This menu describes the general configuration for the server. Unless specified otherwise in other areas, all shares (exports) will inherit these properties.
This allows the computer to change the password for the user in /etc/passwd (the main Linux passwd file) whenever the encrypted password is changed in smbpasswd. This function will call the executable described in the Passwd program field, and execute it with root permissions.
This boolean parameter controls whether Samba attempts to synchronise the UNIX password with the SMB password when the encrypted SMB password in the smbpasswd file is changed. If this is set to true the Passwd program program is called AS ROOT - to allow the new UNIX password to be set without access to the old UNIX password (as the SMB password change code has no access to the old password cleartext, only the new).
See also Passwd program.
Default: Off
This controls what string will show up in the printer comment box in print manager and next to the IPC connection in "net view". It can be any string that you wish your users to see.
It also sets what will appear next to the machine name in the browse lists.
A %v will be replaced with the Samba version number.
A %h will be replaced with the hostname.
Default: Samba %v
Example: University of GNUs Samba Server
This controls which workgroup your server will appear to be in when queried by clients.
Default: set in the Makefile
Example: MYGROUP
This is a username which will be used for access to services which are specified as Public Access (see below). Whatever privileges this user has will be available to any client connecting to the guest service. Typically this user will exist in the password file, but will not have a valid login. If a username is specified in a given service, the specified username overrides this one.
Note that as of version 1.9 of Samba this option may be set differently for each service.
Default: specified at compile time
Example: nobody
This boolean parameter controls whether encrypted passwords will be negotiated with the client. Note that Windows NT 4.0 SP3 and above will by default expect encrypted passwords unless a registry entry is changed. To use encrypted passwords in Samba see the file docs/ENCRYPTION.txt.
By specifying the name of another SMB server (such as a WinNT box) with this option, and using "security = server" you can get Samba to do all its username/password validation via a remote server.
This options sets the name of the password server to use. It must be a netbios name, so if the machine's netbios name is different from its internet name then you may have to add its netbios name to /etc/hosts.
Note that with Samba 1.9.18p4 and above the name of the password server is looked up using the parameter "name resolve order=" and so may resolved by any method and order described in that parameter.
The password server much be a machine capable of using the "LM1.2X002" or the "LM NT 0.12" protocol, and it must be in user level security mode.
NOTE: Using a password server means your UNIX box (running Samba) is only as secure as your password server. DO NOT CHOOSE A PASSWORD SERVER THAT YOU DON'T COMPLETELY TRUST.
Never point a Samba server at itself for password serving. This will cause a loop and could lock up your Samba server!
The name of the password server takes the standard substitutions, but probably the only useful one is %m, which means the Samba server will use the incoming client as the password server. If you use this then you better trust your clients, and you better restrict them with allow hosts!
If you list several hosts in the "password server" option then smbd will try each in turn till it finds one that responds. This is useful in case your primary server goes down.
If you are using a WindowsNT server as your password server then you will have to ensure that your users are able to login from the Samba server, as the network logon will appear to come from there rather than from the users workstation.
Some client/server combinations have difficulty with mixed-case passwords. One offending client is Windows for Workgroups, which for some reason forces passwords to upper case when using the LANMAN1 protocol, but leaves them alone when using COREPLUS!
This parameter defines the maximum number of characters that may be upper case in passwords.
For example, say the password given was "FRED". If password level is set to 1 (one), the following combinations would be tried if "FRED" failed: "Fred", "fred", "fRed", "frEd", "freD". If password level was set to 2 (two), the following combinations would also be tried: "FRed", "FrEd", "FreD", "fREd", "fReD", "frED". And so on.
The higher value this parameter is set to the more likely it is that a mixed case password will be matched against a single case password. However, you should be aware that use of this parameter reduces security and increases the time taken to process a new connection.
A value of zero will cause only two attempts to be made - the password as is and the password in all-lower case.
If you find the connections are taking too long with this option then you probably have a slow crypt() routine. Samba now comes with a fast "ufc crypt" that you can select in the Makefile. You should also make sure the PASSWORD_LENGTH option is correct for your system in local.h and includes.h. On most systems only the first 8 chars of a password are significant so PASSWORD_LENGTH should be 8, but on some longer passwords are significant. The includes.h file tries to select the right length for your system.
Default: 0
Example: 4
The name of a program that can be used to set user passwords.
This is only available if you have enabled remote password changing at compile time (see the comments in the Makefile for details). Any occurrences of %u will be replaced with the user name. The user name is checked for existance before calling the password changing program.
Also note that many passwd programs insist in "reasonable" passwords, such as a minimum length, or the inclusion of mixed case chars and digits. This can pose a problem as some clients (such as Windows for Workgroups) uppercase the password before sending it.
Note that if the Synchronize Linux and SMB Passwords parameter is set to true, then this sequence is called *AS ROOT* when the SMB password in the smbpasswd file is being changed. If the Synchronize Linux and SMB Passwords parameter is set this parameter MUST USE ABSOLUTE PATHS for ALL programs called, and must be examined for security implications. Note that by default
See also Synchronize Linux and SMB Passwords.
Default: /bin/passwd
Example: /sbin/passwd %u
This boolean parameter controls if Samba is a preferred master browser for its workgroup. If this is set to true, on startup, samba will force an election, and it will have a slight advantage in winning the election. It is recommended that this parameter is used in conjunction with Domain master set on, so that samba can guarantee becoming a domain master.
Use this option with caution, because if there are several hosts (whether samba servers, Windows 95 or NT) that are preferred master browsers on the same subnet, they will each periodically and continuously attempt to become the local master browser. This will result in unnecessary broadcast traffic and reduced browsing capabilities.
See OS level.
Default: Off
This integer value controls what level Samba advertises itself as for browse elections. See BROWSING.txt for details.
Allow or disallow access to accounts that have null passwords.
Default: Off
This parameter is a comma delimited set of hosts which are permitted to access a service.
If specified in the Default section then it will apply to all services, regardless of whether the individual service has a different setting.
You can specify the hosts by name or IP number. For example, you could restrict access to only the hosts on a Class C subnet with something like "allow hosts = 150.203.5.". The full syntax of the list is described in the man page hosts_access(5).
You can also specify hosts by network/netmask pairs and by netgroup names if your system supports netgroups. The EXCEPT keyword can also be used to limit a wildcard list. The following examples may provide some help:
Example 1: allow all IPs in 150.203.*.* except one
hosts allow = 150.203. EXCEPT 150.203.6.66
Example 2: allow hosts that match the given network/net mask
hosts allow = 150.203.15.0/255.255.255.0
Example 3: allow a couple of hosts
hosts allow = lapland, arvidsjaur
Example 4: allow only hosts in netgroup "foonet" or local host, but deny access from one particular host
hosts allow = @foonet, localhost hosts deny = pirate
Note that access still requires suitable user-level passwords.
See testparm(1) for a way of testing your host access to see if it does what you expect.
Default: None (i.e., all hosts permitted access)
Example: 150.203.5. myhost.mynet.edu.au
The opposite of 'allow hosts' - hosts listed here are NOT permitted access to services unless the specific services have their own lists to override this one. Where the lists conflict, the 'allow' list takes precedence.
Default: none (i.e., no hosts specifically excluded)
Example: 150.203.4. badhost.mynet.edu.au
The value of the parameter (a decimal integer) represents the number of minutes of inactivity before a connection is considered dead, and it is disconnected. The deadtime only takes effect if the number of open files is zero.
This is useful to stop a server's resources being exhausted by a large number of inactive connections.
Most clients have an auto-reconnect feature when a connection is broken so in most cases this parameter should be transparent to users.
Using this parameter with a timeout of a few minutes is recommended for most systems.
A deadtime of zero indicates that no auto-disconnection should be performed.
Default: 0
Example: 15
The value of the parameter (an integer) allows the debug level (logging level) to be specified in the smb.conf file. This is to give greater flexibility in the configuration of the system.
The default will be the debug level specified on the command line.
Default: ???
Example: 3
This parameter specifies the name of a service which will be connected to if the service actually requested cannot be found.
There is no default value for this parameter. If this parameter is not given, attempting to connect to a non existent service results in an error.
Typically the default service would be a public, read-only service.
Also note that as of 1.9.14 the apparent service name will be changed to equal that of the requested service, this is very useful as it allows you to use macros like %S to make a wildcard service.
Note also that any _ characters in the name of the service used in the default service will get mapped to a /. This allows for interesting things.
Example: pub
where, [pub] path = /%S
Enable WAN-wide browse list collation. Local master browsers on broadcast-isolated subnets will give samba their local browse lists, and ask for a complete copy of the browse list for the whole wide area network. Browser clients will then contact their local master browser, and will receive the domain-wide browse list, instead of just the list for their broadcast-isolated subnet.
Default: Off
This option allows you to setup nmbd to periodically announce itself to arbitrary IP addresses with an arbi trary workgroup name.
This is useful if you want your Samba server to appear in a remote workgroup for which the normal browse propagation rules don't work. The remote workgroup can be anywhere that you can send IP packets to.
For example:
Remote announce: 192.168.2.255/SERVERS 192.168.4.255/STAFF
the above line would cause nmbd to announce itself to the two given IP addresses using the given workgroup names. If you leave out the workgroup name then the one given in the "workgroup" option is used instead.
The IP addresses you choose would normally be the broad cast addresses of the remote networks, but can also be the IP addresses of known browse masters if your network con fig is that stable.
This option replaces similar functionality from the nmbd lmhosts file.
A boolean parameter that controls whether all printers in the printcap will be loaded for browsing by default.
Default: On
This specifies what command to run when the server receives a WinPopup style message.
This would normally be a command that would deliver the message somehow. How this is to be done is up to your imagination.
What I use is:
WinPopup command: csh -c 'xedit %s;rm %s' &
This delivers the message using xedit, then removes it afterwards. NOTE THAT IT IS VERY IMPORTANT THAT THIS COMMAND RETURN IMMEDIATELY. That's why I have the & on the end. If it doesn't return immediately then your PCs may freeze when sending messages (they should recover after 30secs, hopefully).
All messages are delivered as the global guest user. The command takes the standard substitutions, although %u won't work (%U may be better in this case).
Apart from the standard substitutions, some additional ones apply. In particular:
%s = the filename containing the message
%t = the destination that the message was sent to (probably the server name)
%f = who the message is from
You could make this command send mail, or whatever else takes your fancy. Please let me know of any really interesting ideas you have.
Here's a way of sending the messages as mail to root:
WinPopup command: /bin/mail -s 'message from %f on %m' root < %s; rm %s
If you don't have a message command then the message won't be delivered and Samba will tell the sender there was an error. Unfortunately WfWg totally ignores the error code and carries on regardless, saying that the message was delivered.
If you want to silently delete it then try "message command = rm %s".
For the really adventurous, try something like this:
WinPopip command: csh -c 'csh < %s |& /usr/local/samba/bin/smbclient \ -M %m; rm %s' &
this would execute the command as a script on the server, then give them the result in a WinPopup message. Note that this could cause a loop if you send a message from the server using smbclient! You better wrap the above in a script that checks for this :-)
Default: no message command
Example: csh -c 'xedit %s;rm %s' &