SMB.CONF(5) SMB.CONF(5)
NAME
smb.conf - The configuration file for the Samba suite
SYNOPSIS
The smb.conf file is a configuration file for the Samba suite. smb.conf contains
runtime configuration information for the Samba programs. Thesmb.conf file is
designed to be configured and administered by theswat(8) program. The complete
description of the file format and possible parameters held within are here for
reference purposes.
FILE FORMAT
The file consists of sections and parameters. A section begins with the name of the
section in square brackets and continues until the next section begins. Sections
contain parameters of the form:
name = value
The file is line-based - that is, each newline-terminated line represents either a
comment, a section name or a parameter.
Section and parameter names are not case sensitive.
Only the first equals sign in a parameter is significant. Whitespace before or
after the first equals sign is discarded. Leading, trailing and internal whitespace
in section and parameter names is irrelevant. Leading and trailing whitespace in a
parameter value is discarded. Internal whitespace within a parameter value is
retained verbatim.
Any line beginning with a semicolon (‘‘;’’) or a hash (‘‘#’’) character is ignored,
as are lines containing only whitespace.
Any line ending in a ‘‘\’’ is continued on the next line in the customary UNIX
fashion.
The values following the equals sign in parameters are all either a string (no
quotes needed) or a boolean, which may be given as yes/no, 0/1 or true/false. Case
is not significant in boolean values, but is preserved in string values. Some items
such as create masks are numeric.
SECTION DESCRIPTIONS
Each section in the configuration file (except for the [global] section) describes
a shared resource (known as a ‘‘share’’). The section name is the name of the
shared resource and the parameters within the section define the shares attributes.
There are three special sections, [global], [homes] and [printers], which are
described underspecial sections. The following notes apply to ordinary section
descriptions.
A share consists of a directory to which access is being given plus a description
of the access rights which are granted to the user of the service. Some housekeep-
ing options are also specifiable.
Sections are either file share services (used by the client as an extension of
their native file systems) or printable services (used by the client to access
print services on the host running the server).
Sections may be designated guest services, in which case no password is required to
access them. A specified UNIX guest account is used to define access privileges in
this case.
Sections other than guest services will require a password to access them. The
client provides the username. As older clients only provide passwords and not user-
names, you may specify a list of usernames to check against the password using the
user = option in the share definition. For modern clients such as Windows
95/98/ME/NT/2000, this should not be necessary.
The access rights granted by the server are masked by the access rights granted to
the specified or guest UNIX user by the host system. The server does not grant more
access than the host system grants.
The following sample section defines a file space share. The user has write access
to the path /home/bar. The share is accessed via the share name foo:
[foo]
path = /home/bar
read only = no
The following sample section defines a printable share. The share is read-only, but
printable. That is, the only write access permitted is via calls to open, write to
and close a spool file. The guest ok parameter means access will be permitted as
the default guest user (specified elsewhere):
[aprinter]
path = /usr/spool/public
read only = yes
printable = yes
guest ok = yes
SPECIAL SECTIONS
The [global] section
Parameters in this section apply to the server as a whole, or are defaults for sec-
tions that do not specifically define certain items. See the notes under PARAMETERS
for more information.
The [homes] section
If a section called [homes] is included in the configuration file, services con-
necting clients to their home directories can be created on the fly by the server.
When the connection request is made, the existing sections are scanned. If a match
is found, it is used. If no match is found, the requested section name is treated
as a username and looked up in the local password file. If the name exists and the
correct password has been given, a share is created by cloning the [homes] section.
Some modifications are then made to the newly created share:
· The share name is changed from homes to the located username.
· If no path was given, the path is set to the user’s home directory.
If you decide to use a path = line in your [homes] section, it may be useful to use
the %S macro. For example:
path = /data/pchome/%S
is useful if you have different home directories for your PCs than for UNIX
access.
This is a fast and simple way to give a large number of clients access to their
home directories with a minimum of fuss.
A similar process occurs if the requested section name is ‘‘homes’’, except that
the share name is not changed to that of the requesting user. This method of using
the [homes] section works well if different users share a client PC.
The [homes] section can specify all the parameters a normal service section can
specify, though some make more sense than others. The following is a typical and
suitable [homes] section:
[homes]
read only = no
An important point is that if guest access is specified in the [homes] section, all
home directories will be visible to all clients without a password. In the very
unlikely event that this is actually desirable, it is wise to also specify read
only access.
The browseable flag for auto home directories will be inherited from the global
browseable flag, not the [homes] browseable flag. This is useful as it means set-
ting browseable = no in the [homes] section will hide the [homes] share but make
any auto home directories visible.
The [printers] section
This section works like [homes], but for printers.
If a [printers] section occurs in the configuration file, users are able to connect
to any printer specified in the local host’s printcap file.
When a connection request is made, the existing sections are scanned. If a match is
found, it is used. If no match is found, but a [homes] section exists, it is used
as described above. Otherwise, the requested section name is treated as a printer
name and the appropriate printcap file is scanned to see if the requested section
name is a valid printer share name. If a match is found, a new printer share is
created by cloning the [printers] section.
A few modifications are then made to the newly created share:
· The share name is set to the located printer name
· If no printer name was given, the printer name is set to the located printer
name
· If the share does not permit guest access and no username was given, the user-
name is set to the located printer name.
The [printers] service MUST be printable - if you specify otherwise, the server
will refuse to load the configuration file.
Typically the path specified is that of a world-writeable spool directory with the
sticky bit set on it. A typical [printers] entry looks like this:
[printers]
path = /usr/spool/public
guest ok = yes
printable = yes
All aliases given for a printer in the printcap file are legitimate printer names
as far as the server is concerned. If your printing subsystem doesn’t work like
that, you will have to set up a pseudo-printcap. This is a file consisting of one
or more lines like this:
alias|alias|alias|alias...
Each alias should be an acceptable printer name for your printing subsystem. In the
[global] section, specify the new file as your printcap. The server will only rec-
ognize names found in your pseudo-printcap, which of course can contain whatever
aliases you like. The same technique could be used simply to limit access to a sub-
set of your local printers.
An alias, by the way, is defined as any component of the first entry of a printcap
record. Records are separated by newlines, components (if there are more than one)
are separated by vertical bar symbols (|).
Note
On SYSV systems which use lpstat to determine what printers are defined on
the system you may be able to useprintcap name = lpstat to automatically
obtain a list of printers. See theprintcap name option for more details.
USERSHARES
Starting with Samba version 3.0.23 the capability for non-root users to add, mod-
ify, and delete their own share definitions has been added. This capability is
called usershares and is controlled by a set of parameters in the section of the
smb.conf. The relevant parameters are :
usershare allow guests
Controls if usershares can permit guest access.
usershare max shares
Maximum number of user defined shares allowed.
usershare owner only
If set only directories owned by the sharing user can be shared.
usershare path
Points to the directory containing the user defined share definitions. The
filesystem permissions on this directory control who can create user defined
shares.
usershare prefix allow list
Comma-separated list of abolute pathnames restricting what directories can
be shared. Only directories below the pathnames in this list are permitted.
usershare prefix deny list
Comma-separated list of abolute pathnames restricting what directories can
be shared. Directories below the pathnames in this list are prohibited.
usershare template share
Names a pre-existing share used as a template for creating new usershares.
All other share parameters not specified in the user defined share defini-
tion are copied from this named share.
To allow members of the UNIX group foo to create user defined shares, create the
directory to contain the share definitions as follows:
Become root:
mkdir /usr/local/samba/lib/usershares
chgrp foo /usr/local/samba/lib/usershares
chmod 1770 /usr/local/samba/lib/usershares
Then add the parameters
usershare path = /usr/local/samba/lib/usershares
usershare max shares = 10 # (or the desired number of shares)
to the global section of your smb.conf. Members of the group foo may then manipu-
late the user defined shares using the following commands.
net usershare add sharename path [comment] [acl] [guest_ok=[y|n]]
To create or modify (overwrite) a user defined share.
net usershare delete sharename
To delete a user defined share.
net usershare list wildcard-sharename
To list user defined shares.
net usershare info wildcard-sharename
To print information about user defined shares.
PARAMETERS
Parameters define the specific attributes of sections.
Some parameters are specific to the [global] section (e.g., security). Some
parameters are usable in all sections (e.g., create mask). All others are permissi-
ble only in normal sections. For the purposes of the following descriptions the
[homes] and [printers] sections will be considered normal. The letter G in paren-
theses indicates that a parameter is specific to the [global] section. The letter S
indicates that a parameter can be specified in a service specific section. All S
parameters can also be specified in the [global] section - in which case they will
define the default behavior for all services.
Parameters are arranged here in alphabetical order - this may not create best bed-
fellows, but at least you can find them! Where there are synonyms, the preferred
synonym is described, others refer to the preferred synonym.
VARIABLE SUBSTITUTIONS
Many of the strings that are settable in the config file can take substitutions.
For example the option‘‘path = /tmp/%u’’ is interpreted as ‘‘path = /tmp/john’’ if
the user connected with the username john.
These substitutions are mostly noted in the descriptions below, but there are some
general substitutions which apply whenever they might be relevant. These are:
%U session username (the username that the client wanted, not necessarily the
same as the one they got).
%G primary group name of %U.
%h the Internet hostname that Samba is running on.
%m the NetBIOS name of the client machine (very useful).
This parameter is not available when Samba listens on port 445, as clients
no longer send this information. If you use this macro in an include state-
ment on a domain that has a Samba domain controller be sure to set in the
[global] section smb ports = 139. This will cause Samba to not listen on
port 445 and will permit include functionality to function as it did with
Samba 2.x.
%L the NetBIOS name of the server. This allows you to change your config based
on what the client calls you. Your server can have a ‘‘dual personality’’.
%M the Internet name of the client machine.
%R the selected protocol level after protocol negotiation. It can be one of
CORE, COREPLUS, LANMAN1, LANMAN2 or NT1.
%d the process id of the current server process.
%a the architecture of the remote machine. It currently recognizes Samba
(Samba), the Linux CIFS file system (CIFSFS), OS/2, (OS2), Windows for Work-
groups (WfWg), Windows 9x/ME (Win95), Windows NT (WinNT), Windows 2000
(Win2K), Windows XP (WinXP), and Windows 2003 (Win2K3). Anything else will
be known asUNKNOWN.
%I the IP address of the client machine.
%i the local IP address to which a client connected.
%T the current date and time.
%D name of the domain or workgroup of the current user.
%w the winbind separator.
%$(envvar)
the value of the environment variableenvar.
The following substitutes apply only to some configuration options (only those that
are used when a connection has been established):
%S the name of the current service, if any.
%P the root directory of the current service, if any.
%u username of the current service, if any.
%g primary group name of %u.
%H the home directory of the user given by %u.
%N the name of your NIS home directory server. This is obtained from your NIS
auto.map entry. If you have not compiled Samba with the --with-automount
option, this value will be the same as %L.
%p the path of the service’s home directory, obtained from your NIS auto.map
entry. The NIS auto.map entry is split up as %N:%p.
There are some quite creative things that can be done with these substitutions and
othersmb.conf options.
NAME MANGLING
Samba supports name mangling so that DOS and Windows clients can use files that
don’t conform to the 8.3 format. It can also be set to adjust the case of 8.3 for-
mat filenames.
There are several options that control the way mangling is performed, and they are
grouped here rather than listed separately. For the defaults look at the output of
the testparm program.
All of these options can be set separately for each service (or globally, of
course).
The options are:
case sensitive = yes/no/auto
controls whether filenames are case sensitive. If they aren’t, Samba must do
a filename search and match on passed names. The default setting of auto
allows clients that support case sensitive filenames (Linux CIFSVFS and smb-
client 3.0.5 and above currently) to tell the Samba server on a per-packet
basis that they wish to access the file system in a case-sensitive manner
(to support UNIX case sensitive semantics). No Windows or DOS system sup-
ports case-sensitive filename so setting this option to auto is that same as
setting it to no for them. Default auto.
default case = upper/lower
controls what the default case is for new filenames (ie. files that don’t
currently exist in the filesystem). Default lower. IMPORTANT NOTE: This
option will be used to modify the case ofall incoming client filenames, not
just new filenames if the options case sensitive = yes, preserve case =
No,short preserve case = No are set. This change is needed as part of the
optimisations for directories containing large numbers of files.
preserve case = yes/no
controls whether new files (ie. files that don’t currently exist in the
filesystem) are created with the case that the client passes, or if they are
forced to be the default case. Defaultyes.
short preserve case = yes/no
controls if new files (ie. files that don’t currently exist in the filesys-
tem) which conform to 8.3 syntax, that is all in upper case and of suitable
length, are created upper case, or if they are forced to be thedefault case.
This option can be used with preserve case = yes to permit long filenames to
retain their case, while short names are lowercased. Default yes.
By default, Samba 3.0 has the same semantics as a Windows NT server, in that it is
case insensitive but case preserving. As a special case for directories with large
numbers of files, if the case options are set as follows, "case sensitive = yes",
"case preserve = no", "short preserve case = no" then the "default case" option
will be applied and will modify all filenames sent from the client when accessing
this share.
NOTE ABOUT USERNAME/PASSWORD VALIDATION
There are a number of ways in which a user can connect to a service. The server
uses the following steps in determining if it will allow a connection to a speci-
fied service. If all the steps fail, the connection request is rejected. However,
if one of the steps succeeds, the following steps are not checked.
If the service is marked ‘‘guest only = yes’’ and the server is running with
share-level security (‘‘security = share’’, steps 1 to 5 are skipped.
1. If the client has passed a username/password pair and that username/password
pair is validated by the UNIX system’s password programs, the connection is made
as that username. This includes the\\server\service%username method of passing a
username.
2. If the client has previously registered a username with the system and now sup-
plies a correct password for that username, the connection is allowed.
3. The client’s NetBIOS name and any previously used usernames are checked against
the supplied password. If they match, the connection is allowed as the corre-
sponding user.
4. If the client has previously validated a username/password pair with the server
and the client has passed the validation token, that username is used.
5. If a user = field is given in the smb.conf file for the service and the client
has supplied a password, and that password matches (according to the UNIX sys-
tem’s password checking) with one of the usernames from the user = field, the
connection is made as the username in the user = line. If one of the usernames
in the user = list begins with a @, that name expands to a list of names in the
group of the same name.
6. If the service is a guest service, a connection is made as the username given in
the guest account = for the service, irrespective of the supplied password.
EXPLANATION OF EACH PARAMETER
abort shutdown script (G)
This a full path name to a script called by smbd(8) that should stop a shut-
down procedure issued by the shutdown script.
If the connected user posseses the SeRemoteShutdownPrivilege, right, this
command will be run as user.
Default: abort shutdown script =
Example: abort shutdown script = /sbin/shutdown -c
acl check permissions (S)
This boolean parameter controls what smbd(8)does on receiving a protocol
request of "open for delete" from a Windows client. If a Windows client
doesn’t have permissions to delete a file then they expect this to be denied
at open time. POSIX systems normally only detect restrictions on delete by
actually attempting to delete the file or directory. As Windows clients can
(and do) "back out" a delete request by unsetting the "delete on close" bit
Samba cannot delete the file immediately on "open for delete" request as we
cannot restore such a deleted file. With this parameter set to true (the
default) then smbd checks the file system permissions directly on "open for
delete" and denies the request without actually deleting the file if the
file system permissions would seem to deny it. This is not perfect, as it’s
possible a user could have deleted a file without Samba being able to check
the permissions correctly, but it is close enough to Windows semantics for
mostly correct behaviour. Samba will correctly check POSIX ACL semantics in
this case.
If this parameter is set to "false" Samba doesn’t check permissions on "open
for delete" and allows the open. If the user doesn’t have permission to
delete the file this will only be discovered at close time, which is too
late for the Windows user tools to display an error message to the user. The
symptom of this is files that appear to have been deleted "magically"
re-appearing on a Windows explorer refersh. This is an extremely advanced
protocol option which should not need to be changed. This parameter was
introduced in its final form in 3.0.21, an earlier version with slightly
different semantics was introduced in 3.0.20. That older version is not doc-
umented here.
Default: acl check permissions = True
acl compatibility (S)
This parameter specifies what OS ACL semantics should be compatible with.
Possible values are winnt for Windows NT 4,win2k for Windows 2000 and above
and auto. If you specify auto, the value for this parameter will be based
upon the version of the client. There should be no reason to change this
parameter from the default.
Default: acl compatibility = Auto
Example: acl compatibility = win2k
acl group control (S)
In a POSIX filesystem, only the owner of a file or directory and the supe-
ruser can modify the permissions and ACLs on a file. If this parameter is
set, then Samba overrides this restriction, and also allows theprimary group
owner of a file or directory to modify the permissions and ACLs on that
file.
On a Windows server, groups may be the owner of a file or directory - thus
allowing anyone in that group to modify the permissions on it. This allows
the delegation of security controls on a point in the filesystem to the
group owner of a directory and anything below it also owned by that group.
This means there are multiple people with permissions to modify ACLs on a
file or directory, easing managability.
This parameter allows Samba to also permit delegation of the control over a
point in the exported directory hierarchy in much the same was as Windows.
This allows all members of a UNIX group to control the permissions on a file
or directory they have group ownership on.
This parameter is best used with the inherit owner option and also on on a
share containing directories with the UNIX setgid bit bit set on them, which
causes new files and directories created within it to inherit the group own-
ership from the containing directory.
This is parameter has been marked deprecated in Samba 3.0.23. The same
behavior is now implemented by the dos filemode option.
Default: acl group control = no
acl map full control (S)
This boolean parameter controls whether smbd(8)maps a POSIX ACE entry of
"rwx" (read/write/execute), the maximum allowed POSIX permission set, into a
Windows ACL of "FULL CONTROL". If this parameter is set to true any POSIX
ACE entry of "rwx" will be returned in a Windows ACL as "FULL CONTROL", is
this parameter is set to false any POSIX ACE entry of "rwx" will be returned
as the specific Windows ACL bits representing read, write and execute.
Default: acl map full control = True
add group script (G)
This is the full pathname to a script that will be runAS ROOT by smbd(8)
when a new group is requested. It will expand any %g to the group name
passed. This script is only useful for installations using the Windows NT
domain administration tools. The script is free to create a group with an
arbitrary name to circumvent unix group name restrictions. In that case the
script must print the numeric gid of the created group on stdout.
No default
add machine script (G)
This is the full pathname to a script that will be run bysmbd(8) when a
machine is added to it’s domain using the administrator username and pass-
word method.
This option is only required when using sam back-ends tied to the Unix uid
method of RID calculation such as smbpasswd. This option is only available
in Samba 3.0.
Default: add machine script =
Example: add machine script = /usr/sbin/adduser -n -g machines -c Machine -d
/var/lib/nobody -s /bin/false %u
add port command (G)
Samba 3.0.23 introduces support for adding printer ports remotely using the
Windows "Add Standard TCP/IP Port Wizard". This option defines an external
program to be executed when smbd receives a request to add a new Port to the
system. he script is passed two parameters:
· port name
· device URI
The deviceURI is in the for of socket://<hostname>[:<portnumber>] or
lpd://<hostname>/<queuename>.
Default: add port command =
Example: add port command = /etc/samba/scripts/addport.sh
add printer command (G)
With the introduction of MS-RPC based printing support for Windows NT/2000
clients in Samba 2.2, The MS Add Printer Wizard (APW) icon is now also
available in the "Printers..." folder displayed a share listing. The APW
allows for printers to be add remotely to a Samba or Windows NT/2000 print
server.
For a Samba host this means that the printer must be physically added to the
underlying printing system. The add printer command defines a script to be
run which will perform the necessary operations for adding the printer to
the print system and to add the appropriate service definition to the
smb.conf file in order that it can be shared by smbd(8).
The addprinter command is automatically invoked with the following parameter
(in order):
· printer name
· share name
· port name
· driver name
· location
· Windows 9x driver location
All parameters are filled in from the PRINTER_INFO_2 structure sent by the
Windows NT/2000 client with one exception. The "Windows 9x driver location"
parameter is included for backwards compatibility only. The remaining fields
in the structure are generated from answers to the APW questions.
Once the addprinter command has been executed, smbd will reparse the
smb.conf to determine if the share defined by the APW exists. If the share-
name is still invalid, then smbd will return an ACCESS_DENIED error to the
client.
The "add printer command" program can output a single line of text, which
Samba will set as the port the new printer is connected to. If this line
isn’t output, Samba won’t reload its printer shares.
Default: add printer command =
Example: add printer command = /usr/bin/addprinter
add share command (G)
Samba 2.2.0 introduced the ability to dynamically add and delete shares via
the Windows NT 4.0 Server Manager. Theadd share command is used to define an
external program or script which will add a new service definition to
smb.conf. In order to successfully execute the add share command, smbd
requires that the administrator be connected using a root account (i.e. uid
== 0).
When executed, smbd will automatically invoke theadd share command with five
parameters.
· configFile - the location of the global smb.conf file.
· shareName - the name of the new share.
· pathName - path to an **existing** directory on disk.
· comment - comment string to associate with the new share.
· max connections Number of maximum simultaneous connections to this share.
This parameter is only used for add file shares. To add printer shares, see
the addprinter command.
Default: add share command =
Example: add share command = /usr/local/bin/addshare
add user script (G)
This is the full pathname to a script that will be run AS ROOT bysmbd(8)
under special circumstances described below.
Normally, a Samba server requires that UNIX users are created for all users
accessing files on this server. For sites that use Windows NT account
databases as their primary user database creating these users and keeping
the user list in sync with the Windows NT PDC is an onerous task. This
option allows smbd to create the required UNIX usersON DEMAND when a user
accesses the Samba server.
In order to use this option, smbd(8) must NOT be set tosecurity = share and
add user script must be set to a full pathname for a script that will create
a UNIX user given one argument of%u, which expands into the UNIX user name
to create.
When the Windows user attempts to access the Samba server, at login (session
setup in the SMB protocol) time, smbd(8) contacts the password server and
attempts to authenticate the given user with the given password. If the
authentication succeeds then smbd attempts to find a UNIX user in the UNIX
password database to map the Windows user into. If this lookup fails, andadd
user script is set then smbd will call the specified script AS ROOT, expand-
ing any%u argument to be the user name to create.
If this script successfully creates the user then smbd will continue on as
though the UNIX user already existed. In this way, UNIX users are dynami-
cally created to match existing Windows NT accounts.
See also security, password server,delete user script.
Default: add user script =
Example: add user script = /usr/local/samba/bin/add_user %u
add user to group script (G)
Full path to the script that will be called when a user is added to a group
using the Windows NT domain administration tools. It will be run by smbd(8)
AS ROOT. Any %g will be replaced with the group name and any %u will be
replaced with the user name.
Note that the adduser command used in the example below does not support the
used syntax on all systems.
Default: add user to group script =
Example: add user to group script = /usr/sbin/adduser %u %g
admin users (S)
This is a list of users who will be granted administrative privileges on the
share. This means that they will do all file operations as the super-user
(root).
You should use this option very carefully, as any user in this list will be
able to do anything they like on the share, irrespective of file permis-
sions.
This parameter will not work with the security = share in Samba 3.0. This is
by design.
Default: admin users =
Example: admin users = jason
afs share (S)
This parameter controls whether special AFS features are enabled for this
share. If enabled, it assumes that the directory exported via the path
parameter is a local AFS import. The special AFS features include the
attempt to hand-craft an AFS token if you enabled --with-fake-kaserver in
configure.
Default: afs share = no
afs username map (G)
If you are using the fake kaserver AFS feature, you might want to hand-craft
the usernames you are creating tokens for. For example this is necessary if
you have users from several domain in your AFS Protection Database. One pos-
sible scheme to code users as DOMAIN+User as it is done by winbind with the
+ as a separator.
The mapped user name must contain the cell name to log into, so without set-
ting this parameter there will be no token.
Default: afs username map =
Example: afs username map = %u AT afs.org
algorithmic rid base (G)
This determines how Samba will use its algorithmic mapping from uids/gid to
the RIDs needed to construct NT Security Identifiers.
Setting this option to a larger value could be useful to sites transitioning
from WinNT and Win2k, as existing user and group rids would otherwise clash
with sytem users etc.
All UIDs and GIDs must be able to be resolved into SIDs for the correct
operation of ACLs on the server. As such the algorithmic mapping can’t be
’turned off’, but pushing it ’out of the way’ should resolve the issues.
Users and groups can then be assigned ’low’ RIDs in arbitary-rid supporting
backends.
Default: algorithmic rid base = 1000
Example: algorithmic rid base = 100000
allocation roundup size (S)
This parameter allows an administrator to tune the allocation size reported
to Windows clients. The default size of 1Mb generally results in improved
Windows client performance. However, rounding the allocation size may cause
difficulties for some applications, e.g. MS Visual Studio. If the MS Visual
Studio compiler starts to crash with an internal error, set this parameter
to zero for this share.
The integer parameter specifies the roundup size in bytes.
Default: allocation roundup size = 1048576
Example: allocation roundup size = 0 # (to disable roundups)
allow trusted domains (G)
This option only takes effect when the security option is set to
server,domain or ads. If it is set to no, then attempts to connect to a
resource from a domain or workgroup other than the one which smbd is running
in will fail, even if that domain is trusted by the remote server doing the
authentication.
This is useful if you only want your Samba server to serve resources to
users in the domain it is a member of. As an example, suppose that there are
two domains DOMA and DOMB. DOMB is trusted by DOMA, which contains the Samba
server. Under normal circumstances, a user with an account in DOMB can then
access the resources of a UNIX account with the same account name on the
Samba server even if they do not have an account in DOMA. This can make
implementing a security boundary difficult.
Default: allow trusted domains = yes
announce as (G)
This specifies what type of server nmbd(8) will announce itself as, to a
network neighborhood browse list. By default this is set to Windows NT. The
valid options are : "NT Server" (which can also be written as "NT"), "NT
Workstation", "Win95" or "WfW" meaning Windows NT Server, Windows NT Work-
station, Windows 95 and Windows for Workgroups respectively. Do not change
this parameter unless you have a specific need to stop Samba appearing as an
NT server as this may prevent Samba servers from participating as browser
servers correctly.
Default: announce as = NT Server
Example: announce as = Win95
announce version (G)
This specifies the major and minor version numbers that nmbd will use when
announcing itself as a server. The default is 4.9. Do not change this param-
eter unless you have a specific need to set a Samba server to be a downlevel
server.
Default: announce version = 4.9
Example: announce version = 2.0
auth methods (G)
This option allows the administrator to chose what authentication methods
smbd will use when authenticating a user. This option defaults to sensible
values based on security. This should be considered a developer option and
used only in rare circumstances. In the majority (if not all) of production
servers, the default setting should be adequate.
Each entry in the list attempts to authenticate the user in turn, until the
user authenticates. In practice only one method will ever actually be able
to complete the authentication.
Possible options include guest (anonymous access), sam (lookups in local
list of accounts based on netbios name or domain name), winbind (relay
authentication requests for remote users through winbindd), ntdomain
(pre-winbindd method of authentication for remote domain users; deprecated
in favour of winbind method), trustdomain (authenticate trusted users by
contacting the remote DC directly from smbd; deprecated in favour of winbind
method).
Default: auth methods =
Example: auth methods = guest sam winbind
available (S)
This parameter lets you "turn off" a service. Ifavailable = no, then ALL
attempts to connect to the service will fail. Such failures are logged.
Default: available = yes
bind interfaces only (G)
This global parameter allows the Samba admin to limit what interfaces on a
machine will serve SMB requests. It affects file service smbd(8) and name
service nmbd(8) in a slightly different ways.
For name service it causes nmbd to bind to ports 137 and 138 on the inter-
faces listed in the interfaces parameter. nmbd also binds to the "all
addresses" interface (0.0.0.0) on ports 137 and 138 for the purposes of
reading broadcast messages. If this option is not set then nmbd will service
name requests on all of these sockets. If bind interfaces only is set thenn-
mbd will check the source address of any packets coming in on the broadcast
sockets and discard any that don’t match the broadcast addresses of the
interfaces in theinterfaces parameter list. As unicast packets are received
on the other sockets it allows nmbd to refuse to serve names to machines
that send packets that arrive through any interfaces not listed in the
interfaces list. IP Source address spoofing does defeat this simple check,
however, so it must not be used seriously as a security feature fornmbd.
For file service it causes smbd(8) to bind only to the interface list given
in the interfaces parameter. This restricts the networks that smbd will
serve to packets coming in those interfaces. Note that you should not use
this parameter for machines that are serving PPP or other intermittent or
non-broadcast network interfaces as it will not cope with non-permanent
interfaces.
If bind interfaces only is set then unless the network address127.0.0.1 is
added to the interfaces parameter listsmbpasswd(8) andswat(8) may not work
as expected due to the reasons covered below.
To change a users SMB password, the smbpasswd by default connects to
thelocalhost - 127.0.0.1 address as an SMB client to issue the password
change request. Ifbind interfaces only is set then unless the network
address127.0.0.1 is added to the interfaces parameter list then smbpasswd
will fail to connect in it’s default mode. smbpasswd can be forced to use
the primary IP interface of the local host by using its smbpasswd(8)-r
remote machine parameter, with remote machine set to the IP name of the pri-
mary interface of the local host.
The swat status page tries to connect with smbd and nmbd at the
address127.0.0.1 to determine if they are running. Not adding 127.0.0.1 will
cause smbd and nmbd to always show "not running" even if they really are.
This can prevent swat from starting/stopping/restarting smbd and nmbd.
Default: bind interfaces only = no
blocking locks (S)
This parameter controls the behavior of smbd(8) when given a request by a
client to obtain a byte range lock on a region of an open file, and the
request has a time limit associated with it.
If this parameter is set and the lock range requested cannot be immediately
satisfied, samba will internally queue the lock request, and periodically
attempt to obtain the lock until the timeout period expires.
If this parameter is set to no, then samba will behave as previous versions
of Samba would and will fail the lock request immediately if the lock range
cannot be obtained.
Default: blocking locks = yes
block size (S)
This parameter controls the behavior of smbd(8) when reporting disk free
sizes. By default, this reports a disk block size of 1024 bytes.
Changing this parameter may have some effect on the efficiency of client
writes, this is not yet confirmed. This parameter was added to allow
advanced administrators to change it (usually to a higher value) and test
the effect it has on client write performance without re-compiling the code.
As this is an experimental option it may be removed in a future release.
Changing this option does not change the disk free reporting size, just the
block size unit reported to the client.
Default: block size = 1024
Example: block size = 4096
browsable
This parameter is a synonym for browseable.
browseable (S)
This controls whether this share is seen in the list of available shares in
a net view and in the browse list.
Default: browseable = yes
browse list (G)
This controls whether smbd(8) will serve a browse list to a client doing a
NetServerEnum call. Normally set to yes. You should never need to change
this.
Default: browse list = yes
casesignames
This parameter is a synonym for case sensitive.
case sensitive (S)
See the discussion in the section name mangling.
Default: case sensitive = no
change notify timeout (S)
This SMB allows a client to tell a server to "watch" a particular directory
for any changes and only reply to the SMB request when a change has
occurred. Such constant scanning of a directory is expensive under UNIX,
hence an smbd(8) daemon only performs such a scan on each requested direc-
tory once every change notify timeout seconds. Note that in 3.0.23 this has
been changed to a per-share parameter and setting this to zero prevents any
change notify directory scans completely on a share. This is to allow this
paramter to be set to zero on shares configured for very large directories,
where a Windows client will re-scan the entire directory after every delete
operation (when deleting many files) due to the change notify triggering.
This is an extremely expensive operation on some systems.
Default: change notify timeout = 60
Example: change notify timeout = 300 # Would change the scan time to every 5
minutes.
change share command (G)
Samba 2.2.0 introduced the ability to dynamically add and delete shares via
the Windows NT 4.0 Server Manager. Thechange share command is used to define
an external program or script which will modify an existing service defini-
tion in smb.conf. In order to successfully execute the change share command,
smbd requires that the administrator be connected using a root account (i.e.
uid == 0).
When executed, smbd will automatically invoke thechange share command with
five parameters.
· configFile - the location of the global smb.conf file.
· shareName - the name of the new share.
· pathName - path to an **existing** directory on disk.
· comment - comment string to associate with the new share.
· max connections Number of maximum simultaneous connections to this share.
This parameter is only used modify existing file shares definitions. To mod-
ify printer shares, use the "Printers..." folder as seen when browsing the
Samba host.
Default: change share command =
Example: change share command = /usr/local/bin/addshare
check password script (G)
The name of a program that can be used to check password complexity. The
password is sent to the program’s standrad input.
The program must return 0 on good password any other value otherwise. In
case the password is considered weak (the program do not return 0) the user
will be notified and the password change will fail.
Note: In the example directory there is a sample program called crackcheck
that uses cracklib to checkpassword quality
.
Default: check password script = Disabled
Example: check password script = check password script =
/usr/local/sbin/crackcheck
client lanman auth (G)
This parameter determines whether or not smbclient(8) and other samba client
tools will attempt to authenticate itself to servers using the weaker LANMAN
password hash. If disabled, only server which support NT password hashes
(e.g. Windows NT/2000, Samba, etc... but not Windows 95/98) will be able to
be connected from the Samba client.
The LANMAN encrypted response is easily broken, due to it’s case-insensitive
nature, and the choice of algorithm. Clients without Windows 95/98 servers
are advised to disable this option.
Disabling this option will also disable the client plaintext auth option
Likewise, if the client ntlmv2 auth parameter is enabled, then only NTLMv2
logins will be attempted.
Default: client lanman auth = yes
client ntlmv2 auth (G)
This parameter determines whether or not smbclient(8) will attempt to
authenticate itself to servers using the NTLMv2 encrypted password response.
If enabled, only an NTLMv2 and LMv2 response (both much more secure than
earlier versions) will be sent. Many servers (including NT4 < SP4, Win9x and
Samba 2.2) are not compatible with NTLMv2.
Similarly, if enabled, NTLMv1, client lanman auth and client plaintext auth
authentication will be disabled. This also disables share-level authentica-
tion.
If disabled, an NTLM response (and possibly a LANMAN response) will be sent
by the client, depending on the value of client lanman auth.
Note that some sites (particularly those following ’best practice’ security
polices) only allow NTLMv2 responses, and not the weaker LM or NTLM.
Default: client ntlmv2 auth = no
client plaintext auth (G)
Specifies whether a client should send a plaintext password if the server
does not support encrypted passwords.
Default: client plaintext auth = yes
client schannel (G)
This controls whether the client offers or even demands the use of the netl-
ogon schannel. client schannel = no does not offer the schannel, client
schannel = auto offers the schannel but does not enforce it, and client
schannel = yes denies access if the server is not able to speak netlogon
schannel.
Default: client schannel = auto
Example: client schannel = yes
client signing (G)
This controls whether the client offers or requires the server it talks to
to use SMB signing. Possible values are auto, mandatory and disabled.
When set to auto, SMB signing is offered, but not enforced. When set to
mandatory, SMB signing is required and if set to disabled, SMB signing is
not offered either.
Default: client signing = auto
client use spnego (G)
This variable controls whether Samba clients will try to use Simple and Pro-
tected NEGOciation (as specified by rfc2478) with supporting servers
(including WindowsXP, Windows2000 and Samba 3.0) to agree upon an authenti-
cation mechanism. This enables Kerberos authentication in particular.
Default: client use spnego = yes
comment (S)
This is a text field that is seen next to a share when a client does a
queries the server, either via the network neighborhood or via net view to
list what shares are available.
If you want to set the string that is displayed next to the machine name
then see the server string parameter.
Default: comment = # No comment
Example: comment = Fred’s Files
config file (G)
This allows you to override the config file to use, instead of the default
(usually smb.conf). There is a chicken and egg problem here as this option
is set in the config file!
For this reason, if the name of the config file has changed when the parame-
ters are loaded then it will reload them from the new config file.
This option takes the usual substitutions, which can be very useful.
If the config file doesn’t exist then it won’t be loaded (allowing you to
special case the config files of just a few clients).
No default
Example: config file = /usr/local/samba/lib/smb.conf.%m
copy (S)
This parameter allows you to "clone" service entries. The specified service
is simply duplicated under the current service’s name. Any parameters speci-
fied in the current section will override those in the section being copied.
This feature lets you set up a ’template’ service and create similar ser-
vices easily. Note that the service being copied must occur earlier in the
configuration file than the service doing the copying.
Default: copy =
Example: copy = otherservice
create mode
This parameter is a synonym for create mask.
create mask (S)
When a file is created, the necessary permissions are calculated according
to the mapping from DOS modes to UNIX permissions, and the resulting UNIX
mode is then bit-wise ’AND’ed with this parameter. This parameter may be
thought of as a bit-wise MASK for the UNIX modes of a file. Any bit not set
here will be removed from the modes set on a file when it is created.
The default value of this parameter removes the group and other write and
execute bits from the UNIX modes.
Following this Samba will bit-wise ’OR’ the UNIX mode created from this
parameter with the value of theforce create mode parameter which is set to
000 by default.
This parameter does not affect directory masks. See the parameter directory
mask for details.
Note that this parameter does not apply to permissions set by Windows
NT/2000 ACL editors. If the administrator wishes to enforce a mask on access
control lists also, they need to set the security mask.
Default: create mask = 0744
Example: create mask = 0775
csc policy (S)
This stands for client-side caching policy, and specifies how clients capa-
ble of offline caching will cache the files in the share. The valid values
are: manual, documents, programs, disable.
These values correspond to those used on Windows servers.
For example, shares containing roaming profiles can have offline caching
disabled usingcsc policy = disable.
Default: csc policy = manual
Example: csc policy = programs
cups options (S)
This parameter is only applicable if printing is set to cups. Its value is a
free form string of options passed directly to the cups library.
You can pass any generic print option known to CUPS (as listed in the CUPS
"Software Users’ Manual"). You can also pass any printer specific option (as
listed in "lpoptions -d printername -l") valid for the target queue.
You should set this parameter to raw if your CUPS server error_log file con-
tains messages such as "Unsupported format ’application/octet-stream’" when
printing from a Windows client through Samba. It is no longer necessary to
enable system wide raw printing in /etc/cups/mime.{convs,types}.
Default: cups options = ""
Example: cups options = "raw,media=a4,job-sheets=secret,secret"
cups server (G)
This parameter is only applicable if printing is set to cups.
If set, this option overrides the ServerName option in the CUPS client.conf.
This is necessary if you have virtual samba servers that connect to differ-
ent CUPS daemons.
Default: cups server = ""
Example: cups server = MYCUPSSERVER
deadtime (G)
The value of the parameter (a decimal integer) represents the number of min-
utes of inactivity before a connection is considered dead, and it is discon-
nected. The deadtime only takes effect if the number of open files is zero.
This is useful to stop a server’s resources being exhausted by a large num-
ber of inactive connections.
Most clients have an auto-reconnect feature when a connection is broken so
in most cases this parameter should be transparent to users.
Using this parameter with a timeout of a few minutes is recommended for most
systems.
A deadtime of zero indicates that no auto-disconnection should be performed.
Default: deadtime = 0
Example: deadtime = 15
debug hires timestamp (G)
Sometimes the timestamps in the log messages are needed with a resolution of
higher that seconds, this boolean parameter adds microsecond resolution to
the timestamp message header when turned on.
Note that the parameter debug timestamp must be on for this to have an
effect.
Default: debug hires timestamp = no
debug pid (G)
When using only one log file for more then one forked smbd(8)-process there
may be hard to follow which process outputs which message. This boolean
parameter is adds the process-id to the timestamp message headers in the
logfile when turned on.
Note that the parameter debug timestamp must be on for this to have an
effect.
Default: debug pid = no
timestamp logs
This parameter is a synonym for debug timestamp.
debug timestamp (G)
Samba debug log messages are timestamped by default. If you are running at a
high debug level these timestamps can be distracting. This boolean parameter
allows timestamping to be turned off.
Default: debug timestamp = yes
debug uid (G)
Samba is sometimes run as root and sometime run as the connected user, this
boolean parameter inserts the current euid, egid, uid and gid to the times-
tamp message headers in the log file if turned on.
Note that the parameter debug timestamp must be on for this to have an
effect.
Default: debug uid = no
default case (S)
See the section on name mangling . Also note the short preserve case parame-
ter.
Default: default case = lower
default devmode (S)
This parameter is only applicable to printable services. When smbd is serv-
ing Printer Drivers to Windows NT/2k/XP clients, each printer on the Samba
server has a Device Mode which defines things such as paper size and orien-
tation and duplex settings. The device mode can only correctly be generated
by the printer driver itself (which can only be executed on a Win32 plat-
form). Because smbd is unable to execute the driver code to generate the
device mode, the default behavior is to set this field to NULL.
Most problems with serving printer drivers to Windows NT/2k/XP clients can
be traced to a problem with the generated device mode. Certain drivers will
do things such as crashing the client’s Explorer.exe with a NULL devmode.
However, other printer drivers can cause the client’s spooler service
(spoolsv.exe) to die if the devmode was not created by the driver itself
(i.e. smbd generates a default devmode).
This parameter should be used with care and tested with the printer driver
in question. It is better to leave the device mode to NULL and let the Win-
dows client set the correct values. Because drivers do not do this all the
time, setting default devmode = yes will instruct smbd to generate a default
one.
For more information on Windows NT/2k printing and Device Modes, see the
MSDN documentation.
Default: default devmode = no
default
This parameter is a synonym for default service.
default service (G)
This parameter specifies the name of a service which will be connected to if
the service actually requested cannot be found. Note that the square brack-
ets are NOT given in the parameter value (see example below).
There is no default value for this parameter. If this parameter is not
given, attempting to connect to a nonexistent service results in an error.
Typically the default service would be a guest ok, read-only service.
Also note that the apparent service name will be changed to equal that of
the requested service, this is very useful as it allows you to use macros
like %S to make a wildcard service.
Note also that any "_" characters in the name of the service used in the
default service will get mapped to a "/". This allows for interesting
things.
Default: default service =
Example: default service = pub
defer sharing violations (G)
Windows allows specifying how a file will be shared with other processes
when it is opened. Sharing violations occur when a file is opened by a dif-
ferent process using options that violate the share settings specified by
other processes. This parameter causes smbd to act as a Windows server does,
and defer returning a "sharing violation" error message for up to one sec-
ond, allowing the client to close the file causing the violation in the
meantime.
UNIX by default does not have this behaviour.
There should be no reason to turn off this parameter, as it is designed to
enable Samba to more correctly emulate Windows.
Default: defer sharing violations = True
delete group script (G)
This is the full pathname to a script that will be run AS ROOT smbd(8) when
a group is requested to be deleted. It will expand any %g to the group name
passed. This script is only useful for installations using the Windows NT
domain administration tools.
Default: delete group script =
deleteprinter command (G)
With the introduction of MS-RPC based printer support for Windows NT/2000
clients in Samba 2.2, it is now possible to delete printer at run time by
issuing the DeletePrinter() RPC call.
For a Samba host this means that the printer must be physically deleted from
underlying printing system. The deleteprinter command defines a script to be
run which will perform the necessary operations for removing the printer
from the print system and from smb.conf.
The deleteprinter command is automatically called with only one parameter:
printer name.
Once the deleteprinter command has been executed, smbd will reparse the
smb.conf to associated printer no longer exists. If the sharename is still
valid, then smbd will return an ACCESS_DENIED error to the client.
Default: deleteprinter command =
Example: deleteprinter command = /usr/bin/removeprinter
delete readonly (S)
This parameter allows readonly files to be deleted. This is not normal DOS
semantics, but is allowed by UNIX.
This option may be useful for running applications such as rcs, where UNIX
file ownership prevents changing file permissions, and DOS semantics prevent
deletion of a read only file.
Default: delete readonly = no
delete share command (G)
Samba 2.2.0 introduced the ability to dynamically add and delete shares via
the Windows NT 4.0 Server Manager. Thedelete share command is used to define
an external program or script which will remove an existing service defini-
tion from smb.conf. In order to successfully execute the delete share com-
mand, smbd requires that the administrator be connected using a root account
(i.e. uid == 0).
When executed, smbd will automatically invoke thedelete share command with
two parameters.
· configFile - the location of the global smb.conf file.
· shareName - the name of the existing service.
This parameter is only used to remove file shares. To delete printer shares,
see the deleteprinter command.
Default: delete share command =
Example: delete share command = /usr/local/bin/delshare
delete user from group script (G)
Full path to the script that will be called when a user is removed from a
group using the Windows NT domain administration tools. It will be run by
smbd(8) AS ROOT. Any %g will be replaced with the group name and any %u
will be replaced with the user name.
Default: delete user from group script =
Example: delete user from group script = /usr/sbin/deluser %u %g
delete user script (G)
This is the full pathname to a script that will be run by smbd(8) when man-
aging users with remote RPC (NT) tools.
This script is called when a remote client removes a user from the server,
normally using ’User Manager for Domains’ orrpcclient.
This script should delete the given UNIX username.
Default: delete user script =
Example: delete user script = /usr/local/samba/bin/del_user %u
delete veto files (S)
This option is used when Samba is attempting to delete a directory that con-
tains one or more vetoed directories (see the veto files option). If this
option is set to no (the default) then if a vetoed directory contains any
non-vetoed files or directories then the directory delete will fail. This is
usually what you want.
If this option is set to yes, then Samba will attempt to recursively delete
any files and directories within the vetoed directory. This can be useful
for integration with file serving systems such as NetAtalk which create
meta-files within directories you might normally veto DOS/Windows users from
seeing (e.g. .AppleDouble)
Setting delete veto files = yes allows these directories to be transparently
deleted when the parent directory is deleted (so long as the user has per-
missions to do so).
Default: delete veto files = no
dfree cache time (S)
The dfree cache time should only be used on systems where a problem occurs
with the internal disk space calculations. This has been known to happen
with Ultrix, but may occur with other operating systems. The symptom that
was seen was an error of "Abort Retry Ignore" at the end of each directory
listing.
This is a new parameter introduced in Samba version 3.0.21. It specifies in
seconds the time that smbd will cache the output of a disk free query. If
set to zero (the default) no caching is done. This allows a heavily loaded
server to prevent rapid spawning of dfree command scripts increasing the
load.
By default this parameter is zero, meaning no caching will be done.
No default
Example: dfree cache time = dfree cache time = 60
dfree command (S)
The dfree command setting should only be used on systems where a problem
occurs with the internal disk space calculations. This has been known to
happen with Ultrix, but may occur with other operating systems. The symptom
that was seen was an error of "Abort Retry Ignore" at the end of each direc-
tory listing.
This setting allows the replacement of the internal routines to calculate
the total disk space and amount available with an external routine. The
example below gives a possible script that might fulfill this function.
In Samba version 3.0.21 this parameter has been changed to be a per-share
parameter, and in addition the parameter dfree cache time was added to allow
the output of this script to be cached for systems under heavy load.
The external program will be passed a single parameter indicating a direc-
tory in the filesystem being queried. This will typically consist of the
string ./. The script should return two integers in ASCII. The first should
be the total disk space in blocks, and the second should be the number of
available blocks. An optional third return value can give the block size in
bytes. The default blocksize is 1024 bytes.
Note: Your script should NOT be setuid or setgid and should be owned by (and
writeable only by) root!
Where the script dfree (which must be made executable) could be:
#!/bin/sh
df $1 | tail -1 | awk ’{print $2" "$4}’
or perhaps (on Sys V based systems):
#!/bin/sh
/usr/bin/df -k $1 | tail -1 | awk ’{print $3" "$5}’
Note that you may have to replace the command names with full path names on
some systems.
By default internal routines for determining the disk capacity and remaining
space will be used.
No default
Example: dfree command = /usr/local/samba/bin/dfree
directory mode
This parameter is a synonym for directory mask.
directory mask (S)
This parameter is the octal modes which are used when converting DOS modes
to UNIX modes when creating UNIX directories.
When a directory is created, the necessary permissions are calculated
according to the mapping from DOS modes to UNIX permissions, and the result-
ing UNIX mode is then bit-wise ’AND’ed with this parameter. This parameter
may be thought of as a bit-wise MASK for the UNIX modes of a directory. Any
bit not set here will be removed from the modes set on a directory when it
is created.
The default value of this parameter removes the ’group’ and ’other’ write
bits from the UNIX mode, allowing only the user who owns the directory to
modify it.
Following this Samba will bit-wise ’OR’ the UNIX mode created from this
parameter with the value of the force directory mode parameter. This parame-
ter is set to 000 by default (i.e. no extra mode bits are added).
Note that this parameter does not apply to permissions set by Windows
NT/2000 ACL editors. If the administrator wishes to enforce a mask on access
control lists also, they need to set the directory security mask.
Default: directory mask = 0755
Example: directory mask = 0775
directory security mask (S)
This parameter controls what UNIX permission bits can be modified when a
Windows NT client is manipulating the UNIX permission on a directory using
the native NT security dialog box.
This parameter is applied as a mask (AND’ed with) to the changed permission
bits, thus preventing any bits not in this mask from being modified. Make
sure not to mix up this parameter with force directory security mode, which
works similar like this one but uses logical OR instead of AND. Essentially,
zero bits in this mask may be treated as a set of bits the user is not
allowed to change.
If not set explicitly this parameter is set to 0777 meaning a user is
allowed to modify all the user/group/world permissions on a directory.
Note that users who can access the Samba server through other means can eas-
ily bypass this restriction, so it is primarily useful for standalone
"appliance" systems. Administrators of most normal systems will probably
want to leave it as the default of 0777.
Default: directory security mask = 0777
Example: directory security mask = 0700
disable netbios (G)
Enabling this parameter will disable netbios support in Samba. Netbios is
the only available form of browsing in all windows versions except for 2000
and XP.
Note
Clients that only support netbios won’t be able to see your samba server
when netbios support is disabled.
Default: disable netbios = no
disable spoolss (G)
Enabling this parameter will disable Samba’s support for the SPOOLSS set of
MS-RPC’s and will yield identical behavior as Samba 2.0.x. Windows NT/2000
clients will downgrade to using Lanman style printing commands. Windows
9x/ME will be unaffected by the parameter. However, this will also disable
the ability to upload printer drivers to a Samba server via the Windows NT
Add Printer Wizard or by using the NT printer properties dialog window. It
will also disable the capability of Windows NT/2000 clients to download
print drivers from the Samba host upon demand. Be very careful about
enabling this parameter.
Default: disable spoolss = no
display charset (G)
Specifies the charset that samba will use to print messages to stdout and
stderr and SWAT will use. Should generally be the same as the unix charset.
Default: display charset = ASCII
Example: display charset = UTF8
dmapi support (S)
This parameter specifies whether Samba should use DMAPI to determine whether
a file is offline or not. This would typically be used in conjunction with a
hierarchical storage system that automatically migrates files to tape.
Note that Samba infers the status of a file by examining the events that a
DMAPI application has registered interest in. This heuristic is satisfactory
for a number of hierarchical storage systems, but there may be system for
which it will fail. In this case, Samba may erroneously report files to be
offline.
This parameter is only available if a supported DMAPI implementation was
found at compilation time. It will only be used if DMAPI is found to enabled
on the system at run time.
Default: dmapi support = no
dns proxy (G)
Specifies that nmbd(8) when acting as a WINS server and finding that a Net-
BIOS name has not been registered, should treat the NetBIOS name
word-for-word as a DNS name and do a lookup with the DNS server for that
name on behalf of the name-querying client.
Note that the maximum length for a NetBIOS name is 15 characters, so the DNS
name (or DNS alias) can likewise only be 15 characters, maximum.
nmbd spawns a second copy of itself to do the DNS name lookup requests, as
doing a name lookup is a blocking action.
Default: dns proxy = yes
domain logons (G)
If set to yes, the Samba server will provide the netlogon service for Win-
dows 9X network logons for theworkgroup it is in. This will also cause the
Samba server to act as a domain controller for NT4 style domain services.
For more details on setting up this feature see the Domain Control chapter
of the Samba HOWTO Collection.
Default: domain logons = no
domain master (G)
Tell smbd(8) to enable WAN-wide browse list collation. Setting this option
causes nmbd to claim a special domain specific NetBIOS name that identifies
it as a domain master browser for its givenworkgroup. Local master browsers
in the same workgroup on broadcast-isolated subnets will give this nmbd
their local browse lists, and then ask smbd(8) for a complete copy of the
browse list for the whole wide area network. Browser clients will then con-
tact their local master browser, and will receive the domain-wide browse
list, instead of just the list for their broadcast-isolated subnet.
Note that Windows NT Primary Domain Controllers expect to be able to claim
this workgroup specific special NetBIOS name that identifies them as domain
master browsers for thatworkgroup by default (i.e. there is no way to pre-
vent a Windows NT PDC from attempting to do this). This means that if this
parameter is set and nmbd claims the special name for a workgroup before a
Windows NT PDC is able to do so then cross subnet browsing will behave
strangely and may fail.
If domain logons = yes, then the default behavior is to enable thedomain
master parameter. If domain logons is not enabled (the default setting),
then neither will domain master be enabled by default.
When domain logons = Yes the default setting for this parameter is Yes, with
the result that Samba will be a PDC. If domain master = No, Samba will func-
tion as a BDC. In general, this parameter should be set to ’No’ only on a
BDC.
Default: domain master = auto
dont descend (S)
There are certain directories on some systems (e.g., the /proc tree under
Linux) that are either not of interest to clients or are infinitely deep
(recursive). This parameter allows you to specify a comma-delimited list of
directories that the server should always show as empty.
Note that Samba can be very fussy about the exact format of the "dont
descend" entries. For example you may need ./proc instead of just /proc.
Experimentation is the best policy :-)
Default: dont descend =
Example: dont descend = /proc,/dev
dos charset (G)
DOS SMB clients assume the server has the same charset as they do. This
option specifies which charset Samba should talk to DOS clients.
The default depends on which charsets you have installed. Samba tries to use
charset 850 but falls back to ASCII in case it is not available. Run test-
parm(1) to check the default on your system.
No default
dos filemode (S)
The default behavior in Samba is to provide UNIX-like behavior where only
the owner of a file/directory is able to change the permissions on it. How-
ever, this behavior is often confusing to DOS/Windows users. Enabling this
parameter allows a user who has write access to the file (by whatever means)
to modify the permissions (including ACL) on it. Note that a user belonging
to the group owning the file will not be allowed to change permissions if
the group is only granted read access. Ownership of the file/directory may
also be changed.
Default: dos filemode = no
dos filetime resolution (S)
Under the DOS and Windows FAT filesystem, the finest granularity on time
resolution is two seconds. Setting this parameter for a share causes Samba
to round the reported time down to the nearest two second boundary when a
query call that requires one second resolution is made to smbd(8).
This option is mainly used as a compatibility option for Visual C++ when
used against Samba shares. If oplocks are enabled on a share, Visual C++
uses two different time reading calls to check if a file has changed since
it was last read. One of these calls uses a one-second granularity, the
other uses a two second granularity. As the two second call rounds any odd
second down, then if the file has a timestamp of an odd number of seconds
then the two timestamps will not match and Visual C++ will keep reporting
the file has changed. Setting this option causes the two timestamps to
match, and Visual C++ is happy.
Default: dos filetime resolution = no
dos filetimes (S)
Under DOS and Windows, if a user can write to a file they can change the
timestamp on it. Under POSIX semantics, only the owner of the file or root
may change the timestamp. By default, Samba runs with POSIX semantics and
refuses to change the timestamp on a file if the user smbd is acting on
behalf of is not the file owner. Setting this option to yes allows DOS
semantics and smbd(8) will change the file timestamp as DOS requires. Due to
changes in Microsoft Office 2000 and beyond, the default for this parameter
has been changed from "no" to "yes" in Samba 3.0.14 and above. Microsoft
Excel will display dialog box warnings about the file being changed by
another user if this parameter is not set to "yes" and files are being
shared between users.
Default: dos filetimes = yes
ea support (S)
This boolean parameter controls whether smbd(8) will allow clients to
attempt to store OS/2 style Extended attributes on a share. In order to
enable this parameter the underlying filesystem exported by the share must
support extended attributes (such as provided on XFS and EXT3 on Linux, with
the correct kernel patches). On Linux the filesystem must have been mounted
with the mount option user_xattr in order for extended attributes to work,
also extended attributes must be compiled into the Linux kernel.
Default: ea support = no
enable asu support (G)
Hosts running the "Advanced Server for Unix (ASU)" product require some spe-
cial accomodations such as creating a builting [ADMIN$] share that only sup-
ports IPC connections. The has been the default behavior in smbd for many
years. However, certain Microsoft applications such as the Print Migrator
tool require that the remote server support an [ADMIN$} file share. Dis-
abling this parameter allows for creating an [ADMIN$] file share in
smb.conf.
Default: enable asu support = no
enable privileges (G)
This parameter controls whether or not smbd will honor privileges assigned
to specific SIDs via either net rpc rights or one of the Windows user and
group manager tools. This parameter is disabled by default to prevent mem-
bers of the Domain Admins group from being able to assign privileges to
users or groups which can then result in certain smbd operations running as
root that would normally run under the context of the connected user.
An example of how privileges can be used is to assign the right to join
clients to a Samba controlled domain without providing root access to the
server via smbd.
Please read the extended description provided in the Samba documentation.
Default: enable privileges = yes
encrypt passwords (G)
This boolean controls whether encrypted passwords will be negotiated with
the client. Note that Windows NT 4.0 SP3 and above and also Windows 98 will
by default expect encrypted passwords unless a registry entry is changed. To
use encrypted passwords in Samba see the chapter "User Database" in the
Samba HOWTO Collection.
MS Windows clients that expect Microsoft encrypted passwords and that do not
have plain text password support enabled will be able to connect only to a
Samba server that has encypted password support enabled and for which the
user accounts have a valid encrypted password. Refer to the smbpasswd com-
mand man page for information regarding the creation of encrypted passwords
for user accounts.
The use of plain text passwords is NOT advised as support for this feature
is no longer maintained in Microsoft Windows products. If you want to use
plain text passwords you must set this parameter to no.
In order for encrypted passwords to work correctly smbd(8) must either have
access to a local smbpasswd(5) file (see the smbpasswd(8) program for infor-
mation on how to set up and maintain this file), or set the security =
[server|domain|ads] parameter which causes smbd to authenticate against
another server.
Default: encrypt passwords = yes
enhanced browsing (G)
This option enables a couple of enhancements to cross-subnet browse propaga-
tion that have been added in Samba but which are not standard in Microsoft
implementations.
The first enhancement to browse propagation consists of a regular wildcard
query to a Samba WINS server for all Domain Master Browsers, followed by a
browse synchronization with each of the returned DMBs. The second enhance-
ment consists of a regular randomised browse synchronization with all cur-
rently known DMBs.
You may wish to disable this option if you have a problem with empty work-
groups not disappearing from browse lists. Due to the restrictions of the
browse protocols these enhancements can cause a empty workgroup to stay
around forever which can be annoying.
In general you should leave this option enabled as it makes cross-subnet
browse propagation much more reliable.
Default: enhanced browsing = yes
enumports command (G)
The concept of a "port" is fairly foreign to UNIX hosts. Under Windows
NT/2000 print servers, a port is associated with a port monitor and gener-
ally takes the form of a local port (i.e. LPT1:, COM1:, FILE:) or a remote
port (i.e. LPD Port Monitor, etc...). By default, Samba has only one port
defined--"Samba Printer Port". Under Windows NT/2000, all printers must have
a valid port name. If you wish to have a list of ports displayed (smbd does
not use a port name for anything) other than the default "Samba Printer
Port", you can define enumports command to point to a program which should
generate a list of ports, one per line, to standard output. This listing
will then be used in response to the level 1 and 2 EnumPorts() RPC.
Default: enumports command =
Example: enumports command = /usr/bin/listports
eventlog list (G)
This option defines a list of log names that Samba will report to the
Microsoft EventViewer utility. The listed eventlogs will be associated with
tdb file on disk in the $(libdir)/eventlog.
The administrator must use an external process to parse the normal Unix logs
such as /var/log/messages and write then entries to the eventlog tdb files.
Refer to the eventlogadm(8) utility for how to write eventlog entries.
Default: eventlog list =
Example: eventlog list = Security Application Syslog Apache
fake directory create times (S)
NTFS and Windows VFAT file systems keep a create time for all files and
directories. This is not the same as the ctime - status change time - that
Unix keeps, so Samba by default reports the earliest of the various times
Unix does keep. Setting this parameter for a share causes Samba to always
report midnight 1-1-1980 as the create time for directories.
This option is mainly used as a compatibility option for Visual C++ when
used against Samba shares. Visual C++ generated makefiles have the object
directory as a dependency for each object file, and a make rule to create
the directory. Also, when NMAKE compares timestamps it uses the creation
time when examining a directory. Thus the object directory will be created
if it does not exist, but once it does exist it will always have an earlier
timestamp than the object files it contains.
However, Unix time semantics mean that the create time reported by Samba
will be updated whenever a file is created or or deleted in the directory.
NMAKE finds all object files in the object directory. The timestamp of the
last one built is then compared to the timestamp of the object directory. If
the directory’s timestamp if newer, then all object files will be rebuilt.
Enabling this option ensures directories always predate their contents and
an NMAKE build will proceed as expected.
Default: fake directory create times = no
fake oplocks (S)
Oplocks are the way that SMB clients get permission from a server to locally
cache file operations. If a server grants an oplock (opportunistic lock)
then the client is free to assume that it is the only one accessing the file
and it will aggressively cache file data. With some oplock types the client
may even cache file open/close operations. This can give enormous perfor-
mance benefits.
When you set fake oplocks = yes, smbd(8) will always grant oplock requests
no matter how many clients are using the file.
It is generally much better to use the real oplocks support rather than this
parameter.
If you enable this option on all read-only shares or shares that you know
will only be accessed from one client at a time such as physically read-only
media like CDROMs, you will see a big performance improvement on many opera-
tions. If you enable this option on shares where multiple clients may be
accessing the files read-write at the same time you can get data corruption.
Use this option carefully!
Default: fake oplocks = no
fam change notify (G)
This parameter specifies whether Samba should ask the FAM daemon change
notifications in directories so that SMB clients can refresh whenever the
data on the server changes.
This parameter is only used when your system supports change notification to
user programs, using the FAM daemon. If the FAM daemon is not running, this
parameter is automatically disabled. Thekernel change notify parameter will
take precedence if it is also enabled.
Default: fam change notify = yes
follow symlinks (S)
This parameter allows the Samba administrator to stop smbd(8)from following
symbolic links in a particular share. Setting this parameter to no prevents
any file or directory that is a symbolic link from being followed (the user
will get an error). This option is very useful to stop users from adding a
symbolic link to /etc/passwd in their home directory for instance. However
it will slow filename lookups down slightly.
This option is enabled (i.e. smbd will follow symbolic links) by default.
Default: follow symlinks = yes
force create mode (S)
This parameter specifies a set of UNIX mode bit permissions that will always
be set on a file created by Samba. This is done by bitwise ’OR’ing these
bits onto the mode bits of a file that is being created or having its per-
missions changed. The default for this parameter is (in octal) 000. The
modes in this parameter are bitwise ’OR’ed onto the file mode after the mask
set in the create mask parameter is applied.
The example below would force all created files to have read and execute
permissions set for ’group’ and ’other’ as well as the read/write/execute
bits set for the ’user’.
Default: force create mode = 000
Example: force create mode = 0755
force directory mode (S)
This parameter specifies a set of UNIX mode bit permissions that will always
be set on a directory created by Samba. This is done by bitwise ’OR’ing
these bits onto the mode bits of a directory that is being created. The
default for this parameter is (in octal) 0000 which will not add any extra
permission bits to a created directory. This operation is done after the
mode mask in the parameter directory mask is applied.
The example below would force all created directories to have read and exe-
cute permissions set for ’group’ and ’other’ as well as the read/write/exe-
cute bits set for the ’user’.
Default: force directory mode = 000
Example: force directory mode = 0755
force directory security mode (S)
This parameter controls what UNIX permission bits can be modified when a
Windows NT client is manipulating the UNIX permission on a directory using
the native NT security dialog box.
This parameter is applied as a mask (OR’ed with) to the changed permission
bits, thus forcing any bits in this mask that the user may have modified to
be on. Make sure not to mix up this parameter with directory security mask,
which works in a similar manner to this one, but uses a logical AND instead
of an OR.
Essentially, this mask may be treated as a set of bits that, when modifying
security on a directory, to will enable (1) any flags that are off (0) but
which the mask has set to on (1).
If not set explicitly this parameter is 0000, which allows a user to modify
all the user/group/world permissions on a directory without restrictions.
Note
Users who can access the Samba server through other means can easily bypass
this restriction, so it is primarily useful for standalone "appliance" sys-
tems. Administrators of most normal systems will probably want to leave it
set as 0000.
Default: force directory security mode = 0
Example: force directory security mode = 700
group This parameter is a synonym for force group.
force group (S)
This specifies a UNIX group name that will be assigned as the default pri-
mary group for all users connecting to this service. This is useful for
sharing files by ensuring that all access to files on service will use the
named group for their permissions checking. Thus, by assigning permissions
for this group to the files and directories within this service the Samba
administrator can restrict or allow sharing of these files.
In Samba 2.0.5 and above this parameter has extended functionality in the
following way. If the group name listed here has a ’+’ character prepended
to it then the current user accessing the share only has the primary group
default assigned to this group if they are already assigned as a member of
that group. This allows an administrator to decide that only users who are
already in a particular group will create files with group ownership set to
that group. This gives a finer granularity of ownership assignment. For
example, the setting force group = +sys means that only users who are
already in group sys will have their default primary group assigned to sys
when accessing this Samba share. All other users will retain their ordinary
primary group.
If the force user parameter is also set the group specified in force group
will override the primary group set in force user.
Default: force group =
Example: force group = agroup
force printername (S)
When printing from Windows NT (or later), each printer in smb.conf has two
associated names which can be used by the client. The first is the sharename
(or shortname) defined in smb.conf. This is the only printername available
for use by Windows 9x clients. The second name associated with a printer can
be seen when browsing to the "Printers" (or "Printers and Faxes") folder on
the Samba server. This is referred to simply as the printername (not to be
confused with the printer name option).
When assigning a new driver to a printer on a remote Windows compatible
print server such as Samba, the Windows client will rename the printer to
match the driver name just uploaded. This can result in confusion for users
when multiple printers are bound to the same driver. To prevent Samba from
allowing the printer’s printername to differ from the sharename defined in
smb.conf, set force printername = yes.
Be aware that enabling this parameter may affect migrating printers from a
Windows server to Samba since Windows has no way to force the sharename and
printername to match.
It is recommended that this parameter’s value not be changed once the
printer is in use by clients as this could cause a user not be able to
delete printer connections from their local Printers folder.
Default: force printername = no
force security mode (S)
This parameter controls what UNIX permission bits can be modified when a
Windows NT client is manipulating the UNIX permission on a file using the
native NT security dialog box.
This parameter is applied as a mask (OR’ed with) to the changed permission
bits, thus forcing any bits in this mask that the user may have modified to
be on. Make sure not to mix up this parameter with security mask, which
works similar like this one but uses logical AND instead of OR.
Essentially, one bits in this mask may be treated as a set of bits that,
when modifying security on a file, the user has always set to be on.
If not set explicitly this parameter is set to 0, and allows a user to mod-
ify all the user/group/world permissions on a file, with no restrictions.
Note that users who can access the Samba server through other means can
easily bypass this restriction, so it is primarily useful for standalone
"appliance" systems. Administrators of most normal systems will probably
want to leave this set to 0000.
Default: force security mode = 0
Example: force security mode = 700
force unknown acl user (S)
If this parameter is set, a Windows NT ACL that contains an unknown SID
(security descriptor, or representation of a user or group id) as the owner
or group owner of the file will be silently mapped into the current UNIX uid
or gid of the currently connected user.
This is designed to allow Windows NT clients to copy files and folders con-
taining ACLs that were created locally on the client machine and contain
users local to that machine only (no domain users) to be copied to a Samba
server (usually with XCOPY /O) and have the unknown userid and groupid of
the file owner map to the current connected user. This can only be fixed
correctly when winbindd allows arbitrary mapping from any Windows NT SID to
a UNIX uid or gid.
Try using this parameter when XCOPY /O gives an ACCESS_DENIED error.
Default: force unknown acl user = no
force user (S)
This specifies a UNIX user name that will be assigned as the default user
for all users connecting to this service. This is useful for sharing files.
You should also use it carefully as using it incorrectly can cause security
problems.
This user name only gets used once a connection is established. Thus clients
still need to connect as a valid user and supply a valid password. Once con-
nected, all file operations will be performed as the "forced user", no mat-
ter what username the client connected as. This can be very useful.
In Samba 2.0.5 and above this parameter also causes the primary group of the
forced user to be used as the primary group for all file activity. Prior to
2.0.5 the primary group was left as the primary group of the connecting user
(this was a bug).
Default: force user =
Example: force user = auser
fstype (S)
This parameter allows the administrator to configure the string that speci-
fies the type of filesystem a share is using that is reported by smbd(8)
when a client queries the filesystem type for a share. The default type is
NTFS for compatibility with Windows NT but this can be changed to other
strings such as Samba or FAT if required.
Default: fstype = NTFS
Example: fstype = Samba
get quota command (G)
The get quota command should only be used whenever there is no operating
system API available from the OS that samba can use.
This option is only available with ./configure --with-sys-quotas. Or on
linux when ./configure --with-quotas was used and a working quota api was
found in the system.
This parameter should specify the path to a script that queries the quota
information for the specified user/group for the partition that the speci-
fied directory is on.
Such a script should take 3 arguments:
· directory
· type of query
· uid of user or gid of group
The type of query can be one of :
· 1 - user quotas
· 2 - user default quotas (uid = -1)
· 3 - group quotas
· 4 - group default quotas (gid = -1)
This script should print one line as output with spaces between the argu-
ments. The arguments are:
· Arg 1 - quota flags (0 = no quotas, 1 = quotas enabled, 2 = quotas
enabled and enforced)
· Arg 2 - number of currently used blocks
· Arg 3 - the softlimit number of blocks
· Arg 4 - the hardlimit number of blocks
· Arg 5 - currently used number of inodes
· Arg 6 - the softlimit number of inodes
· Arg 7 - the hardlimit number of inodes
· Arg 8(optional) - the number of bytes in a block(default is 1024)
Default: get quota command =
Example: get quota command = /usr/local/sbin/query_quota
getwd cache (G)
This is a tuning option. When this is enabled a caching algorithm will be
used to reduce the time taken for getwd() calls. This can have a significant
impact on performance, especially when the wide smbconfoptions parameter is
set to no.
Default: getwd cache = yes
guest account (G)
This is a username which will be used for access to services which are spec-
ified as guest ok (see below). Whatever privileges this user has will be
available to any client connecting to the guest service. This user must
exist in the password file, but does not require a valid login. The user
account "ftp" is often a good choice for this parameter.
On some systems the default guest account "nobody" may not be able to print.
Use another account in this case. You should test this by trying to log in
as your guest user (perhaps by using the su - command) and trying to print
using the system print command such as lpr(1) or lp(1).
This parameter does not accept % macros, because many parts of the system
require this value to be constant for correct operation.
Default: guest account = nobody # default can be changed at compile-time
Example: guest account = ftp
public This parameter is a synonym for guest ok.
guest ok (S)
If this parameter is yes for a service, then no password is required to con-
nect to the service. Privileges will be those of the guest account.
This paramater nullifies the benifits of setting restrict anonymous = 2
See the section below on security for more information about this option.
Default: guest ok = no
only guest
This parameter is a synonym for guest only.
guest only (S)
If this parameter is yes for a service, then only guest connections to the
service are permitted. This parameter will have no effect if guest ok is not
set for the service.
See the section below on security for more information about this option.
Default: guest only = no
hide dot files (S)
This is a boolean parameter that controls whether files starting with a dot
appear as hidden files.
Default: hide dot files = yes
hide files (S)
This is a list of files or directories that are not visible but are accessi-
ble. The DOS ’hidden’ attribute is applied to any files or directories that
match.
Each entry in the list must be separated by a ’/’, which allows spaces to be
included in the entry. ’*’ and ’?’ can be used to specify multiple files or
directories as in DOS wildcards.
Each entry must be a Unix path, not a DOS path and must not include the Unix
directory separator ’/’.
Note that the case sensitivity option is applicable in hiding files.
Setting this parameter will affect the performance of Samba, as it will be
forced to check all files and directories for a match as they are scanned.
The example shown above is based on files that the Macintosh SMB client
(DAVE) available from Thursby creates for internal use, and also still hides
all files beginning with a dot.
An example of us of this parameter is:
hide files = /.*/DesktopFolderDB/TrashFor%m/resource.frk/
Default: hide files = # no file are hidden
hide special files (S)
This parameter prevents clients from seeing special files such as sockets,
devices and fifo’s in directory listings.
Default: hide special files = no
hide unreadable (S)
This parameter prevents clients from seeing the existance of files that can-
not be read. Defaults to off.
Default: hide unreadable = no
hide unwriteable files (S)
This parameter prevents clients from seeing the existance of files that can-
not be written to. Defaults to off. Note that unwriteable directories are
shown as usual.
Default: hide unwriteable files = no
homedir map (G)
If nis homedir is yes, and smbd(8) is also acting as a Win95/98 logon server
then this parameter specifies the NIS (or YP) map from which the server for
the user’s home directory should be extracted. At present, only the Sun
auto.home map format is understood. The form of the map is:
username server:/some/file/system
and the program will extract the servername from before the first ’:’.
There should probably be a better parsing system that copes with different
map formats and also Amd (another automounter) maps.
Note
A working NIS client is required on the system for this option to work.
Default: homedir map =
Example: homedir map = amd.homedir
host msdfs (G)
If set to yes, Samba will act as a Dfs server, and allow Dfs-aware clients
to browse Dfs trees hosted on the server.
See also the msdfs root share level parameter. For more information on set-
ting up a Dfs tree on Samba, refer to the MSFDS chapter in the book
Samba3-HOWTO.
Default: host msdfs = yes
hostname lookups (G)
Specifies whether samba should use (expensive) hostname lookups or use the
ip addresses instead. An example place where hostname lookups are currently
used is when checking the hosts deny and hosts allow.
Default: hostname lookups = no
Example: hostname lookups = yes
allow hosts
This parameter is a synonym for hosts allow.
hosts allow (S)
A synonym for this parameter is allow hosts.
This parameter is a comma, space, or tab delimited set of hosts which are
permitted to access a service.
If specified in the [global] section then it will apply to all services,
regardless of whether the individual service has a different setting.
You can specify the hosts by name or IP number. For example, you could
restrict access to only the hosts on a Class C subnet with something like
allow hosts = 150.203.5.. The full syntax of the list is described in the
man page hosts_access(5). Note that this man page may not be present on your
system, so a brief description will be given here also.
Note that the localhost address 127.0.0.1 will always be allowed access
unless specifically denied by a hosts deny option.
You can also specify hosts by network/netmask pairs and by netgroup names if
your system supports netgroups. The EXCEPT keyword can also be used to limit
a wildcard list. The following examples may provide some help:
Example 1: allow all IPs in 150.203.*.*; except one
hosts allow = 150.203. EXCEPT 150.203.6.66
Example 2: allow hosts that match the given network/netmask
hosts allow = 150.203.15.0/255.255.255.0
Example 3: allow a couple of hosts
hosts allow = lapland, arvidsjaur
Example 4: allow only hosts in NIS netgroup "foonet", but deny access from
one particular host
hosts allow = @foonet
hosts deny = pirate
Note
Note that access still requires suitable user-level passwords.
See testparm(1) for a way of testing your host access to see if it does what you
expect.
Default: hosts allow = # none (i.e., all hosts permitted access)
Example: hosts allow = 150.203.5. myhost.mynet.edu.au
deny hosts
This parameter is a synonym for hosts deny.
hosts deny (S)
The opposite of hosts allow - hosts listed here are NOT permitted access to
services unless the specific services have their own lists to override this
one. Where the lists conflict, the allow list takes precedence.
In the event that it is necessary to deny all by default, use the keyword
ALL (or the netmask 0.0.0.0/0) and then explicitly specify to the hosts
allow = hosts allow parameter those hosts that should be permitted access.
Default: hosts deny = # none (i.e., no hosts specifically excluded)
Example: hosts deny = 150.203.4. badhost.mynet.edu.au
idmap backend (G)
The purpose of the idmap backend parameter is to allow idmap to NOT use the
local idmap tdb file to obtain SID to UID / GID mappings for unmapped SIDs,
but instead to obtain them from a common LDAP backend. This way all domain
members and controllers will have the same