1 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN">
2 <refentry id="smb.conf">
5 <refentrytitle>smb.conf</refentrytitle>
6 <manvolnum>5</manvolnum>
11 <refname>smb.conf</refname>
12 <refpurpose>The configuration file for the Samba suite</refpurpose>
16 <title>SYNOPSIS</title>
18 <para>The <filename>smb.conf</filename> file is a configuration
19 file for the Samba suite. <filename>smb.conf</filename> contains
20 runtime configuration information for the Samba programs. The
21 <filename>smb.conf</filename> file is designed to be configured and
22 administered by the <ulink url="swat.8.html"><command>swat(8)</command>
23 </ulink> program. The complete description of the file format and
24 possible parameters held within are here for reference purposes.</para>
28 <title id="FILEFORMATSECT">FILE FORMAT</title>
30 <para>The file consists of sections and parameters. A section
31 begins with the name of the section in square brackets and continues
32 until the next section begins. Sections contain parameters of the
35 <para><replaceable>name</replaceable> = <replaceable>value
38 <para>The file is line-based - that is, each newline-terminated
39 line represents either a comment, a section name or a parameter.</para>
41 <para>Section and parameter names are not case sensitive.</para>
43 <para>Only the first equals sign in a parameter is significant.
44 Whitespace before or after the first equals sign is discarded.
45 Leading, trailing and internal whitespace in section and parameter
46 names is irrelevant. Leading and trailing whitespace in a parameter
47 value is discarded. Internal whitespace within a parameter value
48 is retained verbatim.</para>
50 <para>Any line beginning with a semicolon (';') or a hash ('#')
51 character is ignored, as are lines containing only whitespace.</para>
53 <para>Any line ending in a '\' is continued
54 on the next line in the customary UNIX fashion.</para>
56 <para>The values following the equals sign in parameters are all
57 either a string (no quotes needed) or a boolean, which may be given
58 as yes/no, 0/1 or true/false. Case is not significant in boolean
59 values, but is preserved in string values. Some items such as
60 create modes are numeric.</para>
64 <title>SECTION DESCRIPTIONS</title>
66 <para>Each section in the configuration file (except for the
67 [global] section) describes a shared resource (known
68 as a "share"). The section name is the name of the
69 shared resource and the parameters within the section define
70 the shares attributes.</para>
72 <para>There are three special sections, [global],
73 [homes] and [printers], which are
74 described under <emphasis>special sections</emphasis>. The
75 following notes apply to ordinary section descriptions.</para>
77 <para>A share consists of a directory to which access is being
78 given plus a description of the access rights which are granted
79 to the user of the service. Some housekeeping options are
80 also specifiable.</para>
82 <para>Sections are either file share services (used by the
83 client as an extension of their native file systems) or
84 printable services (used by the client to access print services
85 on the host running the server).</para>
87 <para>Sections may be designated <emphasis>guest</emphasis> services,
88 in which case no password is required to access them. A specified
89 UNIX <emphasis>guest account</emphasis> is used to define access
90 privileges in this case.</para>
92 <para>Sections other than guest services will require a password
93 to access them. The client provides the username. As older clients
94 only provide passwords and not usernames, you may specify a list
95 of usernames to check against the password using the "user ="
96 option in the share definition. For modern clients such as
97 Windows 95/98/ME/NT/2000, this should not be necessary.</para>
99 <para>Note that the access rights granted by the server are
100 masked by the access rights granted to the specified or guest
101 UNIX user by the host system. The server does not grant more
102 access than the host system grants.</para>
104 <para>The following sample section defines a file space share.
105 The user has write access to the path <filename>/home/bar</filename>.
106 The share is accessed via the share name "foo":</para>
116 <para>The following sample section defines a printable share.
117 The share is readonly, but printable. That is, the only write
118 access permitted is via calls to open, write to and close a
119 spool file. The <emphasis>guest ok</emphasis> parameter means
120 access will be permitted as the default guest user (specified
126 path = /usr/spool/public
135 <title>SPECIAL SECTIONS</title>
138 <title>The [global] section</title>
140 <para>parameters in this section apply to the server
141 as a whole, or are defaults for sections which do not
142 specifically define certain items. See the notes
143 under PARAMETERS for more information.</para>
147 <title id="HOMESECT">The [homes] section</title>
149 <para>If a section called homes is included in the
150 configuration file, services connecting clients to their
151 home directories can be created on the fly by the server.</para>
153 <para>When the connection request is made, the existing
154 sections are scanned. If a match is found, it is used. If no
155 match is found, the requested section name is treated as a
156 user name and looked up in the local password file. If the
157 name exists and the correct password has been given, a share is
158 created by cloning the [homes] section.</para>
160 <para>Some modifications are then made to the newly
161 created share:</para>
164 <listitem><para>The share name is changed from homes to
165 the located username.</para></listitem>
167 <listitem><para>If no path was given, the path is set to
168 the user's home directory.</para></listitem>
171 <para>If you decide to use a <emphasis>path =</emphasis> line
172 in your [homes] section then you may find it useful
173 to use the %S macro. For example :</para>
175 <para><userinput>path = /data/pchome/%S</userinput></para>
177 <para>would be useful if you have different home directories
178 for your PCs than for UNIX access.</para>
180 <para>This is a fast and simple way to give a large number
181 of clients access to their home directories with a minimum
184 <para>A similar process occurs if the requested section
185 name is "homes", except that the share name is not
186 changed to that of the requesting user. This method of using
187 the [homes] section works well if different users share
190 <para>The [homes] section can specify all the parameters
191 a normal service section can specify, though some make more sense
192 than others. The following is a typical and suitable [homes]
202 <para>An important point is that if guest access is specified
203 in the [homes] section, all home directories will be
204 visible to all clients <emphasis>without a password</emphasis>.
205 In the very unlikely event that this is actually desirable, it
206 would be wise to also specify <emphasis>read only
207 access</emphasis>.</para>
209 <para>Note that the <emphasis>browseable</emphasis> flag for
210 auto home directories will be inherited from the global browseable
211 flag, not the [homes] browseable flag. This is useful as
212 it means setting <emphasis>browseable = no</emphasis> in
213 the [homes] section will hide the [homes] share but make
214 any auto home directories visible.</para>
218 <title id="PRINTERSSECT">The [printers] section</title>
220 <para>This section works like [homes],
221 but for printers.</para>
223 <para>If a [printers] section occurs in the
224 configuration file, users are able to connect to any printer
225 specified in the local host's printcap file.</para>
227 <para>When a connection request is made, the existing sections
228 are scanned. If a match is found, it is used. If no match is found,
229 but a [homes] section exists, it is used as described
230 above. Otherwise, the requested section name is treated as a
231 printer name and the appropriate printcap file is scanned to see
232 if the requested section name is a valid printer share name. If
233 a match is found, a new printer share is created by cloning
234 the [printers] section.</para>
236 <para>A few modifications are then made to the newly created
240 <listitem><para>The share name is set to the located printer
241 name</para></listitem>
243 <listitem><para>If no printer name was given, the printer name
244 is set to the located printer name</para></listitem>
246 <listitem><para>If the share does not permit guest access and
247 no username was given, the username is set to the located
248 printer name.</para></listitem>
251 <para>Note that the [printers] service MUST be
252 printable - if you specify otherwise, the server will refuse
253 to load the configuration file.</para>
255 <para>Typically the path specified would be that of a
256 world-writeable spool directory with the sticky bit set on
257 it. A typical [printers] entry would look like
260 <screen><computeroutput>
262 path = /usr/spool/public
265 </computeroutput></screen>
267 <para>All aliases given for a printer in the printcap file
268 are legitimate printer names as far as the server is concerned.
269 If your printing subsystem doesn't work like that, you will have
270 to set up a pseudo-printcap. This is a file consisting of one or
271 more lines like this:</para>
275 alias|alias|alias|alias...
279 <para>Each alias should be an acceptable printer name for
280 your printing subsystem. In the [global] section, specify
281 the new file as your printcap. The server will then only recognize
282 names found in your pseudo-printcap, which of course can contain
283 whatever aliases you like. The same technique could be used
284 simply to limit access to a subset of your local printers.</para>
286 <para>An alias, by the way, is defined as any component of the
287 first entry of a printcap record. Records are separated by newlines,
288 components (if there are more than one) are separated by vertical
289 bar symbols ('|').</para>
291 <para>NOTE: On SYSV systems which use lpstat to determine what
292 printers are defined on the system you may be able to use
293 "printcap name = lpstat" to automatically obtain a list
294 of printers. See the "printcap name" option
295 for more details.</para>
300 <title>PARAMETERS</title>
302 <para>parameters define the specific attributes of sections.</para>
304 <para>Some parameters are specific to the [global] section
305 (e.g., <emphasis>security</emphasis>). Some parameters are usable
306 in all sections (e.g., <emphasis>create mode</emphasis>). All others
307 are permissible only in normal sections. For the purposes of the
308 following descriptions the [homes] and [printers]
309 sections will be considered normal. The letter <emphasis>G</emphasis>
310 in parentheses indicates that a parameter is specific to the
311 [global] section. The letter <emphasis>S</emphasis>
312 indicates that a parameter can be specified in a service specific
313 section. Note that all <emphasis>S</emphasis> parameters can also be specified in
314 the [global] section - in which case they will define
315 the default behavior for all services.</para>
317 <para>parameters are arranged here in alphabetical order - this may
318 not create best bedfellows, but at least you can find them! Where
319 there are synonyms, the preferred synonym is described, others refer
320 to the preferred synonym.</para>
324 <title>VARIABLE SUBSTITUTIONS</title>
326 <para>Many of the strings that are settable in the config file
327 can take substitutions. For example the option "path =
328 /tmp/%u" would be interpreted as "path =
329 /tmp/john" if the user connected with the username john.</para>
331 <para>These substitutions are mostly noted in the descriptions below,
332 but there are some general substitutions which apply whenever they
333 might be relevant. These are:</para>
338 <listitem><para>the name of the current service, if any.</para>
344 <listitem><para>the root directory of the current service,
345 if any.</para></listitem>
350 <listitem><para>user name of the current service, if any.</para>
356 <listitem><para>primary group name of %u.</para></listitem>
361 <listitem><para>session user name (the user name that the client
362 wanted, not necessarily the same as the one they got).</para></listitem>
367 <listitem><para>primary group name of %U.</para></listitem>
372 <listitem><para>the home directory of the user given
373 by %u.</para></listitem>
378 <listitem><para>the Samba version.</para></listitem>
383 <listitem><para>the Internet hostname that Samba is running
384 on.</para></listitem>
389 <listitem><para>the NetBIOS name of the client machine
390 (very useful).</para></listitem>
395 <listitem><para>the NetBIOS name of the server. This allows you
396 to change your config based on what the client calls you. Your
397 server can have a "dual personality".</para></listitem>
402 <listitem><para>the Internet name of the client machine.
408 <listitem><para>the name of your NIS home directory server.
409 This is obtained from your NIS auto.map entry. If you have
410 not compiled Samba with the <emphasis>--with-automount</emphasis>
411 option then this value will be the same as %L.</para>
417 <listitem><para>the path of the service's home directory,
418 obtained from your NIS auto.map entry. The NIS auto.map entry
419 is split up as "%N:%p".</para></listitem>
424 <listitem><para>the selected protocol level after
425 protocol negotiation. It can be one of CORE, COREPLUS,
426 LANMAN1, LANMAN2 or NT1.</para></listitem>
431 <listitem><para>The process id of the current server
432 process.</para></listitem>
437 <listitem><para>the architecture of the remote
438 machine. Only some are recognized, and those may not be
439 100% reliable. It currently recognizes Samba, WfWg, Win95,
440 WinNT and Win2k. Anything else will be known as
441 "UNKNOWN". If it gets it wrong then sending a level
442 3 log to <ulink url="mailto:samba@samba.org">samba@samba.org
443 </ulink> should allow it to be fixed.</para></listitem>
448 <listitem><para>The IP address of the client machine.</para>
454 <listitem><para>the current date and time.</para></listitem>
458 <term>%$(<replaceable>envvar</replaceable>)</term>
459 <listitem><para>The value of the environment variable
460 <replaceable>envar</replaceable>.</para></listitem>
464 <para>There are some quite creative things that can be done
465 with these substitutions and other smb.conf options.</para
469 <title id="NAMEMANGLINGSECT">NAME MANGLING</title>
471 <para>Samba supports "name mangling" so that DOS and
472 Windows clients can use files that don't conform to the 8.3 format.
473 It can also be set to adjust the case of 8.3 format filenames.</para>
475 <para>There are several options that control the way mangling is
476 performed, and they are grouped here rather than listed separately.
477 For the defaults look at the output of the testparm program. </para>
479 <para>All of these options can be set separately for each service
480 (or globally, of course). </para>
482 <para>The options are: </para>
487 <term>mangle case = yes/no</term>
488 <listitem><para> controls if names that have characters that
489 aren't of the "default" case are mangled. For example,
490 if this is yes then a name like "Mail" would be mangled.
491 Default <emphasis>no</emphasis>.</para></listitem>
495 <term>case sensitive = yes/no</term>
496 <listitem><para>controls whether filenames are case sensitive. If
497 they aren't then Samba must do a filename search and match on passed
498 names. Default <emphasis>no</emphasis>.</para></listitem>
502 <term>default case = upper/lower</term>
503 <listitem><para>controls what the default case is for new
504 filenames. Default <emphasis>lower</emphasis>.</para></listitem>
508 <term>preserve case = yes/no</term>
509 <listitem><para>controls if new files are created with the
510 case that the client passes, or if they are forced to be the
511 "default" case. Default <emphasis>yes</emphasis>.
516 <term>short preserve case = yes/no</term>
517 <listitem><para>controls if new files which conform to 8.3 syntax,
518 that is all in upper case and of suitable length, are created
519 upper case, or if they are forced to be the "default"
520 case. This option can be use with "preserve case = yes"
521 to permit long filenames to retain their case, while short names
522 are lowercased. Default <emphasis>yes</emphasis>.</para></listitem>
526 <para>By default, Samba 2.2 has the same semantics as a Windows
527 NT server, in that it is case insensitive but case preserving.</para>
532 <title id="VALIDATIONSECT">NOTE ABOUT USERNAME/PASSWORD VALIDATION</title>
534 <para>There are a number of ways in which a user can connect
535 to a service. The server uses the following steps in determining
536 if it will allow a connection to a specified service. If all the
537 steps fail, then the connection request is rejected. However, if one of the
538 steps succeeds, then the following steps are not checked.</para>
540 <para>If the service is marked "guest only = yes" then
541 steps 1 to 5 are skipped.</para>
543 <orderedlist numeration="Arabic">
544 <listitem><para>If the client has passed a username/password
545 pair and that username/password pair is validated by the UNIX
546 system's password programs then the connection is made as that
547 username. Note that this includes the
548 \\server\service%<replaceable>username</replaceable> method of passing
549 a username.</para></listitem>
551 <listitem><para>If the client has previously registered a username
552 with the system and now supplies a correct password for that
553 username then the connection is allowed.</para></listitem>
555 <listitem><para>The client's NetBIOS name and any previously
556 used user names are checked against the supplied password, if
557 they match then the connection is allowed as the corresponding
558 user.</para></listitem>
560 <listitem><para>If the client has previously validated a
561 username/password pair with the server and the client has passed
562 the validation token then that username is used. </para></listitem>
564 <listitem><para>If a "user = " field is given in the
565 <filename>smb.conf</filename> file for the service and the client
566 has supplied a password, and that password matches (according to
567 the UNIX system's password checking) with one of the usernames
568 from the "user =" field then the connection is made as
569 the username in the "user =" line. If one
570 of the username in the "user =" list begins with a
571 '@' then that name expands to a list of names in
572 the group of the same name.</para></listitem>
574 <listitem><para>If the service is a guest service then a
575 connection is made as the username given in the "guest
576 account =" for the service, irrespective of the
577 supplied password.</para></listitem>
583 <title>COMPLETE LIST OF GLOBAL PARAMETERS</title>
585 <para>Here is a list of all global parameters. See the section of
586 each parameter for details. Note that some are synonyms.</para>
589 <listitem><para><link linkend="ABORTSHUTDOWNSCRIPT"><parameter>abort shutdown script</parameter></link></para></listitem>
590 <listitem><para><link linkend="ADDPRINTERCOMMAND"><parameter>add printer command</parameter></link></para></listitem>
591 <listitem><para><link linkend="ADDSHARECOMMAND"><parameter>add share command</parameter></link></para></listitem>
592 <listitem><para><link linkend="ADDUSERSCRIPT"><parameter>add user script</parameter></link></para></listitem>
593 <listitem><para><link linkend="ADDMACHINESCRIPT"><parameter>add machine script</parameter></link></para></listitem>
594 <listitem><para><link linkend="ALLOWTRUSTEDDOMAINS"><parameter>allow trusted domains</parameter></link></para></listitem>
595 <listitem><para><link linkend="ANNOUNCEAS"><parameter>announce as</parameter></link></para></listitem>
596 <listitem><para><link linkend="ANNOUNCEVERSION"><parameter>announce version</parameter></link></para></listitem>
597 <listitem><para><link linkend="AUTHMETHODS"><parameter>auth methods</parameter></link></para></listitem>
598 <listitem><para><link linkend="AUTOSERVICES"><parameter>auto services</parameter></link></para></listitem>
599 <listitem><para><link linkend="BINDINTERFACESONLY"><parameter>bind interfaces only</parameter></link></para></listitem>
600 <listitem><para><link linkend="BROWSELIST"><parameter>browse list</parameter></link></para></listitem>
601 <listitem><para><link linkend="CHANGENOTIFYTIMEOUT"><parameter>change notify timeout</parameter></link></para></listitem>
602 <listitem><para><link linkend="CHANGESHARECOMMAND"><parameter>change share command</parameter></link></para></listitem>
603 <listitem><para><link linkend="CHARACTERSET"><parameter>character set</parameter></link></para></listitem>
604 <listitem><para><link linkend="CLIENTCODEPAGE"><parameter>client code page</parameter></link></para></listitem>
605 <listitem><para><link linkend="CODEPAGEDIRECTORY"><parameter>code page directory</parameter></link></para></listitem>
606 <listitem><para><link linkend="CODINGSYSTEM"><parameter>coding system</parameter></link></para></listitem>
607 <listitem><para><link linkend="CONFIGFILE"><parameter>config file</parameter></link></para></listitem>
608 <listitem><para><link linkend="DEADTIME"><parameter>deadtime</parameter></link></para></listitem>
609 <listitem><para><link linkend="DEBUGHIRESTIMESTAMP"><parameter>debug hires timestamp</parameter></link></para></listitem>
610 <listitem><para><link linkend="DEBUGPID"><parameter>debug pid</parameter></link></para></listitem>
611 <listitem><para><link linkend="DEBUGTIMESTAMP"><parameter>debug timestamp</parameter></link></para></listitem>
612 <listitem><para><link linkend="DEBUGUID"><parameter>debug uid</parameter></link></para></listitem>
613 <listitem><para><link linkend="DEBUGLEVEL"><parameter>debuglevel</parameter></link></para></listitem>
614 <listitem><para><link linkend="DEFAULT"><parameter>default</parameter></link></para></listitem>
615 <listitem><para><link linkend="DEFAULTSERVICE"><parameter>default service</parameter></link></para></listitem>
616 <listitem><para><link linkend="DELETEPRINTERCOMMAND"><parameter>delete printer command</parameter></link></para></listitem>
617 <listitem><para><link linkend="DELETESHARECOMMAND"><parameter>delete share command</parameter></link></para></listitem>
618 <listitem><para><link linkend="DELETEUSERSCRIPT"><parameter>delete user script</parameter></link></para></listitem>
619 <listitem><para><link linkend="DFREECOMMAND"><parameter>dfree command</parameter></link></para></listitem>
620 <listitem><para><link linkend="DISABLESPOOLSS"><parameter>disable spoolss</parameter></link></para></listitem>
621 <listitem><para><link linkend="DNSPROXY"><parameter>dns proxy</parameter></link></para></listitem>
622 <listitem><para><link linkend="DOMAINADMINGROUP"><parameter>domain admin group</parameter></link></para></listitem>
623 <listitem><para><link linkend="DOMAINGUESTGROUP"><parameter>domain guest group</parameter></link></para></listitem>
624 <listitem><para><link linkend="DOMAINLOGONS"><parameter>domain logons</parameter></link></para></listitem>
625 <listitem><para><link linkend="DOMAINMASTER"><parameter>domain master</parameter></link></para></listitem>
626 <listitem><para><link linkend="ENCRYPTPASSWORDS"><parameter>encrypt passwords</parameter></link></para></listitem>
627 <listitem><para><link linkend="ENHANCEDBROWSING"><parameter>enhanced browsing</parameter></link></para></listitem>
628 <listitem><para><link linkend="ENUMPORTSCOMMAND"><parameter>enumports command</parameter></link></para></listitem>
629 <listitem><para><link linkend="GETWDCACHE"><parameter>getwd cache</parameter></link></para></listitem>
630 <listitem><para><link linkend="HIDELOCALUSERS"><parameter>hide local users</parameter></link></para></listitem>
631 <listitem><para><link linkend="HIDEUNREADABLE"><parameter>hide unreadable</parameter></link></para></listitem>
632 <listitem><para><link linkend="HOMEDIRMAP"><parameter>homedir map</parameter></link></para></listitem>
633 <listitem><para><link linkend="HOSTMSDFS"><parameter>host msdfs</parameter></link></para></listitem>
634 <listitem><para><link linkend="HOSTSEQUIV"><parameter>hosts equiv</parameter></link></para></listitem>
635 <listitem><para><link linkend="INTERFACES"><parameter>interfaces</parameter></link></para></listitem>
636 <listitem><para><link linkend="KEEPALIVE"><parameter>keepalive</parameter></link></para></listitem>
637 <listitem><para><link linkend="KERNELOPLOCKS"><parameter>kernel oplocks</parameter></link></para></listitem>
638 <listitem><para><link linkend="LANMANAUTH"><parameter>lanman auth</parameter></link></para></listitem>
639 <listitem><para><link linkend="LARGEREADWRITE"><parameter>large readwrite</parameter></link></para></listitem>
641 <listitem><para><link linkend="LDAPADMINDN"><parameter>ldap admin dn</parameter></link></para></listitem>
642 <listitem><para><link linkend="LDAPFILTER"><parameter>ldap filter</parameter></link></para></listitem>
643 <listitem><para><link linkend="LDAPPORT"><parameter>ldap port</parameter></link></para></listitem>
644 <listitem><para><link linkend="LDAPSERVER"><parameter>ldap server</parameter></link></para></listitem>
645 <listitem><para><link linkend="LDAPSSL"><parameter>ldap ssl</parameter></link></para></listitem>
646 <listitem><para><link linkend="LDAPSUFFIX"><parameter>ldap suffix</parameter></link></para></listitem>
648 <listitem><para><link linkend="LMANNOUNCE"><parameter>lm announce</parameter></link></para></listitem>
649 <listitem><para><link linkend="LMINTERVAL"><parameter>lm interval</parameter></link></para></listitem>
650 <listitem><para><link linkend="LOADPRINTERS"><parameter>load printers</parameter></link></para></listitem>
651 <listitem><para><link linkend="LOCALMASTER"><parameter>local master</parameter></link></para></listitem>
652 <listitem><para><link linkend="LOCKDIR"><parameter>lock dir</parameter></link></para></listitem>
653 <listitem><para><link linkend="LOCKDIRECTORY"><parameter>lock directory</parameter></link></para></listitem>
654 <listitem><para><link linkend="LOGFILE"><parameter>log file</parameter></link></para></listitem>
655 <listitem><para><link linkend="LOGLEVEL"><parameter>log level</parameter></link></para></listitem>
656 <listitem><para><link linkend="LOGONDRIVE"><parameter>logon drive</parameter></link></para></listitem>
657 <listitem><para><link linkend="LOGONHOME"><parameter>logon home</parameter></link></para></listitem>
658 <listitem><para><link linkend="LOGONPATH"><parameter>logon path</parameter></link></para></listitem>
659 <listitem><para><link linkend="LOGONSCRIPT"><parameter>logon script</parameter></link></para></listitem>
660 <listitem><para><link linkend="LPQCACHETIME"><parameter>lpq cache time</parameter></link></para></listitem>
661 <listitem><para><link linkend="MACHINEPASSWORDTIMEOUT"><parameter>machine password timeout</parameter></link></para></listitem>
662 <listitem><para><link linkend="MANGLEDSTACK"><parameter>mangled stack</parameter></link></para></listitem>
663 <listitem><para><link linkend="MAPTOGUEST"><parameter>map to guest</parameter></link></para></listitem>
664 <listitem><para><link linkend="MAXDISKSIZE"><parameter>max disk size</parameter></link></para></listitem>
665 <listitem><para><link linkend="MAXLOGSIZE"><parameter>max log size</parameter></link></para></listitem>
666 <listitem><para><link linkend="MAXMUX"><parameter>max mux</parameter></link></para></listitem>
667 <listitem><para><link linkend="MAXOPENFILES"><parameter>max open files</parameter></link></para></listitem>
668 <listitem><para><link linkend="MAXPROTOCOL"><parameter>max protocol</parameter></link></para></listitem>
669 <listitem><para><link linkend="MAXSMBDPROCESSES"><parameter>max smbd processes</parameter></link></para></listitem>
670 <listitem><para><link linkend="MAXTTL"><parameter>max ttl</parameter></link></para></listitem>
671 <listitem><para><link linkend="MAXWINSTTL"><parameter>max wins ttl</parameter></link></para></listitem>
672 <listitem><para><link linkend="MAXXMIT"><parameter>max xmit</parameter></link></para></listitem>
673 <listitem><para><link linkend="MESSAGECOMMAND"><parameter>message command</parameter></link></para></listitem>
674 <listitem><para><link linkend="MINPASSWDLENGTH"><parameter>min passwd length</parameter></link></para></listitem>
675 <listitem><para><link linkend="MINPASSWORDLENGTH"><parameter>min password length</parameter></link></para></listitem>
676 <listitem><para><link linkend="MINPROTOCOL"><parameter>min protocol</parameter></link></para></listitem>
677 <listitem><para><link linkend="MINWINSTTL"><parameter>min wins ttl</parameter></link></para></listitem>
678 <listitem><para><link linkend="NAMERESOLVEORDER"><parameter>name resolve order</parameter></link></para></listitem>
679 <listitem><para><link linkend="NETBIOSALIASES"><parameter>netbios aliases</parameter></link></para></listitem>
680 <listitem><para><link linkend="NETBIOSNAME"><parameter>netbios name</parameter></link></para></listitem>
681 <listitem><para><link linkend="NETBIOSSCOPE"><parameter>netbios scope</parameter></link></para></listitem>
682 <listitem><para><link linkend="NISHOMEDIR"><parameter>nis homedir</parameter></link></para></listitem>
683 <listitem><para><link linkend="NONUNIXACCOUNTRANGE"><parameter>non unix account range</parameter></link></para></listitem>
684 <listitem><para><link linkend="NTPIPESUPPORT"><parameter>nt pipe support</parameter></link></para></listitem>
685 <listitem><para><link linkend="NULLPASSWORDS"><parameter>null passwords</parameter></link></para></listitem>
686 <listitem><para><link linkend="OBEYPAMRESTRICTIONS"><parameter>obey pam restrictions</parameter></link></para></listitem>
687 <listitem><para><link linkend="OPLOCKBREAKWAITTIME"><parameter>oplock break wait time</parameter></link></para></listitem>
688 <listitem><para><link linkend="OSLEVEL"><parameter>os level</parameter></link></para></listitem>
689 <listitem><para><link linkend="OS2DRIVERMAP"><parameter>os2 driver map</parameter></link></para></listitem>
690 <listitem><para><link linkend="PAMPASSWORDCHANGE"><parameter>pam password change</parameter></link></para></listitem>
691 <listitem><para><link linkend="PANICACTION"><parameter>panic action</parameter></link></para></listitem>
692 <listitem><para><link linkend="PASSDBBACKEND"><parameter>passdb backend</parameter></link></para></listitem>
693 <listitem><para><link linkend="PASSWDCHAT"><parameter>passwd chat</parameter></link></para></listitem>
694 <listitem><para><link linkend="PASSWDCHATDEBUG"><parameter>passwd chat debug</parameter></link></para></listitem>
695 <listitem><para><link linkend="PASSWDPROGRAM"><parameter>passwd program</parameter></link></para></listitem>
696 <listitem><para><link linkend="PASSWORDLEVEL"><parameter>password level</parameter></link></para></listitem>
697 <listitem><para><link linkend="PASSWORDSERVER"><parameter>password server</parameter></link></para></listitem>
698 <listitem><para><link linkend="PREFEREDMASTER"><parameter>prefered master</parameter></link></para></listitem>
699 <listitem><para><link linkend="PREFERREDMASTER"><parameter>preferred master</parameter></link></para></listitem>
700 <listitem><para><link linkend="PRELOAD"><parameter>preload</parameter></link></para></listitem>
701 <listitem><para><link linkend="PRINTCAP"><parameter>printcap</parameter></link></para></listitem>
702 <listitem><para><link linkend="PRINTCAPNAME"><parameter>printcap name</parameter></link></para></listitem>
703 <listitem><para><link linkend="PRINTERDRIVERFILE"><parameter>printer driver file</parameter></link></para></listitem>
704 <listitem><para><link linkend="PROTOCOL"><parameter>protocol</parameter></link></para></listitem>
705 <listitem><para><link linkend="READBMPX"><parameter>read bmpx</parameter></link></para></listitem>
706 <listitem><para><link linkend="READRAW"><parameter>read raw</parameter></link></para></listitem>
707 <listitem><para><link linkend="READSIZE"><parameter>read size</parameter></link></para></listitem>
708 <listitem><para><link linkend="REMOTEANNOUNCE"><parameter>remote announce</parameter></link></para></listitem>
709 <listitem><para><link linkend="REMOTEBROWSESYNC"><parameter>remote browse sync</parameter></link></para></listitem>
710 <listitem><para><link linkend="RESTRICTANONYMOUS"><parameter>restrict anonymous</parameter></link></para></listitem>
711 <listitem><para><link linkend="ROOT"><parameter>root</parameter></link></para></listitem>
712 <listitem><para><link linkend="ROOTDIR"><parameter>root dir</parameter></link></para></listitem>
713 <listitem><para><link linkend="ROOTDIRECTORY"><parameter>root directory</parameter></link></para></listitem>
714 <listitem><para><link linkend="SECURITY"><parameter>security</parameter></link></para></listitem>
715 <listitem><para><link linkend="SERVERSTRING"><parameter>server string</parameter></link></para></listitem>
716 <listitem><para><link linkend="SHOWADDPRINTERWIZARD"><parameter>show add printer wizard</parameter></link></para></listitem>
717 <listitem><para><link linkend="SHUTDOWNSCRIPT"><parameter>shutdown script</parameter></link></para></listitem>
718 <listitem><para><link linkend="SMBPASSWDFILE"><parameter>smb passwd file</parameter></link></para></listitem>
719 <listitem><para><link linkend="SOCKETADDRESS"><parameter>socket address</parameter></link></para></listitem>
720 <listitem><para><link linkend="SOCKETOPTIONS"><parameter>socket options</parameter></link></para></listitem>
721 <listitem><para><link linkend="SOURCEENVIRONMENT"><parameter>source environment</parameter></link></para></listitem>
723 <listitem><para><link linkend="SSL"><parameter>ssl</parameter></link></para></listitem>
724 <listitem><para><link linkend="SSLCACERTDIR"><parameter>ssl CA certDir</parameter></link></para></listitem>
725 <listitem><para><link linkend="SSLCACERTFILE"><parameter>ssl CA certFile</parameter></link></para></listitem>
726 <listitem><para><link linkend="SSLCIPHERS"><parameter>ssl ciphers</parameter></link></para></listitem>
727 <listitem><para><link linkend="SSLCLIENTCERT"><parameter>ssl client cert</parameter></link></para></listitem>
728 <listitem><para><link linkend="SSLCLIENTKEY"><parameter>ssl client key</parameter></link></para></listitem>
729 <listitem><para><link linkend="SSLCOMPATIBILITY"><parameter>ssl compatibility</parameter></link></para></listitem>
730 <listitem><para><link linkend="SSLEGDSOCKET"><parameter>ssl egd socket</parameter></link></para></listitem>
731 <listitem><para><link linkend="SSLENTROPYBYTES"><parameter>ssl entropy bytes</parameter></link></para></listitem>
732 <listitem><para><link linkend="SSLENTROPYFILE"><parameter>ssl entropy file</parameter></link></para></listitem>
733 <listitem><para><link linkend="SSLHOSTS"><parameter>ssl hosts</parameter></link></para></listitem>
734 <listitem><para><link linkend="SSLHOSTSRESIGN"><parameter>ssl hosts resign</parameter></link></para></listitem>
735 <listitem><para><link linkend="SSLREQUIRECLIENTCERT"><parameter>ssl require clientcert</parameter></link></para></listitem>
736 <listitem><para><link linkend="SSLREQUIRESERVERCERT"><parameter>ssl require servercert</parameter></link></para></listitem>
737 <listitem><para><link linkend="SSLSERVERCERT"><parameter>ssl server cert</parameter></link></para></listitem>
738 <listitem><para><link linkend="SSLSERVERKEY"><parameter>ssl server key</parameter></link></para></listitem>
739 <listitem><para><link linkend="SSLVERSION"><parameter>ssl version</parameter></link></para></listitem>
741 <listitem><para><link linkend="STATCACHE"><parameter>stat cache</parameter></link></para></listitem>
742 <listitem><para><link linkend="STATCACHESIZE"><parameter>stat cache size</parameter></link></para></listitem>
743 <listitem><para><link linkend="STRIPDOT"><parameter>strip dot</parameter></link></para></listitem>
744 <listitem><para><link linkend="SYSLOG"><parameter>syslog</parameter></link></para></listitem>
745 <listitem><para><link linkend="SYSLOGONLY"><parameter>syslog only</parameter></link></para></listitem>
746 <listitem><para><link linkend="TEMPLATEHOMEDIR"><parameter>template homedir</parameter></link></para></listitem>
747 <listitem><para><link linkend="TEMPLATESHELL"><parameter>template shell</parameter></link></para></listitem>
748 <listitem><para><link linkend="TIMEOFFSET"><parameter>time offset</parameter></link></para></listitem>
749 <listitem><para><link linkend="TIMESERVER"><parameter>time server</parameter></link></para></listitem>
750 <listitem><para><link linkend="TIMESTAMPLOGS"><parameter>timestamp logs</parameter></link></para></listitem>
751 <listitem><para><link linkend="TOTALPRINTJOBS"><parameter>total print jobs</parameter></link></para></listitem>
752 <listitem><para><link linkend="UNIXPASSWORDSYNC"><parameter>unix password sync</parameter></link></para></listitem>
753 <listitem><para><link linkend="UPDATEENCRYPTED"><parameter>update encrypted</parameter></link></para></listitem>
754 <listitem><para><link linkend="USEMMAP"><parameter>use mmap</parameter></link></para></listitem>
755 <listitem><para><link linkend="USERHOSTS"><parameter>use rhosts</parameter></link></para></listitem>
756 <listitem><para><link linkend="USERNAMELEVEL"><parameter>username level</parameter></link></para></listitem>
757 <listitem><para><link linkend="USERNAMEMAP"><parameter>username map</parameter></link></para></listitem>
758 <listitem><para><link linkend="UTMP"><parameter>utmp</parameter></link></para></listitem>
759 <listitem><para><link linkend="UTMPDIRECTORY"><parameter>utmp directory</parameter></link></para></listitem>
760 <listitem><para><link linkend="VALIDCHARS"><parameter>valid chars</parameter></link></para></listitem>
761 <listitem><para><link linkend="WINBINDCACHETIME"><parameter>winbind cache time</parameter></link></para></listitem>
762 <listitem><para><link linkend="WINBINDENUMUSERS"><parameter>winbind enum users</parameter></link></para></listitem>
763 <listitem><para><link linkend="WINBINDENUMGROUPS"><parameter>winbind enum groups</parameter></link></para></listitem>
764 <listitem><para><link linkend="WINBINDGID"><parameter>winbind gid</parameter></link></para></listitem>
765 <listitem><para><link linkend="WINBINDSEPARATOR"><parameter>winbind separator</parameter></link></para></listitem>
766 <listitem><para><link linkend="WINBINDUID"><parameter>winbind uid</parameter></link></para></listitem>
767 <listitem><para><link linkend="WINBINDUSEDEFAULTDOMAIN"><parameter>winbind use default domain</parameter></link></para></listitem>
768 <listitem><para><link linkend="WINSHOOK"><parameter>wins hook</parameter></link></para></listitem>
769 <listitem><para><link linkend="WINSPROXY"><parameter>wins proxy</parameter></link></para></listitem>
770 <listitem><para><link linkend="WINSSERVER"><parameter>wins server</parameter></link></para></listitem>
771 <listitem><para><link linkend="WINSSUPPORT"><parameter>wins support</parameter></link></para></listitem>
772 <listitem><para><link linkend="WORKGROUP"><parameter>workgroup</parameter></link></para></listitem>
773 <listitem><para><link linkend="WRITERAW"><parameter>write raw</parameter></link></para></listitem>
779 <title>COMPLETE LIST OF SERVICE PARAMETERS</title>
781 <para>Here is a list of all service parameters. See the section on
782 each parameter for details. Note that some are synonyms.</para>
785 <listitem><para><link linkend="ADMINUSERS"><parameter>admin users</parameter></link></para></listitem>
786 <listitem><para><link linkend="ALLOWHOSTS"><parameter>allow hosts</parameter></link></para></listitem>
787 <listitem><para><link linkend="AVAILABLE"><parameter>available</parameter></link></para></listitem>
788 <listitem><para><link linkend="BLOCKINGLOCKS"><parameter>blocking locks</parameter></link></para></listitem>
789 <listitem><para><link linkend="BROWSABLE"><parameter>browsable</parameter></link></para></listitem>
790 <listitem><para><link linkend="BROWSEABLE"><parameter>browseable</parameter></link></para></listitem>
791 <listitem><para><link linkend="CASESENSITIVE"><parameter>case sensitive</parameter></link></para></listitem>
792 <listitem><para><link linkend="CASESIGNAMES"><parameter>casesignames</parameter></link></para></listitem>
793 <listitem><para><link linkend="COMMENT"><parameter>comment</parameter></link></para></listitem>
794 <listitem><para><link linkend="COPY"><parameter>copy</parameter></link></para></listitem>
795 <listitem><para><link linkend="CREATEMASK"><parameter>create mask</parameter></link></para></listitem>
796 <listitem><para><link linkend="CREATEMODE"><parameter>create mode</parameter></link></para></listitem>
797 <listitem><para><link linkend="DEFAULTCASE"><parameter>default case</parameter></link></para></listitem>
798 <listitem><para><link linkend="DELETEREADONLY"><parameter>delete readonly</parameter></link></para></listitem>
799 <listitem><para><link linkend="DELETEVETOFILES"><parameter>delete veto files</parameter></link></para></listitem>
800 <listitem><para><link linkend="DENYHOSTS"><parameter>deny hosts</parameter></link></para></listitem>
801 <listitem><para><link linkend="DIRECTORY"><parameter>directory</parameter></link></para></listitem>
802 <listitem><para><link linkend="DIRECTORYMASK"><parameter>directory mask</parameter></link></para></listitem>
803 <listitem><para><link linkend="DIRECTORYMODE"><parameter>directory mode</parameter></link></para></listitem>
804 <listitem><para><link linkend="DIRECTORYSECURITYMASK"><parameter>directory security mask</parameter></link></para></listitem>
805 <listitem><para><link linkend="DONTDESCEND"><parameter>dont descend</parameter></link></para></listitem>
806 <listitem><para><link linkend="DOSFILEMODE"><parameter>dos filemode</parameter></link></para></listitem>
807 <listitem><para><link linkend="DOSFILETIMERESOLUTION"><parameter>dos filetime resolution</parameter></link></para></listitem>
808 <listitem><para><link linkend="DOSFILETIMES"><parameter>dos filetimes</parameter></link></para></listitem>
809 <listitem><para><link linkend="EXEC"><parameter>exec</parameter></link></para></listitem>
810 <listitem><para><link linkend="FAKEDIRECTORYCREATETIMES"><parameter>fake directory create times</parameter></link></para></listitem>
811 <listitem><para><link linkend="FAKEOPLOCKS"><parameter>fake oplocks</parameter></link></para></listitem>
812 <listitem><para><link linkend="FOLLOWSYMLINKS"><parameter>follow symlinks</parameter></link></para></listitem>
813 <listitem><para><link linkend="FORCECREATEMODE"><parameter>force create mode</parameter></link></para></listitem>
814 <listitem><para><link linkend="FORCEDIRECTORYMODE"><parameter>force directory mode</parameter></link></para></listitem>
815 <listitem><para><link linkend="FORCEDIRECTORYSECURITYMODE"><parameter>force directory security mode</parameter></link></para></listitem>
816 <listitem><para><link linkend="FORCEGROUP"><parameter>force group</parameter></link></para></listitem>
817 <listitem><para><link linkend="FORCESECURITYMODE"><parameter>force security mode</parameter></link></para></listitem>
818 <listitem><para><link linkend="FORCEUSER"><parameter>force user</parameter></link></para></listitem>
819 <listitem><para><link linkend="FSTYPE"><parameter>fstype</parameter></link></para></listitem>
820 <listitem><para><link linkend="GROUP"><parameter>group</parameter></link></para></listitem>
821 <listitem><para><link linkend="GUESTACCOUNT"><parameter>guest account</parameter></link></para></listitem>
822 <listitem><para><link linkend="GUESTOK"><parameter>guest ok</parameter></link></para></listitem>
823 <listitem><para><link linkend="GUESTONLY"><parameter>guest only</parameter></link></para></listitem>
824 <listitem><para><link linkend="HIDEDOTFILES"><parameter>hide dot files</parameter></link></para></listitem>
825 <listitem><para><link linkend="HIDEFILES"><parameter>hide files</parameter></link></para></listitem>
826 <listitem><para><link linkend="HOSTSALLOW"><parameter>hosts allow</parameter></link></para></listitem>
827 <listitem><para><link linkend="HOSTSDENY"><parameter>hosts deny</parameter></link></para></listitem>
828 <listitem><para><link linkend="INCLUDE"><parameter>include</parameter></link></para></listitem>
829 <listitem><para><link linkend="INHERITPERMISSIONS"><parameter>inherit permissions</parameter></link></para></listitem>
830 <listitem><para><link linkend="INVALIDUSERS"><parameter>invalid users</parameter></link></para></listitem>
831 <listitem><para><link linkend="LEVEL2OPLOCKS"><parameter>level2 oplocks</parameter></link></para></listitem>
832 <listitem><para><link linkend="LOCKING"><parameter>locking</parameter></link></para></listitem>
833 <listitem><para><link linkend="LPPAUSECOMMAND"><parameter>lppause command</parameter></link></para></listitem>
834 <listitem><para><link linkend="LPQCOMMAND"><parameter>lpq command</parameter></link></para></listitem>
835 <listitem><para><link linkend="LPRESUMECOMMAND"><parameter>lpresume command</parameter></link></para></listitem>
836 <listitem><para><link linkend="LPRMCOMMAND"><parameter>lprm command</parameter></link></para></listitem>
837 <listitem><para><link linkend="MAGICOUTPUT"><parameter>magic output</parameter></link></para></listitem>
838 <listitem><para><link linkend="MAGICSCRIPT"><parameter>magic script</parameter></link></para></listitem>
839 <listitem><para><link linkend="MANGLECASE"><parameter>mangle case</parameter></link></para></listitem>
840 <listitem><para><link linkend="MANGLEDMAP"><parameter>mangled map</parameter></link></para></listitem>
841 <listitem><para><link linkend="MANGLEDNAMES"><parameter>mangled names</parameter></link></para></listitem>
842 <listitem><para><link linkend="MANGLINGCHAR"><parameter>mangling char</parameter></link></para></listitem>
843 <listitem><para><link linkend="MAPARCHIVE"><parameter>map archive</parameter></link></para></listitem>
844 <listitem><para><link linkend="MAPHIDDEN"><parameter>map hidden</parameter></link></para></listitem>
845 <listitem><para><link linkend="MAPSYSTEM"><parameter>map system</parameter></link></para></listitem>
846 <listitem><para><link linkend="MAXCONNECTIONS"><parameter>max connections</parameter></link></para></listitem>
847 <listitem><para><link linkend="MAXPRINTJOBS"><parameter>max print jobs</parameter></link></para></listitem>
848 <listitem><para><link linkend="MINPRINTSPACE"><parameter>min print space</parameter></link></para></listitem>
849 <listitem><para><link linkend="MSDFSROOT"><parameter>msdfs root</parameter></link></para></listitem>
850 <listitem><para><link linkend="NTACLSUPPORT"><parameter>nt acl support</parameter></link></para></listitem>
851 <listitem><para><link linkend="ONLYGUEST"><parameter>only guest</parameter></link></para></listitem>
852 <listitem><para><link linkend="ONLYUSER"><parameter>only user</parameter></link></para></listitem>
853 <listitem><para><link linkend="OPLOCKCONTENTIONLIMIT"><parameter>oplock contention limit</parameter></link></para></listitem>
854 <listitem><para><link linkend="OPLOCKS"><parameter>oplocks</parameter></link></para></listitem>
855 <listitem><para><link linkend="PATH"><parameter>path</parameter></link></para></listitem>
856 <listitem><para><link linkend="POSIXLOCKING"><parameter>posix locking</parameter></link></para></listitem>
857 <listitem><para><link linkend="POSTEXEC"><parameter>postexec</parameter></link></para></listitem>
858 <listitem><para><link linkend="POSTSCRIPT"><parameter>postscript</parameter></link></para></listitem>
859 <listitem><para><link linkend="PREEXEC"><parameter>preexec</parameter></link></para></listitem>
860 <listitem><para><link linkend="PREEXECCLOSE"><parameter>preexec close</parameter></link></para></listitem>
861 <listitem><para><link linkend="PRESERVECASE"><parameter>preserve case</parameter></link></para></listitem>
862 <listitem><para><link linkend="PRINTCOMMAND"><parameter>print command</parameter></link></para></listitem>
863 <listitem><para><link linkend="PRINTOK"><parameter>print ok</parameter></link></para></listitem>
864 <listitem><para><link linkend="PRINTABLE"><parameter>printable</parameter></link></para></listitem>
865 <listitem><para><link linkend="PRINTER"><parameter>printer</parameter></link></para></listitem>
866 <listitem><para><link linkend="PRINTERADMIN"><parameter>printer admin</parameter></link></para></listitem>
867 <listitem><para><link linkend="PRINTERDRIVER"><parameter>printer driver</parameter></link></para></listitem>
868 <listitem><para><link linkend="PRINTERDRIVERLOCATION"><parameter>printer driver location</parameter></link></para></listitem>
869 <listitem><para><link linkend="PRINTERNAME"><parameter>printer name</parameter></link></para></listitem>
870 <listitem><para><link linkend="PRINTING"><parameter>printing</parameter></link></para></listitem>
871 <listitem><para><link linkend="PUBLIC"><parameter>public</parameter></link></para></listitem>
872 <listitem><para><link linkend="QUEUEPAUSECOMMAND"><parameter>queuepause command</parameter></link></para></listitem>
873 <listitem><para><link linkend="QUEUERESUMECOMMAND"><parameter>queueresume command</parameter></link></para></listitem>
874 <listitem><para><link linkend="READLIST"><parameter>read list</parameter></link></para></listitem>
875 <listitem><para><link linkend="READONLY"><parameter>read only</parameter></link></para></listitem>
876 <listitem><para><link linkend="ROOTPOSTEXEC"><parameter>root postexec</parameter></link></para></listitem>
877 <listitem><para><link linkend="ROOTPREEXEC"><parameter>root preexec</parameter></link></para></listitem>
878 <listitem><para><link linkend="ROOTPREEXECCLOSE"><parameter>root preexec close</parameter></link></para></listitem>
879 <listitem><para><link linkend="SECURITYMASK"><parameter>security mask</parameter></link></para></listitem>
880 <listitem><para><link linkend="SETDIRECTORY"><parameter>set directory</parameter></link></para></listitem>
881 <listitem><para><link linkend="SHORTPRESERVECASE"><parameter>short preserve case</parameter></link></para></listitem>
882 <listitem><para><link linkend="STATUS"><parameter>status</parameter></link></para></listitem>
883 <listitem><para><link linkend="STRICTALLOCATE"><parameter>strict allocate</parameter></link></para></listitem>
884 <listitem><para><link linkend="STRICTLOCKING"><parameter>strict locking</parameter></link></para></listitem>
885 <listitem><para><link linkend="STRICTSYNC"><parameter>strict sync</parameter></link></para></listitem>
886 <listitem><para><link linkend="SYNCALWAYS"><parameter>sync always</parameter></link></para></listitem>
887 <listitem><para><link linkend="USECLIENTDRIVER"><parameter>use client driver</parameter></link></para></listitem>
888 <listitem><para><link linkend="USER"><parameter>user</parameter></link></para></listitem>
889 <listitem><para><link linkend="USERNAME"><parameter>username</parameter></link></para></listitem>
890 <listitem><para><link linkend="USERS"><parameter>users</parameter></link></para></listitem>
891 <listitem><para><link linkend="VALIDUSERS"><parameter>valid users</parameter></link></para></listitem>
892 <listitem><para><link linkend="VETOFILES"><parameter>veto files</parameter></link></para></listitem>
893 <listitem><para><link linkend="VETOOPLOCKFILES"><parameter>veto oplock files</parameter></link></para></listitem>
894 <listitem><para><link linkend="VFSOBJECT"><parameter>vfs object</parameter></link></para></listitem>
895 <listitem><para><link linkend="VFSOPTIONS"><parameter>vfs options</parameter></link></para></listitem>
896 <listitem><para><link linkend="VOLUME"><parameter>volume</parameter></link></para></listitem>
897 <listitem><para><link linkend="WIDELINKS"><parameter>wide links</parameter></link></para></listitem>
898 <listitem><para><link linkend="WRITABLE"><parameter>writable</parameter></link></para></listitem>
899 <listitem><para><link linkend="WRITECACHESIZE"><parameter>write cache size</parameter></link></para></listitem>
900 <listitem><para><link linkend="WRITELIST"><parameter>write list</parameter></link></para></listitem>
901 <listitem><para><link linkend="WRITEOK"><parameter>write ok</parameter></link></para></listitem>
902 <listitem><para><link linkend="WRITEABLE"><parameter>writeable</parameter></link></para></listitem>
908 <title>EXPLANATION OF EACH PARAMETER</title>
913 <term><anchor id="ABORTSHUTDOWNSCRIPT">abort shutdown script (G)</term>
914 <listitem><para><emphasis>This parameter only exists in the HEAD cvs branch</emphasis>
915 This a full path name to a script called by
916 <ulink url="smbd.8.html"><command>smbd(8)</command></ulink> that
917 should stop a shutdown procedure issued by the <link
918 linkend="SHUTDOWNSCRIPT"><parameter>shutdown script</parameter></link>.</para>
920 <para>This command will be run as user.</para>
922 <para>Default: <emphasis>None</emphasis>.</para>
923 <para>Example: <command>abort shutdown script = /sbin/shutdown -c</command></para>
929 <term><anchor id="ADDPRINTERCOMMAND">add printer command (G)</term>
930 <listitem><para>With the introduction of MS-RPC based printing
931 support for Windows NT/2000 clients in Samba 2.2, The MS Add
932 Printer Wizard (APW) icon is now also available in the
933 "Printers..." folder displayed a share listing. The APW
934 allows for printers to be add remotely to a Samba or Windows
935 NT/2000 print server.</para>
937 <para>For a Samba host this means that the printer must be
938 physically added to the underlying printing system. The <parameter>add
939 printer command</parameter> defines a script to be run which
940 will perform the necessary operations for adding the printer
941 to the print system and to add the appropriate service definition
942 to the <filename>smb.conf</filename> file in order that it can be
943 shared by <ulink url="smbd.8.html"><command>smbd(8)</command>
946 <para>The <parameter>add printer command</parameter> is
947 automatically invoked with the following parameter (in
951 <listitem><para><parameter>printer name</parameter></para></listitem>
952 <listitem><para><parameter>share name</parameter></para></listitem>
953 <listitem><para><parameter>port name</parameter></para></listitem>
954 <listitem><para><parameter>driver name</parameter></para></listitem>
955 <listitem><para><parameter>location</parameter></para></listitem>
956 <listitem><para><parameter>Windows 9x driver location</parameter>
960 <para>All parameters are filled in from the PRINTER_INFO_2 structure sent
961 by the Windows NT/2000 client with one exception. The "Windows 9x
962 driver location" parameter is included for backwards compatibility
963 only. The remaining fields in the structure are generated from answers
964 to the APW questions.</para>
966 <para>Once the <parameter>add printer command</parameter> has
967 been executed, <command>smbd</command> will reparse the <filename>
968 smb.conf</filename> to determine if the share defined by the APW
969 exists. If the sharename is still invalid, then <command>smbd
970 </command> will return an ACCESS_DENIED error to the client.</para>
972 <para>See also <link linkend="DELETEPRINTERCOMMAND"><parameter>
973 delete printer command</parameter></link>, <link
974 linkend="printing"><parameter>printing</parameter></link>,
975 <link linkend="SHOWADDPRINTERWIZARD"><parameter>show add
976 printer wizard</parameter></link></para>
978 <para>Default: <emphasis>none</emphasis></para>
979 <para>Example: <command>addprinter command = /usr/bin/addprinter
987 <term><anchor id="ADDSHARECOMMAND">add share command (G)</term>
988 <listitem><para>Samba 2.2.0 introduced the ability to dynamically
989 add and delete shares via the Windows NT 4.0 Server Manager. The
990 <parameter>add share command</parameter> is used to define an
991 external program or script which will add a new service definition
992 to <filename>smb.conf</filename>. In order to successfully
993 execute the <parameter>add share command</parameter>, <command>smbd</command>
994 requires that the administrator be connected using a root account (i.e.
999 When executed, <command>smbd</command> will automatically invoke the
1000 <parameter>add share command</parameter> with four parameters.
1004 <listitem><para><parameter>configFile</parameter> - the location
1005 of the global <filename>smb.conf</filename> file.
1008 <listitem><para><parameter>shareName</parameter> - the name of the new
1012 <listitem><para><parameter>pathName</parameter> - path to an **existing**
1016 <listitem><para><parameter>comment</parameter> - comment string to associate
1022 This parameter is only used for add file shares. To add printer shares,
1023 see the <link linkend="ADDPRINTERCOMMAND"><parameter>add printer
1024 command</parameter></link>.
1028 See also <link linkend="CHANGESHARECOMMAND"><parameter>change share
1029 command</parameter></link>, <link linkend="DELETESHARECOMMAND"><parameter>delete share
1030 command</parameter></link>.
1033 <para>Default: <emphasis>none</emphasis></para>
1034 <para>Example: <command>add share command = /usr/local/bin/addshare</command></para>
1041 <term><anchor id="ADDMACHINESCRIPT">add machine script (G)</term>
1042 <listitem><para>This is the full pathname to a script that will
1043 be run by <ulink url="smbd.8.html">smbd(8)</ulink> when a machine is added
1044 to it's domain using the administrator username and password method. </para>
1046 <para>This option is only required when using sam back-ends tied to the
1047 Unix uid method of RID calculation such as smbpasswd. This option is only
1048 available in Samba 3.0.</para>
1050 <para>Default: <command>add machine script = <empty string>
1053 <para>Example: <command>add machine script = /usr/sbin/adduser -n -g machines -c Machine -d /dev/null -s /bin/false %u
1060 <term><anchor id="ADDUSERSCRIPT">add user script (G)</term>
1061 <listitem><para>This is the full pathname to a script that will
1062 be run <emphasis>AS ROOT</emphasis> by <ulink url="smbd.8.html">smbd(8)
1063 </ulink> under special circumstances described below.</para>
1065 <para>Normally, a Samba server requires that UNIX users are
1066 created for all users accessing files on this server. For sites
1067 that use Windows NT account databases as their primary user database
1068 creating these users and keeping the user list in sync with the
1069 Windows NT PDC is an onerous task. This option allows <ulink
1070 url="smbd.8.html">smbd</ulink> to create the required UNIX users
1071 <emphasis>ON DEMAND</emphasis> when a user accesses the Samba server.</para>
1073 <para>In order to use this option, <ulink url="smbd.8.html">smbd</ulink>
1074 must be set to <parameter>security = server</parameter> or <parameter>
1075 security = domain</parameter> and <parameter>add user script</parameter>
1076 must be set to a full pathname for a script that will create a UNIX
1077 user given one argument of <parameter>%u</parameter>, which expands into
1078 the UNIX user name to create.</para>
1080 <para>When the Windows user attempts to access the Samba server,
1081 at login (session setup in the SMB protocol) time, <ulink url="smbd.8.html">
1082 smbd</ulink> contacts the <parameter>password server</parameter> and
1083 attempts to authenticate the given user with the given password. If the
1084 authentication succeeds then <command>smbd</command>
1085 attempts to find a UNIX user in the UNIX password database to map the
1086 Windows user into. If this lookup fails, and <parameter>add user script
1087 </parameter> is set then <command>smbd</command> will
1088 call the specified script <emphasis>AS ROOT</emphasis>, expanding
1089 any <parameter>%u</parameter> argument to be the user name to create.</para>
1091 <para>If this script successfully creates the user then <command>smbd
1092 </command> will continue on as though the UNIX user
1093 already existed. In this way, UNIX users are dynamically created to
1094 match existing Windows NT accounts.</para>
1096 <para>See also <link linkend="SECURITY"><parameter>
1097 security</parameter></link>, <link linkend="PASSWORDSERVER">
1098 <parameter>password server</parameter></link>,
1099 <link linkend="DELETEUSERSCRIPT"><parameter>delete user
1100 script</parameter></link>.</para>
1102 <para>Default: <command>add user script = <empty string>
1105 <para>Example: <command>add user script = /usr/local/samba/bin/add_user
1113 <term><anchor id="ADMINUSERS">admin users (S)</term>
1114 <listitem><para>This is a list of users who will be granted
1115 administrative privileges on the share. This means that they
1116 will do all file operations as the super-user (root).</para>
1118 <para>You should use this option very carefully, as any user in
1119 this list will be able to do anything they like on the share,
1120 irrespective of file permissions.</para>
1122 <para>Default: <emphasis>no admin users</emphasis></para>
1124 <para>Example: <command>admin users = jason</command></para>
1131 <term><anchor id="ALLOWHOSTS">allow hosts (S)</term>
1132 <listitem><para>Synonym for <link linkend="HOSTSALLOW">
1133 <parameter>hosts allow</parameter></link>.</para></listitem>
1139 <term><anchor id="ALLOWTRUSTEDDOMAINS">allow trusted domains (G)</term>
1140 <listitem><para>This option only takes effect when the <link
1141 linkend="SECURITY"><parameter>security</parameter></link> option is set to
1142 <constant>server</constant> or <constant>domain</constant>.
1143 If it is set to no, then attempts to connect to a resource from
1144 a domain or workgroup other than the one which <ulink url="smbd.8.html">smbd</ulink> is running
1145 in will fail, even if that domain is trusted by the remote server
1146 doing the authentication.</para>
1148 <para>This is useful if you only want your Samba server to
1149 serve resources to users in the domain it is a member of. As
1150 an example, suppose that there are two domains DOMA and DOMB. DOMB
1151 is trusted by DOMA, which contains the Samba server. Under normal
1152 circumstances, a user with an account in DOMB can then access the
1153 resources of a UNIX account with the same account name on the
1154 Samba server even if they do not have an account in DOMA. This
1155 can make implementing a security boundary difficult.</para>
1157 <para>Default: <command>allow trusted domains = yes</command></para>
1165 <term><anchor id="ANNOUNCEAS">announce as (G)</term>
1166 <listitem><para>This specifies what type of server
1167 <ulink url="nmbd.8.html"><command>nmbd</command></ulink>
1168 will announce itself as, to a network neighborhood browse
1169 list. By default this is set to Windows NT. The valid options
1170 are : "NT Server" (which can also be written as "NT"),
1171 "NT Workstation", "Win95" or "WfW" meaning Windows NT Server,
1172 Windows NT Workstation, Windows 95 and Windows for Workgroups
1173 respectively. Do not change this parameter unless you have a
1174 specific need to stop Samba appearing as an NT server as this
1175 may prevent Samba servers from participating as browser servers
1178 <para>Default: <command>announce as = NT Server</command></para>
1180 <para>Example: <command>announce as = Win95</command></para>
1187 <term><anchor id="ANNOUNCEVERSION">announce version (G)</term>
1188 <listitem><para>This specifies the major and minor version numbers
1189 that nmbd will use when announcing itself as a server. The default
1190 is 4.2. Do not change this parameter unless you have a specific
1191 need to set a Samba server to be a downlevel server.</para>
1193 <para>Default: <command>announce version = 4.5</command></para>
1195 <para>Example: <command>announce version = 2.0</command></para>
1202 <term><anchor id="AUTOSERVICES">auto services (G)</term>
1203 <listitem><para>This is a synonym for the <link linkend="PRELOAD">
1204 <parameter>preload</parameter></link>.</para>
1211 <term><anchor id="AUTHMETHODS">auth methods (G)</term>
1212 <listitem><para>This option allows the administrator to chose what
1213 authentication methods <command>smbd</command> will use when authenticating
1214 a user. This option defaults to sensible values based on <link linkend="SECURITY"><parameter>
1215 security</parameter></link>.
1217 Each entry in the list attempts to authenticate the user in turn, until
1218 the user authenticates. In practice only one method will ever actually
1219 be able to complete the authentication.
1222 <para>Default: <command>auth methods = <empty string></command></para>
1223 <para>Example: <command>auth methods = guest sam ntdomain</command></para>
1229 <term><anchor id="AVAILABLE">available (S)</term>
1230 <listitem><para>This parameter lets you "turn off" a service. If
1231 <parameter>available = no</parameter>, then <emphasis>ALL</emphasis>
1232 attempts to connect to the service will fail. Such failures are
1235 <para>Default: <command>available = yes</command></para>
1243 <term><anchor id="BINDINTERFACESONLY">bind interfaces only (G)</term>
1244 <listitem><para>This global parameter allows the Samba admin
1245 to limit what interfaces on a machine will serve SMB requests. If
1246 affects file service <ulink url="smbd.8.html">smbd(8)</ulink> and
1247 name service <ulink url="nmbd.8.html">nmbd(8)</ulink> in slightly
1248 different ways.</para>
1250 <para>For name service it causes <command>nmbd</command> to bind
1251 to ports 137 and 138 on the interfaces listed in the <link
1252 linkend="INTERFACES">interfaces</link> parameter. <command>nmbd
1253 </command> also binds to the "all addresses" interface (0.0.0.0)
1254 on ports 137 and 138 for the purposes of reading broadcast messages.
1255 If this option is not set then <command>nmbd</command> will service
1256 name requests on all of these sockets. If <parameter>bind interfaces
1257 only</parameter> is set then <command>nmbd</command> will check the
1258 source address of any packets coming in on the broadcast sockets
1259 and discard any that don't match the broadcast addresses of the
1260 interfaces in the <parameter>interfaces</parameter> parameter list.
1261 As unicast packets are received on the other sockets it allows
1262 <command>nmbd</command> to refuse to serve names to machines that
1263 send packets that arrive through any interfaces not listed in the
1264 <parameter>interfaces</parameter> list. IP Source address spoofing
1265 does defeat this simple check, however so it must not be used
1266 seriously as a security feature for <command>nmbd</command>.</para>
1268 <para>For file service it causes <ulink url="smbd.8.html">smbd(8)</ulink>
1269 to bind only to the interface list given in the <link linkend="INTERFACES">
1270 interfaces</link> parameter. This restricts the networks that
1271 <command>smbd</command> will serve to packets coming in those
1272 interfaces. Note that you should not use this parameter for machines
1273 that are serving PPP or other intermittent or non-broadcast network
1274 interfaces as it will not cope with non-permanent interfaces.</para>
1276 <para>If <parameter>bind interfaces only</parameter> is set then
1277 unless the network address <emphasis>127.0.0.1</emphasis> is added
1278 to the <parameter>interfaces</parameter> parameter list <ulink
1279 url="smbpasswd.8.html"><command>smbpasswd(8)</command></ulink>
1280 and <ulink url="swat.8.html"><command>swat(8)</command></ulink> may
1281 not work as expected due to the reasons covered below.</para>
1283 <para>To change a users SMB password, the <command>smbpasswd</command>
1284 by default connects to the <emphasis>localhost - 127.0.0.1</emphasis>
1285 address as an SMB client to issue the password change request. If
1286 <parameter>bind interfaces only</parameter> is set then unless the
1287 network address <emphasis>127.0.0.1</emphasis> is added to the
1288 <parameter>interfaces</parameter> parameter list then <command>
1289 smbpasswd</command> will fail to connect in it's default mode.
1290 <command>smbpasswd</command> can be forced to use the primary IP interface
1291 of the local host by using its <ulink url="smbpasswd.8.html#minusr">
1292 <parameter>-r <replaceable>remote machine</replaceable></parameter>
1293 </ulink> parameter, with <replaceable>remote machine</replaceable> set
1294 to the IP name of the primary interface of the local host.</para>
1296 <para>The <command>swat</command> status page tries to connect with
1297 <command>smbd</command> and <command>nmbd</command> at the address
1298 <emphasis>127.0.0.1</emphasis> to determine if they are running.
1299 Not adding <emphasis>127.0.0.1</emphasis> will cause <command>
1300 smbd</command> and <command>nmbd</command> to always show
1301 "not running" even if they really are. This can prevent <command>
1302 swat</command> from starting/stopping/restarting <command>smbd</command>
1303 and <command>nmbd</command>.</para>
1305 <para>Default: <command>bind interfaces only = no</command></para>
1313 <term><anchor id="BLOCKINGLOCKS">blocking locks (S)</term>
1314 <listitem><para>This parameter controls the behavior of <ulink
1315 url="smbd.8.html">smbd(8)</ulink> when given a request by a client
1316 to obtain a byte range lock on a region of an open file, and the
1317 request has a time limit associated with it.</para>
1319 <para>If this parameter is set and the lock range requested
1320 cannot be immediately satisfied, Samba 2.2 will internally
1321 queue the lock request, and periodically attempt to obtain
1322 the lock until the timeout period expires.</para>
1324 <para>If this parameter is set to <constant>false</constant>, then
1325 Samba 2.2 will behave as previous versions of Samba would and
1326 will fail the lock request immediately if the lock range
1327 cannot be obtained.</para>
1329 <para>Default: <command>blocking locks = yes</command></para>
1337 <term><anchor id="BROWSABLE">browsable (S)</term>
1338 <listitem><para>See the <link linkend="BROWSEABLE"><parameter>
1339 browseable</parameter></link>.</para></listitem>
1345 <term><anchor id="BROWSELIST">browse list (G)</term>
1346 <listitem><para>This controls whether <ulink url="smbd.8.html">
1347 <command>smbd(8)</command></ulink> will serve a browse list to
1348 a client doing a <command>NetServerEnum</command> call. Normally
1349 set to <constant>true</constant>. You should never need to change
1352 <para>Default: <command>browse list = yes</command></para></listitem>
1358 <term><anchor id="BROWSEABLE">browseable (S)</term>
1359 <listitem><para>This controls whether this share is seen in
1360 the list of available shares in a net view and in the browse list.</para>
1362 <para>Default: <command>browseable = yes</command></para>
1369 <term><anchor id="CASESENSITIVE">case sensitive (S)</term>
1370 <listitem><para>See the discussion in the section <link
1371 linkend="NAMEMANGLINGSECT">NAME MANGLING</link>.</para>
1373 <para>Default: <command>case sensitive = no</command></para>
1380 <term><anchor id="CASESIGNAMES">casesignames (S)</term>
1381 <listitem><para>Synonym for <link linkend="CASESENSITIVE">case
1382 sensitive</link>.</para></listitem>
1388 <term><anchor id="CHANGENOTIFYTIMEOUT">change notify timeout (G)</term>
1389 <listitem><para>This SMB allows a client to tell a server to
1390 "watch" a particular directory for any changes and only reply to
1391 the SMB request when a change has occurred. Such constant scanning of
1392 a directory is expensive under UNIX, hence an <ulink url="smbd.8.html">
1393 <command>smbd(8)</command></ulink> daemon only performs such a scan
1394 on each requested directory once every <parameter>change notify
1395 timeout</parameter> seconds.</para>
1397 <para>Default: <command>change notify timeout = 60</command></para>
1398 <para>Example: <command>change notify timeout = 300</command></para>
1400 <para>Would change the scan time to every 5 minutes.</para></listitem>
1406 <term><anchor id="CHANGESHARECOMMAND">change share command (G)</term>
1407 <listitem><para>Samba 2.2.0 introduced the ability to dynamically
1408 add and delete shares via the Windows NT 4.0 Server Manager. The
1409 <parameter>change share command</parameter> is used to define an
1410 external program or script which will modify an existing service definition
1411 in <filename>smb.conf</filename>. In order to successfully
1412 execute the <parameter>change share command</parameter>, <command>smbd</command>
1413 requires that the administrator be connected using a root account (i.e.
1418 When executed, <command>smbd</command> will automatically invoke the
1419 <parameter>change share command</parameter> with four parameters.
1423 <listitem><para><parameter>configFile</parameter> - the location
1424 of the global <filename>smb.conf</filename> file.
1427 <listitem><para><parameter>shareName</parameter> - the name of the new
1431 <listitem><para><parameter>pathName</parameter> - path to an **existing**
1435 <listitem><para><parameter>comment</parameter> - comment string to associate
1441 This parameter is only used modify existing file shares definitions. To modify
1442 printer shares, use the "Printers..." folder as seen when browsing the Samba host.
1446 See also <link linkend="ADDSHARECOMMAND"><parameter>add share
1447 command</parameter></link>, <link linkend="DELETESHARECOMMAND"><parameter>delete
1448 share command</parameter></link>.
1451 <para>Default: <emphasis>none</emphasis></para>
1452 <para>Example: <command>change share command = /usr/local/bin/addshare</command></para>
1459 <term><anchor id="CHARACTERSET">character set (G)</term>
1460 <listitem><para>This allows <ulink url="smbd.8.html">smbd</ulink> to map incoming filenames
1461 from a DOS Code page (see the <link linkend="CLIENTCODEPAGE">client
1462 code page</link> parameter) to several built in UNIX character sets.
1463 The built in code page translations are:</para>
1466 <listitem><para><constant>ISO8859-1</constant> : Western European
1467 UNIX character set. The parameter <parameter>client code page</parameter>
1468 <emphasis>MUST</emphasis> be set to code page 850 if the
1469 <parameter>character set</parameter> parameter is set to
1470 <constant>ISO8859-1</constant> in order for the conversion to the
1471 UNIX character set to be done correctly.</para></listitem>
1473 <listitem><para><constant>ISO8859-2</constant> : Eastern European
1474 UNIX character set. The parameter <parameter>client code page
1475 </parameter> <emphasis>MUST</emphasis> be set to code page 852 if
1476 the <parameter> character set</parameter> parameter is set
1477 to <constant>ISO8859-2</constant> in order for the conversion
1478 to the UNIX character set to be done correctly. </para></listitem>
1480 <listitem><para><constant>ISO8859-5</constant> : Russian Cyrillic
1481 UNIX character set. The parameter <parameter>client code page
1482 </parameter> <emphasis>MUST</emphasis> be set to code page
1483 866 if the <parameter>character set </parameter> parameter is
1484 set to <constant>ISO8859-5</constant> in order for the conversion
1485 to the UNIX character set to be done correctly. </para></listitem>
1487 <listitem><para><constant>ISO8859-7</constant> : Greek UNIX
1488 character set. The parameter <parameter>client code page
1489 </parameter> <emphasis>MUST</emphasis> be set to code page
1490 737 if the <parameter>character set</parameter> parameter is
1491 set to <constant>ISO8859-7</constant> in order for the conversion
1492 to the UNIX character set to be done correctly.</para></listitem>
1494 <listitem><para><constant>KOI8-R</constant> : Alternate mapping
1495 for Russian Cyrillic UNIX character set. The parameter
1496 <parameter>client code page</parameter> <emphasis>MUST</emphasis>
1497 be set to code page 866 if the <parameter>character set</parameter>
1498 parameter is set to <constant>KOI8-R</constant> in order for the
1499 conversion to the UNIX character set to be done correctly.</para>
1503 <para><emphasis>BUG</emphasis>. These MSDOS code page to UNIX character
1504 set mappings should be dynamic, like the loading of MS DOS code pages,
1507 <para>Normally this parameter is not set, meaning no filename
1508 translation is done.</para>
1510 <para>Default: <command>character set = <empty string></command></para>
1511 <para>Example: <command>character set = ISO8859-1</command></para></listitem>
1517 <term><anchor id="CLIENTCODEPAGE">client code page (G)</term>
1518 <listitem><para>This parameter specifies the DOS code page
1519 that the clients accessing Samba are using. To determine what code
1520 page a Windows or DOS client is using, open a DOS command prompt
1521 and type the command <command>chcp</command>. This will output
1522 the code page. The default for USA MS-DOS, Windows 95, and
1523 Windows NT releases is code page 437. The default for western
1524 European releases of the above operating systems is code page 850.</para>
1526 <para>This parameter tells <ulink url="smbd.8.html">smbd(8)</ulink>
1527 which of the <filename>codepage.<replaceable>XXX</replaceable>
1528 </filename> files to dynamically load on startup. These files,
1529 described more fully in the manual page <ulink url="make_smbcodepage.1.html">
1530 <command>make_smbcodepage(1)</command></ulink>, tell <command>
1531 smbd</command> how to map lower to upper case characters to provide
1532 the case insensitivity of filenames that Windows clients expect.</para>
1534 <para>Samba currently ships with the following code page files :</para>
1537 <listitem><para>Code Page 437 - MS-DOS Latin US</para></listitem>
1538 <listitem><para>Code Page 737 - Windows '95 Greek</para></listitem>
1539 <listitem><para>Code Page 850 - MS-DOS Latin 1</para></listitem>
1540 <listitem><para>Code Page 852 - MS-DOS Latin 2</para></listitem>
1541 <listitem><para>Code Page 861 - MS-DOS Icelandic</para></listitem>
1542 <listitem><para>Code Page 866 - MS-DOS Cyrillic</para></listitem>
1543 <listitem><para>Code Page 932 - MS-DOS Japanese SJIS</para></listitem>
1544 <listitem><para>Code Page 936 - MS-DOS Simplified Chinese</para></listitem>
1545 <listitem><para>Code Page 949 - MS-DOS Korean Hangul</para></listitem>
1546 <listitem><para>Code Page 950 - MS-DOS Traditional Chinese</para></listitem>
1549 <para>Thus this parameter may have any of the values 437, 737, 850, 852,
1550 861, 932, 936, 949, or 950. If you don't find the codepage you need,
1551 read the comments in one of the other codepage files and the
1552 <command>make_smbcodepage(1)</command> man page and write one. Please
1553 remember to donate it back to the Samba user community.</para>
1555 <para>This parameter co-operates with the <parameter>valid
1556 chars</parameter> parameter in determining what characters are
1557 valid in filenames and how capitalization is done. If you set both
1558 this parameter and the <parameter>valid chars</parameter> parameter
1559 the <parameter>client code page</parameter> parameter
1560 <emphasis>MUST</emphasis> be set before the <parameter>valid
1561 chars</parameter> parameter in the <filename>smb.conf</filename>
1562 file. The <parameter>valid chars</parameter> string will then
1563 augment the character settings in the <parameter>client code page</parameter>
1566 <para>If not set, <parameter>client code page</parameter> defaults
1569 <para>See also : <link linkend="VALIDCHARS"><parameter>valid
1570 chars</parameter></link>, <link linkend="CODEPAGEDIRECTORY">
1571 <parameter>code page directory</parameter></link></para>
1573 <para>Default: <command>client code page = 850</command></para>
1574 <para>Example: <command>client code page = 936</command></para>
1582 <term><anchor id="CODEPAGEDIRECTORY">code page directory (G)</term>
1583 <listitem><para>Define the location of the various client code page
1586 <para>See also <link linkend="CLIENTCODEPAGE"><parameter>client
1587 code page</parameter></link></para>
1589 <para>Default: <command>code page directory = ${prefix}/lib/codepages
1591 <para>Example: <command>code page directory = /usr/share/samba/codepages
1601 <term><anchor id="CODINGSYSTEM">coding system (G)</term>
1602 <listitem><para>This parameter is used to determine how incoming
1603 Shift-JIS Japanese characters are mapped from the incoming <link
1604 linkend="CLIENTCODEPAGE"><parameter>client code page</parameter>
1605 </link> used by the client, into file names in the UNIX filesystem.
1606 Only useful if <parameter>client code page</parameter> is set to
1607 932 (Japanese Shift-JIS). The options are :</para>
1610 <listitem><para><constant>SJIS</constant> - Shift-JIS. Does no
1611 conversion of the incoming filename.</para></listitem>
1613 <listitem><para><constant>JIS8, J8BB, J8BH, J8@B,
1614 J8@J, J8@H </constant> - Convert from incoming Shift-JIS to eight
1615 bit JIS code with different shift-in, shift out codes.</para></listitem>
1617 <listitem><para><constant>JIS7, J7BB, J7BH, J7@B, J7@J,
1618 J7@H </constant> - Convert from incoming Shift-JIS to seven bit
1619 JIS code with different shift-in, shift out codes.</para></listitem>
1621 <listitem><para><constant>JUNET, JUBB, JUBH, JU@B, JU@J, JU@H </constant>
1622 - Convert from incoming Shift-JIS to JUNET code with different shift-in,
1623 shift out codes.</para></listitem>
1625 <listitem><para><constant>EUC</constant> - Convert an incoming
1626 Shift-JIS character to EUC code.</para></listitem>
1628 <listitem><para><constant>HEX</constant> - Convert an incoming
1629 Shift-JIS character to a 3 byte hex representation, i.e.
1630 <constant>:AB</constant>.</para></listitem>
1632 <listitem><para><constant>CAP</constant> - Convert an incoming
1633 Shift-JIS character to the 3 byte hex representation used by
1634 the Columbia AppleTalk Program (CAP), i.e. <constant>:AB</constant>.
1635 This is used for compatibility between Samba and CAP.</para></listitem>
1638 <para>Default: <command>coding system = <empty value></command>
1646 <term><anchor id="COMMENT">comment (S)</term>
1647 <listitem><para>This is a text field that is seen next to a share
1648 when a client does a queries the server, either via the network
1649 neighborhood or via <command>net view</command> to list what shares
1650 are available.</para>
1652 <para>If you want to set the string that is displayed next to the
1653 machine name then see the <link linkend="SERVERSTRING"><parameter>
1654 server string</parameter></link> parameter.</para>
1656 <para>Default: <emphasis>No comment string</emphasis></para>
1657 <para>Example: <command>comment = Fred's Files</command></para></listitem>
1663 <term><anchor id="CONFIGFILE">config file (G)</term>
1664 <listitem><para>This allows you to override the config file
1665 to use, instead of the default (usually <filename>smb.conf</filename>).
1666 There is a chicken and egg problem here as this option is set
1667 in the config file!</para>
1669 <para>For this reason, if the name of the config file has changed
1670 when the parameters are loaded then it will reload them from
1671 the new config file.</para>
1673 <para>This option takes the usual substitutions, which can
1674 be very useful.</para>
1676 <para>If the config file doesn't exist then it won't be loaded
1677 (allowing you to special case the config files of just a few
1680 <para>Example: <command>config file = /usr/local/samba/lib/smb.conf.%m
1681 </command></para></listitem>
1687 <term><anchor id="COPY">copy (S)</term>
1688 <listitem><para>This parameter allows you to "clone" service
1689 entries. The specified service is simply duplicated under the
1690 current service's name. Any parameters specified in the current
1691 section will override those in the section being copied.</para>
1693 <para>This feature lets you set up a 'template' service and
1694 create similar services easily. Note that the service being
1695 copied must occur earlier in the configuration file than the
1696 service doing the copying.</para>
1698 <para>Default: <emphasis>no value</emphasis></para>
1699 <para>Example: <command>copy = otherservice</command></para></listitem>
1705 <term><anchor id="CREATEMASK">create mask (S)</term>
1706 <listitem><para>A synonym for this parameter is
1707 <link linkend="CREATEMODE"><parameter>create mode</parameter>
1710 <para>When a file is created, the necessary permissions are
1711 calculated according to the mapping from DOS modes to UNIX
1712 permissions, and the resulting UNIX mode is then bit-wise 'AND'ed
1713 with this parameter. This parameter may be thought of as a bit-wise
1714 MASK for the UNIX modes of a file. Any bit <emphasis>not</emphasis>
1715 set here will be removed from the modes set on a file when it is
1718 <para>The default value of this parameter removes the
1719 'group' and 'other' write and execute bits from the UNIX modes.</para>
1721 <para>Following this Samba will bit-wise 'OR' the UNIX mode created
1722 from this parameter with the value of the <link
1723 linkend="FORCECREATEMODE"><parameter>force create mode</parameter></link>
1724 parameter which is set to 000 by default.</para>
1726 <para>This parameter does not affect directory modes. See the
1727 parameter <link linkend="DIRECTORYMODE"><parameter>directory mode
1728 </parameter></link> for details.</para>
1730 <para>See also the <link linkend="FORCECREATEMODE"><parameter>force
1731 create mode</parameter></link> parameter for forcing particular mode
1732 bits to be set on created files. See also the <link linkend="DIRECTORYMODE">
1733 <parameter>directory mode</parameter></link> parameter for masking
1734 mode bits on created directories. See also the <link linkend="INHERITPERMISSIONS">
1735 <parameter>inherit permissions</parameter></link> parameter.</para>
1737 <para>Note that this parameter does not apply to permissions
1738 set by Windows NT/2000 ACL editors. If the administrator wishes to enforce
1739 a mask on access control lists also, they need to set the <link
1740 linkend="SECURITYMASK"><parameter>security mask</parameter></link>.</para>
1742 <para>Default: <command>create mask = 0744</command></para>
1743 <para>Example: <command>create mask = 0775</command></para></listitem>
1749 <term><anchor id="CREATEMODE">create mode (S)</term>
1750 <listitem><para>This is a synonym for <link linkend="CREATEMASK"><parameter>
1751 create mask</parameter></link>.</para></listitem>
1757 <term><anchor id="DEADTIME">deadtime (G)</term>
1758 <listitem><para>The value of the parameter (a decimal integer)
1759 represents the number of minutes of inactivity before a connection
1760 is considered dead, and it is disconnected. The deadtime only takes
1761 effect if the number of open files is zero.</para>
1763 <para>This is useful to stop a server's resources being
1764 exhausted by a large number of inactive connections.</para>
1766 <para>Most clients have an auto-reconnect feature when a
1767 connection is broken so in most cases this parameter should be
1768 transparent to users.</para>
1770 <para>Using this parameter with a timeout of a few minutes
1771 is recommended for most systems.</para>
1773 <para>A deadtime of zero indicates that no auto-disconnection
1774 should be performed.</para>
1776 <para>Default: <command>deadtime = 0</command></para>
1777 <para>Example: <command>deadtime = 15</command></para></listitem>
1783 <term><anchor id="DEBUGHIRESTIMESTAMP">debug hires timestamp (G)</term>
1784 <listitem><para>Sometimes the timestamps in the log messages
1785 are needed with a resolution of higher that seconds, this
1786 boolean parameter adds microsecond resolution to the timestamp
1787 message header when turned on.</para>
1789 <para>Note that the parameter <link linkend="DEBUGTIMESTAMP"><parameter>
1790 debug timestamp</parameter></link> must be on for this to have an
1793 <para>Default: <command>debug hires timestamp = no</command></para>
1800 <term><anchor id="DEBUGPID">debug pid (G)</term>
1801 <listitem><para>When using only one log file for more then one
1802 forked <ulink url="smbd.8.html">smbd</ulink>-process there may be hard to follow which process
1803 outputs which message. This boolean parameter is adds the process-id
1804 to the timestamp message headers in the logfile when turned on.</para>
1806 <para>Note that the parameter <link linkend="DEBUGTIMESTAMP"><parameter>
1807 debug timestamp</parameter></link> must be on for this to have an
1810 <para>Default: <command>debug pid = no</command></para></listitem>
1815 <term><anchor id="DEBUGTIMESTAMP">debug timestamp (G)</term>
1816 <listitem><para>Samba 2.2 debug log messages are timestamped
1817 by default. If you are running at a high <link linkend="DEBUGLEVEL">
1818 <parameter>debug level</parameter></link> these timestamps
1819 can be distracting. This boolean parameter allows timestamping
1820 to be turned off.</para>
1822 <para>Default: <command>debug timestamp = yes</command></para></listitem>
1828 <term><anchor id="DEBUGUID">debug uid (G)</term>
1829 <listitem><para>Samba is sometimes run as root and sometime
1830 run as the connected user, this boolean parameter inserts the
1831 current euid, egid, uid and gid to the timestamp message headers
1832 in the log file if turned on.</para>
1834 <para>Note that the parameter <link linkend="DEBUGTIMESTAMP"><parameter>
1835 debug timestamp</parameter></link> must be on for this to have an
1838 <para>Default: <command>debug uid = no</command></para></listitem>
1844 <term><anchor id="DEBUGLEVEL">debuglevel (G)</term>
1845 <listitem><para>Synonym for <link linkend="LOGLEVEL"><parameter>
1846 log level</parameter></link>.</para>
1853 <term><anchor id="DEFAULT">default (G)</term>
1854 <listitem><para>A synonym for <link linkend="DEFAULTSERVICE"><parameter>
1855 default service</parameter></link>.</para></listitem>
1861 <term><anchor id="DEFAULTCASE">default case (S)</term>
1862 <listitem><para>See the section on <link linkend="NAMEMANGLINGSECT">
1863 NAME MANGLING</link>. Also note the <link linkend="SHORTPRESERVECASE">
1864 <parameter>short preserve case</parameter></link> parameter.</para>
1866 <para>Default: <command>default case = lower</command></para>
1873 <term><anchor id="DEFAULTSERVICE">default service (G)</term>
1874 <listitem><para>This parameter specifies the name of a service
1875 which will be connected to if the service actually requested cannot
1876 be found. Note that the square brackets are <emphasis>NOT</emphasis>
1877 given in the parameter value (see example below).</para>
1879 <para>There is no default value for this parameter. If this
1880 parameter is not given, attempting to connect to a nonexistent
1881 service results in an error.</para>
1883 <para>Typically the default service would be a <link linkend="GUESTOK">
1884 <parameter>guest ok</parameter></link>, <link linkend="READONLY">
1885 <parameter>read-only</parameter></link> service.</para>
1887 <para>Also note that the apparent service name will be changed
1888 to equal that of the requested service, this is very useful as it
1889 allows you to use macros like <parameter>%S</parameter> to make
1890 a wildcard service.</para>
1892 <para>Note also that any "_" characters in the name of the service
1893 used in the default service will get mapped to a "/". This allows for
1894 interesting things.</para>
1897 <para>Example:</para>
1899 <para><programlisting>
1901 default service = pub
1905 </programlisting></para>
1912 <term><anchor id="DELETEPRINTERCOMMAND">delete printer command (G)</term>
1913 <listitem><para>With the introduction of MS-RPC based printer
1914 support for Windows NT/2000 clients in Samba 2.2, it is now
1915 possible to delete printer at run time by issuing the
1916 DeletePrinter() RPC call.</para>
1918 <para>For a Samba host this means that the printer must be
1919 physically deleted from underlying printing system. The <parameter>
1920 deleteprinter command</parameter> defines a script to be run which
1921 will perform the necessary operations for removing the printer
1922 from the print system and from <filename>smb.conf</filename>.
1925 <para>The <parameter>delete printer command</parameter> is
1926 automatically called with only one parameter: <parameter>
1927 "printer name"</parameter>.</para>
1930 <para>Once the <parameter>delete printer command</parameter> has
1931 been executed, <command>smbd</command> will reparse the <filename>
1932 smb.conf</filename> to associated printer no longer exists.
1933 If the sharename is still valid, then <command>smbd
1934 </command> will return an ACCESS_DENIED error to the client.</para>
1936 <para>See also <link linkend="ADDPRINTERCOMMAND"><parameter>
1937 add printer command</parameter></link>, <link
1938 linkend="printing"><parameter>printing</parameter></link>,
1939 <link linkend="SHOWADDPRINTERWIZARD"><parameter>show add
1940 printer wizard</parameter></link></para>
1942 <para>Default: <emphasis>none</emphasis></para>
1943 <para>Example: <command>deleteprinter command = /usr/bin/removeprinter
1954 <term><anchor id="DELETEREADONLY">delete readonly (S)</term>
1955 <listitem><para>This parameter allows readonly files to be deleted.
1956 This is not normal DOS semantics, but is allowed by UNIX.</para>
1958 <para>This option may be useful for running applications such
1959 as rcs, where UNIX file ownership prevents changing file
1960 permissions, and DOS semantics prevent deletion of a read only file.</para>
1962 <para>Default: <command>delete readonly = no</command></para></listitem>
1968 <term><anchor id="DELETESHARECOMMAND">delete share command (G)</term>
1969 <listitem><para>Samba 2.2.0 introduced the ability to dynamically
1970 add and delete shares via the Windows NT 4.0 Server Manager. The
1971 <parameter>delete share command</parameter> is used to define an
1972 external program or script which will remove an existing service
1973 definition from <filename>smb.conf</filename>. In order to successfully
1974 execute the <parameter>delete share command</parameter>, <command>smbd</command>
1975 requires that the administrator be connected using a root account (i.e.
1980 When executed, <command>smbd</command> will automatically invoke the
1981 <parameter>delete share command</parameter> with two parameters.
1985 <listitem><para><parameter>configFile</parameter> - the location
1986 of the global <filename>smb.conf</filename> file.
1989 <listitem><para><parameter>shareName</parameter> - the name of
1990 the existing service.
1995 This parameter is only used to remove file shares. To delete printer shares,
1996 see the <link linkend="DELETEPRINTERCOMMAND"><parameter>delete printer
1997 command</parameter></link>.
2001 See also <link linkend="ADDSHARECOMMAND"><parameter>add share
2002 command</parameter></link>, <link linkend="CHANGESHARECOMMAND"><parameter>change
2003 share command</parameter></link>.
2006 <para>Default: <emphasis>none</emphasis></para>
2007 <para>Example: <command>delete share command = /usr/local/bin/delshare</command></para>
2016 <term><anchor id="DELETEUSERSCRIPT">delete user script (G)</term>
2017 <listitem><para>This is the full pathname to a script that will
2018 be run <emphasis>AS ROOT</emphasis> by <ulink url="smbd.8.html">
2019 <command>smbd(8)</command></ulink> under special circumstances
2020 described below.</para>
2022 <para>Normally, a Samba server requires that UNIX users are
2023 created for all users accessing files on this server. For sites
2024 that use Windows NT account databases as their primary user database
2025 creating these users and keeping the user list in sync with the
2026 Windows NT PDC is an onerous task. This option allows <command>
2027 smbd</command> to delete the required UNIX users <emphasis>ON
2028 DEMAND</emphasis> when a user accesses the Samba server and the
2029 Windows NT user no longer exists.</para>
2031 <para>In order to use this option, <command>smbd</command> must be
2032 set to <parameter>security = domain</parameter> and <parameter>delete
2033 user script</parameter> must be set to a full pathname for a script
2034 that will delete a UNIX user given one argument of <parameter>%u
2035 </parameter>, which expands into the UNIX user name to delete.
2036 <emphasis>NOTE</emphasis> that this is different to the <link
2037 linkend="ADDUSERSCRIPT"><parameter>add user script</parameter></link>
2038 which will work with the <parameter>security = server</parameter> option
2039 as well as <parameter>security = domain</parameter>. The reason for this
2040 is only when Samba is a domain member does it get the information
2041 on an attempted user logon that a user no longer exists. In the
2042 <parameter>security = server</parameter> mode a missing user
2043 is treated the same as an invalid password logon attempt. Deleting
2044 the user in this circumstance would not be a good idea.</para>
2046 <para>When the Windows user attempts to access the Samba server,
2047 at <emphasis>login</emphasis> (session setup in the SMB protocol)
2048 time, <command>smbd</command> contacts the <link linkend="PASSWORDSERVER">
2049 <parameter>password server</parameter></link> and attempts to authenticate
2050 the given user with the given password. If the authentication fails
2051 with the specific Domain error code meaning that the user no longer
2052 exists then <command>smbd</command> attempts to find a UNIX user in
2053 the UNIX password database that matches the Windows user account. If
2054 this lookup succeeds, and <parameter>delete user script</parameter> is
2055 set then <command>smbd</command> will all the specified script
2056 <emphasis>AS ROOT</emphasis>, expanding any <parameter>%u</parameter>
2057 argument to be the user name to delete.</para>
2059 <para>This script should delete the given UNIX username. In this way,
2060 UNIX users are dynamically deleted to match existing Windows NT
2063 <para>See also <link linkend="SECURITYEQUALSDOMAIN">security = domain</link>,
2064 <link linkend="PASSWORDSERVER"><parameter>password server</parameter>
2065 </link>, <link linkend="ADDUSERSCRIPT"><parameter>add user script</parameter>
2068 <para>Default: <command>delete user script = <empty string>
2070 <para>Example: <command>delete user script = /usr/local/samba/bin/del_user
2071 %u</command></para></listitem>
2079 <term><anchor id="DELETEVETOFILES">delete veto files (S)</term>
2080 <listitem><para>This option is used when Samba is attempting to
2081 delete a directory that contains one or more vetoed directories
2082 (see the <link linkend="VETOFILES"><parameter>veto files</parameter></link>
2083 option). If this option is set to <constant>false</constant> (the default) then if a vetoed
2084 directory contains any non-vetoed files or directories then the
2085 directory delete will fail. This is usually what you want.</para>
2087 <para>If this option is set to <constant>true</constant>, then Samba
2088 will attempt to recursively delete any files and directories within
2089 the vetoed directory. This can be useful for integration with file
2090 serving systems such as NetAtalk which create meta-files within
2091 directories you might normally veto DOS/Windows users from seeing
2092 (e.g. <filename>.AppleDouble</filename>)</para>
2094 <para>Setting <command>delete veto files = yes</command> allows these
2095 directories to be transparently deleted when the parent directory
2096 is deleted (so long as the user has permissions to do so).</para>
2098 <para>See also the <link linkend="VETOFILES"><parameter>veto
2099 files</parameter></link> parameter.</para>
2101 <para>Default: <command>delete veto files = no</command></para></listitem>
2108 <term><anchor id="DENYHOSTS">deny hosts (S)</term>
2109 <listitem><para>Synonym for <link linkend="HOSTSDENY"><parameter>hosts
2110 deny</parameter></link>.</para></listitem>
2117 <term><anchor id="DFREECOMMAND">dfree command (G)</term>
2118 <listitem><para>The <parameter>dfree command</parameter> setting should
2119 only be used on systems where a problem occurs with the internal
2120 disk space calculations. This has been known to happen with Ultrix,
2121 but may occur with other operating systems. The symptom that was
2122 seen was an error of "Abort Retry Ignore" at the end of each
2123 directory listing.</para>
2125 <para>This setting allows the replacement of the internal routines to
2126 calculate the total disk space and amount available with an external
2127 routine. The example below gives a possible script that might fulfill
2128 this function.</para>
2130 <para>The external program will be passed a single parameter indicating
2131 a directory in the filesystem being queried. This will typically consist
2132 of the string <filename>./</filename>. The script should return two
2133 integers in ASCII. The first should be the total disk space in blocks,
2134 and the second should be the number of available blocks. An optional
2135 third return value can give the block size in bytes. The default
2136 blocksize is 1024 bytes.</para>
2138 <para>Note: Your script should <emphasis>NOT</emphasis> be setuid or
2139 setgid and should be owned by (and writeable only by) root!</para>
2141 <para>Default: <emphasis>By default internal routines for
2142 determining the disk capacity and remaining space will be used.
2145 <para>Example: <command>dfree command = /usr/local/samba/bin/dfree
2148 <para>Where the script dfree (which must be made executable) could be:</para>
2150 <para><programlisting>
2152 df $1 | tail -1 | awk '{print $2" "$4}'
2153 </programlisting></para>
2155 <para>or perhaps (on Sys V based systems):</para>
2157 <para><programlisting>
2159 /usr/bin/df -k $1 | tail -1 | awk '{print $3" "$5}'
2160 </programlisting></para>
2162 <para>Note that you may have to replace the command names
2163 with full path names on some systems.</para>
2171 <term><anchor id="DIRECTORY">directory (S)</term>
2172 <listitem><para>Synonym for <link linkend="PATH"><parameter>path
2173 </parameter></link>.</para></listitem>
2179 <term><anchor id="DIRECTORYMASK">directory mask (S)</term>
2180 <listitem><para>This parameter is the octal modes which are
2181 used when converting DOS modes to UNIX modes when creating UNIX
2184 <para>When a directory is created, the necessary permissions are
2185 calculated according to the mapping from DOS modes to UNIX permissions,
2186 and the resulting UNIX mode is then bit-wise 'AND'ed with this
2187 parameter. This parameter may be thought of as a bit-wise MASK for
2188 the UNIX modes of a directory. Any bit <emphasis>not</emphasis> set
2189 here will be removed from the modes set on a directory when it is
2192 <para>The default value of this parameter removes the 'group'
2193 and 'other' write bits from the UNIX mode, allowing only the
2194 user who owns the directory to modify it.</para>
2196 <para>Following this Samba will bit-wise 'OR' the UNIX mode
2197 created from this parameter with the value of the <link
2198 linkend="FORCEDIRECTORYMODE"><parameter>force directory mode
2199 </parameter></link> parameter. This parameter is set to 000 by
2200 default (i.e. no extra mode bits are added).</para>
2202 <para>Note that this parameter does not apply to permissions
2203 set by Windows NT/2000 ACL editors. If the administrator wishes to enforce
2204 a mask on access control lists also, they need to set the <link
2205 linkend="DIRECTORYSECURITYMASK"><parameter>directory security mask</parameter></link>.</para>
2207 <para>See the <link linkend="FORCEDIRECTORYMODE"><parameter>force
2208 directory mode</parameter></link> parameter to cause particular mode
2209 bits to always be set on created directories.</para>
2211 <para>See also the <link linkend="CREATEMODE"><parameter>create mode
2212 </parameter></link> parameter for masking mode bits on created files,
2213 and the <link linkend="DIRECTORYSECURITYMASK"><parameter>directory
2214 security mask</parameter></link> parameter.</para>
2216 <para>Also refer to the <link linkend="INHERITPERMISSIONS"><parameter>
2217 inherit permissions</parameter></link> parameter.</para>
2219 <para>Default: <command>directory mask = 0755</command></para>
2220 <para>Example: <command>directory mask = 0775</command></para>
2227 <term><anchor id="DIRECTORYMODE">directory mode (S)</term>
2228 <listitem><para>Synonym for <link linkend="DIRECTORYMASK"><parameter>
2229 directory mask</parameter></link></para></listitem>
2235 <term><anchor id="DIRECTORYSECURITYMASK">directory security mask (S)</term>
2236 <listitem><para>This parameter controls what UNIX permission bits
2237 can be modified when a Windows NT client is manipulating the UNIX
2238 permission on a directory using the native NT security dialog
2241 <para>This parameter is applied as a mask (AND'ed with) to
2242 the changed permission bits, thus preventing any bits not in
2243 this mask from being modified. Essentially, zero bits in this
2244 mask may be treated as a set of bits the user is not allowed
2247 <para>If not set explicitly this parameter is set to 0777
2248 meaning a user is allowed to modify all the user/group/world
2249 permissions on a directory.</para>
2251 <para><emphasis>Note</emphasis> that users who can access the
2252 Samba server through other means can easily bypass this restriction,
2253 so it is primarily useful for standalone "appliance" systems.
2254 Administrators of most normal systems will probably want to leave
2255 it as the default of <constant>0777</constant>.</para>
2257 <para>See also the <link linkend="FORCEDIRECTORYSECURITYMODE"><parameter>
2258 force directory security mode</parameter></link>, <link
2259 linkend="SECURITYMASK"><parameter>security mask</parameter></link>,
2260 <link linkend="FORCESECURITYMODE"><parameter>force security mode
2261 </parameter></link> parameters.</para>
2263 <para>Default: <command>directory security mask = 0777</command></para>
2264 <para>Example: <command>directory security mask = 0700</command></para>
2271 <term><anchor id="DISABLESPOOLSS">disable spoolss (G)</term>
2272 <listitem><para>Enabling this parameter will disables Samba's support
2273 for the SPOOLSS set of MS-RPC's and will yield identical behavior
2274 as Samba 2.0.x. Windows NT/2000 clients will downgrade to using
2275 Lanman style printing commands. Windows 9x/ME will be uneffected by
2276 the parameter. However, this will also disable the ability to upload
2277 printer drivers to a Samba server via the Windows NT Add Printer
2278 Wizard or by using the NT printer properties dialog window. It will
2279 also disable the capability of Windows NT/2000 clients to download
2280 print drivers from the Samba host upon demand.
2281 <emphasis>Be very careful about enabling this parameter.</emphasis>
2284 <para>See also <link linkend="USECLIENTDRIVER">use client driver</link>
2287 <para>Default : <command>disable spoolss = no</command></para>
2294 <term><anchor id="DNSPROXY">dns proxy (G)</term>
2295 <listitem><para>Specifies that <ulink url="nmbd.8.html">nmbd(8)</ulink>
2296 when acting as a WINS server and finding that a NetBIOS name has not
2297 been registered, should treat the NetBIOS name word-for-word as a DNS
2298 name and do a lookup with the DNS server for that name on behalf of
2299 the name-querying client.</para>
2301 <para>Note that the maximum length for a NetBIOS name is 15
2302 characters, so the DNS name (or DNS alias) can likewise only be
2303 15 characters, maximum.</para>
2305 <para><command>nmbd</command> spawns a second copy of itself to do the
2306 DNS name lookup requests, as doing a name lookup is a blocking
2309 <para>See also the parameter <link linkend="WINSSUPPORT"><parameter>
2310 wins support</parameter></link>.</para>
2312 <para>Default: <command>dns proxy = yes</command></para></listitem>
2318 <term><anchor id="DOMAINADMINGROUP">domain admin group (G)</term>
2319 <listitem><para>This parameter is intended as a temporary solution
2320 to enable users to be a member of the "Domain Admins" group when
2321 a Samba host is acting as a PDC. A complete solution will be provided
2322 by a system for mapping Windows NT/2000 groups onto UNIX groups.
2323 Please note that this parameter has a somewhat confusing name. It
2324 accepts a list of usernames and of group names in standard
2325 <filename>smb.conf</filename> notation.
2328 <para>See also <link linkend="DOMAINGUESTGROUP"><parameter>domain
2329 guest group</parameter></link>, <link linkend="DOMAINLOGONS"><parameter>domain
2330 logons</parameter></link>
2333 <para>Default: <emphasis>no domain administrators</emphasis></para>
2334 <para>Example: <command>domain admin group = root @wheel</command></para>
2342 <term><anchor id="DOMAINGUESTGROUP">domain guest group (G)</term>
2343 <listitem><para>This parameter is intended as a temporary solution
2344 to enable users to be a member of the "Domain Guests" group when
2345 a Samba host is acting as a PDC. A complete solution will be provided
2346 by a system for mapping Windows NT/2000 groups onto UNIX groups.
2347 Please note that this parameter has a somewhat confusing name. It
2348 accepts a list of usernames and of group names in standard
2349 <filename>smb.conf</filename> notation.
2352 <para>See also <link linkend="DOMAINADMINGROUP"><parameter>domain
2353 admin group</parameter></link>, <link linkend="DOMAINLOGONS"><parameter>domain
2354 logons</parameter></link>
2357 <para>Default: <emphasis>no domain guests</emphasis></para>
2358 <para>Example: <command>domain guest group = nobody @guest</command></para>
2364 <term><anchor id="DOMAINLOGONS">domain logons (G)</term>
2365 <listitem><para>If set to <constant>true</constant>, the Samba server will serve
2366 Windows 95/98 Domain logons for the <link linkend="WORKGROUP">
2367 <parameter>workgroup</parameter></link> it is in. Samba 2.2 also
2368 has limited capability to act as a domain controller for Windows
2369 NT 4 Domains. For more details on setting up this feature see
2370 the Samba-PDC-HOWTO included in the <filename>htmldocs/</filename>
2371 directory shipped with the source code.</para>
2373 <para>Default: <command>domain logons = no</command></para></listitem>
2379 <term><anchor id="DOMAINMASTER">domain master (G)</term>
2380 <listitem><para>Tell <ulink url="nmbd.8.html"><command>
2381 nmbd(8)</command></ulink> to enable WAN-wide browse list
2382 collation. Setting this option causes <command>nmbd</command> to
2383 claim a special domain specific NetBIOS name that identifies
2384 it as a domain master browser for its given <link linkend="WORKGROUP">
2385 <parameter>workgroup</parameter></link>. Local master browsers
2386 in the same <parameter>workgroup</parameter> on broadcast-isolated
2387 subnets will give this <command>nmbd</command> their local browse lists,
2388 and then ask <ulink url="smbd.8.html"><command>smbd(8)</command></ulink>
2389 for a complete copy of the browse list for the whole wide area
2390 network. Browser clients will then contact their local master browser,
2391 and will receive the domain-wide browse list, instead of just the list
2392 for their broadcast-isolated subnet.</para>
2394 <para>Note that Windows NT Primary Domain Controllers expect to be
2395 able to claim this <parameter>workgroup</parameter> specific special
2396 NetBIOS name that identifies them as domain master browsers for
2397 that <parameter>workgroup</parameter> by default (i.e. there is no
2398 way to prevent a Windows NT PDC from attempting to do this). This
2399 means that if this parameter is set and <command>nmbd</command> claims
2400 the special name for a <parameter>workgroup</parameter> before a Windows
2401 NT PDC is able to do so then cross subnet browsing will behave
2402 strangely and may fail.</para>
2404 <para>If <link linkend="DOMAINLOGONS"><command>domain logons = yes</command>
2405 </link>, then the default behavior is to enable the <parameter>domain
2406 master</parameter> parameter. If <parameter>domain logons</parameter> is
2407 not enabled (the default setting), then neither will <parameter>domain
2408 master</parameter> be enabled by default.</para>
2410 <para>Default: <command>domain master = auto</command></para></listitem>
2417 <term><anchor id="DONTDESCEND">dont descend (S)</term>
2418 <listitem><para>There are certain directories on some systems
2419 (e.g., the <filename>/proc</filename> tree under Linux) that are either not
2420 of interest to clients or are infinitely deep (recursive). This
2421 parameter allows you to specify a comma-delimited list of directories
2422 that the server should always show as empty.</para>
2424 <para>Note that Samba can be very fussy about the exact format
2425 of the "dont descend" entries. For example you may need <filename>
2426 ./proc</filename> instead of just <filename>/proc</filename>.
2427 Experimentation is the best policy :-) </para>
2429 <para>Default: <emphasis>none (i.e., all directories are OK
2430 to descend)</emphasis></para>
2431 <para>Example: <command>dont descend = /proc,/dev</command></para>
2438 <term><anchor id="DOSFILEMODE">dos filemode (S)</term>
2439 <listitem><para> The default behavior in Samba is to provide
2440 UNIX-like behavior where only the owner of a file/directory is
2441 able to change the permissions on it. However, this behavior
2442 is often confusing to DOS/Windows users. Enabling this parameter
2443 allows a user who has write access to the file (by whatever
2444 means) to modify the permissions on it. Note that a user
2445 belonging to the group owning the file will not be allowed to
2446 change permissions if the group is only granted read access.
2447 Ownership of the file/directory is not changed, only the permissions
2448 are modified.</para>
2450 <para>Default: <command>dos filemode = no</command></para>
2457 <term><anchor id="DOSFILETIMERESOLUTION">dos filetime resolution (S)</term>
2458 <listitem><para>Under the DOS and Windows FAT filesystem, the finest
2459 granularity on time resolution is two seconds. Setting this parameter
2460 for a share causes Samba to round the reported time down to the
2461 nearest two second boundary when a query call that requires one second
2462 resolution is made to <ulink url="smbd.8.html"><command>smbd(8)</command>
2465 <para>This option is mainly used as a compatibility option for Visual
2466 C++ when used against Samba shares. If oplocks are enabled on a
2467 share, Visual C++ uses two different time reading calls to check if a
2468 file has changed since it was last read. One of these calls uses a
2469 one-second granularity, the other uses a two second granularity. As
2470 the two second call rounds any odd second down, then if the file has a
2471 timestamp of an odd number of seconds then the two timestamps will not
2472 match and Visual C++ will keep reporting the file has changed. Setting
2473 this option causes the two timestamps to match, and Visual C++ is
2476 <para>Default: <command>dos filetime resolution = no</command></para>
2483 <term><anchor id="DOSFILETIMES">dos filetimes (S)</term>
2484 <listitem><para>Under DOS and Windows, if a user can write to a
2485 file they can change the timestamp on it. Under POSIX semantics,
2486 only the owner of the file or root may change the timestamp. By
2487 default, Samba runs with POSIX semantics and refuses to change the
2488 timestamp on a file if the user <command>smbd</command> is acting
2489 on behalf of is not the file owner. Setting this option to <constant>
2490 true</constant> allows DOS semantics and <ulink url="smbd.8.html">smbd</ulink> will change the file
2491 timestamp as DOS requires.</para>
2493 <para>Default: <command>dos filetimes = no</command></para></listitem>
2499 <term><anchor id="ENCRYPTPASSWORDS">encrypt passwords (G)</term>
2500 <listitem><para>This boolean controls whether encrypted passwords
2501 will be negotiated with the client. Note that Windows NT 4.0 SP3 and
2502 above and also Windows 98 will by default expect encrypted passwords
2503 unless a registry entry is changed. To use encrypted passwords in
2504 Samba see the file ENCRYPTION.txt in the Samba documentation
2505 directory <filename>docs/</filename> shipped with the source code.</para>
2507 <para>In order for encrypted passwords to work correctly
2508 <ulink url="smbd.8.html"><command>smbd(8)</command></ulink> must either
2509 have access to a local <ulink url="smbpasswd.5.html"><filename>smbpasswd(5)
2510 </filename></ulink> file (see the <ulink url="smbpasswd.8.html"><command>
2511 smbpasswd(8)</command></ulink> program for information on how to set up
2512 and maintain this file), or set the <link
2513 linkend="SECURITY">security = [server|domain|ads]</link> parameter which
2514 causes <command>smbd</command> to authenticate against another
2517 <para>Default: <command>encrypt passwords = yes</command></para></listitem>
2522 <term><anchor id="ENHANCEDBROWSING">enhanced browsing (G)</term>
2523 <listitem><para>This option enables a couple of enhancements to
2524 cross-subnet browse propagation that have been added in Samba
2525 but which are not standard in Microsoft implementations.
2528 <para>The first enhancement to browse propagation consists of a regular
2529 wildcard query to a Samba WINS server for all Domain Master Browsers,
2530 followed by a browse synchronization with each of the returned
2531 DMBs. The second enhancement consists of a regular randomised browse
2532 synchronization with all currently known DMBs.</para>
2534 <para>You may wish to disable this option if you have a problem with empty
2535 workgroups not disappearing from browse lists. Due to the restrictions
2536 of the browse protocols these enhancements can cause a empty workgroup
2537 to stay around forever which can be annoying.</para>
2539 <para>In general you should leave this option enabled as it makes
2540 cross-subnet browse propagation much more reliable.</para>
2542 <para>Default: <command>enhanced browsing = yes</command></para>
2548 <term><anchor id="ENUMPORTSCOMMAND">enumports command (G)</term>
2549 <listitem><para>The concept of a "port" is fairly foreign
2550 to UNIX hosts. Under Windows NT/2000 print servers, a port
2551 is associated with a port monitor and generally takes the form of
2552 a local port (i.e. LPT1:, COM1:, FILE:) or a remote port
2553 (i.e. LPD Port Monitor, etc...). By default, Samba has only one
2554 port defined--<constant>"Samba Printer Port"</constant>. Under
2555 Windows NT/2000, all printers must have a valid port name.
2556 If you wish to have a list of ports displayed (<command>smbd
2557 </command> does not use a port name for anything) other than
2558 the default <constant>"Samba Printer Port"</constant>, you
2559 can define <parameter>enumports command</parameter> to point to
2560 a program which should generate a list of ports, one per line,
2561 to standard output. This listing will then be used in response
2562 to the level 1 and 2 EnumPorts() RPC.</para>
2564 <para>Default: <emphasis>no enumports command</emphasis></para>
2565 <para>Example: <command>enumports command = /usr/bin/listports
2571 <term><anchor id="EXEC">exec (S)</term>
2572 <listitem><para>This is a synonym for <link linkend="PREEXEC">
2573 <parameter>preexec</parameter></link>.</para></listitem>
2579 <term><anchor id="FAKEDIRECTORYCREATETIMES">fake directory create times (S)</term>
2580 <listitem><para>NTFS and Windows VFAT file systems keep a create
2581 time for all files and directories. This is not the same as the
2582 ctime - status change time - that Unix keeps, so Samba by default
2583 reports the earliest of the various times Unix does keep. Setting
2584 this parameter for a share causes Samba to always report midnight
2585 1-1-1980 as the create time for directories.</para>
2587 <para>This option is mainly used as a compatibility option for
2588 Visual C++ when used against Samba shares. Visual C++ generated
2589 makefiles have the object directory as a dependency for each object
2590 file, and a make rule to create the directory. Also, when NMAKE
2591 compares timestamps it uses the creation time when examining a
2592 directory. Thus the object directory will be created if it does not
2593 exist, but once it does exist it will always have an earlier
2594 timestamp than the object files it contains.</para>
2596 <para>However, Unix time semantics mean that the create time
2597 reported by Samba will be updated whenever a file is created or
2598 or deleted in the directory. NMAKE finds all object files in
2599 the object directory. The timestamp of the last one built is then
2600 compared to the timestamp of the object directory. If the
2601 directory's timestamp if newer, then all object files
2602 will be rebuilt. Enabling this option
2603 ensures directories always predate their contents and an NMAKE build
2604 will proceed as expected.</para>
2606 <para>Default: <command>fake directory create times = no</command></para>
2613 <term><anchor id="FAKEOPLOCKS">fake oplocks (S)</term>
2614 <listitem><para>Oplocks are the way that SMB clients get permission
2615 from a server to locally cache file operations. If a server grants
2616 an oplock (opportunistic lock) then the client is free to assume
2617 that it is the only one accessing the file and it will aggressively
2618 cache file data. With some oplock types the client may even cache
2619 file open/close operations. This can give enormous performance benefits.
2622 <para>When you set <command>fake oplocks = yes</command>, <ulink
2623 url="smbd.8.html"><command>smbd(8)</command></ulink> will
2624 always grant oplock requests no matter how many clients are using
2627 <para>It is generally much better to use the real <link
2628 linkend="OPLOCKS"><parameter>oplocks</parameter></link> support rather
2629 than this parameter.</para>
2631 <para>If you enable this option on all read-only shares or
2632 shares that you know will only be accessed from one client at a
2633 time such as physically read-only media like CDROMs, you will see
2634 a big performance improvement on many operations. If you enable
2635 this option on shares where multiple clients may be accessing the
2636 files read-write at the same time you can get data corruption. Use
2637 this option carefully!</para>
2639 <para>Default: <command>fake oplocks = no</command></para></listitem>
2645 <term><anchor id="FOLLOWSYMLINKS">follow symlinks (S)</term>
2646 <listitem><para>This parameter allows the Samba administrator
2647 to stop <ulink url="smbd.8.html"><command>smbd(8)</command></ulink>
2648 from following symbolic links in a particular share. Setting this
2649 parameter to <constant>no</constant> prevents any file or directory
2650 that is a symbolic link from being followed (the user will get an
2651 error). This option is very useful to stop users from adding a
2652 symbolic link to <filename>/etc/passwd</filename> in their home
2653 directory for instance. However it will slow filename lookups
2654 down slightly.</para>
2656 <para>This option is enabled (i.e. <command>smbd</command> will
2657 follow symbolic links) by default.</para>
2659 <para>Default: <command>follow symlinks = yes</command></para></listitem>
2665 <term><anchor id="FORCECREATEMODE">force create mode (S)</term>
2666 <listitem><para>This parameter specifies a set of UNIX mode bit
2667 permissions that will <emphasis>always</emphasis> be set on a
2668 file created by Samba. This is done by bitwise 'OR'ing these bits onto
2669 the mode bits of a file that is being created or having its
2670 permissions changed. The default for this parameter is (in octal)
2671 000. The modes in this parameter are bitwise 'OR'ed onto the file
2672 mode after the mask set in the <parameter>create mask</parameter>
2673 parameter is applied.</para>
2675 <para>See also the parameter <link linkend="CREATEMASK"><parameter>create
2676 mask</parameter></link> for details on masking mode bits on files.</para>
2678 <para>See also the <link linkend="INHERITPERMISSIONS"><parameter>inherit
2679 permissions</parameter></link> parameter.</para>
2681 <para>Default: <command>force create mode = 000</command></para>
2682 <para>Example: <command>force create mode = 0755</command></para>
2684 <para>would force all created files to have read and execute
2685 permissions set for 'group' and 'other' as well as the
2686 read/write/execute bits set for the 'user'.</para>
2693 <term><anchor id="FORCEDIRECTORYMODE">force directory mode (S)</term>
2694 <listitem><para>This parameter specifies a set of UNIX mode bit
2695 permissions that will <emphasis>always</emphasis> be set on a directory
2696 created by Samba. This is done by bitwise 'OR'ing these bits onto the
2697 mode bits of a directory that is being created. The default for this
2698 parameter is (in octal) 0000 which will not add any extra permission
2699 bits to a created directory. This operation is done after the mode
2700 mask in the parameter <parameter>directory mask</parameter> is
2703 <para>See also the parameter <link linkend="DIRECTORYMASK"><parameter>
2704 directory mask</parameter></link> for details on masking mode bits
2705 on created directories.</para>
2707 <para>See also the <link linkend="INHERITPERMISSIONS"><parameter>
2708 inherit permissions</parameter></link> parameter.</para>
2710 <para>Default: <command>force directory mode = 000</command></para>
2711 <para>Example: <command>force directory mode = 0755</command></para>
2713 <para>would force all created directories to have read and execute
2714 permissions set for 'group' and 'other' as well as the
2715 read/write/execute bits set for the 'user'.</para>
2722 <term><anchor id="FORCEDIRECTORYSECURITYMODE">force directory
2723 security mode (S)</term>
2724 <listitem><para>This parameter controls what UNIX permission bits
2725 can be modified when a Windows NT client is manipulating the UNIX
2726 permission on a directory using the native NT security dialog box.</para>
2728 <para>This parameter is applied as a mask (OR'ed with) to the
2729 changed permission bits, thus forcing any bits in this mask that
2730 the user may have modified to be on. Essentially, one bits in this
2731 mask may be treated as a set of bits that, when modifying security
2732 on a directory, the user has always set to be 'on'.</para>
2734 <para>If not set explicitly this parameter is 000, which
2735 allows a user to modify all the user/group/world permissions on a
2736 directory without restrictions.</para>
2738 <para><emphasis>Note</emphasis> that users who can access the
2739 Samba server through other means can easily bypass this restriction,
2740 so it is primarily useful for standalone "appliance" systems.
2741 Administrators of most normal systems will probably want to leave
2742 it set as 0000.</para>
2744 <para>See also the <link linkend="DIRECTORYSECURITYMASK"><parameter>
2745 directory security mask</parameter></link>, <link linkend="SECURITYMASK">
2746 <parameter>security mask</parameter></link>,
2747 <link linkend="FORCESECURITYMODE"><parameter>force security mode
2748 </parameter></link> parameters.</para>
2750 <para>Default: <command>force directory security mode = 0</command></para>
2751 <para>Example: <command>force directory security mode = 700</command></para>
2759 <term><anchor id="FORCEGROUP">force group (S)</term>
2760 <listitem><para>This specifies a UNIX group name that will be
2761 assigned as the default primary group for all users connecting
2762 to this service. This is useful for sharing files by ensuring
2763 that all access to files on service will use the named group for
2764 their permissions checking. Thus, by assigning permissions for this
2765 group to the files and directories within this service the Samba
2766 administrator can restrict or allow sharing of these files.</para>
2768 <para>In Samba 2.0.5 and above this parameter has extended
2769 functionality in the following way. If the group name listed here
2770 has a '+' character prepended to it then the current user accessing
2771 the share only has the primary group default assigned to this group
2772 if they are already assigned as a member of that group. This allows
2773 an administrator to decide that only users who are already in a
2774 particular group will create files with group ownership set to that
2775 group. This gives a finer granularity of ownership assignment. For
2776 example, the setting <filename>force group = +sys</filename> means
2777 that only users who are already in group sys will have their default
2778 primary group assigned to sys when accessing this Samba share. All
2779 other users will retain their ordinary primary group.</para>
2781 <para>If the <link linkend="FORCEUSER"><parameter>force user
2782 </parameter></link> parameter is also set the group specified in
2783 <parameter>force group</parameter> will override the primary group
2784 set in <parameter>force user</parameter>.</para>
2786 <para>See also <link linkend="FORCEUSER"><parameter>force
2787 user</parameter></link>.</para>
2789 <para>Default: <emphasis>no forced group</emphasis></para>
2790 <para>Example: <command>force group = agroup</command></para>
2797 <term><anchor id="FORCESECURITYMODE">force security mode (S)</term>
2798 <listitem><para>This parameter controls what UNIX permission
2799 bits can be modified when a Windows NT client is manipulating
2800 the UNIX permission on a file using the native NT security dialog
2803 <para>This parameter is applied as a mask (OR'ed with) to the
2804 changed permission bits, thus forcing any bits in this mask that
2805 the user may have modified to be on. Essentially, one bits in this
2806 mask may be treated as a set of bits that, when modifying security
2807 on a file, the user has always set to be 'on'.</para>
2809 <para>If not set explicitly this parameter is set to 0,
2810 and allows a user to modify all the user/group/world permissions on a file,
2811 with no restrictions.</para>
2813 <para><emphasis>Note</emphasis> that users who can access
2814 the Samba server through other means can easily bypass this restriction,
2815 so it is primarily useful for standalone "appliance" systems.
2816 Administrators of most normal systems will probably want to leave
2817 this set to 0000.</para>
2819 <para>See also the <link linkend="FORCEDIRECTORYSECURITYMODE"><parameter>
2820 force directory security mode</parameter></link>,
2821 <link linkend="DIRECTORYSECURITYMASK"><parameter>directory security
2822 mask</parameter></link>, <link linkend="SECURITYMASK"><parameter>
2823 security mask</parameter></link> parameters.</para>
2825 <para>Default: <command>force security mode = 0</command></para>
2826 <para>Example: <command>force security mode = 700</command></para>
2833 <term><anchor id="FORCEUSER">force user (S)</term>
2834 <listitem><para>This specifies a UNIX user name that will be
2835 assigned as the default user for all users connecting to this service.
2836 This is useful for sharing files. You should also use it carefully
2837 as using it incorrectly can cause security problems.</para>
2839 <para>This user name only gets used once a connection is established.
2840 Thus clients still need to connect as a valid user and supply a
2841 valid password. Once connected, all file operations will be performed
2842 as the "forced user", no matter what username the client connected
2843 as. This can be very useful.</para>
2845 <para>In Samba 2.0.5 and above this parameter also causes the
2846 primary group of the forced user to be used as the primary group
2847 for all file activity. Prior to 2.0.5 the primary group was left
2848 as the primary group of the connecting user (this was a bug).</para>
2850 <para>See also <link linkend="FORCEGROUP"><parameter>force group
2851 </parameter></link></para>
2853 <para>Default: <emphasis>no forced user</emphasis></para>
2854 <para>Example: <command>force user = auser</command></para>
2861 <term><anchor id="FSTYPE">fstype (S)</term>
2862 <listitem><para>This parameter allows the administrator to
2863 configure the string that specifies the type of filesystem a share
2864 is using that is reported by <ulink url="smbd.8.html"><command>smbd(8)
2865 </command></ulink> when a client queries the filesystem type
2866 for a share. The default type is <constant>NTFS</constant> for
2867 compatibility with Windows NT but this can be changed to other
2868 strings such as <constant>Samba</constant> or <constant>FAT
2869 </constant> if required.</para>
2871 <para>Default: <command>fstype = NTFS</command></para>
2872 <para>Example: <command>fstype = Samba</command></para></listitem>
2878 <term><anchor id="GETWDCACHE">getwd cache (G)</term>
2879 <listitem><para>This is a tuning option. When this is enabled a
2880 caching algorithm will be used to reduce the time taken for getwd()
2881 calls. This can have a significant impact on performance, especially
2882 when the <link linkend="WIDELINKS"><parameter>wide links</parameter>
2883 </link>parameter is set to <constant>false</constant>.</para>
2885 <para>Default: <command>getwd cache = yes</command></para>
2892 <term><anchor id="GROUP">group (S)</term>
2893 <listitem><para>Synonym for <link linkend="FORCEGROUP"><parameter>force
2894 group</parameter></link>.</para></listitem>
2900 <term><anchor id="GUESTACCOUNT">guest account (S)</term>
2901 <listitem><para>This is a username which will be used for access
2902 to services which are specified as <link linkend="GUESTOK"><parameter>
2903 guest ok</parameter></link> (see below). Whatever privileges this
2904 user has will be available to any client connecting to the guest service.
2905 Typically this user will exist in the password file, but will not
2906 have a valid login. The user account "ftp" is often a good choice
2907 for this parameter. If a username is specified in a given service,
2908 the specified username overrides this one.</para>
2910 <para>One some systems the default guest account "nobody" may not
2911 be able to print. Use another account in this case. You should test
2912 this by trying to log in as your guest user (perhaps by using the
2913 <command>su -</command> command) and trying to print using the
2914 system print command such as <command>lpr(1)</command> or <command>
2915 lp(1)</command>.</para>
2917 <para>Default: <emphasis>specified at compile time, usually
2918 "nobody"</emphasis></para>
2920 <para>Example: <command>guest account = ftp</command></para></listitem>
2926 <term><anchor id="GUESTOK">guest ok (S)</term>
2927 <listitem><para>If this parameter is <constant>yes</constant> for
2928 a service, then no password is required to connect to the service.
2929 Privileges will be those of the <link linkend="GUESTACCOUNT"><parameter>
2930 guest account</parameter></link>.</para>
2932 <para>See the section below on <link linkend="SECURITY"><parameter>
2933 security</parameter></link> for more information about this option.
2936 <para>Default: <command>guest ok = no</command></para></listitem>
2942 <term><anchor id="GUESTONLY">guest only (S)</term>
2943 <listitem><para>If this parameter is <constant>yes</constant> for
2944 a service, then only guest connections to the service are permitted.
2945 This parameter will have no effect if <link linkend="GUESTOK">
2946 <parameter>guest ok</parameter></link> is not set for the service.</para>
2948 <para>See the section below on <link linkend="SECURITY"><parameter>
2949 security</parameter></link> for more information about this option.
2952 <para>Default: <command>guest only = no</command></para></listitem>
2958 <term><anchor id="HIDEDOTFILES">hide dot files (S)</term>
2959 <listitem><para>This is a boolean parameter that controls whether
2960 files starting with a dot appear as hidden files.</para>
2962 <para>Default: <command>hide dot files = yes</command></para></listitem>
2968 <term><anchor id="HIDEFILES">hide files(S)</term>
2969 <listitem><para>This is a list of files or directories that are not
2970 visible but are accessible. The DOS 'hidden' attribute is applied
2971 to any files or directories that match.</para>
2973 <para>Each entry in the list must be separated by a '/',
2974 which allows spaces to be included in the entry. '*'
2975 and '?' can be used to specify multiple files or directories
2976 as in DOS wildcards.</para>
2978 <para>Each entry must be a Unix path, not a DOS path and must
2979 not include the Unix directory separator '/'.</para>
2981 <para>Note that the case sensitivity option is applicable
2982 in hiding files.</para>
2984 <para>Setting this parameter will affect the performance of Samba,
2985 as it will be forced to check all files and directories for a match
2986 as they are scanned.</para>
2988 <para>See also <link linkend="HIDEDOTFILES"><parameter>hide
2989 dot files</parameter></link>, <link linkend="VETOFILES"><parameter>
2990 veto files</parameter></link> and <link linkend="CASESENSITIVE">
2991 <parameter>case sensitive</parameter></link>.</para>
2993 <para>Default: <emphasis>no file are hidden</emphasis></para>
2994 <para>Example: <command>hide files =
2995 /.*/DesktopFolderDB/TrashFor%m/resource.frk/</command></para>
2997 <para>The above example is based on files that the Macintosh
2998 SMB client (DAVE) available from <ulink url="http://www.thursby.com">
2999 Thursby</ulink> creates for internal use, and also still hides
3000 all files beginning with a dot.</para></listitem>
3006 <term><anchor id="HIDELOCALUSERS">hide local users(G)</term>
3007 <listitem><para>This parameter toggles the hiding of local UNIX
3008 users (root, wheel, floppy, etc) from remote clients.</para>
3010 <para>Default: <command>hide local users = no</command></para></listitem>
3016 <term><anchor id="HIDEUNREADABLE">hide unreadable (S)</term>
3017 <listitem><para>This parameter prevents clients from seeing the
3018 existance of files that cannot be read. Defaults to off.</para>
3020 <para>Default: <command>hide unreadable = no</command></para></listitem>
3026 <term><anchor id="HOMEDIRMAP">homedir map (G)</term>
3027 <listitem><para>If<link linkend="NISHOMEDIR"><parameter>nis homedir
3028 </parameter></link> is <constant>true</constant>, and <ulink
3029 url="smbd.8.html"><command>smbd(8)</command></ulink> is also acting
3030 as a Win95/98 <parameter>logon server</parameter> then this parameter
3031 specifies the NIS (or YP) map from which the server for the user's
3032 home directory should be extracted. At present, only the Sun
3033 auto.home map format is understood. The form of the map is:</para>
3035 <para><command>username server:/some/file/system</command></para>
3037 <para>and the program will extract the servername from before
3038 the first ':'. There should probably be a better parsing system
3039 that copes with different map formats and also Amd (another
3040 automounter) maps.</para>
3042 <para><emphasis>NOTE :</emphasis>A working NIS client is required on
3043 the system for this option to work.</para>
3045 <para>See also <link linkend="NISHOMEDIR"><parameter>nis homedir</parameter>
3046 </link>, <link linkend="DOMAINLOGONS"><parameter>domain logons</parameter>
3049 <para>Default: <command>homedir map = <empty string></command></para>
3050 <para>Example: <command>homedir map = amd.homedir</command></para>
3059 <term><anchor id="HOSTMSDFS">host msdfs (G)</term>
3060 <listitem><para>This boolean parameter is only available
3061 if Samba has been configured and compiled with the <command>
3062 --with-msdfs</command> option. If set to <constant>yes</constant>,
3063 Samba will act as a Dfs server, and allow Dfs-aware clients
3064 to browse Dfs trees hosted on the server.</para>
3066 <para>See also the <link linkend="MSDFSROOT"><parameter>
3067 msdfs root</parameter></link> share level parameter. For
3068 more information on setting up a Dfs tree on Samba,
3069 refer to <ulink url="msdfs_setup.html">msdfs_setup.html</ulink>.
3072 <para>Default: <command>host msdfs = no</command></para>
3078 <term><anchor id="HOSTSALLOW">hosts allow (S)</term>
3079 <listitem><para>A synonym for this parameter is <parameter>allow
3080 hosts</parameter>.</para>
3082 <para>This parameter is a comma, space, or tab delimited
3083 set of hosts which are permitted to access a service.</para>
3085 <para>If specified in the [global] section then it will
3086 apply to all services, regardless of whether the individual
3087 service has a different setting.</para>
3089 <para>You can specify the hosts by name or IP number. For
3090 example, you could restrict access to only the hosts on a
3091 Class C subnet with something like <command>allow hosts = 150.203.5.
3092 </command>. The full syntax of the list is described in the man
3093 page <filename>hosts_access(5)</filename>. Note that this man
3094 page may not be present on your system, so a brief description will
3095 be given here also.</para>
3097 <para>Note that the localhost address 127.0.0.1 will always
3098 be allowed access unless specifically denied by a <link
3099 linkend="HOSTSDENY"><parameter>hosts deny</parameter></link> option.</para>
3101 <para>You can also specify hosts by network/netmask pairs and
3102 by netgroup names if your system supports netgroups. The
3103 <emphasis>EXCEPT</emphasis> keyword can also be used to limit a
3104 wildcard list. The following examples may provide some help:</para>
3106 <para>Example 1: allow all IPs in 150.203.*.*; except one</para>
3108 <para><command>hosts allow = 150.203. EXCEPT 150.203.6.66</command></para>
3110 <para>Example 2: allow hosts that match the given network/netmask</para>
3112 <para><command>hosts allow = 150.203.15.0/255.255.255.0</command></para>
3114 <para>Example 3: allow a couple of hosts</para>
3116 <para><command>hosts allow = lapland, arvidsjaur</command></para>
3118 <para>Example 4: allow only hosts in NIS netgroup "foonet", but
3119 deny access from one particular host</para>
3121 <para><command>hosts allow = @foonet</command></para>
3123 <para><command>hosts deny = pirate</command></para>
3125 <para>Note that access still requires suitable user-level passwords.</para>
3127 <para>See <ulink url="testparm.1.html"><command>testparm(1)</command>
3128 </ulink> for a way of testing your host access to see if it does
3129 what you expect.</para>
3131 <para>Default: <emphasis>none (i.e., all hosts permitted access)
3134 <para>Example: <command>allow hosts = 150.203.5. myhost.mynet.edu.au
3142 <term><anchor id="HOSTSDENY">hosts deny (S)</term>
3143 <listitem><para>The opposite of <parameter>hosts allow</parameter>
3144 - hosts listed here are <emphasis>NOT</emphasis> permitted access to
3145 services unless the specific services have their own lists to override
3146 this one. Where the lists conflict, the <parameter>allow</parameter>
3147 list takes precedence.</para>
3149 <para>Default: <emphasis>none (i.e., no hosts specifically excluded)
3152 <para>Example: <command>hosts deny = 150.203.4. badhost.mynet.edu.au
3153 </command></para></listitem>
3159 <term><anchor id="HOSTSEQUIV">hosts equiv (G)</term>
3160 <listitem><para>If this global parameter is a non-null string,
3161 it specifies the name of a file to read for the names of hosts
3162 and users who will be allowed access without specifying a password.
3165 <para>This is not be confused with <link linkend="HOSTSALLOW">
3166 <parameter>hosts allow</parameter></link> which is about hosts
3167 access to services and is more useful for guest services. <parameter>
3168 hosts equiv</parameter> may be useful for NT clients which will
3169 not supply passwords to Samba.</para>
3171 <para><emphasis>NOTE :</emphasis> The use of <parameter>hosts equiv
3172 </parameter> can be a major security hole. This is because you are
3173 trusting the PC to supply the correct username. It is very easy to
3174 get a PC to supply a false username. I recommend that the
3175 <parameter>hosts equiv</parameter> option be only used if you really
3176 know what you are doing, or perhaps on a home network where you trust
3177 your spouse and kids. And only if you <emphasis>really</emphasis> trust
3180 <para>Default: <emphasis>no host equivalences</emphasis></para>
3181 <para>Example: <command>hosts equiv = /etc/hosts.equiv</command></para>
3188 <term><anchor id="INCLUDE">include (G)</term>
3189 <listitem><para>This allows you to include one config file
3190 inside another. The file is included literally, as though typed
3193 <para>It takes the standard substitutions, except <parameter>%u
3194 </parameter>, <parameter>%P</parameter> and <parameter>%S</parameter>.
3197 <para>Default: <emphasis>no file included</emphasis></para>
3198 <para>Example: <command>include = /usr/local/samba/lib/admin_smb.conf
3199 </command></para></listitem>
3205 <term><anchor id="INHERITPERMISSIONS">inherit permissions (S)</term>
3206 <listitem><para>The permissions on new files and directories
3207 are normally governed by <link linkend="CREATEMASK"><parameter>
3208 create mask</parameter></link>, <link linkend="DIRECTORYMASK">
3209 <parameter>directory mask</parameter></link>, <link
3210 linkend="FORCECREATEMODE"><parameter>force create mode</parameter>
3211 </link> and <link linkend="FORCEDIRECTORYMODE"><parameter>force
3212 directory mode</parameter></link> but the boolean inherit
3213 permissions parameter overrides this.</para>
3215 <para>New directories inherit the mode of the parent directory,
3216 including bits such as setgid.</para>
3218 <para>New files inherit their read/write bits from the parent
3219 directory. Their execute bits continue to be determined by
3220 <link linkend="MAPARCHIVE"><parameter>map archive</parameter>
3221 </link>, <link linkend="MAPHIDDEN"><parameter>map hidden</parameter>
3222 </link> and <link linkend="MAPSYSTEM"><parameter>map system</parameter>
3223 </link> as usual.</para>
3225 <para>Note that the setuid bit is <emphasis>never</emphasis> set via
3226 inheritance (the code explicitly prohibits this).</para>
3228 <para>This can be particularly useful on large systems with
3229 many users, perhaps several thousand, to allow a single [homes]
3230 share to be used flexibly by each user.</para>
3232 <para>See also <link linkend="CREATEMASK"><parameter>create mask
3233 </parameter></link>, <link linkend="DIRECTORYMASK"><parameter>
3234 directory mask</parameter></link>, <link linkend="FORCECREATEMODE">
3235 <parameter>force create mode</parameter></link> and <link
3236 linkend="FORCEDIRECTORYMODE"><parameter>force directory mode</parameter>
3239 <para>Default: <command>inherit permissions = no</command></para>
3246 <term><anchor id="INTERFACES">interfaces (G)</term>
3247 <listitem><para>This option allows you to override the default
3248 network interfaces list that Samba will use for browsing, name
3249 registration and other NBT traffic. By default Samba will query
3250 the kernel for the list of all active interfaces and use any
3251 interfaces except 127.0.0.1 that are broadcast capable.</para>
3253 <para>The option takes a list of interface strings. Each string
3254 can be in any of the following forms:</para>
3257 <listitem><para>a network interface name (such as eth0).
3258 This may include shell-like wildcards so eth* will match
3259 any interface starting with the substring "eth"</para></listitem>
3261 <listitem><para>an IP address. In this case the netmask is
3262 determined from the list of interfaces obtained from the
3263 kernel</para></listitem>
3265 <listitem><para>an IP/mask pair. </para></listitem>
3267 <listitem><para>a broadcast/mask pair.</para></listitem>
3270 <para>The "mask" parameters can either be a bit length (such
3271 as 24 for a C class network) or a full netmask in dotted
3272 decimal form.</para>
3274 <para>The "IP" parameters above can either be a full dotted
3275 decimal IP address or a hostname which will be looked up via
3276 the OS's normal hostname resolution mechanisms.</para>
3278 <para>For example, the following line:</para>
3280 <para><command>interfaces = eth0 192.168.2.10/24 192.168.3.10/255.255.255.0
3283 <para>would configure three network interfaces corresponding
3284 to the eth0 device and IP addresses 192.168.2.10 and 192.168.3.10.
3285 The netmasks of the latter two interfaces would be set to 255.255.255.0.</para>
3287 <para>See also <link linkend="BINDINTERFACESONLY"><parameter>bind
3288 interfaces only</parameter></link>.</para>
3290 <para>Default: <emphasis>all active interfaces except 127.0.0.1
3291 that are broadcast capable</emphasis></para>
3298 <term><anchor id="INVALIDUSERS">invalid users (S)</term>
3299 <listitem><para>This is a list of users that should not be allowed
3300 to login to this service. This is really a <emphasis>paranoid</emphasis>
3301 check to absolutely ensure an improper setting does not breach
3302 your security.</para>
3304 <para>A name starting with a '@' is interpreted as an NIS
3305 netgroup first (if your system supports NIS), and then as a UNIX
3306 group if the name was not found in the NIS netgroup database.</para>
3308 <para>A name starting with '+' is interpreted only
3309 by looking in the UNIX group database. A name starting with
3310 '&' is interpreted only by looking in the NIS netgroup database
3311 (this requires NIS to be working on your system). The characters
3312 '+' and '&' may be used at the start of the name in either order
3313 so the value <parameter>+&group</parameter> means check the
3314 UNIX group database, followed by the NIS netgroup database, and
3315 the value <parameter>&+group</parameter> means check the NIS
3316 netgroup database, followed by the UNIX group database (the
3317 same as the '@' prefix).</para>
3319 <para>The current servicename is substituted for <parameter>%S</parameter>.
3320 This is useful in the [homes] section.</para>
3322 <para>See also <link linkend="VALIDUSERS"><parameter>valid users
3323 </parameter></link>.</para>
3325 <para>Default: <emphasis>no invalid users</emphasis></para>
3326 <para>Example: <command>invalid users = root fred admin @wheel
3334 <term><anchor id="KEEPALIVE">keepalive (G)</term>
3335 <listitem><para>The value of the parameter (an integer) represents
3336 the number of seconds between <parameter>keepalive</parameter>
3337 packets. If this parameter is zero, no keepalive packets will be
3338 sent. Keepalive packets, if sent, allow the server to tell whether
3339 a client is still present and responding.</para>
3341 <para>Keepalives should, in general, not be needed if the socket
3342 being used has the SO_KEEPALIVE attribute set on it (see <link
3343 linkend="SOCKETOPTIONS"><parameter>socket options</parameter></link>).
3344 Basically you should only use this option if you strike difficulties.</para>
3346 <para>Default: <command>keepalive = 300</command></para>
3347 <para>Example: <command>keepalive = 600</command></para>
3354 <term><anchor id="KERNELOPLOCKS">kernel oplocks (G)</term>
3355 <listitem><para>For UNIXes that support kernel based <link
3356 linkend="OPLOCKS"><parameter>oplocks</parameter></link>
3357 (currently only IRIX and the Linux 2.4 kernel), this parameter
3358 allows the use of them to be turned on or off.</para>
3360 <para>Kernel oplocks support allows Samba <parameter>oplocks
3361 </parameter> to be broken whenever a local UNIX process or NFS operation
3362 accesses a file that <ulink url="smbd.8.html"><command>smbd(8)</command>
3363 </ulink> has oplocked. This allows complete data consistency between
3364 SMB/CIFS, NFS and local file access (and is a <emphasis>very</emphasis>
3365 cool feature :-).</para>
3367 <para>This parameter defaults to <constant>on</constant>, but is translated
3368 to a no-op on systems that no not have the necessary kernel support.
3369 You should never need to touch this parameter.</para>
3371 <para>See also the <link linkend="OPLOCKS"><parameter>oplocks</parameter>
3372 </link> and <link linkend="LEVEL2OPLOCKS"><parameter>level2 oplocks
3373 </parameter></link> parameters.</para>
3375 <para>Default: <command>kernel oplocks = yes</command></para>
3383 <term><anchor id="LANMANAUTH">lanman auth (G)</term>
3384 <listitem><para>This parameter determines whether or not <ulink url="smbd.8.html">smbd</ulink> will
3385 attempt to authenticate users using the LANMAN password hash.
3386 If disabled, only clients which support NT password hashes (e.g. Windows
3387 NT/2000 clients, smbclient, etc... but not Windows 95/98 or the MS DOS
3388 network client) will be able to connect to the Samba host.</para>
3390 <para>Default : <command>lanman auth = yes</command></para>
3399 <term><anchor id="LARGEREADWRITE">large readwrite (G)</term>
3400 <listitem><para>This parameter determines whether or not <ulink url="smbd.8.html">smbd</ulink>
3401 supports the new 64k streaming read and write varient SMB requests introduced
3402 with Windows 2000. Note that due to Windows 2000 client redirector bugs
3403 this requires Samba to be running on a 64-bit capable operating system such
3404 as IRIX, Solaris or a Linux 2.4 kernel. Can improve performance by 10% with
3405 Windows 2000 clients. Defaults to off. Not as tested as some other Samba
3409 <para>Default : <command>large readwrite = no</command></para>
3416 <term><anchor id="LDAPADMINDN">ldap admin dn (G)</term>
3417 <listitem><para>This parameter is only available if Samba has been
3418 configure to include the <command>--with-ldapsam</command> option
3419 at compile time. This option should be considered experimental and
3420 under active development.
3424 The <parameter>ldap admin dn</parameter> defines the Distinguished
3425 Name (DN) name used by Samba to contact the <link linkend="LDAPSERVER">ldap
3426 server</link> when retreiving user account information. The <parameter>ldap
3427 admin dn</parameter> is used in conjunction with the admin dn password
3428 stored in the <filename>private/secrets.tdb</filename> file. See the
3429 <ulink url="smbpasswd.8.html"><command>smbpasswd(8)</command></ulink> man
3430 page for more information on how to accmplish this.
3434 <para>Default : <emphasis>none</emphasis></para>
3442 <term><anchor id="LDAPFILTER">ldap filter (G)</term>
3443 <listitem><para>This parameter is only available if Samba has been
3444 configure to include the <command>--with-ldapsam</command> option
3445 at compile time. This option should be considered experimental and
3446 under active development.
3450 This parameter specifies the RFC 2254 compliant LDAP search filter.
3451 The default is to match the login name with the <constant>uid</constant>
3452 attribute for all entries matching the <constant>sambaAccount</constant>
3453 objectclass. Note that this filter should only return one entry.
3457 <para>Default : <command>ldap filter = (&(uid=%u)(objectclass=sambaAccount))</command></para>
3465 <term><anchor id="LDAPPORT">ldap port (G)</term>
3466 <listitem><para>This parameter is only available if Samba has been
3467 configure to include the <command>--with-ldapsam</command> option
3468 at compile time. This option should be considered experimental and
3469 under active development.
3473 This option is used to control the tcp port number used to contact
3474 the <link linkend="LDAPSERVER"><parameter>ldap server</parameter></link>.
3475 The default is to use the stand LDAPS port 636.
3478 <para>See Also: <link linkend="LDAPSSL">ldap ssl</link>
3481 <para>Default : <command>ldap port = 636</command></para>
3489 <term><anchor id="LDAPSERVER">ldap server (G)</term>
3490 <listitem><para>This parameter is only available if Samba has been
3491 configure to include the <command>--with-ldapsam</command> option
3492 at compile time. This option should be considered experimental and
3493 under active development.
3497 This parameter should contains the FQDN of the ldap directory
3498 server which should be queried to locate user account information.
3503 <para>Default : <command>ldap server = localhost</command></para>
3511 <term><anchor id="LDAPSSL">ldap ssl (G)</term>
3512 <listitem><para>This parameter is only available if Samba has been
3513 configure to include the <command>--with-ldapsam</command> option
3514 at compile time. This option should be considered experimental and
3515 under active development.
3519 This option is used to define whether or not Samba should
3520 use SSL when connecting to the <link linkend="LDAPSERVER"><parameter>ldap
3521 server</parameter></link>. This is <emphasis>NOT</emphasis> related to
3522 Samba SSL support which is enabled by specifying the
3523 <command>--with-ssl</command> option to the <filename>configure</filename>
3524 script (see <link linkend="SSL"><parameter>ssl</parameter></link>).
3528 The <parameter>ldap ssl</parameter> can be set to one of three values:
3529 (a) <constant>on</constant> - Always use SSL when contacting the
3530 <parameter>ldap server</parameter>, (b) <constant>off</constant> -
3531 Never use SSL when querying the directory, or (c) <constant>start_tls</constant>
3532 - Use the LDAPv3 StartTLS extended operation
3533 (RFC2830) for communicating with the directory server.
3537 <para>Default : <command>ldap ssl = on</command></para>
3545 <term><anchor id="LDAPSUFFIX">ldap suffix (G)</term>
3546 <listitem><para>This parameter is only available if Samba has been
3547 configure to include the <command>--with-ldapsam</command> option
3548 at compile time. This option should be considered experimental and
3549 under active development.
3554 <para>Default : <emphasis>none</emphasis></para>
3565 <term><anchor id="LEVEL2OPLOCKS">level2 oplocks (S)</term>
3566 <listitem><para>This parameter controls whether Samba supports
3567 level2 (read-only) oplocks on a share.</para>
3569 <para>Level2, or read-only oplocks allow Windows NT clients
3570 that have an oplock on a file to downgrade from a read-write oplock
3571 to a read-only oplock once a second client opens the file (instead
3572 of releasing all oplocks on a second open, as in traditional,
3573 exclusive oplocks). This allows all openers of the file that
3574 support level2 oplocks to cache the file for read-ahead only (ie.
3575 they may not cache writes or lock requests) and increases performance
3576 for many accesses of files that are not commonly written (such as
3577 application .EXE files).</para>
3579 <para>Once one of the clients which have a read-only oplock
3580 writes to the file all clients are notified (no reply is needed
3581 or waited for) and told to break their oplocks to "none" and
3582 delete any read-ahead caches.</para>
3584 <para>It is recommended that this parameter be turned on
3585 to speed access to shared executables.</para>
3587 <para>For more discussions on level2 oplocks see the CIFS spec.</para>
3589 <para>Currently, if <link linkend="KERNELOPLOCKS"><parameter>kernel
3590 oplocks</parameter></link> are supported then level2 oplocks are
3591 not granted (even if this parameter is set to <constant>yes</constant>).
3592 Note also, the <link linkend="OPLOCKS"><parameter>oplocks</parameter>
3593 </link> parameter must be set to <constant>true</constant> on this share in order for
3594 this parameter to have any effect.</para>
3596 <para>See also the <link linkend="OPLOCKS"><parameter>oplocks</parameter>
3597 </link> and <link linkend="OPLOCKS"><parameter>kernel oplocks</parameter>
3598 </link> parameters.</para>
3600 <para>Default: <command>level2 oplocks = yes</command></para>
3609 <term><anchor id="LMANNOUNCE">lm announce (G)</term>
3610 <listitem><para>This parameter determines if <ulink url="nmbd.8.html">
3611 <command>nmbd(8)</command></ulink> will produce Lanman announce
3612 broadcasts that are needed by OS/2 clients in order for them to see
3613 the Samba server in their browse list. This parameter can have three
3614 values, <constant>true</constant>, <constant>false</constant>, or
3615 <constant>auto</constant>. The default is <constant>auto</constant>.
3616 If set to <constant>false</constant> Samba will never produce these
3617 broadcasts. If set to <constant>true</constant> Samba will produce
3618 Lanman announce broadcasts at a frequency set by the parameter
3619 <parameter>lm interval</parameter>. If set to <constant>auto</constant>
3620 Samba will not send Lanman announce broadcasts by default but will
3621 listen for them. If it hears such a broadcast on the wire it will
3622 then start sending them at a frequency set by the parameter
3623 <parameter>lm interval</parameter>.</para>
3625 <para>See also <link linkend="LMINTERVAL"><parameter>lm interval
3626 </parameter></link>.</para>
3628 <para>Default: <command>lm announce = auto</command></para>
3629 <para>Example: <command>lm announce = yes</command></para>
3636 <term><anchor id="LMINTERVAL">lm interval (G)</term>
3637 <listitem><para>If Samba is set to produce Lanman announce
3638 broadcasts needed by OS/2 clients (see the <link linkend="LMANNOUNCE">
3639 <parameter>lm announce</parameter></link> parameter) then this
3640 parameter defines the frequency in seconds with which they will be
3641 made. If this is set to zero then no Lanman announcements will be
3642 made despite the setting of the <parameter>lm announce</parameter>
3645 <para>See also <link linkend="LMANNOUNCE"><parameter>lm
3646 announce</parameter></link>.</para>
3648 <para>Default: <command>lm interval = 60</command></para>
3649 <para>Example: <command>lm interval = 120</command></para>
3656 <term><anchor id="LOADPRINTERS">load printers (G)</term>
3657 <listitem><para>A boolean variable that controls whether all
3658 printers in the printcap will be loaded for browsing by default.
3659 See the <link linkend="PRINTERSSECT">printers</link> section for
3660 more details.</para>
3662 <para>Default: <command>load printers = yes</command></para></listitem>
3669 <term><anchor id="LOCALMASTER">local master (G)</term>
3670 <listitem><para>This option allows <ulink url="nmbd.8.html"><command>
3671 nmbd(8)</command></ulink> to try and become a local master browser
3672 on a subnet. If set to <constant>false</constant> then <command>
3673 nmbd</command> will not attempt to become a local master browser
3674 on a subnet and will also lose in all browsing elections. By
3675 default this value is set to <constant>true</constant>. Setting this value to <constant>true</constant> doesn't
3676 mean that Samba will <emphasis>become</emphasis> the local master
3677 browser on a subnet, just that <command>nmbd</command> will <emphasis>
3678 participate</emphasis> in elections for local master browser.</para>
3680 <para>Setting this value to <constant>false</constant> will cause <command>nmbd</command>
3681 <emphasis>never</emphasis> to become a local master browser.</para>
3683 <para>Default: <command>local master = yes</command></para>
3690 <term><anchor id="LOCKDIR">lock dir (G)</term>
3691 <listitem><para>Synonym for <link linkend="LOCKDIRECTORY"><parameter>
3692 lock directory</parameter></link>.</para></listitem>
3698 <term><anchor id="LOCKDIRECTORY">lock directory (G)</term>
3699 <listitem><para>This option specifies the directory where lock
3700 files will be placed. The lock files are used to implement the
3701 <link linkend="MAXCONNECTIONS"><parameter>max connections</parameter>
3702 </link> option.</para>
3704 <para>Default: <command>lock directory = ${prefix}/var/locks</command></para>
3705 <para>Example: <command>lock directory = /var/run/samba/locks</command>
3712 <term><anchor id="LOCKING">locking (S)</term>
3713 <listitem><para>This controls whether or not locking will be
3714 performed by the server in response to lock requests from the
3717 <para>If <command>locking = no</command>, all lock and unlock
3718 requests will appear to succeed and all lock queries will report
3719 that the file in question is available for locking.</para>
3721 <para>If <command>locking = yes</command>, real locking will be performed
3722 by the server.</para>
3724 <para>This option <emphasis>may</emphasis> be useful for read-only
3725 filesystems which <emphasis>may</emphasis> not need locking (such as
3726 CDROM drives), although setting this parameter of <constant>no</constant>
3727 is not really recommended even in this case.</para>
3729 <para>Be careful about disabling locking either globally or in a
3730 specific service, as lack of locking may result in data corruption.
3731 You should never need to set this parameter.</para>
3733 <para>Default: <command>locking = yes</command></para>
3740 <term><anchor id="LOGFILE">log file (G)</term>
3741 <listitem><para>This option allows you to override the name
3742 of the Samba log file (also known as the debug file).</para>
3744 <para>This option takes the standard substitutions, allowing
3745 you to have separate log files for each user or machine.</para>
3747 <para>Example: <command>log file = /usr/local/samba/var/log.%m
3748 </command></para></listitem>
3754 <term><anchor id="LOGLEVEL">log level (G)</term>
3755 <listitem><para>The value of the parameter (an integer) allows
3756 the debug level (logging level) to be specified in the
3757 <filename>smb.conf</filename> file. This is to give greater
3758 flexibility in the configuration of the system.</para>
3760 <para>The default will be the log level specified on
3761 the command line or level zero if none was specified.</para>
3763 <para>Example: <command>log level = 3</command></para></listitem>
3769 <term><anchor id="LOGONDRIVE">logon drive (G)</term>
3770 <listitem><para>This parameter specifies the local path to
3771 which the home directory will be connected (see <link
3772 linkend="LOGONHOME"><parameter>logon home</parameter></link>)
3773 and is only used by NT Workstations. </para>
3775 <para>Note that this option is only useful if Samba is set up as a
3776 logon server.</para>
3778 <para>Default: <command>logon drive = z:</command></para>
3779 <para>Example: <command>logon drive = h:</command></para>
3786 <term><anchor id="LOGONHOME">logon home (G)</term>
3787 <listitem><para>This parameter specifies the home directory
3788 location when a Win95/98 or NT Workstation logs into a Samba PDC.
3789 It allows you to do </para>
3791 <para><prompt>C:\> </prompt><userinput>NET USE H: /HOME</userinput>
3794 <para>from a command prompt, for example.</para>
3796 <para>This option takes the standard substitutions, allowing
3797 you to have separate logon scripts for each user or machine.</para>
3799 <para>This parameter can be used with Win9X workstations to ensure
3800 that roaming profiles are stored in a subdirectory of the user's
3801 home directory. This is done in the following way:</para>
3803 <para><command>logon home = \\%N\%U\profile</command></para>
3805 <para>This tells Samba to return the above string, with
3806 substitutions made when a client requests the info, generally
3807 in a NetUserGetInfo request. Win9X clients truncate the info to
3808 \\server\share when a user does <command>net use /home</command>
3809 but use the whole string when dealing with profiles.</para>
3811 <para>Note that in prior versions of Samba, the <link linkend="LOGONPATH">
3812 <parameter>logon path</parameter></link> was returned rather than
3813 <parameter>logon home</parameter>. This broke <command>net use
3814 /home</command> but allowed profiles outside the home directory.
3815 The current implementation is correct, and can be used for
3816 profiles if you use the above trick.</para>
3818 <para>This option is only useful if Samba is set up as a logon
3821 <para>Default: <command>logon home = "\\%N\%U"</command></para>
3822 <para>Example: <command>logon home = "\\remote_smb_server\%U"</command>
3828 <term><anchor id="LOGONPATH">logon path (G)</term>
3829 <listitem><para>This parameter specifies the home directory
3830 where roaming profiles (NTuser.dat etc files for Windows NT) are
3831 stored. Contrary to previous versions of these manual pages, it has
3832 nothing to do with Win 9X roaming profiles. To find out how to
3833 handle roaming profiles for Win 9X system, see the <link linkend="LOGONHOME">
3834 <parameter>logon home</parameter></link> parameter.</para>
3836 <para>This option takes the standard substitutions, allowing you
3837 to have separate logon scripts for each user or machine. It also
3838 specifies the directory from which the "Application Data",
3839 (<filename>desktop</filename>, <filename>start menu</filename>,
3840 <filename>network neighborhood</filename>, <filename>programs</filename>
3841 and other folders, and their contents, are loaded and displayed on
3842 your Windows NT client.</para>
3844 <para>The share and the path must be readable by the user for
3845 the preferences and directories to be loaded onto the Windows NT
3846 client. The share must be writeable when the user logs in for the first
3847 time, in order that the Windows NT client can create the NTuser.dat
3848 and other directories.</para>
3850 <para>Thereafter, the directories and any of the contents can,
3851 if required, be made read-only. It is not advisable that the
3852 NTuser.dat file be made read-only - rename it to NTuser.man to
3853 achieve the desired effect (a <emphasis>MAN</emphasis>datory
3856 <para>Windows clients can sometimes maintain a connection to
3857 the [homes] share, even though there is no user logged in.
3858 Therefore, it is vital that the logon path does not include a
3859 reference to the homes share (i.e. setting this parameter to
3860 \%N\%U\profile_path will cause problems).</para>
3862 <para>This option takes the standard substitutions, allowing
3863 you to have separate logon scripts for each user or machine.</para>
3865 <para>Note that this option is only useful if Samba is set up
3866 as a logon server.</para>
3868 <para>Default: <command>logon path = \\%N\%U\profile</command></para>
3869 <para>Example: <command>logon path = \\PROFILESERVER\PROFILE\%U</command></para>
3876 <term><anchor id="LOGONSCRIPT">logon script (G)</term>
3877 <listitem><para>This parameter specifies the batch file (.bat) or
3878 NT command file (.cmd) to be downloaded and run on a machine when
3879 a user successfully logs in. The file must contain the DOS
3880 style CR/LF line endings. Using a DOS-style editor to create the
3881 file is recommended.</para>
3883 <para>The script must be a relative path to the [netlogon]
3884 service. If the [netlogon] service specifies a <link linkend="PATH">
3885 <parameter>path</parameter></link> of <filename>/usr/local/samba/netlogon
3886 </filename>, and <command>logon script = STARTUP.BAT</command>, then
3887 the file that will be downloaded is:</para>
3889 <para><filename>/usr/local/samba/netlogon/STARTUP.BAT</filename></para>
3891 <para>The contents of the batch file are entirely your choice. A
3892 suggested command would be to add <command>NET TIME \\SERVER /SET
3893 /YES</command>, to force every machine to synchronize clocks with
3894 the same time server. Another use would be to add <command>NET USE
3895 U: \\SERVER\UTILS</command> for commonly used utilities, or <command>
3896 NET USE Q: \\SERVER\ISO9001_QA</command> for example.</para>
3898 <para>Note that it is particularly important not to allow write
3899 access to the [netlogon] share, or to grant users write permission
3900 on the batch files in a secure environment, as this would allow
3901 the batch files to be arbitrarily modified and security to be
3904 <para>This option takes the standard substitutions, allowing you
3905 to have separate logon scripts for each user or machine.</para>
3907 <para>This option is only useful if Samba is set up as a logon
3910 <para>Default: <emphasis>no logon script defined</emphasis></para>
3911 <para>Example: <command>logon script = scripts\%U.bat</command></para>
3918 <term><anchor id="LPPAUSECOMMAND">lppause command (S)</term>
3919 <listitem><para>This parameter specifies the command to be
3920 executed on the server host in order to stop printing or spooling
3921 a specific print job.</para>
3923 <para>This command should be a program or script which takes
3924 a printer name and job number to pause the print job. One way
3925 of implementing this is by using job priorities, where jobs
3926 having a too low priority won't be sent to the printer.</para>
3928 <para>If a <parameter>%p</parameter> is given then the printer name
3929 is put in its place. A <parameter>%j</parameter> is replaced with
3930 the job number (an integer). On HPUX (see <parameter>printing=hpux
3931 </parameter>), if the <parameter>-p%p</parameter> option is added
3932 to the lpq command, the job will show up with the correct status, i.e.
3933 if the job priority is lower than the set fence priority it will
3934 have the PAUSED status, whereas if the priority is equal or higher it
3935 will have the SPOOLED or PRINTING status.</para>
3937 <para>Note that it is good practice to include the absolute path
3938 in the lppause command as the PATH may not be available to the server.</para>
3940 <para>See also the <link linkend="PRINTING"><parameter>printing
3941 </parameter></link> parameter.</para>
3943 <para>Default: Currently no default value is given to
3944 this string, unless the value of the <parameter>printing</parameter>
3945 parameter is <constant>SYSV</constant>, in which case the default is :</para>
3947 <para><command>lp -i %p-%j -H hold</command></para>
3949 <para>or if the value of the <parameter>printing</parameter> parameter
3950 is <constant>SOFTQ</constant>, then the default is:</para>
3952 <para><command>qstat -s -j%j -h</command></para>
3954 <para>Example for HPUX: <command>lppause command = /usr/bin/lpalt
3955 %p-%j -p0</command></para>
3962 <term><anchor id="LPQCACHETIME">lpq cache time (G)</term>
3963 <listitem><para>This controls how long lpq info will be cached
3964 for to prevent the <command>lpq</command> command being called too
3965 often. A separate cache is kept for each variation of the <command>
3966 lpq</command> command used by the system, so if you use different
3967 <command>lpq</command> commands for different users then they won't
3968 share cache information.</para>
3970 <para>The cache files are stored in <filename>/tmp/lpq.xxxx</filename>
3971 where xxxx is a hash of the <command>lpq</command> command in use.</para>
3973 <para>The default is 10 seconds, meaning that the cached results
3974 of a previous identical <command>lpq</command> command will be used
3975 if the cached data is less than 10 seconds old. A large value may
3976 be advisable if your <command>lpq</command> command is very slow.</para>
3978 <para>A value of 0 will disable caching completely.</para>
3980 <para>See also the <link linkend="PRINTING"><parameter>printing
3981 </parameter></link> parameter.</para>
3983 <para>Default: <command>lpq cache time = 10</command></para>
3984 <para>Example: <command>lpq cache time = 30</command></para>
3991 <term><anchor id="LPQCOMMAND">lpq command (S)</term>
3992 <listitem><para>This parameter specifies the command to be
3993 executed on the server host in order to obtain <command>lpq
3994 </command>-style printer status information.</para>
3996 <para>This command should be a program or script which
3997 takes a printer name as its only parameter and outputs printer
3998 status information.</para>
4000 <para>Currently eight styles of printer status information
4001 are supported; BSD, AIX, LPRNG, PLP, SYSV, HPUX, QNX and SOFTQ.
4002 This covers most UNIX systems. You control which type is expected
4003 using the <parameter>printing =</parameter> option.</para>
4005 <para>Some clients (notably Windows for Workgroups) may not
4006 correctly send the connection number for the printer they are
4007 requesting status information about. To get around this, the
4008 server reports on the first printer service connected to by the
4009 client. This only happens if the connection number sent is invalid.</para>
4011 <para>If a <parameter>%p</parameter> is given then the printer name
4012 is put in its place. Otherwise it is placed at the end of the
4015 <para>Note that it is good practice to include the absolute path
4016 in the <parameter>lpq command</parameter> as the <envar>$PATH
4017 </envar> may not be available to the server.</para>
4019 <para>See also the <link linkend="PRINTING"><parameter>printing
4020 </parameter></link> parameter.</para>
4022 <para>Default: <emphasis>depends on the setting of <parameter>
4023 printing</parameter></emphasis></para>
4025 <para>Example: <command>lpq command = /usr/bin/lpq -P%p</command></para>
4032 <term><anchor id="LPRESUMECOMMAND">lpresume command (S)</term>
4033 <listitem><para>This parameter specifies the command to be
4034 executed on the server host in order to restart or continue
4035 printing or spooling a specific print job.</para>
4037 <para>This command should be a program or script which takes
4038 a printer name and job number to resume the print job. See
4039 also the <link linkend="LPPAUSECOMMAND"><parameter>lppause command
4040 </parameter></link> parameter.</para>
4042 <para>If a <parameter>%p</parameter> is given then the printer name
4043 is put in its place. A <parameter>%j</parameter> is replaced with
4044 the job number (an integer).</para>
4046 <para>Note that it is good practice to include the absolute path
4047 in the <parameter>lpresume command</parameter> as the PATH may not
4048 be available to the server.</para>
4050 <para>See also the <link linkend="PRINTING"><parameter>printing
4051 </parameter></link> parameter.</para>
4053 <para>Default: Currently no default value is given
4054 to this string, unless the value of the <parameter>printing</parameter>
4055 parameter is <constant>SYSV</constant>, in which case the default is :</para>
4057 <para><command>lp -i %p-%j -H resume</command></para>
4059 <para>or if the value of the <parameter>printing</parameter> parameter
4060 is <constant>SOFTQ</constant>, then the default is:</para>
4062 <para><command>qstat -s -j%j -r</command></para>
4064 <para>Example for HPUX: <command>lpresume command = /usr/bin/lpalt
4065 %p-%j -p2</command></para>
4072 <term><anchor id="LPRMCOMMAND">lprm command (S)</term>
4073 <listitem><para>This parameter specifies the command to be
4074 executed on the server host in order to delete a print job.</para>
4076 <para>This command should be a program or script which takes
4077 a printer name and job number, and deletes the print job.</para>
4079 <para>If a <parameter>%p</parameter> is given then the printer name
4080 is put in its place. A <parameter>%j</parameter> is replaced with
4081 the job number (an integer).</para>
4083 <para>Note that it is good practice to include the absolute
4084 path in the <parameter>lprm command</parameter> as the PATH may not be
4085 available to the server.</para>
4087 <para>See also the <link linkend="PRINTING"><parameter>printing
4088 </parameter></link> parameter.</para>
4090 <para>Default: <emphasis>depends on the setting of <parameter>printing
4091 </parameter></emphasis></para>
4093 <para>Example 1: <command>lprm command = /usr/bin/lprm -P%p %j
4095 <para>Example 2: <command>lprm command = /usr/bin/cancel %p-%j
4096 </command></para></listitem>
4102 <term><anchor id="MACHINEPASSWORDTIMEOUT">machine password timeout (G)</term>
4103 <listitem><para>If a Samba server is a member of a Windows
4104 NT Domain (see the <link linkend="SECURITYEQUALSDOMAIN">security = domain</link>)
4105 parameter) then periodically a running <ulink url="smbd.8.html">
4106 smbd(8)</ulink> process will try and change the MACHINE ACCOUNT
4107 PASSWORD stored in the TDB called <filename>private/secrets.tdb
4108 </filename>. This parameter specifies how often this password
4109 will be changed, in seconds. The default is one week (expressed in
4110 seconds), the same as a Windows NT Domain member server.</para>
4112 <para>See also <ulink url="smbpasswd.8.html"><command>smbpasswd(8)
4113 </command></ulink>, and the <link linkend="SECURITYEQUALSDOMAIN">
4114 security = domain</link>) parameter.</para>
4116 <para>Default: <command>machine password timeout = 604800</command></para>
4122 <term><anchor id="MAGICOUTPUT">magic output (S)</term>
4123 <listitem><para>This parameter specifies the name of a file
4124 which will contain output created by a magic script (see the
4125 <link linkend="MAGICSCRIPT"><parameter>magic script</parameter></link>
4126 parameter below).</para>
4128 <para>Warning: If two clients use the same <parameter>magic script
4129 </parameter> in the same directory the output file content
4130 is undefined.</para>
4132 <para>Default: <command>magic output = <magic script name>.out
4135 <para>Example: <command>magic output = myfile.txt</command></para>
4142 <term><anchor id="MAGICSCRIPT">magic script (S)</term>
4143 <listitem><para>This parameter specifies the name of a file which,
4144 if opened, will be executed by the server when the file is closed.
4145 This allows a UNIX script to be sent to the Samba host and
4146 executed on behalf of the connected user.</para>
4148 <para>Scripts executed in this way will be deleted upon
4149 completion assuming that the user has the appropriate level
4150 of privilege and the file permissions allow the deletion.</para>
4152 <para>If the script generates output, output will be sent to
4153 the file specified by the <link linkend="MAGICOUTPUT"><parameter>
4154 magic output</parameter></link> parameter (see above).</para>
4156 <para>Note that some shells are unable to interpret scripts
4157 containing CR/LF instead of CR as
4158 the end-of-line marker. Magic scripts must be executable
4159 <emphasis>as is</emphasis> on the host, which for some hosts and
4160 some shells will require filtering at the DOS end.</para>
4162 <para>Magic scripts are <emphasis>EXPERIMENTAL</emphasis> and
4163 should <emphasis>NOT</emphasis> be relied upon.</para>
4165 <para>Default: <emphasis>None. Magic scripts disabled.</emphasis></para>
4166 <para>Example: <command>magic script = user.csh</command></para>
4173 <term><anchor id="MANGLECASE">mangle case (S)</term>
4174 <listitem><para>See the section on <link linkend="NAMEMANGLINGSECT">
4175 NAME MANGLING</link></para>
4177 <para>Default: <command>mangle case = no</command></para>
4183 <term><anchor id="MANGLEDMAP">mangled map (S)</term>
4184 <listitem><para>This is for those who want to directly map UNIX
4185 file names which cannot be represented on Windows/DOS. The mangling
4186 of names is not always what is needed. In particular you may have
4187 documents with file extensions that differ between DOS and UNIX.
4188 For example, under UNIX it is common to use <filename>.html</filename>
4189 for HTML files, whereas under Windows/DOS <filename>.htm</filename>
4190 is more commonly used.</para>
4192 <para>So to map <filename>html</filename> to <filename>htm</filename>
4193 you would use:</para>
4195 <para><command>mangled map = (*.html *.htm)</command></para>
4197 <para>One very useful case is to remove the annoying <filename>;1
4198 </filename> off the ends of filenames on some CDROMs (only visible
4199 under some UNIXes). To do this use a map of (*;1 *;).</para>
4201 <para>Default: <emphasis>no mangled map</emphasis></para>
4202 <para>Example: <command>mangled map = (*;1 *;)</command></para>
4208 <term><anchor id="MANGLEDNAMES">mangled names (S)</term>
4209 <listitem><para>This controls whether non-DOS names under UNIX
4210 should be mapped to DOS-compatible names ("mangled") and made visible,
4211 or whether non-DOS names should simply be ignored.</para>
4213 <para>See the section on <link linkend="NAMEMANGLINGSECT">
4214 NAME MANGLING</link> for details on how to control the mangling process.</para>
4216 <para>If mangling is used then the mangling algorithm is as follows:</para>
4219 <listitem><para>The first (up to) five alphanumeric characters
4220 before the rightmost dot of the filename are preserved, forced
4221 to upper case, and appear as the first (up to) five characters
4222 of the mangled name.</para></listitem>
4224 <listitem><para>A tilde "~" is appended to the first part of the mangled
4225 name, followed by a two-character unique sequence, based on the
4226 original root name (i.e., the original filename minus its final
4227 extension). The final extension is included in the hash calculation
4228 only if it contains any upper case characters or is longer than three
4231 <para>Note that the character to use may be specified using
4232 the <link linkend="MANGLINGCHAR"><parameter>mangling char</parameter>
4233 </link> option, if you don't like '~'.</para></listitem>
4235 <listitem><para>The first three alphanumeric characters of the final
4236 extension are preserved, forced to upper case and appear as the
4237 extension of the mangled name. The final extension is defined as that
4238 part of the original filename after the rightmost dot. If there are no
4239 dots in the filename, the mangled name will have no extension (except
4240 in the case of "hidden files" - see below).</para></listitem>
4242 <listitem><para>Files whose UNIX name begins with a dot will be
4243 presented as DOS hidden files. The mangled name will be created as
4244 for other filenames, but with the leading dot removed and "___" as
4245 its extension regardless of actual original extension (that's three
4246 underscores).</para></listitem>
4249 <para>The two-digit hash value consists of upper case
4250 alphanumeric characters.</para>
4252 <para>This algorithm can cause name collisions only if files
4253 in a directory share the same first five alphanumeric characters.
4254 The probability of such a clash is 1/1300.</para>
4256 <para>The name mangling (if enabled) allows a file to be
4257 copied between UNIX directories from Windows/DOS while retaining
4258 the long UNIX filename. UNIX files can be renamed to a new extension
4259 from Windows/DOS and will retain the same basename. Mangled names
4260 do not change between sessions.</para>
4262 <para>Default: <command>mangled names = yes</command></para>
4269 <term><anchor id="MANGLEDSTACK">mangled stack (G)</term>
4270 <listitem><para>This parameter controls the number of mangled names
4271 that should be cached in the Samba server <ulink url="smbd.8.html">
4272 smbd(8)</ulink>.</para>
4274 <para>This stack is a list of recently mangled base names
4275 (extensions are only maintained if they are longer than 3 characters
4276 or contains upper case characters).</para>
4278 <para>The larger this value, the more likely it is that mangled
4279 names can be successfully converted to correct long UNIX names.
4280 However, large stack sizes will slow most directory accesses. Smaller
4281 stacks save memory in the server (each stack element costs 256 bytes).
4284 <para>It is not possible to absolutely guarantee correct long
4285 filenames, so be prepared for some surprises!</para>
4287 <para>Default: <command>mangled stack = 50</command></para>
4288 <para>Example: <command>mangled stack = 100</command></para>
4296 <term><anchor id="MANGLINGCHAR">mangling char (S)</term>
4297 <listitem><para>This controls what character is used as
4298 the <emphasis>magic</emphasis> character in <link
4299 linkend="NAMEMANGLINGSECT">name mangling</link>. The default is a '~'
4300 but this may interfere with some software. Use this option to set
4301 it to whatever you prefer.</para>
4303 <para>Default: <command>mangling char = ~</command></para>
4304 <para>Example: <command>mangling char = ^</command></para>
4313 <term><anchor id="MAPARCHIVE">map archive (S)</term>
4314 <listitem><para>This controls whether the DOS archive attribute
4315 should be mapped to the UNIX owner execute bit. The DOS archive bit
4316 is set when a file has been modified since its last backup. One
4317 motivation for this option it to keep Samba/your PC from making
4318 any file it touches from becoming executable under UNIX. This can
4319 be quite annoying for shared source code, documents, etc...</para>
4321 <para>Note that this requires the <parameter>create mask</parameter>
4322 parameter to be set such that owner execute bit is not masked out
4323 (i.e. it must include 100). See the parameter <link linkend="CREATEMASK">
4324 <parameter>create mask</parameter></link> for details.</para>
4326 <para>Default: <command>map archive = yes</command></para>
4333 <term><anchor id="MAPHIDDEN">map hidden (S)</term>
4334 <listitem><para>This controls whether DOS style hidden files
4335 should be mapped to the UNIX world execute bit.</para>
4337 <para>Note that this requires the <parameter>create mask</parameter>
4338 to be set such that the world execute bit is not masked out (i.e.
4339 it must include 001). See the parameter <link linkend="CREATEMASK">
4340 <parameter>create mask</parameter></link> for details.</para>
4342 <para>Default: <command>map hidden = no</command></para>
4348 <term><anchor id="MAPSYSTEM">map system (S)</term>
4349 <listitem><para>This controls whether DOS style system files
4350 should be mapped to the UNIX group execute bit.</para>
4352 <para>Note that this requires the <parameter>create mask</parameter>
4353 to be set such that the group execute bit is not masked out (i.e.
4354 it must include 010). See the parameter <link linkend="CREATEMASK">
4355 <parameter>create mask</parameter></link> for details.</para>
4357 <para>Default: <command>map system = no</command></para>
4363 <term><anchor id="MAPTOGUEST">map to guest (G)</term>
4364 <listitem><para>This parameter is only useful in <link linkend="SECURITY">
4365 security</link> modes other than <parameter>security = share</parameter>
4366 - i.e. <constant>user</constant>, <constant>server</constant>,
4367 and <constant>domain</constant>.</para>
4369 <para>This parameter can take three different values, which tell
4370 <ulink url="smbd.8.html">smbd(8)</ulink> what to do with user
4371 login requests that don't match a valid UNIX user in some way.</para>
4373 <para>The three settings are :</para>
4376 <listitem><para><constant>Never</constant> - Means user login
4377 requests with an invalid password are rejected. This is the
4378 default.</para></listitem>
4380 <listitem><para><constant>Bad User</constant> - Means user
4381 logins with an invalid password are rejected, unless the username
4382 does not exist, in which case it is treated as a guest login and
4383 mapped into the <link linkend="GUESTACCOUNT"><parameter>
4384 guest account</parameter></link>.</para></listitem>
4386 <listitem><para><constant>Bad Password</constant> - Means user logins
4387 with an invalid password are treated as a guest login and mapped
4388 into the <link linkend="GUESTACCOUNT">guest account</link>. Note that
4389 this can cause problems as it means that any user incorrectly typing
4390 their password will be silently logged on as "guest" - and
4391 will not know the reason they cannot access files they think
4392 they should - there will have been no message given to them
4393 that they got their password wrong. Helpdesk services will
4394 <emphasis>hate</emphasis> you if you set the <parameter>map to
4395 guest</parameter> parameter this way :-).</para></listitem>
4398 <para>Note that this parameter is needed to set up "Guest"
4399 share services when using <parameter>security</parameter> modes other than
4400 share. This is because in these modes the name of the resource being
4401 requested is <emphasis>not</emphasis> sent to the server until after
4402 the server has successfully authenticated the client so the server
4403 cannot make authentication decisions at the correct time (connection
4404 to the share) for "Guest" shares.</para>
4406 <para>For people familiar with the older Samba releases, this
4407 parameter maps to the old compile-time setting of the <constant>
4408 GUEST_SESSSETUP</constant> value in local.h.</para>
4410 <para>Default: <command>map to guest = Never</command></para>
4411 <para>Example: <command>map to guest = Bad User</command></para>
4418 <term><anchor id="MAXCONNECTIONS">max connections (S)</term>
4419 <listitem><para>This option allows the number of simultaneous
4420 connections to a service to be limited. If <parameter>max connections
4421 </parameter> is greater than 0 then connections will be refused if
4422 this number of connections to the service are already open. A value
4423 of zero mean an unlimited number of connections may be made.</para>
4425 <para>Record lock files are used to implement this feature. The
4426 lock files will be stored in the directory specified by the <link
4427 linkend="LOCKDIRECTORY"><parameter>lock directory</parameter></link>
4430 <para>Default: <command>max connections = 0</command></para>
4431 <para>Example: <command>max connections = 10</command></para>
4438 <term><anchor id="MAXDISKSIZE">max disk size (G)</term>
4439 <listitem><para>This option allows you to put an upper limit
4440 on the apparent size of disks. If you set this option to 100
4441 then all shares will appear to be not larger than 100 MB in
4444 <para>Note that this option does not limit the amount of
4445 data you can put on the disk. In the above case you could still
4446 store much more than 100 MB on the disk, but if a client ever asks
4447 for the amount of free disk space or the total disk size then the
4448 result will be bounded by the amount specified in <parameter>max
4449 disk size</parameter>.</para>
4451 <para>This option is primarily useful to work around bugs
4452 in some pieces of software that can't handle very large disks,
4453 particularly disks over 1GB in size.</para>
4455 <para>A <parameter>max disk size</parameter> of 0 means no limit.</para>
4457 <para>Default: <command>max disk size = 0</command></para>
4458 <para>Example: <command>max disk size = 1000</command></para>
4465 <term><anchor id="MAXLOGSIZE">max log size (G)</term>
4466 <listitem><para>This option (an integer in kilobytes) specifies
4467 the max size the log file should grow to. Samba periodically checks
4468 the size and if it is exceeded it will rename the file, adding
4469 a <filename>.old</filename> extension.</para>
4471 <para>A size of 0 means no limit.</para>
4473 <para>Default: <command>max log size = 5000</command></para>
4474 <para>Example: <command>max log size = 1000</command></para>
4481 <term><anchor id="MAXMUX">max mux (G)</term>
4482 <listitem><para>This option controls the maximum number of
4483 outstanding simultaneous SMB operations that Samba tells the client
4484 it will allow. You should never need to set this parameter.</para>
4486 <para>Default: <command>max mux = 50</command></para>
4493 <term><anchor id="MAXOPENFILES">max open files (G)</term>
4494 <listitem><para>This parameter limits the maximum number of
4495 open files that one <ulink url="smbd.8.html">smbd(8)</ulink> file
4496 serving process may have open for a client at any one time. The
4497 default for this parameter is set very high (10,000) as Samba uses
4498 only one bit per unopened file.</para>
4500 <para>The limit of the number of open files is usually set
4501 by the UNIX per-process file descriptor limit rather than
4502 this parameter so you should never need to touch this parameter.</para>
4504 <para>Default: <command>max open files = 10000</command></para>
4511 <term><anchor id="MAXPRINTJOBS">max print jobs (S)</term>
4512 <listitem><para>This parameter limits the maximum number of
4513 jobs allowable in a Samba printer queue at any given moment.
4514 If this number is exceeded, <ulink url="smbd.8.html"><command>
4515 smbd(8)</command></ulink> will remote "Out of Space" to the client.
4516 See all <link linkend="TOTALPRINTJOBS"><parameter>total
4517 print jobs</parameter></link>.
4520 <para>Default: <command>max print jobs = 1000</command></para>
4521 <para>Example: <command>max print jobs = 5000</command></para>
4527 <term><anchor id="MAXPROTOCOL">max protocol (G)</term>
4528 <listitem><para>The value of the parameter (a string) is the highest
4529 protocol level that will be supported by the server.</para>
4531 <para>Possible values are :</para>
4533 <listitem><para><constant>CORE</constant>: Earliest version. No
4534 concept of user names.</para></listitem>
4536 <listitem><para><constant>COREPLUS</constant>: Slight improvements on
4537 CORE for efficiency.</para></listitem>
4539 <listitem><para><constant>LANMAN1</constant>: First <emphasis>
4540 modern</emphasis> version of the protocol. Long filename
4541 support.</para></listitem>
4543 <listitem><para><constant>LANMAN2</constant>: Updates to Lanman1 protocol.
4546 <listitem><para><constant>NT1</constant>: Current up to date version of
4547 the protocol. Used by Windows NT. Known as CIFS.</para></listitem>
4550 <para>Normally this option should not be set as the automatic
4551 negotiation phase in the SMB protocol takes care of choosing
4552 the appropriate protocol.</para>
4554 <para>See also <link linkend="MINPROTOCOL"><parameter>min
4555 protocol</parameter></link></para>
4557 <para>Default: <command>max protocol = NT1</command></para>
4558 <para>Example: <command>max protocol = LANMAN1</command></para>
4565 <term><anchor id="MAXSMBDPROCESSES">max smbd processes (G)</term>
4566 <listitem><para>This parameter limits the maximum number of
4567 <ulink url="smbd.8.html"><command>smbd(8)</command></ulink>
4568 processes concurrently running on a system and is intended
4569 as a stopgap to prevent degrading service to clients in the event
4570 that the server has insufficient resources to handle more than this
4571 number of connections. Remember that under normal operating
4572 conditions, each user will have an <ulink url="smbd.8.html">smbd</ulink> associated with him or her
4573 to handle connections to all shares from a given host.
4576 <para>Default: <command>max smbd processes = 0</command> ## no limit</para>
4577 <para>Example: <command>max smbd processes = 1000</command></para>
4585 <term><anchor id="MAXTTL">max ttl (G)</term>
4586 <listitem><para>This option tells <ulink url="nmbd.8.html">nmbd(8)</ulink>
4587 what the default 'time to live' of NetBIOS names should be (in seconds)
4588 when <command>nmbd</command> is requesting a name using either a
4589 broadcast packet or from a WINS server. You should never need to
4590 change this parameter. The default is 3 days.</para>
4592 <para>Default: <command>max ttl = 259200</command></para>
4599 <term><anchor id="MAXWINSTTL">max wins ttl (G)</term>
4600 <listitem><para>This option tells <ulink url="nmbd.8.html">nmbd(8)
4601 </ulink> when acting as a WINS server (<link linkend="WINSSUPPORT">
4602 <parameter>wins support = yes</parameter></link>) what the maximum
4603 'time to live' of NetBIOS names that <command>nmbd</command>
4604 will grant will be (in seconds). You should never need to change this
4605 parameter. The default is 6 days (518400 seconds).</para>
4607 <para>See also the <link linkend="MINWINSTTL"><parameter>min
4608 wins ttl</parameter></link> parameter.</para>
4610 <para>Default: <command>max wins ttl = 518400</command></para>
4617 <term><anchor id="MAXXMIT">max xmit (G)</term>
4618 <listitem><para>This option controls the maximum packet size
4619 that will be negotiated by Samba. The default is 65535, which
4620 is the maximum. In some cases you may find you get better performance
4621 with a smaller value. A value below 2048 is likely to cause problems.
4624 <para>Default: <command>max xmit = 65535</command></para>
4625 <para>Example: <command>max xmit = 8192</command></para>
4632 <term><anchor id="MESSAGECOMMAND">message command (G)</term>
4633 <listitem><para>This specifies what command to run when the
4634 server receives a WinPopup style message.</para>
4636 <para>This would normally be a command that would
4637 deliver the message somehow. How this is to be done is
4638 up to your imagination.</para>
4640 <para>An example is:</para>
4642 <para><command>message command = csh -c 'xedit %s;rm %s' &</command>
4645 <para>This delivers the message using <command>xedit</command>, then
4646 removes it afterwards. <emphasis>NOTE THAT IT IS VERY IMPORTANT
4647 THAT THIS COMMAND RETURN IMMEDIATELY</emphasis>. That's why I
4648 have the '&' on the end. If it doesn't return immediately then
4649 your PCs may freeze when sending messages (they should recover
4650 after 30 seconds, hopefully).</para>
4652 <para>All messages are delivered as the global guest user.
4653 The command takes the standard substitutions, although <parameter>
4654 %u</parameter> won't work (<parameter>%U</parameter> may be better
4655 in this case).</para>
4657 <para>Apart from the standard substitutions, some additional
4658 ones apply. In particular:</para>
4661 <listitem><para><parameter>%s</parameter> = the filename containing
4662 the message.</para></listitem>
4664 <listitem><para><parameter>%t</parameter> = the destination that
4665 the message was sent to (probably the server name).</para></listitem>
4667 <listitem><para><parameter>%f</parameter> = who the message
4668 is from.</para></listitem>
4671 <para>You could make this command send mail, or whatever else
4672 takes your fancy. Please let us know of any really interesting
4673 ideas you have.</para>
4676 <para>Here's a way of sending the messages as mail to root:</para>
4678 <para><command>message command = /bin/mail -s 'message from %f on
4679 %m' root < %s; rm %s</command></para>
4681 <para>If you don't have a message command then the message
4682 won't be delivered and Samba will tell the sender there was
4683 an error. Unfortunately WfWg totally ignores the error code
4684 and carries on regardless, saying that the message was delivered.
4687 <para>If you want to silently delete it then try:</para>
4689 <para><command>message command = rm %s</command></para>
4691 <para>Default: <emphasis>no message command</emphasis></para>
4692 <para>Example: <command>message command = csh -c 'xedit %s;
4693 rm %s' &</command></para>
4701 <term><anchor id="MINPASSWDLENGTH">min passwd length (G)</term>
4702 <listitem><para>Synonym for <link linkend="MINPASSWORDLENGTH">
4703 <parameter>min password length</parameter></link>.</para>
4710 <term><anchor id="MINPASSWORDLENGTH">min password length (G)</term>
4711 <listitem><para>This option sets the minimum length in characters
4712 of a plaintext password that <command>smbd</command> will accept when performing
4713 UNIX password changing.</para>
4715 <para>See also <link linkend="UNIXPASSWORDSYNC"><parameter>unix
4716 password sync</parameter></link>, <link linkend="PASSWDPROGRAM">
4717 <parameter>passwd program</parameter></link> and <link
4718 linkend="PASSWDCHATDEBUG"><parameter>passwd chat debug</parameter>
4721 <para>Default: <command>min password length = 5</command></para>
4728 <term><anchor id="MINPRINTSPACE">min print space (S)</term>
4729 <listitem><para>This sets the minimum amount of free disk
4730 space that must be available before a user will be able to spool
4731 a print job. It is specified in kilobytes. The default is 0, which
4732 means a user can always spool a print job.</para>
4734 <para>See also the <link linkend="PRINTING"><parameter>printing
4735 </parameter></link> parameter.</para>
4737 <para>Default: <command>min print space = 0</command></para>
4738 <para>Example: <command>min print space = 2000</command></para>
4746 <term><anchor id="MINPROTOCOL">min protocol (G)</term>
4747 <listitem><para>The value of the parameter (a string) is the
4748 lowest SMB protocol dialect than Samba will support. Please refer
4749 to the <link linkend="MAXPROTOCOL"><parameter>max protocol</parameter></link>
4750 parameter for a list of valid protocol names and a brief description
4751 of each. You may also wish to refer to the C source code in
4752 <filename>source/smbd/negprot.c</filename> for a listing of known protocol
4753 dialects supported by clients.</para>
4755 <para>If you are viewing this parameter as a security measure, you should
4756 also refer to the <link linkend="LANMANAUTH"><parameter>lanman
4757 auth</parameter></link> parameter. Otherwise, you should never need
4758 to change this parameter.</para>
4760 <para>Default : <command>min protocol = CORE</command></para>
4761 <para>Example : <command>min protocol = NT1</command> # disable DOS
4770 <term><anchor id="MINWINSTTL">min wins ttl (G)</term>
4771 <listitem><para>This option tells <ulink url="nmbd.8.html">nmbd(8)</ulink>
4772 when acting as a WINS server (<link linkend="WINSSUPPORT"><parameter>
4773 wins support = yes</parameter></link>) what the minimum 'time to live'
4774 of NetBIOS names that <command>nmbd</command> will grant will be (in
4775 seconds). You should never need to change this parameter. The default
4776 is 6 hours (21600 seconds).</para>
4778 <para>Default: <command>min wins ttl = 21600</command></para>
4786 <term><anchor id="MSDFSROOT">msdfs root (S)</term>
4787 <listitem><para>This boolean parameter is only available if
4788 Samba is configured and compiled with the <command>
4789 --with-msdfs</command> option. If set to <constant>yes</constant>,
4790 Samba treats the share as a Dfs root and allows clients to browse
4791 the distributed file system tree rooted at the share directory.
4792 Dfs links are specified in the share directory by symbolic
4793 links of the form <filename>msdfs:serverA\shareA,serverB\shareB
4794 </filename> and so on. For more information on setting up a Dfs tree
4795 on Samba, refer to <ulink url="msdfs_setup.html">msdfs_setup.html
4798 <para>See also <link linkend="HOSTMSDFS"><parameter>host msdfs
4799 </parameter></link></para>
4801 <para>Default: <command>msdfs root = no</command></para>
4807 <term><anchor id="NAMERESOLVEORDER">name resolve order (G)</term>
4808 <listitem><para>This option is used by the programs in the Samba
4809 suite to determine what naming services to use and in what order
4810 to resolve host names to IP addresses. The option takes a space
4811 separated string of name resolution options.</para>
4813 <para>The options are :"lmhosts", "host", "wins" and "bcast". They
4814 cause names to be resolved as follows :</para>
4817 <listitem><para><constant>lmhosts</constant> : Lookup an IP
4818 address in the Samba lmhosts file. If the line in lmhosts has
4819 no name type attached to the NetBIOS name (see the <ulink
4820 url="lmhosts.5.html">lmhosts(5)</ulink> for details) then
4821 any name type matches for lookup.</para></listitem>
4823 <listitem><para><constant>host</constant> : Do a standard host
4824 name to IP address resolution, using the system <filename>/etc/hosts
4825 </filename>, NIS, or DNS lookups. This method of name resolution
4826 is operating system depended for instance on IRIX or Solaris this
4827 may be controlled by the <filename>/etc/nsswitch.conf</filename>
4828 file. Note that this method is only used if the NetBIOS name
4829 type being queried is the 0x20 (server) name type, otherwise
4830 it is ignored.</para></listitem>
4832 <listitem><para><constant>wins</constant> : Query a name with
4833 the IP address listed in the <link linkend="WINSSERVER"><parameter>
4834 wins server</parameter></link> parameter. If no WINS server has
4835 been specified this method will be ignored.</para></listitem>
4837 <listitem><para><constant>bcast</constant> : Do a broadcast on
4838 each of the known local interfaces listed in the <link
4839 linkend="INTERFACES"><parameter>interfaces</parameter></link>
4840 parameter. This is the least reliable of the name resolution
4841 methods as it depends on the target host being on a locally
4842 connected subnet.</para></listitem>
4845 <para>Default: <command>name resolve order = lmhosts host wins bcast
4847 <para>Example: <command>name resolve order = lmhosts bcast host
4850 <para>This will cause the local lmhosts file to be examined
4851 first, followed by a broadcast attempt, followed by a normal
4852 system hostname lookup.</para>
4860 <term><anchor id="NETBIOSALIASES">netbios aliases (G)</term>
4861 <listitem><para>This is a list of NetBIOS names that <ulink
4862 url="nmbd.8.html">nmbd(8)</ulink> will advertise as additional
4863 names by which the Samba server is known. This allows one machine
4864 to appear in browse lists under multiple names. If a machine is
4865 acting as a browse server or logon server none
4866 of these names will be advertised as either browse server or logon
4867 servers, only the primary name of the machine will be advertised
4868 with these capabilities.</para>
4870 <para>See also <link linkend="NETBIOSNAME"><parameter>netbios
4871 name</parameter></link>.</para>
4873 <para>Default: <emphasis>empty string (no additional names)</emphasis></para>
4874 <para>Example: <command>netbios aliases = TEST TEST1 TEST2</command></para>
4881 <term><anchor id="NETBIOSNAME">netbios name (G)</term>
4882 <listitem><para>This sets the NetBIOS name by which a Samba
4883 server is known. By default it is the same as the first component
4884 of the host's DNS name. If a machine is a browse server or
4885 logon server this name (or the first component
4886 of the hosts DNS name) will be the name that these services are
4887 advertised under.</para>
4889 <para>See also <link linkend="NETBIOSALIASES"><parameter>netbios
4890 aliases</parameter></link>.</para>
4892 <para>Default: <emphasis>machine DNS name</emphasis></para>
4893 <para>Example: <command>netbios name = MYNAME</command></para>
4900 <term><anchor id="NETBIOSSCOPE">netbios scope (G)</term>
4901 <listitem><para>This sets the NetBIOS scope that Samba will
4902 operate under. This should not be set unless every machine
4903 on your LAN also sets this value.</para>
4909 <term><anchor id="NISHOMEDIR">nis homedir (G)</term>
4910 <listitem><para>Get the home share server from a NIS map. For
4911 UNIX systems that use an automounter, the user's home directory
4912 will often be mounted on a workstation on demand from a remote
4915 <para>When the Samba logon server is not the actual home directory
4916 server, but is mounting the home directories via NFS then two
4917 network hops would be required to access the users home directory
4918 if the logon server told the client to use itself as the SMB server
4919 for home directories (one over SMB and one over NFS). This can
4920 be very slow.</para>
4922 <para>This option allows Samba to return the home share as
4923 being on a different server to the logon server and as
4924 long as a Samba daemon is running on the home directory server,
4925 it will be mounted on the Samba client directly from the directory
4926 server. When Samba is returning the home share to the client, it
4927 will consult the NIS map specified in <link linkend="HOMEDIRMAP">
4928 <parameter>homedir map</parameter></link> and return the server
4929 listed there.</para>
4931 <para>Note that for this option to work there must be a working
4932 NIS system and the Samba server with this option must also
4933 be a logon server.</para>
4935 <para>Default: <command>nis homedir = no</command></para>
4942 <term><anchor id="NONUNIXACCOUNTRANGE">non unix account range (G)</term>
4943 <listitem><para>The non unix account range parameter specifies
4944 the range of 'user ids' that are allocated by the various 'non unix
4945 account' passdb backends. These backends allow
4946 the storage of passwords for users who don't exist in /etc/passwd.
4947 This is most often used for machine account creation.
4948 This range of ids should have no existing local or NIS users within
4949 it as strange conflicts can occur otherwise.</para>
4951 <para>NOTE: These userids never appear on the system and Samba will never
4952 'become' these users. They are used only to ensure that the algorithmic
4953 RID mapping does not conflict with normal users.
4955 <para>Default: <command>non unix account range = <empty string>
4958 <para>Example: <command>non unix account range = 10000-20000</command></para>
4963 <listitem><para>This boolean parameter controls whether
4964 <ulink url="smbd.8.html">smbd(8)</ulink> will attempt to map
4965 UNIX permissions into Windows NT access control lists.
4966 This parameter was formally a global parameter in releases
4967 prior to 2.2.2.</para>
4969 <para>Default: <command>nt acl support = yes</command></para>
4976 <term><anchor id="NTACLSUPPORT">nt acl support (S)</term>
4977 <listitem><para>This boolean parameter controls whether
4978 <ulink url="smbd.8.html">smbd(8)</ulink> will attempt to map
4979 UNIX permissions into Windows NT access control lists.
4980 This parameter was formally a global parameter in releases
4981 prior to 2.2.2.</para>
4983 <para>Default: <command>nt acl support = yes</command></para>
4990 <term><anchor id="NTPIPESUPPORT">nt pipe support (G)</term>
4991 <listitem><para>This boolean parameter controls whether
4992 <ulink url="smbd.8.html">smbd(8)</ulink> will allow Windows NT
4993 clients to connect to the NT SMB specific <constant>IPC$</constant>
4994 pipes. This is a developer debugging option and can be left
4997 <para>Default: <command>nt pipe support = yes</command></para>
5004 <term><anchor id="NULLPASSWORDS">null passwords (G)</term>
5005 <listitem><para>Allow or disallow client access to accounts
5006 that have null passwords. </para>
5008 <para>See also <ulink url="smbpasswd.5.html">smbpasswd (5)</ulink>.</para>
5010 <para>Default: <command>null passwords = no</command></para>
5018 <term><anchor id="OBEYPAMRESTRICTIONS">obey pam restrictions (G)</term>
5019 <listitem><para>When Samba 2.2 is configured to enable PAM support
5020 (i.e. --with-pam), this parameter will control whether or not Samba
5021 should obey PAM's account and session management directives. The
5022 default behavior is to use PAM for clear text authentication only
5023 and to ignore any account or session management. Note that Samba
5024 always ignores PAM for authentication in the case of <link
5025 linkend="ENCRYPTPASSWORDS"><parameter>encrypt passwords = yes</parameter>
5026 </link>. The reason is that PAM modules cannot support the challenge/response
5027 authentication mechanism needed in the presence of SMB password encryption.
5030 <para>Default: <command>obey pam restrictions = no</command></para>
5039 <term><anchor id="ONLYUSER">only user (S)</term>
5040 <listitem><para>This is a boolean option that controls whether
5041 connections with usernames not in the <parameter>user</parameter>
5042 list will be allowed. By default this option is disabled so that a
5043 client can supply a username to be used by the server. Enabling
5044 this parameter will force the server to only user the login
5045 names from the <parameter>user</parameter> list and is only really
5046 useful in <link linkend="SECURITYEQUALSSHARE">shave level</link>
5049 <para>Note that this also means Samba won't try to deduce
5050 usernames from the service name. This can be annoying for
5051 the [homes] section. To get around this you could use <command>user =
5052 %S</command> which means your <parameter>user</parameter> list
5053 will be just the service name, which for home directories is the
5054 name of the user.</para>
5056 <para>See also the <link linkend="USER"><parameter>user</parameter>
5057 </link> parameter.</para>
5059 <para>Default: <command>only user = no</command></para>
5067 <term><anchor id="ONLYGUEST">only guest (S)</term>
5068 <listitem><para>A synonym for <link linkend="GUESTONLY"><parameter>
5069 guest only</parameter></link>.</para>
5076 <term><anchor id="OPLOCKBREAKWAITTIME">oplock break wait time (G)</term>
5077 <listitem><para>This is a tuning parameter added due to bugs in
5078 both Windows 9x and WinNT. If Samba responds to a client too
5079 quickly when that client issues an SMB that can cause an oplock
5080 break request, then the network client can fail and not respond
5081 to the break request. This tuning parameter (which is set in milliseconds)
5082 is the amount of time Samba will wait before sending an oplock break
5083 request to such (broken) clients.</para>
5085 <para><emphasis>DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ
5086 AND UNDERSTOOD THE SAMBA OPLOCK CODE</emphasis>.</para>
5088 <para>Default: <command>oplock break wait time = 0</command></para>
5094 <term><anchor id="OPLOCKCONTENTIONLIMIT">oplock contention limit (S)</term>
5095 <listitem><para>This is a <emphasis>very</emphasis> advanced
5096 <ulink url="smbd.8.html">smbd(8)</ulink> tuning option to
5097 improve the efficiency of the granting of oplocks under multiple
5098 client contention for the same file.</para>
5100 <para>In brief it specifies a number, which causes <ulink url="smbd.8.html">smbd</ulink> not to
5101 grant an oplock even when requested if the approximate number of
5102 clients contending for an oplock on the same file goes over this
5103 limit. This causes <command>smbd</command> to behave in a similar
5104 way to Windows NT.</para>
5106 <para><emphasis>DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ
5107 AND UNDERSTOOD THE SAMBA OPLOCK CODE</emphasis>.</para>
5109 <para>Default: <command>oplock contention limit = 2</command></para>
5118 <term><anchor id="OPLOCKS">oplocks (S)</term>
5119 <listitem><para>This boolean option tells <command>smbd</command> whether to
5120 issue oplocks (opportunistic locks) to file open requests on this
5121 share. The oplock code can dramatically (approx. 30% or more) improve
5122 the speed of access to files on Samba servers. It allows the clients
5123 to aggressively cache files locally and you may want to disable this
5124 option for unreliable network environments (it is turned on by
5125 default in Windows NT Servers). For more information see the file
5126 <filename>Speed.txt</filename> in the Samba <filename>docs/</filename>
5129 <para>Oplocks may be selectively turned off on certain files with a
5130 share. See the <link linkend="VETOOPLOCKFILES"><parameter>
5131 veto oplock files</parameter></link> parameter. On some systems
5132 oplocks are recognized by the underlying operating system. This
5133 allows data synchronization between all access to oplocked files,
5134 whether it be via Samba or NFS or a local UNIX process. See the
5135 <parameter>kernel oplocks</parameter> parameter for details.</para>
5137 <para>See also the <link linkend="KERNELOPLOCKS"><parameter>kernel
5138 oplocks</parameter></link> and <link linkend="LEVEL2OPLOCKS"><parameter>
5139 level2 oplocks</parameter></link> parameters.</para>
5141 <para>Default: <command>oplocks = yes</command></para>
5148 <term><anchor id="OSLEVEL">os level (G)</term>
5149 <listitem><para>This integer value controls what level Samba
5150 advertises itself as for browse elections. The value of this
5151 parameter determines whether <ulink url="nmbd.8.html">nmbd(8)</ulink>
5152 has a chance of becoming a local master browser for the <parameter>
5153 WORKGROUP</parameter> in the local broadcast area.</para>
5155 <para><emphasis>Note :</emphasis>By default, Samba will win
5156 a local master browsing election over all Microsoft operating
5157 systems except a Windows NT 4.0/2000 Domain Controller. This
5158 means that a misconfigured Samba host can effectively isolate
5159 a subnet for browsing purposes. See <filename>BROWSING.txt
5160 </filename> in the Samba <filename>docs/</filename> directory
5163 <para>Default: <command>os level = 20</command></para>
5164 <para>Example: <command>os level = 65 </command></para>
5171 <term><anchor id="OS2DRIVERMAP">os2 driver map (G)</term>
5172 <listitem><para>The parameter is used to define the absolute
5173 path to a file containing a mapping of Windows NT printer driver
5174 names to OS/2 printer driver names. The format is:</para>
5176 <para><nt driver name> = <os2 driver
5177 name>.<device name></para>
5179 <para>For example, a valid entry using the HP LaserJet 5
5180 printer driver would appear as <command>HP LaserJet 5L = LASERJET.HP
5181 LaserJet 5L</command>.</para>
5183 <para>The need for the file is due to the printer driver namespace
5184 problem described in the <ulink url="printer_driver2.html">Samba
5185 Printing HOWTO</ulink>. For more details on OS/2 clients, please
5186 refer to the <ulink url="OS2-Client-HOWTO.html">OS2-Client-HOWTO
5187 </ulink> containing in the Samba documentation.</para>
5189 <para>Default: <command>os2 driver map = <empty string>
5196 <term><anchor id="PAMPASSWORDCHANGE">pam password change (G)</term>
5197 <listitem><para>With the addition of better PAM support in Samba 2.2,
5198 this parameter, it is possible to use PAM's password change control
5199 flag for Samba. If enabled, then PAM will be used for password
5200 changes when requested by an SMB client instead of the program listed in
5201 <link linkend="PASSWDPROGRAM"><parameter>passwd program</parameter></link>.
5202 It should be possible to enable this without changing your
5203 <link linkend="PASSWDCHAT"><parameter>passwd chat</parameter></link>
5204 parameter for most setups.
5207 <para>Default: <command>pam password change = no</command></para>
5214 <term><anchor id="PANICACTION">panic action (G)</term>
5215 <listitem><para>This is a Samba developer option that allows a
5216 system command to be called when either <ulink url="smbd.8.html">
5217 smbd(8)</ulink> or <ulink url="nmbd.8.html">nmbd(8)</ulink>
5218 crashes. This is usually used to draw attention to the fact that
5219 a problem occurred.</para>
5221 <para>Default: <command>panic action = <empty string></command></para>
5222 <para>Example: <command>panic action = "/bin/sleep 90000"</command></para>
5228 <term><anchor id="PASSDBBACKEND">passdb backend (G)</term>
5229 <listitem><para>This option allows the administrator to chose what
5230 backend in which to store passwords. This allows (for example) both
5231 smbpasswd and tdbsam to be used without a recompile. Only one can
5232 be used at a time however, and experimental backends must still be selected
5233 (eg --with-tdbsam) at configure time.
5236 <para>Default: <command>passdb backend = smbpasswd</command></para>
5237 <para>Example: <command>passdb backend = tdbsam</command></para>
5243 <term><anchor id="PASSWDCHAT">passwd chat (G)</term>
5244 <listitem><para>This string controls the <emphasis>"chat"</emphasis>
5245 conversation that takes places between <ulink
5246 url="smbd.8.html">smbd</ulink> and the local password changing
5247 program to change the user's password. The string describes a
5248 sequence of response-receive pairs that <ulink url="smbd.8.html">
5249 smbd(8)</ulink> uses to determine what to send to the
5250 <link linkend="PASSWDPROGRAM"><parameter>passwd program</parameter>
5251 </link> and what to expect back. If the expected output is not
5252 received then the password is not changed.</para>
5254 <para>This chat sequence is often quite site specific, depending
5255 on what local methods are used for password control (such as NIS
5257 <para>Note that this parameter only is only used if the <link
5258 linkend="UNIXPASSWORDSYNC"><parameter>unix
5259 password sync</parameter></link> parameter is set to <constant>yes</constant>. This
5260 sequence is then called <emphasis>AS ROOT</emphasis> when the SMB password
5261 in the smbpasswd file is being changed, without access to the old
5262 password cleartext. This means that root must be able to reset the user's password
5263 without knowing the text of the previous password. In the presence of NIS/YP,
5264 this means that the <link linkend="PASSWDPROGRAM">passwd program</link> must be
5265 executed on the NIS master.
5269 <para>The string can contain the macro <parameter>%n</parameter> which is substituted
5270 for the new password. The chat sequence can also contain the standard
5271 macros <constant>\n</constant>, <constant>\r</constant>, <constant>
5272 \t</constant> and <constant>\s</constant> to give line-feed,
5273 carriage-return, tab and space. The chat sequence string can also contain
5274 a '*' which matches any sequence of characters.
5275 Double quotes can be used to collect strings with spaces
5276 in them into a single string.</para>
5278 <para>If the send string in any part of the chat sequence
5279 is a full stop ".", then no string is sent. Similarly,
5280 if the expect string is a full stop then no string is expected.</para>
5282 <para>If the <link linkend="PAMPASSWORDCHANGE"><parameter>pam
5283 password change</parameter></link> parameter is set to true, the chat pairs
5284 may be matched in any order, and success is determined by the PAM result,
5285 not any particular output. The \n macro is ignored for PAM conversions.
5288 <para>See also <link linkend="UNIXPASSWORDSYNC"><parameter>unix password
5289 sync</parameter></link>, <link linkend="PASSWDPROGRAM"><parameter>
5290 passwd program</parameter></link> ,<link linkend="PASSWDCHATDEBUG">
5291 <parameter>passwd chat debug</parameter></link> and <link linkend="PAMPASSWORDCHANGE">
5292 <parameter>pam password change</parameter></link>.</para>
5294 <para>Default: <command>passwd chat = *new*password* %n\n
5295 *new*password* %n\n *changed*</command></para>
5296 <para>Example: <command>passwd chat = "*Enter OLD password*" %o\n
5297 "*Enter NEW password*" %n\n "*Reenter NEW password*" %n\n "*Password
5298 changed*"</command></para>
5305 <term><anchor id="PASSWDCHATDEBUG">passwd chat debug (G)</term>
5306 <listitem><para>This boolean specifies if the passwd chat script
5307 parameter is run in <emphasis>debug</emphasis> mode. In this mode the
5308 strings passed to and received from the passwd chat are printed
5309 in the <ulink url="smbd.8.html">smbd(8)</ulink> log with a
5310 <link linkend="DEBUGLEVEL"><parameter>debug level</parameter></link>
5311 of 100. This is a dangerous option as it will allow plaintext passwords
5312 to be seen in the <command>smbd</command> log. It is available to help
5313 Samba admins debug their <parameter>passwd chat</parameter> scripts
5314 when calling the <parameter>passwd program</parameter> and should
5315 be turned off after this has been done. This option has no effect if the
5316 <link linkend="PAMPASSWORDCHANGE"><parameter>pam password change</parameter></link>
5317 paramter is set. This parameter is off by default.</para>
5320 <para>See also <link linkend="PASSWDCHAT"><parameter>passwd chat</parameter>
5321 </link>, <link linkend="PAMPASSWORDCHANGE"><parameter>pam password change</parameter>
5322 </link>, <link linkend="PASSWDPROGRAM"><parameter>passwd program</parameter>
5325 <para>Default: <command>passwd chat debug = no</command></para>
5332 <term><anchor id="PASSWDPROGRAM">passwd program (G)</term>
5333 <listitem><para>The name of a program that can be used to set
5334 UNIX user passwords. Any occurrences of <parameter>%u</parameter>
5335 will be replaced with the user name. The user name is checked for
5336 existence before calling the password changing program.</para>
5338 <para>Also note that many passwd programs insist in <emphasis>reasonable
5339 </emphasis> passwords, such as a minimum length, or the inclusion
5340 of mixed case chars and digits. This can pose a problem as some clients
5341 (such as Windows for Workgroups) uppercase the password before sending
5344 <para><emphasis>Note</emphasis> that if the <parameter>unix
5345 password sync</parameter> parameter is set to <constant>true
5346 </constant> then this program is called <emphasis>AS ROOT</emphasis>
5347 before the SMB password in the <ulink url="smbpasswd.5.html">smbpasswd(5)
5348 </ulink> file is changed. If this UNIX password change fails, then
5349 <command>smbd</command> will fail to change the SMB password also
5350 (this is by design).</para>
5352 <para>If the <parameter>unix password sync</parameter> parameter
5353 is set this parameter <emphasis>MUST USE ABSOLUTE PATHS</emphasis>
5354 for <emphasis>ALL</emphasis> programs called, and must be examined
5355 for security implications. Note that by default <parameter>unix
5356 password sync</parameter> is set to <constant>false</constant>.</para>
5358 <para>See also <link linkend="UNIXPASSWORDSYNC"><parameter>unix
5359 password sync</parameter></link>.</para>
5361 <para>Default: <command>passwd program = /bin/passwd</command></para>
5362 <para>Example: <command>passwd program = /sbin/npasswd %u</command>
5370 <term><anchor id="PASSWORDLEVEL">password level (G)</term>
5371 <listitem><para>Some client/server combinations have difficulty
5372 with mixed-case passwords. One offending client is Windows for
5373 Workgroups, which for some reason forces passwords to upper
5374 case when using the LANMAN1 protocol, but leaves them alone when
5375 using COREPLUS! Another problem child is the Windows 95/98
5376 family of operating systems. These clients upper case clear
5377 text passwords even when NT LM 0.12 selected by the protocol
5378 negotiation request/response.</para>
5380 <para>This parameter defines the maximum number of characters
5381 that may be upper case in passwords.</para>
5383 <para>For example, say the password given was "FRED". If <parameter>
5384 password level</parameter> is set to 1, the following combinations
5385 would be tried if "FRED" failed:</para>
5387 <para>"Fred", "fred", "fRed", "frEd","freD"</para>
5389 <para>If <parameter>password level</parameter> was set to 2,
5390 the following combinations would also be tried: </para>
5392 <para>"FRed", "FrEd", "FreD", "fREd", "fReD", "frED", ..</para>
5394 <para>And so on.</para>
5396 <para>The higher value this parameter is set to the more likely
5397 it is that a mixed case password will be matched against a single
5398 case password. However, you should be aware that use of this
5399 parameter reduces security and increases the time taken to
5400 process a new connection.</para>
5402 <para>A value of zero will cause only two attempts to be
5403 made - the password as is and the password in all-lower case.</para>
5405 <para>Default: <command>password level = 0</command></para>
5406 <para>Example: <command>password level = 4</command></para>
5413 <term><anchor id="PASSWORDSERVER">password server (G)</term>
5414 <listitem><para>By specifying the name of another SMB server (such
5415 as a WinNT box) with this option, and using <command>security = domain
5416 </command> or <command>security = server</command> you can get Samba
5417 to do all its username/password validation via a remote server.</para>
5419 <para>This option sets the name of the password server to use.
5420 It must be a NetBIOS name, so if the machine's NetBIOS name is
5421 different from its Internet name then you may have to add its NetBIOS
5422 name to the lmhosts file which is stored in the same directory
5423 as the <filename>smb.conf</filename> file.</para>
5425 <para>The name of the password server is looked up using the
5426 parameter <link linkend="NAMERESOLVEORDER"><parameter>name
5427 resolve order</parameter></link> and so may resolved
5428 by any method and order described in that parameter.</para>
5430 <para>The password server much be a machine capable of using
5431 the "LM1.2X002" or the "NT LM 0.12" protocol, and it must be in
5432 user level security mode.</para>
5434 <para><emphasis>NOTE:</emphasis> Using a password server
5435 means your UNIX box (running Samba) is only as secure as your
5436 password server. <emphasis>DO NOT CHOOSE A PASSWORD SERVER THAT
5437 YOU DON'T COMPLETELY TRUST</emphasis>.</para>
5439 <para>Never point a Samba server at itself for password
5440 serving. This will cause a loop and could lock up your Samba
5443 <para>The name of the password server takes the standard
5444 substitutions, but probably the only useful one is <parameter>%m
5445 </parameter>, which means the Samba server will use the incoming
5446 client as the password server. If you use this then you better
5447 trust your clients, and you had better restrict them with hosts allow!</para>
5449 <para>If the <parameter>security</parameter> parameter is set to
5450 <constant>domain</constant>, then the list of machines in this
5451 option must be a list of Primary or Backup Domain controllers for the
5452 Domain or the character '*', as the Samba server is effectively
5453 in that domain, and will use cryptographically authenticated RPC calls
5454 to authenticate the user logging on. The advantage of using <command>
5455 security = domain</command> is that if you list several hosts in the
5456 <parameter>password server</parameter> option then <command>smbd
5457 </command> will try each in turn till it finds one that responds. This
5458 is useful in case your primary server goes down.</para>
5460 <para>If the <parameter>password server</parameter> option is set
5461 to the character '*', then Samba will attempt to auto-locate the
5462 Primary or Backup Domain controllers to authenticate against by
5463 doing a query for the name <constant>WORKGROUP<1C></constant>
5464 and then contacting each server returned in the list of IP
5465 addresses from the name resolution source. </para>
5467 <para>If the <parameter>security</parameter> parameter is
5468 set to <constant>server</constant>, then there are different
5469 restrictions that <command>security = domain</command> doesn't
5473 <listitem><para>You may list several password servers in
5474 the <parameter>password server</parameter> parameter, however if an
5475 <command>smbd</command> makes a connection to a password server,
5476 and then the password server fails, no more users will be able
5477 to be authenticated from this <command>smbd</command>. This is a
5478 restriction of the SMB/CIFS protocol when in <command>security = server
5479 </command> mode and cannot be fixed in Samba.</para></listitem>
5481 <listitem><para>If you are using a Windows NT server as your
5482 password server then you will have to ensure that your users
5483 are able to login from the Samba server, as when in <command>
5484 security = server</command> mode the network logon will appear to
5485 come from there rather than from the users workstation.</para></listitem>
5488 <para>See also the <link linkend="SECURITY"><parameter>security
5489 </parameter></link> parameter.</para>
5491 <para>Default: <command>password server = <empty string></command>
5493 <para>Example: <command>password server = NT-PDC, NT-BDC1, NT-BDC2
5495 <para>Example: <command>password server = *</command></para>
5502 <term><anchor id="PATH">path (S)</term>
5503 <listitem><para>This parameter specifies a directory to which
5504 the user of the service is to be given access. In the case of
5505 printable services, this is where print data will spool prior to
5506 being submitted to the host for printing.</para>
5508 <para>For a printable service offering guest access, the service
5509 should be readonly and the path should be world-writeable and
5510 have the sticky bit set. This is not mandatory of course, but
5511 you probably won't get the results you expect if you do
5514 <para>Any occurrences of <parameter>%u</parameter> in the path
5515 will be replaced with the UNIX username that the client is using
5516 on this connection. Any occurrences of <parameter>%m</parameter>
5517 will be replaced by the NetBIOS name of the machine they are
5518 connecting from. These replacements are very useful for setting
5519 up pseudo home directories for users.</para>
5521 <para>Note that this path will be based on <link linkend="ROOTDIR">
5522 <parameter>root dir</parameter></link> if one was specified.</para>
5524 <para>Default: <emphasis>none</emphasis></para>
5525 <para>Example: <command>path = /home/fred</command></para>
5533 <term><anchor id="POSIXLOCKING">posix locking (S)</term>
5534 <listitem><para>The <ulink url="smbd.8.html"><command>smbd(8)</command></ulink>
5535 daemon maintains an database of file locks obtained by SMB clients.
5536 The default behavior is to map this internal database to POSIX
5537 locks. This means that file locks obtained by SMB clients are
5538 consistent with those seen by POSIX compliant applications accessing
5539 the files via a non-SMB method (e.g. NFS or local file access).
5540 You should never need to disable this parameter.</para>
5542 <para>Default: <command>posix locking = yes</command></para>
5550 <term><anchor id="POSTEXEC">postexec (S)</term>
5551 <listitem><para>This option specifies a command to be run
5552 whenever the service is disconnected. It takes the usual
5553 substitutions. The command may be run as the root on some
5556 <para>An interesting example may be to unmount server
5559 <para><command>postexec = /etc/umount /cdrom</command></para>
5561 <para>See also <link linkend="PREEXEC"><parameter>preexec</parameter>
5564 <para>Default: <emphasis>none (no command executed)</emphasis>
5567 <para>Example: <command>postexec = echo \"%u disconnected from %S
5568 from %m (%I)\" >> /tmp/log</command></para>
5575 <term><anchor id="POSTSCRIPT">postscript (S)</term>
5576 <listitem><para>This parameter forces a printer to interpret
5577 the print files as PostScript. This is done by adding a <constant>%!
5578 </constant> to the start of print output.</para>
5580 <para>This is most useful when you have lots of PCs that persist
5581 in putting a control-D at the start of print jobs, which then
5582 confuses your printer.</para>
5584 <para>Default: <command>postscript = no</command></para>
5591 <term><anchor id="PREEXEC">preexec (S)</term>
5592 <listitem><para>This option specifies a command to be run whenever
5593 the service is connected to. It takes the usual substitutions.</para>
5595 <para>An interesting example is to send the users a welcome
5596 message every time they log in. Maybe a message of the day? Here
5597 is an example:</para>
5599 <para><command>preexec = csh -c 'echo \"Welcome to %S!\" |
5600 /usr/local/samba/bin/smbclient -M %m -I %I' & </command></para>
5602 <para>Of course, this could get annoying after a while :-)</para>
5604 <para>See also <link linkend="PREEXECCLOSE"><parameter>preexec close
5605 </parameter</link> and <link linkend="POSTEXEC"><parameter>postexec
5606 </parameter></link>.</para>
5608 <para>Default: <emphasis>none (no command executed)</emphasis></para>
5609 <para>Example: <command>preexec = echo \"%u connected to %S from %m
5610 (%I)\" >> /tmp/log</command></para>
5617 <term><anchor id="PREEXECCLOSE">preexec close (S)</term>
5618 <listitem><para>This boolean option controls whether a non-zero
5619 return code from <link linkend="PREEXEC"><parameter>preexec
5620 </parameter></link> should close the service being connected to.</para>
5622 <para>Default: <command>preexec close = no</command></para>
5628 <term><anchor id="PREFERREDMASTER">preferred master (G)</term>
5629 <listitem><para>This boolean parameter controls if <ulink
5630 url="nmbd.8.html">nmbd(8)</ulink> is a preferred master browser
5631 for its workgroup.</para>
5633 <para>If this is set to <constant>true</constant>, on startup, <command>nmbd</command>
5634 will force an election, and it will have a slight advantage in
5635 winning the election. It is recommended that this parameter is
5636 used in conjunction with <command><link linkend="DOMAINMASTER"><parameter>
5637 domain master</parameter></link> = yes</command>, so that <command>
5638 nmbd</command> can guarantee becoming a domain master.</para>
5640 <para>Use this option with caution, because if there are several
5641 hosts (whether Samba servers, Windows 95 or NT) that are preferred
5642 master browsers on the same subnet, they will each periodically
5643 and continuously attempt to become the local master browser.
5644 This will result in unnecessary broadcast traffic and reduced browsing
5645 capabilities.</para>
5647 <para>See also <link linkend="OSLEVEL"><parameter>os level</parameter>
5650 <para>Default: <command>preferred master = auto</command></para>
5657 <term><anchor id="PREFEREDMASTER">prefered master (G)</term>
5658 <listitem><para>Synonym for <link linkend="PREFERREDMASTER"><parameter>
5659 preferred master</parameter></link> for people who cannot spell :-).</para>
5666 <term><anchor id="PRELOAD">preload</term>
5667 <listitem><para>This is a list of services that you want to be
5668 automatically added to the browse lists. This is most useful
5669 for homes and printers services that would otherwise not be
5672 <para>Note that if you just want all printers in your
5673 printcap file loaded then the <link linkend="LOADPRINTERS">
5674 <parameter>load printers</parameter></link> option is easier.</para>
5676 <para>Default: <emphasis>no preloaded services</emphasis></para>
5678 <para>Example: <command>preload = fred lp colorlp</command></para>
5684 <term><anchor id="PRESERVECASE">preserve case (S)</term>
5685 <listitem><para> This controls if new filenames are created
5686 with the case that the client passes, or if they are forced to
5687 be the <link linkend="DEFAULTCASE"><parameter>default case
5688 </parameter></link>.</para>
5690 <para>Default: <command>preserve case = yes</command></para>
5692 <para>See the section on <link linkend="NAMEMANGLINGSECT">NAME
5693 MANGLING</link> for a fuller discussion.</para>
5700 <term><anchor id="PRINTCOMMAND">print command (S)</term>
5701 <listitem><para>After a print job has finished spooling to
5702 a service, this command will be used via a <command>system()</command>
5703 call to process the spool file. Typically the command specified will
5704 submit the spool file to the host's printing subsystem, but there
5705 is no requirement that this be the case. The server will not remove
5706 the spool file, so whatever command you specify should remove the
5707 spool file when it has been processed, otherwise you will need to
5708 manually remove old spool files.</para>
5710 <para>The print command is simply a text string. It will be used
5711 verbatim, with two exceptions: All occurrences of <parameter>%s
5712 </parameter> and <parameter>%f</parameter> will be replaced by the
5713 appropriate spool file name, and all occurrences of <parameter>%p
5714 </parameter> will be replaced by the appropriate printer name. The
5715 spool file name is generated automatically by the server. The
5716 <parameter>%J</parameter> macro can be used to access the job
5717 name as transmitted by the client.</para>
5719 <para>The print command <emphasis>MUST</emphasis> contain at least
5720 one occurrence of <parameter>%s</parameter> or <parameter>%f
5721 </parameter> - the <parameter>%p</parameter> is optional. At the time
5722 a job is submitted, if no printer name is supplied the <parameter>%p
5723 </parameter> will be silently removed from the printer command.</para>
5725 <para>If specified in the [global] section, the print command given
5726 will be used for any printable service that does not have its own
5727 print command specified.</para>
5729 <para>If there is neither a specified print command for a
5730 printable service nor a global print command, spool files will
5731 be created but not processed and (most importantly) not removed.</para>
5733 <para>Note that printing may fail on some UNIXes from the
5734 <constant>nobody</constant> account. If this happens then create
5735 an alternative guest account that can print and set the <link
5736 linkend="GUESTACCOUNT"><parameter>guest account</parameter></link>
5737 in the [global] section.</para>
5739 <para>You can form quite complex print commands by realizing
5740 that they are just passed to a shell. For example the following
5741 will log a print job, print the file, then remove it. Note that
5742 ';' is the usual separator for command in shell scripts.</para>
5744 <para><command>print command = echo Printing %s >>
5745 /tmp/print.log; lpr -P %p %s; rm %s</command></para>
5747 <para>You may have to vary this command considerably depending
5748 on how you normally print files on your system. The default for
5749 the parameter varies depending on the setting of the <link linkend="PRINTING">
5750 <parameter>printing</parameter></link> parameter.</para>
5752 <para>Default: For <command>printing = BSD, AIX, QNX, LPRNG
5753 or PLP :</command></para>
5754 <para><command>print command = lpr -r -P%p %s</command></para>
5756 <para>For <command>printing = SYSV or HPUX :</command></para>
5757 <para><command>print command = lp -c -d%p %s; rm %s</command></para>
5759 <para>For <command>printing = SOFTQ :</command></para>
5760 <para><command>print command = lp -d%p -s %s; rm %s</command></para>
5762 <para>Example: <command>print command = /usr/local/samba/bin/myprintscript
5763 %p %s</command></para>
5770 <term><anchor id="PRINTOK">print ok (S)</term>
5771 <listitem><para>Synonym for <link linkend="PRINTABLE">
5772 <parameter>printable</parameter></link>.</para>
5780 <term><anchor id="PRINTABLE">printable (S)</term>
5781 <listitem><para>If this parameter is <constant>yes</constant>, then
5782 clients may open, write to and submit spool files on the directory
5783 specified for the service. </para>
5785 <para>Note that a printable service will ALWAYS allow writing
5786 to the service path (user privileges permitting) via the spooling
5787 of print data. The <link linkend="WRITEABLE"><parameter>writeable
5788 </parameter></link> parameter controls only non-printing access to
5789 the resource.</para>
5791 <para>Default: <command>printable = no</command></para>
5798 <term><anchor id="PRINTCAP">printcap (G)</term>
5799 <listitem><para>Synonym for <link linkend="PRINTCAPNAME"><parameter>
5800 printcap name</parameter></link>.</para>
5808 <term><anchor id="PRINTCAPNAME">printcap name (G)</term>
5809 <listitem><para>This parameter may be used to override the
5810 compiled-in default printcap name used by the server (usually <filename>
5811 /etc/printcap</filename>). See the discussion of the <link
5812 linkend="PRINTERSSECT">[printers]</link> section above for reasons
5813 why you might want to do this.</para>
5815 <para>On System V systems that use <command>lpstat</command> to
5816 list available printers you can use <command>printcap name = lpstat
5817 </command> to automatically obtain lists of available printers. This
5818 is the default for systems that define SYSV at configure time in
5819 Samba (this includes most System V based systems). If <parameter>
5820 printcap name</parameter> is set to <command>lpstat</command> on
5821 these systems then Samba will launch <command>lpstat -v</command> and
5822 attempt to parse the output to obtain a printer list.</para>
5824 <para>A minimal printcap file would look something like this:</para>
5826 <para><programlisting>
5832 </programlisting></para>
5834 <para>where the '|' separates aliases of a printer. The fact
5835 that the second alias has a space in it gives a hint to Samba
5836 that it's a comment.</para>
5838 <para><emphasis>NOTE</emphasis>: Under AIX the default printcap
5839 name is <filename>/etc/qconfig</filename>. Samba will assume the
5840 file is in AIX <filename>qconfig</filename> format if the string
5841 <filename>qconfig</filename> appears in the printcap filename.</para>
5843 <para>Default: <command>printcap name = /etc/printcap</command></para>
5844 <para>Example: <command>printcap name = /etc/myprintcap</command></para>
5853 <term><anchor id="PRINTERADMIN">printer admin (S)</term>
5854 <listitem><para>This is a list of users that can do anything to
5855 printers via the remote administration interfaces offered by MS-RPC
5856 (usually using a NT workstation). Note that the root user always
5857 has admin rights.</para>
5859 <para>Default: <command>printer admin = <empty string></command>
5861 <para>Example: <command>printer admin = admin, @staff</command></para>
5870 <term><anchor id="PRINTERDRIVER">printer driver (S)</term>
5871 <listitem><para><emphasis>Note :</emphasis>This is a deprecated
5872 parameter and will be removed in the next major release
5873 following version 2.2. Please see the instructions in
5874 the <ulink url="printer_driver2.html">Samba 2.2. Printing
5875 HOWTO</ulink> for more information
5876 on the new method of loading printer drivers onto a Samba server.
5879 <para>This option allows you to control the string
5880 that clients receive when they ask the server for the printer driver
5881 associated with a printer. If you are using Windows95 or Windows NT
5882 then you can use this to automate the setup of printers on your
5885 <para>You need to set this parameter to the exact string (case
5886 sensitive) that describes the appropriate printer driver for your
5887 system. If you don't know the exact string to use then you should
5888 first try with no <link linkend="PRINTERDRIVER"><parameter>
5889 printer driver</parameter></link> option set and the client will
5890 give you a list of printer drivers. The appropriate strings are
5891 shown in a scroll box after you have chosen the printer manufacturer.</para>
5893 <para>See also <link linkend="PRINTERDRIVERFILE"><parameter>printer
5894 driver file</parameter></link>.</para>
5896 <para>Example: <command>printer driver = HP LaserJet 4L</command></para>
5903 <term><anchor id="PRINTERDRIVERFILE">printer driver file (G)</term>
5904 <listitem><para><emphasis>Note :</emphasis>This is a deprecated
5905 parameter and will be removed in the next major release
5906 following version 2.2. Please see the instructions in
5907 the <ulink url="printer_driver2.html">Samba 2.2. Printing
5908 HOWTO</ulink> for more information
5909 on the new method of loading printer drivers onto a Samba server.
5912 <para>This parameter tells Samba where the printer driver
5913 definition file, used when serving drivers to Windows 95 clients, is
5914 to be found. If this is not set, the default is :</para>
5916 <para><filename><replaceable>SAMBA_INSTALL_DIRECTORY</replaceable>
5917 /lib/printers.def</filename></para>
5919 <para>This file is created from Windows 95 <filename>msprint.inf
5920 </filename> files found on the Windows 95 client system. For more
5921 details on setting up serving of printer drivers to Windows 95
5922 clients, see the outdated documentation file in the <filename>docs/</filename>
5923 directory, <filename>PRINTER_DRIVER.txt</filename>.</para>
5925 <para>See also <link linkend="PRINTERDRIVERLOCATION"><parameter>
5926 printer driver location</parameter></link>.</para>
5928 <para>Default: <emphasis>None (set in compile).</emphasis></para>
5930 <para>Example: <command>printer driver file =
5931 /usr/local/samba/printers/drivers.def</command></para>
5939 <term><anchor id="PRINTERDRIVERLOCATION">printer driver location (S)</term>
5940 <listitem><para><emphasis>Note :</emphasis>This is a deprecated
5941 parameter and will be removed in the next major release
5942 following version 2.2. Please see the instructions in
5943 the <ulink url="printer_driver2.html">Samba 2.2. Printing
5944 HOWTO</ulink> for more information
5945 on the new method of loading printer drivers onto a Samba server.
5948 <para>This parameter tells clients of a particular printer
5949 share where to find the printer driver files for the automatic
5950 installation of drivers for Windows 95 machines. If Samba is set up
5951 to serve printer drivers to Windows 95 machines, this should be set to</para>
5953 <para><command>\\MACHINE\PRINTER$</command></para>
5955 <para>Where MACHINE is the NetBIOS name of your Samba server,
5956 and PRINTER$ is a share you set up for serving printer driver
5957 files. For more details on setting this up see the outdated documentation
5958 file in the <filename>docs/</filename> directory, <filename>
5959 PRINTER_DRIVER.txt</filename>.</para>
5961 <para>See also <link linkend="PRINTERDRIVERFILE"><parameter>
5962 printer driver file</parameter></link>.</para>
5964 <para>Default: <command>none</command></para>
5965 <para>Example: <command>printer driver location = \\MACHINE\PRINTER$
5973 <term><anchor id="PRINTERNAME">printer name (S)</term>
5974 <listitem><para>This parameter specifies the name of the printer
5975 to which print jobs spooled through a printable service will be sent.</para>
5977 <para>If specified in the [global] section, the printer
5978 name given will be used for any printable service that does
5979 not have its own printer name specified.</para>
5981 <para>Default: <emphasis>none (but may be <constant>lp</constant>
5982 on many systems)</emphasis></para>
5984 <para>Example: <command>printer name = laserwriter</command></para>
5990 <term><anchor id="PRINTER">printer (S)</term>
5991 <listitem><para>Synonym for <link linkend="PRINTERNAME"><parameter>
5992 printer name</parameter></link>.</para>
5999 <term><anchor id="PRINTING">printing (S)</term>
6000 <listitem><para>This parameters controls how printer status
6001 information is interpreted on your system. It also affects the
6002 default values for the <parameter>print command</parameter>,
6003 <parameter>lpq command</parameter>, <parameter>lppause command
6004 </parameter>, <parameter>lpresume command</parameter>, and
6005 <parameter>lprm command</parameter> if specified in the
6006 [global] section.</para>
6008 <para>Currently nine printing styles are supported. They are
6009 <constant>BSD</constant>, <constant>AIX</constant>,
6010 <constant>LPRNG</constant>, <constant>PLP</constant>,
6011 <constant>SYSV</constant>, <constant>HPUX</constant>,
6012 <constant>QNX</constant>, <constant>SOFTQ</constant>,
6013 and <constant>CUPS</constant>.</para>
6015 <para>To see what the defaults are for the other print
6016 commands when using the various options use the <ulink
6017 url="testparm.1.html">testparm(1)</ulink> program.</para>
6019 <para>This option can be set on a per printer basis</para>
6021 <para>See also the discussion in the <link linkend="PRINTERSSECT">
6022 [printers]</link> section.</para>
6030 <term><anchor id="PROTOCOL">protocol (G)</term>
6031 <listitem><para>Synonym for <link linkend="MAXPROTOCOL">
6032 <parameter>max protocol</parameter></link>.</para></listitem>
6039 <term><anchor id="PUBLIC">public (S)</term>
6040 <listitem><para>Synonym for <link linkend="GUESTOK"><parameter>guest
6041 ok</parameter></link>.</para>
6048 <term><anchor id="QUEUEPAUSECOMMAND">queuepause command (S)</term>
6049 <listitem><para>This parameter specifies the command to be
6050 executed on the server host in order to pause the printer queue.</para>
6052 <para>This command should be a program or script which takes
6053 a printer name as its only parameter and stops the printer queue,
6054 such that no longer jobs are submitted to the printer.</para>
6056 <para>This command is not supported by Windows for Workgroups,
6057 but can be issued from the Printers window under Windows 95
6060 <para>If a <parameter>%p</parameter> is given then the printer name
6061 is put in its place. Otherwise it is placed at the end of the command.
6064 <para>Note that it is good practice to include the absolute
6065 path in the command as the PATH may not be available to the
6068 <para>Default: <emphasis>depends on the setting of <parameter>printing
6069 </parameter></emphasis></para>
6070 <para>Example: <command>queuepause command = disable %p</command></para>
6077 <term><anchor id="QUEUERESUMECOMMAND">queueresume command (S)</term>
6078 <listitem><para>This parameter specifies the command to be
6079 executed on the server host in order to resume the printer queue. It
6080 is the command to undo the behavior that is caused by the
6081 previous parameter (<link linkend="QUEUEPAUSECOMMAND"><parameter>
6082 queuepause command</parameter></link>).</para>
6084 <para>This command should be a program or script which takes
6085 a printer name as its only parameter and resumes the printer queue,
6086 such that queued jobs are resubmitted to the printer.</para>
6088 <para>This command is not supported by Windows for Workgroups,
6089 but can be issued from the Printers window under Windows 95
6092 <para>If a <parameter>%p</parameter> is given then the printer name
6093 is put in its place. Otherwise it is placed at the end of the
6096 <para>Note that it is good practice to include the absolute
6097 path in the command as the PATH may not be available to the
6100 <para>Default: <emphasis>depends on the setting of <link
6101 linkend="PRINTING"><parameter>printing</parameter></link></emphasis>
6104 <para>Example: <command>queuepause command = enable %p
6112 <term><anchor id="READBMPX">read bmpx (G)</term>
6113 <listitem><para>This boolean parameter controls whether <ulink
6114 url="smbd.8.html">smbd(8)</ulink> will support the "Read
6115 Block Multiplex" SMB. This is now rarely used and defaults to
6116 <constant>no</constant>. You should never need to set this
6119 <para>Default: <command>read bmpx = no</command></para>
6127 <term><anchor id="READLIST">read list (S)</term>
6128 <listitem><para>This is a list of users that are given read-only
6129 access to a service. If the connecting user is in this list then
6130 they will not be given write access, no matter what the <link
6131 linkend="WRITEABLE"><parameter>writeable</parameter></link>
6132 option is set to. The list can include group names using the
6133 syntax described in the <link linkend="INVALIDUSERS"><parameter>
6134 invalid users</parameter></link> parameter.</para>
6136 <para>See also the <link linkend="WRITELIST"><parameter>
6137 write list</parameter></link> parameter and the <link
6138 linkend="INVALIDUSERS"><parameter>invalid users</parameter>
6139 </link> parameter.</para>
6141 <para>Default: <command>read list = <empty string></command></para>
6142 <para>Example: <command>read list = mary, @students</command></para>
6149 <term><anchor id="READONLY">read only (S)</term>
6150 <listitem><para>Note that this is an inverted synonym for <link
6151 linkend="WRITEABLE"><parameter>writeable</parameter></link>.</para>
6158 <term><anchor id="READRAW">read raw (G)</term>
6159 <listitem><para>This parameter controls whether or not the server
6160 will support the raw read SMB requests when transferring data
6163 <para>If enabled, raw reads allow reads of 65535 bytes in
6164 one packet. This typically provides a major performance benefit.
6167 <para>However, some clients either negotiate the allowable
6168 block size incorrectly or are incapable of supporting larger block
6169 sizes, and for these clients you may need to disable raw reads.</para>
6171 <para>In general this parameter should be viewed as a system tuning
6172 tool and left severely alone. See also <link linkend="WRITERAW">
6173 <parameter>write raw</parameter></link>.</para>
6175 <para>Default: <command>read raw = yes</command></para>
6181 <term><anchor id="READSIZE">read size (G)</term>
6182 <listitem><para>The option <parameter>read size</parameter>
6183 affects the overlap of disk reads/writes with network reads/writes.
6184 If the amount of data being transferred in several of the SMB
6185 commands (currently SMBwrite, SMBwriteX and SMBreadbraw) is larger
6186 than this value then the server begins writing the data before it
6187 has received the whole packet from the network, or in the case of
6188 SMBreadbraw, it begins writing to the network before all the data
6189 has been read from disk.</para>
6191 <para>This overlapping works best when the speeds of disk and
6192 network access are similar, having very little effect when the
6193 speed of one is much greater than the other.</para>
6195 <para>The default value is 16384, but very little experimentation
6196 has been done yet to determine the optimal value, and it is likely
6197 that the best value will vary greatly between systems anyway.
6198 A value over 65536 is pointless and will cause you to allocate
6199 memory unnecessarily.</para>
6201 <para>Default: <command>read size = 16384</command></para>
6202 <para>Example: <command>read size = 8192</command></para>
6209 <term><anchor id="REMOTEANNOUNCE">remote announce (G)</term>
6210 <listitem><para>This option allows you to setup <ulink
6211 url="nmbd.8.html">nmbd(8)</ulink> to periodically announce itself
6212 to arbitrary IP addresses with an arbitrary workgroup name.</para>
6214 <para>This is useful if you want your Samba server to appear
6215 in a remote workgroup for which the normal browse propagation
6216 rules don't work. The remote workgroup can be anywhere that you
6217 can send IP packets to.</para>
6219 <para>For example:</para>
6221 <para><command>remote announce = 192.168.2.255/SERVERS
6222 192.168.4.255/STAFF</command></para>
6224 <para>the above line would cause <command>nmbd</command> to announce itself
6225 to the two given IP addresses using the given workgroup names.
6226 If you leave out the workgroup name then the one given in
6227 the <link linkend="WORKGROUP"><parameter>workgroup</parameter></link>
6228 parameter is used instead.</para>
6230 <para>The IP addresses you choose would normally be the broadcast
6231 addresses of the remote networks, but can also be the IP addresses
6232 of known browse masters if your network config is that stable.</para>
6234 <para>See the documentation file <filename>BROWSING.txt</filename>
6235 in the <filename>docs/</filename> directory.</para>
6237 <para>Default: <command>remote announce = <empty string>
6245 <term><anchor id="REMOTEBROWSESYNC">remote browse sync (G)</term>
6246 <listitem><para>This option allows you to setup <ulink
6247 url="nmbd.8.html">nmbd(8)</ulink> to periodically request
6248 synchronization of browse lists with the master browser of a Samba
6249 server that is on a remote segment. This option will allow you to
6250 gain browse lists for multiple workgroups across routed networks. This
6251 is done in a manner that does not work with any non-Samba servers.</para>
6253 <para>This is useful if you want your Samba server and all local
6254 clients to appear in a remote workgroup for which the normal browse
6255 propagation rules don't work. The remote workgroup can be anywhere
6256 that you can send IP packets to.</para>
6258 <para>For example:</para>
6260 <para><command>remote browse sync = 192.168.2.255 192.168.4.255
6263 <para>the above line would cause <command>nmbd</command> to request
6264 the master browser on the specified subnets or addresses to
6265 synchronize their browse lists with the local server.</para>
6267 <para>The IP addresses you choose would normally be the broadcast
6268 addresses of the remote networks, but can also be the IP addresses
6269 of known browse masters if your network config is that stable. If
6270 a machine IP address is given Samba makes NO attempt to validate
6271 that the remote machine is available, is listening, nor that it
6272 is in fact the browse master on its segment.</para>
6274 <para>Default: <command>remote browse sync = <empty string>
6283 <term><anchor id="RESTRICTANONYMOUS">restrict anonymous (G)</term>
6284 <listitem><para>This is a boolean parameter. If it is <constant>true</constant>, then
6285 anonymous access to the server will be restricted, namely in the
6286 case where the server is expecting the client to send a username,
6287 but it doesn't. Setting it to <constant>true</constant> will force these anonymous
6288 connections to be denied, and the client will be required to always
6289 supply a username and password when connecting. Use of this parameter
6290 is only recommended for homogeneous NT client environments.</para>
6292 <para>This parameter makes the use of macro expansions that rely
6293 on the username (%U, %G, etc) consistent. NT 4.0
6294 likes to use anonymous connections when refreshing the share list,
6295 and this is a way to work around that.</para>
6297 <para>When restrict anonymous is <constant>true</constant>, all anonymous connections
6298 are denied no matter what they are for. This can effect the ability
6299 of a machine to access the Samba Primary Domain Controller to revalidate
6300 its machine account after someone else has logged on the client
6301 interactively. The NT client will display a message saying that
6302 the machine's account in the domain doesn't exist or the password is
6303 bad. The best way to deal with this is to reboot NT client machines
6304 between interactive logons, using "Shutdown and Restart", rather
6305 than "Close all programs and logon as a different user".</para>
6307 <para>Default: <command>restrict anonymous = no</command></para>
6314 <term><anchor id="ROOT">root (G)</term>
6315 <listitem><para>Synonym for <link linkend="ROOTDIRECTORY">
6316 <parameter>root directory"</parameter></link>.</para>
6323 <term><anchor id="ROOTDIR">root dir (G)</term>
6324 <listitem><para>Synonym for <link linkend="ROOTDIRECTORY">
6325 <parameter>root directory"</parameter></link>.</para>
6331 <term><anchor id="ROOTDIRECTORY">root directory (G)</term>
6332 <listitem><para>The server will <command>chroot()</command> (i.e.
6333 Change its root directory) to this directory on startup. This is
6334 not strictly necessary for secure operation. Even without it the
6335 server will deny access to files not in one of the service entries.
6336 It may also check for, and deny access to, soft links to other
6337 parts of the filesystem, or attempts to use ".." in file names
6338 to access other directories (depending on the setting of the <link
6339 linkend="WIDELINKS"><parameter>wide links</parameter></link>
6342 <para>Adding a <parameter>root directory</parameter> entry other
6343 than "/" adds an extra level of security, but at a price. It
6344 absolutely ensures that no access is given to files not in the
6345 sub-tree specified in the <parameter>root directory</parameter>
6346 option, <emphasis>including</emphasis> some files needed for
6347 complete operation of the server. To maintain full operability
6348 of the server you will need to mirror some system files
6349 into the <parameter>root directory</parameter> tree. In particular
6350 you will need to mirror <filename>/etc/passwd</filename> (or a
6351 subset of it), and any binaries or configuration files needed for
6352 printing (if required). The set of files that must be mirrored is
6353 operating system dependent.</para>
6355 <para>Default: <command>root directory = /</command></para>
6356 <para>Example: <command>root directory = /homes/smb</command></para>
6363 <term><anchor id="ROOTPOSTEXEC">root postexec (S)</term>
6364 <listitem><para>This is the same as the <parameter>postexec</parameter>
6365 parameter except that the command is run as root. This
6366 is useful for unmounting filesystems
6367 (such as CDROMs) after a connection is closed.</para>
6369 <para>See also <link linkend="POSTEXEC"><parameter>
6370 postexec</parameter></link>.</para>
6372 <para>Default: <command>root postexec = <empty string>
6378 <term><anchor id="ROOTPREEXEC">root preexec (S)</term>
6379 <listitem><para>This is the same as the <parameter>preexec</parameter>
6380 parameter except that the command is run as root. This
6381 is useful for mounting filesystems (such as CDROMs) when a
6382 connection is opened.</para>
6384 <para>See also <link linkend="PREEXEC"><parameter>
6385 preexec</parameter></link> and <link linkend="PREEXECCLOSE">
6386 <parameter>preexec close</parameter></link>.</para>
6388 <para>Default: <command>root preexec = <empty string>
6396 <term><anchor id="ROOTPREEXECCLOSE">root preexec close (S)</term>
6397 <listitem><para>This is the same as the <parameter>preexec close
6398 </parameter> parameter except that the command is run as root.</para>
6400 <para>See also <link linkend="PREEXEC"><parameter>
6401 preexec</parameter></link> and <link linkend="PREEXECCLOSE">
6402 <parameter>preexec close</parameter></link>.</para>
6404 <para>Default: <command>root preexec close = no</command></para>
6410 <term><anchor id="SECURITY">security (G)</term>
6411 <listitem><para>This option affects how clients respond to
6412 Samba and is one of the most important settings in the <filename>
6413 smb.conf</filename> file.</para>
6415 <para>The option sets the "security mode bit" in replies to
6416 protocol negotiations with <ulink url="smbd.8.html">smbd(8)
6417 </ulink> to turn share level security on or off. Clients decide
6418 based on this bit whether (and how) to transfer user and password
6419 information to the server.</para>
6422 <para>The default is <command>security = user</command>, as this is
6423 the most common setting needed when talking to Windows 98 and
6426 <para>The alternatives are <command>security = share</command>,
6427 <command>security = server</command> or <command>security = domain
6430 <para>In versions of Samba prior to 2.0.0, the default was
6431 <command>security = share</command> mainly because that was
6432 the only option at one stage.</para>
6434 <para>There is a bug in WfWg that has relevance to this
6435 setting. When in user or server level security a WfWg client
6436 will totally ignore the password you type in the "connect
6437 drive" dialog box. This makes it very difficult (if not impossible)
6438 to connect to a Samba service as anyone except the user that
6439 you are logged into WfWg as.</para>
6441 <para>If your PCs use usernames that are the same as their
6442 usernames on the UNIX machine then you will want to use
6443 <command>security = user</command>. If you mostly use usernames
6444 that don't exist on the UNIX box then use <command>security =
6445 share</command>.</para>
6447 <para>You should also use <command>security = share</command> if you
6448 want to mainly setup shares without a password (guest shares). This
6449 is commonly used for a shared printer server. It is more difficult
6450 to setup guest shares with <command>security = user</command>, see
6451 the <link linkend="MAPTOGUEST"><parameter>map to guest</parameter>
6452 </link>parameter for details.</para>
6454 <para>It is possible to use <command>smbd</command> in a <emphasis>
6455 hybrid mode</emphasis> where it is offers both user and share
6456 level security under different <link linkend="NETBIOSALIASES">
6457 <parameter>NetBIOS aliases</parameter></link>. </para>
6459 <para>The different settings will now be explained.</para>
6462 <para><anchor id="SECURITYEQUALSSHARE"><emphasis>SECURITY = SHARE
6465 <para>When clients connect to a share level security server they
6466 need not log onto the server with a valid username and password before
6467 attempting to connect to a shared resource (although modern clients
6468 such as Windows 95/98 and Windows NT will send a logon request with
6469 a username but no password when talking to a <command>security = share
6470 </command> server). Instead, the clients send authentication information
6471 (passwords) on a per-share basis, at the time they attempt to connect
6472 to that share.</para>
6474 <para>Note that <command>smbd</command> <emphasis>ALWAYS</emphasis>
6475 uses a valid UNIX user to act on behalf of the client, even in
6476 <command>security = share</command> level security.</para>
6478 <para>As clients are not required to send a username to the server
6479 in share level security, <command>smbd</command> uses several
6480 techniques to determine the correct UNIX user to use on behalf
6481 of the client.</para>
6483 <para>A list of possible UNIX usernames to match with the given
6484 client password is constructed using the following methods :</para>
6487 <listitem><para>If the <link linkend="GUESTONLY"><parameter>guest
6488 only</parameter></link> parameter is set, then all the other
6489 stages are missed and only the <link linkend="GUESTACCOUNT">
6490 <parameter>guest account</parameter></link> username is checked.
6493 <listitem><para>Is a username is sent with the share connection
6494 request, then this username (after mapping - see <link
6495 linkend="USERNAMEMAP"><parameter>username map</parameter></link>),
6496 is added as a potential username.</para></listitem>
6498 <listitem><para>If the client did a previous <emphasis>logon
6499 </emphasis> request (the SessionSetup SMB call) then the
6500 username sent in this SMB will be added as a potential username.
6503 <listitem><para>The name of the service the client requested is
6504 added as a potential username.</para></listitem>
6506 <listitem><para>The NetBIOS name of the client is added to
6507 the list as a potential username.</para></listitem>
6509 <listitem><para>Any users on the <link linkend="USER"><parameter>
6510 user</parameter></link> list are added as potential usernames.
6514 <para>If the <parameter>guest only</parameter> parameter is
6515 not set, then this list is then tried with the supplied password.
6516 The first user for whom the password matches will be used as the
6519 <para>If the <parameter>guest only</parameter> parameter is
6520 set, or no username can be determined then if the share is marked
6521 as available to the <parameter>guest account</parameter>, then this
6522 guest user will be used, otherwise access is denied.</para>
6524 <para>Note that it can be <emphasis>very</emphasis> confusing
6525 in share-level security as to which UNIX username will eventually
6526 be used in granting access.</para>
6528 <para>See also the section <link linkend="VALIDATIONSECT">
6529 NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para>
6531 <para><anchor id="SECURITYEQUALSUSER"><emphasis>SECURITY = USER
6534 <para>This is the default security setting in Samba 2.2.
6535 With user-level security a client must first "log-on" with a
6536 valid username and password (which can be mapped using the <link
6537 linkend="USERNAMEMAP"><parameter>username map</parameter></link>
6538 parameter). Encrypted passwords (see the <link linkend="ENCRYPTPASSWORDS">
6539 <parameter>encrypted passwords</parameter></link> parameter) can also
6540 be used in this security mode. Parameters such as <link linkend="USER">
6541 <parameter>user</parameter></link> and <link linkend="GUESTONLY">
6542 <parameter>guest only</parameter></link> if set are then applied and
6543 may change the UNIX user to use on this connection, but only after
6544 the user has been successfully authenticated.</para>
6546 <para><emphasis>Note</emphasis> that the name of the resource being
6547 requested is <emphasis>not</emphasis> sent to the server until after
6548 the server has successfully authenticated the client. This is why
6549 guest shares don't work in user level security without allowing
6550 the server to automatically map unknown users into the <link
6551 linkend="GUESTACCOUNT"><parameter>guest account</parameter></link>.
6552 See the <link linkend="MAPTOGUEST"><parameter>map to guest</parameter>
6553 </link> parameter for details on doing this.</para>
6555 <para>See also the section <link linkend="VALIDATIONSECT">
6556 NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para>
6558 <para><anchor id="SECURITYEQUALSSERVER"><emphasis>SECURITY = SERVER
6561 <para>In this mode Samba will try to validate the username/password
6562 by passing it to another SMB server, such as an NT box. If this
6563 fails it will revert to <command>security = user</command>, but note
6564 that if encrypted passwords have been negotiated then Samba cannot
6565 revert back to checking the UNIX password file, it must have a valid
6566 <filename>smbpasswd</filename> file to check users against. See the
6567 documentation file in the <filename>docs/</filename> directory
6568 <filename>ENCRYPTION.txt</filename> for details on how to set this
6571 <para><emphasis>Note</emphasis> that from the client's point of
6572 view <command>security = server</command> is the same as <command>
6573 security = user</command>. It only affects how the server deals
6574 with the authentication, it does not in any way affect what the
6577 <para><emphasis>Note</emphasis> that the name of the resource being
6578 requested is <emphasis>not</emphasis> sent to the server until after
6579 the server has successfully authenticated the client. This is why
6580 guest shares don't work in user level security without allowing
6581 the server to automatically map unknown users into the <link
6582 linkend="GUESTACCOUNT"><parameter>guest account</parameter></link>.
6583 See the <link linkend="MAPTOGUEST"><parameter>map to guest</parameter>
6584 </link> parameter for details on doing this.</para>
6586 <para>See also the section <link linkend="VALIDATIONSECT">
6587 NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para>
6589 <para>See also the <link linkend="PASSWORDSERVER"><parameter>password
6590 server</parameter></link> parameter and the <link
6591 linkend="ENCRYPTPASSWORDS"><parameter>encrypted passwords</parameter>
6592 </link> parameter.</para>
6594 <para><anchor id="SECURITYEQUALSDOMAIN"><emphasis>SECURITY = DOMAIN
6597 <para>This mode will only work correctly if <ulink
6598 url="smbpasswd.8.html">smbpasswd(8)</ulink> has been used to add this
6599 machine into a Windows NT Domain. It expects the <link
6600 linkend="ENCRYPTPASSWORDS"><parameter>encrypted passwords</parameter>
6601 </link> parameter to be set to <constant>true</constant>. In this
6602 mode Samba will try to validate the username/password by passing
6603 it to a Windows NT Primary or Backup Domain Controller, in exactly
6604 the same way that a Windows NT Server would do.</para>
6606 <para><emphasis>Note</emphasis> that a valid UNIX user must still
6607 exist as well as the account on the Domain Controller to allow
6608 Samba to have a valid UNIX account to map file access to.</para>
6610 <para><emphasis>Note</emphasis> that from the client's point
6611 of view <command>security = domain</command> is the same as <command>security = user
6612 </command>. It only affects how the server deals with the authentication,
6613 it does not in any way affect what the client sees.</para>
6615 <para><emphasis>Note</emphasis> that the name of the resource being
6616 requested is <emphasis>not</emphasis> sent to the server until after
6617 the server has successfully authenticated the client. This is why
6618 guest shares don't work in user level security without allowing
6619 the server to automatically map unknown users into the <link
6620 linkend="GUESTACCOUNT"><parameter>guest account</parameter></link>.
6621 See the <link linkend="MAPTOGUEST"><parameter>map to guest</parameter>
6622 </link> parameter for details on doing this.</para>
6624 <para><emphasis>BUG:</emphasis> There is currently a bug in the
6625 implementation of <command>security = domain</command> with respect
6626 to multi-byte character set usernames. The communication with a
6627 Domain Controller must be done in UNICODE and Samba currently
6628 does not widen multi-byte user names to UNICODE correctly, thus
6629 a multi-byte username will not be recognized correctly at the
6630 Domain Controller. This issue will be addressed in a future release.</para>
6632 <para>See also the section <link linkend="VALIDATIONSECT">
6633 NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para>
6635 <para>See also the <link linkend="PASSWORDSERVER"><parameter>password
6636 server</parameter></link> parameter and the <link
6637 linkend="ENCRYPTPASSWORDS"><parameter>encrypted passwords</parameter>
6638 </link> parameter.</para>
6640 <para>Default: <command>security = USER</command></para>
6641 <para>Example: <command>security = DOMAIN</command></para>
6648 <term><anchor id="SECURITYMASK">security mask (S)</term>
6649 <listitem><para>This parameter controls what UNIX permission
6650 bits can be modified when a Windows NT client is manipulating
6651 the UNIX permission on a file using the native NT security
6654 <para>This parameter is applied as a mask (AND'ed with) to
6655 the changed permission bits, thus preventing any bits not in
6656 this mask from being modified. Essentially, zero bits in this
6657 mask may be treated as a set of bits the user is not allowed
6660 <para>If not set explicitly this parameter is 0777, allowing
6661 a user to modify all the user/group/world permissions on a file.
6664 <para><emphasis>Note</emphasis> that users who can access the
6665 Samba server through other means can easily bypass this
6666 restriction, so it is primarily useful for standalone
6667 "appliance" systems. Administrators of most normal systems will
6668 probably want to leave it set to <constant>0777</constant>.</para>
6670 <para>See also the <link linkend="FORCEDIRECTORYSECURITYMODE">
6671 <parameter>force directory security mode</parameter></link>,
6672 <link linkend="DIRECTORYSECURITYMASK"><parameter>directory
6673 security mask</parameter></link>, <link linkend="FORCESECURITYMODE">
6674 <parameter>force security mode</parameter></link> parameters.</para>
6676 <para>Default: <command>security mask = 0777</command></para>
6677 <para>Example: <command>security mask = 0770</command></para>
6683 <term><anchor id="SERVERSTRING">server string (G)</term>
6684 <listitem><para>This controls what string will show up in the
6685 printer comment box in print manager and next to the IPC connection
6686 in <command>net view</command>. It can be any string that you wish
6687 to show to your users.</para>
6689 <para>It also sets what will appear in browse lists next
6690 to the machine name.</para>
6692 <para>A <parameter>%v</parameter> will be replaced with the Samba
6693 version number.</para>
6695 <para>A <parameter>%h</parameter> will be replaced with the
6698 <para>Default: <command>server string = Samba %v</command></para>
6700 <para>Example: <command>server string = University of GNUs Samba
6701 Server</command></para>
6708 <term><anchor id="SETDIRECTORY">set directory (S)</term>
6709 <listitem><para>If <command>set directory = no</command>, then
6710 users of the service may not use the setdir command to change
6713 <para>The <command>setdir</command> command is only implemented
6714 in the Digital Pathworks client. See the Pathworks documentation
6717 <para>Default: <command>set directory = no</command></para>
6726 <term><anchor id="SHORTPRESERVECASE">short preserve case (S)</term>
6727 <listitem><para>This boolean parameter controls if new files
6728 which conform to 8.3 syntax, that is all in upper case and of
6729 suitable length, are created upper case, or if they are forced
6730 to be the <link linkend="DEFAULTCASE"><parameter>default case
6731 </parameter></link>. This option can be use with <link
6732 linkend="PRESERVECASE"><command>preserve case = yes</command>
6733 </link> to permit long filenames to retain their case, while short
6734 names are lowered. </para>
6736 <para>See the section on <link linkend="NAMEMANGLINGSECT">
6737 NAME MANGLING</link>.</para>
6739 <para>Default: <command>short preserve case = yes</command></para>
6746 <term><anchor id="SHOWADDPRINTERWIZARD">show add printer wizard (G)</term>
6747 <listitem><para>With the introduction of MS-RPC based printing support
6748 for Windows NT/2000 client in Samba 2.2, a "Printers..." folder will
6749 appear on Samba hosts in the share listing. Normally this folder will
6750 contain an icon for the MS Add Printer Wizard (APW). However, it is
6751 possible to disable this feature regardless of the level of privilege
6752 of the connected user.</para>
6754 <para>Under normal circumstances, the Windows NT/2000 client will
6755 open a handle on the printer server with OpenPrinterEx() asking for
6756 Administrator privileges. If the user does not have administrative
6757 access on the print server (i.e is not root or a member of the
6758 <parameter>printer admin</parameter> group), the OpenPrinterEx()
6759 call fails and the client makes another open call with a request for
6760 a lower privilege level. This should succeed, however the APW
6761 icon will not be displayed.</para>
6763 <para>Disabling the <parameter>show add printer wizard</parameter>
6764 parameter will always cause the OpenPrinterEx() on the server
6765 to fail. Thus the APW icon will never be displayed. <emphasis>
6766 Note :</emphasis>This does not prevent the same user from having
6767 administrative privilege on an individual printer.</para>
6769 <para>See also <link linkend="ADDPRINTERCOMMAND"><parameter>addprinter
6770 command</parameter></link>, <link linkend="DELETEPRINTERCOMMAND">
6771 <parameter>deleteprinter command</parameter></link>, <link
6772 linkend="PRINTERADMIN"><parameter>printer admin</parameter></link></para>
6774 <para>Default :<command>show add printer wizard = yes</command></para>
6781 <term><anchor id="SHUTDOWNSCRIPT">shutdown script (G)</term>
6782 <listitem><para><emphasis>This parameter only exists in the HEAD cvs branch</emphasis>
6783 This a full path name to a script called by
6784 <ulink url="smbd.8.html"><command>smbd(8)</command></ulink> that
6785 should start a shutdown procedure.</para>
6787 <para>This command will be run as the user connected to the
6790 <para>%m %t %r %f parameters are expanded</para>
6791 <para><parameter>%m</parameter> will be substituted with the
6792 shutdown message sent to the server.</para>
6793 <para><parameter>%t</parameter> will be substituted with the
6794 number of seconds to wait before effectively starting the
6795 shutdown procedure.</para>
6796 <para><parameter>%r</parameter> will be substituted with the
6797 switch <emphasis>-r</emphasis>. It means reboot after shutdown
6800 <para><parameter>%f</parameter> will be substituted with the
6801 switch <emphasis>-f</emphasis>. It means force the shutdown
6802 even if applications do not respond for NT.</para>
6804 <para>Default: <emphasis>None</emphasis>.</para>
6805 <para>Example: <command>abort shutdown script = /usr/local/samba/sbin/shutdown %m %t %r %f</command></para>
6806 <para>Shutdown script example:
6814 /sbin/shutdown $3 $4 +$time $1 &
6816 Shutdown does not return so we need to launch it in background.
6819 <para>See also <link linkend="ABORTSHUTDOWNSCRIPT"><parameter>abort shutdown script</parameter></link>.</para>
6825 <term><anchor id="SMBPASSWDFILE">smb passwd file (G)</term>
6826 <listitem><para>This option sets the path to the encrypted
6827 smbpasswd file. By default the path to the smbpasswd file
6828 is compiled into Samba.</para>
6830 <para>Default: <command>smb passwd file = ${prefix}/private/smbpasswd
6833 <para>Example: <command>smb passwd file = /etc/samba/smbpasswd
6842 <term><anchor id="SOCKETADDRESS">socket address (G)</term>
6843 <listitem><para>This option allows you to control what
6844 address Samba will listen for connections on. This is used to
6845 support multiple virtual interfaces on the one server, each
6846 with a different configuration.</para>
6848 <para>By default Samba will accept connections on any
6851 <para>Example: <command>socket address = 192.168.2.20</command>
6859 <term><anchor id="SOCKETOPTIONS">socket options (G)</term>
6860 <listitem><para>This option allows you to set socket options
6861 to be used when talking with the client.</para>
6863 <para>Socket options are controls on the networking layer
6864 of the operating systems which allow the connection to be
6867 <para>This option will typically be used to tune your Samba
6868 server for optimal performance for your local network. There is
6869 no way that Samba can know what the optimal parameters are for
6870 your net, so you must experiment and choose them yourself. We
6871 strongly suggest you read the appropriate documentation for your
6872 operating system first (perhaps <command>man setsockopt</command>
6875 <para>You may find that on some systems Samba will say
6876 "Unknown socket option" when you supply an option. This means you
6877 either incorrectly typed it or you need to add an include file
6878 to includes.h for your OS. If the latter is the case please
6879 send the patch to <ulink url="mailto:samba@samba.org">
6880 samba@samba.org</ulink>.</para>
6882 <para>Any of the supported socket options may be combined
6883 in any way you like, as long as your OS allows it.</para>
6885 <para>This is the list of socket options currently settable
6886 using this option:</para>
6889 <listitem><para>SO_KEEPALIVE</para></listitem>
6890 <listitem><para>SO_REUSEADDR</para></listitem>
6891 <listitem><para>SO_BROADCAST</para></listitem>
6892 <listitem><para>TCP_NODELAY</para></listitem>
6893 <listitem><para>IPTOS_LOWDELAY</para></listitem>
6894 <listitem><para>IPTOS_THROUGHPUT</para></listitem>
6895 <listitem><para>SO_SNDBUF *</para></listitem>
6896 <listitem><para>SO_RCVBUF *</para></listitem>
6897 <listitem><para>SO_SNDLOWAT *</para></listitem>
6898 <listitem><para>SO_RCVLOWAT *</para></listitem>
6901 <para>Those marked with a <emphasis>'*'</emphasis> take an integer
6902 argument. The others can optionally take a 1 or 0 argument to enable
6903 or disable the option, by default they will be enabled if you
6904 don't specify 1 or 0.</para>
6906 <para>To specify an argument use the syntax SOME_OPTION = VALUE
6907 for example <command>SO_SNDBUF = 8192</command>. Note that you must
6908 not have any spaces before or after the = sign.</para>
6910 <para>If you are on a local network then a sensible option
6912 <para><command>socket options = IPTOS_LOWDELAY</command></para>
6914 <para>If you have a local network then you could try:</para>
6915 <para><command>socket options = IPTOS_LOWDELAY TCP_NODELAY</command></para>
6917 <para>If you are on a wide area network then perhaps try
6918 setting IPTOS_THROUGHPUT. </para>
6920 <para>Note that several of the options may cause your Samba
6921 server to fail completely. Use these options with caution!</para>
6923 <para>Default: <command>socket options = TCP_NODELAY</command></para>
6924 <para>Example: <command>socket options = IPTOS_LOWDELAY</command></para>
6932 <term><anchor id="SOURCEENVIRONMENT">source environment (G)</term>
6933 <listitem><para>This parameter causes Samba to set environment
6934 variables as per the content of the file named.</para>
6936 <para>If the value of this parameter starts with a "|" character
6937 then Samba will treat that value as a pipe command to open and
6938 will set the environment variables from the output of the pipe.</para>
6940 <para>The contents of the file or the output of the pipe should
6941 be formatted as the output of the standard Unix <command>env(1)
6942 </command> command. This is of the form :</para>
6943 <para>Example environment entry:</para>
6944 <para><command>SAMBA_NETBIOS_NAME = myhostname</command></para>
6946 <para>Default: <emphasis>No default value</emphasis></para>
6947 <para>Examples: <command>source environment = |/etc/smb.conf.sh
6950 <para>Example: <command>source environment =
6951 /usr/local/smb_env_vars</command></para>
6958 <term><anchor id="SSL">ssl (G)</term>
6959 <listitem><para>This variable is part of SSL-enabled Samba. This
6960 is only available if the SSL libraries have been compiled on your
6961 system and the configure option <command>--with-ssl</command> was
6962 given at configure time.</para>
6964 <para>This variable enables or disables the entire SSL mode. If
6965 it is set to <constant>no</constant>, the SSL-enabled Samba behaves
6966 exactly like the non-SSL Samba. If set to <constant>yes</constant>,
6967 it depends on the variables <link linkend="SSLHOSTS"><parameter>
6968 ssl hosts</parameter></link> and <link linkend="SSLHOSTSRESIGN">
6969 <parameter>ssl hosts resign</parameter></link> whether an SSL
6970 connection will be required.</para>
6972 <para>Default: <command>ssl = no</command></para>
6979 <term><anchor id="SSLCACERTDIR">ssl CA certDir (G)</term>
6980 <listitem><para>This variable is part of SSL-enabled Samba. This
6981 is only available if the SSL libraries have been compiled on your
6982 system and the configure option <command>--with-ssl</command> was
6983 given at configure time.</para>
6985 <para>This variable defines where to look up the Certification
6986 Authorities. The given directory should contain one file for
6987 each CA that Samba will trust. The file name must be the hash
6988 value over the "Distinguished Name" of the CA. How this directory
6989 is set up is explained later in this document. All files within the
6990 directory that don't fit into this naming scheme are ignored. You
6991 don't need this variable if you don't verify client certificates.</para>
6993 <para>Default: <command>ssl CA certDir = /usr/local/ssl/certs
7001 <term><anchor id="SSLCACERTFILE">ssl CA certFile (G)</term>
7002 <listitem><para>This variable is part of SSL-enabled Samba. This
7003 is only available if the SSL libraries have been compiled on your
7004 system and the configure option <command>--with-ssl</command> was
7005 given at configure time.</para>
7007 <para>This variable is a second way to define the trusted CAs.
7008 The certificates of the trusted CAs are collected in one big
7009 file and this variable points to the file. You will probably
7010 only use one of the two ways to define your CAs. The first choice is
7011 preferable if you have many CAs or want to be flexible, the second
7012 is preferable if you only have one CA and want to keep things
7013 simple (you won't need to create the hashed file names). You
7014 don't need this variable if you don't verify client certificates.</para>
7016 <para>Default: <command>ssl CA certFile = /usr/local/ssl/certs/trustedCAs.pem
7024 <term><anchor id="SSLCIPHERS">ssl ciphers (G)</term>
7025 <listitem><para>This variable is part of SSL-enabled Samba. This
7026 is only available if the SSL libraries have been compiled on your
7027 system and the configure option <command>--with-ssl</command> was
7028 given at configure time.</para>
7030 <para>This variable defines the ciphers that should be offered
7031 during SSL negotiation. You should not set this variable unless
7032 you know what you are doing.</para>
7038 <term><anchor id="SSLCLIENTCERT">ssl client cert (G)</term>
7039 <listitem><para>This variable is part of SSL-enabled Samba. This
7040 is only available if the SSL libraries have been compiled on your
7041 system and the configure option <command>--with-ssl</command> was
7042 given at configure time.</para>
7044 <para>The certificate in this file is used by <ulink url="smbclient.1.html">
7045 <command>smbclient(1)</command></ulink> if it exists. It's needed
7046 if the server requires a client certificate.</para>
7048 <para>Default: <command>ssl client cert = /usr/local/ssl/certs/smbclient.pem
7056 <term><anchor id="SSLCLIENTKEY">ssl client key (G)</term>
7057 <listitem><para>This variable is part of SSL-enabled Samba. This
7058 is only available if the SSL libraries have been compiled on your
7059 system and the configure option <command>--with-ssl</command> was
7060 given at configure time.</para>
7062 <para>This is the private key for <ulink url="smbclient.1.html">
7063 <command>smbclient(1)</command></ulink>. It's only needed if the
7064 client should have a certificate. </para>
7066 <para>Default: <command>ssl client key = /usr/local/ssl/private/smbclient.pem
7074 <term><anchor id="SSLCOMPATIBILITY">ssl compatibility (G)</term>
7075 <listitem><para>This variable is part of SSL-enabled Samba. This
7076 is only available if the SSL libraries have been compiled on your
7077 system and the configure option <command>--with-ssl</command> was
7078 given at configure time.</para>
7080 <para>This variable defines whether OpenSSL should be configured
7081 for bug compatibility with other SSL implementations. This is
7082 probably not desirable because currently no clients with SSL
7083 implementations other than OpenSSL exist.</para>
7085 <para>Default: <command>ssl compatibility = no</command></para>
7091 <term><anchor id="SSLEGDSOCKET">ssl egd socket (G)</term>
7092 <listitem><para>This variable is part of SSL-enabled Samba. This
7093 is only available if the SSL libraries have been compiled on your
7094 system and the configure option <command>--with-ssl</command> was
7095 given at configure time.</para>
7098 This option is used to define the location of the communiation socket of
7099 an EGD or PRNGD daemon, from which entropy can be retrieved. This option
7100 can be used instead of or together with the <link
7101 linkend="SSLENTROPYFILE"><parameter>ssl entropy file</parameter></link>
7102 directive. 255 bytes of entropy will be retrieved from the daemon.
7105 <para>Default: <emphasis>none</emphasis></para>
7111 <term><anchor id="SSLENTROPYBYTES">ssl entropy bytes (G)</term>
7112 <listitem><para>This variable is part of SSL-enabled Samba. This
7113 is only available if the SSL libraries have been compiled on your
7114 system and the configure option <command>--with-ssl</command> was
7115 given at configure time.</para>
7118 This parameter is used to define the number of bytes which should
7119 be read from the <link linkend="SSLENTROPYFILE"><parameter>ssl entropy
7120 file</parameter></link> If a -1 is specified, the entire file will
7124 <para>Default: <command>ssl entropy bytes = 255</command></para>
7131 <term><anchor id="SSLENTROPYFILE">ssl entropy file (G)</term>
7132 <listitem><para>This variable is part of SSL-enabled Samba. This
7133 is only available if the SSL libraries have been compiled on your
7134 system and the configure option <command>--with-ssl</command> was
7135 given at configure time.</para>
7138 This parameter is used to specify a file from which processes will
7139 read "random bytes" on startup. In order to seed the internal pseudo
7140 random number generator, entropy must be provided. On system with a
7141 <filename>/dev/urandom</filename> device file, the processes
7142 will retrieve its entropy from the kernel. On systems without kernel
7143 entropy support, a file can be supplied that will be read on startup
7144 and that will be used to seed the PRNG.
7147 <para>Default: <emphasis>none</emphasis></para>
7154 <term><anchor id="SSLHOSTS">ssl hosts (G)</term>
7155 <listitem><para>See <link linkend="SSLHOSTSRESIGN"><parameter>
7156 ssl hosts resign</parameter></link>.</para>
7162 <term><anchor id="SSLHOSTSRESIGN">ssl hosts resign (G)</term>
7163 <listitem><para>This variable is part of SSL-enabled Samba. This
7164 is only available if the SSL libraries have been compiled on your
7165 system and the configure option <command>--with-ssl</command> was
7166 given at configure time.</para>
7168 <para>These two variables define whether Samba will go
7169 into SSL mode or not. If none of them is defined, Samba will
7170 allow only SSL connections. If the <link linkend="SSLHOSTS">
7171 <parameter>ssl hosts</parameter></link> variable lists
7172 hosts (by IP-address, IP-address range, net group or name),
7173 only these hosts will be forced into SSL mode. If the <parameter>
7174 ssl hosts resign</parameter> variable lists hosts, only these
7175 hosts will <emphasis>NOT</emphasis> be forced into SSL mode. The syntax for these two
7176 variables is the same as for the <link linkend="HOSTSALLOW"><parameter>
7177 hosts allow</parameter></link> and <link linkend="HOSTSDENY">
7178 <parameter>hosts deny</parameter></link> pair of variables, only
7179 that the subject of the decision is different: It's not the access
7180 right but whether SSL is used or not. </para>
7182 <para>The example below requires SSL connections from all hosts
7183 outside the local net (which is 192.168.*.*).</para>
7185 <para>Default: <command>ssl hosts = <empty string></command></para>
7186 <para><command>ssl hosts resign = <empty string></command></para>
7188 <para>Example: <command>ssl hosts resign = 192.168.</command></para>
7195 <term><anchor id="SSLREQUIRECLIENTCERT">ssl require clientcert (G)</term>
7196 <listitem><para>This variable is part of SSL-enabled Samba. This
7197 is only available if the SSL libraries have been compiled on your
7198 system and the configure option <command>--with-ssl</command> was
7199 given at configure time.</para>
7201 <para>If this variable is set to <constant>yes</constant>, the
7202 server will not tolerate connections from clients that don't
7203 have a valid certificate. The directory/file given in <link
7204 linkend="SSLCACERTDIR"><parameter>ssl CA certDir</parameter>
7205 </link> and <link linkend="SSLCACERTFILE"><parameter>ssl CA certFile
7206 </parameter></link> will be used to look up the CAs that issued
7207 the client's certificate. If the certificate can't be verified
7208 positively, the connection will be terminated. If this variable
7209 is set to <constant>no</constant>, clients don't need certificates.
7210 Contrary to web applications you really <emphasis>should</emphasis>
7211 require client certificates. In the web environment the client's
7212 data is sensitive (credit card numbers) and the server must prove
7213 to be trustworthy. In a file server environment the server's data
7214 will be sensitive and the clients must prove to be trustworthy.</para>
7216 <para>Default: <command>ssl require clientcert = no</command></para>
7223 <term><anchor id="SSLREQUIRESERVERCERT">ssl require servercert (G)</term>
7224 <listitem><para>This variable is part of SSL-enabled Samba. This
7225 is only available if the SSL libraries have been compiled on your
7226 system and the configure option <command>--with-ssl</command> was
7227 given at configure time.</para>
7229 <para>If this variable is set to <constant>yes</constant>, the
7230 <ulink url="smbclient.1.html"><command>smbclient(1)</command>
7231 </ulink> will request a certificate from the server. Same as
7232 <link linkend="SSLREQUIRECLIENTCERT"><parameter>ssl require
7233 clientcert</parameter></link> for the server.</para>
7235 <para>Default: <command>ssl require servercert = no</command>
7241 <term><anchor id="SSLSERVERCERT">ssl server cert (G)</term>
7242 <listitem><para>This variable is part of SSL-enabled Samba. This
7243 is only available if the SSL libraries have been compiled on your
7244 system and the configure option <command>--with-ssl</command> was
7245 given at configure time.</para>
7247 <para>This is the file containing the server's certificate.
7248 The server <emphasis>must</emphasis> have a certificate. The
7249 file may also contain the server's private key. See later for
7250 how certificates and private keys are created.</para>
7252 <para>Default: <command>ssl server cert = <empty string>
7259 <term><anchor id="SSLSERVERKEY">ssl server key (G)</term>
7260 <listitem><para>This variable is part of SSL-enabled Samba. This
7261 is only available if the SSL libraries have been compiled on your
7262 system and the configure option <command>--with-ssl</command> was
7263 given at configure time.</para>
7265 <para>This file contains the private key of the server. If
7266 this variable is not defined, the key is looked up in the
7267 certificate file (it may be appended to the certificate).
7268 The server <emphasis>must</emphasis> have a private key
7269 and the certificate <emphasis>must</emphasis>
7270 match this private key.</para>
7272 <para>Default: <command>ssl server key = <empty string>
7279 <term><anchor id="SSLVERSION">ssl version (G)</term>
7280 <listitem><para>This variable is part of SSL-enabled Samba. This
7281 is only available if the SSL libraries have been compiled on your
7282 system and the configure option <command>--with-ssl</command> was
7283 given at configure time.</para>
7285 <para>This enumeration variable defines the versions of the
7286 SSL protocol that will be used. <constant>ssl2or3</constant> allows
7287 dynamic negotiation of SSL v2 or v3, <constant>ssl2</constant> results
7288 in SSL v2, <constant>ssl3</constant> results in SSL v3 and
7289 <constant>tls1</constant> results in TLS v1. TLS (Transport Layer
7290 Security) is the new standard for SSL.</para>
7292 <para>Default: <command>ssl version = "ssl2or3"</command></para>
7299 <term><anchor id="STATCACHE">stat cache (G)</term>
7300 <listitem><para>This parameter determines if <ulink
7301 url="smbd.8.html">smbd(8)</ulink> will use a cache in order to
7302 speed up case insensitive name mappings. You should never need
7303 to change this parameter.</para>
7305 <para>Default: <command>stat cache = yes</command></para>
7310 <term><anchor id="STATCACHESIZE">stat cache size (G)</term>
7311 <listitem><para>This parameter determines the number of
7312 entries in the <parameter>stat cache</parameter>. You should
7313 never need to change this parameter.</para>
7315 <para>Default: <command>stat cache size = 50</command></para>
7322 <term><anchor id="STATUS">status (G)</term>
7323 <listitem><para>This enables or disables logging of connections
7324 to a status file that <ulink url="smbstatus.1.html">smbstatus(1)</ulink>
7327 <para>With this disabled <command>smbstatus</command> won't be able
7328 to tell you what connections are active. You should never need to
7329 change this parameter.</para>
7331 <para>Default: <command>status = yes</command></para>
7338 <term><anchor id="STRICTALLOCATE">strict allocate (S)</term>
7339 <listitem><para>This is a boolean that controls the handling of
7340 disk space allocation in the server. When this is set to <constant>yes</constant>
7341 the server will change from UNIX behaviour of not committing real
7342 disk storage blocks when a file is extended to the Windows behaviour
7343 of actually forcing the disk system to allocate real storage blocks
7344 when a file is created or extended to be a given size. In UNIX
7345 terminology this means that Samba will stop creating sparse files.
7346 This can be slow on some systems.</para>
7348 <para>When strict allocate is <constant>no</constant> the server does sparse
7349 disk block allocation when a file is extended.</para>
7351 <para>Setting this to <constant>yes</constant> can help Samba return
7352 out of quota messages on systems that are restricting the disk quota
7355 <para>Default: <command>strict allocate = no</command></para>
7362 <term><anchor id="STRICTLOCKING">strict locking (S)</term>
7363 <listitem><para>This is a boolean that controls the handling of
7364 file locking in the server. When this is set to <constant>yes</constant>
7365 the server will check every read and write access for file locks, and
7366 deny access if locks exist. This can be slow on some systems.</para>
7368 <para>When strict locking is <constant>no</constant> the server does file
7369 lock checks only when the client explicitly asks for them.</para>
7371 <para>Well-behaved clients always ask for lock checks when it
7372 is important, so in the vast majority of cases <command>strict
7373 locking = no</command> is preferable.</para>
7375 <para>Default: <command>strict locking = no</command></para>
7382 <term><anchor id="STRICTSYNC">strict sync (S)</term>
7383 <listitem><para>Many Windows applications (including the Windows
7384 98 explorer shell) seem to confuse flushing buffer contents to
7385 disk with doing a sync to disk. Under UNIX, a sync call forces
7386 the process to be suspended until the kernel has ensured that
7387 all outstanding data in kernel disk buffers has been safely stored
7388 onto stable storage. This is very slow and should only be done
7389 rarely. Setting this parameter to <constant>no</constant> (the
7390 default) means that <ulink url="smbd.8.html">smbd</ulink> ignores the Windows applications requests for
7391 a sync call. There is only a possibility of losing data if the
7392 operating system itself that Samba is running on crashes, so there is
7393 little danger in this default setting. In addition, this fixes many
7394 performance problems that people have reported with the new Windows98
7395 explorer shell file copies.</para>
7397 <para>See also the <link linkend="SYNCALWAYS"><parameter>sync
7398 always></parameter></link> parameter.</para>
7400 <para>Default: <command>strict sync = no</command></para>
7406 <term><anchor id="STRIPDOT">strip dot (G)</term>
7407 <listitem><para>This is a boolean that controls whether to
7408 strip trailing dots off UNIX filenames. This helps with some
7409 CDROMs that have filenames ending in a single dot.</para>
7411 <para>Default: <command>strip dot = no</command></para>
7418 <term><anchor id="SYNCALWAYS">sync always (S)</term>
7419 <listitem><para>This is a boolean parameter that controls
7420 whether writes will always be written to stable storage before
7421 the write call returns. If this is <constant>false</constant> then the server will be
7422 guided by the client's request in each write call (clients can
7423 set a bit indicating that a particular write should be synchronous).
7424 If this is <constant>true</constant> then every write will be followed by a <command>fsync()
7425 </command> call to ensure the data is written to disk. Note that
7426 the <parameter>strict sync</parameter> parameter must be set to
7427 <constant>yes</constant> in order for this parameter to have
7430 <para>See also the <link linkend="STRICTSYNC"><parameter>strict
7431 sync</parameter></link> parameter.</para>
7433 <para>Default: <command>sync always = no</command></para>
7440 <term><anchor id="SYSLOG">syslog (G)</term>
7441 <listitem><para>This parameter maps how Samba debug messages
7442 are logged onto the system syslog logging levels. Samba debug
7443 level zero maps onto syslog <constant>LOG_ERR</constant>, debug
7444 level one maps onto <constant>LOG_WARNING</constant>, debug level
7445 two maps onto <constant>LOG_NOTICE</constant>, debug level three
7446 maps onto LOG_INFO. All higher levels are mapped to <constant>
7447 LOG_DEBUG</constant>.</para>
7449 <para>This parameter sets the threshold for sending messages
7450 to syslog. Only messages with debug level less than this value
7451 will be sent to syslog.</para>
7453 <para>Default: <command>syslog = 1</command></para>
7460 <term><anchor id="SYSLOGONLY">syslog only (G)</term>
7461 <listitem><para>If this parameter is set then Samba debug
7462 messages are logged into the system syslog only, and not to
7463 the debug log files.</para>
7465 <para>Default: <command>syslog only = no</command></para>
7472 <term><anchor id="TEMPLATEHOMEDIR">template homedir (G)</term>
7473 <listitem><para>When filling out the user information for a Windows NT
7474 user, the <ulink url="winbindd.8.html">winbindd(8)</ulink> daemon
7475 uses this parameter to fill in the home directory for that user.
7476 If the string <parameter>%D</parameter> is present it is substituted
7477 with the user's Windows NT domain name. If the string <parameter>%U
7478 </parameter> is present it is substituted with the user's Windows
7479 NT user name.</para>
7481 <para>Default: <command>template homedir = /home/%D/%U</command></para>
7488 <term><anchor id="TEMPLATESHELL">template shell (G)</term>
7489 <listitem><para>When filling out the user information for a Windows NT
7490 user, the <ulink url="winbindd.8.html">winbindd(8)</ulink> daemon
7491 uses this parameter to fill in the login shell for that user.</para>
7493 <para>Default: <command>template shell = /bin/false</command></para>
7500 <term><anchor id="TIMEOFFSET">time offset (G)</term>
7501 <listitem><para>This parameter is a setting in minutes to add
7502 to the normal GMT to local time conversion. This is useful if
7503 you are serving a lot of PCs that have incorrect daylight
7504 saving time handling.</para>
7506 <para>Default: <command>time offset = 0</command></para>
7507 <para>Example: <command>time offset = 60</command></para>
7514 <term><anchor id="TIMESERVER">time server (G)</term>
7515 <listitem><para>This parameter determines if <ulink url="nmbd.8.html">
7516 nmbd(8)</ulink> advertises itself as a time server to Windows
7519 <para>Default: <command>time server = no</command></para>
7525 <term><anchor id="TIMESTAMPLOGS">timestamp logs (G)</term>
7526 <listitem><para>Synonym for <link linkend="DEBUGTIMESTAMP"><parameter>
7527 debug timestamp</parameter></link>.</para>
7536 <term><anchor id="TOTALPRINTJOBS">total print jobs (G)</term>
7537 <listitem><para>This parameter accepts an integer value which defines
7538 a limit on the maximum number of print jobs that will be accepted
7539 system wide at any given time. If a print job is submitted
7540 by a client which will exceed this number, then <ulink url="smbd.8.html">smbd</ulink> will return an
7541 error indicating that no space is available on the server. The
7542 default value of 0 means that no such limit exists. This parameter
7543 can be used to prevent a server from exceeding its capacity and is
7544 designed as a printing throttle. See also
7545 <link linkend="MAXPRINTJOBS"><parameter>max print jobs</parameter</link>.
7548 <para>Default: <command>total print jobs = 0</command></para>
7549 <para>Example: <command>total print jobs = 5000</command></para>
7557 <term><anchor id="UNIXPASSWORDSYNC">unix password sync (G)</term>
7558 <listitem><para>This boolean parameter controls whether Samba
7559 attempts to synchronize the UNIX password with the SMB password
7560 when the encrypted SMB password in the smbpasswd file is changed.
7561 If this is set to <constant>true</constant> the program specified in the <parameter>passwd
7562 program</parameter>parameter is called <emphasis>AS ROOT</emphasis> -
7563 to allow the new UNIX password to be set without access to the
7564 old UNIX password (as the SMB password change code has no
7565 access to the old password cleartext, only the new).</para>
7567 <para>See also <link linkend="PASSWDPROGRAM"><parameter>passwd
7568 program</parameter></link>, <link linkend="PASSWDCHAT"><parameter>
7569 passwd chat</parameter></link>.</para>
7571 <para>Default: <command>unix password sync = no</command></para>
7578 <term><anchor id="UPDATEENCRYPTED">update encrypted (G)</term>
7579 <listitem><para>This boolean parameter allows a user logging
7580 on with a plaintext password to have their encrypted (hashed)
7581 password in the smbpasswd file to be updated automatically as
7582 they log on. This option allows a site to migrate from plaintext
7583 password authentication (users authenticate with plaintext
7584 password over the wire, and are checked against a UNIX account
7585 database) to encrypted password authentication (the SMB
7586 challenge/response authentication mechanism) without forcing
7587 all users to re-enter their passwords via smbpasswd at the time the
7588 change is made. This is a convenience option to allow the change over
7589 to encrypted passwords to be made over a longer period. Once all users
7590 have encrypted representations of their passwords in the smbpasswd
7591 file this parameter should be set to <constant>no</constant>.</para>
7593 <para>In order for this parameter to work correctly the <link
7594 linkend="ENCRYPTPASSWORDS"><parameter>encrypt passwords</parameter>
7595 </link> parameter must be set to <constant>no</constant> when
7596 this parameter is set to <constant>yes</constant>.</para>
7598 <para>Note that even when this parameter is set a user
7599 authenticating to <command>smbd</command> must still enter a valid
7600 password in order to connect correctly, and to update their hashed
7601 (smbpasswd) passwords.</para>
7603 <para>Default: <command>update encrypted = no</command></para>
7609 <term><anchor id="USECLIENTDRIVER">use client driver (S)</term>
7610 <listitem><para>This parameter applies only to Windows NT/2000
7611 clients. It has no affect on Windows 95/98/ME clients. When
7612 serving a printer to Windows NT/2000 clients without first installing
7613 a valid printer driver on the Samba host, the client will be required
7614 to install a local printer driver. From this point on, the client
7615 will treat the print as a local printer and not a network printer
7616 connection. This is much the same behavior that will occur
7617 when <command>disable spoolss = yes</command>. </para>
7619 <para>The differentiating
7620 factor is that under normal circumstances, the NT/2000 client will
7621 attempt to open the network printer using MS-RPC. The problem is that
7622 because the client considers the printer to be local, it will attempt
7623 to issue the OpenPrinterEx() call requesting access rights associated
7624 with the logged on user. If the user possesses local administator rights
7625 but not root privilegde on the Samba host (often the case), the OpenPrinterEx()
7626 call will fail. The result is that the client will now display an "Access
7627 Denied; Unable to connect" message in the printer queue window (even though
7628 jobs may successfully be printed). </para>
7630 <para>If this parameter is enabled for a printer, then any attempt
7631 to open the printer with the PRINTER_ACCESS_ADMINISTER right is mapped
7632 to PRINTER_ACCESS_USE instead. Thus allowing the OpenPrinterEx()
7633 call to succeed. <emphasis>This parameter MUST not be able enabled
7634 on a print share which has valid print driver installed on the Samba
7635 server.</emphasis></para>
7637 <para>See also <link linkend="DISABLESPOOLSS">disable spoolss</link>
7640 <para>Default: <command>use client driver = no</command></para>
7647 <term><anchor id="USEMMAP">use mmap (G)</term>
7648 <listitem><para>This global parameter determines if the tdb internals of Samba can
7649 depend on mmap working correctly on the running system. Samba requires a coherent
7650 mmap/read-write system memory cache. Currently only HPUX does not have such a
7651 coherent cache, and so this parameter is set to <constant>false</constant> by
7652 default on HPUX. On all other systems this parameter should be left alone. This
7653 parameter is provided to help the Samba developers track down problems with
7654 the tdb internal code.
7657 <para>Default: <command>use mmap = yes</command></para>
7665 <term><anchor id="USERHOSTS">use rhosts (G)</term>
7666 <listitem><para>If this global parameter is <constant>true</constant>, it specifies
7667 that the UNIX user's <filename>.rhosts</filename> file in their home directory
7668 will be read to find the names of hosts and users who will be allowed
7669 access without specifying a password.</para>
7671 <para><emphasis>NOTE:</emphasis> The use of <parameter>use rhosts
7672 </parameter> can be a major security hole. This is because you are
7673 trusting the PC to supply the correct username. It is very easy to
7674 get a PC to supply a false username. I recommend that the <parameter>
7675 use rhosts</parameter> option be only used if you really know what
7676 you are doing.</para>
7678 <para>Default: <command>use rhosts = no</command></para>
7685 <term><anchor id="USER">user (S)</term>
7686 <listitem><para>Synonym for <link linkend="USERNAME"><parameter>
7687 username</parameter></link>.</para>
7694 <term><anchor id="USERS">users (S)</term>
7695 <listitem><para>Synonym for <link linkend="USERNAME"><parameter>
7696 username</parameter></link>.</para>
7702 <term><anchor id="USERNAME">username (S)</term>
7703 <listitem><para>Multiple users may be specified in a comma-delimited
7704 list, in which case the supplied password will be tested against
7705 each username in turn (left to right).</para>
7707 <para>The <parameter>username</parameter> line is needed only when
7708 the PC is unable to supply its own username. This is the case
7709 for the COREPLUS protocol or where your users have different WfWg
7710 usernames to UNIX usernames. In both these cases you may also be
7711 better using the \\server\share%user syntax instead.</para>
7713 <para>The <parameter>username</parameter> line is not a great
7714 solution in many cases as it means Samba will try to validate
7715 the supplied password against each of the usernames in the
7716 <parameter>username</parameter> line in turn. This is slow and
7717 a bad idea for lots of users in case of duplicate passwords.
7718 You may get timeouts or security breaches using this parameter
7721 <para>Samba relies on the underlying UNIX security. This
7722 parameter does not restrict who can login, it just offers hints
7723 to the Samba server as to what usernames might correspond to the
7724 supplied password. Users can login as whoever they please and
7725 they will be able to do no more damage than if they started a
7726 telnet session. The daemon runs as the user that they log in as,
7727 so they cannot do anything that user cannot do.</para>
7729 <para>To restrict a service to a particular set of users you
7730 can use the <link linkend="VALIDUSERS"><parameter>valid users
7731 </parameter></link> parameter.</para>
7733 <para>If any of the usernames begin with a '@' then the name
7734 will be looked up first in the NIS netgroups list (if Samba
7735 is compiled with netgroup support), followed by a lookup in
7736 the UNIX groups database and will expand to a list of all users
7737 in the group of that name.</para>
7739 <para>If any of the usernames begin with a '+' then the name
7740 will be looked up only in the UNIX groups database and will
7741 expand to a list of all users in the group of that name.</para>
7743 <para>If any of the usernames begin with a '&'then the name
7744 will be looked up only in the NIS netgroups database (if Samba
7745 is compiled with netgroup support) and will expand to a list
7746 of all users in the netgroup group of that name.</para>
7748 <para>Note that searching though a groups database can take
7749 quite some time, and some clients may time out during the
7752 <para>See the section <link linkend="VALIDATIONSECT">NOTE ABOUT
7753 USERNAME/PASSWORD VALIDATION</link> for more information on how
7754 this parameter determines access to the services.</para>
7756 <para>Default: <command>The guest account if a guest service,
7757 else <empty string>.</command></para>
7759 <para>Examples:<command>username = fred, mary, jack, jane,
7760 @users, @pcgroup</command></para>
7767 <term><anchor id="USERNAMELEVEL">username level (G)</term>
7768 <listitem><para>This option helps Samba to try and 'guess' at
7769 the real UNIX username, as many DOS clients send an all-uppercase
7770 username. By default Samba tries all lowercase, followed by the
7771 username with the first letter capitalized, and fails if the
7772 username is not found on the UNIX machine.</para>
7774 <para>If this parameter is set to non-zero the behavior changes.
7775 This parameter is a number that specifies the number of uppercase
7776 combinations to try while trying to determine the UNIX user name. The
7777 higher the number the more combinations will be tried, but the slower
7778 the discovery of usernames will be. Use this parameter when you have
7779 strange usernames on your UNIX machine, such as <constant>AstrangeUser
7782 <para>Default: <command>username level = 0</command></para>
7783 <para>Example: <command>username level = 5</command></para>
7790 <term><anchor id="USERNAMEMAP">username map (G)</term>
7791 <listitem><para>This option allows you to specify a file containing
7792 a mapping of usernames from the clients to the server. This can be
7793 used for several purposes. The most common is to map usernames
7794 that users use on DOS or Windows machines to those that the UNIX
7795 box uses. The other is to map multiple users to a single username
7796 so that they can more easily share files.</para>
7798 <para>The map file is parsed line by line. Each line should
7799 contain a single UNIX username on the left then a '=' followed
7800 by a list of usernames on the right. The list of usernames on the
7801 right may contain names of the form @group in which case they
7802 will match any UNIX username in that group. The special client
7803 name '*' is a wildcard and matches any name. Each line of the
7804 map file may be up to 1023 characters long.</para>
7806 <para>The file is processed on each line by taking the
7807 supplied username and comparing it with each username on the right
7808 hand side of the '=' signs. If the supplied name matches any of
7809 the names on the right hand side then it is replaced with the name
7810 on the left. Processing then continues with the next line.</para>
7812 <para>If any line begins with a '#' or a ';' then it is
7815 <para>If any line begins with an '!' then the processing
7816 will stop after that line if a mapping was done by the line.
7817 Otherwise mapping continues with every line being processed.
7818 Using '!' is most useful when you have a wildcard mapping line
7819 later in the file.</para>
7821 <para>For example to map from the name <constant>admin</constant>
7822 or <constant>administrator</constant> to the UNIX name <constant>
7823 root</constant> you would use:</para>
7825 <para><command>root = admin administrator</command></para>
7827 <para>Or to map anyone in the UNIX group <constant>system</constant>
7828 to the UNIX name <constant>sys</constant> you would use:</para>
7830 <para><command>sys = @system</command></para>
7832 <para>You can have as many mappings as you like in a username
7836 <para>If your system supports the NIS NETGROUP option then
7837 the netgroup database is checked before the <filename>/etc/group
7838 </filename> database for matching groups.</para>
7840 <para>You can map Windows usernames that have spaces in them
7841 by using double quotes around the name. For example:</para>
7843 <para><command>tridge = "Andrew Tridgell"</command></para>
7845 <para>would map the windows username "Andrew Tridgell" to the
7846 unix username "tridge".</para>
7848 <para>The following example would map mary and fred to the
7849 unix user sys, and map the rest to guest. Note the use of the
7850 '!' to tell Samba to stop processing if it gets a match on
7853 <para><programlisting>
7856 </programlisting></para>
7858 <para>Note that the remapping is applied to all occurrences
7859 of usernames. Thus if you connect to \\server\fred and <constant>
7860 fred</constant> is remapped to <constant>mary</constant> then you
7861 will actually be connecting to \\server\mary and will need to
7862 supply a password suitable for <constant>mary</constant> not
7863 <constant>fred</constant>. The only exception to this is the
7864 username passed to the <link linkend="PASSWORDSERVER"><parameter>
7865 password server</parameter></link> (if you have one). The password
7866 server will receive whatever username the client supplies without
7867 modification.</para>
7869 <para>Also note that no reverse mapping is done. The main effect
7870 this has is with printing. Users who have been mapped may have
7871 trouble deleting print jobs as PrintManager under WfWg will think
7872 they don't own the print job.</para>
7874 <para>Default: <emphasis>no username map</emphasis></para>
7875 <para>Example: <command>username map = /usr/local/samba/lib/users.map
7883 <term><anchor id="UTMP">utmp (G)</term>
7884 <listitem><para>This boolean parameter is only available if
7885 Samba has been configured and compiled with the option <command>
7886 --with-utmp</command>. If set to <constant>true</constant> then Samba will attempt
7887 to add utmp or utmpx records (depending on the UNIX system) whenever a
7888 connection is made to a Samba server. Sites may use this to record the
7889 user connecting to a Samba share.</para>
7891 <para>See also the <link linkend="UTMPDIRECTORY"><parameter>
7892 utmp directory</parameter></link> parameter.</para>
7894 <para>Default: <command>utmp = no</command></para>
7901 <term><anchor id="UTMPDIRECTORY">utmp directory(G)</term>
7902 <listitem><para>This parameter is only available if Samba has
7903 been configured and compiled with the option <command>
7904 --with-utmp</command>. It specifies a directory pathname that is
7905 used to store the utmp or utmpx files (depending on the UNIX system) that
7906 record user connections to a Samba server. See also the <link linkend="UTMP">
7907 <parameter>utmp</parameter></link> parameter. By default this is
7908 not set, meaning the system will use whatever utmp file the
7909 native system is set to use (usually
7910 <filename>/var/run/utmp</filename> on Linux).</para>
7912 <para>Default: <emphasis>no utmp directory</emphasis></para>
7919 <term><anchor id="VALIDCHARS">valid chars (G)</term>
7920 <listitem><para>The option allows you to specify additional
7921 characters that should be considered valid by the server in
7922 filenames. This is particularly useful for national character
7923 sets, such as adding u-umlaut or a-ring.</para>
7925 <para>The option takes a list of characters in either integer
7926 or character form with spaces between them. If you give two
7927 characters with a colon between them then it will be taken as
7928 an lowercase:uppercase pair.</para>
7930 <para>If you have an editor capable of entering the characters
7931 into the config file then it is probably easiest to use this
7932 method. Otherwise you can specify the characters in octal,
7933 decimal or hexadecimal form using the usual C notation.</para>
7935 <para>For example to add the single character 'Z' to the charset
7936 (which is a pointless thing to do as it's already there) you could
7937 do one of the following</para>
7939 <para><programlisting>
7942 valid chars = 0132:0172
7943 </programlisting></para>
7945 <para>The last two examples above actually add two characters,
7946 and alter the uppercase and lowercase mappings appropriately.</para>
7948 <para>Note that you <emphasis>MUST</emphasis> specify this parameter
7949 after the <parameter>client code page</parameter> parameter if you
7950 have both set. If <parameter>client code page</parameter> is set after
7951 the <parameter>valid chars</parameter> parameter the <parameter>valid
7952 chars</parameter> settings will be overwritten.</para>
7954 <para>See also the <link linkend="CLIENTCODEPAGE"><parameter>client
7955 code page</parameter></link> parameter.</para>
7957 <para>Default: <emphasis>Samba defaults to using a reasonable set
7958 of valid characters for English systems</emphasis></para>
7960 <para>Example: <command>valid chars = 0345:0305 0366:0326 0344:0304
7963 <para>The above example allows filenames to have the Swedish
7964 characters in them.</para>
7966 <para><emphasis>NOTE:</emphasis> It is actually quite difficult to
7967 correctly produce a <parameter>valid chars</parameter> line for
7968 a particular system. To automate the process <ulink
7969 url="mailto:tino@augsburg.net">tino@augsburg.net</ulink> has written
7970 a package called <command>validchars</command> which will automatically
7971 produce a complete <parameter>valid chars</parameter> line for
7972 a given client system. Look in the <filename>examples/validchars/
7973 </filename> subdirectory of your Samba source code distribution
7974 for this package.</para>
7981 <term><anchor id="VALIDUSERS">valid users (S)</term>
7982 <listitem><para>This is a list of users that should be allowed
7983 to login to this service. Names starting with '@', '+' and '&'
7984 are interpreted using the same rules as described in the
7985 <parameter>invalid users</parameter> parameter.</para>
7987 <para>If this is empty (the default) then any user can login.
7988 If a username is in both this list and the <parameter>invalid
7989 users</parameter> list then access is denied for that user.</para>
7991 <para>The current servicename is substituted for <parameter>%S
7992 </parameter>. This is useful in the [homes] section.</para>
7994 <para>See also <link linkend="INVALIDUSERS"><parameter>invalid users
7995 </parameter></link></para>
7997 <para>Default: <emphasis>No valid users list (anyone can login)
8000 <para>Example: <command>valid users = greg, @pcusers</command></para>
8008 <term><anchor id="VETOFILES">veto files(S)</term>
8009 <listitem><para>This is a list of files and directories that
8010 are neither visible nor accessible. Each entry in the list must
8011 be separated by a '/', which allows spaces to be included
8012 in the entry. '*' and '?' can be used to specify multiple files
8013 or directories as in DOS wildcards.</para>
8015 <para>Each entry must be a unix path, not a DOS path and
8016 must <emphasis>not</emphasis> include the unix directory
8017 separator '/'.</para>
8019 <para>Note that the <parameter>case sensitive</parameter> option
8020 is applicable in vetoing files.</para>
8022 <para>One feature of the veto files parameter that it
8023 is important to be aware of is Samba's behaviour when
8024 trying to delete a directory. If a directory that is
8025 to be deleted contains nothing but veto files this
8026 deletion will <emphasis>fail</emphasis> unless you also set
8027 the <parameter>delete veto files</parameter> parameter to
8028 <parameter>yes</parameter>.</para>
8030 <para>Setting this parameter will affect the performance
8031 of Samba, as it will be forced to check all files and directories
8032 for a match as they are scanned.</para>
8034 <para>See also <link linkend="HIDEFILES"><parameter>hide files
8035 </parameter></link> and <link linkend="CASESENSITIVE"><parameter>
8036 case sensitive</parameter></link>.</para>
8038 <para>Default: <emphasis>No files or directories are vetoed.
8041 <para>Examples:<programlisting>
8042 ; Veto any files containing the word Security,
8043 ; any ending in .tmp, and any directory containing the
8045 veto files = /*Security*/*.tmp/*root*/
8047 ; Veto the Apple specific files that a NetAtalk server
8049 veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/
8050 </programlisting></para>
8056 <term><anchor id="VETOOPLOCKFILES">veto oplock files (S)</term>
8057 <listitem><para>This parameter is only valid when the <link
8058 linkend="OPLOCKS"><parameter>oplocks</parameter></link>
8059 parameter is turned on for a share. It allows the Samba administrator
8060 to selectively turn off the granting of oplocks on selected files that
8061 match a wildcarded list, similar to the wildcarded list used in the
8062 <link linkend="VETOFILES"><parameter>veto files</parameter></link>
8065 <para>Default: <emphasis>No files are vetoed for oplock
8066 grants</emphasis></para>
8068 <para>You might want to do this on files that you know will
8069 be heavily contended for by clients. A good example of this
8070 is in the NetBench SMB benchmark program, which causes heavy
8071 client contention for files ending in <filename>.SEM</filename>.
8072 To cause Samba not to grant oplocks on these files you would use
8073 the line (either in the [global] section or in the section for
8074 the particular NetBench share :</para>
8076 <para>Example: <command>veto oplock files = /*.SEM/
8084 <term><anchor id="VFSOBJECT">vfs object (S)</term>
8085 <listitem><para>This parameter specifies a shared object file that
8086 is used for Samba VFS I/O operations. By default, normal
8087 disk I/O operations are used but these can be overloaded
8088 with a VFS object. The Samba VFS layer is new to Samba 2.2 and
8089 must be enabled at compile time with --with-vfs.</para>
8091 <para>Default : <emphasis>no value</emphasis></para>
8099 <term><anchor id="VFSOPTIONS">vfs options (S)</term>
8100 <listitem><para>This parameter allows parameters to be passed
8101 to the vfs layer at initialization time. The Samba VFS layer
8102 is new to Samba 2.2 and must be enabled at compile time
8103 with --with-vfs. See also <link linkend="VFSOBJECT"><parameter>
8104 vfs object</parameter></link>.</para>
8106 <para>Default : <emphasis>no value</emphasis></para>
8113 <term><anchor id="VOLUME">volume (S)</term>
8114 <listitem><para> This allows you to override the volume label
8115 returned for a share. Useful for CDROMs with installation programs
8116 that insist on a particular volume label.</para>
8118 <para>Default: <emphasis>the name of the share</emphasis></para>
8125 <term><anchor id="WIDELINKS">wide links (S)</term>
8126 <listitem><para>This parameter controls whether or not links
8127 in the UNIX file system may be followed by the server. Links
8128 that point to areas within the directory tree exported by the
8129 server are always allowed; this parameter controls access only
8130 to areas that are outside the directory tree being exported.</para>
8132 <para>Note that setting this parameter can have a negative
8133 effect on your server performance due to the extra system calls
8134 that Samba has to do in order to perform the link checks.</para>
8136 <para>Default: <command>wide links = yes</command></para>
8144 <term><anchor id="WINBINDCACHETIME">winbind cache time</term>
8145 <listitem><para>This parameter specifies the number of seconds the
8146 <ulink url="winbindd.8.html">winbindd(8)</ulink> daemon will cache
8147 user and group information before querying a Windows NT server
8150 <para>Default: <command>winbind cache type = 15</command></para>
8156 <term><anchor id="WINBINDENUMUSERS">winbind enum
8157 users</term> <listitem><para>On large installations using
8158 <ulink url="winbindd.8.html">winbindd(8)</ulink> it may be
8159 necessary to suppress the enumeration of users through the
8160 <command> setpwent()</command>,
8161 <command>getpwent()</command> and
8162 <command>endpwent()</command> group of system calls. If
8163 the <parameter>winbind enum users</parameter> parameter is
8164 false, calls to the <command>getpwent</command> system call
8165 will not return any data. </para>
8167 <para><emphasis>Warning:</emphasis> Turning off user
8168 enumeration may cause some programs to behave oddly. For
8169 example, the finger program relies on having access to the
8170 full user list when searching for matching
8173 <para>Default: <command>winbind enum users = yes </command></para>
8178 <term><anchor id="WINBINDENUMGROUPS">winbind enum
8179 groups</term> <listitem><para>On large installations using
8180 <ulink url="winbindd.8.html">winbindd(8)</ulink> it may be
8181 necessary to suppress the enumeration of groups through the
8182 <command> setgrent()</command>,
8183 <command>getgrent()</command> and
8184 <command>endgrent()</command> group of system calls. If
8185 the <parameter>winbind enum groups</parameter> parameter is
8186 false, calls to the <command>getgrent()</command> system
8187 call will not return any data. </para>
8189 <para><emphasis>Warning:</emphasis> Turning off group
8190 enumeration may cause some programs to behave oddly.
8193 <para>Default: <command>winbind enum groups = yes </command>
8199 <term><anchor id="WINBINDGID">winbind gid</term>
8200 <listitem><para>The winbind gid parameter specifies the range of group
8201 ids that are allocated by the <ulink url="winbindd.8.html">
8202 winbindd(8)</ulink> daemon. This range of group ids should have no
8203 existing local or NIS groups within it as strange conflicts can
8204 occur otherwise.</para>
8206 <para>Default: <command>winbind gid = <empty string>
8209 <para>Example: <command>winbind gid = 10000-20000</command></para>
8215 <term><anchor id="WINBINDSEPARATOR">winbind separator</term>
8216 <listitem><para>This parameter allows an admin to define the character
8217 used when listing a username of the form of <replaceable>DOMAIN
8218 </replaceable>\<replaceable>user</replaceable>. This parameter
8219 is only applicable when using the <filename>pam_winbind.so</filename>
8220 and <filename>nss_winbind.so</filename> modules for UNIX services.
8223 <para>Example: <command>winbind separator = \</command></para>
8224 <para>Example: <command>winbind separator = +</command></para>
8232 <term><anchor id="WINBINDUID">winbind uid</term>
8233 <listitem><para>The winbind gid parameter specifies the range of group
8234 ids that are allocated by the <ulink url="winbindd.8.html">
8235 winbindd(8)</ulink> daemon. This range of ids should have no
8236 existing local or NIS users within it as strange conflicts can
8237 occur otherwise.</para>
8239 <para>Default: <command>winbind uid = <empty string>
8242 <para>Example: <command>winbind uid = 10000-20000</command></para>
8248 <term>winbind use default domain</term>
8251 <term><anchor id="WINBINDUSEDEFAULTDOMAIN">winbind use default domain</term>
8252 <listitem><para>This parameter specifies whether the <ulink url="winbindd.8.html">
8254 daemon should operate on users without domain component in their username.
8255 Users without a domain component are treated as is part of the winbindd server's
8256 own domain. While this does not benifit Windows users, it makes SSH, FTP and e-mail
8257 function in a way much closer to the way they would in a native unix system.</para>
8259 <para>Default: <command>winbind use default domain = <falseg>
8261 <para>Example: <command>winbind use default domain = true</command></para>
8267 <term><anchor id="WINSHOOK">wins hook (G)</term>
8268 <listitem><para>When Samba is running as a WINS server this
8269 allows you to call an external program for all changes to the
8270 WINS database. The primary use for this option is to allow the
8271 dynamic update of external name resolution databases such as
8274 <para>The wins hook parameter specifies the name of a script
8275 or executable that will be called as follows:</para>
8277 <para><command>wins_hook operation name nametype ttl IP_list
8281 <listitem><para>The first argument is the operation and is one
8282 of "add", "delete", or "refresh". In most cases the operation can
8283 be ignored as the rest of the parameters provide sufficient
8284 information. Note that "refresh" may sometimes be called when the
8285 name has not previously been added, in that case it should be treated
8286 as an add.</para></listitem>
8288 <listitem><para>The second argument is the NetBIOS name. If the
8289 name is not a legal name then the wins hook is not called.
8290 Legal names contain only letters, digits, hyphens, underscores
8291 and periods.</para></listitem>
8293 <listitem><para>The third argument is the NetBIOS name
8294 type as a 2 digit hexadecimal number. </para></listitem>
8296 <listitem><para>The fourth argument is the TTL (time to live)
8297 for the name in seconds.</para></listitem>
8299 <listitem><para>The fifth and subsequent arguments are the IP
8300 addresses currently registered for that name. If this list is
8301 empty then the name should be deleted.</para></listitem>
8304 <para>An example script that calls the BIND dynamic DNS update
8305 program <command>nsupdate</command> is provided in the examples
8306 directory of the Samba source code. </para>
8315 <term><anchor id="WINSPROXY">wins proxy (G)</term>
8316 <listitem><para>This is a boolean that controls if <ulink
8317 url="nmbd.8.html">nmbd(8)</ulink> will respond to broadcast name
8318 queries on behalf of other hosts. You may need to set this
8319 to <constant>yes</constant> for some older clients.</para>
8321 <para>Default: <command>wins proxy = no</command></para>
8329 <term><anchor id="WINSSERVER">wins server (G)</term>
8330 <listitem><para>This specifies the IP address (or DNS name: IP
8331 address for preference) of the WINS server that <ulink url="nmbd.8.html">
8332 nmbd(8)</ulink> should register with. If you have a WINS server on
8333 your network then you should set this to the WINS server's IP.</para>
8335 <para>You should point this at your WINS server if you have a
8336 multi-subnetted network.</para>
8338 <para><emphasis>NOTE</emphasis>. You need to set up Samba to point
8339 to a WINS server if you have multiple subnets and wish cross-subnet
8340 browsing to work correctly.</para>
8342 <para>See the documentation file <filename>BROWSING.txt</filename>
8343 in the docs/ directory of your Samba source distribution.</para>
8345 <para>Default: <emphasis>not enabled</emphasis></para>
8346 <para>Example: <command>wins server = 192.9.200.1</command></para>
8353 <term><anchor id="WINSSUPPORT">wins support (G)</term>
8354 <listitem><para>This boolean controls if the <ulink url="nmbd.8.html">
8355 nmbd(8)</ulink> process in Samba will act as a WINS server. You should
8356 not set this to <constant>true</constant> unless you have a multi-subnetted network and
8357 you wish a particular <command>nmbd</command> to be your WINS server.
8358 Note that you should <emphasis>NEVER</emphasis> set this to <constant>true</constant>
8359 on more than one machine in your network.</para>
8361 <para>Default: <command>wins support = no</command></para>
8368 <term><anchor id="WORKGROUP">workgroup (G)</term>
8369 <listitem><para>This controls what workgroup your server will
8370 appear to be in when queried by clients. Note that this parameter
8371 also controls the Domain name used with the <link
8372 linkend="SECURITYEQUALSDOMAIN"><command>security = domain</command></link>
8375 <para>Default: <emphasis>set at compile time to WORKGROUP</emphasis></para>
8376 <para>Example: <command>workgroup = MYGROUP</command></para>
8384 <term><anchor id="WRITABLE">writable (S)</term>
8385 <listitem><para>Synonym for <link linkend="WRITEABLE"><parameter>
8386 writeable</parameter></link> for people who can't spell :-).</para>
8393 <term><anchor id="WRITECACHESIZE">write cache size (S)</term>
8394 <listitem><para>If this integer parameter is set to non-zero value,
8395 Samba will create an in-memory cache for each oplocked file
8396 (it does <emphasis>not</emphasis> do this for
8397 non-oplocked files). All writes that the client does not request
8398 to be flushed directly to disk will be stored in this cache if possible.
8399 The cache is flushed onto disk when a write comes in whose offset
8400 would not fit into the cache or when the file is closed by the client.
8401 Reads for the file are also served from this cache if the data is stored
8404 <para>This cache allows Samba to batch client writes into a more
8405 efficient write size for RAID disks (i.e. writes may be tuned to
8406 be the RAID stripe size) and can improve performance on systems
8407 where the disk subsystem is a bottleneck but there is free
8408 memory for userspace programs.</para>
8410 <para>The integer parameter specifies the size of this cache
8411 (per oplocked file) in bytes.</para>
8413 <para>Default: <command>write cache size = 0</command></para>
8414 <para>Example: <command>write cache size = 262144</command></para>
8416 <para>for a 256k cache size per file.</para>
8425 <term><anchor id="WRITELIST">write list (S)</term>
8426 <listitem><para>This is a list of users that are given read-write
8427 access to a service. If the connecting user is in this list then
8428 they will be given write access, no matter what the <link
8429 linkend="WRITEABLE"><parameter>writeable</parameter></link>
8430 option is set to. The list can include group names using the
8431 @group syntax.</para>
8433 <para>Note that if a user is in both the read list and the
8434 write list then they will be given write access.</para>
8436 <para>See also the <link linkend="READLIST"><parameter>read list
8437 </parameter></link> option.</para>
8439 <para>Default: <command>write list = <empty string>
8442 <para>Example: <command>write list = admin, root, @staff
8452 <term><anchor id="WRITEOK">write ok (S)</term>
8453 <listitem><para>Synonym for <link linkend="WRITEABLE"><parameter>
8454 writeable</parameter></link>.</para>
8461 <term><anchor id="WRITERAW">write raw (G)</term>
8462 <listitem><para>This parameter controls whether or not the server
8463 will support raw write SMB's when transferring data from clients.
8464 You should never need to change this parameter.</para>
8466 <para>Default: <command>write raw = yes</command></para>
8473 <term><anchor id="WRITEABLE">writeable (S)</term>
8474 <listitem><para>An inverted synonym is <link linkend="READONLY">
8475 <parameter>read only</parameter></link>.</para>
8477 <para>If this parameter is <constant>no</constant>, then users
8478 of a service may not create or modify files in the service's
8481 <para>Note that a printable service (<command>printable = yes</command>)
8482 will <emphasis>ALWAYS</emphasis> allow writing to the directory
8483 (user privileges permitting), but only via spooling operations.</para>
8485 <para>Default: <command>writeable = no</command></para>
8495 <title>WARNINGS</title>
8497 <para>Although the configuration file permits service names
8498 to contain spaces, your client software may not. Spaces will
8499 be ignored in comparisons anyway, so it shouldn't be a
8500 problem - but be aware of the possibility.</para>
8502 <para>On a similar note, many clients - especially DOS clients -
8503 limit service names to eight characters. <ulink url="smbd.8.html">smbd(8)
8504 </ulink> has no such limitation, but attempts to connect from such
8505 clients will fail if they truncate the service names. For this reason
8506 you should probably keep your service names down to eight characters
8509 <para>Use of the [homes] and [printers] special sections make life
8510 for an administrator easy, but the various combinations of default
8511 attributes can be tricky. Take extreme care when designing these
8512 sections. In particular, ensure that the permissions on spool
8513 directories are correct.</para>
8517 <title>VERSION</title>
8519 <para>This man page is correct for version 2.2 of
8520 the Samba suite.</para>
8524 <title>SEE ALSO</title>
8525 <para><ulink url="samba.7.html">samba(7)</ulink>,
8526 <ulink url="smbpasswd.8.html"><command>smbpasswd(8)</command></ulink>,
8527 <ulink url="swat.8.html"><command>swat(8)</command></ulink>,
8528 <ulink url="smbd.8.html"><command>smbd(8)</command></ulink>,
8529 <ulink url="nmbd.8.html"><command>nmbd(8)</command></ulink>,
8530 <ulink url="smbclient.1.html"><command>smbclient(1)</command></ulink>,
8531 <ulink url="nmblookup.1.html"><command>nmblookup(1)</command></ulink>,
8532 <ulink url="testparm.1.html"><command>testparm(1)</command></ulink>,
8533 <ulink url="testprns.1.html"><command>testprns(1)</command></ulink>
8538 <title>AUTHOR</title>
8540 <para>The original Samba software and related utilities
8541 were created by Andrew Tridgell. Samba is now developed
8542 by the Samba Team as an Open Source project similar
8543 to the way the Linux kernel is developed.</para>
8545 <para>The original Samba man pages were written by Karl Auer.
8546 The man page sources were converted to YODL format (another
8547 excellent piece of Open Source software, available at
8548 <ulink url="ftp://ftp.icce.rug.nl/pub/unix/">
8549 ftp://ftp.icce.rug.nl/pub/unix/</ulink>) and updated for the Samba 2.0
8550 release by Jeremy Allison. The conversion to DocBook for
8551 Samba 2.2 was done by Gerald Carter</para>