)</span></a>, <a href="testparm.1.html"><span class="citerefentry"><span class="refentrytitle">testparm</span>(1)</span></a>, <a href="testprns.1.html"><span class="citerefentry"><span class="refentrytitle">testprns</span>(1)</span></a>.</p></div><div class="refsect1" lang="en"><a name="id297 714"></a><h2>AUTHOR</h2><p>4914 </p></div><div class="refsect1" lang="en"><a name="id297741"></a><h2>VERSION</h2><p>This man page is correct for version 3.0 of the Samba suite.</p></div><div class="refsect1" lang="en"><a name="id297752"></a><h2>SEE ALSO</h2><p> 4915 <a href="samba.7.html"><span class="citerefentry"><span class="refentrytitle">samba</span>(7)</span></a>, <a href="smbpasswd.8.html"><span class="citerefentry"><span class="refentrytitle">smbpasswd</span>(8)</span></a>, <a href="swat.8.html"><span class="citerefentry"><span class="refentrytitle">swat</span>(8)</span></a>, <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a>, <a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a>, <a href="smbclient.1.html"><span class="citerefentry"><span class="refentrytitle">smbclient</span>(1)</span></a>, <a href="nmblookup.1.html"><span class="citerefentry"><span class="refentrytitle">nmblookup</span>(1)</span></a>, <a href="testparm.1.html"><span class="citerefentry"><span class="refentrytitle">testparm</span>(1)</span></a>, <a href="testprns.1.html"><span class="citerefentry"><span class="refentrytitle">testprns</span>(1)</span></a>.</p></div><div class="refsect1" lang="en"><a name="id297831"></a><h2>AUTHOR</h2><p> 4835 4916 The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed 4836 4917 by the Samba Team as an Open Source project similar to the way the Linux kernel is developed. -
trunk/samba/docs/htmldocs/manpages/smbclient.1.html
r1 r26 148 148 accessing a service that does not require a password. </p><p>Unless a password is specified on the command line or 149 149 this parameter is specified, the client will request a 150 password.</p></dd><dt><span class="term">-k</span></dt><dd><p> 150 password.</p><p>If a password is specified on the command line and this 151 option is also defined the password on the command line will 152 be silently ingnored and no password will be used.</p></dd><dt><span class="term">-k</span></dt><dd><p> 151 153 Try to authenticate with kerberos. Only useful in 152 154 an Active Directory environment. … … 175 177 it in directly. </p></dd><dt><span class="term">-n <primary NetBIOS name></span></dt><dd><p>This option allows you to override 176 178 the NetBIOS name that Samba uses for itself. This is identical 177 to setting the <a class="indexterm" name="id2723 79"></a> parameter in the <code class="filename">smb.conf</code> file.179 to setting the <a class="indexterm" name="id272383"></a> parameter in the <code class="filename">smb.conf</code> file. 178 180 However, a command 179 181 line setting will take precedence over settings in … … 260 262 commands to be executed instead of prompting from stdin. <em class="parameter"><code> 261 263 -N</code></em> is implied by <em class="parameter"><code>-c</code></em>.</p><p>This is particularly useful in scripts and for printing stdin 262 to the server, e.g. <span><strong class="command">-c 'print -'</strong></span>. </p></dd></dl></div></div><div class="refsect1" lang="en"><a name="id27282 3"></a><h2>OPERATIONS</h2><p>Once the client is running, the user is presented with264 to the server, e.g. <span><strong class="command">-c 'print -'</strong></span>. </p></dd></dl></div></div><div class="refsect1" lang="en"><a name="id272828"></a><h2>OPERATIONS</h2><p>Once the client is running, the user is presented with 263 265 a prompt : </p><p><code class="prompt">smb:\> </code></p><p>The backslash ("\\") indicates the current working directory 264 266 on the server, and will change if the current working directory … … 395 397 tar will only back up files with the archive bit set. In reset mode, 396 398 tar will reset the archive bit on all files it backs up (implies 397 read/write share). </p></dd></dl></div></div><div class="refsect1" lang="en"><a name="id273 496"></a><h2>NOTES</h2><p>Some servers are fussy about the case of supplied usernames,399 read/write share). </p></dd></dl></div></div><div class="refsect1" lang="en"><a name="id273570"></a><h2>NOTES</h2><p>Some servers are fussy about the case of supplied usernames, 398 400 passwords, share names (AKA service names) and machine names. 399 401 If you fail to connect try giving all parameters in uppercase. … … 402 404 on a valid NetBIOS name being used, so you need to supply a valid 403 405 name that would be known to the server.</p><p>smbclient supports long file names where the server 404 supports the LANMAN2 protocol or above. </p></div><div class="refsect1" lang="en"><a name="id2735 18"></a><h2>ENVIRONMENT VARIABLES</h2><p>The variable <code class="envar">USER</code> may contain the406 supports the LANMAN2 protocol or above. </p></div><div class="refsect1" lang="en"><a name="id273591"></a><h2>ENVIRONMENT VARIABLES</h2><p>The variable <code class="envar">USER</code> may contain the 405 407 username of the person using the client. This information is 406 408 used only if the protocol level is high enough to support … … 412 414 to instead of connecting to a server. This functionality is primarily 413 415 intended as a development aid, and works best when using a LMHOSTS 414 file</p></div><div class="refsect1" lang="en"><a name="id273 550"></a><h2>INSTALLATION</h2><p>The location of the client program is a matter for416 file</p></div><div class="refsect1" lang="en"><a name="id273624"></a><h2>INSTALLATION</h2><p>The location of the client program is a matter for 415 417 individual system administrators. The following are thus 416 418 suggestions only. </p><p>It is recommended that the smbclient software be installed … … 423 425 running SMB/CIFS server. It is possible to run <a href="smbd.8.html"><span class="citerefentry"><span class="refentrytitle">smbd</span>(8)</span></a> as an ordinary user - running that server as a daemon 424 426 on a user-accessible port (typically any port number over 1024) 425 would provide a suitable test server. </p></div><div class="refsect1" lang="en"><a name="id2736 00"></a><h2>DIAGNOSTICS</h2><p>Most diagnostics issued by the client are logged in a427 would provide a suitable test server. </p></div><div class="refsect1" lang="en"><a name="id273673"></a><h2>DIAGNOSTICS</h2><p>Most diagnostics issued by the client are logged in a 426 428 specified log file. The log file name is specified at compile time, 427 429 but may be overridden on the command line. </p><p>The number and nature of diagnostics available depends 428 430 on the debug level used by the client. If you have problems, 429 set the debug level to 3 and peruse the log files. </p></div><div class="refsect1" lang="en"><a name="id2736 16"></a><h2>VERSION</h2><p>This man page is correct for version 3 of the Samba suite.</p></div><div class="refsect1" lang="en"><a name="id273626"></a><h2>AUTHOR</h2><p>The original Samba software and related utilities431 set the debug level to 3 and peruse the log files. </p></div><div class="refsect1" lang="en"><a name="id273689"></a><h2>VERSION</h2><p>This man page is correct for version 3 of the Samba suite.</p></div><div class="refsect1" lang="en"><a name="id273700"></a><h2>AUTHOR</h2><p>The original Samba software and related utilities 430 432 were created by Andrew Tridgell. Samba is now developed 431 433 by the Samba Team as an Open Source project similar -
trunk/samba/docs/htmldocs/manpages/smbcquotas.1.html
r1 r26 36 36 accessing a service that does not require a password. </p><p>Unless a password is specified on the command line or 37 37 this parameter is specified, the client will request a 38 password.</p></dd><dt><span class="term">-k</span></dt><dd><p> 38 password.</p><p>If a password is specified on the command line and this 39 option is also defined the password on the command line will 40 be silently ingnored and no password will be used.</p></dd><dt><span class="term">-k</span></dt><dd><p> 39 41 Try to authenticate with kerberos. Only useful in 40 42 an Active Directory environment. … … 61 63 via the <span><strong class="command">ps</strong></span> command. To be safe always allow 62 64 <span><strong class="command">rpcclient</strong></span> to prompt for a password and type 63 it in directly. </p></dd></dl></div></div><div class="refsect1" lang="en"><a name="id2717 88"></a><h2>QUOTA_SET_COMAND</h2><p>The format of an the QUOTA_SET_COMMAND is an operation65 it in directly. </p></dd></dl></div></div><div class="refsect1" lang="en"><a name="id271793"></a><h2>QUOTA_SET_COMAND</h2><p>The format of an the QUOTA_SET_COMMAND is an operation 64 66 name followed by a set of parameters specific to that operation. 65 67 </p><p>To set user quotas for the user specified by -u or for the … … 73 75 </p><p><strong class="userinput"><code> 74 76 FSQFLAGS:QUOTA_ENABLED/DENY_DISK/LOG_SOFTLIMIT/LOG_HARD_LIMIT 75 </code></strong></p><p>All limits are specified as a number of bytes.</p></div><div class="refsect1" lang="en"><a name="id2718 36"></a><h2>EXIT STATUS</h2><p>The <span><strong class="command">smbcquotas</strong></span> program sets the exit status77 </code></strong></p><p>All limits are specified as a number of bytes.</p></div><div class="refsect1" lang="en"><a name="id271841"></a><h2>EXIT STATUS</h2><p>The <span><strong class="command">smbcquotas</strong></span> program sets the exit status 76 78 depending on the success or otherwise of the operations performed. 77 79 The exit status may be one of the following values. </p><p>If the operation succeeded, smbcquotas returns an exit … … 79 81 or when there was an error getting or setting the quota(s), an exit status 80 82 of 1 is returned. If there was an error parsing any command line 81 arguments, an exit status of 2 is returned. </p></div><div class="refsect1" lang="en"><a name="id2718 65"></a><h2>VERSION</h2><p>This man page is correct for version 3.0 of the Samba suite.</p></div><div class="refsect1" lang="en"><a name="id271875"></a><h2>AUTHOR</h2><p>The original Samba software and related utilities83 arguments, an exit status of 2 is returned. </p></div><div class="refsect1" lang="en"><a name="id271870"></a><h2>VERSION</h2><p>This man page is correct for version 3.0 of the Samba suite.</p></div><div class="refsect1" lang="en"><a name="id271880"></a><h2>AUTHOR</h2><p>The original Samba software and related utilities 82 84 were created by Andrew Tridgell. Samba is now developed 83 85 by the Samba Team as an Open Source project similar -
trunk/samba/docs/htmldocs/manpages/smbtree.1.html
r1 r26 40 40 accessing a service that does not require a password. </p><p>Unless a password is specified on the command line or 41 41 this parameter is specified, the client will request a 42 password.</p></dd><dt><span class="term">-k</span></dt><dd><p> 42 password.</p><p>If a password is specified on the command line and this 43 option is also defined the password on the command line will 44 be silently ingnored and no password will be used.</p></dd><dt><span class="term">-k</span></dt><dd><p> 43 45 Try to authenticate with kerberos. Only useful in 44 46 an Active Directory environment. … … 66 68 <span><strong class="command">rpcclient</strong></span> to prompt for a password and type 67 69 it in directly. </p></dd><dt><span class="term">-h|--help</span></dt><dd><p>Print a summary of command line options. 68 </p></dd></dl></div></div><div class="refsect1" lang="en"><a name="id2305 36"></a><h2>VERSION</h2><p>This man page is correct for version 3.0 of the Samba69 suite.</p></div><div class="refsect1" lang="en"><a name="id2305 46"></a><h2>AUTHOR</h2><p>The original Samba software and related utilities70 </p></dd></dl></div></div><div class="refsect1" lang="en"><a name="id230540"></a><h2>VERSION</h2><p>This man page is correct for version 3.0 of the Samba 71 suite.</p></div><div class="refsect1" lang="en"><a name="id230550"></a><h2>AUTHOR</h2><p>The original Samba software and related utilities 70 72 were created by Andrew Tridgell. Samba is now developed 71 73 by the Samba Team as an Open Source project similar -
trunk/samba/docs/htmldocs/manpages/vfs_recycle.8.html
r22 r26 41 41 </p></dd><dt><span class="term">recycle:exclude = LIST</span></dt><dd><p>List of files that should not be put into the 42 42 repository when deleted, but deleted in the normal way. 43 Wildcards such as * and ? are supported. 43 44 </p></dd><dt><span class="term">recycle:exclude_dir = LIST</span></dt><dd><p>List of directories whose files should not be put 44 45 into the repository when deleted, but deleted in the 45 normal way. 46 normal way. Wildcards such as * and ? are supported. 46 47 </p></dd><dt><span class="term">recycle:noversions = LIST</span></dt><dd><p>Specifies a list of paths (wildcards such as * 47 48 and ? are supported) for which no versioning should 48 49 be used. Only useful when recycle:versions is enabled. 49 </p></dd></dl></div></div><div class="refsect1" lang="en"><a name="id23152 0"></a><h2>EXAMPLES</h2><p>Log operations on all shares using the LOCAL1 facility50 </p></dd></dl></div></div><div class="refsect1" lang="en"><a name="id231521"></a><h2>EXAMPLES</h2><p>Log operations on all shares using the LOCAL1 facility 50 51 and NOTICE priority:</p><pre class="programlisting"> 51 52 <em class="parameter"><code>[global]</code></em> 52 <a class="indexterm" name="id2315 39"></a>vfs objects = recycle53 <a class="indexterm" name="id23049 3"></a>recycle:facility = LOCAL154 <a class="indexterm" name="id23050 0"></a>recycle:priority = NOTICE53 <a class="indexterm" name="id231540"></a>vfs objects = recycle 54 <a class="indexterm" name="id230494"></a>recycle:facility = LOCAL1 55 <a class="indexterm" name="id230501"></a>recycle:priority = NOTICE 55 56 </pre></div><div class="refsect1" lang="en"><a name="id230510"></a><h2>VERSION</h2><p>This man page is correct for version 3.0.25 of the Samba suite. 56 </p></div><div class="refsect1" lang="en"><a name="id23052 0"></a><h2>AUTHOR</h2><p>The original Samba software and related utilities57 </p></div><div class="refsect1" lang="en"><a name="id230521"></a><h2>AUTHOR</h2><p>The original Samba software and related utilities 57 58 were created by Andrew Tridgell. Samba is now developed 58 59 by the Samba Team as an Open Source project similar
Note: See TracChangeset
for help on using the changeset viewer.
