1SMB.CONF(5) File Formats and Conventions SMB.CONF(5)
2
6 smb.conf - The configuration file for the Samba suite
7
9 The smb.conf file is a configuration file for the Samba suite.
10 smb.conf contains runtime configuration information for the Samba
11 programs. The complete description of the file format and possible
12 parameters held within are here for reference purposes.
13
15 The file consists of sections and parameters. A section begins with the
16 name of the section in square brackets and continues until the next
17 section begins. Sections contain parameters of the form:
18 name = value
20 The file is line-based - that is, each newline-terminated line
22 represents either a comment, a section name or a parameter.
23 Section and parameter names are not case sensitive.
25 Only the first equals sign in a parameter is significant. Whitespace
27 before or after the first equals sign is discarded. Leading, trailing
28 and internal whitespace in section and parameter names is irrelevant.
29 Leading and trailing whitespace in a parameter value is discarded.
30 Internal whitespace within a parameter value is retained verbatim.
31 Any line beginning with a semicolon (“;”) or a hash (“#”) character is
33 ignored, as are lines containing only whitespace.
34 Any line ending in a “\” is continued on the next line in the customary
36 UNIX fashion.
37 The values following the equals sign in parameters are all either a
39 string (no quotes needed) or a boolean, which may be given as yes/no,
40 1/0 or true/false. Case is not significant in boolean values, but is
41 preserved in string values. Some items such as create masks are
42 numeric.
43
45 Each section in the configuration file (except for the [global]
46 section) describes a shared resource (known as a “share”). The section
47 name is the name of the shared resource and the parameters within the
48 section define the shares attributes.
49 There are three special sections, [global], [homes] and [printers],
51 which are described under special sections. The following notes apply
52 to ordinary section descriptions.
53 A share consists of a directory to which access is being given plus a
55 description of the access rights which are granted to the user of the
56 service. Some housekeeping options are also specifiable.
57 Sections are either file share services (used by the client as an
59 extension of their native file systems) or printable services (used by
60 the client to access print services on the host running the server).
61 Sections may be designated guest services, in which case no password is
63 required to access them. A specified UNIX guest account is used to
64 define access privileges in this case.
65 Sections other than guest services will require a password to access
67 them. The client provides the username. As older clients only provide
68 passwords and not usernames, you may specify a list of usernames to
69 check against the password using the user = option in the share
70 definition. For modern clients such as Windows 95/98/ME/NT/2000, this
71 should not be necessary.
72 The access rights granted by the server are masked by the access rights
74 granted to the specified or guest UNIX user by the host system. The
75 server does not grant more access than the host system grants.
76 The following sample section defines a file space share. The user has
78 write access to the path /home/bar. The share is accessed via the share
79 name foo:
80 [foo]
82 path = /home/bar
83 read only = no
84 The following sample section defines a printable share. The share is
86 read-only, but printable. That is, the only write access permitted is
87 via calls to open, write to and close a spool file. The guest ok
88 parameter means access will be permitted as the default guest user
89 (specified elsewhere):
90 [aprinter]
92 path = /usr/spool/public
93 read only = yes
94 printable = yes
95 guest ok = yes
96
99 The [global] section
100 Parameters in this section apply to the server as a whole, or are
101 defaults for sections that do not specifically define certain items.
102 See the notes under PARAMETERS for more information.
103 The [homes] section
105 If a section called [homes] is included in the configuration file,
106 services connecting clients to their home directories can be created on
107 the fly by the server.
108 When the connection request is made, the existing sections are scanned.
110 If a match is found, it is used. If no match is found, the requested
111 section name is treated as a username and looked up in the local
112 password file. If the name exists and the correct password has been
113 given, a share is created by cloning the [homes] section.
114 Some modifications are then made to the newly created share:
116 · The share name is changed from homes to the located
118 username.
119 · If no path was given, the path is set to the user's home
121 directory.
122 If you decide to use a path = line in your [homes] section, it may be
125 useful to use the %S macro. For example:
126 path = /data/pchome/%S
128 is useful if you have different home directories for your PCs than for
130 UNIX access.
131 This is a fast and simple way to give a large number of clients access
133 to their home directories with a minimum of fuss.
134 A similar process occurs if the requested section name is “homes”,
136 except that the share name is not changed to that of the requesting
137 user. This method of using the [homes] section works well if different
138 users share a client PC.
139 The [homes] section can specify all the parameters a normal service
141 section can specify, though some make more sense than others. The
142 following is a typical and suitable [homes] section:
143 [homes]
145 read only = no
146 An important point is that if guest access is specified in the [homes]
148 section, all home directories will be visible to all clients without a
149 password. In the very unlikely event that this is actually desirable,
150 it is wise to also specify read only access.
151 The browseable flag for auto home directories will be inherited from
153 the global browseable flag, not the [homes] browseable flag. This is
154 useful as it means setting browseable = no in the [homes] section will
155 hide the [homes] share but make any auto home directories visible.
156 The [printers] section
158 This section works like [homes], but for printers.
159 If a [printers] section occurs in the configuration file, users are
161 able to connect to any printer specified in the local host's printcap
162 file.
163 When a connection request is made, the existing sections are scanned.
165 If a match is found, it is used. If no match is found, but a [homes]
166 section exists, it is used as described above. Otherwise, the requested
167 section name is treated as a printer name and the appropriate printcap
168 file is scanned to see if the requested section name is a valid printer
169 share name. If a match is found, a new printer share is created by
170 cloning the [printers] section.
171 A few modifications are then made to the newly created share:
173 · The share name is set to the located printer name
175 · If no printer name was given, the printer name is set to the
177 located printer name
178 · If the share does not permit guest access and no username
180 was given, the username is set to the located printer name.
181 The [printers] service MUST be printable - if you specify otherwise,
184 the server will refuse to load the configuration file.
185 Typically the path specified is that of a world-writeable spool
187 directory with the sticky bit set on it. A typical [printers] entry
188 looks like this:
189 [printers]
191 path = /usr/spool/public
192 guest ok = yes
193 printable = yes
194 All aliases given for a printer in the printcap file are legitimate
196 printer names as far as the server is concerned. If your printing
197 subsystem doesn't work like that, you will have to set up a
198 pseudo-printcap. This is a file consisting of one or more lines like
199 this:
200 alias|alias|alias|alias...
202 Each alias should be an acceptable printer name for your printing
204 subsystem. In the [global] section, specify the new file as your
205 printcap. The server will only recognize names found in your
206 pseudo-printcap, which of course can contain whatever aliases you like.
207 The same technique could be used simply to limit access to a subset of
208 your local printers.
209 An alias, by the way, is defined as any component of the first entry of
211 a printcap record. Records are separated by newlines, components (if
212 there are more than one) are separated by vertical bar symbols (|).
213 Note
215 On SYSV systems which use lpstat to determine what printers are
216 defined on the system you may be able to use printcap name = lpstat
217 to automatically obtain a list of printers. See the printcap name
218 option for more details.
219
221 Starting with Samba version 3.0.23 the capability for non-root users to
222 add, modify, and delete their own share definitions has been added.
223 This capability is called usershares and is controlled by a set of
224 parameters in the [global] section of the smb.conf. The relevant
225 parameters are :
226 usershare allow guests
228 Controls if usershares can permit guest access.
229 usershare max shares
231 Maximum number of user defined shares allowed.
232 usershare owner only
234 If set only directories owned by the sharing user can be shared.
235 usershare path
237 Points to the directory containing the user defined share
238 definitions. The filesystem permissions on this directory control
239 who can create user defined shares.
240 usershare prefix allow list
242 Comma-separated list of absolute pathnames restricting what
243 directories can be shared. Only directories below the pathnames in
244 this list are permitted.
245 usershare prefix deny list
247 Comma-separated list of absolute pathnames restricting what
248 directories can be shared. Directories below the pathnames in this
249 list are prohibited.
250 usershare template share
252 Names a pre-existing share used as a template for creating new
253 usershares. All other share parameters not specified in the user
254 defined share definition are copied from this named share.
255 To allow members of the UNIX group foo to create user defined shares,
257 create the directory to contain the share definitions as follows:
258 Become root:
260 mkdir /usr/local/samba/lib/usershares
262 chgrp foo /usr/local/samba/lib/usershares
263 chmod 1770 /usr/local/samba/lib/usershares
264 Then add the parameters
266 usershare path = /usr/local/samba/lib/usershares
268 usershare max shares = 10 # (or the desired number of shares)
269 to the global section of your smb.conf. Members of the group foo may
271 then manipulate the user defined shares using the following commands.
272 net usershare add sharename path [comment] [acl] [guest_ok=[y|n]]
274 To create or modify (overwrite) a user defined share.
275 net usershare delete sharename
277 To delete a user defined share.
278 net usershare list wildcard-sharename
280 To list user defined shares.
281 net usershare info wildcard-sharename
283 To print information about user defined shares.
284
286 Parameters define the specific attributes of sections.
287 Some parameters are specific to the [global] section (e.g., security).
289 Some parameters are usable in all sections (e.g., create mask). All
290 others are permissible only in normal sections. For the purposes of the
291 following descriptions the [homes] and [printers] sections will be
292 considered normal. The letter G in parentheses indicates that a
293 parameter is specific to the [global] section. The letter S indicates
294 that a parameter can be specified in a service specific section. All S
295 parameters can also be specified in the [global] section - in which
296 case they will define the default behavior for all services.
297 Parameters are arranged here in alphabetical order - this may not
299 create best bedfellows, but at least you can find them! Where there are
300 synonyms, the preferred synonym is described, others refer to the
301 preferred synonym.
302
304 Many of the strings that are settable in the config file can take
305 substitutions. For example the option “path = /tmp/%u” is interpreted
306 as “path = /tmp/john” if the user connected with the username john.
307 These substitutions are mostly noted in the descriptions below, but
309 there are some general substitutions which apply whenever they might be
310 relevant. These are:
311 %U
313 session username (the username that the client wanted, not
314 necessarily the same as the one they got).
315 %G
317 primary group name of %U.
318 %h
320 the Internet hostname that Samba is running on.
321 %m
323 the NetBIOS name of the client machine (very useful).
324 This parameter is not available when Samba listens on port 445, as
326 clients no longer send this information. If you use this macro in
327 an include statement on a domain that has a Samba domain controller
328 be sure to set in the [global] section smb ports = 139. This will
329 cause Samba to not listen on port 445 and will permit include
330 functionality to function as it did with Samba 2.x.
331 %L
333 the NetBIOS name of the server. This allows you to change your
334 config based on what the client calls you. Your server can have a
335 “dual personality”.
336 %M
338 the Internet name of the client machine.
339 %R
341 the selected protocol level after protocol negotiation. It can be
342 one of CORE, COREPLUS, LANMAN1, LANMAN2, NT1, SMB2_02, SMB2_10,
343 SMB2_22, SMB2_24, SMB3_00, SMB3_02, SMB3_10, SMB3_11 or SMB2_FF.
344 %d
346 the process id of the current server process.
347 %a
349 The architecture of the remote machine. It currently recognizes
350 Samba (Samba), the Linux CIFS file system (CIFSFS), OS/2, (OS2),
351 Mac OS X (OSX), Windows for Workgroups (WfWg), Windows 9x/ME
352 (Win95), Windows NT (WinNT), Windows 2000 (Win2K), Windows XP
353 (WinXP), Windows XP 64-bit(WinXP64), Windows 2003 including 2003R2
354 (Win2K3), and Windows Vista (Vista). Anything else will be known as
355 UNKNOWN.
356 %I
358 the IP address of the client machine.
359 Before 4.0.0 it could contain IPv4 mapped IPv6 addresses, now it
361 only contains IPv4 or IPv6 addresses.
362 %J
364 the IP address of the client machine, colons/dots replaced by
365 underscores.
366 %i
368 the local IP address to which a client connected.
369 Before 4.0.0 it could contain IPv4 mapped IPv6 addresses, now it
371 only contains IPv4 or IPv6 addresses.
372 %j
374 the local IP address to which a client connected, colons/dots
375 replaced by underscores.
376 %T
378 the current date and time.
379 %t
381 the current date and time in a minimal format without colons
382 (YYYYYmmdd_HHMMSS).
383 %D
385 name of the domain or workgroup of the current user.
386 %w
388 the winbind separator.
389 %$(envvar)
391 the value of the environment variable envar.
392 The following substitutes apply only to some configuration options
394 (only those that are used when a connection has been established):
395 %S
397 the name of the current service, if any.
398 %P
400 the root directory of the current service, if any.
401 %u
403 username of the current service, if any.
404 %g
406 primary group name of %u.
407 %H
409 the home directory of the user given by %u.
410 %N
412 the name of your NIS home directory server. This is obtained from
413 your NIS auto.map entry. If you have not compiled Samba with the
414 --with-automount option, this value will be the same as %L.
415 %p
417 the path of the service's home directory, obtained from your NIS
418 auto.map entry. The NIS auto.map entry is split up as %N:%p.
419 There are some quite creative things that can be done with these
421 substitutions and other smb.conf options.
422
424 Samba supports name mangling so that DOS and Windows clients can use
425 files that don't conform to the 8.3 format. It can also be set to
426 adjust the case of 8.3 format filenames.
427 There are several options that control the way mangling is performed,
429 and they are grouped here rather than listed separately. For the
430 defaults look at the output of the testparm program.
431 These options can be set separately for each service.
433 The options are:
435 case sensitive = yes/no/auto
437 controls whether filenames are case sensitive. If they aren't,
438 Samba must do a filename search and match on passed names. The
439 default setting of auto allows clients that support case sensitive
440 filenames (Linux CIFSVFS and smbclient 3.0.5 and above currently)
441 to tell the Samba server on a per-packet basis that they wish to
442 access the file system in a case-sensitive manner (to support UNIX
443 case sensitive semantics). No Windows or DOS system supports
444 case-sensitive filename so setting this option to auto is that same
445 as setting it to no for them. Default auto.
446 default case = upper/lower
448 controls what the default case is for new filenames (ie. files that
449 don't currently exist in the filesystem). Default lower. IMPORTANT
450 NOTE: As part of the optimizations for directories containing large
451 numbers of files, the following special case applies. If the
452 options case sensitive = yes, preserve case = No, and short
453 preserve case = No are set, then the case of all incoming client
454 filenames, not just new filenames, will be modified. See additional
455 notes below.
456 preserve case = yes/no
458 controls whether new files (ie. files that don't currently exist in
459 the filesystem) are created with the case that the client passes,
460 or if they are forced to be the default case. Default yes.
461 short preserve case = yes/no
463 controls if new files (ie. files that don't currently exist in the
464 filesystem) which conform to 8.3 syntax, that is all in upper case
465 and of suitable length, are created upper case, or if they are
466 forced to be the default case. This option can be used with
467 preserve case = yes to permit long filenames to retain their case,
468 while short names are lowercased. Default yes.
469 By default, Samba 3.0 has the same semantics as a Windows NT server, in
471 that it is case insensitive but case preserving. As a special case for
472 directories with large numbers of files, if the case options are set as
473 follows, "case sensitive = yes", "case preserve = no", "short preserve
474 case = no" then the "default case" option will be applied and will
475 modify all filenames sent from the client when accessing this share.
476
478 Starting with Samba version 3.2.0, the capability to store Samba
479 configuration in the registry is available. The configuration is stored
480 in the registry key HKLM\Software\Samba\smbconf. There are two levels
481 of registry configuration:
482 1. Share definitions stored in registry are used. This is
484 triggered by setting the global parameter registry shares to
485 “yes” in smb.conf.
486 The registry shares are loaded not at startup but on demand
488 at runtime by smbd. Shares defined in smb.conf take priority
489 over shares of the same name defined in registry.
490 2. Global smb.conf options stored in registry are used. This
492 can be activated in two different ways:
493 Firstly, a registry only configuration is triggered by
495 setting config backend = registry in the [global] section of
496 smb.conf. This resets everything that has been read from
497 config files to this point and reads the content of the
498 global configuration section from the registry. This is the
499 recommended method of using registry based configuration.
500 Secondly, a mixed configuration can be activated by a
502 special new meaning of the parameter include = registry in
503 the [global] section of smb.conf. This reads the global
504 options from registry with the same priorities as for an
505 include of a text file. This may be especially useful in
506 cases where an initial configuration is needed to access the
507 registry.
508 Activation of global registry options automatically
510 activates registry shares. So in the registry only case,
511 shares are loaded on demand only.
512 Note: To make registry-based configurations foolproof at least to a
515 certain extent, the use of lock directory and config backend inside the
516 registry configuration has been disabled: Especially by changing the
517 lock directory inside the registry configuration, one would create a
518 broken setup where the daemons do not see the configuration they loaded
519 once it is active.
520 The registry configuration can be accessed with tools like regedit or
522 net (rpc) registry in the key HKLM\Software\Samba\smbconf. More
523 conveniently, the conf subcommand of the net(8) utility offers a
524 dedicated interface to read and write the registry based configuration
525 locally, i.e. directly accessing the database file, circumventing the
526 server.
527
529 In the SMB protocol, users, groups, and machines are represented by
530 their security identifiers (SIDs). On POSIX system Samba processes need
531 to run under corresponding POSIX user identities and with supplemental
532 POSIX groups to allow access to the files owned by those users and
533 groups. The process of mapping SIDs to POSIX users and groups is called
534 IDENTITY MAPPING or, in short, ID MAPPING.
535 Samba supports multiple ways to map SIDs to POSIX users and groups. The
537 configuration is driven by the idmap config DOMAIN : OPTION option
538 which allows one to specify identity mapping (idmap) options for each
539 domain separately.
540 Identity mapping modules implement different strategies for mapping of
542 SIDs to POSIX user and group identities. They are applicable to
543 different use cases and scenarios. It is advised to read the
544 documentation of the individual identity mapping modules before
545 choosing a specific scenario to use. Each identity management module is
546 documented in a separate manual page. The standard idmap backends are
547 tdb (idmap_tdb(8)), tdb2 (idmap_tdb2(8)), ldap (idmap_ldap(8)), rid
548 (idmap_rid(8)), hash (idmap_hash(8)), autorid (idmap_autorid(8)), ad
549 (idmap_ad(8)), nss (idmap_nss(8)), and rfc2307 (idmap_rfc2307(8)).
550 Overall, ID mapping configuration should be decided carefully. Changes
552 to the already deployed ID mapping configuration may create the risk of
553 losing access to the data or disclosing the data to the wrong parties.
554 This example shows how to configure two domains with idmap_rid(8), the
556 principal domain and a trusted domain, leaving the default id mapping
557 scheme at tdb.
558 [global]
560 security = domain
561 workgroup = MAIN
562 idmap config * : backend = tdb
564 idmap config * : range = 1000000-1999999
565 idmap config MAIN : backend = rid
567 idmap config MAIN : range = 5000000-5999999
568 idmap config TRUSTED : backend = rid
570 idmap config TRUSTED : range = 6000000-6999999
571
574 abort shutdown script (G)
575 This a full path name to a script called by smbd(8) that should
577 stop a shutdown procedure issued by the shutdown script.
578 If the connected user possesses the SeRemoteShutdownPrivilege,
580 right, this command will be run as root.
581 Default: abort shutdown script = ""
583 Example: abort shutdown script = /sbin/shutdown -c
585 access based share enum (S)
587 If this parameter is yes for a service, then the share hosted by
589 the service will only be visible to users who have read or write
590 access to the share during share enumeration (for example net view
591 \\sambaserver). The share ACLs which allow or deny the access to
592 the share can be modified using for example the sharesec command or
593 using the appropriate Windows tools. This has parallels to access
594 based enumeration, the main difference being that only share
595 permissions are evaluated, and security descriptors on files
596 contained on the share are not used in computing enumeration access
597 rights.
598 Default: access based share enum = no
600 acl allow execute always (S)
602 This boolean parameter controls the behaviour of smbd(8) when
604 receiving a protocol request of "open for execution" from a Windows
605 client. With Samba 3.6 and older, the execution right in the ACL
606 was not checked, so a client could execute a file even if it did
607 not have execute rights on the file. In Samba 4.0, this has been
608 fixed, so that by default, i.e. when this parameter is set to
609 "False", "open for execution" is now denied when execution
610 permissions are not present.
611 If this parameter is set to "True", Samba does not check execute
613 permissions on "open for execution", thus re-establishing the
614 behaviour of Samba 3.6. This can be useful to smoothen upgrades
615 from older Samba versions to 4.0 and newer. This setting is not
616 meant to be used as a permanent setting, but as a temporary relief:
617 It is recommended to fix the permissions in the ACLs and reset this
618 parameter to the default after a certain transition period.
619 Default: acl allow execute always = no
621 acl check permissions (S)
623 Please note this parameter is now deprecated in Samba 3.6.2 and
625 will be removed in a future version of Samba.
626 This boolean parameter controls what smbd(8) does on receiving a
628 protocol request of "open for delete" from a Windows client. If a
629 Windows client doesn't have permissions to delete a file then they
630 expect this to be denied at open time. POSIX systems normally only
631 detect restrictions on delete by actually attempting to delete the
632 file or directory. As Windows clients can (and do) "back out" a
633 delete request by unsetting the "delete on close" bit Samba cannot
634 delete the file immediately on "open for delete" request as we
635 cannot restore such a deleted file. With this parameter set to true
636 (the default) then smbd checks the file system permissions directly
637 on "open for delete" and denies the request without actually
638 deleting the file if the file system permissions would seem to deny
639 it. This is not perfect, as it's possible a user could have deleted
640 a file without Samba being able to check the permissions correctly,
641 but it is close enough to Windows semantics for mostly correct
642 behaviour. Samba will correctly check POSIX ACL semantics in this
643 case.
644 If this parameter is set to "false" Samba doesn't check permissions
646 on "open for delete" and allows the open. If the user doesn't have
647 permission to delete the file this will only be discovered at close
648 time, which is too late for the Windows user tools to display an
649 error message to the user. The symptom of this is files that appear
650 to have been deleted "magically" re-appearing on a Windows explorer
651 refresh. This is an extremely advanced protocol option which should
652 not need to be changed. This parameter was introduced in its final
653 form in 3.0.21, an earlier version with slightly different
654 semantics was introduced in 3.0.20. That older version is not
655 documented here.
656 Default: acl check permissions = yes
658 acl group control (S)
660 In a POSIX filesystem, only the owner of a file or directory and
662 the superuser can modify the permissions and ACLs on a file. If
663 this parameter is set, then Samba overrides this restriction, and
664 also allows the primary group owner of a file or directory to
665 modify the permissions and ACLs on that file.
666 On a Windows server, groups may be the owner of a file or directory
668 - thus allowing anyone in that group to modify the permissions on
669 it. This allows the delegation of security controls on a point in
670 the filesystem to the group owner of a directory and anything below
671 it also owned by that group. This means there are multiple people
672 with permissions to modify ACLs on a file or directory, easing
673 manageability.
674 This parameter allows Samba to also permit delegation of the
676 control over a point in the exported directory hierarchy in much
677 the same way as Windows. This allows all members of a UNIX group to
678 control the permissions on a file or directory they have group
679 ownership on.
680 This parameter is best used with the inherit owner option and also
682 on a share containing directories with the UNIX setgid bit set on
683 them, which causes new files and directories created within it to
684 inherit the group ownership from the containing directory.
685 This parameter was deprecated in Samba 3.0.23, but re-activated in
687 Samba 3.0.31 and above, as it now only controls permission changes
688 if the user is in the owning primary group. It is now no longer
689 equivalent to the dos filemode option.
690 Default: acl group control = no
692 acl map full control (S)
694 This boolean parameter controls whether smbd(8) maps a POSIX ACE
696 entry of "rwx" (read/write/execute), the maximum allowed POSIX
697 permission set, into a Windows ACL of "FULL CONTROL". If this
698 parameter is set to true any POSIX ACE entry of "rwx" will be
699 returned in a Windows ACL as "FULL CONTROL", is this parameter is
700 set to false any POSIX ACE entry of "rwx" will be returned as the
701 specific Windows ACL bits representing read, write and execute.
702 Default: acl map full control = yes
704 add group script (G)
706 This is the full pathname to a script that will be run AS ROOT by
708 smbd(8) when a new group is requested. It will expand any %g to the
709 group name passed. This script is only useful for installations
710 using the Windows NT domain administration tools. The script is
711 free to create a group with an arbitrary name to circumvent unix
712 group name restrictions. In that case the script must print the
713 numeric gid of the created group on stdout.
714 Default: add group script =
716 Example: add group script = /usr/sbin/groupadd %g
718 additional dns hostnames (G)
720 A list of additional DNS names by which this host can be identified
722 Default: additional dns hostnames = # empty string (no additional
724 dns names)
725 Example: additional dns hostnames = host2.example.com
727 host3.other.com
728 add machine script (G)
730 This is the full pathname to a script that will be run by smbd(8)
732 when a machine is added to Samba's domain and a Unix account
733 matching the machine's name appended with a "$" does not already
734 exist.
735 This option is very similar to the add user script, and likewise
737 uses the %u substitution for the account name. Do not use the %m
738 substitution.
739 Default: add machine script =
741 Example: add machine script = /usr/sbin/adduser -n -g machines -c
743 Machine -d /var/lib/nobody -s /bin/false %u
744 addport command (G)
746 Samba 3.0.23 introduced support for adding printer ports remotely
748 using the Windows "Add Standard TCP/IP Port Wizard". This option
749 defines an external program to be executed when smbd receives a
750 request to add a new Port to the system. The script is passed two
751 parameters:
752 · port name
754 · device URI
756 The deviceURI is in the format of
758 socket://<hostname>[:<portnumber>] or lpd://<hostname>/<queuename>.
759 Default: addport command =
761 Example: addport command = /etc/samba/scripts/addport.sh
763 addprinter command (G)
765 With the introduction of MS-RPC based printing support for Windows
767 NT/2000 clients in Samba 2.2, The MS Add Printer Wizard (APW) icon
768 is now also available in the "Printers..." folder displayed a share
769 listing. The APW allows for printers to be add remotely to a Samba
770 or Windows NT/2000 print server.
771 For a Samba host this means that the printer must be physically
773 added to the underlying printing system. The addprinter command
774 defines a script to be run which will perform the necessary
775 operations for adding the printer to the print system and to add
776 the appropriate service definition to the smb.conf file in order
777 that it can be shared by smbd(8).
778 The addprinter command is automatically invoked with the following
780 parameter (in order):
781 · printer name
783 · share name
785 · port name
787 · driver name
789 · location
791 · Windows 9x driver location
793 All parameters are filled in from the PRINTER_INFO_2 structure sent
795 by the Windows NT/2000 client with one exception. The "Windows 9x
796 driver location" parameter is included for backwards compatibility
797 only. The remaining fields in the structure are generated from
798 answers to the APW questions.
799 Once the addprinter command has been executed, smbd will reparse
801 the smb.conf to determine if the share defined by the APW exists.
802 If the sharename is still invalid, then smbd will return an
803 ACCESS_DENIED error to the client.
804 The addprinter command program can output a single line of text,
806 which Samba will set as the port the new printer is connected to.
807 If this line isn't output, Samba won't reload its printer shares.
808 Default: addprinter command =
810 Example: addprinter command = /usr/bin/addprinter
812 add share command (G)
814 Samba 2.2.0 introduced the ability to dynamically add and delete
816 shares via the Windows NT 4.0 Server Manager. The add share command
817 is used to define an external program or script which will add a
818 new service definition to smb.conf.
819 In order to successfully execute the add share command, smbd
821 requires that the administrator connects using a root account (i.e.
822 uid == 0) or has the SeDiskOperatorPrivilege. Scripts defined in
823 the add share command parameter are executed as root.
824 When executed, smbd will automatically invoke the add share command
826 with five parameters.
827 · configFile - the location of the global smb.conf file.
829 · shareName - the name of the new share.
831 · pathName - path to an **existing** directory on disk.
833 · comment - comment string to associate with the new
835 share.
836 · max connections Number of maximum simultaneous
838 connections to this share.
839 This parameter is only used to add file shares. To add printer
841 shares, see the addprinter command.
842 Default: add share command =
844 Example: add share command = /usr/local/bin/addshare
846 add user script (G)
848 This is the full pathname to a script that will be run AS ROOT by
850 smbd(8) under special circumstances described below.
851 Normally, a Samba server requires that UNIX users are created for
853 all users accessing files on this server. For sites that use
854 Windows NT account databases as their primary user database
855 creating these users and keeping the user list in sync with the
856 Windows NT PDC is an onerous task. This option allows smbd to
857 create the required UNIX users ON DEMAND when a user accesses the
858 Samba server.
859 When the Windows user attempts to access the Samba server, at login
861 (session setup in the SMB protocol) time, smbd(8) contacts the
862 password server and attempts to authenticate the given user with
863 the given password. If the authentication succeeds then smbd
864 attempts to find a UNIX user in the UNIX password database to map
865 the Windows user into. If this lookup fails, and add user script is
866 set then smbd will call the specified script AS ROOT, expanding any
867 %u argument to be the user name to create.
868 If this script successfully creates the user then smbd will
870 continue on as though the UNIX user already existed. In this way,
871 UNIX users are dynamically created to match existing Windows NT
872 accounts.
873 See also security, password server, delete user script.
875 Default: add user script =
877 Example: add user script = /usr/local/samba/bin/add_user %u
879 add user to group script (G)
881 Full path to the script that will be called when a user is added to
883 a group using the Windows NT domain administration tools. It will
884 be run by smbd(8) AS ROOT. Any %g will be replaced with the group
885 name and any %u will be replaced with the user name.
886 Note that the adduser command used in the example below does not
888 support the used syntax on all systems.
889 Default: add user to group script =
891 Example: add user to group script = /usr/sbin/adduser %u %g
893 administrative share (S)
895 If this parameter is set to yes for a share, then the share will be
897 an administrative share. The Administrative Shares are the default
898 network shares created by all Windows NT-based operating systems.
899 These are shares like C$, D$ or ADMIN$. The type of these shares is
900 STYPE_DISKTREE_HIDDEN.
901 See the section below on security for more information about this
903 option.
904 Default: administrative share = no
906 admin users (S)
908 This is a list of users who will be granted administrative
910 privileges on the share. This means that they will do all file
911 operations as the super-user (root).
912 You should use this option very carefully, as any user in this list
914 will be able to do anything they like on the share, irrespective of
915 file permissions.
916 Default: admin users =
918 Example: admin users = jason
920 afs share (S)
922 This parameter controls whether special AFS features are enabled
924 for this share. If enabled, it assumes that the directory exported
925 via the path parameter is a local AFS import. The special AFS
926 features include the attempt to hand-craft an AFS token if you
927 enabled --with-fake-kaserver in configure.
928 Default: afs share = no
930 afs token lifetime (G)
932 This parameter controls the lifetime of tokens that the AFS
934 fake-kaserver claims. In reality these never expire but this
935 lifetime controls when the afs client will forget the token.
936 Set this parameter to 0 to get NEVERDATE.
938 Default: afs token lifetime = 604800
940 afs username map (G)
942 If you are using the fake kaserver AFS feature, you might want to
944 hand-craft the usernames you are creating tokens for. For example
945 this is necessary if you have users from several domain in your AFS
946 Protection Database. One possible scheme to code users as
947 DOMAIN+User as it is done by winbind with the + as a separator.
948 The mapped user name must contain the cell name to log into, so
950 without setting this parameter there will be no token.
951 Default: afs username map =
953 Example: afs username map = %u@afs.samba.org
955 aio max threads (G)
957 The integer parameter specifies the maximum number of threads each
959 smbd process will create when doing parallel asynchronous IO calls.
960 If the number of outstanding calls is greater than this number the
961 requests will not be refused but go onto a queue and will be
962 scheduled in turn as outstanding requests complete.
963 Related command: aio read size
965 Related command: aio write size
967 Default: aio max threads = 100
969 aio read size (S)
971 If this integer parameter is set to a non-zero value, Samba will
973 read from files asynchronously when the request size is bigger than
974 this value. Note that it happens only for non-chained and
975 non-chaining reads and when not using write cache.
976 The only reasonable values for this parameter are 0 (no async I/O)
978 and 1 (always do async I/O).
979 Related command: write cache size
981 Related command: aio write size
983 Default: aio read size = 1
985 Example: aio read size = 0 # Always do reads synchronously
987 aio write behind (S)
989 If Samba has been built with asynchronous I/O support, Samba will
991 not wait until write requests are finished before returning the
992 result to the client for files listed in this parameter. Instead,
993 Samba will immediately return that the write request has been
994 finished successfully, no matter if the operation will succeed or
995 not. This might speed up clients without aio support, but is really
996 dangerous, because data could be lost and files could be damaged.
997 The syntax is identical to the veto files parameter.
999 Default: aio write behind =
1001 Example: aio write behind = /*.tmp/
1003 aio write size (S)
1005 If this integer parameter is set to a non-zero value, Samba will
1007 write to files asynchronously when the request size is bigger than
1008 this value. Note that it happens only for non-chained and
1009 non-chaining reads and when not using write cache.
1010 The only reasonable values for this parameter are 0 (no async I/O)
1012 and 1 (always do async I/O).
1013 Compared to aio read size this parameter has a smaller effect, most
1015 writes should end up in the file system cache. Writes that require
1016 space allocation might benefit most from going asynchronous.
1017 Related command: write cache size
1019 Related command: aio read size
1021 Default: aio write size = 1
1023 Example: aio write size = 0 # Always do writes synchronously
1025 algorithmic rid base (G)
1027 This determines how Samba will use its algorithmic mapping from
1029 uids/gid to the RIDs needed to construct NT Security Identifiers.
1030 Setting this option to a larger value could be useful to sites
1032 transitioning from WinNT and Win2k, as existing user and group rids
1033 would otherwise clash with system users etc.
1034 All UIDs and GIDs must be able to be resolved into SIDs for the
1036 correct operation of ACLs on the server. As such the algorithmic
1037 mapping can't be 'turned off', but pushing it 'out of the way'
1038 should resolve the issues. Users and groups can then be assigned
1039 'low' RIDs in arbitrary-rid supporting backends.
1040 Default: algorithmic rid base = 1000
1042 Example: algorithmic rid base = 100000
1044 allocation roundup size (S)
1046 This parameter allows an administrator to tune the allocation size
1048 reported to Windows clients. This is only useful for old SMB1
1049 clients because modern SMB dialects eliminated that bottleneck and
1050 have better performance by default. Using this parameter may cause
1051 difficulties for some applications, e.g. MS Visual Studio. If the
1052 MS Visual Studio compiler starts to crash with an internal error,
1053 set this parameter to zero for this share. Settings this parameter
1054 to a large value can also cause small files to allocate more space
1055 on the disk than needed.
1056 This parameter is deprecated and will be removed in one of the next
1058 Samba releases.
1059 The integer parameter specifies the roundup size in bytes.
1061 Default: allocation roundup size = 0
1063 Example: allocation roundup size = 1048576 # (to set it to the
1065 former default of 1 MiB)
1066 allow dcerpc auth level connect (G)
1068 This option controls whether DCERPC services are allowed to be used
1070 with DCERPC_AUTH_LEVEL_CONNECT, which provides authentication, but
1071 no per message integrity nor privacy protection.
1072 Some interfaces like samr, lsarpc and netlogon have a hard-coded
1074 default of no and epmapper, mgmt and rpcecho have a hard-coded
1075 default of yes.
1076 The behavior can be overwritten per interface name (e.g. lsarpc,
1078 netlogon, samr, srvsvc, winreg, wkssvc ...) by using 'allow dcerpc
1079 auth level connect:interface = yes' as option.
1080 This option yields precedence to the implementation specific
1082 restrictions. E.g. the drsuapi and backupkey protocols require
1083 DCERPC_AUTH_LEVEL_PRIVACY. The dnsserver protocol requires
1084 DCERPC_AUTH_LEVEL_INTEGRITY.
1085 Default: allow dcerpc auth level connect = no
1087 Example: allow dcerpc auth level connect = yes
1089 allow dns updates (G)
1091 This option determines what kind of updates to the DNS are allowed.
1093 DNS updates can either be disallowed completely by setting it to
1095 disabled, enabled over secure connections only by setting it to
1096 secure only or allowed in all cases by setting it to nonsecure.
1097 Default: allow dns updates = secure only
1099 Example: allow dns updates = disabled
1101 allow insecure wide links (G)
1103 In normal operation the option wide links which allows the server
1105 to follow symlinks outside of a share path is automatically
1106 disabled when unix extensions are enabled on a Samba server. This
1107 is done for security purposes to prevent UNIX clients creating
1108 symlinks to areas of the server file system that the administrator
1109 does not wish to export.
1110 Setting allow insecure wide links to true disables the link between
1112 these two parameters, removing this protection and allowing a site
1113 to configure the server to follow symlinks (by setting wide links
1114 to "true") even when unix extensions is turned on.
1115 It is not recommended to enable this option unless you fully
1117 understand the implications of allowing the server to follow
1118 symbolic links created by UNIX clients. For most normal Samba
1119 configurations this would be considered a security hole and setting
1120 this parameter is not recommended.
1121 This option was added at the request of sites who had deliberately
1123 set Samba up in this way and needed to continue supporting this
1124 functionality without having to patch the Samba code.
1125 Default: allow insecure wide links = no
1127 allow nt4 crypto (G)
1129 This option controls whether the netlogon server (currently only in
1131 'active directory domain controller' mode), will reject clients
1132 which does not support NETLOGON_NEG_STRONG_KEYS nor
1133 NETLOGON_NEG_SUPPORTS_AES.
1134 This option was added with Samba 4.2.0. It may lock out clients
1136 which worked fine with Samba versions up to 4.1.x. as the effective
1137 default was "yes" there, while it is "no" now.
1138 If you have clients without RequireStrongKey = 1 in the registry,
1140 you may need to set "allow nt4 crypto = yes", until you have fixed
1141 all clients.
1142 "allow nt4 crypto = yes" allows weak crypto to be negotiated, maybe
1144 via downgrade attacks.
1145 This option yields precedence to the 'reject md5 clients' option.
1147 Default: allow nt4 crypto = no
1149 allow trusted domains (G)
1151 This option only takes effect when the security option is set to
1153 server, domain or ads. If it is set to no, then attempts to connect
1154 to a resource from a domain or workgroup other than the one which
1155 smbd is running in will fail, even if that domain is trusted by the
1156 remote server doing the authentication.
1157 This is useful if you only want your Samba server to serve
1159 resources to users in the domain it is a member of. As an example,
1160 suppose that there are two domains DOMA and DOMB. DOMB is trusted
1161 by DOMA, which contains the Samba server. Under normal
1162 circumstances, a user with an account in DOMB can then access the
1163 resources of a UNIX account with the same account name on the Samba
1164 server even if they do not have an account in DOMA. This can make
1165 implementing a security boundary difficult.
1166 Default: allow trusted domains = yes
1168 allow unsafe cluster upgrade (G)
1170 If set to no (the default), smbd checks at startup if other smbd
1172 versions are running in the cluster and refuses to start if so.
1173 This is done to protect data corruption in internal data structures
1174 due to incompatible Samba versions running concurrently in the same
1175 cluster. Setting this parameter to yes disables this safety check.
1176 Default: allow unsafe cluster upgrade = no
1178 apply group policies (G)
1180 This option controls whether winbind will execute the gpupdate
1182 command defined in gpo update command on the Group Policy update
1183 interval. The Group Policy update interval is defined as every 90
1184 minutes, plus a random offset between 0 and 30 minutes. This
1185 applies Group Policy Machine polices to the client or KDC and
1186 machine policies to a server.
1187 Default: apply group policies = no
1189 Example: apply group policies = yes
1191 async smb echo handler (G)
1193 This parameter specifies whether Samba should fork the async smb
1195 echo handler. It can be beneficial if your file system can block
1196 syscalls for a very long time. In some circumstances, it prolongs
1197 the timeout that Windows uses to determine whether a connection is
1198 dead. This parameter is only for SMB1. For SMB2 and above TCP
1199 keepalives can be used instead.
1200 Default: async smb echo handler = no
1202 auth event notification (G)
1204 When enabled, this option causes Samba (acting as an Active
1206 Directory Domain Controller) to stream authentication events across
1207 the internal message bus. Scripts built using Samba's python
1208 bindings can listen to these events by registering as the service
1209 auth_event.
1210 This should be considered a developer option (it assists in the
1212 Samba testsuite) rather than a facility for external auditing, as
1213 message delivery is not guaranteed (a feature that the testsuite
1214 works around). Additionally Samba must be compiled with the jansson
1215 support for this option to be effective.
1216 The authentication events are also logged via the normal logging
1218 methods when the log level is set appropriately.
1219 Default: auth event notification = no
1221 preload
1223 This parameter is a synonym for auto services.
1225 auto services (G)
1227 This is a list of services that you want to be automatically added
1229 to the browse lists. This is most useful for homes and printers
1230 services that would otherwise not be visible.
1231 Note that if you just want all printers in your printcap file
1233 loaded then the load printers option is easier.
1234 Default: auto services =
1236 Example: auto services = fred lp colorlp
1238 available (S)
1240 This parameter lets you "turn off" a service. If available = no,
1242 then ALL attempts to connect to the service will fail. Such
1243 failures are logged.
1244 Default: available = yes
1246 bind dns directory
1248 This parameter is a synonym for binddns dir.
1250 binddns dir (G)
1252 This parameters defines the directory samba will use to store the
1254 configuration files for bind, such as named.conf. NOTE: The bind
1255 dns directory needs to be on the same mount point as the private
1256 directory!
1257 Default: binddns dir = /var/lib/samba/bind-dns
1259 bind interfaces only (G)
1261 This global parameter allows the Samba admin to limit what
1263 interfaces on a machine will serve SMB requests. It affects file
1264 service smbd(8) and name service nmbd(8) in a slightly different
1265 ways.
1266 For name service it causes nmbd to bind to ports 137 and 138 on the
1268 interfaces listed in the interfaces parameter. nmbd also binds to
1269 the "all addresses" interface (0.0.0.0) on ports 137 and 138 for
1270 the purposes of reading broadcast messages. If this option is not
1271 set then nmbd will service name requests on all of these sockets.
1272 If bind interfaces only is set then nmbd will check the source
1273 address of any packets coming in on the broadcast sockets and
1274 discard any that don't match the broadcast addresses of the
1275 interfaces in the interfaces parameter list. As unicast packets are
1276 received on the other sockets it allows nmbd to refuse to serve
1277 names to machines that send packets that arrive through any
1278 interfaces not listed in the interfaces list. IP Source address
1279 spoofing does defeat this simple check, however, so it must not be
1280 used seriously as a security feature for nmbd.
1281 For file service it causes smbd(8) to bind only to the interface
1283 list given in the interfaces parameter. This restricts the networks
1284 that smbd will serve, to packets coming in on those interfaces.
1285 Note that you should not use this parameter for machines that are
1286 serving PPP or other intermittent or non-broadcast network
1287 interfaces as it will not cope with non-permanent interfaces.
1288 If bind interfaces only is set and the network address 127.0.0.1 is
1290 not added to the interfaces parameter list smbpasswd(8) may not
1291 work as expected due to the reasons covered below.
1292 To change a users SMB password, the smbpasswd by default connects
1294 to the localhost - 127.0.0.1 address as an SMB client to issue the
1295 password change request. If bind interfaces only is set then unless
1296 the network address 127.0.0.1 is added to the interfaces parameter
1297 list then smbpasswd will fail to connect in it's default mode.
1298 smbpasswd can be forced to use the primary IP interface of the
1299 local host by using its smbpasswd(8) -r remote machine parameter,
1300 with remote machine set to the IP name of the primary interface of
1301 the local host.
1302 Default: bind interfaces only = no
1304 blocking locks (S)
1306 This parameter controls the behavior of smbd(8) when given a
1308 request by a client to obtain a byte range lock on a region of an
1309 open file, and the request has a time limit associated with it.
1310 If this parameter is set and the lock range requested cannot be
1312 immediately satisfied, samba will internally queue the lock
1313 request, and periodically attempt to obtain the lock until the
1314 timeout period expires.
1315 If this parameter is set to no, then samba will behave as previous
1317 versions of Samba would and will fail the lock request immediately
1318 if the lock range cannot be obtained.
1319 Default: blocking locks = yes
1321 block size (S)
1323 This parameter controls the behavior of smbd(8) when reporting disk
1325 free sizes. By default, this reports a disk block size of 1024
1326 bytes.
1327 Changing this parameter may have some effect on the efficiency of
1329 client writes, this is not yet confirmed. This parameter was added
1330 to allow advanced administrators to change it (usually to a higher
1331 value) and test the effect it has on client write performance
1332 without re-compiling the code. As this is an experimental option it
1333 may be removed in a future release.
1334 Changing this option does not change the disk free reporting size,
1336 just the block size unit reported to the client.
1337 Default: block size = 1024
1339 Example: block size = 4096
1341 browsable
1343 This parameter is a synonym for browseable.
1345 browseable (S)
1347 This controls whether this share is seen in the list of available
1349 shares in a net view and in the browse list.
1350 Default: browseable = yes
1352 browse list (G)
1354 This controls whether smbd(8) will serve a browse list to a client
1356 doing a NetServerEnum call. Normally set to yes. You should never
1357 need to change this.
1358 Default: browse list = yes
1360 cache directory (G)
1362 Usually, most of the TDB files are stored in the lock directory.
1364 Since Samba 3.4.0, it is possible to differentiate between TDB
1365 files with persistent data and TDB files with non-persistent data
1366 using the state directory and the cache directory options.
1367 This option specifies the directory for storing TDB files
1369 containing non-persistent data that will be kept across service
1370 restarts. The directory should be placed on persistent storage, but
1371 the data can be safely deleted by an administrator.
1372 Default: cache directory = /var/lib/samba
1374 Example: cache directory = /var/run/samba/locks/cache
1376 casesignames
1378 This parameter is a synonym for case sensitive.
1380 case sensitive (S)
1382 See the discussion in the section name mangling.
1384 Default: case sensitive = auto
1386 change notify (G)
1388 This parameter specifies whether Samba should reply to a client's
1390 file change notify requests.
1391 You should never need to change this parameter
1393 Default: change notify = yes
1395 change share command (G)
1397 Samba 2.2.0 introduced the ability to dynamically add and delete
1399 shares via the Windows NT 4.0 Server Manager. The change share
1400 command is used to define an external program or script which will
1401 modify an existing service definition in smb.conf.
1402 In order to successfully execute the change share command, smbd
1404 requires that the administrator connects using a root account (i.e.
1405 uid == 0) or has the SeDiskOperatorPrivilege. Scripts defined in
1406 the change share command parameter are executed as root.
1407 When executed, smbd will automatically invoke the change share
1409 command with six parameters.
1410 · configFile - the location of the global smb.conf file.
1412 · shareName - the name of the new share.
1414 · pathName - path to an **existing** directory on disk.
1416 · comment - comment string to associate with the new
1418 share.
1419 · max connections Number of maximum simultaneous
1421 connections to this share.
1422 · CSC policy - client side caching policy in string form.
1424 Valid values are: manual, documents, programs, disable.
1425 This parameter is only used to modify existing file share
1427 definitions. To modify printer shares, use the "Printers..." folder
1428 as seen when browsing the Samba host.
1429 Default: change share command =
1431 Example: change share command = /usr/local/bin/changeshare
1433 check parent directory delete on close (S)
1435 A Windows SMB server prevents the client from creating files in a
1437 directory that has the delete-on-close flag set. By default Samba
1438 doesn't perform this check as this check is a quite expensive
1439 operation in Samba.
1440 Default: check parent directory delete on close = no
1442 check password script (G)
1444 The name of a program that can be used to check password
1446 complexity. The password is sent to the program's standard input.
1447 The program must return 0 on a good password, or any other value if
1449 the password is bad. In case the password is considered weak (the
1450 program does not return 0) the user will be notified and the
1451 password change will fail.
1452 In Samba AD, this script will be run AS ROOT by samba(8) without
1454 any substitutions.
1455 Note that starting with Samba 4.11 the following environment
1457 variables are exported to the script:
1458 · SAMBA_CPS_ACCOUNT_NAME is always present and contains
1460 the sAMAccountName of user, the is the same as the %u
1461 substitutions in the none AD DC case.
1462 · SAMBA_CPS_USER_PRINCIPAL_NAME is optional in the AD DC
1464 case if the userPrincipalName is present.
1465 · SAMBA_CPS_FULL_NAME is optional if the displayName is
1467 present.
1468 Note: In the example directory is a sample program called
1470 crackcheck that uses cracklib to check the password quality.
1471 Default: check password script = # Disabled
1473 Example: check password script = /usr/local/sbin/crackcheck
1475 cldap port (G)
1477 This option controls the port used by the CLDAP protocol.
1479 Default: cldap port = 389
1481 Example: cldap port = 3389
1483 client ipc max protocol (G)
1485 The value of the parameter (a string) is the highest protocol level
1487 that will be supported for IPC$ connections as DCERPC transport.
1488 Normally this option should not be set as the automatic negotiation
1490 phase in the SMB protocol takes care of choosing the appropriate
1491 protocol.
1492 The value default refers to the latest supported protocol,
1494 currently SMB3_11.
1495 See client max protocol for a full list of available protocols. The
1497 values CORE, COREPLUS, LANMAN1, LANMAN2 are silently upgraded to
1498 NT1.
1499 Default: client ipc max protocol = default
1501 Example: client ipc max protocol = SMB2_10
1503 client ipc min protocol (G)
1505 This setting controls the minimum protocol version that the will be
1507 attempted to use for IPC$ connections as DCERPC transport.
1508 Normally this option should not be set as the automatic negotiation
1510 phase in the SMB protocol takes care of choosing the appropriate
1511 protocol.
1512 The value default refers to the higher value of NT1 and the
1514 effective value of client min protocol.
1515 See client max protocol for a full list of available protocols. The
1517 values CORE, COREPLUS, LANMAN1, LANMAN2 are silently upgraded to
1518 NT1.
1519 Default: client ipc min protocol = default
1521 Example: client ipc min protocol = SMB3_11
1523 client ipc signing (G)
1525 This controls whether the client is allowed or required to use SMB
1527 signing for IPC$ connections as DCERPC transport. Possible values
1528 are auto, mandatory and disabled.
1529 When set to mandatory or default, SMB signing is required.
1531 When set to auto, SMB signing is offered, but not enforced and if
1533 set to disabled, SMB signing is not offered either.
1534 Connections from winbindd to Active Directory Domain Controllers
1536 always enforce signing.
1537 Default: client ipc signing = default
1539 client lanman auth (G)
1541 This parameter determines whether or not smbclient(8) and other
1543 samba client tools will attempt to authenticate itself to servers
1544 using the weaker LANMAN password hash. If disabled, only server
1545 which support NT password hashes (e.g. Windows NT/2000, Samba,
1546 etc... but not Windows 95/98) will be able to be connected from the
1547 Samba client.
1548 The LANMAN encrypted response is easily broken, due to its
1550 case-insensitive nature, and the choice of algorithm. Clients
1551 without Windows 95/98 servers are advised to disable this option.
1552 Disabling this option will also disable the client plaintext auth
1554 option.
1555 Likewise, if the client ntlmv2 auth parameter is enabled, then only
1557 NTLMv2 logins will be attempted.
1558 Default: client lanman auth = no
1560 client ldap sasl wrapping (G)
1562 The client ldap sasl wrapping defines whether ldap traffic will be
1564 signed or signed and encrypted (sealed). Possible values are plain,
1565 sign and seal.
1566 The values sign and seal are only available if Samba has been
1568 compiled against a modern OpenLDAP version (2.3.x or higher).
1569 This option is needed in the case of Domain Controllers enforcing
1571 the usage of signed LDAP connections (e.g. Windows 2000 SP3 or
1572 higher). LDAP sign and seal can be controlled with the registry key
1573 "HKLM\System\CurrentControlSet\Services\
1574 NTDS\Parameters\LDAPServerIntegrity" on the Windows server side.
1575 Depending on the used KRB5 library (MIT and older Heimdal versions)
1577 it is possible that the message "integrity only" is not supported.
1578 In this case, sign is just an alias for seal.
1579 The default value is sign. That implies synchronizing the time with
1581 the KDC in the case of using Kerberos.
1582 Default: client ldap sasl wrapping = sign
1584 client max protocol (G)
1586 The value of the parameter (a string) is the highest protocol level
1588 that will be supported by the client.
1589 Possible values are :
1591 · CORE: Earliest version. No concept of user names.
1593 · COREPLUS: Slight improvements on CORE for efficiency.
1595 · LANMAN1: First modern version of the protocol. Long
1597 filename support.
1598 · LANMAN2: Updates to Lanman1 protocol.
1600 · NT1: Current up to date version of the protocol. Used by
1602 Windows NT. Known as CIFS.
1603 · SMB2: Re-implementation of the SMB protocol. Used by
1605 Windows Vista and later versions of Windows. SMB2 has
1606 sub protocols available.
1607 · SMB2_02: The earliest SMB2 version.
1609 · SMB2_10: Windows 7 SMB2 version.
1611 · SMB2_22: Early Windows 8 SMB2 version.
1613 · SMB2_24: Windows 8 beta SMB2 version.
1615 By default SMB2 selects the SMB2_10 variant.
1617 · SMB3: The same as SMB2. Used by Windows 8. SMB3 has sub
1619 protocols available.
1620 · SMB3_00: Windows 8 SMB3 version. (mostly the
1622 same as SMB2_24)
1623 · SMB3_02: Windows 8.1 SMB3 version.
1625 · SMB3_10: early Windows 10 technical preview
1627 SMB3 version.
1628 · SMB3_11: Windows 10 technical preview SMB3
1630 version (maybe final).
1631 By default SMB3 selects the SMB3_11 variant.
1633 Normally this option should not be set as the automatic negotiation
1635 phase in the SMB protocol takes care of choosing the appropriate
1636 protocol.
1637 The value default refers to SMB3_11.
1639 IPC$ connections for DCERPC e.g. in winbindd, are handled by the
1641 client ipc max protocol option.
1642 Default: client max protocol = default
1644 Example: client max protocol = LANMAN1
1646 client min protocol (G)
1648 This setting controls the minimum protocol version that the client
1650 will attempt to use.
1651 Normally this option should not be set as the automatic negotiation
1653 phase in the SMB protocol takes care of choosing the appropriate
1654 protocol unless you connect to a legacy SMB1-only server.
1655 See Related command: client max protocol for a full list of
1657 available protocols.
1658 IPC$ connections for DCERPC e.g. in winbindd, are handled by the
1660 client ipc min protocol option.
1661 Note that most command line tools support --option='client min
1663 protocol=NT1', so it may not be required to enable SMB1 protocols
1664 globally in smb.conf.
1665 Default: client min protocol = SMB2_02
1667 Example: client min protocol = NT1
1669 client NTLMv2 auth (G)
1671 This parameter determines whether or not smbclient(8) will attempt
1673 to authenticate itself to servers using the NTLMv2 encrypted
1674 password response.
1675 If enabled, only an NTLMv2 and LMv2 response (both much more secure
1677 than earlier versions) will be sent. Older servers (including NT4 <
1678 SP4, Win9x and Samba 2.2) are not compatible with NTLMv2 when not
1679 in an NTLMv2 supporting domain
1680 Similarly, if enabled, NTLMv1, client lanman auth and client
1682 plaintext auth authentication will be disabled. This also disables
1683 share-level authentication.
1684 If disabled, an NTLM response (and possibly a LANMAN response) will
1686 be sent by the client, depending on the value of client lanman
1687 auth.
1688 Note that Windows Vista and later versions already use NTLMv2 by
1690 default, and some sites (particularly those following 'best
1691 practice' security polices) only allow NTLMv2 responses, and not
1692 the weaker LM or NTLM.
1693 When client use spnego is also set to yes extended security
1695 (SPNEGO) is required in order to use NTLMv2 only within NTLMSSP.
1696 This behavior was introduced with the patches for CVE-2016-2111.
1697 Default: client NTLMv2 auth = yes
1699 client plaintext auth (G)
1701 Specifies whether a client should send a plaintext password if the
1703 server does not support encrypted passwords.
1704 Default: client plaintext auth = no
1706 client schannel (G)
1708 This option is deprecated with Samba 4.8 and will be removed in
1710 future. At the same time the default changed to yes, which will be
1711 the hardcoded behavior in future.
1712 This controls whether the client offers or even demands the use of
1714 the netlogon schannel. client schannel = no does not offer the
1715 schannel, client schannel = auto offers the schannel but does not
1716 enforce it, and client schannel = yes denies access if the server
1717 is not able to speak netlogon schannel.
1718 Note that for active directory domains this is hardcoded to client
1720 schannel = yes.
1721 This option yields precedence to the require strong key option.
1723 Default: client schannel = yes
1725 Example: client schannel = auto
1727 client signing (G)
1729 This controls whether the client is allowed or required to use SMB
1731 signing. Possible values are auto, mandatory and disabled.
1732 When set to auto or default, SMB signing is offered, but not
1734 enforced.
1735 When set to mandatory, SMB signing is required and if set to
1737 disabled, SMB signing is not offered either.
1738 IPC$ connections for DCERPC e.g. in winbindd, are handled by the
1740 client ipc signing option.
1741 Default: client signing = default
1743 client use spnego principal (G)
1745 This parameter determines whether or not smbclient(8) and other
1747 samba components acting as a client will attempt to use the
1748 server-supplied principal sometimes given in the SPNEGO exchange.
1749 If enabled, Samba can attempt to use Kerberos to contact servers
1751 known only by IP address. Kerberos relies on names, so ordinarily
1752 cannot function in this situation.
1753 This is a VERY BAD IDEA for security reasons, and so this parameter
1755 SHOULD NOT BE USED. It will be removed in a future version of
1756 Samba.
1757 If disabled, Samba will use the name used to look up the server
1759 when asking the KDC for a ticket. This avoids situations where a
1760 server may impersonate another, soliciting authentication as one
1761 principal while being known on the network as another.
1762 Note that Windows XP SP2 and later versions already follow this
1764 behaviour, and Windows Vista and later servers no longer supply
1765 this 'rfc4178 hint' principal on the server side.
1766 This parameter is deprecated in Samba 4.2.1 and will be removed
1768 (along with the functionality) in a later release of Samba.
1769 Default: client use spnego principal = no
1771 client use spnego (G)
1773 This variable controls whether Samba clients will try to use Simple
1775 and Protected NEGOciation (as specified by rfc2478) with supporting
1776 servers (including WindowsXP, Windows2000 and Samba 3.0) to agree
1777 upon an authentication mechanism. This enables Kerberos
1778 authentication in particular.
1779 When client NTLMv2 auth is also set to yes extended security
1781 (SPNEGO) is required in order to use NTLMv2 only within NTLMSSP.
1782 This behavior was introduced with the patches for CVE-2016-2111.
1783 Default: client use spnego = yes
1785 cluster addresses (G)
1787 With this parameter you can add additional addresses that nmbd will
1789 register with a WINS server. Similarly, these addresses will be
1790 registered by default when net ads dns register is called with
1791 clustering = yes configured.
1792 Default: cluster addresses =
1794 Example: cluster addresses = 10.0.0.1 10.0.0.2 10.0.0.3
1796 clustering (G)
1798 This parameter specifies whether Samba should contact ctdb for
1800 accessing its tdb files and use ctdb as a backend for its messaging
1801 backend.
1802 Set this parameter to yes only if you have a cluster setup with
1804 ctdb running.
1805 Default: clustering = no
1807 comment (S)
1809 This is a text field that is seen next to a share when a client
1811 does a queries the server, either via the network neighborhood or
1812 via net view to list what shares are available.
1813 If you want to set the string that is displayed next to the machine
1815 name then see the server string parameter.
1816 Default: comment = # No comment
1818 Example: comment = Fred's Files
1820 config backend (G)
1822 This controls the backend for storing the configuration. Possible
1824 values are file (the default) and registry. When config backend =
1825 registry is encountered while loading smb.conf, the configuration
1826 read so far is dropped and the global options are read from
1827 registry instead. So this triggers a registry only configuration.
1828 Share definitions are not read immediately but instead registry
1829 shares is set to yes.
1830 Note: This option can not be set inside the registry configuration
1832 itself.
1833 Default: config backend = file
1835 Example: config backend = registry
1837 config file (G)
1839 This allows you to override the config file to use, instead of the
1841 default (usually smb.conf). There is a chicken and egg problem here
1842 as this option is set in the config file!
1843 For this reason, if the name of the config file has changed when
1845 the parameters are loaded then it will reload them from the new
1846 config file.
1847 This option takes the usual substitutions, which can be very
1849 useful.
1850 If the config file doesn't exist then it won't be loaded (allowing
1852 you to special case the config files of just a few clients).
1853 No default
1855 Example: config file = /usr/local/samba/lib/smb.conf.%m
1857 copy (S)
1859 This parameter allows you to "clone" service entries. The specified
1861 service is simply duplicated under the current service's name. Any
1862 parameters specified in the current section will override those in
1863 the section being copied.
1864 This feature lets you set up a 'template' service and create
1866 similar services easily. Note that the service being copied must
1867 occur earlier in the configuration file than the service doing the
1868 copying.
1869 Default: copy =
1871 Example: copy = otherservice
1873 create krb5 conf (G)
1875 Setting this parameter to no prevents winbind from creating custom
1877 krb5.conf files. Winbind normally does this because the krb5
1878 libraries are not AD-site-aware and thus would pick any domain
1879 controller out of potentially very many. Winbind is site-aware and
1880 makes the krb5 libraries use a local DC by creating its own
1881 krb5.conf files.
1882 Preventing winbind from doing this might become necessary if you
1884 have to add special options into your system-krb5.conf that winbind
1885 does not see.
1886 Default: create krb5 conf = yes
1888 create mode
1890 This parameter is a synonym for create mask.
1892 create mask (S)
1894 When a file is created, the necessary permissions are calculated
1896 according to the mapping from DOS modes to UNIX permissions, and
1897 the resulting UNIX mode is then bit-wise 'AND'ed with this
1898 parameter. This parameter may be thought of as a bit-wise MASK for
1899 the UNIX modes of a file. Any bit not set here will be removed from
1900 the modes set on a file when it is created.
1901 The default value of this parameter removes the group and other
1903 write and execute bits from the UNIX modes.
1904 Following this Samba will bit-wise 'OR' the UNIX mode created from
1906 this parameter with the value of the force create mode parameter
1907 which is set to 000 by default.
1908 This parameter does not affect directory masks. See the parameter
1910 directory mask for details.
1911 Default: create mask = 0744
1913 Example: create mask = 0775
1915 csc policy (S)
1917 This stands for client-side caching policy, and specifies how
1919 clients capable of offline caching will cache the files in the
1920 share. The valid values are: manual, documents, programs, disable.
1921 These values correspond to those used on Windows servers.
1923 For example, shares containing roaming profiles can have offline
1925 caching disabled using csc policy = disable.
1926 Default: csc policy = manual
1928 Example: csc policy = programs
1930 ctdbd socket (G)
1932 If you set clustering=yes, you need to tell Samba where ctdbd
1934 listens on its unix domain socket. The default path as of ctdb 1.0
1935 is /tmp/ctdb.socket which you have to explicitly set for Samba in
1936 smb.conf.
1937 Default: ctdbd socket =
1939 Example: ctdbd socket = /tmp/ctdb.socket
1941 ctdb locktime warn threshold (G)
1943 In a cluster environment using Samba and ctdb it is critical that
1945 locks on central ctdb-hosted databases like locking.tdb are not
1946 held for long. With the current Samba architecture it happens that
1947 Samba takes a lock and while holding that lock makes file system
1948 calls into the shared cluster file system. This option makes Samba
1949 warn if it detects that it has held locks for the specified number
1950 of milliseconds. If this happens, smbd will emit a debug level 0
1951 message into its logs and potentially into syslog. The most likely
1952 reason for such a log message is that an operation of the cluster
1953 file system Samba exports is taking longer than expected. The
1954 messages are meant as a debugging aid for potential cluster
1955 problems.
1956 The default value of 0 disables this logging.
1958 Default: ctdb locktime warn threshold = 0
1960 ctdb timeout (G)
1962 This parameter specifies a timeout in milliseconds for the
1964 connection between Samba and ctdb. It is only valid if you have
1965 compiled Samba with clustering and if you have set clustering=yes.
1966 When something in the cluster blocks, it can happen that we wait
1968 indefinitely long for ctdb, just adding to the blocking condition.
1969 In a well-running cluster this should never happen, but there are
1970 too many components in a cluster that might have hickups. Choosing
1971 the right balance for this value is very tricky, because on a busy
1972 cluster long service times to transfer something across the cluster
1973 might be valid. Setting it too short will degrade the service your
1974 cluster presents, setting it too long might make the cluster itself
1975 not recover from something severely broken for too long.
1976 Be aware that if you set this parameter, this needs to be in the
1978 file smb.conf, it is not really helpful to put this into a registry
1979 configuration (typical on a cluster), because to access the
1980 registry contact to ctdb is required.
1981 Setting ctdb timeout to n makes any process waiting longer than n
1983 milliseconds for a reply by the cluster panic. Setting it to 0 (the
1984 default) makes Samba block forever, which is the highly recommended
1985 default.
1986 Default: ctdb timeout = 0
1988 cups connection timeout (G)
1990 This parameter is only applicable if printing is set to cups.
1992 If set, this option specifies the number of seconds that smbd will
1994 wait whilst trying to contact to the CUPS server. The connection
1995 will fail if it takes longer than this number of seconds.
1996 Default: cups connection timeout = 30
1998 Example: cups connection timeout = 60
2000 cups encrypt (G)
2002 This parameter is only applicable if printing is set to cups and if
2004 you use CUPS newer than 1.0.x.It is used to define whether or not
2005 Samba should use encryption when talking to the CUPS server.
2006 Possible values are auto, yes and no
2007 When set to auto we will try to do a TLS handshake on each CUPS
2009 connection setup. If that fails, we will fall back to unencrypted
2010 operation.
2011 Default: cups encrypt = no
2013 cups options (S)
2015 This parameter is only applicable if printing is set to cups. Its
2017 value is a free form string of options passed directly to the cups
2018 library.
2019 You can pass any generic print option known to CUPS (as listed in
2021 the CUPS "Software Users' Manual"). You can also pass any printer
2022 specific option (as listed in "lpoptions -d printername -l") valid
2023 for the target queue. Multiple parameters should be space-delimited
2024 name/value pairs according to the PAPI text option ABNF
2025 specification. Collection values ("name={a=... b=... c=...}") are
2026 stored with the curley brackets intact.
2027 You should set this parameter to raw if your CUPS server error_log
2029 file contains messages such as "Unsupported format
2030 'application/octet-stream'" when printing from a Windows client
2031 through Samba. It is no longer necessary to enable system wide raw
2032 printing in /etc/cups/mime.{convs,types}.
2033 Default: cups options = ""
2035 Example: cups options = "raw media=a4"
2037 cups server (G)
2039 This parameter is only applicable if printing is set to cups.
2041 If set, this option overrides the ServerName option in the CUPS
2043 client.conf. This is necessary if you have virtual samba servers
2044 that connect to different CUPS daemons.
2045 Optionally, a port can be specified by separating the server name
2047 and port number with a colon. If no port was specified, the default
2048 port for IPP (631) will be used.
2049 Default: cups server = ""
2051 Example: cups server = mycupsserver
2053 Example: cups server = mycupsserver:1631
2055 dcerpc endpoint servers (G)
2057 Specifies which DCE/RPC endpoint servers should be run.
2059 Default: dcerpc endpoint servers = epmapper, wkssvc, rpcecho, samr,
2061 netlogon, lsarpc, drsuapi, dssetup, unixinfo, browser, eventlog6,
2062 backupkey, dnsserver
2063 Example: dcerpc endpoint servers = rpcecho
2065 deadtime (G)
2067 The value of the parameter (a decimal integer) represents the
2069 number of minutes of inactivity before a connection is considered
2070 dead, and it is disconnected. The deadtime only takes effect if the
2071 number of open files is zero.
2072 This is useful to stop a server's resources being exhausted by a
2074 large number of inactive connections.
2075 Most clients have an auto-reconnect feature when a connection is
2077 broken so in most cases this parameter should be transparent to
2078 users.
2079 Using this parameter with a timeout of a few minutes is recommended
2081 for most systems.
2082 A deadtime of zero indicates that no auto-disconnection should be
2084 performed.
2085 Default: deadtime = 10080
2087 Example: deadtime = 15
2089 debug class (G)
2091 With this boolean parameter enabled, the debug class (DBGC_CLASS)
2093 will be displayed in the debug header.
2094 For more information about currently available debug classes, see
2096 section about log level.
2097 Default: debug class = no
2099 debug encryption (G)
2101 This option will make the smbd server and client code using libsmb
2103 (smbclient, smbget, smbspool, ...) dump the Session Id, the
2104 decrypted Session Key, the Signing Key, the Application Key, the
2105 Encryption Key and the Decryption Key every time an SMB3+ session
2106 is established. This information will be printed in logs at level
2107 0.
2108 Warning: access to these values enables the decryption of any
2110 encrypted traffic on the dumped sessions. This option should only
2111 be enabled for debugging purposes.
2112 Default: debug encryption = no
2114 debug hires timestamp (G)
2116 Sometimes the timestamps in the log messages are needed with a
2118 resolution of higher that seconds, this boolean parameter adds
2119 microsecond resolution to the timestamp message header when turned
2120 on.
2121 Note that the parameter debug timestamp must be on for this to have
2123 an effect.
2124 Default: debug hires timestamp = yes
2126 debug pid (G)
2128 When using only one log file for more then one forked
2130 smbd(8)-process there may be hard to follow which process outputs
2131 which message. This boolean parameter is adds the process-id to the
2132 timestamp message headers in the logfile when turned on.
2133 Note that the parameter debug timestamp must be on for this to have
2135 an effect.
2136 Default: debug pid = no
2138 debug prefix timestamp (G)
2140 With this option enabled, the timestamp message header is prefixed
2142 to the debug message without the filename and function information
2143 that is included with the debug timestamp parameter. This gives
2144 timestamps to the messages without adding an additional line.
2145 Note that this parameter overrides the debug timestamp parameter.
2147 Default: debug prefix timestamp = no
2149 debug uid (G)
2151 Samba is sometimes run as root and sometime run as the connected
2153 user, this boolean parameter inserts the current euid, egid, uid
2154 and gid to the timestamp message headers in the log file if turned
2155 on.
2156 Note that the parameter debug timestamp must be on for this to have
2158 an effect.
2159 Default: debug uid = no
2161 dedicated keytab file (G)
2163 Specifies the absolute path to the kerberos keytab file when
2165 kerberos method is set to "dedicated keytab".
2166 Default: dedicated keytab file =
2168 Example: dedicated keytab file = /usr/local/etc/krb5.keytab
2170 default case (S)
2172 See the section on name mangling. Also note the short preserve case
2174 parameter.
2175 Default: default case = lower
2177 default devmode (S)
2179 This parameter is only applicable to printable services. When smbd
2181 is serving Printer Drivers to Windows NT/2k/XP clients, each
2182 printer on the Samba server has a Device Mode which defines things
2183 such as paper size and orientation and duplex settings. The device
2184 mode can only correctly be generated by the printer driver itself
2185 (which can only be executed on a Win32 platform). Because smbd is
2186 unable to execute the driver code to generate the device mode, the
2187 default behavior is to set this field to NULL.
2188 Most problems with serving printer drivers to Windows NT/2k/XP
2190 clients can be traced to a problem with the generated device mode.
2191 Certain drivers will do things such as crashing the client's
2192 Explorer.exe with a NULL devmode. However, other printer drivers
2193 can cause the client's spooler service (spoolsv.exe) to die if the
2194 devmode was not created by the driver itself (i.e. smbd generates a
2195 default devmode).
2196 This parameter should be used with care and tested with the printer
2198 driver in question. It is better to leave the device mode to NULL
2199 and let the Windows client set the correct values. Because drivers
2200 do not do this all the time, setting default devmode = yes will
2201 instruct smbd to generate a default one.
2202 For more information on Windows NT/2k printing and Device Modes,
2204 see the MSDN documentation.
2205 Default: default devmode = yes
2207 default
2209 This parameter is a synonym for default service.
2211 default service (G)
2213 This parameter specifies the name of a service which will be
2215 connected to if the service actually requested cannot be found.
2216 Note that the square brackets are NOT given in the parameter value
2217 (see example below).
2218 There is no default value for this parameter. If this parameter is
2220 not given, attempting to connect to a nonexistent service results
2221 in an error.
2222 Typically the default service would be a guest ok, read-only
2224 service.
2225 Also note that the apparent service name will be changed to equal
2227 that of the requested service, this is very useful as it allows you
2228 to use macros like %S to make a wildcard service.
2229 Note also that any "_" characters in the name of the service used
2231 in the default service will get mapped to a "/". This allows for
2232 interesting things.
2233 Default: default service =
2235 Example: default service = pub
2237 defer sharing violations (G)
2239 Windows allows specifying how a file will be shared with other
2241 processes when it is opened. Sharing violations occur when a file
2242 is opened by a different process using options that violate the
2243 share settings specified by other processes. This parameter causes
2244 smbd to act as a Windows server does, and defer returning a
2245 "sharing violation" error message for up to one second, allowing
2246 the client to close the file causing the violation in the meantime.
2247 UNIX by default does not have this behaviour.
2249 There should be no reason to turn off this parameter, as it is
2251 designed to enable Samba to more correctly emulate Windows.
2252 Default: defer sharing violations = yes
2254 delete group script (G)
2256 This is the full pathname to a script that will be run AS ROOT by
2258 smbd(8) when a group is requested to be deleted. It will expand any
2259 %g to the group name passed. This script is only useful for
2260 installations using the Windows NT domain administration tools.
2261 Default: delete group script =
2263 deleteprinter command (G)
2265 With the introduction of MS-RPC based printer support for Windows
2267 NT/2000 clients in Samba 2.2, it is now possible to delete a
2268 printer at run time by issuing the DeletePrinter() RPC call.
2269 For a Samba host this means that the printer must be physically
2271 deleted from the underlying printing system. The deleteprinter
2272 command defines a script to be run which will perform the necessary
2273 operations for removing the printer from the print system and from
2274 smb.conf.
2275 The deleteprinter command is automatically called with only one
2277 parameter: printer name.
2278 Once the deleteprinter command has been executed, smbd will reparse
2280 the smb.conf to check that the associated printer no longer exists.
2281 If the sharename is still valid, then smbd will return an
2282 ACCESS_DENIED error to the client.
2283 Default: deleteprinter command =
2285 Example: deleteprinter command = /usr/bin/removeprinter
2287 delete readonly (S)
2289 This parameter allows readonly files to be deleted. This is not
2291 normal DOS semantics, but is allowed by UNIX.
2292 This option may be useful for running applications such as rcs,
2294 where UNIX file ownership prevents changing file permissions, and
2295 DOS semantics prevent deletion of a read only file.
2296 Default: delete readonly = no
2298 delete share command (G)
2300 Samba 2.2.0 introduced the ability to dynamically add and delete
2302 shares via the Windows NT 4.0 Server Manager. The delete share
2303 command is used to define an external program or script which will
2304 remove an existing service definition from smb.conf.
2305 In order to successfully execute the delete share command, smbd
2307 requires that the administrator connects using a root account (i.e.
2308 uid == 0) or has the SeDiskOperatorPrivilege. Scripts defined in
2309 the delete share command parameter are executed as root.
2310 When executed, smbd will automatically invoke the delete share
2312 command with two parameters.
2313 · configFile - the location of the global smb.conf file.
2315 · shareName - the name of the existing service.
2317 This parameter is only used to remove file shares. To delete
2319 printer shares, see the deleteprinter command.
2320 Default: delete share command =
2322 Example: delete share command = /usr/local/bin/delshare
2324 delete user from group script (G)
2326 Full path to the script that will be called when a user is removed
2328 from a group using the Windows NT domain administration tools. It
2329 will be run by smbd(8) AS ROOT. Any %g will be replaced with the
2330 group name and any %u will be replaced with the user name.
2331 Default: delete user from group script =
2333 Example: delete user from group script = /usr/sbin/deluser %u %g
2335 delete user script (G)
2337 This is the full pathname to a script that will be run by smbd(8)
2339 when managing users with remote RPC (NT) tools.
2340 This script is called when a remote client removes a user from the
2342 server, normally using 'User Manager for Domains' or rpcclient.
2343 This script should delete the given UNIX username.
2345 Default: delete user script =
2347 Example: delete user script = /usr/local/samba/bin/del_user %u
2349 delete veto files (S)
2351 This option is used when Samba is attempting to delete a directory
2353 that contains one or more vetoed directories (see the veto files
2354 option). If this option is set to no (the default) then if a vetoed
2355 directory contains any non-vetoed files or directories then the
2356 directory delete will fail. This is usually what you want.
2357 If this option is set to yes, then Samba will attempt to
2359 recursively delete any files and directories within the vetoed
2360 directory. This can be useful for integration with file serving
2361 systems such as NetAtalk which create meta-files within directories
2362 you might normally veto DOS/Windows users from seeing (e.g.
2363 .AppleDouble)
2364 Setting delete veto files = yes allows these directories to be
2366 transparently deleted when the parent directory is deleted (so long
2367 as the user has permissions to do so).
2368 Default: delete veto files = no
2370 dfree cache time (S)
2372 The dfree cache time should only be used on systems where a problem
2374 occurs with the internal disk space calculations. This has been
2375 known to happen with Ultrix, but may occur with other operating
2376 systems. The symptom that was seen was an error of "Abort Retry
2377 Ignore" at the end of each directory listing.
2378 This is a new parameter introduced in Samba version 3.0.21. It
2380 specifies in seconds the time that smbd will cache the output of a
2381 disk free query. If set to zero (the default) no caching is done.
2382 This allows a heavily loaded server to prevent rapid spawning of
2383 dfree command scripts increasing the load.
2384 By default this parameter is zero, meaning no caching will be done.
2386 No default
2388 Example: dfree cache time = 60
2390 dfree command (S)
2392 The dfree command setting should only be used on systems where a
2394 problem occurs with the internal disk space calculations. This has
2395 been known to happen with Ultrix, but may occur with other
2396 operating systems. The symptom that was seen was an error of "Abort
2397 Retry Ignore" at the end of each directory listing.
2398 This setting allows the replacement of the internal routines to
2400 calculate the total disk space and amount available with an
2401 external routine. The example below gives a possible script that
2402 might fulfill this function.
2403 In Samba version 3.0.21 this parameter has been changed to be a
2405 per-share parameter, and in addition the parameter dfree cache time
2406 was added to allow the output of this script to be cached for
2407 systems under heavy load.
2408 The external program will be passed a single parameter indicating a
2410 directory in the filesystem being queried. This will typically
2411 consist of the string ./. The script should return two integers in
2412 ASCII. The first should be the total disk space in blocks, and the
2413 second should be the number of available blocks. An optional third
2414 return value can give the block size in bytes. The default
2415 blocksize is 1024 bytes.
2416 Note: Your script should NOT be setuid or setgid and should be
2418 owned by (and writeable only by) root!
2419 Where the script dfree (which must be made executable) could be:
2421 #!/bin/sh
2424 df "$1" | tail -1 | awk '{print $(NF-4),$(NF-2)}'
2425 or perhaps (on Sys V based systems):
2427 #!/bin/sh
2430 /usr/bin/df -k "$1" | tail -1 | awk '{print $3" "$5}'
2431 Note that you may have to replace the command names with full path
2433 names on some systems. Also note the arguments passed into the
2434 script should be quoted inside the script in case they contain
2435 special characters such as spaces or newlines.
2436 By default internal routines for determining the disk capacity and
2438 remaining space will be used.
2439 No default
2441 Example: dfree command = /usr/local/samba/bin/dfree
2443 dgram port (G)
2445 Specifies which ports the server should listen on for NetBIOS
2447 datagram traffic.
2448 Default: dgram port = 138
2450 directory mode
2452 This parameter is a synonym for directory mask.
2454 directory mask (S)
2456 This parameter is the octal modes which are used when converting
2458 DOS modes to UNIX modes when creating UNIX directories.
2459 When a directory is created, the necessary permissions are
2461 calculated according to the mapping from DOS modes to UNIX
2462 permissions, and the resulting UNIX mode is then bit-wise 'AND'ed
2463 with this parameter. This parameter may be thought of as a bit-wise
2464 MASK for the UNIX modes of a directory. Any bit not set here will
2465 be removed from the modes set on a directory when it is created.
2466 The default value of this parameter removes the 'group' and 'other'
2468 write bits from the UNIX mode, allowing only the user who owns the
2469 directory to modify it.
2470 Following this Samba will bit-wise 'OR' the UNIX mode created from
2472 this parameter with the value of the force directory mode
2473 parameter. This parameter is set to 000 by default (i.e. no extra
2474 mode bits are added).
2475 Default: directory mask = 0755
2477 Example: directory mask = 0775
2479 directory name cache size (S)
2481 This parameter specifies the size of the directory name cache for
2483 SMB1 connections. It is not used for SMB2. It will be needed to
2484 turn this off for *BSD systems.
2485 Default: directory name cache size = 100
2487 directory security mask (S)
2489 This parameter has been removed for Samba 4.0.0.
2491 No default
2493 disable netbios (G)
2495 Enabling this parameter will disable netbios support in Samba.
2497 Netbios is the only available form of browsing in all windows
2498 versions except for 2000 and XP.
2499 Note
2501 Clients that only support netbios won't be able to see your
2502 samba server when netbios support is disabled.
2503 Default: disable netbios = no
2504 disable spoolss (G)
2506 Enabling this parameter will disable Samba's support for the
2508 SPOOLSS set of MS-RPC's and will yield identical behavior as Samba
2509 2.0.x. Windows NT/2000 clients will downgrade to using Lanman style
2510 printing commands. Windows 9x/ME will be unaffected by the
2511 parameter. However, this will also disable the ability to upload
2512 printer drivers to a Samba server via the Windows NT Add Printer
2513 Wizard or by using the NT printer properties dialog window. It will
2514 also disable the capability of Windows NT/2000 clients to download
2515 print drivers from the Samba host upon demand. Be very careful
2516 about enabling this parameter.
2517 Default: disable spoolss = no
2519 dmapi support (S)
2521 This parameter specifies whether Samba should use DMAPI to
2523 determine whether a file is offline or not. This would typically be
2524 used in conjunction with a hierarchical storage system that
2525 automatically migrates files to tape.
2526 Note that Samba infers the status of a file by examining the events
2528 that a DMAPI application has registered interest in. This heuristic
2529 is satisfactory for a number of hierarchical storage systems, but
2530 there may be system for which it will fail. In this case, Samba may
2531 erroneously report files to be offline.
2532 This parameter is only available if a supported DMAPI
2534 implementation was found at compilation time. It will only be used
2535 if DMAPI is found to enabled on the system at run time.
2536 Default: dmapi support = no
2538 dns forwarder (G)
2540 This option specifies the list of DNS servers that DNS requests
2542 will be forwarded to if they can not be handled by Samba itself.
2543 The DNS forwarder is only used if the internal DNS server in Samba
2545 is used.
2546 Default: dns forwarder =
2548 Example: dns forwarder = 192.168.0.1 192.168.0.2
2550 dns proxy (G)
2552 Specifies that nmbd(8) when acting as a WINS server and finding
2554 that a NetBIOS name has not been registered, should treat the
2555 NetBIOS name word-for-word as a DNS name and do a lookup with the
2556 DNS server for that name on behalf of the name-querying client.
2557 Note that the maximum length for a NetBIOS name is 15 characters,
2559 so the DNS name (or DNS alias) can likewise only be 15 characters,
2560 maximum.
2561 nmbd spawns a second copy of itself to do the DNS name lookup
2563 requests, as doing a name lookup is a blocking action.
2564 Default: dns proxy = yes
2566 dns update command (G)
2568 This option sets the command that is called when there are DNS
2570 updates. It should update the local machines DNS names using
2571 TSIG-GSS.
2572 Default: dns update command =
2574 /builddir/build/BUILD/samba-4.12.2/source4/scripting/bin/samba_dnsupdate
2575 Example: dns update command = /usr/local/sbin/dnsupdate
2577 dns zone scavenging (G)
2579 When enabled (the default is disabled) unused dynamic dns records
2581 are periodically removed.
2582 Warning
2584 This option should not be enabled for installations created
2585 with versions of samba before 4.9. Doing this will result in
2586 the loss of static DNS entries. This is due to a bug in
2587 previous versions of samba (BUG 12451) which marked dynamic DNS
2588 records as static and static records as dynamic.
2589 Note
2591 If one record for a DNS name is static (non-aging) then no
2592 other record for that DNS name will be scavenged.
2593 Default: dns zone scavenging = no
2594 domain logons (G)
2596 If set to yes, the Samba server will provide the netlogon service
2598 for Windows 9X network logons for the workgroup it is in. This will
2599 also cause the Samba server to act as a domain controller for NT4
2600 style domain services. For more details on setting up this feature
2601 see the Domain Control chapter of the Samba HOWTO Collection.
2602 Default: domain logons = no
2604 domain master (G)
2606 Tell smbd(8) to enable WAN-wide browse list collation. Setting this
2608 option causes nmbd to claim a special domain specific NetBIOS name
2609 that identifies it as a domain master browser for its given
2610 workgroup. Local master browsers in the same workgroup on
2611 broadcast-isolated subnets will give this nmbd their local browse
2612 lists, and then ask smbd(8) for a complete copy of the browse list
2613 for the whole wide area network. Browser clients will then contact
2614 their local master browser, and will receive the domain-wide browse
2615 list, instead of just the list for their broadcast-isolated subnet.
2616 Note that Windows NT Primary Domain Controllers expect to be able
2618 to claim this workgroup specific special NetBIOS name that
2619 identifies them as domain master browsers for that workgroup by
2620 default (i.e. there is no way to prevent a Windows NT PDC from
2621 attempting to do this). This means that if this parameter is set
2622 and nmbd claims the special name for a workgroup before a Windows
2623 NT PDC is able to do so then cross subnet browsing will behave
2624 strangely and may fail.
2625 If domain logons = yes, then the default behavior is to enable the
2627 domain master parameter. If domain logons is not enabled (the
2628 default setting), then neither will domain master be enabled by
2629 default.
2630 When domain logons = Yes the default setting for this parameter is
2632 Yes, with the result that Samba will be a PDC. If domain master =
2633 No, Samba will function as a BDC. In general, this parameter should
2634 be set to 'No' only on a BDC.
2635 Default: domain master = auto
2637 dont descend (S)
2639 There are certain directories on some systems (e.g., the /proc tree
2641 under Linux) that are either not of interest to clients or are
2642 infinitely deep (recursive). This parameter allows you to specify a
2643 comma-delimited list of directories that the server should always
2644 show as empty.
2645 Note that Samba can be very fussy about the exact format of the
2647 "dont descend" entries. For example you may need ./proc instead of
2648 just /proc. Experimentation is the best policy :-)
2649 Default: dont descend =
2651 Example: dont descend = /proc,/dev
2653 dos charset (G)
2655 DOS SMB clients assume the server has the same charset as they do.
2657 This option specifies which charset Samba should talk to DOS
2658 clients.
2659 The default depends on which charsets you have installed. Samba
2661 tries to use charset 850 but falls back to ASCII in case it is not
2662 available. Run testparm(1) to check the default on your system.
2663 No default
2665 dos filemode (S)
2667 The default behavior in Samba is to provide UNIX-like behavior
2669 where only the owner of a file/directory is able to change the
2670 permissions on it. However, this behavior is often confusing to
2671 DOS/Windows users. Enabling this parameter allows a user who has
2672 write access to the file (by whatever means, including an ACL
2673 permission) to modify the permissions (including ACL) on it. Note
2674 that a user belonging to the group owning the file will not be
2675 allowed to change permissions if the group is only granted read
2676 access. Ownership of the file/directory may also be changed. Note
2677 that using the VFS modules acl_xattr or acl_tdb which store native
2678 Windows as meta-data will automatically turn this option on for any
2679 share for which they are loaded, as they require this option to
2680 emulate Windows ACLs correctly.
2681 Default: dos filemode = no
2683 dos filetime resolution (S)
2685 Under the DOS and Windows FAT filesystem, the finest granularity on
2687 time resolution is two seconds. Setting this parameter for a share
2688 causes Samba to round the reported time down to the nearest two
2689 second boundary when a query call that requires one second
2690 resolution is made to smbd(8).
2691 This option is mainly used as a compatibility option for Visual C++
2693 when used against Samba shares. If oplocks are enabled on a share,
2694 Visual C++ uses two different time reading calls to check if a file
2695 has changed since it was last read. One of these calls uses a
2696 one-second granularity, the other uses a two second granularity. As
2697 the two second call rounds any odd second down, then if the file
2698 has a timestamp of an odd number of seconds then the two timestamps
2699 will not match and Visual C++ will keep reporting the file has
2700 changed. Setting this option causes the two timestamps to match,
2701 and Visual C++ is happy.
2702 Default: dos filetime resolution = no
2704 dos filetimes (S)
2706 Under DOS and Windows, if a user can write to a file they can
2708 change the timestamp on it. Under POSIX semantics, only the owner
2709 of the file or root may change the timestamp. By default, Samba
2710 emulates the DOS semantics and allows one to change the timestamp
2711 on a file if the user smbd is acting on behalf has write
2712 permissions. Due to changes in Microsoft Office 2000 and beyond,
2713 the default for this parameter has been changed from "no" to "yes"
2714 in Samba 3.0.14 and above. Microsoft Excel will display dialog box
2715 warnings about the file being changed by another user if this
2716 parameter is not set to "yes" and files are being shared between
2717 users.
2718 Default: dos filetimes = yes
2720 dsdb event notification (G)
2722 When enabled, this option causes Samba (acting as an Active
2724 Directory Domain Controller) to stream Samba database events across
2725 the internal message bus. Scripts built using Samba's python
2726 bindings can listen to these events by registering as the service
2727 dsdb_event.
2728 This should be considered a developer option (it assists in the
2730 Samba testsuite) rather than a facility for external auditing, as
2731 message delivery is not guaranteed (a feature that the testsuite
2732 works around).
2733 The Samba database events are also logged via the normal logging
2735 methods when the log level is set appropriately.
2736 Default: dsdb event notification = no
2738 dsdb group change notification (G)
2740 When enabled, this option causes Samba (acting as an Active
2742 Directory Domain Controller) to stream group membership change
2743 events across the internal message bus. Scripts built using Samba's
2744 python bindings can listen to these events by registering as the
2745 service dsdb_group_event.
2746 This should be considered a developer option (it assists in the
2748 Samba testsuite) rather than a facility for external auditing, as
2749 message delivery is not guaranteed (a feature that the testsuite
2750 works around).
2751 The group events are also logged via the normal logging methods
2753 when the log level is set appropriately.
2754 Default: dsdb group change notification = no
2756 dsdb password event notification (G)
2758 When enabled, this option causes Samba (acting as an Active
2760 Directory Domain Controller) to stream password change and reset
2761 events across the internal message bus. Scripts built using Samba's
2762 python bindings can listen to these events by registering as the
2763 service password_event.
2764 This should be considered a developer option (it assists in the
2766 Samba testsuite) rather than a facility for external auditing, as
2767 message delivery is not guaranteed (a feature that the testsuite
2768 works around).
2769 The password events are also logged via the normal logging methods
2771 when the log level is set appropriately.
2772 Default: dsdb password event notification = no
2774 durable handles (S)
2776 This boolean parameter controls whether Samba can grant SMB2
2778 durable file handles on a share.
2779 Note that durable handles are only enabled if kernel oplocks = no,
2781 kernel share modes = no, and posix locking = no, i.e. if the share
2782 is configured for CIFS/SMB2 only access, not supporting
2783 interoperability features with local UNIX processes or NFS
2784 operations.
2785 Also note that, for the time being, durability is not granted for a
2787 handle that has the delete on close flag set.
2788 Default: durable handles = yes
2790 ea support (S)
2792 This boolean parameter controls whether smbd(8) will allow clients
2794 to attempt to access extended attributes on a share. In order to
2795 enable this parameter on a setup with default VFS modules:
2796 · Samba must have been built with extended attributes
2798 support.
2799 · The underlying filesystem exposed by the share must
2801 support extended attributes (e.g. the getfattr(1) /
2802 setfattr(1) utilities must work).
2803 Note that the SMB protocol allows setting attributes whose value is
2805 64K bytes long, and that on NTFS, the maximum storage space for
2806 extended attributes per file is 64K. On most UNIX systems (Solaris
2807 and ZFS file system being the exception), the limits are much lower
2808 - typically 4K. Worse, the same 4K space is often used to store
2809 system metadata such as POSIX ACLs, or Samba's NT ACLs. Giving
2810 clients access to this tight space via extended attribute support
2811 could consume all of it by unsuspecting client applications, which
2812 would prevent changing system metadata due to lack of space. The
2813 default has changed to yes in Samba release 4.9.0 and above to
2814 allow better Windows fileserver compatibility in a default install.
2815 Default: ea support = yes
2817 elasticsearch:address (S)
2819 Specifies the name of the Elasticsearch server to use for Spotlight
2821 queries when using the Elasticsearch backend.
2822 Default: elasticsearch:address = localhost
2824 Example: elasticsearch:address = needle.haystack.samba.org
2826 elasticsearch:index (S)
2828 Specifies the name of the Elasticsearch index to use for Spotlight
2830 queries when using the Elasticsearch backend. The default value of
2831 "_all" is a special Elasticsearch value that performs the search
2832 operation on all indices.
2833 Default: elasticsearch:index = _all
2835 Example: elasticsearch:index = spotlight
2837 elasticsearch:mappings (G)
2839 Path to a file specifying metadata attribute mappings in JSON
2841 format. Use by the Elasticsearch backend of the Spotlight RPC
2842 service.
2843 Default: elasticsearch:mappings =
2845 /usr/share/samba/elasticsearch_mappings.json
2846 Example: elasticsearch:mappings = /usr/share/foo/mymappings.json
2848 elasticsearch:max results (S)
2850 Path to a file specifying metadata attribute mappings in JSON
2852 format. Used by the Elasticsearch backend of the Spotlight RPC
2853 service. A value of 0 means no limit.
2854 Default: elasticsearch:max results = 100
2856 Example: elasticsearch:max results = 10
2858 elasticsearch:port (S)
2860 Specifies the TCP port of the Elasticsearch server to use for
2862 Spotlight queries when using the Elasticsearch backend.
2863 Default: elasticsearch:port = 9200
2865 Example: elasticsearch:port = 9201
2867 elasticsearch:use tls (S)
2869 Specifies whether to use HTTPS when talking to the Elasticsearch
2871 server used for Spotlight queries when using the Elasticsearch
2872 backend.
2873 Default: elasticsearch:use tls = no
2875 Example: elasticsearch:use tls = yes
2877 enable asu support (G)
2879 Hosts running the "Advanced Server for Unix (ASU)" product require
2881 some special accommodations such as creating a builtin [ADMIN$]
2882 share that only supports IPC connections. The has been the default
2883 behavior in smbd for many years. However, certain Microsoft
2884 applications such as the Print Migrator tool require that the
2885 remote server support an [ADMIN$] file share. Disabling this
2886 parameter allows for creating an [ADMIN$] file share in smb.conf.
2887 Default: enable asu support = no
2889 enable core files (G)
2891 This parameter specifies whether core dumps should be written on
2893 internal exits. Normally set to yes. You should never need to
2894 change this.
2895 Default: enable core files = yes
2897 Example: enable core files = no
2899 enable privileges (G)
2901 This deprecated parameter controls whether or not smbd will honor
2903 privileges assigned to specific SIDs via either net rpc rights or
2904 one of the Windows user and group manager tools. This parameter is
2905 enabled by default. It can be disabled to prevent members of the
2906 Domain Admins group from being able to assign privileges to users
2907 or groups which can then result in certain smbd operations running
2908 as root that would normally run under the context of the connected
2909 user.
2910 An example of how privileges can be used is to assign the right to
2912 join clients to a Samba controlled domain without providing root
2913 access to the server via smbd.
2914 Please read the extended description provided in the Samba HOWTO
2916 documentation.
2917 Default: enable privileges = yes
2919 enable spoolss (G)
2921 Inverted synonym for disable spoolss.
2923 Default: enable spoolss = yes
2925 encrypt passwords (G)
2927 This parameter has been deprecated since Samba 4.11 and support for
2929 plaintext (as distinct from NTLM, NTLMv2 or Kerberos
2930 authentication) will be removed in a future Samba release.
2931 That is, in the future, the current default of encrypt passwords =
2933 yes will be the enforced behaviour.
2934 This boolean controls whether encrypted passwords will be
2936 negotiated with the client. Note that Windows NT 4.0 SP3 and above
2937 and also Windows 98 will by default expect encrypted passwords
2938 unless a registry entry is changed. To use encrypted passwords in
2939 Samba see the chapter "User Database" in the Samba HOWTO
2940 Collection.
2941 MS Windows clients that expect Microsoft encrypted passwords and
2943 that do not have plain text password support enabled will be able
2944 to connect only to a Samba server that has encrypted password
2945 support enabled and for which the user accounts have a valid
2946 encrypted password. Refer to the smbpasswd command man page for
2947 information regarding the creation of encrypted passwords for user
2948 accounts.
2949 The use of plain text passwords is NOT advised as support for this
2951 feature is no longer maintained in Microsoft Windows products. If
2952 you want to use plain text passwords you must set this parameter to
2953 no.
2954 In order for encrypted passwords to work correctly smbd(8) must
2956 either have access to a local smbpasswd(5) file (see the
2957 smbpasswd(8) program for information on how to set up and maintain
2958 this file), or set the security = [domain|ads] parameter which
2959 causes smbd to authenticate against another server.
2960 Default: encrypt passwords = yes
2962 enhanced browsing (G)
2964 This option enables a couple of enhancements to cross-subnet browse
2966 propagation that have been added in Samba but which are not
2967 standard in Microsoft implementations.
2968 The first enhancement to browse propagation consists of a regular
2970 wildcard query to a Samba WINS server for all Domain Master
2971 Browsers, followed by a browse synchronization with each of the
2972 returned DMBs. The second enhancement consists of a regular
2973 randomised browse synchronization with all currently known DMBs.
2974 You may wish to disable this option if you have a problem with
2976 empty workgroups not disappearing from browse lists. Due to the
2977 restrictions of the browse protocols, these enhancements can cause
2978 a empty workgroup to stay around forever which can be annoying.
2979 In general you should leave this option enabled as it makes
2981 cross-subnet browse propagation much more reliable.
2982 Default: enhanced browsing = yes
2984 enumports command (G)
2986 The concept of a "port" is fairly foreign to UNIX hosts. Under
2988 Windows NT/2000 print servers, a port is associated with a port
2989 monitor and generally takes the form of a local port (i.e. LPT1:,
2990 COM1:, FILE:) or a remote port (i.e. LPD Port Monitor, etc...). By
2991 default, Samba has only one port defined--"Samba Printer Port".
2992 Under Windows NT/2000, all printers must have a valid port name. If
2993 you wish to have a list of ports displayed (smbd does not use a
2994 port name for anything) other than the default "Samba Printer
2995 Port", you can define enumports command to point to a program which
2996 should generate a list of ports, one per line, to standard output.
2997 This listing will then be used in response to the level 1 and 2
2998 EnumPorts() RPC.
2999 Default: enumports command =
3001 Example: enumports command = /usr/bin/listports
3003 eventlog list (G)
3005 This option defines a list of log names that Samba will report to
3007 the Microsoft EventViewer utility. The listed eventlogs will be
3008 associated with tdb file on disk in the $(statedir)/eventlog.
3009 The administrator must use an external process to parse the normal
3011 Unix logs such as /var/log/messages and write then entries to the
3012 eventlog tdb files. Refer to the eventlogadm(8) utility for how to
3013 write eventlog entries.
3014 Default: eventlog list =
3016 Example: eventlog list = Security Application Syslog Apache
3018 fake directory create times (S)
3020 NTFS and Windows VFAT file systems keep a create time for all files
3022 and directories. This is not the same as the ctime - status change
3023 time - that Unix keeps, so Samba by default reports the earliest of
3024 the various times Unix does keep. Setting this parameter for a
3025 share causes Samba to always report midnight 1-1-1980 as the create
3026 time for directories.
3027 This option is mainly used as a compatibility option for Visual C++
3029 when used against Samba shares. Visual C++ generated makefiles have
3030 the object directory as a dependency for each object file, and a
3031 make rule to create the directory. Also, when NMAKE compares
3032 timestamps it uses the creation time when examining a directory.
3033 Thus the object directory will be created if it does not exist, but
3034 once it does exist it will always have an earlier timestamp than
3035 the object files it contains.
3036 However, Unix time semantics mean that the create time reported by
3038 Samba will be updated whenever a file is created or deleted in the
3039 directory. NMAKE finds all object files in the object directory.
3040 The timestamp of the last one built is then compared to the
3041 timestamp of the object directory. If the directory's timestamp if
3042 newer, then all object files will be rebuilt. Enabling this option
3043 ensures directories always predate their contents and an NMAKE
3044 build will proceed as expected.
3045 Default: fake directory create times = no
3047 fake oplocks (S)
3049 Oplocks are the way that SMB clients get permission from a server
3051 to locally cache file operations. If a server grants an oplock
3052 (opportunistic lock) then the client is free to assume that it is
3053 the only one accessing the file and it will aggressively cache file
3054 data. With some oplock types the client may even cache file
3055 open/close operations. This can give enormous performance benefits.
3056 When you set fake oplocks = yes, smbd(8) will always grant oplock
3058 requests no matter how many clients are using the file.
3059 It is generally much better to use the real oplocks support rather
3061 than this parameter.
3062 If you enable this option on all read-only shares or shares that
3064 you know will only be accessed from one client at a time such as
3065 physically read-only media like CDROMs, you will see a big
3066 performance improvement on many operations. If you enable this
3067 option on shares where multiple clients may be accessing the files
3068 read-write at the same time you can get data corruption. Use this
3069 option carefully!
3070 Default: fake oplocks = no
3072 follow symlinks (S)
3074 This parameter allows the Samba administrator to stop smbd(8) from
3076 following symbolic links in a particular share. Setting this
3077 parameter to no prevents any file or directory that is a symbolic
3078 link from being followed (the user will get an error). This option
3079 is very useful to stop users from adding a symbolic link to
3080 /etc/passwd in their home directory for instance. However it will
3081 slow filename lookups down slightly.
3082 This option is enabled (i.e. smbd will follow symbolic links) by
3084 default.
3085 Default: follow symlinks = yes
3087 force create mode (S)
3089 This parameter specifies a set of UNIX mode bit permissions that
3091 will always be set on a file created by Samba. This is done by
3092 bitwise 'OR'ing these bits onto the mode bits of a file that is
3093 being created. The default for this parameter is (in octal) 000.
3094 The modes in this parameter are bitwise 'OR'ed onto the file mode
3095 after the mask set in the create mask parameter is applied.
3096 The example below would force all newly created files to have read
3098 and execute permissions set for 'group' and 'other' as well as the
3099 read/write/execute bits set for the 'user'.
3100 Default: force create mode = 0000
3102 Example: force create mode = 0755
3104 force directory mode (S)
3106 This parameter specifies a set of UNIX mode bit permissions that
3108 will always be set on a directory created by Samba. This is done by
3109 bitwise 'OR'ing these bits onto the mode bits of a directory that
3110 is being created. The default for this parameter is (in octal) 0000
3111 which will not add any extra permission bits to a created
3112 directory. This operation is done after the mode mask in the
3113 parameter directory mask is applied.
3114 The example below would force all created directories to have read
3116 and execute permissions set for 'group' and 'other' as well as the
3117 read/write/execute bits set for the 'user'.
3118 Default: force directory mode = 0000
3120 Example: force directory mode = 0755
3122 force directory security mode (S)
3124 This parameter has been removed for Samba 4.0.0.
3126 No default
3128 group
3130 This parameter is a synonym for force group.
3132 force group (S)
3134 This specifies a UNIX group name that will be assigned as the
3136 default primary group for all users connecting to this service.
3137 This is useful for sharing files by ensuring that all access to
3138 files on service will use the named group for their permissions
3139 checking. Thus, by assigning permissions for this group to the
3140 files and directories within this service the Samba administrator
3141 can restrict or allow sharing of these files.
3142 In Samba 2.0.5 and above this parameter has extended functionality
3144 in the following way. If the group name listed here has a '+'
3145 character prepended to it then the current user accessing the share
3146 only has the primary group default assigned to this group if they
3147 are already assigned as a member of that group. This allows an
3148 administrator to decide that only users who are already in a
3149 particular group will create files with group ownership set to that
3150 group. This gives a finer granularity of ownership assignment. For
3151 example, the setting force group = +sys means that only users who
3152 are already in group sys will have their default primary group
3153 assigned to sys when accessing this Samba share. All other users
3154 will retain their ordinary primary group.
3155 If the force user parameter is also set the group specified in
3157 force group will override the primary group set in force user.
3158 Default: force group =
3160 Example: force group = agroup
3162 force printername (S)
3164 When printing from Windows NT (or later), each printer in smb.conf
3166 has two associated names which can be used by the client. The first
3167 is the sharename (or shortname) defined in smb.conf. This is the
3168 only printername available for use by Windows 9x clients. The
3169 second name associated with a printer can be seen when browsing to
3170 the "Printers" (or "Printers and Faxes") folder on the Samba
3171 server. This is referred to simply as the printername (not to be
3172 confused with the printer name option).
3173 When assigning a new driver to a printer on a remote Windows
3175 compatible print server such as Samba, the Windows client will
3176 rename the printer to match the driver name just uploaded. This can
3177 result in confusion for users when multiple printers are bound to
3178 the same driver. To prevent Samba from allowing the printer's
3179 printername to differ from the sharename defined in smb.conf, set
3180 force printername = yes.
3181 Be aware that enabling this parameter may affect migrating printers
3183 from a Windows server to Samba since Windows has no way to force
3184 the sharename and printername to match.
3185 It is recommended that this parameter's value not be changed once
3187 the printer is in use by clients as this could cause a user not be
3188 able to delete printer connections from their local Printers
3189 folder.
3190 Default: force printername = no
3192 force security mode (S)
3194 This parameter has been removed for Samba 4.0.0.
3196 No default
3198 force unknown acl user (S)
3200 If this parameter is set, a Windows NT ACL that contains an unknown
3202 SID (security descriptor, or representation of a user or group id)
3203 as the owner or group owner of the file will be silently mapped
3204 into the current UNIX uid or gid of the currently connected user.
3205 This is designed to allow Windows NT clients to copy files and
3207 folders containing ACLs that were created locally on the client
3208 machine and contain users local to that machine only (no domain
3209 users) to be copied to a Samba server (usually with XCOPY /O) and
3210 have the unknown userid and groupid of the file owner map to the
3211 current connected user. This can only be fixed correctly when
3212 winbindd allows arbitrary mapping from any Windows NT SID to a UNIX
3213 uid or gid.
3214 Try using this parameter when XCOPY /O gives an ACCESS_DENIED
3216 error.
3217 Default: force unknown acl user = no
3219 force user (S)
3221 This specifies a UNIX user name that will be assigned as the
3223 default user for all users connecting to this service. This is
3224 useful for sharing files. You should also use it carefully as using
3225 it incorrectly can cause security problems.
3226 This user name only gets used once a connection is established.
3228 Thus clients still need to connect as a valid user and supply a
3229 valid password. Once connected, all file operations will be
3230 performed as the "forced user", no matter what username the client
3231 connected as. This can be very useful.
3232 In Samba 2.0.5 and above this parameter also causes the primary
3234 group of the forced user to be used as the primary group for all
3235 file activity. Prior to 2.0.5 the primary group was left as the
3236 primary group of the connecting user (this was a bug).
3237 Default: force user =
3239 Example: force user = auser
3241 fss: prune stale (G)
3243 When enabled, Samba's File Server Remote VSS Protocol (FSRVP)
3245 server checks all FSRVP initiated snapshots on startup, and removes
3246 any corresponding state (including share definitions) for
3247 nonexistent snapshot paths.
3248 Default: fss: prune stale = no
3250 Example: fss: prune stale = yes
3252 fss: sequence timeout (G)
3254 The File Server Remote VSS Protocol (FSRVP) server includes a
3256 message sequence timer to ensure cleanup on unexpected client
3257 disconnect. This parameter overrides the default timeout between
3258 FSRVP operations. FSRVP timeouts can be completely disabled via a
3259 value of 0.
3260 Default: fss: sequence timeout = 180 or 1800, depending on
3262 operation
3263 Example: fss: sequence timeout = 0
3265 fstype (S)
3267 This parameter allows the administrator to configure the string
3269 that specifies the type of filesystem a share is using that is
3270 reported by smbd(8) when a client queries the filesystem type for a
3271 share. The default type is NTFS for compatibility with Windows NT
3272 but this can be changed to other strings such as Samba or FAT if
3273 required.
3274 Default: fstype = NTFS
3276 Example: fstype = Samba
3278 get quota command (G)
3280 The get quota command should only be used whenever there is no
3282 operating system API available from the OS that samba can use.
3283 This option is only available Samba was compiled with quotas
3285 support.
3286 This parameter should specify the path to a script that queries the
3288 quota information for the specified user/group for the partition
3289 that the specified directory is on.
3290 Such a script is being given 3 arguments:
3292 · directory
3294 · type of query
3296 · uid of user or gid of group
3298 The directory is actually mostly just "." - It needs to be treated
3300 relatively to the current working directory that the script can
3301 also query.
3302 The type of query can be one of:
3304 · 1 - user quotas
3306 · 2 - user default quotas (uid = -1)
3308 · 3 - group quotas
3310 · 4 - group default quotas (gid = -1)
3312 This script should print one line as output with spaces between the
3314 columns. The printed columns should be:
3315 · 1 - quota flags (0 = no quotas, 1 = quotas enabled, 2 =
3317 quotas enabled and enforced)
3318 · 2 - number of currently used blocks
3320 · 3 - the softlimit number of blocks
3322 · 4 - the hardlimit number of blocks
3324 · 5 - currently used number of inodes
3326 · 6 - the softlimit number of inodes
3328 · 7 - the hardlimit number of inodes
3330 · 8 (optional) - the number of bytes in a block(default is
3332 1024)
3333 Default: get quota command =
3335 Example: get quota command = /usr/local/sbin/query_quota
3337 getwd cache (G)
3339 This is a tuning option. When this is enabled a caching algorithm
3341 will be used to reduce the time taken for getwd() calls. This can
3342 have a significant impact on performance, especially when the wide
3343 links parameter is set to no.
3344 Default: getwd cache = yes
3346 gpo update command (G)
3348 This option sets the command that is called to apply GPO policies.
3350 The samba-gpupdate script applies System Access and Kerberos
3351 Policies to the KDC. System Access policies set minPwdAge,
3352 maxPwdAge, minPwdLength, and pwdProperties in the samdb. Kerberos
3353 Policies set kdc:service ticket lifetime, kdc:user ticket lifetime,
3354 and kdc:renewal lifetime in smb.conf.
3355 Default: gpo update command =
3357 /builddir/build/BUILD/samba-4.12.2/source4/scripting/bin/samba-gpupdate
3358 Example: gpo update command = /usr/local/sbin/gpoupdate
3360 guest account (G)
3362 This is a username which will be used for access to services which
3364 are specified as guest ok (see below). Whatever privileges this
3365 user has will be available to any client connecting to the guest
3366 service. This user must exist in the password file, but does not
3367 require a valid login. The user account "ftp" is often a good
3368 choice for this parameter.
3369 On some systems the default guest account "nobody" may not be able
3371 to print. Use another account in this case. You should test this by
3372 trying to log in as your guest user (perhaps by using the su -
3373 command) and trying to print using the system print command such as
3374 lpr(1) or lp(1).
3375 This parameter does not accept % macros, because many parts of the
3377 system require this value to be constant for correct operation.
3378 Default: guest account = nobody # default can be changed at
3380 compile-time
3381 Example: guest account = ftp
3383 public
3385 This parameter is a synonym for guest ok.
3387 guest ok (S)
3389 If this parameter is yes for a service, then no password is
3391 required to connect to the service. Privileges will be those of the
3392 guest account.
3393 This parameter nullifies the benefits of setting restrict anonymous
3395 = 2
3396 See the section below on security for more information about this
3398 option.
3399 Default: guest ok = no
3401 only guest
3403 This parameter is a synonym for guest only.
3405 guest only (S)
3407 If this parameter is yes for a service, then only guest connections
3409 to the service are permitted. This parameter will have no effect if
3410 guest ok is not set for the service.
3411 See the section below on security for more information about this
3413 option.
3414 Default: guest only = no
3416 hide dot files (S)
3418 This is a boolean parameter that controls whether files starting
3420 with a dot appear as hidden files.
3421 Default: hide dot files = yes
3423 hide files (S)
3425 This is a list of files or directories that are not visible but are
3427 accessible. The DOS 'hidden' attribute is applied to any files or
3428 directories that match.
3429 Each entry in the list must be separated by a '/', which allows
3431 spaces to be included in the entry. '*' and '?' can be used to
3432 specify multiple files or directories as in DOS wildcards.
3433 Each entry must be a Unix path, not a DOS path and must not include
3435 the Unix directory separator '/'.
3436 Note that the case sensitivity option is applicable in hiding
3438 files.
3439 Setting this parameter will affect the performance of Samba, as it
3441 will be forced to check all files and directories for a match as
3442 they are scanned.
3443 The example shown above is based on files that the Macintosh SMB
3445 client (DAVE) available from Thursby creates for internal use, and
3446 also still hides all files beginning with a dot.
3447 An example of us of this parameter is:
3449 hide files = /.*/DesktopFolderDB/TrashFor%m/resource.frk/
3451 Default: hide files = # no file are hidden
3453 hide new files timeout (S)
3455 Setting this parameter to something but 0 hides files that have
3457 been modified less than N seconds ago.
3458 It can be used for ingest/process queue style workloads. A
3460 processing application should only see files that are definitely
3461 finished. As many applications do not have proper external workflow
3462 control, this can be a way to make sure processing does not
3463 interfere with file ingest.
3464 Default: hide new files timeout = 0
3466 hide special files (S)
3468 This parameter prevents clients from seeing special files such as
3470 sockets, devices and fifo's in directory listings.
3471 Default: hide special files = no
3473 hide unreadable (S)
3475 This parameter prevents clients from seeing the existence of files
3477 that cannot be read. Defaults to off.
3478 Please note that enabling this can slow down listing large
3480 directories significantly. Samba has to evaluate the ACLs of all
3481 directory members, which can be a lot of effort.
3482 Default: hide unreadable = no
3484 hide unwriteable files (S)
3486 This parameter prevents clients from seeing the existence of files
3488 that cannot be written to. Defaults to off. Note that unwriteable
3489 directories are shown as usual.
3490 Please note that enabling this can slow down listing large
3492 directories significantly. Samba has to evaluate the ACLs of all
3493 directory members, which can be a lot of effort.
3494 Default: hide unwriteable files = no
3496 homedir map (G)
3498 If nis homedir is yes, and smbd(8) is also acting as a Win95/98
3500 logon server then this parameter specifies the NIS (or YP) map from
3501 which the server for the user's home directory should be extracted.
3502 At present, only the Sun auto.home map format is understood. The
3503 form of the map is:
3504 username server:/some/file/system
3506 and the program will extract the servername from before the first
3508 ':'. There should probably be a better parsing system that copes
3509 with different map formats and also Amd (another automounter) maps.
3510 Note
3512 A working NIS client is required on the system for this option
3513 to work.
3514 Default: homedir map =
3515 Example: homedir map = amd.homedir
3517 host msdfs (G)
3519 If set to yes, Samba will act as a Dfs server, and allow Dfs-aware
3521 clients to browse Dfs trees hosted on the server.
3522 See also the msdfs root share level parameter. For more information
3524 on setting up a Dfs tree on Samba, refer to the MSFDS chapter in
3525 the book Samba3-HOWTO.
3526 Default: host msdfs = yes
3528 hostname lookups (G)
3530 Specifies whether samba should use (expensive) hostname lookups or
3532 use the ip addresses instead. An example place where hostname
3533 lookups are currently used is when checking the hosts deny and
3534 hosts allow.
3535 Default: hostname lookups = no
3537 Example: hostname lookups = yes
3539 allow hosts
3541 This parameter is a synonym for hosts allow.
3543 hosts allow (S)
3545 A synonym for this parameter is allow hosts.
3547 This parameter is a comma, space, or tab delimited set of hosts
3549 which are permitted to access a service.
3550 If specified in the [global] section then it will apply to all
3552 services, regardless of whether the individual service has a
3553 different setting.
3554 You can specify the hosts by name or IP number. For example, you
3556 could restrict access to only the hosts on a Class C subnet with
3557 something like allow hosts = 150.203.5.. The full syntax of the
3558 list is described in the man page hosts_access(5). Note that this
3559 man page may not be present on your system, so a brief description
3560 will be given here also.
3561 Note that the localhost address 127.0.0.1 will always be allowed
3563 access unless specifically denied by a hosts deny option.
3564 You can also specify hosts by network/netmask pairs and by netgroup
3566 names if your system supports netgroups. The EXCEPT keyword can
3567 also be used to limit a wildcard list. The following examples may
3568 provide some help:
3569 Example 1: allow all IPs in 150.203.*.*; except one
3571 hosts allow = 150.203. EXCEPT 150.203.6.66
3573 Example 2: allow hosts that match the given network/netmask
3575 hosts allow = 150.203.15.0/255.255.255.0
3577 Example 3: allow a couple of hosts
3579 hosts allow = lapland, arvidsjaur
3581 Example 4: allow only hosts in NIS netgroup "foonet", but deny
3583 access from one particular host
3584 hosts allow = @foonet
3586 hosts deny = pirate
3588 Note
3590 Note that access still requires suitable user-level passwords.
3591 See testparm(1) for a way of testing your host access to see if it
3592 does what you expect.
3593 Default: hosts allow = # none (i.e., all hosts permitted access)
3595 Example: hosts allow = 150.203.5. myhost.mynet.edu.au
3597 deny hosts
3599 This parameter is a synonym for hosts deny.
3601 hosts deny (S)
3603 The opposite of hosts allow - hosts listed here are NOT permitted
3605 access to services unless the specific services have their own
3606 lists to override this one. Where the lists conflict, the allow
3607 list takes precedence.
3608 In the event that it is necessary to deny all by default, use the
3610 keyword ALL (or the netmask 0.0.0.0/0) and then explicitly specify
3611 to the hosts allow = hosts allow parameter those hosts that should
3612 be permitted access.
3613 Default: hosts deny = # none (i.e., no hosts specifically
3615 excluded)
3616 Example: hosts deny = 150.203.4. badhost.mynet.edu.au
3618 idmap backend (G)
3620 The idmap backend provides a plugin interface for Winbind to use
3622 varying backends to store SID/uid/gid mapping tables.
3623 This option specifies the default backend that is used when no
3625 special configuration set, but it is now deprecated in favour of
3626 the new spelling idmap config * : backend.
3627 Default: idmap backend = tdb
3629 idmap cache time (G)
3631 This parameter specifies the number of seconds that Winbind's idmap
3633 interface will cache positive SID/uid/gid query results. By
3634 default, Samba will cache these results for one week.
3635 Default: idmap cache time = 604800
3637 idmap config DOMAIN : OPTION (G)
3639 ID mapping in Samba is the mapping between Windows SIDs and Unix
3641 user and group IDs. This is performed by Winbindd with a
3642 configurable plugin interface. Samba's ID mapping is configured by
3643 options starting with the idmap config prefix. An idmap option
3644 consists of the idmap config prefix, followed by a domain name or
3645 the asterisk character (*), a colon, and the name of an idmap
3646 setting for the chosen domain.
3647 The idmap configuration is hence divided into groups, one group for
3649 each domain to be configured, and one group with the asterisk
3650 instead of a proper domain name, which specifies the default
3651 configuration that is used to catch all domains that do not have an
3652 explicit idmap configuration of their own.
3653 There are three general options available:
3655 backend = backend_name
3657 This specifies the name of the idmap plugin to use as the
3658 SID/uid/gid backend for this domain. The standard backends are
3659 tdb (idmap_tdb(8)), tdb2 (idmap_tdb2(8)), ldap (idmap_ldap(8)),
3660 rid (idmap_rid(8)), hash (idmap_hash(8)), autorid
3661 (idmap_autorid(8)), ad (idmap_ad(8)) and nss (idmap_nss(8)).
3662 The corresponding manual pages contain the details, but here is
3663 a summary.
3664 The first three of these create mappings of their own using
3666 internal unixid counters and store the mappings in a database.
3667 These are suitable for use in the default idmap configuration.
3668 The rid and hash backends use a pure algorithmic calculation to
3669 determine the unixid for a SID. The autorid module is a mixture
3670 of the tdb and rid backend. It creates ranges for each domain
3671 encountered and then uses the rid algorithm for each of these
3672 automatically configured domains individually. The ad backend
3673 uses unix ids stored in Active Directory via the standard
3674 schema extensions. The nss backend reverses the standard
3675 winbindd setup and gets the unix ids via names from nsswitch
3676 which can be useful in an ldap setup.
3677 range = low - high
3679 Defines the available matching uid and gid range for which the
3680 backend is authoritative. For allocating backends, this also
3681 defines the start and the end of the range for allocating new
3682 unique IDs.
3683 winbind uses this parameter to find the backend that is
3685 authoritative for a unix ID to SID mapping, so it must be set
3686 for each individually configured domain and for the default
3687 configuration. The configured ranges must be mutually disjoint.
3688 read only = yes|no
3690 This option can be used to turn the writing backends tdb, tdb2,
3691 and ldap into read only mode. This can be useful e.g. in cases
3692 where a pre-filled database exists that should not be extended
3693 automatically.
3694 The following example illustrates how to configure the idmap_ad(8)
3696 backend for the CORP domain and the idmap_tdb(8) backend for all
3697 other domains. This configuration assumes that the admin of CORP
3698 assigns unix ids below 1000000 via the SFU extensions, and winbind
3699 is supposed to use the next million entries for its own mappings
3700 from trusted domains and for local groups for example.
3701 idmap config * : backend = tdb
3703 idmap config * : range = 1000000-1999999
3704 idmap config CORP : backend = ad
3706 idmap config CORP : range = 1000-999999
3707 No default
3710 winbind gid
3712 This parameter is a synonym for idmap gid.
3714 idmap gid (G)
3716 The idmap gid parameter specifies the range of group ids for the
3718 default idmap configuration. It is now deprecated in favour of
3719 idmap config * : range.
3720 See the idmap config option.
3722 Default: idmap gid =
3724 Example: idmap gid = 10000-20000
3726 idmap negative cache time (G)
3728 This parameter specifies the number of seconds that Winbind's idmap
3730 interface will cache negative SID/uid/gid query results.
3731 Default: idmap negative cache time = 120
3733 winbind uid
3735 This parameter is a synonym for idmap uid.
3737 idmap uid (G)
3739 The idmap uid parameter specifies the range of user ids for the
3741 default idmap configuration. It is now deprecated in favour of
3742 idmap config * : range.
3743 See the idmap config option.
3745 Default: idmap uid =
3747 Example: idmap uid = 10000-20000
3749 include (S)
3751 This allows you to include one config file inside another. The file
3753 is included literally, as though typed in place.
3754 It takes the standard substitutions, except %u, %P and %S.
3756 The parameter include = registry has a special meaning: It does not
3758 include a file named registry from the current working directory,
3759 but instead reads the global configuration options from the
3760 registry. See the section on registry-based configuration for
3761 details. Note that this option automatically activates registry
3762 shares.
3763 Default: include =
3765 Example: include = /usr/local/samba/lib/admin_smb.conf
3767 include system krb5 conf (G)
3769 Setting this parameter to no will prevent winbind to include the
3771 system /etc/krb5.conf file into the krb5.conf file it creates. See
3772 also create krb5 conf. This option only applies to Samba built with
3773 MIT Kerberos.
3774 Default: include system krb5 conf = yes
3776 inherit acls (S)
3778 This parameter can be used to ensure that if default acls exist on
3780 parent directories, they are always honored when creating a new
3781 file or subdirectory in these parent directories. The default
3782 behavior is to use the unix mode specified when creating the
3783 directory. Enabling this option sets the unix mode to 0777, thus
3784 guaranteeing that default directory acls are propagated. Note that
3785 using the VFS modules acl_xattr or acl_tdb which store native
3786 Windows as meta-data will automatically turn this option on for any
3787 share for which they are loaded, as they require this option to
3788 emulate Windows ACLs correctly.
3789 Default: inherit acls = no
3791 inherit owner (S)
3793 The ownership of new files and directories is normally governed by
3795 effective uid of the connected user. This option allows the Samba
3796 administrator to specify that the ownership for new files and
3797 directories should be controlled by the ownership of the parent
3798 directory.
3799 Valid options are:
3801 · no - Both the Windows (SID) owner and the UNIX (uid)
3803 owner of the file are governed by the identity of the
3804 user that created the file.
3805 · windows and unix - The Windows (SID) owner and the UNIX
3807 (uid) owner of new files and directories are set to the
3808 respective owner of the parent directory.
3809 · yes - a synonym for windows and unix.
3811 · unix only - Only the UNIX owner is set to the UNIX owner
3813 of the parent directory.
3814 Common scenarios where this behavior is useful is in implementing
3816 drop-boxes, where users can create and edit files but not delete
3817 them and ensuring that newly created files in a user's roaming
3818 profile directory are actually owned by the user.
3819 The unix only option effectively breaks the tie between the Windows
3821 owner of a file and the UNIX owner. As a logical consequence, in
3822 this mode, setting the the Windows owner of a file does not modify
3823 the UNIX owner. Using this mode should typically be combined with a
3824 backing store that can emulate the full NT ACL model without
3825 affecting the POSIX permissions, such as the acl_xattr VFS module,
3826 coupled with acl_xattr:ignore system acls = yes. This can be used
3827 to emulate folder quotas, when files are exposed only via SMB
3828 (without UNIX extensions). The UNIX owner of a directory is locally
3829 set and inherited by all subdirectories and files, and they all
3830 consume the same quota.
3831 Default: inherit owner = no
3833 inherit permissions (S)
3835 The permissions on new files and directories are normally governed
3837 by create mask, directory mask, force create mode and force
3838 directory mode but the boolean inherit permissions parameter
3839 overrides this.
3840 New directories inherit the mode of the parent directory, including
3842 bits such as setgid.
3843 New files inherit their read/write bits from the parent directory.
3845 Their execute bits continue to be determined by map archive, map
3846 hidden and map system as usual.
3847 Note that the setuid bit is never set via inheritance (the code
3849 explicitly prohibits this).
3850 This can be particularly useful on large systems with many users,
3852 perhaps several thousand, to allow a single [homes] share to be
3853 used flexibly by each user.
3854 Default: inherit permissions = no
3856 init logon delay (G)
3858 This parameter specifies a delay in milliseconds for the hosts
3860 configured for delayed initial samlogon with init logon delayed
3861 hosts.
3862 Default: init logon delay = 100
3864 init logon delayed hosts (G)
3866 This parameter takes a list of host names, addresses or networks
3868 for which the initial samlogon reply should be delayed (so other
3869 DCs get preferred by XP workstations if there are any).
3870 The length of the delay can be specified with the init logon delay
3872 parameter.
3873 Default: init logon delayed hosts =
3875 Example: init logon delayed hosts = 150.203.5. myhost.mynet.de
3877 interfaces (G)
3879 This option allows you to override the default network interfaces
3881 list that Samba will use for browsing, name registration and other
3882 NetBIOS over TCP/IP (NBT) traffic. By default Samba will query the
3883 kernel for the list of all active interfaces and use any interfaces
3884 except 127.0.0.1 that are broadcast capable.
3885 The option takes a list of interface strings. Each string can be in
3887 any of the following forms:
3888 · a network interface name (such as eth0). This may
3890 include shell-like wildcards so eth* will match any
3891 interface starting with the substring "eth"
3892 · an IP address. In this case the netmask is determined
3894 from the list of interfaces obtained from the kernel
3895 · an IP/mask pair.
3897 · a broadcast/mask pair.
3899 The "mask" parameters can either be a bit length (such as 24 for a
3901 C class network) or a full netmask in dotted decimal form.
3902 The "IP" parameters above can either be a full dotted decimal IP
3904 address or a hostname which will be looked up via the OS's normal
3905 hostname resolution mechanisms.
3906 By default Samba enables all active interfaces that are broadcast
3908 capable except the loopback adaptor (IP address 127.0.0.1).
3909 In order to support SMB3 multi-channel configurations, smbd
3911 understands some extra data that can be appended after the actual
3912 interface with this extended syntax:
3913 interface[;key1=value1[,key2=value2[...]]]
3915 Known keys are speed, capability, and if_index. Speed is specified
3917 in bits per second. Known capabilities are RSS and RDMA. The
3918 if_index should be used with care: the values must not coincide
3919 with indexes used by the kernel. Note that these options are mainly
3920 intended for testing and development rather than for production
3921 use. At least on Linux systems, these values should be
3922 auto-detected, but the settings can serve as last a resort when
3923 autodetection is not working or is not available.
3924 The example below configures three network interfaces corresponding
3926 to the eth0 device and IP addresses 192.168.2.10 and 192.168.3.10.
3927 The netmasks of the latter two interfaces would be set to
3928 255.255.255.0.
3929 Default: interfaces =
3931 Example: interfaces = eth0 192.168.2.10/24
3933 192.168.3.10/255.255.255.0
3934 invalid users (S)
3936 This is a list of users that should not be allowed to login to this
3938 service. This is really a paranoid check to absolutely ensure an
3939 improper setting does not breach your security.
3940 A name starting with a '@' is interpreted as an NIS netgroup first
3942 (if your system supports NIS), and then as a UNIX group if the name
3943 was not found in the NIS netgroup database.
3944 A name starting with '+' is interpreted only by looking in the UNIX
3946 group database via the NSS getgrnam() interface. A name starting
3947 with '&' is interpreted only by looking in the NIS netgroup
3948 database (this requires NIS to be working on your system). The
3949 characters '+' and '&' may be used at the start of the name in
3950 either order so the value +&group means check the UNIX group
3951 database, followed by the NIS netgroup database, and the value
3952 &+group means check the NIS netgroup database, followed by the UNIX
3953 group database (the same as the '@' prefix).
3954 The current servicename is substituted for %S. This is useful in
3956 the [homes] section.
3957 Default: invalid users = # no invalid users
3959 Example: invalid users = root fred admin @wheel
3961 iprint server (G)
3963 This parameter is only applicable if printing is set to iprint.
3965 If set, this option overrides the ServerName option in the CUPS
3967 client.conf. This is necessary if you have virtual samba servers
3968 that connect to different CUPS daemons.
3969 Default: iprint server = ""
3971 Example: iprint server = MYCUPSSERVER
3973 keepalive (G)
3975 The value of the parameter (an integer) represents the number of
3977 seconds between keepalive packets. If this parameter is zero, no
3978 keepalive packets will be sent. Keepalive packets, if sent, allow
3979 the server to tell whether a client is still present and
3980 responding.
3981 Keepalives should, in general, not be needed if the socket has the
3983 SO_KEEPALIVE attribute set on it by default. (see socket options).
3984 Basically you should only use this option if you strike
3985 difficulties.
3986 Please note this option only applies to SMB1 client connections,
3988 and has no effect on SMB2 clients.
3989 Default: keepalive = 300
3991 Example: keepalive = 600
3993 kerberos encryption types (G)
3995 This parameter determines the encryption types to use when
3997 operating as a Kerberos client. Possible values are all, strong,
3998 and legacy.
3999 Samba uses a Kerberos library (MIT or Heimdal) to obtain Kerberos
4001 tickets. This library is normally configured outside of Samba,
4002 using the krb5.conf file. This file may also include directives to
4003 configure the encryption types to be used. However, Samba
4004 implements Active Directory protocols and algorithms to locate a
4005 domain controller. In order to force the Kerberos library into
4006 using the correct domain controller, some Samba processes, such as
4007 winbindd(8) and net(8), build a private krb5.conf file for use by
4008 the Kerberos library while being invoked from Samba. This private
4009 file controls all aspects of the Kerberos library operation, and
4010 this parameter controls how the encryption types are configured
4011 within this generated file, and therefore also controls the
4012 encryption types negotiable by Samba.
4013 When set to all, all active directory encryption types are allowed.
4015 When set to strong, only AES-based encryption types are offered.
4017 This can be used in hardened environments to prevent downgrade
4018 attacks.
4019 When set to legacy, only RC4-HMAC-MD5 is allowed. Avoiding AES this
4021 way has one a very specific use. Normally, the encryption type is
4022 negotiated between the peers. However, there is one scenario in
4023 which a Windows read-only domain controller (RODC) advertises AES
4024 encryption, but then proxies the request to a writeable DC which
4025 may not support AES encryption, leading to failure of the
4026 handshake. Setting this parameter to legacy would cause samba not
4027 to negotiate AES encryption. It is assumed of course that the
4028 weaker legacy encryption types are acceptable for the setup.
4029 Default: kerberos encryption types = all
4031 kerberos method (G)
4033 Controls how kerberos tickets are verified.
4035 Valid options are:
4037 · secrets only - use only the secrets.tdb for ticket
4039 verification (default)
4040 · system keytab - use only the system keytab for ticket
4042 verification
4043 · dedicated keytab - use a dedicated keytab for ticket
4045 verification
4046 · secrets and keytab - use the secrets.tdb first, then the
4048 system keytab
4049 The major difference between "system keytab" and "dedicated keytab"
4051 is that the latter method relies on kerberos to find the correct
4052 keytab entry instead of filtering based on expected principals.
4053 When the kerberos method is in "dedicated keytab" mode, dedicated
4055 keytab file must be set to specify the location of the keytab file.
4056 Default: kerberos method = default
4058 kernel change notify (G)
4060 This parameter specifies whether Samba should ask the kernel for
4062 change notifications in directories so that SMB clients can refresh
4063 whenever the data on the server changes.
4064 This parameter is only used when your kernel supports change
4066 notification to user programs using the inotify interface.
4067 Default: kernel change notify = yes
4069 kernel oplocks (S)
4071 For UNIXes that support kernel based oplocks (currently only
4073 Linux), this parameter allows the use of them to be turned on or
4074 off. However, this disables Level II oplocks for clients as the
4075 Linux kernel does not support them properly.
4076 Kernel oplocks support allows Samba oplocks to be broken whenever a
4078 local UNIX process or NFS operation accesses a file that smbd(8)
4079 has oplocked. This allows complete data consistency between
4080 SMB/CIFS, NFS and local file access (and is a very cool feature
4081 :-).
4082 If you do not need this interaction, you should disable the
4084 parameter on Linux to get Level II oplocks and the associated
4085 performance benefit.
4086 This parameter defaults to no and is translated to a no-op on
4088 systems that do not have the necessary kernel support.
4089 Default: kernel oplocks = no
4091 kernel share modes (S)
4093 This parameter controls whether SMB share modes are translated into
4095 UNIX flocks.
4096 Kernel share modes provide a minimal level of interoperability with
4098 local UNIX processes and NFS operations by preventing access with
4099 flocks corresponding to the SMB share modes. Generally, it is very
4100 desirable to leave this enabled.
4101 Note that in order to use SMB2 durable file handles on a share, you
4103 have to turn kernel share modes off.
4104 This parameter defaults to yes and is translated to a no-op on
4106 systems that do not have the necessary kernel flock support.
4107 Default: kernel share modes = yes
4109 kpasswd port (G)
4111 Specifies which ports the Kerberos server should listen on for
4113 password changes.
4114 Default: kpasswd port = 464
4116 krb5 port (G)
4118 Specifies which port the KDC should listen on for Kerberos traffic.
4120 Default: krb5 port = 88
4122 lanman auth (G)
4124 This parameter has been deprecated since Samba 4.11 and support for
4126 LanMan (as distinct from NTLM, NTLMv2 or Kerberos authentication)
4127 will be removed in a future Samba release.
4128 That is, in the future, the current default of lanman auth = no
4130 will be the enforced behaviour.
4131 This parameter determines whether or not smbd(8) will attempt to
4133 authenticate users or permit password changes using the LANMAN
4134 password hash. If disabled, only clients which support NT password
4135 hashes (e.g. Windows NT/2000 clients, smbclient, but not Windows
4136 95/98 or the MS DOS network client) will be able to connect to the
4137 Samba host.
4138 The LANMAN encrypted response is easily broken, due to its
4140 case-insensitive nature, and the choice of algorithm. Servers
4141 without Windows 95/98/ME or MS DOS clients are advised to disable
4142 this option.
4143 When this parameter is set to no this will also result in
4145 sambaLMPassword in Samba's passdb being blanked after the next
4146 password change. As a result of that lanman clients won't be able
4147 to authenticate, even if lanman auth is re-enabled later on.
4148 Unlike the encrypt passwords option, this parameter cannot alter
4150 client behaviour, and the LANMAN response will still be sent over
4151 the network. See the client lanman auth to disable this for Samba's
4152 clients (such as smbclient)
4153 This parameter is overridden by ntlm auth, so unless that it is
4155 also set to ntlmv1-permitted or yes, then only NTLMv2 logins will
4156 be permitted and no LM hash will be stored. All modern clients
4157 support NTLMv2, and but some older clients require special
4158 configuration to use it.
4159 Default: lanman auth = no
4161 large readwrite (G)
4163 This parameter determines whether or not smbd(8) supports the new
4165 64k streaming read and write variant SMB requests introduced with
4166 Windows 2000. Note that due to Windows 2000 client redirector bugs
4167 this requires Samba to be running on a 64-bit capable operating
4168 system such as IRIX, Solaris or a Linux 2.4 kernel. Can improve
4169 performance by 10% with Windows 2000 clients. Defaults to on. Not
4170 as tested as some other Samba code paths.
4171 Default: large readwrite = yes
4173 ldap admin dn (G)
4175 The ldap admin dn defines the Distinguished Name (DN) name used by
4177 Samba to contact the ldap server when retrieving user account
4178 information. The ldap admin dn is used in conjunction with the
4179 admin dn password stored in the private/secrets.tdb file. See the
4180 smbpasswd(8) man page for more information on how to accomplish
4181 this.
4182 The ldap admin dn requires a fully specified DN. The ldap suffix is
4184 not appended to the ldap admin dn.
4185 No default
4187 ldap connection timeout (G)
4189 This parameter tells the LDAP library calls which timeout in
4191 seconds they should honor during initial connection establishments
4192 to LDAP servers. It is very useful in failover scenarios in
4193 particular. If one or more LDAP servers are not reachable at all,
4194 we do not have to wait until TCP timeouts are over. This feature
4195 must be supported by your LDAP library.
4196 This parameter is different from ldap timeout which affects
4198 operations on LDAP servers using an existing connection and not
4199 establishing an initial connection.
4200 Default: ldap connection timeout = 2
4202 ldap debug level (G)
4204 This parameter controls the debug level of the LDAP library calls.
4206 In the case of OpenLDAP, it is the same bit-field as understood by
4207 the server and documented in the slapd.conf(5) manpage. A typical
4208 useful value will be 1 for tracing function calls.
4209 The debug output from the LDAP libraries appears with the prefix
4211 [LDAP] in Samba's logging output. The level at which LDAP logging
4212 is printed is controlled by the parameter ldap debug threshold.
4213 Default: ldap debug level = 0
4215 Example: ldap debug level = 1
4217 ldap debug threshold (G)
4219 This parameter controls the Samba debug level at which the ldap
4221 library debug output is printed in the Samba logs. See the
4222 description of ldap debug level for details.
4223 Default: ldap debug threshold = 10
4225 Example: ldap debug threshold = 5
4227 ldap delete dn (G)
4229 This parameter specifies whether a delete operation in the ldapsam
4231 deletes the complete entry or only the attributes specific to
4232 Samba.
4233 Default: ldap delete dn = no
4235 ldap deref (G)
4237 This option controls whether Samba should tell the LDAP library to
4239 use a certain alias dereferencing method. The default is auto,
4240 which means that the default setting of the ldap client library
4241 will be kept. Other possible values are never, finding, searching
4242 and always. Grab your LDAP manual for more information.
4243 Default: ldap deref = auto
4245 Example: ldap deref = searching
4247 ldap follow referral (G)
4249 This option controls whether to follow LDAP referrals or not when
4251 searching for entries in the LDAP database. Possible values are on
4252 to enable following referrals, off to disable this, and auto, to
4253 use the libldap default settings. libldap's choice of following
4254 referrals or not is set in /etc/openldap/ldap.conf with the
4255 REFERRALS parameter as documented in ldap.conf(5).
4256 Default: ldap follow referral = auto
4258 Example: ldap follow referral = off
4260 ldap group suffix (G)
4262 This parameter specifies the suffix that is used for groups when
4264 these are added to the LDAP directory. If this parameter is unset,
4265 the value of ldap suffix will be used instead. The suffix string is
4266 pre-pended to the ldap suffix string so use a partial DN.
4267 Default: ldap group suffix =
4269 Example: ldap group suffix = ou=Groups
4271 ldap idmap suffix (G)
4273 This parameters specifies the suffix that is used when storing
4275 idmap mappings. If this parameter is unset, the value of ldap
4276 suffix will be used instead. The suffix string is pre-pended to the
4277 ldap suffix string so use a partial DN.
4278 Default: ldap idmap suffix =
4280 Example: ldap idmap suffix = ou=Idmap
4282 ldap machine suffix (G)
4284 It specifies where machines should be added to the ldap tree. If
4286 this parameter is unset, the value of ldap suffix will be used
4287 instead. The suffix string is pre-pended to the ldap suffix string
4288 so use a partial DN.
4289 Default: ldap machine suffix =
4291 Example: ldap machine suffix = ou=Computers
4293 ldap max anonymous request size (G)
4295 This parameter specifies the maximum permitted size (in bytes) for
4297 an LDAP request received on an anonymous connection.
4298 If the request size exceeds this limit the request will be
4300 rejected.
4301 Default: ldap max anonymous request size = 256000
4303 Example: ldap max anonymous request size = 500000
4305 ldap max authenticated request size (G)
4307 This parameter specifies the maximum permitted size (in bytes) for
4309 an LDAP request received on an authenticated connection.
4310 If the request size exceeds this limit the request will be
4312 rejected.
4313 Default: ldap max authenticated request size = 16777216
4315 Example: ldap max authenticated request size = 4194304
4317 ldap max search request size (G)
4319 This parameter specifies the maximum permitted size (in bytes) for
4321 an LDAP search request.
4322 If the request size exceeds this limit the request will be
4324 rejected.
4325 Default: ldap max search request size = 256000
4327 Example: ldap max search request size = 4194304
4329 ldap page size (G)
4331 This parameter specifies the number of entries per page.
4333 If the LDAP server supports paged results, clients can request
4335 subsets of search results (pages) instead of the entire list. This
4336 parameter specifies the size of these pages.
4337 Default: ldap page size = 1000
4339 Example: ldap page size = 512
4341 ldap password sync
4343 This parameter is a synonym for ldap passwd sync.
4345 ldap passwd sync (G)
4347 This option is used to define whether or not Samba should sync the
4349 LDAP password with the NT and LM hashes for normal accounts (NOT
4350 for workstation, server or domain trusts) on a password change via
4351 SAMBA.
4352 The ldap passwd sync can be set to one of three values:
4354 · Yes = Try to update the LDAP, NT and LM passwords and
4356 update the pwdLastSet time.
4357 · No = Update NT and LM passwords and update the
4359 pwdLastSet time.
4360 · Only = Only update the LDAP password and let the LDAP
4362 server do the rest.
4363 Default: ldap passwd sync = no
4365 ldap replication sleep (G)
4367 When Samba is asked to write to a read-only LDAP replica, we are
4369 redirected to talk to the read-write master server. This server
4370 then replicates our changes back to the 'local' server, however the
4371 replication might take some seconds, especially over slow links.
4372 Certain client activities, particularly domain joins, can become
4373 confused by the 'success' that does not immediately change the LDAP
4374 back-end's data.
4375 This option simply causes Samba to wait a short time, to allow the
4377 LDAP server to catch up. If you have a particularly high-latency
4378 network, you may wish to time the LDAP replication with a network
4379 sniffer, and increase this value accordingly. Be aware that no
4380 checking is performed that the data has actually replicated.
4381 The value is specified in milliseconds, the maximum value is 5000
4383 (5 seconds).
4384 Default: ldap replication sleep = 1000
4386 ldapsam:editposix (G)
4388 Editposix is an option that leverages ldapsam:trusted to make it
4390 simpler to manage a domain controller eliminating the need to set
4391 up custom scripts to add and manage the posix users and groups.
4392 This option will instead directly manipulate the ldap tree to
4393 create, remove and modify user and group entries. This option also
4394 requires a running winbindd as it is used to allocate new uids/gids
4395 on user/group creation. The allocation range must be therefore
4396 configured.
4397 To use this option, a basic ldap tree must be provided and the ldap
4399 suffix parameters must be properly configured. On virgin servers
4400 the default users and groups (Administrator, Guest, Domain Users,
4401 Domain Admins, Domain Guests) can be precreated with the command
4402 net sam provision. To run this command the ldap server must be
4403 running, Winbindd must be running and the smb.conf ldap options
4404 must be properly configured. The typical ldap setup used with the
4405 ldapsam:trusted = yes option is usually sufficient to use
4406 ldapsam:editposix = yes as well.
4407 An example configuration can be the following:
4409 encrypt passwords = true
4411 passdb backend = ldapsam
4412 ldapsam:trusted=yes
4414 ldapsam:editposix=yes
4415 ldap admin dn = cn=admin,dc=samba,dc=org
4417 ldap delete dn = yes
4418 ldap group suffix = ou=groups
4419 ldap idmap suffix = ou=idmap
4420 ldap machine suffix = ou=computers
4421 ldap user suffix = ou=users
4422 ldap suffix = dc=samba,dc=org
4423 idmap backend = ldap:"ldap://localhost"
4425 idmap uid = 5000-50000
4427 idmap gid = 5000-50000
4428 This configuration assumes a directory layout like described in the
4431 following ldif:
4432 dn: dc=samba,dc=org
4434 objectClass: top
4435 objectClass: dcObject
4436 objectClass: organization
4437 o: samba.org
4438 dc: samba
4439 dn: cn=admin,dc=samba,dc=org
4441 objectClass: simpleSecurityObject
4442 objectClass: organizationalRole
4443 cn: admin
4444 description: LDAP administrator
4445 userPassword: secret
4446 dn: ou=users,dc=samba,dc=org
4448 objectClass: top
4449 objectClass: organizationalUnit
4450 ou: users
4451 dn: ou=groups,dc=samba,dc=org
4453 objectClass: top
4454 objectClass: organizationalUnit
4455 ou: groups
4456 dn: ou=idmap,dc=samba,dc=org
4458 objectClass: top
4459 objectClass: organizationalUnit
4460 ou: idmap
4461 dn: ou=computers,dc=samba,dc=org
4463 objectClass: top
4464 objectClass: organizationalUnit
4465 ou: computers
4466 Default: ldapsam:editposix = no
4469 ldapsam:trusted (G)
4471 By default, Samba as a Domain Controller with an LDAP backend needs
4473 to use the Unix-style NSS subsystem to access user and group
4474 information. Due to the way Unix stores user information in
4475 /etc/passwd and /etc/group this inevitably leads to inefficiencies.
4476 One important question a user needs to know is the list of groups
4477 he is member of. The plain UNIX model involves a complete
4478 enumeration of the file /etc/group and its NSS counterparts in
4479 LDAP. UNIX has optimized functions to enumerate group membership.
4480 Sadly, other functions that are used to deal with user and group
4481 attributes lack such optimization.
4482 To make Samba scale well in large environments, the ldapsam:trusted
4484 = yes option assumes that the complete user and group database that
4485 is relevant to Samba is stored in LDAP with the standard
4486 posixAccount/posixGroup attributes. It further assumes that the
4487 Samba auxiliary object classes are stored together with the POSIX
4488 data in the same LDAP object. If these assumptions are met,
4489 ldapsam:trusted = yes can be activated and Samba can bypass the NSS
4490 system to query user group memberships. Optimized LDAP queries can
4491 greatly speed up domain logon and administration tasks. Depending
4492 on the size of the LDAP database a factor of 100 or more for common
4493 queries is easily achieved.
4494 Default: ldapsam:trusted = no
4496 ldap server require strong auth (G)
4498 The ldap server require strong auth defines whether the ldap server
4500 requires ldap traffic to be signed or signed and encrypted
4501 (sealed). Possible values are no, allow_sasl_over_tls and yes.
4502 A value of no allows simple and sasl binds over all transports.
4504 A value of allow_sasl_over_tls allows simple and sasl binds
4506 (without sign or seal) over TLS encrypted connections. Unencrypted
4507 connections only allow sasl binds with sign or seal.
4508 A value of yes allows only simple binds over TLS encrypted
4510 connections. Unencrypted connections only allow sasl binds with
4511 sign or seal.
4512 Default: ldap server require strong auth = yes
4514 ldap ssl (G)
4516 This option is used to define whether or not Samba should use SSL
4518 when connecting to the ldap server This is NOT related to Samba's
4519 previous SSL support which was enabled by specifying the --with-ssl
4520 option to the configure script.
4521 LDAP connections should be secured where possible. This may be done
4523 setting either this parameter to start tls or by specifying
4524 ldaps:// in the URL argument of passdb backend.
4525 The ldap ssl can be set to one of two values:
4527 · Off = Never use SSL when querying the directory.
4529 · start tls = Use the LDAPv3 StartTLS extended operation
4531 (RFC2830) for communicating with the directory server.
4532 Please note that this parameter does only affect rpc methods. To
4534 enable the LDAPv3 StartTLS extended operation (RFC2830) for ads,
4535 set ldap ssl = start tls and ldap ssl ads = yes. See smb.conf(5)
4536 for more information on ldap ssl ads.
4537 Default: ldap ssl = start tls
4539 ldap ssl ads (G)
4541 This option is used to define whether or not Samba should use SSL
4543 when connecting to the ldap server using ads methods. Rpc methods
4544 are not affected by this parameter. Please note, that this
4545 parameter won't have any effect if ldap ssl is set to no.
4546 See smb.conf(5) for more information on ldap ssl.
4548 Default: ldap ssl ads = no
4550 ldap suffix (G)
4552 Specifies the base for all ldap suffixes and for storing the
4554 sambaDomain object.
4555 The ldap suffix will be appended to the values specified for the
4557 ldap user suffix, ldap group suffix, ldap machine suffix, and the
4558 ldap idmap suffix. Each of these should be given only a DN relative
4559 to the ldap suffix.
4560 Default: ldap suffix =
4562 Example: ldap suffix = dc=samba,dc=org
4564 ldap timeout (G)
4566 This parameter defines the number of seconds that Samba should use
4568 as timeout for LDAP operations.
4569 Default: ldap timeout = 15
4571 ldap user suffix (G)
4573 This parameter specifies where users are added to the tree. If this
4575 parameter is unset, the value of ldap suffix will be used instead.
4576 The suffix string is pre-pended to the ldap suffix string so use a
4577 partial DN.
4578 Default: ldap user suffix =
4580 Example: ldap user suffix = ou=people
4582 level2 oplocks (S)
4584 This parameter controls whether Samba supports level2 (read-only)
4586 oplocks on a share.
4587 Level2, or read-only oplocks allow Windows NT clients that have an
4589 oplock on a file to downgrade from a read-write oplock to a
4590 read-only oplock once a second client opens the file (instead of
4591 releasing all oplocks on a second open, as in traditional,
4592 exclusive oplocks). This allows all openers of the file that
4593 support level2 oplocks to cache the file for read-ahead only (ie.
4594 they may not cache writes or lock requests) and increases
4595 performance for many accesses of files that are not commonly
4596 written (such as application .EXE files).
4597 Once one of the clients which have a read-only oplock writes to the
4599 file all clients are notified (no reply is needed or waited for)
4600 and told to break their oplocks to "none" and delete any read-ahead
4601 caches.
4602 It is recommended that this parameter be turned on to speed access
4604 to shared executables.
4605 For more discussions on level2 oplocks see the CIFS spec.
4607 Currently, if kernel oplocks are supported then level2 oplocks are
4609 not granted (even if this parameter is set to yes). Note also, the
4610 oplocks parameter must be set to yes on this share in order for
4611 this parameter to have any effect.
4612 Default: level2 oplocks = yes
4614 lm announce (G)
4616 This parameter determines if nmbd(8) will produce Lanman announce
4618 broadcasts that are needed by OS/2 clients in order for them to see
4619 the Samba server in their browse list. This parameter can have
4620 three values, yes, no, or auto. The default is auto. If set to no
4621 Samba will never produce these broadcasts. If set to yes Samba will
4622 produce Lanman announce broadcasts at a frequency set by the
4623 parameter lm interval. If set to auto Samba will not send Lanman
4624 announce broadcasts by default but will listen for them. If it
4625 hears such a broadcast on the wire it will then start sending them
4626 at a frequency set by the parameter lm interval.
4627 Default: lm announce = auto
4629 Example: lm announce = yes
4631 lm interval (G)
4633 If Samba is set to produce Lanman announce broadcasts needed by
4635 OS/2 clients (see the lm announce parameter) then this parameter
4636 defines the frequency in seconds with which they will be made. If
4637 this is set to zero then no Lanman announcements will be made
4638 despite the setting of the lm announce parameter.
4639 Default: lm interval = 60
4641 Example: lm interval = 120
4643 load printers (G)
4645 A boolean variable that controls whether all printers in the
4647 printcap will be loaded for browsing by default. See the printers
4648 section for more details.
4649 Default: load printers = yes
4651 local master (G)
4653 This option allows nmbd(8) to try and become a local master browser
4655 on a subnet. If set to no then nmbd will not attempt to become a
4656 local master browser on a subnet and will also lose in all browsing
4657 elections. By default this value is set to yes. Setting this value
4658 to yes doesn't mean that Samba will become the local master browser
4659 on a subnet, just that nmbd will participate in elections for local
4660 master browser.
4661 Setting this value to no will cause nmbd never to become a local
4663 master browser.
4664 Default: local master = yes
4666 lock dir
4668 This parameter is a synonym for lock directory.
4670 lock directory (G)
4672 This option specifies the directory where lock files will be
4674 placed. The lock files are used to implement the max connections
4675 option.
4676 Note: This option can not be set inside registry configurations.
4678 The files placed in this directory are not required across service
4680 restarts and can be safely placed on volatile storage (e.g. tmpfs
4681 in Linux)
4682 Default: lock directory = /var/lib/samba/lock
4684 Example: lock directory = /var/run/samba/locks
4686 locking (S)
4688 This controls whether or not locking will be performed by the
4690 server in response to lock requests from the client.
4691 If locking = no, all lock and unlock requests will appear to
4693 succeed and all lock queries will report that the file in question
4694 is available for locking.
4695 If locking = yes, real locking will be performed by the server.
4697 This option may be useful for read-only filesystems which may not
4699 need locking (such as CDROM drives), although setting this
4700 parameter of no is not really recommended even in this case.
4701 Be careful about disabling locking either globally or in a specific
4703 service, as lack of locking may result in data corruption. You
4704 should never need to set this parameter.
4705 Default: locking = yes
4707 lock spin time (G)
4709 The time in milliseconds that smbd should keep waiting to see if a
4711 failed lock request can be granted. This parameter has changed in
4712 default value from Samba 3.0.23 from 10 to 200. The associated lock
4713 spin count parameter is no longer used in Samba 3.0.24. You should
4714 not need to change the value of this parameter.
4715 Default: lock spin time = 200
4717 log file (G)
4719 This option allows you to override the name of the Samba log file
4721 (also known as the debug file).
4722 This option takes the standard substitutions, allowing you to have
4724 separate log files for each user or machine.
4725 No default
4727 Example: log file = /usr/local/samba/var/log.%m
4729 logging (G)
4731 This parameter configures logging backends. Multiple backends can
4733 be specified at the same time, with different log levels for each
4734 backend. The parameter is a list of backends, where each backend is
4735 specified as backend[:option][@loglevel].
4736 The 'option' parameter can be used to pass backend-specific
4738 options.
4739 The log level for a backend is optional, if it is not set for a
4741 backend, all messages are sent to this backend. The parameter log
4742 level determines overall log levels, while the log levels specified
4743 here define what is sent to the individual backends.
4744 When logging is set, it overrides the syslog and syslog only
4746 parameters.
4747 Some backends are only available when Samba has been compiled with
4749 the additional libraries. The overall list of logging backends:
4750 · syslog
4752 · file
4754 · systemd
4756 · lttng
4758 · gpfs
4760 · ringbuf
4762 The ringbuf backend supports an optional size argument to change
4764 the buffer size used, the default is 1 MB: ringbuf:size=NBYTES
4765 Default: logging =
4767 Example: logging = syslog@1 file
4769 debuglevel
4771 This parameter is a synonym for log level.
4773 log level (G)
4775 The value of the parameter (a string) allows the debug level
4777 (logging level) to be specified in the smb.conf file.
4778 This parameter has been extended since the 2.2.x series, now it
4780 allows one to specify the debug level for multiple debug classes
4781 and distinct logfiles for debug classes. This is to give greater
4782 flexibility in the configuration of the system. The following debug
4783 classes are currently implemented:
4784 · all
4786 · tdb
4788 · printdrivers
4790 · lanman
4792 · smb
4794 · smb2
4796 · smb2_credits
4798 · rpc_parse
4800 · rpc_srv
4802 · rpc_cli
4804 · passdb
4806 · sam
4808 · auth
4810 · winbind
4812 · vfs
4814 · idmap
4816 · quota
4818 · acls
4820 · locking
4822 · msdfs
4824 · dmapi
4826 · registry
4828 · scavenger
4830 · dns
4832 · ldb
4834 · tevent
4836 · auth_audit
4838 · auth_json_audit
4840 · kerberos
4842 · dsdb_audit
4844 · dsdb_json_audit
4846 · dsdb_password_audit
4848 · dsdb_password_json_audit
4850 · dsdb_transaction_audit
4852 · dsdb_transaction_json_audit
4854 To configure the logging for specific classes to go into a
4856 different file then log file, you can append @PATH to the class, eg
4857 log level = 1 full_audit:1@/var/log/audit.log.
4858 Authentication and authorization audit information is logged under
4860 the auth_audit, and if Samba was not compiled with --without-json,
4861 a JSON representation is logged under auth_json_audit.
4862 Support is comprehensive for all authentication and authorisation
4864 of user accounts in the Samba Active Directory Domain Controller,
4865 as well as the implicit authentication in password changes. In the
4866 file server, NTLM authentication, SMB and RPC authorization is
4867 covered.
4868 Log levels for auth_audit and auth_audit_json are:
4870 · 2: Authentication Failure
4872 · 3: Authentication Success
4874 · 4: Authorization Success
4876 · 5: Anonymous Authentication and Authorization Success
4878 Changes to the sam.ldb database are logged under the dsdb_audit and
4880 a JSON representation is logged under dsdb_json_audit.
4881 Password changes and Password resets are logged under
4883 dsdb_password_audit and a JSON representation is logged under the
4884 dsdb_password_json_audit.
4885 Transaction rollbacks and prepare commit failures are logged under
4887 the dsdb_transaction_audit and a JSON representation is logged
4888 under the password_json_audit. Logging the transaction details
4889 allows the identification of password and sam.ldb operations that
4890 have been rolled back.
4891 Default: log level = 0
4893 Example: log level = 3 passdb:5 auth:10 winbind:2
4895 Example: log level = 1 full_audit:1@/var/log/audit.log winbind:2
4897 log nt token command (G)
4899 This option can be set to a command that will be called when new nt
4901 tokens are created.
4902 This is only useful for development purposes.
4904 Default: log nt token command =
4906 logon drive (G)
4908 This parameter specifies the local path to which the home directory
4910 will be connected (see logon home) and is only used by NT
4911 Workstations.
4912 Note that this option is only useful if Samba is set up as a logon
4914 server.
4915 Default: logon drive =
4917 Example: logon drive = h:
4919 logon home (G)
4921 This parameter specifies the home directory location when a
4923 Win95/98 or NT Workstation logs into a Samba PDC. It allows you to
4924 do
4925 C:\>NET USE H: /HOME
4927 from a command prompt, for example.
4929 This option takes the standard substitutions, allowing you to have
4931 separate logon scripts for each user or machine.
4932 This parameter can be used with Win9X workstations to ensure that
4934 roaming profiles are stored in a subdirectory of the user's home
4935 directory. This is done in the following way:
4936 logon home = \\%N\%U\profile
4938 This tells Samba to return the above string, with substitutions
4940 made when a client requests the info, generally in a NetUserGetInfo
4941 request. Win9X clients truncate the info to \\server\share when a
4942 user does net use /home but use the whole string when dealing with
4943 profiles.
4944 Note that in prior versions of Samba, the logon path was returned
4946 rather than logon home. This broke net use /home but allowed
4947 profiles outside the home directory. The current implementation is
4948 correct, and can be used for profiles if you use the above trick.
4949 Disable this feature by setting logon home = "" - using the empty
4951 string.
4952 This option is only useful if Samba is set up as a logon server.
4954 Default: logon home = \\%N\%U
4956 Example: logon home = \\remote_smb_server\%U
4958 logon path (G)
4960 This parameter specifies the directory where roaming profiles
4962 (Desktop, NTuser.dat, etc) are stored. Contrary to previous
4963 versions of these manual pages, it has nothing to do with Win 9X
4964 roaming profiles. To find out how to handle roaming profiles for
4965 Win 9X system, see the logon home parameter.
4966 This option takes the standard substitutions, allowing you to have
4968 separate logon scripts for each user or machine. It also specifies
4969 the directory from which the "Application Data", desktop, start
4970 menu, network neighborhood, programs and other folders, and their
4971 contents, are loaded and displayed on your Windows NT client.
4972 The share and the path must be readable by the user for the
4974 preferences and directories to be loaded onto the Windows NT
4975 client. The share must be writeable when the user logs in for the
4976 first time, in order that the Windows NT client can create the
4977 NTuser.dat and other directories. Thereafter, the directories and
4978 any of the contents can, if required, be made read-only. It is not
4979 advisable that the NTuser.dat file be made read-only - rename it to
4980 NTuser.man to achieve the desired effect (a MANdatory profile).
4981 Windows clients can sometimes maintain a connection to the [homes]
4983 share, even though there is no user logged in. Therefore, it is
4984 vital that the logon path does not include a reference to the homes
4985 share (i.e. setting this parameter to \\%N\homes\profile_path will
4986 cause problems).
4987 This option takes the standard substitutions, allowing you to have
4989 separate logon scripts for each user or machine.
4990 Warning
4992 Do not quote the value. Setting this as “\\%N\profile\%U” will
4993 break profile handling. Where the tdbsam or ldapsam passdb
4994 backend is used, at the time the user account is created the
4995 value configured for this parameter is written to the passdb
4996 backend and that value will over-ride the parameter value
4997 present in the smb.conf file. Any error present in the passdb
4998 backend account record must be editted using the appropriate
4999 tool (pdbedit on the command-line, or any other locally
5000 provided system tool).
5001 Note that this option is only useful if Samba is set up as a domain
5002 controller.
5003 Disable the use of roaming profiles by setting the value of this
5005 parameter to the empty string. For example, logon path = "". Take
5006 note that even if the default setting in the smb.conf file is the
5007 empty string, any value specified in the user account settings in
5008 the passdb backend will over-ride the effect of setting this
5009 parameter to null. Disabling of all roaming profile use requires
5010 that the user account settings must also be blank.
5011 An example of use is:
5013 logon path = \\PROFILESERVER\PROFILE\%U
5015 Default: logon path = \\%N\%U\profile
5017 logon script (G)
5019 This parameter specifies the batch file (.bat) or NT command file
5021 (.cmd) to be downloaded and run on a machine when a user
5022 successfully logs in. The file must contain the DOS style CR/LF
5023 line endings. Using a DOS-style editor to create the file is
5024 recommended.
5025 The script must be a relative path to the [netlogon] service. If
5027 the [netlogon] service specifies a path of
5028 /usr/local/samba/netlogon, and logon script = STARTUP.BAT, then the
5029 file that will be downloaded is:
5030 /usr/local/samba/netlogon/STARTUP.BAT
5032 The contents of the batch file are entirely your choice. A
5034 suggested command would be to add NET TIME \\SERVER /SET /YES, to
5035 force every machine to synchronize clocks with the same time
5036 server. Another use would be to add NET USE U: \\SERVER\UTILS for
5037 commonly used utilities, or
5038 NET USE Q: \\SERVER\ISO9001_QA
5040 for example.
5042 Note that it is particularly important not to allow write access to
5044 the [netlogon] share, or to grant users write permission on the
5045 batch files in a secure environment, as this would allow the batch
5046 files to be arbitrarily modified and security to be breached.
5047 This option takes the standard substitutions, allowing you to have
5049 separate logon scripts for each user or machine.
5050 This option is only useful if Samba is set up as a logon server in
5052 a classic domain controller role. If Samba is set up as an Active
5053 Directory domain controller, LDAP attribute scriptPath is used
5054 instead. For configurations where passdb backend = ldapsam is in
5055 use, this option only defines a default value in case LDAP
5056 attribute sambaLogonScript is missing.
5057 Default: logon script =
5059 Example: logon script = scripts\%U.bat
5061 log writeable files on exit (G)
5063 When the network connection between a CIFS client and Samba dies,
5065 Samba has no option but to simply shut down the server side of the
5066 network connection. If this happens, there is a risk of data
5067 corruption because the Windows client did not complete all write
5068 operations that the Windows application requested. Setting this
5069 option to "yes" makes smbd log with a level 0 message a list of all
5070 files that have been opened for writing when the network connection
5071 died. Those are the files that are potentially corrupted. It is
5072 meant as an aid for the administrator to give him a list of files
5073 to do consistency checks on.
5074 Default: log writeable files on exit = no
5076 lppause command (S)
5078 This parameter specifies the command to be executed on the server
5080 host in order to stop printing or spooling a specific print job.
5081 This command should be a program or script which takes a printer
5083 name and job number to pause the print job. One way of implementing
5084 this is by using job priorities, where jobs having a too low
5085 priority won't be sent to the printer.
5086 If a %p is given then the printer name is put in its place. A %j is
5088 replaced with the job number (an integer). On HPUX (see
5089 printing=hpux ), if the -p%p option is added to the lpq command,
5090 the job will show up with the correct status, i.e. if the job
5091 priority is lower than the set fence priority it will have the
5092 PAUSED status, whereas if the priority is equal or higher it will
5093 have the SPOOLED or PRINTING status.
5094 Note that it is good practice to include the absolute path in the
5096 lppause command as the PATH may not be available to the server.
5097 Currently no default value is given to this string, unless the
5099 value of the printing parameter is SYSV, in which case the default
5100 is : lp -i %p-%j -H hold or if the value of the printing parameter
5101 is SOFTQ, then the default is: qstat -s -j%j -h.
5102 Default: lppause command = # determined by printing parameter
5104 Example: lppause command = /usr/bin/lpalt %p-%j -p0
5106 lpq cache time (G)
5108 This controls how long lpq info will be cached for to prevent the
5110 lpq command being called too often. A separate cache is kept for
5111 each variation of the lpq command used by the system, so if you use
5112 different lpq commands for different users then they won't share
5113 cache information.
5114 The cache files are stored in /tmp/lpq.xxxx where xxxx is a hash of
5116 the lpq command in use.
5117 The default is 30 seconds, meaning that the cached results of a
5119 previous identical lpq command will be used if the cached data is
5120 less than 30 seconds old. A large value may be advisable if your
5121 lpq command is very slow.
5122 A value of 0 will disable caching completely.
5124 Default: lpq cache time = 30
5126 Example: lpq cache time = 10
5128 lpq command (S)
5130 This parameter specifies the command to be executed on the server
5132 host in order to obtain lpq-style printer status information.
5133 This command should be a program or script which takes a printer
5135 name as its only parameter and outputs printer status information.
5136 Currently nine styles of printer status information are supported;
5138 BSD, AIX, LPRNG, PLP, SYSV, HPUX, QNX, CUPS, and SOFTQ. This covers
5139 most UNIX systems. You control which type is expected using the
5140 printing = option.
5141 Some clients (notably Windows for Workgroups) may not correctly
5143 send the connection number for the printer they are requesting
5144 status information about. To get around this, the server reports on
5145 the first printer service connected to by the client. This only
5146 happens if the connection number sent is invalid.
5147 If a %p is given then the printer name is put in its place.
5149 Otherwise it is placed at the end of the command.
5150 Note that it is good practice to include the absolute path in the
5152 lpq command as the $PATH may not be available to the server. When
5153 compiled with the CUPS libraries, no lpq command is needed because
5154 smbd will make a library call to obtain the print queue listing.
5155 Default: lpq command = # determined by printing parameter
5157 Example: lpq command = /usr/bin/lpq -P%p
5159 lpresume command (S)
5161 This parameter specifies the command to be executed on the server
5163 host in order to restart or continue printing or spooling a
5164 specific print job.
5165 This command should be a program or script which takes a printer
5167 name and job number to resume the print job. See also the lppause
5168 command parameter.
5169 If a %p is given then the printer name is put in its place. A %j is
5171 replaced with the job number (an integer).
5172 Note that it is good practice to include the absolute path in the
5174 lpresume command as the PATH may not be available to the server.
5175 See also the printing parameter.
5177 Default: Currently no default value is given to this string, unless
5179 the value of the printing parameter is SYSV, in which case the
5180 default is:
5181 lp -i %p-%j -H resume
5183 or if the value of the printing parameter is SOFTQ, then the
5185 default is:
5186 qstat -s -j%j -r
5188 Default: lpresume command = # determined by printing parameter
5190 Example: lpresume command = /usr/bin/lpalt %p-%j -p2
5192 lprm command (S)
5194 This parameter specifies the command to be executed on the server
5196 host in order to delete a print job.
5197 This command should be a program or script which takes a printer
5199 name and job number, and deletes the print job.
5200 If a %p is given then the printer name is put in its place. A %j is
5202 replaced with the job number (an integer).
5203 Note that it is good practice to include the absolute path in the
5205 lprm command as the PATH may not be available to the server.
5206 Examples of use are:
5208 lprm command = /usr/bin/lprm -P%p %j
5210 or
5212 lprm command = /usr/bin/cancel %p-%j
5214 Default: lprm command = # determined by printing parameter
5216 lsa over netlogon (G)
5218 Setting this deprecated option will allow the RPC server in the AD
5220 DC to answer the LSARPC interface on the \pipe\netlogon IPC pipe.
5221 When enabled, this matches the behaviour of Microsoft's Windows,
5223 due to their internal implementation choices.
5224 If it is disabled (the default), the AD DC can offer improved
5226 performance, as the netlogon server is decoupled and can run as
5227 multiple processes.
5228 Default: lsa over netlogon = no
5230 machine password timeout (G)
5232 If a Samba server is a member of a Windows NT or Active Directory
5234 Domain (see the security = domain and security = ads parameters),
5235 then periodically a running winbindd process will try and change
5236 the MACHINE ACCOUNT PASSWORD stored in the TDB called secrets.tdb.
5237 This parameter specifies how often this password will be changed,
5238 in seconds. The default is one week (expressed in seconds), the
5239 same as a Windows NT Domain member server.
5240 See also smbpasswd(8), and the security = domain and security = ads
5242 parameters.
5243 Default: machine password timeout = 604800
5245 magic output (S)
5247 This parameter specifies the name of a file which will contain
5249 output created by a magic script (see the magic script parameter
5250 below).
5251 Warning
5253 If two clients use the same magic script in the same directory
5254 the output file content is undefined.
5255 Default: magic output = # <magic script name>.out
5256 Example: magic output = myfile.txt
5258 magic script (S)
5260 This parameter specifies the name of a file which, if opened, will
5262 be executed by the server when the file is closed. This allows a
5263 UNIX script to be sent to the Samba host and executed on behalf of
5264 the connected user.
5265 Scripts executed in this way will be deleted upon completion
5267 assuming that the user has the appropriate level of privilege and
5268 the file permissions allow the deletion.
5269 If the script generates output, output will be sent to the file
5271 specified by the magic output parameter (see above).
5272 Note that some shells are unable to interpret scripts containing
5274 CR/LF instead of CR as the end-of-line marker. Magic scripts must
5275 be executable as is on the host, which for some hosts and some
5276 shells will require filtering at the DOS end.
5277 Magic scripts are EXPERIMENTAL and should NOT be relied upon.
5279 Default: magic script =
5281 Example: magic script = user.csh
5283 mangled names (S)
5285 This controls whether non-DOS names under UNIX should be mapped to
5287 DOS-compatible names ("mangled") and made visible, or whether
5288 non-DOS names should simply be ignored.
5289 See the section on name mangling for details on how to control the
5291 mangling process.
5292 Possible option settings are
5294 · yes - enables name mangling for all not DOS 8.3
5296 conforming names.
5297 · no - disables any name mangling.
5299 · illegal (default) - does mangling for names with illegal
5301 NTFS characters. This is the most sensible setting for
5302 modern clients that don't use the shortname anymore.
5303 If mangling is used then the mangling method is as follows:
5305 · The first (up to) five alphanumeric characters before
5307 the rightmost dot of the filename are preserved, forced
5308 to upper case, and appear as the first (up to) five
5309 characters of the mangled name.
5310 · A tilde "~" is appended to the first part of the mangled
5312 name, followed by a two-character unique sequence, based
5313 on the original root name (i.e., the original filename
5314 minus its final extension). The final extension is
5315 included in the hash calculation only if it contains any
5316 upper case characters or is longer than three
5317 characters.
5318 Note that the character to use may be specified using
5320 the mangling char option, if you don't like '~'.
5321 · Files whose UNIX name begins with a dot will be
5323 presented as DOS hidden files. The mangled name will be
5324 created as for other filenames, but with the leading dot
5325 removed and "___" as its extension regardless of actual
5326 original extension (that's three underscores).
5327 The two-digit hash value consists of upper case alphanumeric
5329 characters.
5330 This algorithm can cause name collisions only if files in a
5332 directory share the same first five alphanumeric characters. The
5333 probability of such a clash is 1/1300.
5334 The name mangling (if enabled) allows a file to be copied between
5336 UNIX directories from Windows/DOS while retaining the long UNIX
5337 filename. UNIX files can be renamed to a new extension from
5338 Windows/DOS and will retain the same basename. Mangled names do not
5339 change between sessions.
5340 Default: mangled names = illegal
5342 Example: mangled names = no
5344 mangle prefix (G)
5346 controls the number of prefix characters from the original name
5348 used when generating the mangled names. A larger value will give a
5349 weaker hash and therefore more name collisions. The minimum value
5350 is 1 and the maximum value is 6.
5351 mangle prefix is effective only when mangling method is hash2.
5353 Default: mangle prefix = 1
5355 Example: mangle prefix = 4
5357 mangling char (S)
5359 This controls what character is used as the magic character in name
5361 mangling. The default is a '~' but this may interfere with some
5362 software. Use this option to set it to whatever you prefer. This is
5363 effective only when mangling method is hash.
5364 Default: mangling char = ~
5366 Example: mangling char = ^
5368 mangling method (G)
5370 controls the algorithm used for the generating the mangled names.
5372 Can take two different values, "hash" and "hash2". "hash" is the
5373 algorithm that was used in Samba for many years and was the default
5374 in Samba 2.2.x "hash2" is now the default and is newer and
5375 considered a better algorithm (generates less collisions) in the
5376 names. Many Win32 applications store the mangled names and so
5377 changing to algorithms must not be done lightly as these
5378 applications may break unless reinstalled.
5379 Default: mangling method = hash2
5381 Example: mangling method = hash
5383 map acl inherit (S)
5385 This boolean parameter controls whether smbd(8) will attempt to map
5387 the 'inherit' and 'protected' access control entry flags stored in
5388 Windows ACLs into an extended attribute called user.SAMBA_PAI. This
5389 parameter only takes effect if Samba is being run on a platform
5390 that supports extended attributes (Linux and IRIX so far) and
5391 allows the Windows 2000 ACL editor to correctly use inheritance
5392 with the Samba POSIX ACL mapping code.
5393 Default: map acl inherit = no
5395 map archive (S)
5397 This controls whether the DOS archive attribute should be mapped to
5399 the UNIX owner execute bit. The DOS archive bit is set when a file
5400 has been modified since its last backup. One motivation for this
5401 option is to keep Samba/your PC from making any file it touches
5402 from becoming executable under UNIX. This can be quite annoying for
5403 shared source code, documents, etc...
5404 Note that this parameter will be ignored if the store dos
5406 attributes parameter is set, as the DOS archive attribute will then
5407 be stored inside a UNIX extended attribute.
5408 Note that this requires the create mask parameter to be set such
5410 that owner execute bit is not masked out (i.e. it must include
5411 100). See the parameter create mask for details.
5412 Default: map archive = yes
5414 map hidden (S)
5416 This controls whether DOS style hidden files should be mapped to
5418 the UNIX world execute bit.
5419 Note that this parameter will be ignored if the store dos
5421 attributes parameter is set, as the DOS hidden attribute will then
5422 be stored inside a UNIX extended attribute.
5423 Note that this requires the create mask to be set such that the
5425 world execute bit is not masked out (i.e. it must include 001). See
5426 the parameter create mask for details.
5427 Default: map hidden = no
5429 map readonly (S)
5431 This controls how the DOS read only attribute should be mapped from
5433 a UNIX filesystem.
5434 This parameter can take three different values, which tell smbd(8)
5436 how to display the read only attribute on files, where either store
5437 dos attributes is set to No, or no extended attribute is present.
5438 If store dos attributes is set to yes then this parameter is
5439 ignored. This is a new parameter introduced in Samba version
5440 3.0.21.
5441 The three settings are :
5443 · Yes - The read only DOS attribute is mapped to the
5445 inverse of the user or owner write bit in the unix
5446 permission mode set. If the owner write bit is not set,
5447 the read only attribute is reported as being set on the
5448 file. If the read only DOS attribute is set, Samba sets
5449 the owner, group and others write bits to zero. Write
5450 bits set in an ACL are ignored by Samba. If the read
5451 only DOS attribute is unset, Samba simply sets the write
5452 bit of the owner to one.
5453 · Permissions - The read only DOS attribute is mapped to
5455 the effective permissions of the connecting user, as
5456 evaluated by smbd(8) by reading the unix permissions and
5457 POSIX ACL (if present). If the connecting user does not
5458 have permission to modify the file, the read only
5459 attribute is reported as being set on the file.
5460 · No - The read only DOS attribute is unaffected by
5462 permissions, and can only be set by the store dos
5463 attributes method. This may be useful for exporting
5464 mounted CDs.
5465 Note that this parameter will be ignored if the store dos
5467 attributes parameter is set, as the DOS 'read-only' attribute will
5468 then be stored inside a UNIX extended attribute.
5469 The default has changed to no in Samba release 4.9.0 and above to
5471 allow better Windows fileserver compatibility in a default install.
5472 In addition the default setting of store dos attributes has been
5473 changed to Yes in Samba release 4.9.0 and above.
5474 Default: map readonly = no
5476 map system (S)
5478 This controls whether DOS style system files should be mapped to
5480 the UNIX group execute bit.
5481 Note that this parameter will be ignored if the store dos
5483 attributes parameter is set, as the DOS system attribute will then
5484 be stored inside a UNIX extended attribute.
5485 Note that this requires the create mask to be set such that the
5487 group execute bit is not masked out (i.e. it must include 010). See
5488 the parameter create mask for details.
5489 Default: map system = no
5491 map to guest (G)
5493 This parameter can take four different values, which tell smbd(8)
5495 what to do with user login requests that don't match a valid UNIX
5496 user in some way.
5497 The four settings are :
5499 · Never - Means user login requests with an invalid
5501 password are rejected. This is the default.
5502 · Bad User - Means user logins with an invalid password
5504 are rejected, unless the username does not exist, in
5505 which case it is treated as a guest login and mapped
5506 into the guest account.
5507 · Bad Password - Means user logins with an invalid
5509 password are treated as a guest login and mapped into
5510 the guest account. Note that this can cause problems as
5511 it means that any user incorrectly typing their password
5512 will be silently logged on as "guest" - and will not
5513 know the reason they cannot access files they think they
5514 should - there will have been no message given to them
5515 that they got their password wrong. Helpdesk services
5516 will hate you if you set the map to guest parameter this
5517 way :-).
5518 · Bad Uid - Is only applicable when Samba is configured in
5520 some type of domain mode security (security =
5521 {domain|ads}) and means that user logins which are
5522 successfully authenticated but which have no valid Unix
5523 user account (and smbd is unable to create one) should
5524 be mapped to the defined guest account. This was the
5525 default behavior of Samba 2.x releases. Note that if a
5526 member server is running winbindd, this option should
5527 never be required because the nss_winbind library will
5528 export the Windows domain users and groups to the
5529 underlying OS via the Name Service Switch interface.
5530 Note that this parameter is needed to set up "Guest" share
5532 services. This is because in these modes the name of the resource
5533 being requested is not sent to the server until after the server
5534 has successfully authenticated the client so the server cannot make
5535 authentication decisions at the correct time (connection to the
5536 share) for "Guest" shares.
5537 Default: map to guest = Never
5539 Example: map to guest = Bad User
5541 max connections (S)
5543 This option allows the number of simultaneous connections to a
5545 service to be limited. If max connections is greater than 0 then
5546 connections will be refused if this number of connections to the
5547 service are already open. A value of zero mean an unlimited number
5548 of connections may be made.
5549 Record lock files are used to implement this feature. The lock
5551 files will be stored in the directory specified by the lock
5552 directory option.
5553 Default: max connections = 0
5555 Example: max connections = 10
5557 max disk size (G)
5559 This option allows you to put an upper limit on the apparent size
5561 of disks. If you set this option to 100 then all shares will appear
5562 to be not larger than 100 MB in size.
5563 Note that this option does not limit the amount of data you can put
5565 on the disk. In the above case you could still store much more than
5566 100 MB on the disk, but if a client ever asks for the amount of
5567 free disk space or the total disk size then the result will be
5568 bounded by the amount specified in max disk size.
5569 This option is primarily useful to work around bugs in some pieces
5571 of software that can't handle very large disks, particularly disks
5572 over 1GB in size.
5573 A max disk size of 0 means no limit.
5575 Default: max disk size = 0
5577 Example: max disk size = 1000
5579 max log size (G)
5581 This option (an integer in kilobytes) specifies the max size the
5583 log file should grow to. Samba periodically checks the size and if
5584 it is exceeded it will rename the file, adding a .old extension.
5585 A size of 0 means no limit.
5587 Default: max log size = 5000
5589 Example: max log size = 1000
5591 max mux (G)
5593 This option controls the maximum number of outstanding simultaneous
5595 SMB operations that Samba tells the client it will allow. You
5596 should never need to set this parameter.
5597 Default: max mux = 50
5599 max open files (G)
5601 This parameter limits the maximum number of open files that one
5603 smbd(8) file serving process may have open for a client at any one
5604 time. This parameter can be set very high (16384) as Samba uses
5605 only one bit per unopened file. Setting this parameter lower than
5606 16384 will cause Samba to complain and set this value back to the
5607 minimum of 16384, as Windows 7 depends on this number of open file
5608 handles being available.
5609 The limit of the number of open files is usually set by the UNIX
5611 per-process file descriptor limit rather than this parameter so you
5612 should never need to touch this parameter.
5613 Default: max open files = 16384
5615 max print jobs (S)
5617 This parameter limits the maximum number of jobs allowable in a
5619 Samba printer queue at any given moment. If this number is
5620 exceeded, smbd(8) will remote "Out of Space" to the client.
5621 Default: max print jobs = 1000
5623 Example: max print jobs = 5000
5625 max reported print jobs (S)
5627 This parameter limits the maximum number of jobs displayed in a
5629 port monitor for Samba printer queue at any given moment. If this
5630 number is exceeded, the excess jobs will not be shown. A value of
5631 zero means there is no limit on the number of print jobs reported.
5632 Default: max reported print jobs = 0
5634 Example: max reported print jobs = 1000
5636 max smbd processes (G)
5638 This parameter limits the maximum number of smbd(8) processes
5640 concurrently running on a system and is intended as a stopgap to
5641 prevent degrading service to clients in the event that the server
5642 has insufficient resources to handle more than this number of
5643 connections. Remember that under normal operating conditions, each
5644 user will have an smbd(8) associated with him or her to handle
5645 connections to all shares from a given host.
5646 For a Samba ADDC running the standard process model this option
5648 limits the number of processes forked to handle requests. Currently
5649 new processes are only forked for ldap and netlogon requests.
5650 Default: max smbd processes = 0
5652 Example: max smbd processes = 1000
5654 max stat cache size (G)
5656 This parameter limits the size in memory of any stat cache being
5658 used to speed up case insensitive name mappings. It represents the
5659 number of kilobyte (1024) units the stat cache can use. A value of
5660 zero, meaning unlimited, is not advisable due to increased memory
5661 usage. You should not need to change this parameter.
5662 Default: max stat cache size = 512
5664 Example: max stat cache size = 100
5666 max ttl (G)
5668 This option tells nmbd(8) what the default 'time to live' of
5670 NetBIOS names should be (in seconds) when nmbd is requesting a name
5671 using either a broadcast packet or from a WINS server. You should
5672 never need to change this parameter. The default is 3 days.
5673 Default: max ttl = 259200
5675 max wins ttl (G)
5677 This option tells smbd(8) when acting as a WINS server (wins
5679 support = yes) what the maximum 'time to live' of NetBIOS names
5680 that nmbd will grant will be (in seconds). You should never need to
5681 change this parameter. The default is 6 days (518400 seconds).
5682 Default: max wins ttl = 518400
5684 max xmit (G)
5686 This option controls the maximum packet size that will be
5688 negotiated by Samba's smbd(8) for the SMB1 protocol. The default is
5689 16644, which matches the behavior of Windows 2000. A value below
5690 2048 is likely to cause problems. You should never need to change
5691 this parameter from its default value.
5692 Default: max xmit = 16644
5694 Example: max xmit = 8192
5696 mdns name (G)
5698 This parameter controls the name that multicast DNS support
5700 advertises as its' hostname.
5701 The default is to use the NETBIOS name which is typically the
5703 hostname in all capital letters.
5704 A setting of mdns will defer the hostname configuration to the MDNS
5706 library that is used.
5707 Default: mdns name = netbios
5709 message command (G)
5711 This specifies what command to run when the server receives a
5713 WinPopup style message.
5714 This would normally be a command that would deliver the message
5716 somehow. How this is to be done is up to your imagination.
5717 An example is:
5719 message command = csh -c 'xedit %s;rm %s' &
5721 This delivers the message using xedit, then removes it afterwards.
5723 NOTE THAT IT IS VERY IMPORTANT THAT THIS COMMAND RETURN
5724 IMMEDIATELY. That's why I have the '&' on the end. If it doesn't
5725 return immediately then your PCs may freeze when sending messages
5726 (they should recover after 30 seconds, hopefully).
5727 All messages are delivered as the global guest user. The command
5729 takes the standard substitutions, although
5730 %u won't work (%U may be better in this case).
5731 Apart from the standard substitutions, some additional ones apply.
5733 In particular:
5734 · %s = the filename containing the message.
5736 · %t = the destination that the message was sent to
5738 (probably the server name).
5739 · %f = who the message is from.
5741 You could make this command send mail, or whatever else takes your
5743 fancy. Please let us know of any really interesting ideas you have.
5744 Here's a way of sending the messages as mail to root:
5746 message command = /bin/mail -s 'message from %f on %m' root < %s; rm %s
5748 If you don't have a message command then the message won't be
5750 delivered and Samba will tell the sender there was an error.
5751 Unfortunately WfWg totally ignores the error code and carries on
5752 regardless, saying that the message was delivered.
5753 If you want to silently delete it then try:
5755 message command = rm %s
5757 Default: message command =
5759 Example: message command = csh -c 'xedit %s; rm %s' &
5761 min print space (S)
5763 This sets the minimum amount of free disk space that must be
5765 available before a user will be able to spool a print job. It is
5766 specified in kilobytes. The default is 0, which means a user can
5767 always spool a print job.
5768 Default: min print space = 0
5770 Example: min print space = 2000
5772 min receivefile size (G)
5774 This option changes the behavior of smbd(8) when processing
5776 SMBwriteX calls. Any incoming SMBwriteX call on a non-signed
5777 SMB/CIFS connection greater than this value will not be processed
5778 in the normal way but will be passed to any underlying kernel
5779 recvfile or splice system call (if there is no such call Samba will
5780 emulate in user space). This allows zero-copy writes directly from
5781 network socket buffers into the filesystem buffer cache, if
5782 available. It may improve performance but user testing is
5783 recommended. If set to zero Samba processes SMBwriteX calls in the
5784 normal way. To enable POSIX large write support (SMB/CIFS writes up
5785 to 16Mb) this option must be nonzero. The maximum value is 128k.
5786 Values greater than 128k will be silently set to 128k.
5787 Note this option will have NO EFFECT if set on a SMB signed
5789 connection.
5790 The default is zero, which disables this option.
5792 Default: min receivefile size = 0
5794 min wins ttl (G)
5796 This option tells nmbd(8) when acting as a WINS server (wins
5798 support = yes) what the minimum 'time to live' of NetBIOS names
5799 that nmbd will grant will be (in seconds). You should never need to
5800 change this parameter. The default is 6 hours (21600 seconds).
5801 Default: min wins ttl = 21600
5803 mit kdc command (G)
5805 This option specifies the path to the MIT kdc binary.
5807 If the KDC is not installed in the default location and wasn't
5809 correctly detected during build then you should modify this
5810 variable and point it to the correct binary.
5811 Default: mit kdc command = /usr/sbin/krb5kdc
5813 Example: mit kdc command = /opt/mit/sbin/krb5kdc
5815 msdfs proxy (S)
5817 This parameter indicates that the share is a stand-in for another
5819 CIFS share whose location is specified by the value of the
5820 parameter. When clients attempt to connect to this share, they are
5821 redirected to one or multiple, comma separated proxied shares using
5822 the SMB-Dfs protocol.
5823 Only Dfs roots can act as proxy shares. Take a look at the msdfs
5825 root and host msdfs options to find out how to set up a Dfs root
5826 share.
5827 No default
5829 Example: msdfs proxy =
5831 \otherserver\someshare,\otherserver2\someshare
5832 msdfs root (S)
5834 If set to yes, Samba treats the share as a Dfs root and allows
5836 clients to browse the distributed file system tree rooted at the
5837 share directory. Dfs links are specified in the share directory by
5838 symbolic links of the form msdfs:serverA\\shareA,serverB\\shareB
5839 and so on. For more information on setting up a Dfs tree on Samba,
5840 refer to the MSDFS chapter in the Samba3-HOWTO book.
5841 Default: msdfs root = no
5843 msdfs shuffle referrals (S)
5845 If set to yes, Samba will shuffle Dfs referrals for a given Dfs
5847 link if multiple are available, allowing for load balancing across
5848 clients. For more information on setting up a Dfs tree on Samba,
5849 refer to the MSDFS chapter in the Samba3-HOWTO book.
5850 Default: msdfs shuffle referrals = no
5852 multicast dns register (G)
5854 If compiled with proper support for it, Samba will announce itself
5856 with multicast DNS services like for example provided by the Avahi
5857 daemon.
5858 This parameter allows disabling Samba to register itself.
5860 Default: multicast dns register = yes
5862 name cache timeout (G)
5864 Specifies the number of seconds it takes before entries in samba's
5866 hostname resolve cache time out. If the timeout is set to 0. the
5867 caching is disabled.
5868 Default: name cache timeout = 660
5870 Example: name cache timeout = 0
5872 name resolve order (G)
5874 This option is used by the programs in the Samba suite to determine
5876 what naming services to use and in what order to resolve host names
5877 to IP addresses. Its main purpose to is to control how netbios name
5878 resolution is performed. The option takes a space separated string
5879 of name resolution options.
5880 The options are: "lmhosts", "host", "wins" and "bcast". They cause
5882 names to be resolved as follows:
5883 · lmhosts : Lookup an IP address in the Samba lmhosts
5885 file. If the line in lmhosts has no name type attached
5886 to the NetBIOS name (see the manpage for lmhosts for
5887 details) then any name type matches for lookup.
5888 · host : Do a standard host name to IP address resolution,
5890 using the system /etc/hosts, NIS, or DNS lookups. This
5891 method of name resolution is operating system depended
5892 for instance on IRIX or Solaris this may be controlled
5893 by the /etc/nsswitch.conf file. Note that this method is
5894 used only if the NetBIOS name type being queried is the
5895 0x20 (server) name type or 0x1c (domain controllers).
5896 The latter case is only useful for active directory
5897 domains and results in a DNS query for the SRV RR entry
5898 matching _ldap._tcp.domain.
5899 · wins : Query a name with the IP address listed in the
5901 WINSSERVER parameter. If no WINS server has been
5902 specified this method will be ignored.
5903 · bcast : Do a broadcast on each of the known local
5905 interfaces listed in the interfaces parameter. This is
5906 the least reliable of the name resolution methods as it
5907 depends on the target host being on a locally connected
5908 subnet.
5909 The example below will cause the local lmhosts file to be examined
5911 first, followed by a broadcast attempt, followed by a normal system
5912 hostname lookup.
5913 When Samba is functioning in ADS security mode (security = ads) it
5915 is advised to use following settings for name resolve order:
5916 name resolve order = wins bcast
5918 DC lookups will still be done via DNS, but fallbacks to netbios
5920 names will not inundate your DNS servers with needless queries for
5921 DOMAIN<0x1c> lookups.
5922 Default: name resolve order = lmhosts wins host bcast
5924 Example: name resolve order = lmhosts bcast host
5926 socket address
5928 This parameter is a synonym for nbt client socket address.
5930 nbt client socket address (G)
5932 This option allows you to control what address Samba will send NBT
5934 client packets from, and process replies using, including in nmbd.
5935 Setting this option should never be necessary on usual Samba
5937 servers running only one nmbd.
5938 By default Samba will send UDP packets from the OS default address
5940 for the destination, and accept replies on 0.0.0.0.
5941 This parameter is deprecated. See bind interfaces only = Yes and
5943 interfaces for the previous behaviour of controlling the normal
5944 listening sockets.
5945 Default: nbt client socket address = 0.0.0.0
5947 Example: nbt client socket address = 192.168.2.20
5949 nbtd:wins_prepend1Bto1Cqueries (G)
5951 Normally queries for 0x1C names (all logon servers for a domain)
5953 will return the first address of the 0x1B names (domain master
5954 browser and PDC) as first address in the result list. As many
5955 client only use the first address in the list by default, all
5956 clients will use the same server (the PDC). Windows servers have an
5957 option to disable this behavior (since Windows 2000 Service Pack
5958 2).
5959 Default: nbtd:wins_prepend1Bto1Cqueries = yes
5961 nbtd:wins_wins_randomize1Clist (G)
5963 Normally queries for 0x1C names will return the addresses in the
5965 same order as they're stored in the database, that means first all
5966 addresses which have been directly registered at the local wins
5967 server and then all addresses registered at other servers. Windows
5968 servers have an option to change this behavior and randomize the
5969 returned addresses. Set this parameter to "yes" and Samba will sort
5970 the address list depending on the client address and the matching
5971 bits of the addresses, the first address is randomized based on
5972 depending on the "nbtd:wins_randomize1Clist_mask" parameter.
5973 Default: nbtd:wins_wins_randomize1Clist = no
5975 nbtd:wins_randomize1Clist_mask (G)
5977 If the "nbtd:wins_randomize1Clist" parameter is set to "yes", then
5979 randomizing of the first returned address is based on the specified
5980 netmask. If there are addresses which are in the same subnet as the
5981 client address, the first returned address is randomly chosen out
5982 them. Otherwise the first returned address is randomly chosen out
5983 of all addresses.
5984 Default: nbtd:wins_randomize1Clist_mask = 255.255.255.0
5986 nbt port (G)
5988 Specifies which port the server should use for NetBIOS over IP name
5990 services traffic.
5991 Default: nbt port = 137
5993 ncalrpc dir (G)
5995 This directory will hold a series of named pipes to allow RPC over
5997 inter-process communication.
5998 This will allow Samba and other unix processes to interact over
6000 DCE/RPC without using TCP/IP. Additionally a sub-directory 'np' has
6001 restricted permissions, and allows a trusted communication channel
6002 between Samba processes
6003 Default: ncalrpc dir = /run/samba/ncalrpc
6005 Example: ncalrpc dir = /var/run/samba/ncalrpc
6007 netbios aliases (G)
6009 This is a list of NetBIOS names that nmbd will advertise as
6011 additional names by which the Samba server is known. This allows
6012 one machine to appear in browse lists under multiple names. If a
6013 machine is acting as a browse server or logon server none of these
6014 names will be advertised as either browse server or logon servers,
6015 only the primary name of the machine will be advertised with these
6016 capabilities.
6017 Default: netbios aliases = # empty string (no additional names)
6019 Example: netbios aliases = TEST TEST1 TEST2
6021 netbios name (G)
6023 This sets the NetBIOS name by which a Samba server is known. By
6025 default it is the same as the first component of the host's DNS
6026 name. If a machine is a browse server or logon server this name (or
6027 the first component of the hosts DNS name) will be the name that
6028 these services are advertised under.
6029 Note that the maximum length for a NetBIOS name is 15 characters.
6031 There is a bug in Samba that breaks operation of browsing and
6033 access to shares if the netbios name is set to the literal name
6034 PIPE. To avoid this problem, do not name your Samba server PIPE.
6035 Default: netbios name = # machine DNS name
6037 Example: netbios name = MYNAME
6039 netbios scope (G)
6041 This sets the NetBIOS scope that Samba will operate under. This
6043 should not be set unless every machine on your LAN also sets this
6044 value.
6045 Default: netbios scope =
6047 neutralize nt4 emulation (G)
6049 This option controls whether winbindd sends the
6051 NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION flag in order to bypass the
6052 NT4 emulation of a domain controller.
6053 Typically you should not need set this. It can be useful for
6055 upgrades from NT4 to AD domains.
6056 The behavior can be controlled per netbios domain by using
6058 'neutralize nt4 emulation:NETBIOSDOMAIN = yes' as option.
6059 Default: neutralize nt4 emulation = no
6061 NIS homedir (G)
6063 Get the home share server from a NIS map. For UNIX systems that use
6065 an automounter, the user's home directory will often be mounted on
6066 a workstation on demand from a remote server.
6067 When the Samba logon server is not the actual home directory
6069 server, but is mounting the home directories via NFS then two
6070 network hops would be required to access the users home directory
6071 if the logon server told the client to use itself as the SMB server
6072 for home directories (one over SMB and one over NFS). This can be
6073 very slow.
6074 This option allows Samba to return the home share as being on a
6076 different server to the logon server and as long as a Samba daemon
6077 is running on the home directory server, it will be mounted on the
6078 Samba client directly from the directory server. When Samba is
6079 returning the home share to the client, it will consult the NIS map
6080 specified in homedir map and return the server listed there.
6081 Note that for this option to work there must be a working NIS
6083 system and the Samba server with this option must also be a logon
6084 server.
6085 Default: NIS homedir = no
6087 nmbd bind explicit broadcast (G)
6089 This option causes nmbd(8) to explicitly bind to the broadcast
6091 address of the local subnets. This is needed to make nmbd work
6092 correctly in combination with the socket address option. You should
6093 not need to unset this option.
6094 Default: nmbd bind explicit broadcast = yes
6096 nsupdate command (G)
6098 This option sets the path to the nsupdate command which is used for
6100 GSS-TSIG dynamic DNS updates.
6101 Default: nsupdate command = /usr/bin/nsupdate -g
6103 nt acl support (S)
6105 This boolean parameter controls whether smbd(8) will attempt to map
6107 UNIX permissions into Windows NT access control lists. The UNIX
6108 permissions considered are the traditional UNIX owner and group
6109 permissions, as well as POSIX ACLs set on any files or directories.
6110 This parameter was formally a global parameter in releases prior to
6111 2.2.2.
6112 Default: nt acl support = yes
6114 ntlm auth (G)
6116 This parameter determines whether or not smbd(8) will attempt to
6118 authenticate users using the NTLM encrypted password response for
6119 this local passdb (SAM or account database).
6120 If disabled, both NTLM and LanMan authencication against the local
6122 passdb is disabled.
6123 Note that these settings apply only to local users, authentication
6125 will still be forwarded to and NTLM authentication accepted against
6126 any domain we are joined to, and any trusted domain, even if
6127 disabled or if NTLMv2-only is enforced here. To control NTLM
6128 authentiation for domain users, this must option must be configured
6129 on each DC.
6130 By default with ntlm auth set to ntlmv2-only only NTLMv2 logins
6132 will be permitted. All modern clients support NTLMv2 by default,
6133 but some older clients will require special configuration to use
6134 it.
6135 The primary user of NTLMv1 is MSCHAPv2 for VPNs and 802.1x.
6137 The available settings are:
6139 · ntlmv1-permitted (alias yes) - Allow NTLMv1 and above
6141 for all clients.
6142 This is the required setting for to enable the lanman
6144 auth parameter.
6145 · ntlmv2-only (alias no) - Do not allow NTLMv1 to be used,
6147 but permit NTLMv2.
6148 · mschapv2-and-ntlmv2-only - Only allow NTLMv1 when the
6150 client promises that it is providing MSCHAPv2
6151 authentication (such as the ntlm_auth tool).
6152 · disabled - Do not accept NTLM (or LanMan) authentication
6154 of any level, nor permit NTLM password changes.
6155 The default changed from yes to no with Samba 4.5. The default
6157 changed again to ntlmv2-only with Samba 4.7, however the behaviour
6158 is unchanged.
6159 Default: ntlm auth = ntlmv2-only
6161 nt pipe support (G)
6163 This boolean parameter controls whether smbd(8) will allow Windows
6165 NT clients to connect to the NT SMB specific IPC$ pipes. This is a
6166 developer debugging option and can be left alone.
6167 Default: nt pipe support = yes
6169 ntp signd socket directory (G)
6171 This setting controls the location of the socket that the NTP
6173 daemon uses to communicate with Samba for signing packets.
6174 If a non-default path is specified here, then it is also necessary
6176 to make NTP aware of the new path using the ntpsigndsocket
6177 directive in ntp.conf.
6178 Default: ntp signd socket directory = /var/lib/samba/ntp_signd
6180 nt status support (G)
6182 This boolean parameter controls whether smbd(8) will negotiate NT
6184 specific status support with Windows NT/2k/XP clients. This is a
6185 developer debugging option and should be left alone. If this option
6186 is set to no then Samba offers exactly the same DOS error codes
6187 that versions prior to Samba 2.2.3 reported.
6188 You should not need to ever disable this parameter.
6190 Default: nt status support = yes
6192 ntvfs handler (S)
6194 This specifies the NTVFS handlers for this share.
6196 · unixuid: Sets up user credentials based on POSIX
6198 gid/uid.
6199 · cifs: Proxies a remote CIFS FS. Mainly useful for
6201 testing.
6202 · nbench: Filter module that saves data useful to the
6204 nbench benchmark suite.
6205 · ipc: Allows using SMB for inter process communication.
6207 Only used for the IPC$ share.
6208 · posix: Maps POSIX FS semantics to NT semantics
6210 · print: Allows printing over SMB. This is LANMAN-style
6212 printing, not the be confused with the spoolss DCE/RPC
6213 interface used by later versions of Windows.
6214 Note that this option is only used when the NTVFS file server is in
6216 use. It is not used with the (default) s3fs file server.
6217 Default: ntvfs handler = unixuid, default
6219 null passwords (G)
6221 Allow or disallow client access to accounts that have null
6223 passwords.
6224 See also smbpasswd(5).
6226 Default: null passwords = no
6228 obey pam restrictions (G)
6230 When Samba 3.0 is configured to enable PAM support (i.e.
6232 --with-pam), this parameter will control whether or not Samba
6233 should obey PAM's account and session management directives. The
6234 default behavior is to use PAM for clear text authentication only
6235 and to ignore any account or session management. Note that Samba
6236 always ignores PAM for authentication in the case of encrypt
6237 passwords = yes. The reason is that PAM modules cannot support the
6238 challenge/response authentication mechanism needed in the presence
6239 of SMB password encryption.
6240 Default: obey pam restrictions = no
6242 old password allowed period (G)
6244 Number of minutes to permit an NTLM login after a password change
6246 or reset using the old password. This allows the user to re-cache
6247 the new password on multiple clients without disrupting a network
6248 reconnection in the meantime.
6249 This parameter only applies when server role is set to Active
6251 Directory Domain Controller
6252 Default: old password allowed period = 60
6254 oplock break wait time (G)
6256 This is a tuning parameter added due to bugs in both Windows 9x and
6258 WinNT. If Samba responds to a client too quickly when that client
6259 issues an SMB that can cause an oplock break request, then the
6260 network client can fail and not respond to the break request. This
6261 tuning parameter (which is set in milliseconds) is the amount of
6262 time Samba will wait before sending an oplock break request to such
6263 (broken) clients.
6264 Warning
6266 DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND
6267 UNDERSTOOD THE SAMBA OPLOCK CODE.
6268 Default: oplock break wait time = 0
6269 oplocks (S)
6271 This boolean option tells smbd whether to issue oplocks
6273 (opportunistic locks) to file open requests on this share. The
6274 oplock code can dramatically (approx. 30% or more) improve the
6275 speed of access to files on Samba servers. It allows the clients to
6276 aggressively cache files locally and you may want to disable this
6277 option for unreliable network environments (it is turned on by
6278 default in Windows NT Servers).
6279 Oplocks may be selectively turned off on certain files with a
6281 share. See the veto oplock files parameter. On some systems oplocks
6282 are recognized by the underlying operating system. This allows data
6283 synchronization between all access to oplocked files, whether it be
6284 via Samba or NFS or a local UNIX process. See the kernel oplocks
6285 parameter for details.
6286 Default: oplocks = yes
6288 os2 driver map (G)
6290 The parameter is used to define the absolute path to a file
6292 containing a mapping of Windows NT printer driver names to OS/2
6293 printer driver names. The format is:
6294 <nt driver name> = <os2 driver name>.<device name>
6296 For example, a valid entry using the HP LaserJet 5 printer driver
6298 would appear as HP LaserJet 5L = LASERJET.HP LaserJet 5L.
6299 The need for the file is due to the printer driver namespace
6301 problem described in the chapter on Classical Printing in the
6302 Samba3-HOWTO book. For more details on OS/2 clients, please refer
6303 to chapter on other clients in the Samba3-HOWTO book.
6304 Default: os2 driver map =
6306 os level (G)
6308 This integer value controls what level Samba advertises itself as
6310 for browse elections. The value of this parameter determines
6311 whether nmbd(8) has a chance of becoming a local master browser for
6312 the workgroup in the local broadcast area.
6313 Note: By default, Samba will win a local master browsing election
6315 over all Microsoft operating systems except a Windows NT 4.0/2000
6316 Domain Controller. This means that a misconfigured Samba host can
6317 effectively isolate a subnet for browsing purposes. This parameter
6318 is largely auto-configured in the Samba-3 release series and it is
6319 seldom necessary to manually override the default setting. Please
6320 refer to the chapter on Network Browsing in the Samba-3 HOWTO
6321 document for further information regarding the use of this
6322 parameter. Note: The maximum value for this parameter is 255. If
6323 you use higher values, counting will start at 0!
6324 Default: os level = 20
6326 Example: os level = 65
6328 pam password change (G)
6330 With the addition of better PAM support in Samba 2.2, this
6332 parameter, it is possible to use PAM's password change control flag
6333 for Samba. If enabled, then PAM will be used for password changes
6334 when requested by an SMB client instead of the program listed in
6335 passwd program. It should be possible to enable this without
6336 changing your passwd chat parameter for most setups.
6337 Default: pam password change = no
6339 panic action (G)
6341 This is a Samba developer option that allows a system command to be
6343 called when either smbd(8) or nmbd(8) crashes. This is usually used
6344 to draw attention to the fact that a problem occurred.
6345 Default: panic action =
6347 Example: panic action = /bin/sleep 90000
6349 passdb backend (G)
6351 This option allows the administrator to chose which backend will be
6353 used for storing user and possibly group information. This allows
6354 you to swap between different storage mechanisms without recompile.
6355 The parameter value is divided into two parts, the backend's name,
6357 and a 'location' string that has meaning only to that particular
6358 backed. These are separated by a : character.
6359 Available backends can include:
6361 · smbpasswd - The old plaintext passdb backend. Some Samba
6363 features will not work if this passdb backend is used.
6364 Takes a path to the smbpasswd file as an optional
6365 argument.
6366 · tdbsam - The TDB based password storage backend. Takes a
6368 path to the TDB as an optional argument (defaults to
6369 passdb.tdb in the private dir directory.
6370 · ldapsam - The LDAP based passdb backend. Takes an LDAP
6372 URL as an optional argument (defaults to
6373 ldap://localhost)
6374 LDAP connections should be secured where possible. This
6376 may be done using either Start-TLS (see ldap ssl) or by
6377 specifying ldaps:// in the URL argument.
6378 Multiple servers may also be specified in double-quotes.
6380 Whether multiple servers are supported or not and the
6381 exact syntax depends on the LDAP library you use.
6382 Examples of use are:
6385 passdb backend = tdbsam:/etc/samba/private/passdb.tdb
6387 or multi server LDAP URL with OpenLDAP library:
6389 passdb backend = ldapsam:"ldap://ldap-1.example.com ldap://ldap-2.example.com"
6391 or multi server LDAP URL with Netscape based LDAP library:
6393 passdb backend = ldapsam:"ldap://ldap-1.example.com ldap-2.example.com"
6395 Default: passdb backend = tdbsam
6397 passdb expand explicit (G)
6399 This parameter controls whether Samba substitutes %-macros in the
6401 passdb fields if they are explicitly set. We used to expand macros
6402 here, but this turned out to be a bug because the Windows client
6403 can expand a variable %G_osver% in which %G would have been
6404 substituted by the user's primary group.
6405 Default: passdb expand explicit = no
6407 passwd chat (G)
6409 This string controls the "chat" conversation that takes places
6411 between smbd(8) and the local password changing program to change
6412 the user's password. The string describes a sequence of
6413 response-receive pairs that smbd(8) uses to determine what to send
6414 to the passwd program and what to expect back. If the expected
6415 output is not received then the password is not changed.
6416 This chat sequence is often quite site specific, depending on what
6418 local methods are used for password control (such as NIS etc).
6419 Note that this parameter only is used if the unix password sync
6421 parameter is set to yes. This sequence is then called AS ROOT when
6422 the SMB password in the smbpasswd file is being changed, without
6423 access to the old password cleartext. This means that root must be
6424 able to reset the user's password without knowing the text of the
6425 previous password. In the presence of NIS/YP, this means that the
6426 passwd program must be executed on the NIS master.
6427 The string can contain the macro %n which is substituted for the
6429 new password. The old password (%o) is only available when encrypt
6430 passwords has been disabled. The chat sequence can also contain the
6431 standard macros \n, \r, \t and \s to give line-feed,
6432 carriage-return, tab and space. The chat sequence string can also
6433 contain a '*' which matches any sequence of characters. Double
6434 quotes can be used to collect strings with spaces in them into a
6435 single string.
6436 If the send string in any part of the chat sequence is a full stop
6438 ".", then no string is sent. Similarly, if the expect string is a
6439 full stop then no string is expected.
6440 If the pam password change parameter is set to yes, the chat pairs
6442 may be matched in any order, and success is determined by the PAM
6443 result, not any particular output. The \n macro is ignored for PAM
6444 conversions.
6445 Default: passwd chat = *new*password* %n\n *new*password* %n\n
6447 *changed*
6448 Example: passwd chat = "*Enter NEW password*" %n\n "*Reenter NEW
6450 password*" %n\n "*Password changed*"
6451 passwd chat debug (G)
6453 This boolean specifies if the passwd chat script parameter is run
6455 in debug mode. In this mode the strings passed to and received from
6456 the passwd chat are printed in the smbd(8) log with a debug level
6457 of 100. This is a dangerous option as it will allow plaintext
6458 passwords to be seen in the smbd log. It is available to help Samba
6459 admins debug their passwd chat scripts when calling the passwd
6460 program and should be turned off after this has been done. This
6461 option has no effect if the pam password change parameter is set.
6462 This parameter is off by default.
6463 Default: passwd chat debug = no
6465 passwd chat timeout (G)
6467 This integer specifies the number of seconds smbd will wait for an
6469 initial answer from a passwd chat script being run. Once the
6470 initial answer is received the subsequent answers must be received
6471 in one tenth of this time. The default it two seconds.
6472 Default: passwd chat timeout = 2
6474 passwd program (G)
6476 The name of a program that can be used to set UNIX user passwords.
6478 Any occurrences of %u will be replaced with the user name. The user
6479 name is checked for existence before calling the password changing
6480 program.
6481 Also note that many passwd programs insist in reasonable passwords,
6483 such as a minimum length, or the inclusion of mixed case chars and
6484 digits. This can pose a problem as some clients (such as Windows
6485 for Workgroups) uppercase the password before sending it.
6486 Note that if the unix password sync parameter is set to yes then
6488 this program is called AS ROOT before the SMB password in the
6489 smbpasswd file is changed. If this UNIX password change fails, then
6490 smbd will fail to change the SMB password also (this is by design).
6491 If the unix password sync parameter is set this parameter MUST USE
6493 ABSOLUTE PATHS for ALL programs called, and must be examined for
6494 security implications. Note that by default unix password sync is
6495 set to no.
6496 Default: passwd program =
6498 Example: passwd program = /bin/passwd %u
6500 password hash gpg key ids (G)
6502 If samba is running as an active directory domain controller, it is
6504 possible to store the cleartext password of accounts in a
6505 PGP/OpenGPG encrypted form.
6506 You can specify one or more recipients by key id or user id. Note
6508 that 32bit key ids are not allowed, specify at least 64bit.
6509 The value is stored as 'Primary:SambaGPG' in the
6511 supplementalCredentials attribute.
6512 As password changes can occur on any domain controller, you should
6514 configure this on each of them. Note that this feature is currently
6515 available only on Samba domain controllers.
6516 This option is only available if samba was compiled with gpgme
6518 support.
6519 You may need to export the GNUPGHOME environment variable before
6521 starting samba. It is strongly recommended to only store the
6522 public key in this location. The private key is not used for
6523 encryption and should be only stored where decryption is required.
6524 Being able to restore the cleartext password helps, when they need
6526 to be imported into other authentication systems later (see
6527 samba-tool user getpassword) or you want to keep the passwords in
6528 sync with another system, e.g. an OpenLDAP server (see samba-tool
6529 user syncpasswords).
6530 While this option needs to be configured on all domain controllers,
6532 the samba-tool user syncpasswords command should run on a single
6533 domain controller only (typically the PDC-emulator).
6534 Default: password hash gpg key ids =
6536 Example: password hash gpg key ids = 4952E40301FAB41A
6538 Example: password hash gpg key ids = selftest@samba.example.com
6540 Example: password hash gpg key ids = selftest@samba.example.com,
6542 4952E40301FAB41A
6543 password hash userPassword schemes (G)
6545 This parameter determines whether or not samba(8) acting as an
6547 Active Directory Domain Controller will attempt to store additional
6548 passwords hash types for the user
6549 The values are stored as 'Primary:userPassword' in the
6551 supplementalCredentials attribute. The value of this option is a
6552 hash type.
6553 The currently supported hash types are:
6555 · CryptSHA256
6557 · CryptSHA512
6559 Multiple instances of a hash type may be computed and stored. The
6561 password hashes are calculated using the crypt(3) call. The number
6562 of rounds used to compute the hash can be specified by adding
6563 ':rounds=xxxx' to the hash type, i.e. CryptSHA512:rounds=4500 would
6564 calculate an SHA512 hash using 4500 rounds. If not specified the
6565 Operating System defaults for crypt(3) are used.
6566 As password changes can occur on any domain controller, you should
6568 configure this on each of them. Note that this feature is currently
6569 available only on Samba domain controllers.
6570 Currently the NT Hash of the password is recorded when these hashes
6572 are calculated and stored. When retrieving the hashes the current
6573 value of the NT Hash is checked against the stored NT Hash. This
6574 detects password changes that have not updated the password hashes.
6575 In this case samba-tool user will ignore the stored hash values.
6576 Being able to obtain the hashed password helps, when they need to
6578 be imported into other authentication systems later (see samba-tool
6579 user getpassword) or you want to keep the passwords in sync with
6580 another system, e.g. an OpenLDAP server (see samba-tool user
6581 syncpasswords).
6582 Related command: unix password sync
6584 Default: password hash userPassword schemes =
6586 Example: password hash userPassword schemes = CryptSHA256
6588 Example: password hash userPassword schemes = CryptSHA256
6590 CryptSHA512
6591 Example: password hash userPassword schemes =
6593 CryptSHA256:rounds=5000 CryptSHA512:rounds=7000
6594 password server (G)
6596 By specifying the name of a domain controller with this option, and
6598 using security = [ads|domain] it is possible to get Samba to do all
6599 its username/password validation using a specific remote server.
6600 Ideally, this option should not be used, as the default '*'
6602 indicates to Samba to determine the best DC to contact dynamically,
6603 just as all other hosts in an AD domain do. This allows the domain
6604 to be maintained (addition and removal of domain controllers)
6605 without modification to the smb.conf file. The cryptographic
6606 protection on the authenticated RPC calls used to verify passwords
6607 ensures that this default is safe.
6608 It is strongly recommended that you use the default of '*', however
6610 if in your particular environment you have reason to specify a
6611 particular DC list, then the list of machines in this option must
6612 be a list of names or IP addresses of Domain controllers for the
6613 Domain. If you use the default of '*', or list several hosts in the
6614 password server option then smbd will try each in turn till it
6615 finds one that responds. This is useful in case your primary server
6616 goes down.
6617 If the list of servers contains both names/IP's and the '*'
6619 character, the list is treated as a list of preferred domain
6620 controllers, but an auto lookup of all remaining DC's will be added
6621 to the list as well. Samba will not attempt to optimize this list
6622 by locating the closest DC.
6623 If parameter is a name, it is looked up using the parameter name
6625 resolve order and so may resolved by any method and order described
6626 in that parameter.
6627 Default: password server = *
6629 Example: password server = NT-PDC, NT-BDC1, NT-BDC2, *
6631 Example: password server = windc.mydomain.com:389 192.168.1.101 *
6633 directory
6635 This parameter is a synonym for path.
6637 path (S)
6639 This parameter specifies a directory to which the user of the
6641 service is to be given access. In the case of printable services,
6642 this is where print data will spool prior to being submitted to the
6643 host for printing.
6644 For a printable service offering guest access, the service should
6646 be readonly and the path should be world-writeable and have the
6647 sticky bit set. This is not mandatory of course, but you probably
6648 won't get the results you expect if you do otherwise.
6649 Any occurrences of %u in the path will be replaced with the UNIX
6651 username that the client is using on this connection. Any
6652 occurrences of %m will be replaced by the NetBIOS name of the
6653 machine they are connecting from. These replacements are very
6654 useful for setting up pseudo home directories for users.
6655 Note that this path will be based on root dir if one was specified.
6657 Default: path =
6659 Example: path = /home/fred
6661 perfcount module (G)
6663 This parameter specifies the perfcount backend to be used when
6665 monitoring SMB operations. Only one perfcount module may be used,
6666 and it must implement all of the apis contained in the
6667 smb_perfcount_handler structure defined in smb.h.
6668 No default
6670 pid directory (G)
6672 This option specifies the directory where pid files will be placed.
6674 Default: pid directory = /run
6676 Example: pid directory = /var/run/
6678 posix locking (S)
6680 The smbd(8) daemon maintains an database of file locks obtained by
6682 SMB clients. The default behavior is to map this internal database
6683 to POSIX locks. This means that file locks obtained by SMB clients
6684 are consistent with those seen by POSIX compliant applications
6685 accessing the files via a non-SMB method (e.g. NFS or local file
6686 access). It is very unlikely that you need to set this parameter to
6687 "no", unless you are sharing from an NFS mount, which is not a good
6688 idea in the first place.
6689 Default: posix locking = yes
6691 postexec (S)
6693 This option specifies a command to be run whenever the service is
6695 disconnected. It takes the usual substitutions. The command may be
6696 run as the root on some systems.
6697 An interesting example may be to unmount server resources:
6699 postexec = /etc/umount /cdrom
6701 Default: postexec =
6703 Example: postexec = echo \"%u disconnected from %S from %m (%I)\"
6705 >> /tmp/log
6706 exec
6708 This parameter is a synonym for preexec.
6710 preexec (S)
6712 This option specifies a command to be run whenever the service is
6714 connected to. It takes the usual substitutions.
6715 An interesting example is to send the users a welcome message every
6717 time they log in. Maybe a message of the day? Here is an example:
6718 preexec = csh -c 'echo \"Welcome to %S!\" |
6720 /usr/local/samba/bin/smbclient -M %m -I %I' &
6721 Of course, this could get annoying after a while :-)
6723 See also preexec close and postexec.
6725 Default: preexec =
6727 Example: preexec = echo \"%u connected to %S from %m (%I)\" >>
6729 /tmp/log
6730 preexec close (S)
6732 This boolean option controls whether a non-zero return code from
6734 preexec should close the service being connected to.
6735 Default: preexec close = no
6737 prefered master
6739 This parameter is a synonym for preferred master.
6741 preferred master (G)
6743 This boolean parameter controls if nmbd(8) is a preferred master
6745 browser for its workgroup.
6746 If this is set to yes, on startup, nmbd will force an election, and
6748 it will have a slight advantage in winning the election. It is
6749 recommended that this parameter is used in conjunction with domain
6750 master = yes, so that nmbd can guarantee becoming a domain master.
6751 Use this option with caution, because if there are several hosts
6753 (whether Samba servers, Windows 95 or NT) that are preferred master
6754 browsers on the same subnet, they will each periodically and
6755 continuously attempt to become the local master browser. This will
6756 result in unnecessary broadcast traffic and reduced browsing
6757 capabilities.
6758 Default: preferred master = auto
6760 prefork backoff increment (G)
6762 This option specifies the number of seconds added to the delay
6764 before a prefork master or worker process is restarted. The restart
6765 is initially zero, the prefork backoff increment is added to the
6766 delay on each restart up to the value specified by "prefork maximum
6767 backoff".
6768 Additionally the the backoff for an individual service by using
6770 "prefork backoff increment: service name" i.e. "prefork backoff
6771 increment:ldap = 2" to set the backoff increment to 2.
6772 If the backoff increment is 2 and the maximum backoff is 5. There
6774 will be a zero second delay for the first restart. A two second
6775 delay for the second restart. A four second delay for the third and
6776 any subsequent restarts
6777 Default: prefork backoff increment = 10
6779 prefork children (G)
6781 This option controls the number of worker processes that are
6783 started for each service when prefork process model is enabled (see
6784 samba(8) -M) The prefork children are only started for those
6785 services that support prefork (currently ldap, kdc and netlogon).
6786 For processes that don't support preforking all requests are
6787 handled by a single process for that service.
6788 This should be set to a small multiple of the number of CPU's
6790 available on the server
6791 Additionally the number of prefork children can be specified for an
6793 individual service by using "prefork children: service name" i.e.
6794 "prefork children:ldap = 8" to set the number of ldap worker
6795 processes.
6796 Default: prefork children = 4
6798 prefork maximum backoff (G)
6800 This option controls the maximum delay before a failed pre-fork
6802 process is restarted.
6803 Default: prefork maximum backoff = 120
6805 preload modules (G)
6807 This is a list of paths to modules that should be loaded into smbd
6809 before a client connects. This improves the speed of smbd when
6810 reacting to new connections somewhat.
6811 Default: preload modules =
6813 Example: preload modules = /usr/lib/samba/passdb/mysql.so
6815 preserve case (S)
6817 This controls if new filenames are created with the case that the
6819 client passes, or if they are forced to be the default case.
6820 See the section on NAME MANGLING for a fuller discussion.
6822 Default: preserve case = yes
6824 print ok
6826 This parameter is a synonym for printable.
6828 printable (S)
6830 If this parameter is yes, then clients may open, write to and
6832 submit spool files on the directory specified for the service.
6833 Note that a printable service will ALWAYS allow writing to the
6835 service path (user privileges permitting) via the spooling of print
6836 data. The read only parameter controls only non-printing access to
6837 the resource.
6838 Default: printable = no
6840 printcap cache time (G)
6842 This option specifies the number of seconds before the printing
6844 subsystem is again asked for the known printers.
6845 Setting this parameter to 0 disables any rescanning for new or
6847 removed printers after the initial startup.
6848 Default: printcap cache time = 750
6850 Example: printcap cache time = 600
6852 printcap
6854 This parameter is a synonym for printcap name.
6856 printcap name (G)
6858 This parameter may be used to override the compiled-in default
6860 printcap name used by the server (usually /etc/printcap). See the
6861 discussion of the [printers] section above for reasons why you
6862 might want to do this.
6863 To use the CUPS printing interface set printcap name = cups. This
6865 should be supplemented by an additional setting printing = cups in
6866 the [global] section. printcap name = cups will use the "dummy"
6867 printcap created by CUPS, as specified in your CUPS configuration
6868 file.
6869 On System V systems that use lpstat to list available printers you
6871 can use printcap name = lpstat to automatically obtain lists of
6872 available printers. This is the default for systems that define
6873 SYSV at configure time in Samba (this includes most System V based
6874 systems). If
6875 printcap name is set to lpstat on these systems then Samba will
6876 launch lpstat -v and attempt to parse the output to obtain a
6877 printer list.
6878 A minimal printcap file would look something like this:
6880 print1|My Printer 1
6882 print2|My Printer 2
6883 print3|My Printer 3
6884 print4|My Printer 4
6885 print5|My Printer 5
6886 where the '|' separates aliases of a printer. The fact that the
6888 second alias has a space in it gives a hint to Samba that it's a
6889 comment.
6890 Note
6892 Under AIX the default printcap name is /etc/qconfig. Samba will
6893 assume the file is in AIX qconfig format if the string qconfig
6894 appears in the printcap filename.
6895 Default: printcap name = /etc/printcap
6896 Example: printcap name = /etc/myprintcap
6898 print command (S)
6900 After a print job has finished spooling to a service, this command
6902 will be used via a system() call to process the spool file.
6903 Typically the command specified will submit the spool file to the
6904 host's printing subsystem, but there is no requirement that this be
6905 the case. The server will not remove the spool file, so whatever
6906 command you specify should remove the spool file when it has been
6907 processed, otherwise you will need to manually remove old spool
6908 files.
6909 The print command is simply a text string. It will be used verbatim
6911 after macro substitutions have been made:
6912 %s, %f - the path to the spool file name
6914 %p - the appropriate printer name
6916 %J - the job name as transmitted by the client.
6918 %c - The number of printed pages of the spooled job (if known).
6920 %z - the size of the spooled print job (in bytes)
6922 The print command MUST contain at least one occurrence of %s or %f
6924 - the %p is optional. At the time a job is submitted, if no printer
6925 name is supplied the %p will be silently removed from the printer
6926 command.
6927 If specified in the [global] section, the print command given will
6929 be used for any printable service that does not have its own print
6930 command specified.
6931 If there is neither a specified print command for a printable
6933 service nor a global print command, spool files will be created but
6934 not processed and (most importantly) not removed.
6935 Note that printing may fail on some UNIXes from the nobody account.
6937 If this happens then create an alternative guest account that can
6938 print and set the guest account in the [global] section.
6939 You can form quite complex print commands by realizing that they
6941 are just passed to a shell. For example the following will log a
6942 print job, print the file, then remove it. Note that ';' is the
6943 usual separator for command in shell scripts.
6944 print command = echo Printing %s >> /tmp/print.log; lpr -P %p %s;
6946 rm %s
6947 You may have to vary this command considerably depending on how you
6949 normally print files on your system. The default for the parameter
6950 varies depending on the setting of the printing parameter.
6951 Default: For printing = BSD, AIX, QNX, LPRNG or PLP :
6953 print command = lpr -r -P%p %s
6955 For printing = SYSV or HPUX :
6957 print command = lp -c -d%p %s; rm %s
6959 For printing = SOFTQ :
6961 print command = lp -d%p -s %s; rm %s
6963 For printing = CUPS : If SAMBA is compiled against libcups, then
6965 printcap = cups uses the CUPS API to submit jobs, etc. Otherwise it
6966 maps to the System V commands with the -oraw option for printing,
6967 i.e. it uses lp -c -d%p -oraw; rm %s. With printing = cups, and if
6968 SAMBA is compiled against libcups, any manually set print command
6969 will be ignored.
6970 No default
6972 Example: print command = /usr/local/samba/bin/myprintscript %p %s
6974 printer
6976 This parameter is a synonym for printer name.
6978 printer name (S)
6980 This parameter specifies the name of the printer to which print
6982 jobs spooled through a printable service will be sent.
6983 If specified in the [global] section, the printer name given will
6985 be used for any printable service that does not have its own
6986 printer name specified.
6987 The default value of the printer name may be lp on many systems.
6989 Default: printer name =
6991 Example: printer name = laserwriter
6993 printing (S)
6995 This parameters controls how printer status information is
6997 interpreted on your system. It also affects the default values for
6998 the print command, lpq command, lppause command , lpresume command,
6999 and lprm command if specified in the [global] section.
7000 Currently nine printing styles are supported. They are BSD, AIX,
7002 LPRNG, PLP, SYSV, HPUX, QNX, SOFTQ, CUPS and IPRINT.
7003 Be aware that CUPS and IPRINT are only available if the CUPS
7005 development library was available at the time Samba was compiled or
7006 packaged.
7007 To see what the defaults are for the other print commands when
7009 using the various options use the testparm(1) program.
7010 This option can be set on a per printer basis. Please be aware
7012 however, that you must place any of the various printing commands
7013 (e.g. print command, lpq command, etc...) after defining the value
7014 for the printing option since it will reset the printing commands
7015 to default values.
7016 See also the discussion in the [printers] section.
7018 See testparm -v. for the default value on your system
7020 Default: printing = # Depends on the operating system
7022 printjob username (S)
7024 This parameter specifies which user information will be passed to
7026 the printing system. Usually, the username is sent, but in some
7027 cases, e.g. the domain prefix is useful, too.
7028 Default: printjob username = %U
7030 Example: printjob username = %D\%U
7032 print notify backchannel (S)
7034 Windows print clients can update print queue status by expecting
7036 the server to open a backchannel SMB connection to them. Due to
7037 client firewall settings this can cause considerable timeouts and
7038 will often fail, as there is no guarantee the client is even
7039 running an SMB server. By default, the Samba print server will not
7040 try to connect back to clients, and will treat corresponding
7041 requests as if the connection back to the client failed.
7042 Default: print notify backchannel = no
7044 private directory
7046 This parameter is a synonym for private dir.
7048 private dir (G)
7050 This parameters defines the directory smbd will use for storing
7052 such files as smbpasswd and secrets.tdb.
7053 Default: private dir = /var/lib/samba/private
7055 queuepause command (S)
7057 This parameter specifies the command to be executed on the server
7059 host in order to pause the printer queue.
7060 This command should be a program or script which takes a printer
7062 name as its only parameter and stops the printer queue, such that
7063 no longer jobs are submitted to the printer.
7064 This command is not supported by Windows for Workgroups, but can be
7066 issued from the Printers window under Windows 95 and NT.
7067 If a %p is given then the printer name is put in its place.
7069 Otherwise it is placed at the end of the command.
7070 Note that it is good practice to include the absolute path in the
7072 command as the PATH may not be available to the server.
7073 Default: queuepause command = # determined by printing parameter
7075 Example: queuepause command = disable %p
7077 queueresume command (S)
7079 This parameter specifies the command to be executed on the server
7081 host in order to resume the printer queue. It is the command to
7082 undo the behavior that is caused by the previous parameter
7083 (queuepause command).
7084 This command should be a program or script which takes a printer
7086 name as its only parameter and resumes the printer queue, such that
7087 queued jobs are resubmitted to the printer.
7088 This command is not supported by Windows for Workgroups, but can be
7090 issued from the Printers window under Windows 95 and NT.
7091 If a %p is given then the printer name is put in its place.
7093 Otherwise it is placed at the end of the command.
7094 Note that it is good practice to include the absolute path in the
7096 command as the PATH may not be available to the server.
7097 Default: queueresume command = # determined by printing parameter
7099 Example: queueresume command = enable %p
7101 raw NTLMv2 auth (G)
7103 This parameter determines whether or not smbd(8) will allow SMB1
7105 clients without extended security (without SPNEGO) to use NTLMv2
7106 authentication.
7107 If this option, lanman auth and ntlm auth are all disabled, then
7109 only clients with SPNEGO support will be permitted. That means
7110 NTLMv2 is only supported within NTLMSSP.
7111 Default: raw NTLMv2 auth = no
7113 read list (S)
7115 This is a list of users that are given read-only access to a
7117 service. If the connecting user is in this list then they will not
7118 be given write access, no matter what the read only option is set
7119 to. The list can include group names using the syntax described in
7120 the invalid users parameter.
7121 Default: read list =
7123 Example: read list = mary, @students
7125 read only (S)
7127 An inverted synonym is writeable.
7129 If this parameter is yes, then users of a service may not create or
7131 modify files in the service's directory.
7132 Note that a printable service (printable = yes) will ALWAYS allow
7134 writing to the directory (user privileges permitting), but only via
7135 spooling operations.
7136 Default: read only = yes
7138 read raw (G)
7140 This is ignored if async smb echo handler is set, because this
7142 feature is incompatible with raw read SMB requests
7143 If enabled, raw reads allow reads of 65535 bytes in one packet.
7145 This typically provides a major performance benefit for some very,
7146 very old clients.
7147 However, some clients either negotiate the allowable block size
7149 incorrectly or are incapable of supporting larger block sizes, and
7150 for these clients you may need to disable raw reads.
7151 In general this parameter should be viewed as a system tuning tool
7153 and left severely alone.
7154 Default: read raw = yes
7156 realm (G)
7158 This option specifies the kerberos realm to use. The realm is used
7160 as the ADS equivalent of the NT4 domain. It is usually set to the
7161 DNS name of the kerberos server.
7162 Default: realm =
7164 Example: realm = mysambabox.mycompany.com
7166 registry shares (G)
7168 This turns on or off support for share definitions read from
7170 registry. Shares defined in smb.conf take precedence over shares
7171 with the same name defined in registry. See the section on
7172 registry-based configuration for details.
7173 Note that this parameter defaults to no, but it is set to yes when
7175 config backend is set to registry.
7176 Default: registry shares = no
7178 Example: registry shares = yes
7180 reject md5 clients (G)
7182 This option controls whether the netlogon server (currently only in
7184 'active directory domain controller' mode), will reject clients
7185 which does not support NETLOGON_NEG_SUPPORTS_AES.
7186 You can set this to yes if all domain members support aes. This
7188 will prevent downgrade attacks.
7189 This option takes precedence to the 'allow nt4 crypto' option.
7191 Default: reject md5 clients = no
7193 reject md5 servers (G)
7195 This option controls whether winbindd requires support for aes
7197 support for the netlogon secure channel.
7198 The following flags will be required NETLOGON_NEG_ARCFOUR,
7200 NETLOGON_NEG_SUPPORTS_AES, NETLOGON_NEG_PASSWORD_SET2 and
7201 NETLOGON_NEG_AUTHENTICATED_RPC.
7202 You can set this to yes if all domain controllers support aes. This
7204 will prevent downgrade attacks.
7205 The behavior can be controlled per netbios domain by using 'reject
7207 md5 servers:NETBIOSDOMAIN = yes' as option.
7208 This option takes precedence to the require strong key option.
7210 Default: reject md5 servers = no
7212 remote announce (G)
7214 This option allows you to setup nmbd(8) to periodically announce
7216 itself to arbitrary IP addresses with an arbitrary workgroup name.
7217 This is useful if you want your Samba server to appear in a remote
7219 workgroup for which the normal browse propagation rules don't work.
7220 The remote workgroup can be anywhere that you can send IP packets
7221 to.
7222 For example:
7224 remote announce = 192.168.2.255/SERVERS 192.168.4.255/STAFF
7226 the above line would cause nmbd to announce itself to the two given
7228 IP addresses using the given workgroup names. If you leave out the
7229 workgroup name, then the one given in the workgroup parameter is
7230 used instead.
7231 The IP addresses you choose would normally be the broadcast
7233 addresses of the remote networks, but can also be the IP addresses
7234 of known browse masters if your network config is that stable.
7235 See the chapter on Network Browsing in the Samba-HOWTO book.
7237 Default: remote announce =
7239 remote browse sync (G)
7241 This option allows you to setup nmbd(8) to periodically request
7243 synchronization of browse lists with the master browser of a Samba
7244 server that is on a remote segment. This option will allow you to
7245 gain browse lists for multiple workgroups across routed networks.
7246 This is done in a manner that does not work with any non-Samba
7247 servers.
7248 This is useful if you want your Samba server and all local clients
7250 to appear in a remote workgroup for which the normal browse
7251 propagation rules don't work. The remote workgroup can be anywhere
7252 that you can send IP packets to.
7253 For example:
7255 remote browse sync = 192.168.2.255 192.168.4.255
7257 the above line would cause nmbd to request the master browser on
7259 the specified subnets or addresses to synchronize their browse
7260 lists with the local server.
7261 The IP addresses you choose would normally be the broadcast
7263 addresses of the remote networks, but can also be the IP addresses
7264 of known browse masters if your network config is that stable. If a
7265 machine IP address is given Samba makes NO attempt to validate that
7266 the remote machine is available, is listening, nor that it is in
7267 fact the browse master on its segment.
7268 The remote browse sync may be used on networks where there is no
7270 WINS server, and may be used on disjoint networks where each
7271 network has its own WINS server.
7272 Default: remote browse sync =
7274 rename user script (G)
7276 This is the full pathname to a script that will be run as root by
7278 smbd(8) under special circumstances described below.
7279 When a user with admin authority or SeAddUserPrivilege rights
7281 renames a user (e.g.: from the NT4 User Manager for Domains), this
7282 script will be run to rename the POSIX user. Two variables, %uold
7283 and %unew, will be substituted with the old and new usernames,
7284 respectively. The script should return 0 upon successful
7285 completion, and nonzero otherwise.
7286 Note
7288 The script has all responsibility to rename all the necessary
7289 data that is accessible in this posix method. This can mean
7290 different requirements for different backends. The tdbsam and
7291 smbpasswd backends will take care of the contents of their
7292 respective files, so the script is responsible only for
7293 changing the POSIX username, and other data that may required
7294 for your circumstances, such as home directory. Please also
7295 consider whether or not you need to rename the actual home
7296 directories themselves. The ldapsam backend will not make any
7297 changes, because of the potential issues with renaming the LDAP
7298 naming attribute. In this case the script is responsible for
7299 changing the attribute that samba uses (uid) for locating
7300 users, as well as any data that needs to change for other
7301 applications using the same directory.
7302 Default: rename user script =
7303 require strong key (G)
7305 This option controls whether winbindd requires support for md5
7307 strong key support for the netlogon secure channel.
7308 The following flags will be required NETLOGON_NEG_STRONG_KEYS,
7310 NETLOGON_NEG_ARCFOUR and NETLOGON_NEG_AUTHENTICATED_RPC.
7311 You can set this to no if some domain controllers only support des.
7313 This might allows weak crypto to be negotiated, may via downgrade
7314 attacks.
7315 The behavior can be controlled per netbios domain by using 'require
7317 strong key:NETBIOSDOMAIN = no' as option.
7318 Note for active directory domain this option is hardcoded to 'yes'
7320 This option yields precedence to the reject md5 servers option.
7322 This option takes precedence to the client schannel option.
7324 Default: require strong key = yes
7326 reset on zero vc (G)
7328 This boolean option controls whether an incoming SMB1 session setup
7330 should kill other connections coming from the same IP. This matches
7331 the default Windows 2003 behaviour. Setting this parameter to yes
7332 becomes necessary when you have a flaky network and windows decides
7333 to reconnect while the old connection still has files with share
7334 modes open. These files become inaccessible over the new
7335 connection. The client sends a zero VC on the new connection, and
7336 Windows 2003 kills all other connections coming from the same IP.
7337 This way the locked files are accessible again. Please be aware
7338 that enabling this option will kill connections behind a
7339 masquerading router, and will not trigger for clients that only use
7340 SMB2 or SMB3.
7341 Default: reset on zero vc = no
7343 restrict anonymous (G)
7345 The setting of this parameter determines whether SAMR and LSA
7347 DCERPC services can be accessed anonymously. This corresponds to
7348 the following Windows Server registry options:
7349 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\RestrictAnonymous
7351 The option also affects the browse option which is required by
7354 legacy clients which rely on Netbios browsing. While modern Windows
7355 version should be fine with restricting the access there could
7356 still be applications relying on anonymous access.
7357 Setting restrict anonymous = 1 will disable anonymous SAMR access.
7359 Setting restrict anonymous = 2 will, in addition to restricting
7361 SAMR access, disallow anonymous connections to the IPC$ share in
7362 general. Setting guest ok = yes on any share will remove the
7363 security advantage.
7364 Default: restrict anonymous = 0
7366 root
7368 This parameter is a synonym for root directory.
7370 root dir
7372 This parameter is a synonym for root directory.
7374 root directory (G)
7376 The server will chroot() (i.e. Change its root directory) to this
7378 directory on startup. This is not strictly necessary for secure
7379 operation. Even without it the server will deny access to files not
7380 in one of the service entries. It may also check for, and deny
7381 access to, soft links to other parts of the filesystem, or attempts
7382 to use ".." in file names to access other directories (depending on
7383 the setting of the wide smbconfoptions parameter).
7384 Adding a root directory entry other than "/" adds an extra level of
7386 security, but at a price. It absolutely ensures that no access is
7387 given to files not in the sub-tree specified in the root directory
7388 option, including some files needed for complete operation of the
7389 server. To maintain full operability of the server you will need to
7390 mirror some system files into the root directory tree. In
7391 particular you will need to mirror /etc/passwd (or a subset of it),
7392 and any binaries or configuration files needed for printing (if
7393 required). The set of files that must be mirrored is operating
7394 system dependent.
7395 Default: root directory =
7397 Example: root directory = /homes/smb
7399 root postexec (S)
7401 This is the same as the postexec parameter except that the command
7403 is run as root. This is useful for unmounting filesystems (such as
7404 CDROMs) after a connection is closed.
7405 Default: root postexec =
7407 root preexec (S)
7409 This is the same as the preexec parameter except that the command
7411 is run as root. This is useful for mounting filesystems (such as
7412 CDROMs) when a connection is opened.
7413 Default: root preexec =
7415 root preexec close (S)
7417 This is the same as the preexec close parameter except that the
7419 command is run as root.
7420 Default: root preexec close = no
7422 rpc big endian (G)
7424 Setting this option will force the RPC client and server to
7426 transfer data in big endian.
7427 If it is disabled, data will be transferred in little endian.
7429 The behaviour is independent of the endianness of the host machine.
7431 Default: rpc big endian = no
7433 rpc_daemon:DAEMON (G)
7435 Defines whether to use the embedded code or start a separate daemon
7437 for the defined rpc services. The rpc_daemon prefix must be
7438 followed by the server name, and a value.
7439 Two possible values are currently supported:
7441 disabled
7443 fork
7444 The classic method is to run rpc services as internal daemons
7447 embedded in smbd, therefore the external daemons are disabled by
7448 default.
7449 Choosing the fork option will cause samba to fork a separate
7451 process for each daemon configured this way. Each daemon may in
7452 turn fork a number of children used to handle requests from
7453 multiple smbds and direct tcp/ip connections (if the Endpoint
7454 Mapper is enabled). Communication with smbd happens over named
7455 pipes and require that said pipes are forward to the external
7456 daemon (see rpc_server).
7457 Forked RPC Daemons support dynamically forking children to handle
7459 connections. The heuristics about how many children to keep around
7460 and how fast to allow them to fork and also how many clients each
7461 child is allowed to handle concurrently is defined by parametrical
7462 options named after the daemon. Five options are currently
7463 supported:
7464 prefork_min_children
7466 prefork_max_children
7467 prefork_spawn_rate
7468 prefork_max_allowed_clients
7469 prefork_child_min_life
7470 To set one of these options use the following syntax:
7473 daemonname:prefork_min_children = 5
7475 Samba includes separate daemons for spoolss, lsarpc/lsass,
7478 netlogon, samr, FSRVP and mdssvc(Spotlight). Currently five daemons
7479 are available and they are called:
7480 epmd
7482 lsasd
7483 spoolssd
7484 fssd
7485 mdssd
7486 Example:
7489 rpc_daemon:spoolssd = fork
7491 Default: rpc_daemon:DAEMON = disabled
7494 rpc_server:SERVER (G)
7496 With this option you can define if a rpc service should be running
7498 internal/embedded in smbd or should be redirected to an external
7499 daemon like Samba4, the endpoint mapper daemon, the spoolss daemon
7500 or the new LSA service daemon. The rpc_server prefix must be
7501 followed by the pipe name, and a value.
7502 This option can be set for each available rpc service in Samba. The
7504 following list shows all available pipe names services you can
7505 modify with this option.
7506 · epmapper - Endpoint Mapper
7508 · winreg - Remote Registry Service
7510 · srvsvc - Remote Server Services
7512 · lsarpc - Local Security Authority
7514 · samr - Security Account Management
7516 · netlogon - Netlogon Remote Protocol
7518 · netdfs - Settings for Distributed File System
7520 · dssetup - Active Directory Setup
7522 · wkssvc - Workstation Services
7524 · spoolss - Network Printing Spooler
7526 · svcctl - Service Control
7528 · ntsvcs - Plug and Play Services
7530 · eventlog - Event Logger
7532 · initshutdown - Init Shutdown Service
7534 · mdssvc - Spotlight
7536 Three possible values currently supported are: embedded external
7538 disabled
7539 The classic method is to run every pipe as an internal function
7541 embedded in smbd. The defaults may vary depending on the service.
7542 Choosing the external option allows one to run a separate daemon or
7544 even a completely independent (3rd party) server capable of
7545 interfacing with samba via the MS-RPC interface over named pipes.
7546 Currently in Samba3 we support four daemons, spoolssd, epmd, lsasd
7548 and mdssd. These daemons can be enabled using the rpc_daemon
7549 option. For spoolssd you have to enable the daemon and proxy the
7550 named pipe with:
7551 Examples:
7553 rpc_daemon:lsasd = fork
7555 rpc_server:lsarpc = external
7556 rpc_server:samr = external
7557 rpc_server:netlogon = external
7558 rpc_server:spoolss = external
7560 rpc_server:epmapper = disabled
7561 rpc_daemon:mdssd = fork
7563 rpc_server:mdssvc = external
7564 There is one special option which allows you to enable rpc services
7567 to listen for ncacn_ip_tcp connections too. Currently this is only
7568 used for testing and doesn't scale!
7569 rpc_server:tcpip = yes
7571 Default: rpc_server:SERVER = embedded
7574 rpc server dynamic port range (G)
7576 This parameter tells the RPC server which port range it is allowed
7578 to use to create a listening socket for LSA, SAM, Netlogon and
7579 others without wellknown tcp ports. The first value is the lowest
7580 number of the port range and the second the highest.
7581 This applies to RPC servers in all server roles.
7583 Default: rpc server dynamic port range = 49152-65535
7585 rpc server port (G)
7587 Specifies which port the server should listen on for DCE/RPC over
7589 TCP/IP traffic.
7590 This controls the default port for all protocols, except for
7592 NETLOGON.
7593 If unset, the first available port from rpc server dynamic port
7595 range is used, e.g. 49152.
7596 The NETLOGON server will use the next available port, e.g. 49153.
7598 To change this port use (eg) rpc server port:netlogon = 4000.
7599 Furthermore, all RPC servers can have the port they use specified
7601 independenty, with (for example) rpc server port:drsuapi = 5000.
7602 This option applies currently only when samba(8) runs as an active
7604 directory domain controller.
7605 The default value 0 causes Samba to select the first available port
7607 from rpc server dynamic port range.
7608 Default: rpc server port = 0
7610 samba kcc command (G)
7612 This option specifies the path to the Samba KCC command. This
7614 script is used for replication topology replication.
7615 It should not be necessary to modify this option except for testing
7617 purposes or if the samba_kcc was installed in a non-default
7618 location.
7619 Default: samba kcc command =
7621 /builddir/build/BUILD/samba-4.12.2/source4/scripting/bin/samba_kcc
7622 Example: samba kcc command = /usr/local/bin/kcc
7624 security (G)
7626 This option affects how clients respond to Samba and is one of the
7628 most important settings in the smb.conf file.
7629 The default is security = user, as this is the most common setting,
7631 used for a standalone file server or a DC.
7632 The alternatives are security = ads or security = domain, which
7634 support joining Samba to a Windows domain
7635 You should use security = user and map to guest if you want to
7637 mainly setup shares without a password (guest shares). This is
7638 commonly used for a shared printer server.
7639 The different settings will now be explained.
7641 SECURITY = AUTO
7643 This is the default security setting in Samba, and causes Samba to
7645 consult the server role parameter (if set) to determine the
7646 security mode.
7647 SECURITY = USER
7649 If server role is not specified, this is the default security
7651 setting in Samba. With user-level security a client must first
7652 "log-on" with a valid username and password (which can be mapped
7653 using the username map parameter). Encrypted passwords (see the
7654 encrypted passwords parameter) can also be used in this security
7655 mode. Parameters such as user and guest only if set are then
7656 applied and may change the UNIX user to use on this connection, but
7657 only after the user has been successfully authenticated.
7658 Note that the name of the resource being requested is not sent to
7660 the server until after the server has successfully authenticated
7661 the client. This is why guest shares don't work in user level
7662 security without allowing the server to automatically map unknown
7663 users into the guest account. See the map to guest parameter for
7664 details on doing this.
7665 SECURITY = DOMAIN
7667 This mode will only work correctly if net(8) has been used to add
7669 this machine into a Windows NT Domain. It expects the encrypted
7670 passwords parameter to be set to yes. In this mode Samba will try
7671 to validate the username/password by passing it to a Windows NT
7672 Primary or Backup Domain Controller, in exactly the same way that a
7673 Windows NT Server would do.
7674 Note that a valid UNIX user must still exist as well as the account
7676 on the Domain Controller to allow Samba to have a valid UNIX
7677 account to map file access to.
7678 Note that from the client's point of view security = domain is the
7680 same as security = user. It only affects how the server deals with
7681 the authentication, it does not in any way affect what the client
7682 sees.
7683 Note that the name of the resource being requested is not sent to
7685 the server until after the server has successfully authenticated
7686 the client. This is why guest shares don't work in user level
7687 security without allowing the server to automatically map unknown
7688 users into the guest account. See the map to guest parameter for
7689 details on doing this.
7690 See also the password server parameter and the encrypted passwords
7692 parameter.
7693 SECURITY = ADS
7695 In this mode, Samba will act as a domain member in an ADS realm. To
7697 operate in this mode, the machine running Samba will need to have
7698 Kerberos installed and configured and Samba will need to be joined
7699 to the ADS realm using the net utility.
7700 Note that this mode does NOT make Samba operate as a Active
7702 Directory Domain Controller.
7703 Note that this forces require strong key = yes and client schannel
7705 = yes for the primary domain.
7706 Read the chapter about Domain Membership in the HOWTO for details.
7708 Default: security = AUTO
7710 Example: security = DOMAIN
7712 security mask (S)
7714 This parameter has been removed for Samba 4.0.0.
7716 No default
7718 max protocol
7720 This parameter is a synonym for server max protocol.
7722 protocol
7724 This parameter is a synonym for server max protocol.
7726 server max protocol (G)
7728 The value of the parameter (a string) is the highest protocol level
7730 that will be supported by the server.
7731 Possible values are :
7733 · LANMAN1: First modern version of the protocol. Long
7735 filename support.
7736 · LANMAN2: Updates to Lanman1 protocol.
7738 · NT1: Current up to date version of the protocol. Used by
7740 Windows NT. Known as CIFS.
7741 · SMB2: Re-implementation of the SMB protocol. Used by
7743 Windows Vista and later versions of Windows. SMB2 has
7744 sub protocols available.
7745 · SMB2_02: The earliest SMB2 version.
7747 · SMB2_10: Windows 7 SMB2 version.
7749 · SMB2_22: Early Windows 8 SMB2 version.
7751 · SMB2_24: Windows 8 beta SMB2 version.
7753 By default SMB2 selects the SMB2_10 variant.
7755 · SMB3: The same as SMB2. Used by Windows 8. SMB3 has sub
7757 protocols available.
7758 · SMB3_00: Windows 8 SMB3 version. (mostly the
7760 same as SMB2_24)
7761 · SMB3_02: Windows 8.1 SMB3 version.
7763 · SMB3_10: early Windows 10 technical preview
7765 SMB3 version.
7766 · SMB3_11: Windows 10 technical preview SMB3
7768 version (maybe final).
7769 By default SMB3 selects the SMB3_11 variant.
7771 Normally this option should not be set as the automatic negotiation
7773 phase in the SMB protocol takes care of choosing the appropriate
7774 protocol.
7775 Default: server max protocol = SMB3
7777 Example: server max protocol = LANMAN1
7779 min protocol
7781 This parameter is a synonym for server min protocol.
7783 server min protocol (G)
7785 This setting controls the minimum protocol version that the server
7787 will allow the client to use.
7788 Normally this option should not be set as the automatic negotiation
7790 phase in the SMB protocol takes care of choosing the appropriate
7791 protocol unless you have legacy clients which are SMB1 capable
7792 only.
7793 See Related command: server max protocol for a full list of
7795 available protocols.
7796 Default: server min protocol = SMB2_02
7798 Example: server min protocol = NT1
7800 server multi channel support (G)
7802 This boolean parameter controls whether smbd(8) will support SMB3
7804 multi-channel.
7805 This parameter was added with version 4.4.
7807 Warning: Note that this feature is still considered experimental.
7809 Use it at your own risk: Even though it may seem to work well in
7810 testing, it may result in data corruption under some race
7811 conditions. Future releases may improve this situation.
7812 Default: server multi channel support = no
7814 server role (G)
7816 This option determines the basic operating mode of a Samba server
7818 and is one of the most important settings in the smb.conf file.
7819 The default is server role = auto, as causes Samba to operate
7821 according to the security setting, or if not specified as a simple
7822 file server that is not connected to any domain.
7823 The alternatives are server role = standalone or server role =
7825 member server, which support joining Samba to a Windows domain,
7826 along with server role = domain controller, which run Samba as a
7827 Windows domain controller.
7828 You should use server role = standalone and map to guest if you
7830 want to mainly setup shares without a password (guest shares). This
7831 is commonly used for a shared printer server.
7832 SERVER ROLE = AUTO
7834 This is the default server role in Samba, and causes Samba to
7836 consult the security parameter (if set) to determine the server
7837 role, giving compatible behaviours to previous Samba versions.
7838 SERVER ROLE = STANDALONE
7840 If security is also not specified, this is the default security
7842 setting in Samba. In standalone operation, a client must first
7843 "log-on" with a valid username and password (which can be mapped
7844 using the username map parameter) stored on this machine. Encrypted
7845 passwords (see the encrypted passwords parameter) are by default
7846 used in this security mode. Parameters such as user and guest only
7847 if set are then applied and may change the UNIX user to use on this
7848 connection, but only after the user has been successfully
7849 authenticated.
7850 SERVER ROLE = MEMBER SERVER
7852 This mode will only work correctly if net(8) has been used to add
7854 this machine into a Windows Domain. It expects the encrypted
7855 passwords parameter to be set to yes. In this mode Samba will try
7856 to validate the username/password by passing it to a Windows or
7857 Samba Domain Controller, in exactly the same way that a Windows
7858 Server would do.
7859 Note that a valid UNIX user must still exist as well as the account
7861 on the Domain Controller to allow Samba to have a valid UNIX
7862 account to map file access to. Winbind can provide this.
7863 SERVER ROLE = CLASSIC PRIMARY DOMAIN CONTROLLER
7865 This mode of operation runs a classic Samba primary domain
7867 controller, providing domain logon services to Windows and Samba
7868 clients of an NT4-like domain. Clients must be joined to the domain
7869 to create a secure, trusted path across the network. There must be
7870 only one PDC per NetBIOS scope (typcially a broadcast network or
7871 clients served by a single WINS server).
7872 SERVER ROLE = CLASSIC BACKUP DOMAIN CONTROLLER
7874 This mode of operation runs a classic Samba backup domain
7876 controller, providing domain logon services to Windows and Samba
7877 clients of an NT4-like domain. As a BDC, this allows multiple Samba
7878 servers to provide redundant logon services to a single NetBIOS
7879 scope.
7880 SERVER ROLE = ACTIVE DIRECTORY DOMAIN CONTROLLER
7882 This mode of operation runs Samba as an active directory domain
7884 controller, providing domain logon services to Windows and Samba
7885 clients of the domain. This role requires special configuration,
7886 see the Samba4 HOWTO
7887 Default: server role = AUTO
7889 Example: server role = ACTIVE DIRECTORY DOMAIN CONTROLLER
7891 server schannel (G)
7893 This option is deprecated with Samba 4.8 and will be removed in
7895 future. At the same time the default changed to yes, which will be
7896 the hardcoded behavior in future. If you have the need for the
7897 behavior of "auto" to be kept, please file a bug at
7898 https://bugzilla.samba.org.
7899 This controls whether the server offers or even demands the use of
7901 the netlogon schannel. server schannel = no does not offer the
7902 schannel, server schannel = auto offers the schannel but does not
7903 enforce it, and server schannel = yes denies access if the client
7904 is not able to speak netlogon schannel. This is only the case for
7905 Windows NT4 before SP4.
7906 Please note that with this set to no, you will have to apply the
7908 WindowsXP WinXP_SignOrSeal.reg registry patch found in the
7909 docs/registry subdirectory of the Samba distribution tarball.
7910 Default: server schannel = yes
7912 Example: server schannel = auto
7914 server services (G)
7916 This option contains the services that the Samba daemon will run.
7918 An entry in the smb.conf file can either override the previous
7920 value completely or entries can be removed from or added to it by
7921 prefixing them with + or -.
7922 Default: server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc,
7924 drepl, winbindd, ntp_signd, kcc, dnsupdate, dns
7925 Example: server services = -s3fs, +smb
7927 server signing (G)
7929 This controls whether the client is allowed or required to use SMB1
7931 and SMB2 signing. Possible values are default, auto, mandatory and
7932 disabled.
7933 By default, and when smb signing is set to default, smb signing is
7935 required when server role is active directory domain controller and
7936 disabled otherwise.
7937 When set to auto, SMB1 signing is offered, but not enforced. When
7939 set to mandatory, SMB1 signing is required and if set to disabled,
7940 SMB signing is not offered either.
7941 For the SMB2 protocol, by design, signing cannot be disabled. In
7943 the case where SMB2 is negotiated, if this parameter is set to
7944 disabled, it will be treated as auto. Setting it to mandatory will
7945 still require SMB2 clients to use signing.
7946 Default: server signing = default
7948 server string (G)
7950 This controls what string will show up in the printer comment box
7952 in print manager and next to the IPC connection in net view. It can
7953 be any string that you wish to show to your users.
7954 It also sets what will appear in browse lists next to the machine
7956 name.
7957 A %v will be replaced with the Samba version number.
7959 A %h will be replaced with the hostname.
7961 Default: server string = Samba %v
7963 Example: server string = University of GNUs Samba Server
7965 set primary group script (G)
7967 Thanks to the Posix subsystem in NT a Windows User has a primary
7969 group in addition to the auxiliary groups. This script sets the
7970 primary group in the unix user database when an administrator sets
7971 the primary group from the windows user manager or when fetching a
7972 SAM with net rpc vampire. %u will be replaced with the user whose
7973 primary group is to be set. %g will be replaced with the group to
7974 set.
7975 Default: set primary group script =
7977 Example: set primary group script = /usr/sbin/usermod -g '%g' '%u'
7979 set quota command (G)
7981 The set quota command should only be used whenever there is no
7983 operating system API available from the OS that samba can use.
7984 This option is only available if Samba was compiled with quota
7986 support.
7987 This parameter should specify the path to a script that can set
7989 quota for the specified arguments.
7990 The specified script should take the following arguments:
7992 · 1 - path to where the quota needs to be set. This needs
7994 to be interpreted relative to the current working
7995 directory that the script may also check for.
7996 · 2 - quota type
7998 · 1 - user quotas
8000 · 2 - user default quotas (uid = -1)
8002 · 3 - group quotas
8004 · 4 - group default quotas (gid = -1)
8006 · 3 - id (uid for user, gid for group, -1 if N/A)
8009 · 4 - quota state (0 = disable, 1 = enable, 2 = enable and
8011 enforce)
8012 · 5 - block softlimit
8014 · 6 - block hardlimit
8016 · 7 - inode softlimit
8018 · 8 - inode hardlimit
8020 · 9(optional) - block size, defaults to 1024
8022 The script should output at least one line of data on success. And
8024 nothing on failure.
8025 Default: set quota command =
8027 Example: set quota command = /usr/local/sbin/set_quota
8029 share backend (G)
8031 This option specifies the backend that will be used to access the
8033 configuration of file shares.
8034 Traditionally, Samba file shares have been configured in the
8036 smb.conf file and this is still the default.
8037 At the moment there are no other supported backends.
8039 Default: share backend = classic
8041 share:fake_fscaps (G)
8043 This is needed to support some special application that makes
8045 QFSINFO calls to check whether we set the SPARSE_FILES bit (0x40).
8046 If this bit is not set that particular application refuses to work
8047 against Samba. With share:fake_fscaps = 64 the SPARSE_FILES file
8048 system capability flag is set. Use other decimal values to specify
8049 the bitmask you need to fake.
8050 Default: share:fake_fscaps = 0
8052 short preserve case (S)
8054 This boolean parameter controls if new files which conform to 8.3
8056 syntax, that is all in upper case and of suitable length, are
8057 created upper case, or if they are forced to be the default case.
8058 This option can be use with preserve case = yes to permit long
8059 filenames to retain their case, while short names are lowered.
8060 See the section on NAME MANGLING.
8062 Default: short preserve case = yes
8064 show add printer wizard (G)
8066 With the introduction of MS-RPC based printing support for Windows
8068 NT/2000 client in Samba 2.2, a "Printers..." folder will appear on
8069 Samba hosts in the share listing. Normally this folder will contain
8070 an icon for the MS Add Printer Wizard (APW). However, it is
8071 possible to disable this feature regardless of the level of
8072 privilege of the connected user.
8073 Under normal circumstances, the Windows NT/2000 client will open a
8075 handle on the printer server with OpenPrinterEx() asking for
8076 Administrator privileges. If the user does not have administrative
8077 access on the print server (i.e is not root or has granted the
8078 SePrintOperatorPrivilege), the OpenPrinterEx() call fails and the
8079 client makes another open call with a request for a lower privilege
8080 level. This should succeed, however the APW icon will not be
8081 displayed.
8082 Disabling the show add printer wizard parameter will always cause
8084 the OpenPrinterEx() on the server to fail. Thus the APW icon will
8085 never be displayed.
8086 Note
8088 This does not prevent the same user from having administrative
8089 privilege on an individual printer.
8090 Default: show add printer wizard = yes
8091 shutdown script (G)
8093 This a full path name to a script called by smbd(8) that should
8095 start a shutdown procedure.
8096 If the connected user possesses the SeRemoteShutdownPrivilege,
8098 right, this command will be run as root.
8099 The %z %t %r %f variables are expanded as follows:
8101 · %z will be substituted with the shutdown message sent to
8103 the server.
8104 · %t will be substituted with the number of seconds to
8106 wait before effectively starting the shutdown procedure.
8107 · %r will be substituted with the switch -r. It means
8109 reboot after shutdown for NT.
8110 · %f will be substituted with the switch -f. It means
8112 force the shutdown even if applications do not respond
8113 for NT.
8114 Shutdown script example:
8116 #!/bin/bash
8118 time=$2
8120 let time="${time} / 60"
8121 let time="${time} + 1"
8122 /sbin/shutdown $3 $4 +$time $1 &
8124 Shutdown does not return so we need to launch it in background.
8127 Default: shutdown script =
8129 Example: shutdown script = /usr/local/samba/sbin/shutdown %m %t %r
8131 %f
8132 smb2 leases (G)
8134 This boolean option tells smbd whether to globally negotiate SMB2
8136 leases on file open requests. Leasing is an SMB2-only feature which
8137 allows clients to aggressively cache files locally above and beyond
8138 the caching allowed by SMB1 oplocks.
8139 This is only available with oplocks = yes and kernel oplocks = no.
8141 Note that the write cache won't be used for file handles with a
8143 smb2 write lease.
8144 Default: smb2 leases = yes
8146 smb2 max credits (G)
8148 This option controls the maximum number of outstanding simultaneous
8150 SMB2 operations that Samba tells the client it will allow. This is
8151 similar to the max mux parameter for SMB1. You should never need to
8152 set this parameter.
8153 The default is 8192 credits, which is the same as a Windows 2008R2
8155 SMB2 server.
8156 Default: smb2 max credits = 8192
8158 smb2 max read (G)
8160 This option specifies the protocol value that smbd(8) will return
8162 to a client, informing the client of the largest size that may be
8163 returned by a single SMB2 read call.
8164 The maximum is 8388608 bytes (8MiB), which is the same as a Windows
8166 Server 2012 r2.
8167 Please note that the default is 8MiB, but it's limit is based on
8169 the smb2 dialect (64KiB for SMB == 2.0, 8MiB for SMB >= 2.1 with
8170 LargeMTU). Large MTU is not supported over NBT (tcp port 139).
8171 Default: smb2 max read = 8388608
8173 smb2 max trans (G)
8175 This option specifies the protocol value that smbd(8) will return
8177 to a client, informing the client of the largest size of buffer
8178 that may be used in querying file meta-data via QUERY_INFO and
8179 related SMB2 calls.
8180 The maximum is 8388608 bytes (8MiB), which is the same as a Windows
8182 Server 2012 r2.
8183 Please note that the default is 8MiB, but it's limit is based on
8185 the smb2 dialect (64KiB for SMB == 2.0, 1MiB for SMB >= 2.1 with
8186 LargeMTU). Large MTU is not supported over NBT (tcp port 139).
8187 Default: smb2 max trans = 8388608
8189 smb2 max write (G)
8191 This option specifies the protocol value that smbd(8) will return
8193 to a client, informing the client of the largest size that may be
8194 sent to the server by a single SMB2 write call.
8195 The maximum is 8388608 bytes (8MiB), which is the same as a Windows
8197 Server 2012 r2.
8198 Please note that the default is 8MiB, but it's limit is based on
8200 the smb2 dialect (64KiB for SMB == 2.0, 8MiB for SMB => 2.1 with
8201 LargeMTU). Large MTU is not supported over NBT (tcp port 139).
8202 Default: smb2 max write = 8388608
8204 smbd async dosmode (S)
8206 This parameter control whether the fileserver will use sync or
8208 async methods for fetching the DOS attributes when doing a
8209 directory listing. By default sync methods will be used.
8210 Default: smbd async dosmode = no
8212 smbd getinfo ask sharemode (S)
8214 This parameter allows disabling fetching file write time from the
8216 open file handle database locking.tdb when a client requests file
8217 or directory metadata. It's a performance optimisation at the
8218 expense of protocol correctness.
8219 Default: smbd getinfo ask sharemode = yes
8221 smbd max async dosmode (S)
8223 This parameter controls how many async operations to fetch the DOS
8225 attributes the fileserver will queue when doing directory listings.
8226 Default: smbd max async dosmode = aio max threads * 2
8228 smbd profiling level (G)
8230 This parameter allows the administrator to enable profiling
8232 support.
8233 Possible values are off, count and on.
8235 Default: smbd profiling level = off
8237 Example: smbd profiling level = on
8239 smbd search ask sharemode (S)
8241 This parameter allows disabling fetching file write time from the
8243 open file handle database locking.tdb. It's a performance
8244 optimisation at the expense of protocol correctness.
8245 Default: smbd search ask sharemode = yes
8247 smb encrypt (S)
8249 This parameter controls whether a remote client is allowed or
8251 required to use SMB encryption. It has different effects depending
8252 on whether the connection uses SMB1 or SMB2 and newer:
8253 · If the connection uses SMB1, then this option controls
8255 the use of a Samba-specific extension to the SMB
8256 protocol introduced in Samba 3.2 that makes use of the
8257 Unix extensions.
8258 · If the connection uses SMB2 or newer, then this option
8260 controls the use of the SMB-level encryption that is
8261 supported in SMB version 3.0 and above and available in
8262 Windows 8 and newer.
8263 This parameter can be set globally and on a per-share bases.
8265 Possible values are off (or disabled), enabled (or auto, or
8266 if_required), desired, and required (or mandatory). A special value
8267 is default which is the implicit default setting of enabled.
8268 Effects for SMB1
8270 The Samba-specific encryption of SMB1 connections is an
8271 extension to the SMB protocol negotiated as part of the UNIX
8272 extensions. SMB encryption uses the GSSAPI (SSPI on Windows)
8273 ability to encrypt and sign every request/response in a SMB
8274 protocol stream. When enabled it provides a secure method of
8275 SMB/CIFS communication, similar to an ssh protected session,
8276 but using SMB/CIFS authentication to negotiate encryption and
8277 signing keys. Currently this is only supported smbclient of by
8278 Samba 3.2 and newer, and hopefully soon Linux CIFSFS and
8279 MacOS/X clients. Windows clients do not support this feature.
8280 This may be set on a per-share basis, but clients may chose to
8282 encrypt the entire session, not just traffic to a specific
8283 share. If this is set to mandatory then all traffic to a share
8284 must be encrypted once the connection has been made to the
8285 share. The server would return "access denied" to all
8286 non-encrypted requests on such a share. Selecting encrypted
8287 traffic reduces throughput as smaller packet sizes must be used
8288 (no huge UNIX style read/writes allowed) as well as the
8289 overhead of encrypting and signing all the data.
8290 If SMB encryption is selected, Windows style SMB signing (see
8292 the server signing option) is no longer necessary, as the
8293 GSSAPI flags use select both signing and sealing of the data.
8294 When set to auto or default, SMB encryption is offered, but not
8296 enforced. When set to mandatory, SMB encryption is required and
8297 if set to disabled, SMB encryption can not be negotiated.
8298 Effects for SMB2
8300 Native SMB transport encryption is available in SMB version 3.0
8301 or newer. It is only offered by Samba if server max protocol is
8302 set to SMB3 or newer. Clients supporting this type of
8303 encryption include Windows 8 and newer, Windows server 2012 and
8304 newer, and smbclient of Samba 4.1 and newer.
8305 The protocol implementation offers various options:
8307 · The capability to perform SMB encryption can be
8309 negotiated during protocol negotiation.
8310 · Data encryption can be enabled globally. In that
8312 case, an encryption-capable connection will have all
8313 traffic in all its sessions encrypted. In particular
8314 all share connections will be encrypted.
8315 · Data encryption can also be enabled per share if not
8317 enabled globally. For an encryption-capable
8318 connection, all connections to an encryption-enabled
8319 share will be encrypted.
8320 · Encryption can be enforced. This means that session
8322 setups will be denied on non-encryption-capable
8323 connections if data encryption has been enabled
8324 globally. And tree connections will be denied for
8325 non-encryption capable connections to shares with
8326 data encryption enabled.
8327 These features can be controlled with settings of smb encrypt
8329 as follows:
8330 · Leaving it as default, explicitly setting default,
8332 or setting it to enabled globally will enable
8333 negotiation of encryption but will not turn on data
8334 encryption globally or per share.
8335 · Setting it to desired globally will enable
8337 negotiation and will turn on data encryption on
8338 sessions and share connections for those clients
8339 that support it.
8340 · Setting it to required globally will enable
8342 negotiation and turn on data encryption on sessions
8343 and share connections. Clients that do not support
8344 encryption will be denied access to the server.
8345 · Setting it to off globally will completely disable
8347 the encryption feature for all connections. Setting
8348 smb encrypt = required for individual shares (while
8349 it's globally off) will deny access to this shares
8350 for all clients.
8351 · Setting it to desired on a share will turn on data
8353 encryption for this share for clients that support
8354 encryption if negotiation has been enabled globally.
8355 · Setting it to required on a share will enforce data
8357 encryption for this share if negotiation has been
8358 enabled globally. I.e. clients that do not support
8359 encryption will be denied access to the share.
8360 Note that this allows per-share enforcing to be
8362 controlled in Samba differently from Windows: In
8363 Windows, RejectUnencryptedAccess is a global
8364 setting, and if it is set, all shares with data
8365 encryption turned on are automatically enforcing
8366 encryption. In order to achieve the same effect in
8367 Samba, one has to globally set smb encrypt to
8368 enabled, and then set all shares that should be
8369 encrypted to required. Additionally, it is possible
8370 in Samba to have some shares with encryption
8371 required and some other shares with encryption only
8372 desired, which is not possible in Windows.
8373 · Setting it to off or enabled for a share has no
8375 effect.
8376 Default: smb encrypt = default
8379 smb passwd file (G)
8381 This option sets the path to the encrypted smbpasswd file. By
8383 default the path to the smbpasswd file is compiled into Samba.
8384 An example of use is:
8386 smb passwd file = /etc/samba/smbpasswd
8388 Default: smb passwd file = /var/lib/samba/private/smbpasswd
8390 smb ports (G)
8392 Specifies which ports the server should listen on for SMB traffic.
8394 Default: smb ports = 445 139
8396 socket options (G)
8398 Warning
8400 Modern server operating systems are tuned for high network
8401 performance in the majority of situations; when you set socket
8402 options you are overriding those settings. Linux in particular
8403 has an auto-tuning mechanism for buffer sizes that will be
8404 disabled if you specify a socket buffer size. This can
8405 potentially cripple your TCP/IP stack.
8406 Getting the socket options correct can make a big difference to
8408 your performance, but getting them wrong can degrade it by just
8409 as much. As with any other low level setting, if you must make
8410 changes to it, make small changes and test the effect before
8411 making any large changes.
8412 This option allows you to set socket options to be used when
8414 talking with the client.
8415 Socket options are controls on the networking layer of the
8417 operating systems which allow the connection to be tuned.
8418 This option will typically be used to tune your Samba server for
8420 optimal performance for your local network. There is no way that
8421 Samba can know what the optimal parameters are for your net, so you
8422 must experiment and choose them yourself. We strongly suggest you
8423 read the appropriate documentation for your operating system first
8424 (perhaps man setsockopt will help).
8425 You may find that on some systems Samba will say "Unknown socket
8427 option" when you supply an option. This means you either
8428 incorrectly typed it or you need to add an include file to
8429 includes.h for your OS. If the latter is the case please send the
8430 patch to samba-technical@lists.samba.org.
8431 Any of the supported socket options may be combined in any way you
8433 like, as long as your OS allows it.
8434 This is the list of socket options currently settable using this
8436 option:
8437 · SO_KEEPALIVE
8439 · SO_REUSEADDR
8441 · SO_BROADCAST
8443 · TCP_NODELAY
8445 · TCP_KEEPCNT *
8447 · TCP_KEEPIDLE *
8449 · TCP_KEEPINTVL *
8451 · IPTOS_LOWDELAY
8453 · IPTOS_THROUGHPUT
8455 · SO_REUSEPORT
8457 · SO_SNDBUF *
8459 · SO_RCVBUF *
8461 · SO_SNDLOWAT *
8463 · SO_RCVLOWAT *
8465 · SO_SNDTIMEO *
8467 · SO_RCVTIMEO *
8469 · TCP_FASTACK *
8471 · TCP_QUICKACK
8473 · TCP_NODELAYACK
8475 · TCP_KEEPALIVE_THRESHOLD *
8477 · TCP_KEEPALIVE_ABORT_THRESHOLD *
8479 · TCP_DEFER_ACCEPT *
8481 Those marked with a '*' take an integer argument. The others can
8483 optionally take a 1 or 0 argument to enable or disable the option,
8484 by default they will be enabled if you don't specify 1 or 0.
8485 To specify an argument use the syntax SOME_OPTION = VALUE for
8487 example SO_SNDBUF = 8192. Note that you must not have any spaces
8488 before or after the = sign.
8489 If you are on a local network then a sensible option might be:
8491 socket options = IPTOS_LOWDELAY
8493 If you have a local network then you could try:
8495 socket options = IPTOS_LOWDELAY TCP_NODELAY
8497 If you are on a wide area network then perhaps try setting
8499 IPTOS_THROUGHPUT.
8500 Note that several of the options may cause your Samba server to
8502 fail completely. Use these options with caution!
8503 Default: socket options = TCP_NODELAY
8505 Example: socket options = IPTOS_LOWDELAY
8507 spn update command (G)
8509 This option sets the command that for updating servicePrincipalName
8511 names from spn_update_list.
8512 Default: spn update command =
8514 /builddir/build/BUILD/samba-4.12.2/source4/scripting/bin/samba_spnupdate
8515 Example: spn update command = /usr/local/sbin/spnupdate
8517 spoolss: architecture (G)
8519 Windows spoolss print clients only allow association of server-side
8521 drivers with printers when the driver architecture matches the
8522 advertised print server architecture. Samba's spoolss print server
8523 architecture can be changed using this parameter.
8524 Default: spoolss: architecture = Windows NT x86
8526 Example: spoolss: architecture = Windows x64
8528 spoolss: os_major (G)
8530 Windows might require a new os version number. This option allows
8532 to modify the build number. The complete default version number is:
8533 5.0.2195 (Windows 2000). The example is 6.1.7601 (Windows 2008 R2).
8534 Default: spoolss: os_major = 5
8536 Example: spoolss: os_major = 6
8538 spoolss: os_minor (G)
8540 Windows might require a new os version number. This option allows
8542 to modify the build number. The complete default version number is:
8543 5.0.2195 (Windows 2000). The example is 6.1.7601 (Windows 2008 R2).
8544 Default: spoolss: os_minor = 0
8546 Example: spoolss: os_minor = 1
8548 spoolss: os_build (G)
8550 Windows might require a new os version number. This option allows
8552 to modify the build number. The complete default version number is:
8553 5.0.2195 (Windows 2000). The example is 6.1.7601 (Windows 2008 R2).
8554 Default: spoolss: os_build = 2195
8556 Example: spoolss: os_build = 7601
8558 spoolss_client: os_major (G)
8560 Windows might require a new os version number. This option allows
8562 to modify the build number. The complete default version number is:
8563 6.1.7007 (Windows 7 and Windows Server 2008 R2).
8564 Default: spoolss_client: os_major = 6
8566 spoolss_client: os_minor (G)
8568 Windows might require a new os version number. This option allows
8570 to modify the build number. The complete default version number is:
8571 6.1.7007 (Windows 7 and Windows Server 2008 R2).
8572 Default: spoolss_client: os_minor = 1
8574 spoolss_client: os_build (G)
8576 Windows might require a new os version number. This option allows
8578 to modify the build number. The complete default version number is:
8579 6.1.7007 (Windows 7 and Windows Server 2008 R2).
8580 Default: spoolss_client: os_build = 7007
8582 spotlight (S)
8584 This parameter controls whether Samba allows Spotlight queries on a
8586 share. For controlling indexing of filesystems you also have to use
8587 Tracker's own configuration system.
8588 Spotlight has several prerequisites:
8590 · Samba must be configured and built with Spotlight
8592 support.
8593 · The mdssvc RPC service must be enabled, see below.
8595 · Tracker integration must be setup and the share must be
8597 indexed by Tracker.
8598 For a detailed set of instructions please see
8600 https://wiki.samba.org/index.php/Spotlight.
8601 The Spotlight RPC service can either be enabled as embedded RPC
8603 service:
8604 [Global]
8606 rpc_server:mdsvc = embedded
8607 Or it can be run in a separate RPC service daemon:
8609 [Global]
8611 rpc_server:mdssd = fork
8612 rpc_server:mdsvc = external
8613 Default: spotlight = no
8615 spotlight backend (S)
8617 Spotlight search backend. Available backends:
8619 · noindex - a backend that returns no results.
8621 · tracker - Gnome Tracker.
8624 · elasticsearch - a backend that uses JSON and REST over
8626 HTTP(s) to query an Elasticsearch server.
8627 Default: spotlight backend = noindex
8630 stat cache (G)
8632 This parameter determines if smbd(8) will use a cache in order to
8634 speed up case insensitive name mappings. You should never need to
8635 change this parameter.
8636 Default: stat cache = yes
8638 state directory (G)
8640 Usually, most of the TDB files are stored in the lock directory.
8642 Since Samba 3.4.0, it is possible to differentiate between TDB
8643 files with persistent data and TDB files with non-persistent data
8644 using the state directory and the cache directory options.
8645 This option specifies the directory where TDB files containing
8647 important persistent data will be stored.
8648 Default: state directory = /var/lib/samba
8650 Example: state directory = /var/run/samba/locks/state
8652 store dos attributes (S)
8654 If this parameter is set Samba attempts to first read DOS
8656 attributes (SYSTEM, HIDDEN, ARCHIVE or READ-ONLY) from a filesystem
8657 extended attribute, before mapping DOS attributes to UNIX
8658 permission bits (such as occurs with map hidden and map readonly).
8659 When set, DOS attributes will be stored onto an extended attribute
8660 in the UNIX filesystem, associated with the file or directory. When
8661 this parameter is set it will override the parameters map hidden,
8662 map system, map archive and map readonly and they will behave as if
8663 they were set to off. This parameter writes the DOS attributes as a
8664 string into the extended attribute named "user.DOSATTRIB". This
8665 extended attribute is explicitly hidden from smbd clients
8666 requesting an EA list. On Linux the filesystem must have been
8667 mounted with the mount option user_xattr in order for extended
8668 attributes to work, also extended attributes must be compiled into
8669 the Linux kernel. In Samba 3.5.0 and above the "user.DOSATTRIB"
8670 extended attribute has been extended to store the create time for a
8671 file as well as the DOS attributes. This is done in a backwards
8672 compatible way so files created by Samba 3.5.0 and above can still
8673 have the DOS attribute read from this extended attribute by earlier
8674 versions of Samba, but they will not be able to read the create
8675 time stored there. Storing the create time separately from the
8676 normal filesystem meta-data allows Samba to faithfully reproduce
8677 NTFS semantics on top of a POSIX filesystem. The default has
8678 changed to yes in Samba release 4.9.0 and above to allow better
8679 Windows fileserver compatibility in a default install.
8680 Default: store dos attributes = yes
8682 strict allocate (S)
8684 This is a boolean that controls the handling of disk space
8686 allocation in the server. When this is set to yes the server will
8687 change from UNIX behaviour of not committing real disk storage
8688 blocks when a file is extended to the Windows behaviour of actually
8689 forcing the disk system to allocate real storage blocks when a file
8690 is created or extended to be a given size. In UNIX terminology this
8691 means that Samba will stop creating sparse files.
8692 This option is really designed for file systems that support fast
8694 allocation of large numbers of blocks such as extent-based file
8695 systems. On file systems that don't support extents (most notably
8696 ext3) this can make Samba slower. When you work with large files
8697 over >100MB on file systems without extents you may even run into
8698 problems with clients running into timeouts.
8699 When you have an extent based filesystem it's likely that we can
8701 make use of unwritten extents which allows Samba to allocate even
8702 large amounts of space very fast and you will not see any timeout
8703 problems caused by strict allocate. With strict allocate in use you
8704 will also get much better out of quota messages in case you use
8705 quotas. Another advantage of activating this setting is that it
8706 will help to reduce file fragmentation.
8707 To give you an idea on which filesystems this setting might
8709 currently be a good option for you: XFS, ext4, btrfs, ocfs2 on
8710 Linux and JFS2 on AIX support unwritten extents. On Filesystems
8711 that do not support it, preallocation is probably an expensive
8712 operation where you will see reduced performance and risk to let
8713 clients run into timeouts when creating large files. Examples are
8714 ext3, ZFS, HFS+ and most others, so be aware if you activate this
8715 setting on those filesystems.
8716 Default: strict allocate = no
8718 strict locking (S)
8720 This is an enumerated type that controls the handling of file
8722 locking in the server. When this is set to yes, the server will
8723 check every read and write access for file locks, and deny access
8724 if locks exist. This can be slow on some systems.
8725 When strict locking is set to Auto (the default), the server
8727 performs file lock checks only on non-oplocked files. As most
8728 Windows redirectors perform file locking checks locally on oplocked
8729 files this is a good trade off for improved performance.
8730 When strict locking is disabled, the server performs file lock
8732 checks only when the client explicitly asks for them.
8733 Well-behaved clients always ask for lock checks when it is
8735 important. So in the vast majority of cases, strict locking = Auto
8736 or strict locking = no is acceptable.
8737 Default: strict locking = Auto
8739 strict rename (S)
8741 By default a Windows SMB server prevents directory renames when
8743 there are open file or directory handles below it in the filesystem
8744 hierarchy. Historically Samba has always allowed this as POSIX
8745 filesystem semantics require it.
8746 This boolean parameter allows Samba to match the Windows behavior.
8748 Setting this to "yes" is a very expensive change, as it forces
8749 Samba to travers the entire open file handle database on every
8750 directory rename request. In a clustered Samba system the cost is
8751 even greater than the non-clustered case.
8752 When set to "no" smbd only checks the local process the client is
8754 attached to for open files below a directory being renamed, instead
8755 of checking for open files across all smbd processes.
8756 Because of the expense in fully searching the database, the default
8758 is "no", and it is recommended to be left that way unless a
8759 specific Windows application requires it to be changed.
8760 If the client has requested UNIX extensions (POSIX pathnames) then
8762 renames are always allowed and this parameter has no effect.
8763 Default: strict rename = no
8765 strict sync (S)
8767 This parameter controls whether Samba honors a request from an SMB
8769 client to ensure any outstanding operating system buffer contents
8770 held in memory are safely written onto stable storage on disk. If
8771 set to yes, which is the default, then Windows applications can
8772 force the smbd server to synchronize unwritten data onto the disk.
8773 If set to no then smbd will ignore client requests to synchronize
8774 unwritten data onto stable storage on disk.
8775 In Samba 4.7.0, the default for this parameter changed from no to
8777 yes to better match the expectations of SMB2/3 clients and improve
8778 application safety when running against smbd.
8779 The flush request from SMB2/3 clients is handled asynchronously
8781 inside smbd, so leaving the parameter as the default value of yes
8782 does not block the processing of other requests to the smbd
8783 process.
8784 Legacy Windows applications (such as the Windows 98 explorer shell)
8786 seemed to confuse writing buffer contents to the operating system
8787 with synchronously writing outstanding data onto stable storage on
8788 disk. Changing this parameter to no means that smbd(8) will ignore
8789 the Windows applications request to synchronize unwritten data onto
8790 disk. Only consider changing this if smbd is serving obsolete SMB1
8791 Windows clients prior to Windows XP (Windows 98 and below). There
8792 should be no need to change this setting for normal operations.
8793 Default: strict sync = yes
8795 svcctl list (G)
8797 This option defines a list of init scripts that smbd will use for
8799 starting and stopping Unix services via the Win32 ServiceControl
8800 API. This allows Windows administrators to utilize the MS
8801 Management Console plug-ins to manage a Unix server running Samba.
8802 The administrator must create a directory name svcctl in Samba's
8804 $(libdir) and create symbolic links to the init scripts in
8805 /etc/init.d/. The name of the links must match the names given as
8806 part of the svcctl list.
8807 Default: svcctl list =
8809 Example: svcctl list = cups postfix portmap httpd
8811 sync always (S)
8813 This is a boolean parameter that controls whether writes will
8815 always be written to stable storage before the write call returns.
8816 If this is no then the server will be guided by the client's
8817 request in each write call (clients can set a bit indicating that a
8818 particular write should be synchronous). If this is yes then every
8819 write will be followed by a fsync() call to ensure the data is
8820 written to disk. Note that the strict sync parameter must be set to
8821 yes in order for this parameter to have any effect.
8822 Default: sync always = no
8824 syslog (G)
8826 This parameter maps how Samba debug messages are logged onto the
8828 system syslog logging levels. Samba debug level zero maps onto
8829 syslog LOG_ERR, debug level one maps onto LOG_WARNING, debug level
8830 two maps onto LOG_NOTICE, debug level three maps onto LOG_INFO. All
8831 higher levels are mapped to LOG_DEBUG.
8832 This parameter sets the threshold for sending messages to syslog.
8834 Only messages with debug level less than this value will be sent to
8835 syslog. There still will be some logging to log.[sn]mbd even if
8836 syslog only is enabled.
8837 The logging parameter should be used instead. When logging is set,
8839 it overrides the syslog parameter.
8840 Default: syslog = 1
8842 syslog only (G)
8844 If this parameter is set then Samba debug messages are logged into
8846 the system syslog only, and not to the debug log files. There still
8847 will be some logging to log.[sn]mbd even if syslog only is enabled.
8848 The logging parameter should be used instead. When logging is set,
8850 it overrides the syslog only parameter.
8851 Default: syslog only = no
8853 template homedir (G)
8855 When filling out the user information for a Windows NT user, the
8857 winbindd(8) daemon uses this parameter to fill in the home
8858 directory for that user. If the string %D is present it is
8859 substituted with the user's Windows NT domain name. If the string
8860 %U is present it is substituted with the user's Windows NT user
8861 name.
8862 Default: template homedir = /home/%D/%U
8864 template shell (G)
8866 When filling out the user information for a Windows NT user, the
8868 winbindd(8) daemon uses this parameter to fill in the login shell
8869 for that user.
8870 Default: template shell = /bin/false
8872 time server (G)
8874 This parameter determines if nmbd(8) advertises itself as a time
8876 server to Windows clients.
8877 Default: time server = no
8879 debug timestamp
8881 This parameter is a synonym for timestamp logs.
8883 timestamp logs (G)
8885 Samba debug log messages are timestamped by default. If you are
8887 running at a high debug level these timestamps can be distracting.
8888 This boolean parameter allows timestamping to be turned off.
8889 Default: timestamp logs = yes
8891 tls cafile (G)
8893 This option can be set to a file (PEM format) containing CA
8895 certificates of root CAs to trust to sign certificates or
8896 intermediate CA certificates.
8897 This path is relative to private dir if the path does not start
8899 with a /.
8900 Default: tls cafile = tls/ca.pem
8902 tls certfile (G)
8904 This option can be set to a file (PEM format) containing the RSA
8906 certificate.
8907 This path is relative to private dir if the path does not start
8909 with a /.
8910 Default: tls certfile = tls/cert.pem
8912 tls crlfile (G)
8914 This option can be set to a file containing a certificate
8916 revocation list (CRL).
8917 This path is relative to private dir if the path does not start
8919 with a /.
8920 Default: tls crlfile =
8922 tls dh params file (G)
8924 This option can be set to a file with Diffie-Hellman parameters
8926 which will be used with DH ciphers.
8927 This path is relative to private dir if the path does not start
8929 with a /.
8930 Default: tls dh params file =
8932 tls enabled (G)
8934 If this option is set to yes, then Samba will use TLS when possible
8936 in communication.
8937 Default: tls enabled = yes
8939 tls keyfile (G)
8941 This option can be set to a file (PEM format) containing the RSA
8943 private key. This file must be accessible without a pass-phrase,
8944 i.e. it must not be encrypted.
8945 This path is relative to private dir if the path does not start
8947 with a /.
8948 Default: tls keyfile = tls/key.pem
8950 tls priority (G)
8952 This option can be set to a string describing the TLS protocols to
8954 be supported in the parts of Samba that use GnuTLS, specifically
8955 the AD DC.
8956 The default turns off SSLv3, as this protocol is no longer
8958 considered secure after CVE-2014-3566 (otherwise known as POODLE)
8959 impacted SSLv3 use in HTTPS applications.
8960 The valid options are described in the GNUTLS Priority-Strings
8962 documentation at
8963 http://gnutls.org/manual/html_node/Priority-Strings.html
8964 Default: tls priority = NORMAL:-VERS-SSL3.0
8966 tls verify peer (G)
8968 This controls if and how strict the client will verify the peer's
8970 certificate and name. Possible values are (in increasing order):
8971 no_check, ca_only, ca_and_name_if_available, ca_and_name and
8972 as_strict_as_possible.
8973 When set to no_check the certificate is not verified at all, which
8975 allows trivial man in the middle attacks.
8976 When set to ca_only the certificate is verified to be signed from a
8978 ca specified in the tls ca file option. Setting tls ca file to a
8979 valid file is required. The certificate lifetime is also verified.
8980 If the tls crl file option is configured, the certificate is also
8981 verified against the ca crl.
8982 When set to ca_and_name_if_available all checks from ca_only are
8984 performed. In addition, the peer hostname is verified against the
8985 certificate's name, if it is provided by the application layer and
8986 not given as an ip address string.
8987 When set to ca_and_name all checks from ca_and_name_if_available
8989 are performed. In addition the peer hostname needs to be provided
8990 and even an ip address is checked against the certificate's name.
8991 When set to as_strict_as_possible all checks from ca_and_name are
8993 performed. In addition the tls crl file needs to be configured.
8994 Future versions of Samba may implement additional checks.
8995 Default: tls verify peer = as_strict_as_possible
8997 unicode (G)
8999 Specifies whether the server and client should support unicode.
9001 If this option is set to false, the use of ASCII will be forced.
9003 Default: unicode = yes
9005 unix charset (G)
9007 Specifies the charset the unix machine Samba runs on uses. Samba
9009 needs to know this in order to be able to convert text to the
9010 charsets other SMB clients use.
9011 This is also the charset Samba will use when specifying arguments
9013 to scripts that it invokes.
9014 Default: unix charset = UTF-8
9016 Example: unix charset = ASCII
9018 unix extensions (G)
9020 This boolean parameter controls whether Samba implements the CIFS
9022 UNIX extensions, as defined by HP. These extensions enable Samba to
9023 better serve UNIX CIFS clients by supporting features such as
9024 symbolic links, hard links, etc... These extensions require a
9025 similarly enabled client, and are of no current use to Windows
9026 clients.
9027 Note if this parameter is turned on, the wide links parameter will
9029 automatically be disabled.
9030 See the parameter allow insecure wide links if you wish to change
9032 this coupling between the two parameters.
9033 Default: unix extensions = yes
9035 unix password sync (G)
9037 This boolean parameter controls whether Samba attempts to
9039 synchronize the UNIX password with the SMB password when the
9040 encrypted SMB password in the smbpasswd file is changed. If this is
9041 set to yes the program specified in the passwd program parameter is
9042 called AS ROOT - to allow the new UNIX password to be set without
9043 access to the old UNIX password (as the SMB password change code
9044 has no access to the old password cleartext, only the new).
9045 This option has no effect if samba is running as an active
9047 directory domain controller, in that case have a look at the
9048 password hash gpg key ids option and the samba-tool user
9049 syncpasswords command.
9050 Default: unix password sync = no
9052 use client driver (S)
9054 This parameter applies only to Windows NT/2000 clients. It has no
9056 effect on Windows 95/98/ME clients. When serving a printer to
9057 Windows NT/2000 clients without first installing a valid printer
9058 driver on the Samba host, the client will be required to install a
9059 local printer driver. From this point on, the client will treat the
9060 print as a local printer and not a network printer connection. This
9061 is much the same behavior that will occur when disable spoolss =
9062 yes.
9063 The differentiating factor is that under normal circumstances, the
9065 NT/2000 client will attempt to open the network printer using
9066 MS-RPC. The problem is that because the client considers the
9067 printer to be local, it will attempt to issue the OpenPrinterEx()
9068 call requesting access rights associated with the logged on user.
9069 If the user possesses local administrator rights but not root
9070 privilege on the Samba host (often the case), the OpenPrinterEx()
9071 call will fail. The result is that the client will now display an
9072 "Access Denied; Unable to connect" message in the printer queue
9073 window (even though jobs may successfully be printed).
9074 If this parameter is enabled for a printer, then any attempt to
9076 open the printer with the PRINTER_ACCESS_ADMINISTER right is mapped
9077 to PRINTER_ACCESS_USE instead. Thus allowing the OpenPrinterEx()
9078 call to succeed. This parameter MUST not be enabled on a print
9079 share which has valid print driver installed on the Samba server.
9080 Default: use client driver = no
9082 use mmap (G)
9084 This global parameter determines if the tdb internals of Samba can
9086 depend on mmap working correctly on the running system. Samba
9087 requires a coherent mmap/read-write system memory cache. Currently
9088 only HPUX does not have such a coherent cache, and so this
9089 parameter is set to no by default on HPUX. On all other systems
9090 this parameter should be left alone. This parameter is provided to
9091 help the Samba developers track down problems with the tdb internal
9092 code.
9093 Default: use mmap = yes
9095 username level (G)
9097 This option helps Samba to try and 'guess' at the real UNIX
9099 username, as many DOS clients send an all-uppercase username. By
9100 default Samba tries all lowercase, followed by the username with
9101 the first letter capitalized, and fails if the username is not
9102 found on the UNIX machine.
9103 If this parameter is set to non-zero the behavior changes. This
9105 parameter is a number that specifies the number of uppercase
9106 combinations to try while trying to determine the UNIX user name.
9107 The higher the number the more combinations will be tried, but the
9108 slower the discovery of usernames will be. Use this parameter when
9109 you have strange usernames on your UNIX machine, such as
9110 AstrangeUser .
9111 This parameter is needed only on UNIX systems that have case
9113 sensitive usernames.
9114 Default: username level = 0
9116 Example: username level = 5
9118 username map (G)
9120 This option allows you to specify a file containing a mapping of
9122 usernames from the clients to the server. This can be used for
9123 several purposes. The most common is to map usernames that users
9124 use on DOS or Windows machines to those that the UNIX box uses. The
9125 other is to map multiple users to a single username so that they
9126 can more easily share files.
9127 Please note that for user mode security, the username map is
9129 applied prior to validating the user credentials. Domain member
9130 servers (domain or ads) apply the username map after the user has
9131 been successfully authenticated by the domain controller and
9132 require fully qualified entries in the map table (e.g. biddle =
9133 DOMAIN\foo).
9134 The map file is parsed line by line. Each line should contain a
9136 single UNIX username on the left then a '=' followed by a list of
9137 usernames on the right. The list of usernames on the right may
9138 contain names of the form @group in which case they will match any
9139 UNIX username in that group. The special client name '*' is a
9140 wildcard and matches any name. Each line of the map file may be up
9141 to 1023 characters long.
9142 The file is processed on each line by taking the supplied username
9144 and comparing it with each username on the right hand side of the
9145 '=' signs. If the supplied name matches any of the names on the
9146 right hand side then it is replaced with the name on the left.
9147 Processing then continues with the next line.
9148 If any line begins with a '#' or a ';' then it is ignored.
9150 If any line begins with an '!' then the processing will stop after
9152 that line if a mapping was done by the line. Otherwise mapping
9153 continues with every line being processed. Using '!' is most useful
9154 when you have a wildcard mapping line later in the file.
9155 For example to map from the name admin or administrator to the UNIX
9157 name
9158 root you would use:
9159 root = admin administrator
9161 Or to map anyone in the UNIX group system to the UNIX name sys you
9163 would use:
9164 sys = @system
9166 You can have as many mappings as you like in a username map file.
9168 If your system supports the NIS NETGROUP option then the netgroup
9170 database is checked before the /etc/group database for matching
9171 groups.
9172 You can map Windows usernames that have spaces in them by using
9174 double quotes around the name. For example:
9175 tridge = "Andrew Tridgell"
9177 would map the windows username "Andrew Tridgell" to the unix
9179 username "tridge".
9180 The following example would map mary and fred to the unix user sys,
9182 and map the rest to guest. Note the use of the '!' to tell Samba to
9183 stop processing if it gets a match on that line:
9184 !sys = mary fred
9186 guest = *
9187 Note that the remapping is applied to all occurrences of usernames.
9189 Thus if you connect to \\server\fred and fred is remapped to mary
9190 then you will actually be connecting to \\server\mary and will need
9191 to supply a password suitable for mary not fred. The only exception
9192 to this is the username passed to a Domain Controller (if you have
9193 one). The DC will receive whatever username the client supplies
9194 without modification.
9195 Also note that no reverse mapping is done. The main effect this has
9197 is with printing. Users who have been mapped may have trouble
9198 deleting print jobs as PrintManager under WfWg will think they
9199 don't own the print job.
9200 Samba versions prior to 3.0.8 would only support reading the fully
9202 qualified username (e.g.: DOMAIN\user) from the username map when
9203 performing a kerberos login from a client. However, when looking up
9204 a map entry for a user authenticated by NTLM[SSP], only the login
9205 name would be used for matches. This resulted in inconsistent
9206 behavior sometimes even on the same server.
9207 The following functionality is obeyed in version 3.0.8 and later:
9209 When performing local authentication, the username map is applied
9211 to the login name before attempting to authenticate the connection.
9212 When relying upon a external domain controller for validating
9214 authentication requests, smbd will apply the username map to the
9215 fully qualified username (i.e. DOMAIN\user) only after the user
9216 has been successfully authenticated.
9217 An example of use is:
9219 username map = /usr/local/samba/lib/users.map
9221 Default: username map = # no username map
9223 username map cache time (G)
9225 Mapping usernames with the username map or username map script
9227 features of Samba can be relatively expensive. During login of a
9228 user, the mapping is done several times. In particular, calling the
9229 username map script can slow down logins if external databases have
9230 to be queried from the script being called.
9231 The parameter username map cache time controls a mapping cache. It
9233 specifies the number of seconds a mapping from the username map
9234 file or script is to be efficiently cached. The default of 0 means
9235 no caching is done.
9236 Default: username map cache time = 0
9238 Example: username map cache time = 60
9240 username map script (G)
9242 This script is a mutually exclusive alternative to the username map
9244 parameter. This parameter specifies and external program or script
9245 that must accept a single command line option (the username
9246 transmitted in the authentication request) and return a line on
9247 standard output (the name to which the account should mapped). In
9248 this way, it is possible to store username map tables in an LDAP or
9249 NIS directory services.
9250 Default: username map script =
9252 Example: username map script = /etc/samba/scripts/mapusers.sh
9254 usershare allow guests (G)
9256 This parameter controls whether user defined shares are allowed to
9258 be accessed by non-authenticated users or not. It is the equivalent
9259 of allowing people who can create a share the option of setting
9260 guest ok = yes in a share definition. Due to its security sensitive
9261 nature, the default is set to off.
9262 Default: usershare allow guests = no
9264 usershare max shares (G)
9266 This parameter specifies the number of user defined shares that are
9268 allowed to be created by users belonging to the group owning the
9269 usershare directory. If set to zero (the default) user defined
9270 shares are ignored.
9271 Default: usershare max shares = 0
9273 usershare owner only (G)
9275 This parameter controls whether the pathname exported by a user
9277 defined shares must be owned by the user creating the user defined
9278 share or not. If set to True (the default) then smbd checks that
9279 the directory path being shared is owned by the user who owns the
9280 usershare file defining this share and refuses to create the share
9281 if not. If set to False then no such check is performed and any
9282 directory path may be exported regardless of who owns it.
9283 Default: usershare owner only = yes
9285 usershare path (G)
9287 This parameter specifies the absolute path of the directory on the
9289 filesystem used to store the user defined share definition files.
9290 This directory must be owned by root, and have no access for other,
9291 and be writable only by the group owner. In addition the "sticky"
9292 bit must also be set, restricting rename and delete to owners of a
9293 file (in the same way the /tmp directory is usually configured).
9294 Members of the group owner of this directory are the users allowed
9295 to create usershares.
9296 For example, a valid usershare directory might be
9298 /usr/local/samba/lib/usershares, set up as follows.
9299 ls -ld /usr/local/samba/lib/usershares/
9301 drwxrwx--T 2 root power_users 4096 2006-05-05 12:27 /usr/local/samba/lib/usershares/
9302 In this case, only members of the group "power_users" can create
9305 user defined shares.
9306 Default: usershare path = /var/lib/samba/usershares
9308 usershare prefix allow list (G)
9310 This parameter specifies a list of absolute pathnames the root of
9312 which are allowed to be exported by user defined share definitions.
9313 If the pathname to be exported doesn't start with one of the
9314 strings in this list, the user defined share will not be allowed.
9315 This allows the Samba administrator to restrict the directories on
9316 the system that can be exported by user defined shares.
9317 If there is a "usershare prefix deny list" and also a "usershare
9319 prefix allow list" the deny list is processed first, followed by
9320 the allow list, thus leading to the most restrictive
9321 interpretation.
9322 Default: usershare prefix allow list =
9324 Example: usershare prefix allow list = /home /data /space
9326 usershare prefix deny list (G)
9328 This parameter specifies a list of absolute pathnames the root of
9330 which are NOT allowed to be exported by user defined share
9331 definitions. If the pathname exported starts with one of the
9332 strings in this list the user defined share will not be allowed.
9333 Any pathname not starting with one of these strings will be allowed
9334 to be exported as a usershare. This allows the Samba administrator
9335 to restrict the directories on the system that can be exported by
9336 user defined shares.
9337 If there is a "usershare prefix deny list" and also a "usershare
9339 prefix allow list" the deny list is processed first, followed by
9340 the allow list, thus leading to the most restrictive
9341 interpretation.
9342 Default: usershare prefix deny list =
9344 Example: usershare prefix deny list = /etc /dev /private
9346 usershare template share (G)
9348 User defined shares only have limited possible parameters such as
9350 path, guest ok, etc. This parameter allows usershares to "cloned"
9351 from an existing share. If "usershare template share" is set to the
9352 name of an existing share, then all usershares created have their
9353 defaults set from the parameters set on this share.
9354 The target share may be set to be invalid for real file sharing by
9356 setting the parameter "-valid = False" on the template share
9357 definition. This causes it not to be seen as a real exported share
9358 but to be able to be used as a template for usershares.
9359 Default: usershare template share =
9361 Example: usershare template share = template_share
9363 use sendfile (S)
9365 If this parameter is yes, and the sendfile() system call is
9367 supported by the underlying operating system, then some SMB read
9368 calls (mainly ReadAndX and ReadRaw) will use the more efficient
9369 sendfile system call for files that are exclusively oplocked. This
9370 may make more efficient use of the system CPU's and cause Samba to
9371 be faster. Samba automatically turns this off for clients that use
9372 protocol levels lower than NT LM 0.12 and when it detects a client
9373 is Windows 9x (using sendfile from Linux will cause these clients
9374 to fail).
9375 Default: use sendfile = no
9377 utmp (G)
9379 This boolean parameter is only available if Samba has been
9381 configured and compiled with the option --with-utmp. If set to yes
9382 then Samba will attempt to add utmp or utmpx records (depending on
9383 the UNIX system) whenever a connection is made to a Samba server.
9384 Sites may use this to record the user connecting to a Samba share.
9385 Due to the requirements of the utmp record, we are required to
9387 create a unique identifier for the incoming user. Enabling this
9388 option creates an n^2 algorithm to find this number. This may
9389 impede performance on large installations.
9390 Default: utmp = no
9392 utmp directory (G)
9394 This parameter is only available if Samba has been configured and
9396 compiled with the option --with-utmp. It specifies a directory
9397 pathname that is used to store the utmp or utmpx files (depending
9398 on the UNIX system) that record user connections to a Samba server.
9399 By default this is not set, meaning the system will use whatever
9400 utmp file the native system is set to use (usually /var/run/utmp on
9401 Linux).
9402 Default: utmp directory = # Determined automatically
9404 Example: utmp directory = /var/run/utmp
9406 -valid (S)
9408 This parameter indicates whether a share is valid and thus can be
9410 used. When this parameter is set to false, the share will be in no
9411 way visible nor accessible.
9412 This option should not be used by regular users but might be of
9414 help to developers. Samba uses this option internally to mark
9415 shares as deleted.
9416 Default: -valid = yes
9418 valid users (S)
9420 This is a list of users that should be allowed to login to this
9422 service. Names starting with '@', '+' and '&' are interpreted using
9423 the same rules as described in the invalid users parameter.
9424 If this is empty (the default) then any user can login. If a
9426 username is in both this list and the invalid users list then
9427 access is denied for that user.
9428 The current servicename is substituted for %S. This is useful in
9430 the [homes] section.
9431 Note: When used in the [global] section this parameter may have
9433 unwanted side effects. For example: If samba is configured as a
9434 MASTER BROWSER (see local master, os level, domain master,
9435 preferred master) this option will prevent workstations from being
9436 able to browse the network.
9437 Default: valid users = # No valid users list (anyone can login)
9439 Example: valid users = greg, @pcusers
9441 veto files (S)
9443 This is a list of files and directories that are neither visible
9445 nor accessible. Each entry in the list must be separated by a '/',
9446 which allows spaces to be included in the entry. '*' and '?' can be
9447 used to specify multiple files or directories as in DOS wildcards.
9448 Each entry must be a unix path, not a DOS path and must not include
9450 the unix directory separator '/'.
9451 Note that the case sensitive option is applicable in vetoing files.
9453 One feature of the veto files parameter that it is important to be
9455 aware of is Samba's behaviour when trying to delete a directory. If
9456 a directory that is to be deleted contains nothing but veto files
9457 this deletion will fail unless you also set the delete veto files
9458 parameter to yes.
9459 Setting this parameter will affect the performance of Samba, as it
9461 will be forced to check all files and directories for a match as
9462 they are scanned.
9463 Examples of use include:
9465 ; Veto any files containing the word Security,
9467 ; any ending in .tmp, and any directory containing the
9468 ; word root.
9469 veto files = /*Security*/*.tmp/*root*/
9470 ; Veto the Apple specific files that a NetAtalk server
9472 ; creates.
9473 veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/
9474 Default: veto files = # No files or directories are vetoed
9476 veto oplock files (S)
9478 This parameter is only valid when the oplocks parameter is turned
9480 on for a share. It allows the Samba administrator to selectively
9481 turn off the granting of oplocks on selected files that match a
9482 wildcarded list, similar to the wildcarded list used in the veto
9483 files parameter.
9484 You might want to do this on files that you know will be heavily
9486 contended for by clients. A good example of this is in the NetBench
9487 SMB benchmark program, which causes heavy client contention for
9488 files ending in .SEM. To cause Samba not to grant oplocks on these
9489 files you would use the line (either in the [global] section or in
9490 the section for the particular NetBench share.
9491 An example of use is:
9493 veto oplock files = /.*SEM/
9495 Default: veto oplock files = # No files are vetoed for oplock
9497 grants
9498 vfs object
9500 This parameter is a synonym for vfs objects.
9502 vfs objects (S)
9504 This parameter specifies the backend names which are used for Samba
9506 VFS I/O operations. By default, normal disk I/O operations are used
9507 but these can be overloaded with one or more VFS objects. Be aware
9508 that the definition of this parameter will overwrite a possible
9509 previous definition of the vfs objects parameter.
9510 Default: vfs objects =
9512 Example: vfs objects = extd_audit recycle
9514 volume (S)
9516 This allows you to override the volume label returned for a share.
9518 Useful for CDROMs with installation programs that insist on a
9519 particular volume label.
9520 Default: volume = # the name of the share
9522 wide links (S)
9524 This parameter controls whether or not links in the UNIX file
9526 system may be followed by the server. Links that point to areas
9527 within the directory tree exported by the server are always
9528 allowed; this parameter controls access only to areas that are
9529 outside the directory tree being exported.
9530 Note: Turning this parameter on when UNIX extensions are enabled
9532 will allow UNIX clients to create symbolic links on the share that
9533 can point to files or directories outside restricted path exported
9534 by the share definition. This can cause access to areas outside of
9535 the share. Due to this problem, this parameter will be
9536 automatically disabled (with a message in the log file) if the unix
9537 extensions option is on.
9538 See the parameter allow insecure wide links if you wish to change
9540 this coupling between the two parameters.
9541 Default: wide links = no
9543 winbind cache time (G)
9545 This parameter specifies the number of seconds the winbindd(8)
9547 daemon will cache user and group information before querying a
9548 Windows NT server again.
9549 This does not apply to authentication requests, these are always
9551 evaluated in real time unless the winbind offline logon option has
9552 been enabled.
9553 Default: winbind cache time = 300
9555 winbindd socket directory (G)
9557 This setting controls the location of the winbind daemon's socket.
9559 Except within automated test scripts, this should not be altered,
9561 as the client tools (nss_winbind etc) do not honour this parameter.
9562 Client tools must then be advised of the altered path with the
9563 WINBINDD_SOCKET_DIR environment variable.
9564 Default: winbindd socket directory = /run/samba/winbindd
9566 winbind enum groups (G)
9568 On large installations using winbindd(8) it may be necessary to
9570 suppress the enumeration of groups through the setgrent(),
9571 getgrent() and endgrent() group of system calls. If the winbind
9572 enum groups parameter is no, calls to the getgrent() system call
9573 will not return any data.
9574 Warning
9576 Turning off group enumeration may cause some programs to behave
9577 oddly.
9578 Default: winbind enum groups = no
9579 winbind enum users (G)
9581 On large installations using winbindd(8) it may be necessary to
9583 suppress the enumeration of users through the setpwent(),
9584 getpwent() and endpwent() group of system calls. If the winbind
9585 enum users parameter is no, calls to the getpwent system call will
9586 not return any data.
9587 Warning
9589 Turning off user enumeration may cause some programs to behave
9590 oddly. For example, the finger program relies on having access
9591 to the full user list when searching for matching usernames.
9592 Default: winbind enum users = no
9593 winbind expand groups (G)
9595 This option controls the maximum depth that winbindd will traverse
9597 when flattening nested group memberships of Windows domain groups.
9598 This is different from the winbind nested groups option which
9599 implements the Windows NT4 model of local group nesting. The
9600 "winbind expand groups" parameter specifically applies to the
9601 membership of domain groups.
9602 This option also affects the return of non nested group memberships
9604 of Windows domain users. With the new default "winbind expand
9605 groups = 0" winbind does not query group memberships at all.
9606 Be aware that a high value for this parameter can result in system
9608 slowdown as the main parent winbindd daemon must perform the group
9609 unrolling and will be unable to answer incoming NSS or
9610 authentication requests during this time.
9611 The default value was changed from 1 to 0 with Samba 4.2. Some
9613 broken applications (including some implementations of newgrp and
9614 sg) calculate the group memberships of users by traversing groups,
9615 such applications will require "winbind expand groups = 1". But the
9616 new default makes winbindd more reliable as it doesn't require SAMR
9617 access to domain controllers of trusted domains.
9618 Default: winbind expand groups = 0
9620 winbind:ignore domains (G)
9622 Allows one to enter a list of trusted domains winbind should ignore
9624 (untrust). This can avoid the overhead of resources from attempting
9625 to login to DCs that should not be communicated with.
9626 Default: winbind:ignore domains =
9628 Example: winbind:ignore domains = DOMAIN1, DOMAIN2
9630 winbind max clients (G)
9632 This parameter specifies the maximum number of clients the
9634 winbindd(8) daemon can connect with. The parameter is not a hard
9635 limit. The winbindd(8) daemon configures itself to be able to
9636 accept at least that many connections, and if the limit is reached,
9637 an attempt is made to disconnect idle clients.
9638 Default: winbind max clients = 200
9640 winbind max domain connections (G)
9642 This parameter specifies the maximum number of simultaneous
9644 connections that the winbindd(8) daemon should open to the domain
9645 controller of one domain. Setting this parameter to a value greater
9646 than 1 can improve scalability with many simultaneous winbind
9647 requests, some of which might be slow.
9648 Note that if winbind offline logon is set to Yes, then only one DC
9650 connection is allowed per domain, regardless of this setting.
9651 Default: winbind max domain connections = 1
9653 Example: winbind max domain connections = 10
9655 winbind nested groups (G)
9657 If set to yes, this parameter activates the support for nested
9659 groups. Nested groups are also called local groups or aliases. They
9660 work like their counterparts in Windows: Nested groups are defined
9661 locally on any machine (they are shared between DC's through their
9662 SAM) and can contain users and global groups from any trusted SAM.
9663 To be able to use nested groups, you need to run nss_winbind.
9664 Default: winbind nested groups = yes
9666 winbind normalize names (G)
9668 This parameter controls whether winbindd will replace whitespace in
9670 user and group names with an underscore (_) character. For example,
9671 whether the name "Space Kadet" should be replaced with the string
9672 "space_kadet". Frequently Unix shell scripts will have difficulty
9673 with usernames contains whitespace due to the default field
9674 separator in the shell. If your domain possesses names containing
9675 the underscore character, this option may cause problems unless the
9676 name aliasing feature is supported by your nss_info plugin.
9677 This feature also enables the name aliasing API which can be used
9679 to make domain user and group names to a non-qualified version.
9680 Please refer to the manpage for the configured idmap and nss_info
9681 plugin for the specifics on how to configure name aliasing for a
9682 specific configuration. Name aliasing takes precedence (and is
9683 mutually exclusive) over the whitespace replacement mechanism
9684 discussed previously.
9685 Default: winbind normalize names = no
9687 Example: winbind normalize names = yes
9689 winbind nss info (G)
9691 This parameter is designed to control how Winbind retrieves Name
9693 Service Information to construct a user's home directory and login
9694 shell. Currently the following settings are available:
9695 · template - The default, using the parameters of template
9697 shell and template homedir)
9698 · <sfu | sfu20 | rfc2307 > - When Samba is running in
9700 security = ads and your Active Directory Domain
9701 Controller does support the Microsoft "Services for
9702 Unix" (SFU) LDAP schema, winbind can retrieve the login
9703 shell and the home directory attributes directly from
9704 your Directory Server. For SFU 3.0 or 3.5 simply choose
9705 "sfu", if you use SFU 2.0 please choose "sfu20".
9706 Note that for the idmap backend idmap_ad you need to
9708 configure those settings in the idmap configuration
9709 section. Make sure to consult the documentation of the
9710 idmap backend that you are using.
9711 Default: winbind nss info = template
9714 Example: winbind nss info = sfu
9716 winbind offline logon (G)
9718 This parameter is designed to control whether Winbind should allow
9720 one to login with the pam_winbind module using Cached Credentials.
9721 If enabled, winbindd will store user credentials from successful
9722 logins encrypted in a local cache.
9723 Default: winbind offline logon = no
9725 Example: winbind offline logon = yes
9727 winbind reconnect delay (G)
9729 This parameter specifies the number of seconds the winbindd(8)
9731 daemon will wait between attempts to contact a Domain controller
9732 for a domain that is determined to be down or not contactable.
9733 Default: winbind reconnect delay = 30
9735 winbind refresh tickets (G)
9737 This parameter is designed to control whether Winbind should
9739 refresh Kerberos Tickets retrieved using the pam_winbind module.
9740 Default: winbind refresh tickets = no
9742 Example: winbind refresh tickets = yes
9744 winbind request timeout (G)
9746 This parameter specifies the number of seconds the winbindd(8)
9748 daemon will wait before disconnecting either a client connection
9749 with no outstanding requests (idle) or a client connection with a
9750 request that has remained outstanding (hung) for longer than this
9751 number of seconds.
9752 Default: winbind request timeout = 60
9754 winbind rpc only (G)
9756 Setting this parameter to yes forces winbindd to use RPC instead of
9758 LDAP to retrieve information from Domain Controllers.
9759 Default: winbind rpc only = no
9761 winbind scan trusted domains (G)
9763 This option only takes effect when the security option is set to
9765 domain or ads. If it is set to yes (the default), winbindd
9766 periodically tries to scan for new trusted domains and adds them to
9767 a global list inside of winbindd. The list can be extracted with
9768 wbinfo --trusted-domains --verbose. This matches the behaviour of
9769 Samba 4.7 and older.
9770 The construction of that global list is not reliable and often
9772 incomplete in complex trust setups. In most situations the list is
9773 not needed any more for winbindd to operate correctly. E.g. for
9774 plain file serving via SMB using a simple idmap setup with autorid,
9775 tdb or ad. However some more complex setups require the list, e.g.
9776 if you specify idmap backends for specific domains. Some
9777 pam_winbind setups may also require the global list.
9778 If you have a setup that doesn't require the global list, you
9780 should set winbind scan trusted domains = no.
9781 Default: winbind scan trusted domains = yes
9783 winbind sealed pipes (G)
9785 This option controls whether any requests from winbindd to domain
9787 controllers pipe will be sealed. Disabling sealing can be useful
9788 for debugging purposes.
9789 The behavior can be controlled per netbios domain by using 'winbind
9791 sealed pipes:NETBIOSDOMAIN = no' as option.
9792 Default: winbind sealed pipes = yes
9794 winbind separator (G)
9796 This parameter allows an admin to define the character used when
9798 listing a username of the form of DOMAIN \user. This parameter is
9799 only applicable when using the pam_winbind.so and nss_winbind.so
9800 modules for UNIX services.
9801 Please note that setting this parameter to + causes problems with
9803 group membership at least on glibc systems, as the character + is
9804 used as a special character for NIS in /etc/group.
9805 Default: winbind separator = \
9807 Example: winbind separator = +
9809 winbind use default domain (G)
9811 This parameter specifies whether the winbindd(8) daemon should
9813 operate on users without domain component in their username. Users
9814 without a domain component are treated as is part of the winbindd
9815 server's own domain. While this does not benefit Windows users, it
9816 makes SSH, FTP and e-mail function in a way much closer to the way
9817 they would in a native unix system.
9818 This option should be avoided if possible. It can cause confusion
9820 about responsibilities for a user or group. In many situations it
9821 is not clear whether winbind or /etc/passwd should be seen as
9822 authoritative for a user, likewise for groups.
9823 Default: winbind use default domain = no
9825 Example: winbind use default domain = yes
9827 winbind use krb5 enterprise principals (G)
9829 winbindd is able to get kerberos tickets for pam_winbind with
9831 krb5_auth or wbinfo -K/--krb5auth=.
9832 winbindd (at least on a domain member) is never be able to have a
9834 complete picture of the trust topology (which is managed by the
9835 DCs). There might be uPNSuffixes and msDS-SPNSuffixes values, which
9836 don't belong to any AD domain at all.
9837 With winbind scan trusted domains = no winbindd don't even get an
9839 incomplete picture of the topology.
9840 It is not really required to know about the trust topology. We can
9842 just rely on the [K]DCs of our primary domain (e.g.
9843 PRIMARY.A.EXAMPLE.COM) and use enterprise principals e.g.
9844 upnfromB@B.EXAMPLE.COM@PRIMARY.A.EXAMPLE.COM and follow the
9845 WRONG_REALM referrals in order to find the correct DC. The final
9846 principal might be userfromB@INTERNALB.EXAMPLE.PRIVATE.
9847 With winbind use krb5 enterprise principals = yes winbindd
9849 enterprise principals will be used.
9850 Default: winbind use krb5 enterprise principals = no
9852 Example: winbind use krb5 enterprise principals = yes
9854 winsdb:local_owner (G)
9856 This specifies the address that is stored in the winsOwner
9858 attribute, of locally registered winsRecord-objects. The default is
9859 to use the ip-address of the first network interface.
9860 No default
9862 winsdb:dbnosync (G)
9864 This parameter disables fsync() after changes of the WINS database.
9866 Default: winsdb:dbnosync = no
9868 wins hook (G)
9870 When Samba is running as a WINS server this allows you to call an
9872 external program for all changes to the WINS database. The primary
9873 use for this option is to allow the dynamic update of external name
9874 resolution databases such as dynamic DNS.
9875 The wins hook parameter specifies the name of a script or
9877 executable that will be called as follows:
9878 wins_hook operation name nametype ttl IP_list
9880 · The first argument is the operation and is one of "add",
9882 "delete", or "refresh". In most cases the operation can
9883 be ignored as the rest of the parameters provide
9884 sufficient information. Note that "refresh" may
9885 sometimes be called when the name has not previously
9886 been added, in that case it should be treated as an add.
9887 · The second argument is the NetBIOS name. If the name is
9889 not a legal name then the wins hook is not called. Legal
9890 names contain only letters, digits, hyphens, underscores
9891 and periods.
9892 · The third argument is the NetBIOS name type as a 2 digit
9894 hexadecimal number.
9895 · The fourth argument is the TTL (time to live) for the
9897 name in seconds.
9898 · The fifth and subsequent arguments are the IP addresses
9900 currently registered for that name. If this list is
9901 empty then the name should be deleted.
9902 An example script that calls the BIND dynamic DNS update program
9904 nsupdate is provided in the examples directory of the Samba source
9905 code.
9906 No default
9908 wins proxy (G)
9910 This is a boolean that controls if nmbd(8) will respond to
9912 broadcast name queries on behalf of other hosts. You may need to
9913 set this to yes for some older clients.
9914 Default: wins proxy = no
9916 wins server (G)
9918 This specifies the IP address (or DNS name: IP address for
9920 preference) of the WINS server that nmbd(8) should register with.
9921 If you have a WINS server on your network then you should set this
9922 to the WINS server's IP.
9923 You should point this at your WINS server if you have a
9925 multi-subnetted network.
9926 If you want to work in multiple namespaces, you can give every wins
9928 server a 'tag'. For each tag, only one (working) server will be
9929 queried for a name. The tag should be separated from the ip address
9930 by a colon.
9931 Note
9933 You need to set up Samba to point to a WINS server if you have
9934 multiple subnets and wish cross-subnet browsing to work
9935 correctly.
9936 See the chapter in the Samba3-HOWTO on Network Browsing.
9937 Default: wins server =
9939 Example: wins server = mary:192.9.200.1 fred:192.168.3.199
9941 mary:192.168.2.61 # For this example when querying a certain name,
9942 192.19.200.1 will be asked first and if that doesn't respond
9943 192.168.2.61. If either of those doesn't know the name
9944 192.168.3.199 will be queried.
9945 Example: wins server = 192.9.200.1 192.168.2.61
9947 wins support (G)
9949 This boolean controls if the nmbd(8) process in Samba will act as a
9951 WINS server. You should not set this to yes unless you have a
9952 multi-subnetted network and you wish a particular nmbd to be your
9953 WINS server. Note that you should NEVER set this to yes on more
9954 than one machine in your network.
9955 Default: wins support = no
9957 workgroup (G)
9959 This controls what workgroup your server will appear to be in when
9961 queried by clients. Note that this parameter also controls the
9962 Domain name used with the security = domain setting.
9963 Default: workgroup = WORKGROUP
9965 Example: workgroup = MYGROUP
9967 wreplsrv:periodic_interval (G)
9969 This maximum interval in seconds between 2 periodically scheduled
9971 runs where we check for wins.ldb changes and do push notifications
9972 to our push partners. Also wins_config.ldb changes are checked in
9973 that interval and partner configuration reloads are done.
9974 Default: wreplsrv:periodic_interval = 15
9976 wreplsrv:propagate name releases (G)
9978 If this parameter is enabled, then explicit (from the client) and
9980 implicit (via the scavenging) name releases are propagated to the
9981 other servers directly, even if there are still other addresses
9982 active, this applies to SPECIAL GROUP (2) and MULTIHOMED (3)
9983 entries. Also the replication conflict merge algorithm for SPECIAL
9984 GROUP (2) entries discards replica addresses where the address
9985 owner is the local server, if the address was not stored locally
9986 before. The merge result is propagated directly in case an address
9987 was discarded. A Windows servers doesn't propagate name releases of
9988 SPECIAL GROUP (2) and MULTIHOMED (3) entries directly, which means
9989 that Windows servers may return different results to name queries
9990 for SPECIAL GROUP (2) and MULTIHOMED (3) names. The option doesn't
9991 have much negative impact if Windows servers are around, but be
9992 aware that they might return unexpected results.
9993 Default: wreplsrv:propagate name releases = no
9995 wreplsrv:scavenging_interval (G)
9997 This is the interval in s between 2 scavenging runs which clean up
9999 the WINS database and changes the states of expired name records.
10000 Defaults to half of the value of wreplsrv:renew_interval.
10001 No default
10003 wreplsrv:tombstone_extra_timeout (G)
10005 This is the time in s the server needs to be up till we'll remove
10007 tombstone records from our database. Defaults to 3 days.
10008 Default: wreplsrv:tombstone_extra_timeout = 259200
10010 wreplsrv:tombstone_interval (G)
10012 This is the interval in s till released records of the WINS server
10014 become tombstone. Defaults to 6 days.
10015 Default: wreplsrv:tombstone_interval = 518400
10017 wreplsrv:tombstone_timeout (G)
10019 This is the interval in s till tombstone records are deleted from
10021 the WINS database. Defaults to 1 day.
10022 Default: wreplsrv:tombstone_timeout = 86400
10024 wreplsrv:verify_interval (G)
10026 This is the interval in s till we verify active replica records
10028 with the owning WINS server. Unfortunately not implemented yet.
10029 Defaults to 24 days.
10030 Default: wreplsrv:verify_interval = 2073600
10032 writable
10034 This parameter is a synonym for writeable.
10036 write ok
10038 This parameter is a synonym for writeable.
10040 writeable (S)
10042 Inverted synonym for read only.
10044 Default: writeable = no
10046 write list (S)
10048 This is a list of users that are given read-write access to a
10050 service. If the connecting user is in this list then they will be
10051 given write access, no matter what the read only option is set to.
10052 The list can include group names using the @group syntax.
10053 Note that if a user is in both the read list and the write list
10055 then they will be given write access.
10056 Default: write list =
10058 Example: write list = admin, root, @staff
10060 write raw (G)
10062 This is ignored if async smb echo handler is set, because this
10064 feature is incompatible with raw write SMB requests
10065 If enabled, raw writes allow writes of 65535 bytes in one packet.
10067 This typically provides a major performance benefit for some very,
10068 very old clients.
10069 However, some clients either negotiate the allowable block size
10071 incorrectly or are incapable of supporting larger block sizes, and
10072 for these clients you may need to disable raw writes.
10073 In general this parameter should be viewed as a system tuning tool
10075 and left severely alone.
10076 Default: write raw = yes
10078 wtmp directory (G)
10080 This parameter is only available if Samba has been configured and
10082 compiled with the option --with-utmp. It specifies a directory
10083 pathname that is used to store the wtmp or wtmpx files (depending
10084 on the UNIX system) that record user connections to a Samba server.
10085 The difference with the utmp directory is the fact that user info
10086 is kept after a user has logged out.
10087 By default this is not set, meaning the system will use whatever
10089 utmp file the native system is set to use (usually /var/run/wtmp on
10090 Linux).
10091 Default: wtmp directory =
10093 Example: wtmp directory = /var/log/wtmp
10095
10097 Although the configuration file permits service names to contain
10098 spaces, your client software may not. Spaces will be ignored in
10099 comparisons anyway, so it shouldn't be a problem - but be aware of the
10100 possibility.
10101 On a similar note, many clients - especially DOS clients - limit
10103 service names to eight characters. smbd(8) has no such limitation, but
10104 attempts to connect from such clients will fail if they truncate the
10105 service names. For this reason you should probably keep your service
10106 names down to eight characters in length.
10107 Use of the [homes] and [printers] special sections make life for an
10109 administrator easy, but the various combinations of default attributes
10110 can be tricky. Take extreme care when designing these sections. In
10111 particular, ensure that the permissions on spool directories are
10112 correct.
10113
10115 This man page is part of version 4.12.2 of the Samba suite.
10116
10118 samba(7), smbpasswd(8), smbd(8), nmbd(8), winbindd(8), samba(8), samba-
10119 tool(8), smbclient(1), nmblookup(1), testparm(1).
10120
10122 The original Samba software and related utilities were created by
10123 Andrew Tridgell. Samba is now developed by the Samba Team as an Open
10124 Source project similar to the way the Linux kernel is developed.
10125Samba 4.12.2 04/28/2020 SMB.CONF(5)