SMB.CONF(5) File Formats and Conventions SMB.CONF(5) (NAME) smb.conf - (Samba) (SYNOPSIS) smb.conf Samba . smb.conf Samba . . (HOW CONFIGURATION CHANGES ARE APPLIED) Samba . . smb.conf : o Samba . . o Samba . . smbd(8) winbindd(8) . Samba smbcontrol(1) . (FILE FORMAT) (sections) (parameters) . () . : name = value - . (case-insensitive). . . . . . - (";") ("#") . "\" UNIX . ( ) (boolean) yes/no 1/0 true/false . . create masks . (SECTION DESCRIPTIONS) ( [global]) ( "" "share" ) . . : [global] [homes] [printers] (special sections) . . . . ( ) ( ). (guest) . (guest account) UNIX . . . user = . Windows 95/98/ME/NT/2000 . UNIX (mask) . . . /home/bar . foo : [foo] path = /home/bar read only = no . (printable) . (spool file) . guest ok ( ) : [aprinter] path = /var/tmp read only = yes printable = yes guest ok = yes (SPECIAL SECTIONS) [global] () . PARAMETERS . [homes] [homes] (home directories) . . . . [homes] . : o homes . o (path) . path = [homes] %S . : path = /data/pchome/%S PC (UNIX) . . "homes" . [homes] PC . [homes] . [homes] : [homes] read only = no (guest access) [homes] . (read only) . browseable browseable browseable [homes]. browseable = no [homes] [homes] . [printers] [homes] (printers). [printers] printcap . . . [homes] . printcap . [printers] . : o o o (guest) . [printers] (printable) - . (path) spool (world-writeable) sticky bit . [printers] : [printers] path = /var/tmp guest ok = yes printable = yes (aliases) printcap . pseudo-printcap . : alias|alias|alias|alias... . [global] printcap . pseudo-printcap . . printcap . (newlines) ( ) (|) . SYSV lpstat printcap name = lpstat . printcap name . (USERSHARES) 3.0.23 (Samba) (non-root) . usershares [global] smb.conf . : usershare allow guests (usershares) (guest) . usershare max shares . usershare owner only . usershare path . . usershare prefix allow list . . usershare prefix deny list . . usershare template share . . foo : (root): mkdir /usr/local/samba/lib/usershares chgrp foo /usr/local/samba/lib/usershares chmod 1770 /usr/local/samba/lib/usershares usershare path = /usr/local/samba/lib/usershares usershare max shares = 10 # ( ) global smb.conf . foo . net usershare add sharename path [comment] [acl] [guest_ok=[y|n]] () . net usershare delete sharename . net usershare list wildcard-sharename . net usershare info wildcard-sharename . (PARAMETERS) . [global] ( security). ( create mask). . [homes] [printers] . G [global] . S . S [global] - . - ! . (VARIABLE SUBSTITUTIONS) . "path = /tmp/%u" john "path = /tmp/john" . . : %U ( ). %G (primary group) %U. %h (hostname) . %m NetBIOS ( ). () 445 . include (Domain Controller) [global] server smb transports = 139 . 445 include 2.x . %L NetBIOS . . " " . %M . %R (protocol negotiation). CORE COREPLUS LANMAN1 LANMAN2 NT1 SMB2_02 SMB2_10 SMB3_00 SMB3_02 SMB3_11 SMB2_FF . %d (PID) . %a (remote machine). (Samba) CIFS (CIFSFS) OS/2 (OS2) Mac OS X (OSX) Windows for Workgroups (WfWg) Windows 9x/ME (Win95) Windows NT (WinNT) Windows 2000 (Win2K) Windows XP (WinXP) Windows XP (WinXP64) Windows 2003 2003R2 (Win2K3) Windows Vista (Vista) . UNKNOWN . %I IP . 4.0.0 IPv6 IPv4 IPv4 IPv6 . %J IP / (underscore) . %i IP . 4.0.0 IPv6 IPv4 IPv4 IPv6 . %j IP / (underscore) . %T . %t (YYYYYmmdd_HHMMSS). %D workgroup . %w winbind. %$(envvar) envvar. ( ): %S . %P . %u . %g (primary group) %u. %H (home directory) %u . %N %L . smb.conf . (NAME MANGLING) (name mangling) DOS Windows 8.3 . 8.3 . . testparm . . : case sensitive = yes/no/auto (case sensitive) . . auto ( Linux CIFSVFS smbclient 3.0.5 ) (per-packet) ( UNIX). Windows DOS auto no . Default auto. default case = upper/lower ( ) . Default lower. : . case sensitive = yes preserve case = No short preserve case = No . . preserve case = yes/no ( ) default . Default yes. short preserve case = yes/no ( ) 8.3 default . preserve case = yes . Default yes. 3.0 Windows NT (case preserving). "case sensitive = yes" "case preserve = no" "short preserve case = no" "default case" . (REGISTRY-BASED CONFIGURATION) 3.2.0 . HKLM\Software\Samba\smbconf . : 1. . registry shares "yes" smb.conf . smbd . smb.conf . 2. smb.conf . : - config backend = registry [global] smb.conf . . . include = registry [global] smb.conf . include . . . - . : (foolproof) lock directory config backend : lock directory . regedit net (rpc) registry HKLM\Software\Samba\smbconf . conf net(8) . (IDENTITY MAPPING CONSIDERATIONS) SMB (SID) . POSIX Samba POSIX POSIX . SID POSIX (IDENTITY MAPPING) (ID MAPPING) . (Samba) SID POSIX . idmap config DOMAIN : OPTION (idmap) . SID POSIX . . . . idmap : tdb (idmap_tdb(8)) tdb2 (idmap_tdb2(8)) ldap (idmap_ldap(8)) rid (idmap_rid(8)) hash (idmap_hash(8)) autorid (idmap_autorid(8)) ad (idmap_ad(8)) nss (idmap_nss(8)) rfc2307 (idmap_rfc2307(8)). ID mapping . ID mapping . idmap_rid(8) ( ) tdb . [global] security = domain workgroup = MAIN idmap config * : backend = tdb idmap config * : range = 1000000-1999999 idmap config MAIN : backend = rid idmap config MAIN : range = 5000000-5999999 idmap config TRUSTED : backend = rid idmap config TRUSTED : range = 6000000-6999999 (EXPLANATION OF EACH PARAMETER) abort shutdown script (G) smbd(8) shutdown script . SeRemoteShutdownPrivilege root . Default: abort shutdown script = "" Example: abort shutdown script = /sbin/shutdown -c access based share enum (S) yes ( net view \\sambaserver) . (ACL) sharesec . (access based enumeration) (security descriptors) . Default: access based share enum = no acl allow execute always (S) (boolean) smbd(8) << >> ("open for execution") . Samba 3.6 ACL . Samba 4.0 "False" << >> . "True" Samba << >> Samba 3.6 . Samba 4.0 . : ACL . Default: acl allow execute always = no acl check permissions (S) Samba 3.6.2 Samba . smbd(8) << >> ("open for delete") . . POSIX . ( ) <> Samba << >> . true () smbd << >> . Samba . Samba POSIX ACL . "false" Samba << >> . . (refresh) (Windows Explorer) . . 3.0.21 3.0.20 . Default: acl check permissions = yes acl claims evaluation (G) (security descriptors) Samba Active Directory Claims . AD Claims 2012 - Active Directory ( Kerberos PAC ) . Active Directory claims Samba 4.20 . (claims) . AD DC . AD DC DC ( functional level) 2012 . : ad dc functional level. : o AD DC only: Samba AD DC ( DC 2012 ). o never: . ( ) Authentication Policies Authentication Policy Silos Windows 2012R2 AD DC . Default: acl claims evaluation = AD DC only acl flag inherited canonicalization (S) (Security Descriptor) <> ( DI) . DI ACE ( ) . Security Descriptor DI <> ( DR) Security Descriptor ( DR ). () . no DI DI . rsync (xattrs) ACL VFS acl_xattr ACL . ACL DI . Default: acl flag inherited canonicalization = yes acl group control (S) POSIX (superuser) ACL . Samba primary group owner ( ) ACL . . . ACL . Samba . UNIX . inherit owner UNIX setgid bit . Samba 3.0.23 Samba 3.0.31 . dos filemode . Default: acl group control = no acl map full control (S) smbd(8) POSIX ACE "rwx" (//) POSIX Windows ACL "FULL CONTROL" . true POSIX ACE "rwx" Windows ACL "FULL CONTROL" false POSIX ACE "rwx" Windows ACL . Default: acl map full control = yes ad dc functional level (G) ( ) (functional level) Active Directory Domain Controller . : o 2008_R2: Windows 2008 R2 o 2012: Windows 2012 o 2012_R2: Windows 2012 R2 o 2016: Windows 2016 Samba Samba Active Directory Domain Controller . 2016 . Domain Controller Domain Controller Samba DC . 2016 samba-tool domain level raise --domain-level=2016 Kerberos Claims Dynamic Access Control Samba . Kerberos Claims Dynamic Access Control Samba 2016 Samba 4.19 . Default: ad dc functional level = 2008_R2 Example: ad dc functional level = 2016 add group script (G) AS ROOT smbd(8) . %g . Windows NT . . gid (stdout) . Default: add group script = Example: add group script = /usr/sbin/groupadd %g additional dns hostnames (G) DNS . Default: additional dns hostnames = # empty string (no additional dns names) Example: additional dns hostnames = host2.example.com host3.other.com add machine script (G) Samba Unix <<$>> smbd(8) . add user script %u . %m . Default: add machine script = Example: add machine script = /usr/sbin/adduser -n -g machines -c Machine -d /var/lib/nobody -s /bin/false %u addport command (G) Samba 3.0.23 () <> . smbd . : o port name o device URI deviceURI socket://[:] lpd:/// . Default: addport command = Example: addport command = /etc/samba/scripts/addport.sh addprinter command (G) MS-RPC Windows NT/2000 Samba 2.2 MS Add Printer Wizard (APW) <<...Printers>> . APW Samba Windows NT/2000 . Samba . addprinter command smb.conf smbd(8) . addprinter command ( ) : o printer name o share name o port name o driver name o location o Windows 9x driver location PRINTER_INFO_2 Windows NT/2000 . <> . APW . addprinter command smbd smb.conf APW . smbd ACCESS_DENIED . addprinter command . . Default: addprinter command = Example: addprinter command = /usr/bin/addprinter add share command (G) Samba 2.2.0 Windows NT 4.0 Server Manager . add share command smb.conf . add share command smbd ( uid == 0) SeDiskOperatorPrivilege . add share command (root) . smbd add share command . o configFile - smb.conf. o shareName - . o pathName - **** . o comment - . o max connections . . addprinter command . Default: add share command = Example: add share command = /usr/local/bin/addshare add user script (G) smbd(8) AS ROOT ( ) . Samba UNIX . Windows NT PDC Windows NT . smbd Samba UNIX ON DEMAND ( ) . Windows Samba ( SMB) smbd(8) password server . smbd UNIX UNIX Windows . add user script smbd AS ROOT %u . smbd UNIX . UNIX Windows NT . : security password server delete user script. Default: add user script = Example: add user script = /usr/local/samba/bin/add_user %u add user to group script (G) Windows NT . smbd(8) AS ROOT ( ) . %g %u . adduser . Default: add user to group script = Example: add user to group script = /usr/sbin/adduser %u %g administrative share (S) yes . (Administrative Shares) Windows NT . C$ D$ ADMIN$ . STYPE_DISKTREE_HIDDEN . security . Default: administrative share = no admin users (S) . (root) . . Default: admin users = Example: admin users = jason afs share (S) AFS . path AFS . AFS AFS --with-fake-kaserver configure . Default: afs share = no afs token lifetime (G) fake-kaserver AFS . afs . NEVERDATE 0 . Default: afs token lifetime = 604800 afs username map (G) fake kaserver AFS . AFS Protection Database . DOMAIN+User winbind + . cell . Default: afs username map = Example: afs username map = %u@afs.samba.org aio max threads (G) (thread) smbd / (IO) . . : aio read size : aio write size Default: aio max threads = 100 aio read size (S) Samba . (non-chained and non-chaining) . 0 ( I/O ) 1 ( I/O ) . : aio write size Default: aio read size = 1 Example: aio read size = 0 # Always do reads synchronously aio write behind (S) Samba / . Samba . aio . veto files . Default: aio write behind = Example: aio write behind = /*.tmp/ aio write size (S) Samba . (non-chained and non-chaining) . 0 ( I/O ) 1 ( I/O ) . aio read size () . . : aio read size Default: aio write size = 1 Example: aio write size = 0 # Always do writes synchronously algorithmic rid base (G) Samba uid/gid RID NT ( NT Security Identifiers) . WinNT Win2k RID . UID GID ACL SID . ' ' ' ' ( ) . backend RID RID '' . Default: algorithmic rid base = 1000 Example: algorithmic rid base = 100000 allocation roundup size (S) (allocation size) Windows . SMB1 SMB . MS Visual Studio . MS Visual Studio (crash) . . Samba . (roundup size) . Default: allocation roundup size = 0 Example: allocation roundup size = 1048576 # (to set it to the former default of 1 MiB) allow dcerpc auth level connect (G) DCERPC DCERPC_AUTH_LEVEL_CONNECT . (interfaces) samr lsarpc netlogon no epmapper mgmt rpcecho yes . ( lsarpc netlogon samr srvsvc winreg wkssvc ...) 'allow dcerpc auth level connect:interface = yes' (override) . drsuapi backupkey DCERPC_AUTH_LEVEL_PRIVACY . dnsserver DCERPC_AUTH_LEVEL_INTEGRITY . Default: allow dcerpc auth level connect = no Example: allow dcerpc auth level connect = yes allow dns updates (G) DNS . DNS disabled secure only nonsecure . Default: allow dns updates = secure only Example: allow dns updates = disabled allow insecure wide links (G) wide links (symlinks) unix extensions Samba . UNIX . allow insecure wide links true ( wide links "true") unix extensions . UNIX . Samba . Samba Samba . Default: allow insecure wide links = no allow nt4 crypto (G) "no" ( ) . netlogon ( 'active directory domain controller') NETLOGON_NEG_STRONG_KEYS NETLOGON_NEG_SUPPORTS_AES . Samba 4.2.0 . Samba 4.1.x "yes" "no" . RequireStrongKey = 1 "allow nt4 crypto = yes" . "allow nt4 crypto = yes" (downgrade attacks) . ! 'allow nt4 crypto:COMPUTERACCOUNT = yes' ! CVE-2022-38023 https://bugzilla.samba.org/show_bug.cgi?id=15240 (legacy) 'allow nt4 crypto:COMPUTERACCOUNT = yes' Samba 0 . 'allow nt4 crypto:COMPUTERACCOUNT = yes' . ( 'CVE_2022_38023:error_debug_level = 1' ). "yes" 'allow nt4 crypto:COMPUTERACCOUNT = yes' . 'yes' 'server reject md5 schannel:COMPUTERACCOUNT' 'reject md5 clients' 'server reject aes schannel:COMPUTERACCOUNT' / 'server reject aes schannel' (override) . Default: allow nt4 crypto = no allow nt4 crypto:COMPUTERACCOUNT (G) (legacy) 'allow nt4 crypto = yes' 'allow nt4 crypto:COMPUTERACCOUNT = yes' . COMPUTERACCOUNT sAMAccountName ( '$' ). "yes" Samba 0 . ( 'CVE_2022_38023:warn_about_unused_debug_level = 1' ). Samba 5 . CVE-2022-38023 https://bugzilla.samba.org/show_bug.cgi?id=15240. allow nt4 crypto (override) . 'yes' 'server reject md5 schannel:COMPUTERACCOUNT' 'reject md5 clients' 'server reject aes schannel:COMPUTERACCOUNT' / 'server reject aes schannel' . 'allow nt4 crypto:COMPUTERACCOUNT = yes' 'server reject md5 schannel:COMPUTERACCOUNT = no' 'server reject aes schannel:COMPUTERACCOUNT = no' . allow nt4 crypto:LEGACYCOMPUTER1$ = yes server reject md5 schannel:LEGACYCOMPUTER1$ = no server reject aes schannel:LEGACYCOMPUTER1$ = no allow nt4 crypto:NASBOX$ = yes server reject md5 schannel:NASBOX$ = no server reject aes schannel:NASBOX$ = no allow nt4 crypto:LEGACYCOMPUTER2$ = yes server reject md5 schannel:LEGACYCOMPUTER2$ = no server reject aes schannel:LEGACYCOMPUTER2$ = no No default allow trusted domains (G) security server domain ads . no (workgroup) smbd (trusted) . Samba . DOMA DOMB . DOMB DOMA ( Samba ) . DOMB UNIX Samba DOMA . . Default: allow trusted domains = yes allow unsafe cluster upgrade (G) no () smbd smbd . Samba . yes . Default: allow unsafe cluster upgrade = no apply group policies (G) winbind gpupdate gpo update command Group Policy . Group Policy . (machine policies) Group Policy KDC . Default: apply group policies = no Example: apply group policies = yes async dns timeout (G) DNS Samba . Samba Active Directory ( Active Directory Domain controllers) DNS A AAAA . (timeout) DNS . . Default: async dns timeout = 10 Example: async dns timeout = 20 async smb echo handler (G) Samba async smb echo handler fork . (syscalls) (block) . (timeout) . SMB1 . SMB2 TCP keepalives . Default: async smb echo handler = no auth event notification (G) Samba ( Active Directory Domain Controller) . Samba auth_event . (audit logging) log level . ( Samba ) ( ). log level auth_json_audit:3 . Default: auth event notification = no preload auto services . auto services (G) . homes printers . printcap load printers . Default: auto services = Example: auto services = fred lp colorlp automount fs types (G) (magic numbers) (automounting) . ( 0x) . : . /usr/include/linux/magic.h : stat -f -c '0x%t' /path/to/mountpoint : autofs (0x187) . Default: automount fs types = Example: automount fs types = 0xA0B0C0D0 0x12345678 available (S) <<>> . available = no . . Default: available = yes bind dns directory binddns dir . binddns dir (G) bind named.conf . : bind dns (mount point) private ! Default: binddns dir = /var/lib/samba/bind-dns bind interfaces only (G) SMB . smbd(8) nmbd(8) . nmbd interfaces (bind) . nmbd (broadcast) << >> (0.0.0.0) . nmbd . bind interfaces only nmbd interfaces . (unicast) nmbd interfaces . IP (IP Source address spoofing) nmbd . smbd(8) interfaces . smbd . PPP . bind interfaces only 127.0.0.1 interfaces smbpasswd(8) . SMB smbpasswd SMB localhost - 127.0.0.1 . bind interfaces only 127.0.0.1 interfaces smbpasswd . smbpasswd smbpasswd(8) -r remote machine IP remote machine IP . Default: bind interfaces only = no blocking locks (S) smbd(8) (byte range lock) . (timeout) . no . Default: blocking locks = yes block size (S) smbd(8) . . . ( ) . . . Default: block size = 1024 Example: block size = 4096 browsable browseable . browseable (S) net view (browse list) . Default: browseable = yes browse list (G) smbd(8) NetServerEnum . yes . . Default: browse list = yes cache directory (G) TDB lock directory . Samba 3.4.0 state directory cache directory TDB (persistent) TDB . TDB . . Default: cache directory = /var/cache/samba Example: cache directory = /var/run/samba/locks/cache casesignames case sensitive . case sensitive (S) name mangling . Default: case sensitive = auto change notify (G) (file change notify) . . Default: change notify = yes change share command (G) Samba 2.2.0 Windows NT 4.0 Server Manager . change share command smb.conf . change share command smbd ( uid == 0) SeDiskOperatorPrivilege . change share command (root) . smbd change share command . o configFile - smb.conf. o shareName - . o pathName - **** . o comment - . o max connections . o CSC policy - (client side caching policy) . : manual documents programs disable. . "Printers..." . Default: change share command = Example: change share command = /usr/local/bin/changeshare check parent directory delete on close (S) SMB delete-on-close . Samba Samba . Default: check parent directory delete on close = no check password script (G) . (standard input) . 0 . ( 0 ) . Samba AD AS ROOT ( ) samba(8) . Samba 4.11 (export) : o SAMBA_CPS_ACCOUNT_NAME sAMAccountName . '%u' AD DC . o SAMBA_CPS_USER_PRINCIPAL_NAME AD DC userPrincipalName . o SAMBA_CPS_FULL_NAME displayName . AD DC SAMBA_CPS_ACCOUNT_NAME . () %u '%u' path/to/somescript/ CVE-2026-4408 . : crackcheck cracklib . Default: check password script = # Disabled Example: check password script = /usr/local/sbin/crackcheck client ipc max protocol (G) ( ) $IPC DCERPC . (automatic negotiation) SMB . default SMB3_11 . client max protocol . CORE COREPLUS LANMAN1 LANMAN2 NT1 . Default: client ipc max protocol = default Example: client ipc max protocol = SMB2_10 client ipc min protocol (G) $IPC DCERPC . SMB . default NT1 client min protocol . client max protocol . CORE COREPLUS LANMAN1 LANMAN2 NT1 . Default: client ipc min protocol = default Example: client ipc min protocol = SMB3_11 client ipc signing (G) SMB $IPC DCERPC . desired required disabled. required default SMB . desired SMB disabled SMB . winbindd Domain Controller Active Directory . Default: client ipc signing = default client lanman auth (G) Samba 4.13 LanMan ( NTLM NTLMv2 Kerberos) Samba . client NTLMv2 auth = yes . smbclient(8) samba LANMAN . NT ( Windows NT/2000 Samba Windows 95/98) Samba . LANMAN . Windows 95/98 . client plaintext auth . client ntlmv2 auth NTLMv2 . Default: client lanman auth = no client ldap sasl wrapping (G) client ldap sasl wrapping ldap ( / sealed) . plain sign seal. sign seal Samba OpenLDAP ( 2.3.x ) . samba-tool . seal . winbindd net LDAP Domain Controller . AD DC LDAP sign . seal . Kerberos KDC . LDAP ( 389) STARTTLS LDAPS ( 636) starttls ldaps . NTLMSSP Kerberos TLS (TLS channel bindings) . Default: client ldap sasl wrapping = seal client max protocol (G) ( ) . : o CORE: . . o COREPLUS: CORE . o LANMAN1: . . o LANMAN2: Lanman1. o NT1: . Windows NT. CIFS. o SMB2: SMB. . SMB2 . o SMB2_02: SMB2. o SMB2_10: SMB2 7. SMB2 SMB2_10 . o SMB3: SMB2. 8. SMB3 . o SMB3_00: SMB3 8. o SMB3_02: SMB3 8.1. o SMB3_11: SMB3 10. SMB3 SMB3_11 . SMB . default SMB3_11 . $IPC DCERPC winbindd client ipc max protocol . Default: client max protocol = default Example: client max protocol = LANMAN1 client min protocol (G) . SMB SMB1 . : client max protocol . IPC$ DCERPC winbindd client ipc min protocol . --option='client min protocol=NT1' SMB1 smb.conf . Default: client min protocol = SMB2_02 Example: client min protocol = NT1 client netlogon ping protocol (G) Samba netlogon . ldap (connectionless) LDAPS TCP 636 . : o CLDAP o LDAP o LDAPS o STARTTLS Default: client netlogon ping protocol = CLDAP client NTLMv2 auth (G) Samba 4.13 NTLM LanMan ( NTLMv2 Kerberos) Samba . client NTLMv2 auth = yes . smbclient(8) NTLMv2 . NTLMv2 LMv2 ( ) . ( NT4 < SP4 Win9x Samba 2.2) NTLMv2 NTLMv2 . NTLMv1 client lanman auth client plaintext auth . (share-level) . client lanman auth NTLM ( LANMAN) . Windows Vista NTLMv2 ( 'best practice' ) NTLMv2 LM NTLM. client use spnego yes (SPNEGO) NTLMv2 NTLMSSP . CVE-2016-2111 . Default: client NTLMv2 auth = yes client plaintext auth (G) Samba 4.13 (plaintext) ( NTLM NTLMv2 Kerberos) Samba . client plaintext auth = no . (plaintext) . Default: client plaintext auth = no client protection (G) Samba . : o default - : o client signing o client smb encrypt o plain - . o sign - . o encrypt - . Default: client protection = default client schannel (G) Samba 4.8 . yes (hardcoded) . netlogon schannel . client schannel = no schannel client schannel = auto schannel client schannel = yes netlogon schannel . (Active Directory) (hardcoded) client schannel = yes . require strong key (override) . Default: client schannel = yes Example: client schannel = auto client signing (G) SMB ( SMB signing) . desired required disabled. desired default SMB . required SMB disabled SMB . IPC$ DCERPC winbindd client ipc signing . Default: client signing = default client smb encrypt (G) SMB . SMB1 SMB3 : o SMB1 SMB Samba 3.2 Unix extensions . o SMB2 SMB SMB . Windows 8 . . off if_required desired required. default if_required . SMB1 SMB1 SMB UNIX extensions . SMB GSSAPI ( Windows SSPI) / SMB . SMB/CIFS ssh SMB/CIFS . smbclient Samba 3.2 . Windows . default SMB (probe) . required SMB disabled SMB . SMB3 SMB . SMB . Samba client max protocol SMB3 . client smb encrypt : o default if_required . o desired . o required . . o off . Default: client smb encrypt = default client smb3 encryption algorithms (G) SMB3_11 . '-' . (hardcoded) . : AES-128-CCM SMB3_00 SMB3_02 . Default: client smb3 encryption algorithms = AES-128-GCM, AES-128-CCM, AES-256-GCM, AES-256-CCM Example: client smb3 encryption algorithms = AES-256-GCM Example: client smb3 encryption algorithms = -AES-128-GCM -AES-128-CCM client smb encryption over quic (G) SMB QUIC TLS . client smb encrypt SMB3.0 . client smb encryption over quic no QUIC ( TLS) client smb encrypt . client smb encryption over quic yes TCP tls verify peer ca_and_name client smb encrypt . QUIC TLS . SMB Windows . client smb encryption over quic . Default: client smb encryption over quic = yes client smb3 signing algorithms (G) (signing) SMB3_11 . '-' . (hardcoded) . : AES-128-CMAC SMB3_00 SMB3_02 HMAC-SHA256 SMB2_02 SMB2_10 . Default: client smb3 signing algorithms = AES-128-GMAC, AES-128-CMAC, HMAC-SHA256 Example: client smb3 signing algorithms = AES-128-CMAC, HMAC-SHA256 Example: client smb3 signing algorithms = -AES-128-CMAC client smb transports (G) SMB . (fallback) . 'tcp' tcp PDU SMB . 'tcp' . ':' 'tcp:1445'. 'nbt' netbios tcp PDU SMB . 'nbt' . ':' 'nbt:1139'. 'quic' quic udp . 'quic' . ':' 'quic:1443'. : tls enabled tls ca directories tls trust system cas tls cafile tls certfile tls keyfile tls verify peer. : 'quic' quic.ko Linux https://github.com/lxin/quic ( Linux 6.14). Linux . 'tcp' '139' 'nbt' . . Default: client smb transports = tcp, nbt Example: client smb transports = 445 Example: client smb transports = tcp, tcp:1445 Example: client smb transports = 8000, nbt:1139 Example: client smb transports = tcp, quic, nbt Example: client smb transports = +quic client use kerberos (G) Samba Kerberos . Kerberos IP dns . : o desired - Kerberos NTLM . o required - Kerberos . NTLM . o off - Kerberos NTLM . ( FIPS) required . Default: client use kerberos = desired client use krb5 netlogon (G) ! winbindd ( ) ServerAuthenticateKerberos netlogon . NetBIOS 'client use krb5 netlogon:NETBIOSDOMAIN = yes|no' . reject aes netlogon servers ( ) (override) client use krb5 netlogon yes . 'default' 'no' . 'auto' Kerberos (trust)/ . '--without-ads' '--with-system-heimdalkrb5' ServerAuthenticateKerberos krb5_init_creds_step() . 'auto' 'no' . 'auto' Active Directory ( 'SECURITY = ADS' Active Directory) 'yes' . : Samba ( VERSION ) ! Default: client use krb5 netlogon = default Example: client use krb5 netlogon = no Example: client use krb5 netlogon = auto Example: client use krb5 netlogon = yes client use spnego (G) Samba 4.13 NTLMv2 NTLM LanMan NTLMSSP Samba . client use spnego = yes . Samba ( WindowsXP Windows2000 Samba 3.0) Simple and Protected NEGOtiation ( rfc2478) . Kerberos . client NTLMv2 auth yes (SPNEGO) NTLMv2 NTLMSSP . CVE-2016-2111 . Default: client use spnego = yes cluster addresses (G) nmbd WINS . clustering = yes net ads dns register . Default: cluster addresses = Example: cluster addresses = 10.0.0.1 10.0.0.2 10.0.0.3 clustering (G) Samba tdb ctdb ctdb (messaging backend) . yes ctdb . Default: clustering = no comment (S) Network Neighborhood net view . server string . Default: comment = # No comment Example: comment = Fred's Files config backend (G) . file () registry. smb.conf config backend = registry . . registry shares yes . : . Default: config backend = file Example: config backend = registry config file (G) ( smb.conf ) . ! . . ( ). No default Example: config file = /usr/local/samba/lib/smb.conf.%m copy (S) <<>> (clone) . . . <<>> (template) . . Default: copy = Example: copy = otherservice create krb5 conf (G) no krb5.conf winbind . Winbind krb5 (AD-site) . Winbind (site-aware) krb5.conf krb5 DC . winbind krb5.conf winbind . Default: create krb5 conf = yes create mode create mask . create mask (S) DOS UNIX UNIX <> . (MASK) UNIX . . group other UNIX . Samba UNIX force create mode ( 000 ) <> . . directory mask . Default: create mask = 0744 Example: create mask = 0775 csc policy (S) client-side caching policy ( ) . : manual documents programs disable. Windows . (roaming profiles) csc policy = disable . Default: csc policy = manual Example: csc policy = programs ctdbd socket (G) clustering=yes (Unix domain socket) CTDB . . ( ) . Default: ctdbd socket = Example: ctdbd socket = /var/run/altctdb/ctdbd.socket ctdb locktime warn threshold (G) Samba ctdb ctdb locking.tdb . Samba Samba . Samba . smbd (debug level 0) syslog . Samba . . 0 . Default: ctdb locktime warn threshold = 0 ctdb timeout (G) (timeout) Samba ctdb . Samba (clustering) clustering=yes . (block) ctdb . . . . smb.conf ( ) ctdb . ctdb timeout n n (panic) . 0 () Samba ( ) . Default: ctdb timeout = 0 cups connection timeout (G) printing cups . smbd CUPS . . Default: cups connection timeout = 30 Example: cups connection timeout = 60 cups encrypt (G) printing cups CUPS 1.0.x . Samba CUPS . auto yes no auto CUPS (handshake) TLS . . Default: cups encrypt = no cups options (S) printing cups . cups . CUPS ( << >> CUPS ) . ( <> ) . ABNF PAPI / . (<>) . error_log CUPS Windows Samba <> raw . (raw) /etc/cups/mime.{convs,types} . Default: cups options = "" Example: cups options = "raw media=a4" cups server (G) printing cups . ServerName client.conf CUPS . samba CUPS . () (:) . IPP ( 631) . Default: cups server = "" Example: cups server = mycupsserver Example: cups server = mycupsserver:1631 dcerpc endpoint servers (G) DCE/RPC . Default: dcerpc endpoint servers = epmapper, samr, netlogon, lsarpc, drsuapi, dssetup, unixinfo, browser, eventlog6, backupkey, dnsserver Example: dcerpc endpoint servers = rpcecho deadtime (G) ( ) . deadtime . . . . deadtime . Default: deadtime = 10080 Example: deadtime = 15 debug class (G) (boolean) (DBGC_CLASS) . log level . Default: debug class = no debug encryption (G) smbd libsmb ( smbclient smbget smbspool ) SMB3+ Session Id (Session Key) (Signing Key) (Application Key) (Encryption Key) (Decryption Key) (dump) . 0 . : . . Default: debug encryption = no debug hires timestamp (G) . debug timestamp debug syslog format . Default: debug hires timestamp = yes debug pid (G) (forked) smbd(8) . (process-id) . debug timestamp . Default: debug pid = no debug prefix timestamp (G) debug timestamp . . debug timestamp . Default: debug prefix timestamp = no debug syslog format (G) (yes ( in_logs) always) syslog . . . always STDOUT STDERR . no Samba . debug hires timestamp RFC5424 . Default: debug syslog format = no winbind debug traceid (G) (traceid) winbind . Default: winbind debug traceid = yes debug uid (G) Samba (root) euid egid uid gid . debug timestamp . Default: debug uid = no dedicated keytab file (G) kerberos method "dedicated keytab" keytab Kerberos . Default: dedicated keytab file = Example: dedicated keytab file = /usr/local/etc/krb5.keytab default case (S) name mangling . short preserve case . Default: default case = lower default devmode (S) printable . smbd Windows NT/2k/XP Device Mode (duplex) . ( Win32 ). smbd NULL . Windows NT/2k/XP . devmode (NULL) Explorer.exe . (spoolsv.exe) devmode ( smbd devmode ). . NULL . default devmode = yes smbd . Device Modes Windows NT/2k MSDN . Default: default devmode = yes default default service . default service (G) . NOT ( ). . . guest ok read only . %S (wildcard) . "_" "/" . . Default: default service = Example: default service = pub defer sharing violations (G) . (Sharing violations) . smbd "sharing violation" . (UNIX) . . Default: defer sharing violations = yes delete group script (G) AS ROOT ( ) smbd(8) . %g . Windows NT . Default: delete group script = deleteprinter command (G) MS-RPC Windows NT/2000 Samba 2.2 DeletePrinter() RPC . . deleteprinter command smb.conf . deleteprinter command : printer name. deleteprinter command smbd smb.conf . smbd ACCESS_DENIED . Default: deleteprinter command = Example: deleteprinter command = /usr/bin/removeprinter delete readonly (S) (readonly) . DOS UNIX . rcs UNIX DOS . Default: delete readonly = no delete share command (G) 2.2.0 Windows NT 4.0 Server Manager . delete share command smb.conf . delete share command smbd ( uid == 0) SeDiskOperatorPrivilege . delete share command (root) . smbd delete share command . o configFile - smb.conf. o shareName - . . deleteprinter command . Default: delete share command = Example: delete share command = /usr/local/bin/delshare delete user from group script (G) Windows NT . smbd(8) AS ROOT ( ) . %g %u . Default: delete user from group script = Example: delete user from group script = /usr/sbin/deluser %u %g delete user script (G) smbd(8) RPC (NT) . 'User Manager for Domains' rpcclient . UNIX . Default: delete user script = Example: delete user script = /usr/local/samba/bin/del_user %u delete veto files (S) (vetoed) ( ) ( veto files hide special files hide unreadable hide unwriteable files ). no () . . yes . NetAtalk DOS/Windows ( .AppleDouble). delete veto files = yes ( ). Default: delete veto files = no dfree cache time (S) dfree cache time . Ultrix . <> . 3.0.21 . smbd (disk free) . () . dfree command . . Example: dfree cache time = 60 dfree command (S) dfree command . Ultrix . <> . . . 3.0.21 (per-share) dfree cache time . . ./ . ASCII . . . . : setuid setgid root ( root )! dfree ( ) : #!/bin/sh df "$1" | tail -1 | awk '{print $(NF-4),$(NF-2)}' ( Sys V): #!/bin/sh /usr/bin/df -k "$1" | tail -1 | awk '{print $3" "$5}' . . . Example: dfree command = /usr/local/samba/bin/dfree dgram port (G) NetBIOS . Default: dgram port = 138 directory mode directory mask . directory mask (S) (octal modes) DOS UNIX UNIX . DOS UNIX UNIX AND ('AND'ed) . (MASK) UNIX . . 'group' () 'other' () UNIX . UNIX force directory mode OR ('OR') . 000 ( ). Default: directory mask = 0755 Example: directory mask = 0775 directory security mask (S) 4.0.0 . disable netbios (G) NetBIOS . Windows 2000 NetBIOS (browsing) . NetBIOS NetBIOS . Default: disable netbios = no disable spoolss (G) MS-RPC SPOOLSS 2.0.x . Windows NT/2000 Lanman . 9x/ME . <> NT . Windows NT/2000 . . Default: disable spoolss = no dmapi support (S) DMAPI . (tape) . DMAPI . . . DMAPI . DMAPI . Default: dmapi support = no dns hostname (G) : o DNS AD (join) net ads dns register o Kerberos service principal name o keytab - sync machine password to keytab samba-tool . Default: dns hostname = [netbios name].[realm] Example: dns hostname = client-hostname.example.com dns forwarder (G) DNS DNS () . DNS DNS . (':') . IPv6 ('[' ']') . IPv6 . Default: dns forwarder = Example: dns forwarder = 192.168.0.1 192.168.0.2 ::1 [2001:db8::1] [2001:db8:1:2::1]:54 dns port (G) DNS . DNS (front) . DNS (Dynamic DNS) DNS . DNS DNS . Default: dns port = 53 dns proxy (G) nmbd(8) WINS NetBIOS NetBIOS DNS DNS . NetBIOS DNS ( DNS) . nmbd () DNS (blocking) . Default: dns proxy = yes dns update command (G) DNS . DNS TSIG-GSS . Default: dns update command = /build/samba/src/samba-4.24.6/source4/scripting/bin/samba_dnsupdate Example: dns update command = /usr/local/sbin/dnsupdate dns zone scavenging (G) ( ) DNS . Samba 4.9 . (static) DNS . Samba ( BUG 12451) DNS . DNS ( / non-aging) DNS . Default: dns zone scavenging = no dns zone transfer clients allow (G) IP (zone transfer) DNS bind DLZ . IP hosts allow IP IP IP. DNS (hostnames) . . dns zone transfer clients deny . Default: dns zone transfer clients allow = Example: dns zone transfer clients allow = 192.168.0.1 dns zone transfer clients deny (G) IP ( ) (zone transfer) DNS bind DLZ . IP hosts allow IP IP IP. DNS . dns zone transfer clients allow . (subnet) . Default: dns zone transfer clients deny = Example: dns zone transfer clients deny = 192.168.0.1 domain logons (G) Samba 4.13 NT4 ( Samba AD DC) Samba . domain logons = no . yes Samba netlogon Windows 9X workgroup . Samba NT4 . Domain Control Samba HOWTO Collection . Default: domain logons = no domain master (G) smbd(8) (browse list) (WAN) . nmbd NetBIOS (domain master browser) workgroup . (Local master browsers) workgroup nmbd smbd(8) . . Windows NT ( PDC) NetBIOS workgroup domain master browser workgroup ( Windows NT PDC ). nmbd Windows NT PDC workgroup . domain logons = yes domain master . domain logons ( ) domain master . domain logons = Yes Yes Samba PDC . domain master = No Samba BDC . BDC 'No' . Default: domain master = auto dont descend (S) ( /proc ) () . . Samba "dont descend" . /proc ./proc . :-) Default: dont descend = Example: dont descend = /proc,/dev dos charset (G) DOS SMB (charset) . Samba charset DOS . . charset 850 ASCII . testparm(1) . dos filemode (S) Samba / . DOS/Windows . ( ACL) ( ACL) . . / . VFS acl_xattr acl_tdb ACL . Default: dos filemode = no dos filetime resolution (S) FAT DOS Windows . Samba smbd(8) . Visual C++ Samba . oplocks Visual C++ . . Visual C++ . Visual C++ . Default: dos filetime resolution = no dos filetimes (S) DOS Windows . POSIX (root) . Samba DOS smbd . Microsoft Office 2000 Samba 3.0.14 "no" "yes" . "yes" Microsoft Excel . Default: dos filetimes = yes dsdb event notification (G) Samba ( Active Directory Domain Controller) Samba () . Samba dsdb_event . (audit logging) log level . ( Samba ) ( ). Samba log level ( dsdb_json_audit:5) . Default: dsdb event notification = no dsdb group change notification (G) Samba ( Active Directory Domain Controller) (internal message bus) . Samba dsdb_group_event . log level . ( Samba) ( ). Samba log level dsdb_group_json_audit:5 . Default: dsdb group change notification = no dsdb password event notification (G) Samba ( Active Directory Domain Controller) (internal message bus) . Samba password_event . log level . ( Samba) ( ). Samba log level dsdb_password_json_audit:5 . Default: dsdb password event notification = no durable handles (S) Samba (durable file handles) SMB2 . kernel oplocks = no kernel share modes = no posix locking = no CIFS/SMB2 UNIX NFS . delete on close . Default: durable handles = yes ea support (S) smbd(8) (extended attributes) . VFS: o (extended attributes) . o ( getfattr(1) / setfattr(1) ). o (extended user attributes) ( user_xattr ). "user" . ("user.") . ( "security" "system" "trusted") . SMB 64K NTFS 64K . . EA . 4.9.0 Samba yes . Default: ea support = yes elasticsearch:address (S) Elasticsearch Spotlight Elasticsearch . Default: elasticsearch:address = localhost Example: elasticsearch:address = needle.haystack.samba.org elasticsearch:default_fields (G) Elasticsearch Spotlight "*" . macOS Finder . Elasticsearch (double quotes) . Default: elasticsearch:default_fields = "file.filename", "content" Example: elasticsearch:default_fields = "foo", "bar" elasticsearch:force substring search (G) * (prefix search) . : Spotlight '*=="samba*"' "'query': '(samba*)'" "'query': '(*samba*)'" . Default: elasticsearch:force substring search = no Example: elasticsearch:force substring search = yes elasticsearch:ignore unknown attribute (G) Spotlight . "kMDItemTopic" kMDItemTopic=="hotstuff" . . . Default: elasticsearch:ignore unknown attribute = no Example: elasticsearch:ignore unknown attribute = yes elasticsearch:ignore unknown type (G) Spotlight . "public.calendar-event" kMDItemContentType=="public.calendar-event" . . . Default: elasticsearch:ignore unknown type = no Example: elasticsearch:ignore unknown type = yes elasticsearch:index (S) Elasticsearch Spotlight Elasticsearch . "_all" Elasticsearch . Default: elasticsearch:index = _all Example: elasticsearch:index = spotlight elasticsearch:mappings (G) (metadata) JSON . Elasticsearch Spotlight RPC . Default: elasticsearch:mappings = /usr/share/samba/elasticsearch_mappings.json Example: elasticsearch:mappings = /usr/share/foo/mymappings.json elasticsearch:max results (S) JSON . Elasticsearch Spotlight RPC . 0 . Default: elasticsearch:max results = 100 Example: elasticsearch:max results = 10 elasticsearch:port (S) TCP Elasticsearch Spotlight Elasticsearch . Default: elasticsearch:port = 9200 Example: elasticsearch:port = 9201 elasticsearch:use tls (S) Elasticsearch Spotlight ( Elasticsearch) HTTPS . Default: elasticsearch:use tls = no Example: elasticsearch:use tls = yes enable asu support (G) "Advanced Server for Unix (ASU)" [ADMIN$] IPC . smbd . Print Migrator [ADMIN$] . [ADMIN$] smb.conf . Default: enable asu support = no enable core files (G) (internal exits) core dump . yes . . Default: enable core files = yes Example: enable core files = no enable privileges (G) smbd (privileges) SID net rpc rights . . Domain Admins smbd (root) . (root) smbd . Samba HOWTO . Default: enable privileges = yes enable spoolss (G) disable spoolss. Default: enable spoolss = yes encrypt passwords (G) Samba 4.11 (plaintext) ( NTLM NTLMv2 Kerberos) . encrypt passwords = yes . . NT 4.0 SP3 98 . << >> (User Database) Samba HOWTO . . smbpasswd . . no . smbd(8) smbpasswd(5) ( smbpasswd(8) ) security = [domain|ads] smbd . Default: encrypt passwords = yes enhanced browsing (G) (cross-subnet browse propagation) . (wildcard) Samba WINS Domain Master Browser DMB . DMB . (workgroups) . . . Default: enhanced browsing = yes enumports command (G) <<>> . NT/2000 (port monitor) ( LPT1: COM1: FILE:) ( LPD Port Monitor ) . --"Samba Printer Port". NT/2000 . (smbd ) "Samba Printer Port" enumports command . RPC EnumPorts() . Default: enumports command = Example: enumports command = /usr/bin/listports eventlog list (G) EventViewer . (eventlogs) tdb $(statedir)/eventlog . /var/log/messages tdb (eventlog) . eventlogadm(8) . Default: eventlog list = Example: eventlog list = Security Application Syslog Apache fake directory create times (S) NTFS VFAT . ctime - - . -- . Visual C++ . makefile Visual C++ (object directory) (object file) (make rule) . NMAKE . . . NMAKE . . . NMAKE . Default: fake directory create times = no fake oplocks (S) (Oplocks) SMB ( ) . oplock ( - opportunistic lock) () . oplock / . . fake oplocks = yes smbd(8) oplock . oplocks . ( CDROM) . / (data corruption) . ! Default: fake oplocks = no follow symlinks (S) (symbolic links) smbd(8) . no ( ). /etc/passwd . . ( smbd ). Default: follow symlinks = yes smbd force process locks (S) smbd (Open File Description locks) . . Default: smbd force process locks = no force create mode (S) (UNIX mode bit permissions) . <> . ( ) 000 . create mask <> . <> <> // <> . Default: force create mode = 0000 Example: force create mode = 0755 force directory mode (S) . <> . ( ) 0000 . directory mask . <> <> // <> . Default: force directory mode = 0000 Example: force directory mode = 0755 force directory security mode (S) Samba 4.0.0 . No default group force group . force group (S) (primary group) . . . Samba 2.0.5 : <<+>> . . . force group = +sys sys sys . . force user force group force user . Default: force group = Example: force group = agroup force printername (S) NT ( ) smb.conf . ( shortname) smb.conf . 9x . "Printers" ( "Printers and Faxes") . printername ( printer name ). . . printername (sharename) smb.conf force printername = yes . printername . Printers . Default: force printername = no force security mode (S) Samba 4.0.0 . No default force unknown acl user (S) ACL Windows NT SID ( ) ( ) uid gid . Windows NT ACL ( ) ( XCOPY /O) . winbindd SID Windows NT uid gid . XCOPY /O ACCESS_DENIED . Default: force unknown acl user = no force user (S) . . . . . << >> (forced user) . . Samba 2.0.5 . 2.0.5 ( ). Default: force user = Example: force user = auser fss: prune stale (G) File Server Remote VSS Protocol (FSRVP) FSRVP ( ) . Default: fss: prune stale = no Example: fss: prune stale = yes fss: sequence timeout (G) File Server Remote VSS Protocol (FSRVP) . (timeout) FSRVP . FSRVP 0 . Default: fss: sequence timeout = 180 or 1800, depending on operation Example: fss: sequence timeout = 0 fstype (S) smbd(8) . Windows NT NTFS Samba FAT . Default: fstype = NTFS Example: fstype = Samba get quota command (G) get quota command API . (quotas) . (quota) / . : o o o uid gid <<.>> - . : o 1 - o 2 - (uid = -1) o 3 - o 4 - (gid = -1) . : o 1 - (0 = quota 1 = 2 = ) o 2 - o 3 - (softlimit) o 4 - (hardlimit) o 5 - inode o 6 - inode (softlimit) o 7 - inode (hardlimit) o 8 () - ( 1024 ) Default: get quota command = Example: get quota command = /usr/local/sbin/query_quota getwd cache (G) (tuning) . getwd() . wide links no . Default: getwd cache = yes gpo update command (G) GPO . samba-gpupdate System Access Kerberos KDC . System Access minPwdAge maxPwdAge minPwdLength pwdProperties samdb . Kerberos kdc:service ticket lifetime kdc:user ticket lifetime kdc:renewal lifetime smb.conf . Default: gpo update command = /build/samba/src/samba-4.24.6/source4/scripting/bin/samba-gpupdate Example: gpo update command = /usr/local/sbin/gpoupdate guest account (G) guest ok ( ) . . (login) . "ftp" . "nobody" . . ( su - ) lpr(1) lp(1) . % . Default: guest account = nobody # default can be changed at compile-time Example: guest account = ftp public guest ok . guest ok (S) yes . guest account . restrict anonymous = 2 . security . Default: guest ok = no only guest guest only . guest only (S) yes . guest ok . security . Default: guest only = no hide dot files (S) . Default: hide dot files = yes hide files (S) . 'hidden' DOS . '/' . (wildcards) DOS '*' '?' . hide files NAME hide files : NAME = valid users . . "hide files : NAME" [global] [global] . Unix DOS Unix '/' . (case sensitivity) . Samba . SMB (DAVE) Thursby . : hide files = /.*/DesktopFolderDB/TrashFor%m/resource.frk/ ; hide files = /hideforall1/ hide files : USER = /hidetoforuser/ hide files : GROUP = /hideforgroup/ hide files : UNIVERSITY\Alumnis = /somefile.txt/ hide files : john@university.org = /anotherfile.txt/ hide files : S-1-5-21-123-456-789-1000 = /secretfile.txt/ Default: hide files = # no file are hidden hide new files timeout (S) 0 N . / (ingest/process queue) . . . Default: hide new files timeout = 0 hide special files (S) FIFO . Default: hide special files = no hide unreadable (S) . (off) . . Samba ACL . Default: hide unreadable = no hide unwriteable files (S) . (off) . . . Samba ACL . Default: hide unwriteable files = no honor change notify privilege (S) (change notify privilege) . (notify) . "honor change notify privilege" change notify . change notify . Default: honor change notify privilege = no host msdfs (G) yes Samba Dfs Dfs Dfs . msdfs root . Dfs Samba MSFDS Samba3-HOWTO . Default: host msdfs = yes hostname lookups (G) Samba ( ) IP . hosts deny hosts allow . Default: hostname lookups = no Example: hostname lookups = yes allow hosts hosts allow . hosts allow (S) allow hosts . . [global] . IP . C allow hosts = 150.203.5. . hosts_access(5) . . localhost 127.0.0.1 hosts deny . netgroup network/netmask netgroup . EXCEPT (wildcard) . : : IP 150.203.*.* hosts allow = 150.203. EXCEPT 150.203.6.66 : network/netmask hosts allow = 150.203.15.0/255.255.255.0 : hosts allow = lapland, arvidsjaur : NIS "foonet" hosts allow = @foonet hosts deny = pirate . testparm(1) . Default: hosts allow = # none (i.e., all hosts permitted access) Example: hosts allow = 150.203.5. myhost.mynet.edu.au deny hosts hosts deny . hosts deny (S) hosts allow - . allow . ALL ( 0.0.0.0/0) hosts allow = hosts allow . Default: hosts deny = # none (i.e., no hosts specifically excluded) Example: hosts deny = 150.203.4. badhost.mynet.edu.au idmap backend (G) idmap backend () Winbind SID/uid/gid . idmap config * : backend . Default: idmap backend = tdb idmap cache time (G) idmap Winbind SID/uid/gid (cache) . Samba . Default: idmap cache time = 604800 idmap config DOMAIN : OPTION (G) (ID mapping) Samba SID Windows Unix . Winbindd . Samba idmap config . idmap idmap config (*) idmap . idmap : idmap . : backend = backend_name idmap SID/uid/gid . : tdb (idmap_tdb(8)) tdb2 (idmap_tdb2(8)) ldap (idmap_ldap(8)) rid (idmap_rid(8)) hash (idmap_hash(8)) autorid (idmap_autorid(8)) ad (idmap_ad(8)) nss (idmap_nss(8)). . unixid . idmap . rid hash unixid SID . autorid tdb rid . rid . ad unix Active Directory (schema extensions) . nss winbindd unix nsswitch ldap . range = low - high uid gid (authoritative) . . winbind unix SID . . low min domain uid ! read only = yes|no tdb tdb2 ldap . . idmap_ad(8) CORP idmap_tdb(8) . CORP unix SFU winbind . idmap config * : backend = tdb idmap config * : range = 1000000-1999999 idmap config CORP : backend = ad idmap config CORP : range = 1000-999999 No default winbind gid idmap gid . idmap gid (G) idmap gid idmap . idmap config * : range . idmap config . Default: idmap gid = Example: idmap gid = 10000-20000 idmap negative cache time (G) idmap Winbind SID/uid/gid . Default: idmap negative cache time = 120 winbind uid idmap uid . idmap uid (G) idmap uid idmap . idmap config * : range . idmap config . Default: idmap uid = Example: idmap uid = 10000-20000 include (S) (include ). . %u %P %S. include = registry : registry . . . Default: include = Example: include = /usr/local/samba/lib/admin_smb.conf include system krb5 conf (G) no /etc/krb5.conf krb5.conf winbind . create krb5 conf . Samba MIT Kerberos . Default: include system krb5 conf = yes inherit acls (S) NFS4 ACL POSIX ACL ACL . ACL ACL . unix . unix 0777 ACL . VFS acl_xattr acl_tdb Windows Windows ACL . Default: inherit acls = no inherit owner (S) uid . Samba . : o no - Windows (SID) UNIX (uid) . o windows and unix - Windows (SID) UNIX (uid) . o yes - windows and unix. o unix only - UNIX UNIX . (drop-boxes) (roaming profile) . unix only Windows UNIX . Windows UNIX . NT ACL POSIX acl_xattr VFS acl_xattr:ignore system acls = yes. (folder quotas) SMB ( UNIX) . UNIX . Default: inherit owner = no inherit permissions (S) create mask directory mask force create mode force directory mode inherit permissions (override) . (mode) setgid. / (read/write) . (execute) map archive map hidden map system . setuid ( ). ( ) [homes] . Default: inherit permissions = no init logon delay (G) samlogon init logon delayed hosts . Default: init logon delay = 100 init logon delayed hosts (G) samlogon ( DC XP ). init logon delay . Default: init logon delayed hosts = Example: init logon delayed hosts = 150.203.5. myhost.mynet.de interfaces (G) (browsing) NetBIOS over TCP/IP (NBT) . (broadcast) 127.0.0.1 . . : o ( eth0). eth* "eth" o IP. netmask o IP/mask. o broadcast/mask. "mask" ( 24 C) netmask . "IP" IP . ( IP 127.0.0.1) . SMB3 (SMB3 multi-channel) smbd ( ; , ): "interface[;key1=value1[,key2=value2[...]]]" speed capability if_index options. speed . RSS RDMA . if_index : . . . . options "dynamic" "nodynamic". bind interfaces only . "dynamic" smbd IP / . "nodynamic" / IP . IP IP ( TCP ). ( ) . eth0 IP 192.168.2.10 192.168.3.10 . 255.255.255.0 . . "," ";" (double quoting) . Default: interfaces = Example: interfaces = eth0 192.168.2.10/24 192.168.3.10/255.255.255.0 Example: interfaces = eth0, 192.168.2.10/24; 192.168.3.10/255.255.255.0 Example: interfaces = "eth0;if_index=65,speed=1000000000,capability=RSS" Example: interfaces = "lo;speed=1000000000" "eth0;capability=RSS" Example: interfaces = "lo;speed=1000000000" , "eth0;capability=RSS" Example: interfaces = "eth0;capability=RSS" , "rdma1;capability=RDMA" ; "rdma2;capability=RSS,capability=RDMA" Example: interfaces = "eth0;options=dynamic" invalid users (S) . (paranoid) . '@' netgroup NIS ( NIS ) netgroup NIS . '+' NSS getgrnam() . '&' netgroup NIS ( NIS ). '+' '&' +&group netgroup NIS &+group netgroup NIS ( '@'). %S . [homes] . Default: invalid users = # no invalid users Example: invalid users = root fred admin @wheel iprint server (G) printing iprint . ServerName client.conf CUPS . CUPS . Default: iprint server = "" Example: iprint server = MYCUPSSERVER kdc always include pac (G) PA-PAC-REQUEST . ( ) PAC Kerberos . KDC Heimdal . Default: kdc always include pac = yes certificate backdating compensation (G) (PKINIT) strong certificate binding enforcement = compatibility . : KB5014754: Certificate-based authentication changes on Windows domain controllers Default: certificate backdating compensation = 0 strong certificate binding enforcement (G) (Windows Certificate bindings) KB5014754: Certificate-based authentication changes on Windows domain controllers (PKINIT) . : o none . o compatibility (Weak) . (compatibility) WEAK . certificate backdating compensation . . o full (strong) . . (attribute) altSecurityIdentities : o X509 (Issuer and subject) Example: "X509:IssuerNameSubjectName" . WEAK o X509 (Subject only) Example: "X509:SubjectName" . WEAK o X509 RFC822 Example: "X509:test@example.com" WEAK o X509 (Issuer and serial number) Example: "X509:IssuerName123456789" STRONG o X509 (Subject Key Identifier) Example: "01234xxxxx" STRONG o SHA1 X509 (public key SHA1) Example: "X509:1234567890abcdef" SHA1 STRONG ( 1.3.6.1.4.1.311.25.2) SID . STRONG . Default: strong certificate binding enforcement = full kdc default domain supported enctypes (G) msDS-SupportedEncryptionTypes Active Directory msDS-SupportedEncryptionTypes 0 . HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\KDC\DefaultDomainSupportedEncTypes . ( ) Kerberos . OR : o arcfour-hmac-md5 rc4-hmac 0x4 4 Kerberos RC4 o aes128-cts-hmac-sha1-96 aes128-cts 0x8 8 Kerberos AES 128 bit o aes256-cts-hmac-sha1-96 aes256-cts 0x10 16 Kerberos AES 256 bit o aes256-cts-hmac-sha1-96-sk aes256-cts-sk 0x20 32 AES. KDC AES aes256-cts aes128-cts . AES RC4 ( ). Default: kdc default domain supported enctypes = 0 # . AES ( ) aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96 . arcfour-hmac-md5 aes256-cts-hmac-sha1-96-sk . kdc enable fast (G) 4.16 KDC Heimdal RFC6113 FAST . KDC Heimdal . Default: kdc enable fast = yes kdc force enable rc4 weak session keys (G) RFC8429 rc4-hmac Kerberos Active Directory . Microsoft Windows KDC msDS-SupportedEncryptionTypes Kerberos rc4-hmac ( keytab ) . Default: kdc force enable rc4 weak session keys = no kdc name match implicit dollar without canonicalization (G) (name canonicalization) AS Kerberos . KDC AS User Principal Name 'canonicalize' . Active Directory KDC '$' '$' . 'foo' 'foo$' . ( ) . 'dollar ticket attack' ( ) . 'no' KDC '$' canonicalize . AD . Default: kdc name match implicit dollar without canonicalization = yes kdc require canonicalization (G) Kerberos (canonicalization) . Kerberos (RFC 6806 ) TGT . 'root' 'ROOT$' KDC AD Kerberos 'root' . Kerberos AD root . . ( ) . MIT Kerberos . "kdc name match implicit dollar without canonicalization" Kerberos canonicalize . Default: kdc require canonicalization = no kdc supported enctypes (G) Active Directory KDC . / Network security: Configure encryption types allowed for Kerberos GPO/Local Policies/Security Options HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\SupportedEncryptionTypes . ( ) Kerberos . OR : o arcfour-hmac-md5 rc4-hmac 0x4 4 Kerberos RC4 o aes128-cts-hmac-sha1-96 aes128-cts 0x8 8 Kerberos AES 128 bit o aes256-cts-hmac-sha1-96 aes256-cts 0x10 16 Kerberos AES 256 bit Default: kdc supported enctypes = 0 # : arcfour-hmac-md5 aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96 keepalive (G) ( ) keepalive . keepalive . keepalive . SO_KEEPALIVE keepalive . ( socket options). . SMB1 SMB2 . Default: keepalive = 300 Example: keepalive = 600 kerberos encryption types (G) Kerberos . all strong legacy. Kerberos Kerberos ( MIT Heimdal) . krb5.conf . . Active Directory . Kerberos winbindd(8) net(8) krb5.conf Kerberos . Kerberos . all Active Directory . strong AES . (downgrade attacks) . legacy RC4-HMAC-MD5 . CVE-2022-37966 : https://bugzilla.samba.org/show_bug.cgi?id=15237. Default: kerberos encryption types = all kerberos method (G) Kerberos . : o secrets only - secrets.tdb () o system keytab - keytab o dedicated keytab - keytab o secrets and keytab - secrets.tdb keytab <> <> Principal keytab Kerberos . kerberos method <> dedicated keytab file keytab . 'secrets only' sync machine password to keytab . Default: kerberos method = default kernel change notify (G) SMB (refresh) . inotify . Default: kernel change notify = yes kernel oplocks (S) UNIX oplocks ( ) . Level II oplocks . oplocks Samba oplocks UNIX NFS smbd(8) (oplocked) . SMB/CIFS NFS ( :-). Level II oplocks . no (no-op) . Default: kernel oplocks = no kernel share modes (S) (share modes) SMB sharemode . SMB share modes UNIX NFS . VFS . (durable file handles) SMB2 kernel share modes . no . yes sharemode (sharing violation) . Default: kernel share modes = no kpasswd port (G) Kerberos . Default: kpasswd port = 464 krb5 acceptor report canonical client name (G) Kerberos Kerberos . 'yes' (sAMAccountName) . . Heimdal KDC . Default: krb5 acceptor report canonical client name = yes krb5 port (G) KDC Kerberos . Default: krb5 port = 88 lanman auth (G) Samba 4.11 LanMan ( NTLM NTLMv2 Kerberos) . lanman auth = no . smbd(8) LANMAN . NT ( Windows NT/2000 smbclient Windows 95/98 MS DOS) . LANMAN . Windows 95/98/ME MS DOS . no sambaLMPassword passdb . lanman lanman auth . encrypt passwords LANMAN . ( smbclient) client lanman auth . ntlm auth (override) ntlmv1-permitted yes NTLMv2 LM . NTLMv2 . Samba AD DC LM LM . Default: lanman auth = no large readwrite (G) smbd(8) (streaming) SMB Windows 2000 . Windows 2000 IRIX Solaris 2.4 . Windows 2000 . (on) . . Default: large readwrite = yes ldap admin dn (G) ldap admin dn (Distinguished Name DN) LDAP . ldap admin dn admin dn private/secrets.tdb . smbpasswd(8) . ldap admin dn DN (fully specified) . ldap suffix ldap admin dn . ldap connection timeout (G) LDAP LDAP (timeout) . (failover) . LDAP TCP . LDAP . ldap timeout LDAP . Default: ldap connection timeout = 2 ldap debug level (G) LDAP . OpenLDAP (bit-field) slapd.conf(5) . 1 . LDAP [LDAP] . LDAP ldap debug threshold . Default: ldap debug level = 0 Example: ldap debug level = 1 ldap debug threshold (G) (debug level) ldap . ldap debug level . Default: ldap debug threshold = 10 Example: ldap debug threshold = 5 ldap delete dn (G) ldapsam (entry) Samba . Default: ldap delete dn = no ldap deref (G) Samba LDAP (alias dereferencing) . auto ldap . never finding searching always. LDAP . Default: ldap deref = auto Example: ldap deref = searching ldap follow referral (G) LDAP (referrals) LDAP . on off auto libldap. libldap /etc/openldap/ldap.conf REFERRALS ldap.conf(5) . Default: ldap follow referral = auto Example: ldap follow referral = off ldap group suffix (G) LDAP . ldap suffix . ldap suffix DN . Default: ldap group suffix = Example: ldap group suffix = ou=Groups ldap idmap suffix (G) idmap . ldap suffix . ldap suffix DN . Default: ldap idmap suffix = Example: ldap idmap suffix = ou=Idmap ldap machine suffix (G) ldap . ldap suffix . ldap suffix DN . Default: ldap machine suffix = Example: ldap machine suffix = ou=Computers ldap max anonymous request size (G) ( ) LDAP (anonymous) . . Default: ldap max anonymous request size = 256000 Example: ldap max anonymous request size = 500000 ldap max authenticated request size (G) ( ) LDAP . . Default: ldap max authenticated request size = 16777216 Example: ldap max authenticated request size = 4194304 ldap max search request size (G) ( ) LDAP . . Default: ldap max search request size = 256000 Example: ldap max search request size = 4194304 ldap page size (G) . LDAP () . . Default: ldap page size = 1000 Example: ldap page size = 512 ldap password sync ldap passwd sync . ldap passwd sync (G) Samba SAMBA LDAP NT LM ( workstation /domain trusts) . ldap passwd sync : o Yes = LDAP NT LM pwdLastSet. o No = NT LM pwdLastSet. o Only = LDAP LDAP . Default: ldap passwd sync = no ldap replication sleep (G) Samba LDAP (master) - . <<>> . (domain joins) <<>> LDAP . Samba LDAP . LDAP . . ( ) . Default: ldap replication sleep = 1000 ldapsam:editposix (G) Editposix ldapsam:trusted posix . ldap . winbindd uid/gid / . . ldap ldap suffix . ( ) (Administrator Guest Domain Users Domain Admins Domain Guests) net sam provision . ldap Winbindd ldap smb.conf . ldap ldapsam:trusted = yes ldapsam:editposix = yes . : encrypt passwords = true passdb backend = ldapsam ldapsam:trusted=yes ldapsam:editposix=yes ldap admin dn = cn=admin,dc=samba,dc=org ldap delete dn = yes ldap group suffix = ou=groups ldap idmap suffix = ou=idmap ldap machine suffix = ou=computers ldap user suffix = ou=users ldap suffix = dc=samba,dc=org idmap backend = ldap:"ldap://localhost" idmap uid = 5000-50000 idmap gid = 5000-50000 ldif : dn: dc=samba,dc=org objectClass: top objectClass: dcObject objectClass: organization o: samba.org dc: samba dn: cn=admin,dc=samba,dc=org objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword: secret dn: ou=users,dc=samba,dc=org objectClass: top objectClass: organizationalUnit ou: users dn: ou=groups,dc=samba,dc=org objectClass: top objectClass: organizationalUnit ou: groups dn: ou=idmap,dc=samba,dc=org objectClass: top objectClass: organizationalUnit ou: idmap dn: ou=computers,dc=samba,dc=org objectClass: top objectClass: organizationalUnit ou: computers Default: ldapsam:editposix = no ldapsam:trusted (G) (Samba) (Domain Controller) LDAP NSS (Unix) . /etc/passwd /etc/group . . UNIX /etc/group NSS LDAP . UNIX . . ldapsam:trusted = yes LDAP posixAccount/posixGroup . (auxiliary object classes) POSIX LDAP . ldapsam:trusted = yes NSS ( ). LDAP (logon) . LDAP . Default: ldapsam:trusted = no ldap server require strong auth (G) ldap server require strong auth ldap ldap (sealed) . no allow_sasl_without_tls_channel_bindings yes. LdapEnforceChannelBinding HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\ . no (binds) (simple) sasl . LdapEnforceChannelBinding=0 . allow_sasl_without_tls_channel_bindings bind sasl ( seal) TLS . tls channel bindings yes . bind sasl seal . LdapEnforceChannelBinding=1 . tls channel bindings allow_sasl_over_tls bind sasl tls channel bindings . yes bind sasl tls channel bindings . yes allow_sasl_without_tls_channel_bindings . allow_sasl_over_tls allow_sasl_without_tls_channel_bindings . yes bind bind sasl tls channel bindings TLS . bind sasl tls channel bindings . bind sasl seal . LdapEnforceChannelBinding=2 . Default: ldap server require strong auth = yes ldap ssl (G) ldap SSL . SSL --with-ssl configure . LDAP . start tls ldaps:// URL passdb backend . ldap ssl : o Off = SSL . o start tls = StartTLS LDAPv3 ( RFC2830) . rpc . Default: ldap ssl = start tls ldap suffix (G) (base) ldap sambaDomain . ldap suffix ldap user suffix ldap group suffix ldap machine suffix ldap idmap suffix . DN ldap suffix . Default: ldap suffix = Example: ldap suffix = dc=samba,dc=org ldap timeout (G) (timeout) LDAP . Default: ldap timeout = 15 ldap user suffix (G) (tree) . ldap suffix . ldap suffix DN () . Default: ldap user suffix = Example: ldap user suffix = ou=people level2 oplocks (S) level2 oplocks () . oplock Windows NT oplock oplock ( oplock ) - oplock . level2 oplocks (read-ahead) ( ) ( EXE ) . oplock ( ) oplock <> (read-ahead) . . level2 oplocks CIFS . kernel oplocks level2 oplocks ( yes ). oplocks yes . Default: level2 oplocks = yes lm announce (G) nmbd(8) Lanman ( OS/2 ) . : yes no auto. auto . no . yes Lanman ( ) lm interval . auto Lanman . lm interval . Default: lm announce = auto Example: lm announce = yes lm interval (G) Lanman OS/2 ( lm announce ) ( ) . lm announce Lanman . Default: lm interval = 60 Example: lm interval = 120 load printers (G) printcap (browsing) . printers . Default: load printers = yes local master (G) nmbd(8) (local master browser) . no nmbd (browsing elections) . yes . yes nmbd . no nmbd . Default: local master = yes lock dir lock directory . lock directory (G) . max connections . : . ( tmpfs ) . Default: lock directory = /var/cache/samba Example: lock directory = /var/run/samba/locks locking (S) . locking = no . locking = yes . ( CDROM) no . . . Default: locking = yes lock spin time (G) smbd . Samba 3.0.23 . lock spin count Samba 3.0.24 . . Default: lock spin time = 200 log file (G) ( ) . . Example: log file = /usr/local/samba/var/log.%m logging (G) backend . backend backend. backend backend backend[:option][@loglevel] . 'option' backend . backend backend backend . log level backend . logging syslog syslog only (override) . backend . backend : o syslog o file o systemd o lttng o gpfs o ringbuf ringbuf size 1 MB : ringbuf:size=NBYTES Default: logging = Example: logging = syslog@1 file debuglevel log level. . log level (G) ( ) ( ) smb.conf . 2.2.x . . : o all o tdb o printdrivers o lanman o smb o rpc_parse o rpc_srv o rpc_cli o passdb o sam o auth o winbind o vfs o idmap o quota o acls o locking o msdfs o dmapi o registry o scavenger o dns o ldb o tevent o auth_audit o auth_json_audit o kerberos o drs_repl o smb2 o smb2_credits o dsdb_audit o dsdb_json_audit o dsdb_password_audit o dsdb_password_json_audit o dsdb_transaction_audit o dsdb_transaction_json_audit o dsdb_group_audit o dsdb_group_json_audit o ldapsrv : o catia o dfs_samba4 o extd_audit o fileid o fruit o full_audit o media_harmony o preopen o recycle o shadow_copy o shadow_copy o unityed_media o virusfilter log file @PATH log level = 1 full_audit:1@/var/log/audit.log. (audit) auth_audit --without-json JSON auth_json_audit . Samba Active Directory Domain Controller . NTLM SMB RPC . auth_audit auth_audit_json : o 2: o 3: o 4: o 5: (Anonymous) sam.ldb AD DC dsdb_audit JSON dsdb_json_audit . sam.ldb AD DC dsdb_group_audit JSON dsdb_group_json_audit . dsdb_audit dsdb_json_audit dsdb_group_audit dsdb_group_json_audit dsdb_json_audit : o 5: o 5: (Replicated) DC AD DC dsdb_password_audit JSON dsdb_password_json_audit . auth_audit auth_audit_json . dsdb_password_audit dsdb_password_json_audit : o 5: . : o altSecurityIdentities o dNSHostName o msDS-AdditionalDnsHostName o msDS-KeyCredentialLink o servicePrincipalName dsdb_password_json_audit "action" "Auth info change" . "change" "reset" . (rollbacks) prepare commit dsdb_transaction_audit JSON dsdb_transaction_json_audit . dsdb_transaction_audit dsdb_transaction_json : o 5: (rollback) o 10: (commit) (roll-back) ( ) . . sam.ldb (rollback) . sam.ldb root . . Default: log level = 0 Example: log level = 3 passdb:5 auth:10 winbind:2 Example: log level = 1 full_audit:1@/var/log/audit.log winbind:2 log nt token command (G) NT . . Default: log nt token command = logon drive (G) ( logon home) NT Workstations . (logon server) . Default: logon drive = Example: logon drive = h: logon home (G) Win95/98 NT Workstation Samba PDC . C:\>NET USE H: /HOME . . Win9X (roaming profiles) . : logon home = \\%N\%U\profile ( NetUserGetInfo) . Win9X net use /home \\server\share . logon home logon path . net use /home . . logon home = "" - - . (logon server) . Default: logon home = \\%N\%U Example: logon home = \\remote_smb_server\%U logon path (G) (roaming profiles Desktop NTuser.dat ) . Win 9X . Win 9X logon home . . "Application Data" desktop start menu network neighborhood programs Windows NT . Windows NT . Windows NT NTuser.dat . (read-only) . NTuser.dat - NTuser.man ( MANdatory profile). [homes] . logon path homes ( \\%N\homes\profile_path ). . (Warning) . "\\%N\profile\%U" . passdb tdbsam ldapsam passdb smb.conf ( ). passdb (pdbedit ) . (domain controller) . ( ) . smb.conf passdb . . : logon path = \\PROFILESERVER\PROFILE\%U ( passdb ): logon path = Default: logon path = \\%N\%U\profile logon script (G) (.bat) NT (.cmd) . DOS CR/LF . DOS . [netlogon] . [netlogon] path /usr/local/samba/netlogon logon script = STARTUP.BAT : /usr/local/samba/netlogon/STARTUP.BAT . NET TIME \\SERVER /SET /YES . NET USE U: \\SERVER\UTILS NET USE Q: \\SERVER\ISO9001_QA . [netlogon] . . (classic domain controller) . Active Directory LDAP scriptPath . passdb backend = ldapsam LDAP sambaLogonScript . Default: logon script = Example: logon script = scripts\%U.bat log writeable files on exit (G) CIFS . . "yes" smbd 0 . . . Default: log writeable files on exit = no lppause command (S) (spooling) (print job) . . . %p . %j ( ) . HPUX ( printing=hpux ) -p%p lpq (fence priority) PAUSED SPOOLED PRINTING . lppause PATH . printing SYSV : lp -i %p-%j -H hold printing SOFTQ : qstat -s -j%j -h. Default: lppause command = # determined by printing parameter Example: lppause command = /usr/bin/lpalt %p-%j -p0 lpq cache time (G) lpq () lpq . lpq lpq . /tmp/lpq.xxxx xxxx lpq . 30 30 lpq . lpq . 0 . Default: lpq cache time = 30 Example: lpq cache time = 10 lpq command (S) lpq . . BSD AIX LPRNG PLP SYSV HPUX QNX CUPS SOFTQ. UNIX . printing = . ( Windows for Workgroups) (connection number) . . . %p . . lpq command $PATH . CUPS lpq command smbd . Default: lpq command = # printing Example: lpq command = /usr/bin/lpq -P%p lpresume command (S) (spooling) (print job) . . lppause command . %p . %j ( ) . lpresume command PATH . printing . Default: printing SYSV : lp -i %p-%j -H resume printing SOFTQ : qstat -s -j%j -r Default: lpresume command = # printing Example: lpresume command = /usr/bin/lpalt %p-%j -p2 lprm command (S) . . %p . %j ( ) . lprm command PATH . : lprm command = /usr/bin/lprm -P%p %j lprm command = /usr/bin/cancel %p-%j Default: lprm command = # printing lsa over netlogon (G) (deprecated) RPC AD DC LSARPC IPC \pipe\netlogon . . ( ) AD DC netlogon . Default: lsa over netlogon = no machine password timeout (G) Samba Windows NT Active Directory ( security = domain security = ads ) winbindd (MACHINE ACCOUNT PASSWORD) TDB secrets.tdb . . ( ) Windows NT. smbpasswd(8) security = domain security = ads . Default: machine password timeout = 604800 magic output (S) (magic script) ( magic script ). magic script . Default: magic output = # .out Example: magic output = myfile.txt magic script (S) . UNIX Samba . . magic output ( ) . (shell) CR/LF CR . DOS . (EXPERIMENTAL) . Default: magic script = Example: magic script = user.csh mangled names (S) DOS UNIX DOS ("mangled" ) DOS . (name mangling) . : o yes - 8.3 (DOS) . o no - . o illegal (default) - NTFS . (shortname) . : o - ( ) () . o "~" ( ) . . '~' mangling char . o UNIX DOS . "___" ( ) . - . (name collision) - . / . ( ) Windows/DOS UNIX UNIX . UNIX Windows/DOS (basename) . (sessions) . Default: mangled names = illegal Example: mangled names = no mangle prefix (G) (mangled names) . (name collisions) . . mangle prefix mangling method hash2 . Default: mangle prefix = 1 Example: mangle prefix = 4 mangling char (S) (magic) (name mangling) . '~' . . mangling method hash . Default: mangling char = ~ Example: mangling char = ^ mangling method (G) . : <> <>. <> Samba Samba 2.2.x . <> ( ). Win32 . Default: mangling method = hash2 Example: mangling method = hash map acl inherit (S) ACL NFS4 POSIX ACL . ACL NFS4 . smbd(8) 'protected' ( ) ACL user.SAMBA_PAI ( POSIX ACL) . Windows ACL () NT ACL ACL POSIX . Default: map acl inherit = no map archive (S) DOS . DOS . Samba . ... store dos attributes DOS . create mask ( 100 ). create mask . Default: map archive = yes map hidden (S) DOS (world execute bit) . store dos attributes DOS . create mask ( 001 ). create mask . Default: map hidden = no map readonly (S) (read only) . smbd(8) store dos attributes No . store dos attributes yes . 3.0.21 . : o Yes - DOS . . DOS . ACL . DOS . o Permissions - DOS smbd(8) ACL ( ) . . o No - DOS store dos attributes . CD (mount ) . store dos attributes 'read-only' . 4.9.0 no . store dos attributes 4.9.0 Yes . Default: map readonly = no map system (S) DOS . store dos attributes DOS . create mask ( 010 ). create mask . Default: map system = no map to guest (G) smbd(8) . : o Never - . . o Bad User - guest account . o Bad Password - guest account . <<>> - - . map to guest (Helpdesk) :-). o Bad Uid - (security = {domain|ads}) ( smbd ) . Samba 2.x . winbindd nss_winbind Name Service Switch . (<>) . ( ) <> . Default: map to guest = Never Example: map to guest = Bad User max connections (S) . max connections 0 . . (record lock files) . lock directory . Default: max connections = 0 Example: max connections = 10 max disk size (G) . 100 100 . . 100 max disk size . . 0 max disk size . Default: max disk size = 0 Example: max disk size = 1000 max log size (G) ( ) . .old . 0 . Default: max log size = 5000 Example: max log size = 1000 max mux (G) SMB . . Default: max mux = 50 max open files (G) smbd(8) . (16384) . 16384 16384 Windows 7 (file handle) . UNIX . Default: max open files = 16384 max print jobs (S) . smbd(8) "Out of Space" . Default: max print jobs = 1000 Example: max print jobs = 5000 max reported print jobs (S) (port monitor) . . . Default: max reported print jobs = 0 Example: max reported print jobs = 1000 max smbd processes (G) smbd(8) . smbd(8) . Samba ADDC (fork) . ldap netlogon . Default: max smbd processes = 0 Example: max smbd processes = 1000 max stat cache size (G) stat cache . (1024) stat . . . Default: max stat cache size = 512 Example: max stat cache size = 100 max ttl (G) nmbd(8) << >> ('time to live') NetBIOS ( ) nmbd (broadcast) WINS . . . Default: max ttl = 259200 max wins ttl (G) smbd(8) WINS (wins support = yes) << >> ('time to live') NetBIOS nmbd ( ) . . (518400 ) . Default: max wins ttl = 518400 max xmit (G) smbd(8) SMB1 . 16644 Windows 2000 . 2048 . . Default: max xmit = 16644 Example: max xmit = 8192 mdns name (G) DNS (multicast DNS) (hostname) . NETBIOS . mdns MDNS . Default: mdns name = netbios message command (G) WinPopup . . . : message command = csh -c 'xedit %s;rm %s' & xedit . ( ). '&' . (PC) ( ). (global guest user) . %u ( %U ). : o %s = . o %t = ( ). o %f = . . . root : message command = /bin/mail -s 'message from %f on %m' root < %s; rm %s message command . WfWg . : message command = rm %s Default: message command = Example: message command = csh -c 'xedit %s; rm %s' & min domain uid (G) uid . idmap ranges ! Default: min domain uid = 1000 min print space (S) (spool) . . 0 (spool) . Default: min print space = 0 Example: min print space = 2000 min receivefile size (G) smbd(8) SMBwriteX . SMBwriteX SMB/CIFS recvfile splice ( ). (zero-copy) . . SMBwriteX . POSIX ( SMB/CIFS ) . 128k . 128k 128k . SMB . . Default: min receivefile size = 0 min wins ttl (G) nmbd(8) WINS (wins support = yes) << >> (time to live) NetBIOS nmbd ( ). . ( ) . Default: min wins ttl = 21600 mit kdc command (G) MIT kdc . KDC (build) . Default: mit kdc command = Example: mit kdc command = /opt/mit/sbin/krb5kdc msdfs proxy (S) CIFS . SMB-Dfs . Dfs . Dfs msdfs root host msdfs . No default Example: msdfs proxy = \otherserver\someshare,\otherserver2\someshare msdfs root (S) yes Dfs (Dfs) . Dfs msdfs:serverA\\shareA,serverB\\shareB . Dfs MSDFS Samba3-HOWTO . Default: msdfs root = no msdfs shuffle referrals (S) yes (referral) Dfs Dfs (load balancing) . Dfs MSDFS Samba3-HOWTO . Default: msdfs shuffle referrals = no multicast dns register (G) multicast DNS Avahi . . Default: multicast dns register = yes name cache timeout (G) ( ) () . 0 . Default: name cache timeout = 660 Example: name cache timeout = 0 name resolve order (G) IP . NetBIOS . . : "lmhosts" "host" "wins" "bcast". : o lmhosts : IP lmhosts . lmhosts NetBIOS ( lmhosts ) . o host : IP /etc/hosts DNS. IRIX Solaris /etc/nsswitch.conf . NetBIOS 0x20 () 0x1c ( ) . DNS SRV RR _ldap._tcp.domain . o wins : IP WINSSERVER. WINS . o bcast : (broadcast) interfaces . . lmhosts . ADS (security = ads) name resolve order : name resolve order = wins bcast DC DNS NetBIOS DNS DOMAIN<0x1c> . Default: name resolve order = lmhosts wins host bcast Example: name resolve order = lmhosts bcast host socket address nbt client socket address . nbt client socket address (G) NBT nmbd. nmbd . UDP 0.0.0.0 . . bind interfaces only = Yes interfaces . Default: nbt client socket address = 0.0.0.0 Example: nbt client socket address = 192.168.2.20 nbtd:wins_prepend1Bto1Cqueries (G) 0x1C ( ) 0x1B ( PDC) . (PDC) . ( Windows 2000 Service Pack 2). Default: nbtd:wins_prepend1Bto1Cqueries = yes nbtd:wins_wins_randomize1Clist (G) 0x1C WINS . . "yes" "nbtd:wins_randomize1Clist_mask" . Default: nbtd:wins_wins_randomize1Clist = no nbtd:wins_randomize1Clist_mask (G) <> <> (netmask) . . . Default: nbtd:wins_randomize1Clist_mask = 255.255.255.0 nbt port (G) () NetBIOS IP . Default: nbt port = 137 ncalrpc dir (G) (named pipes) RPC (IPC) . TCP/IP DCE/RPC . 'np' . Default: ncalrpc dir = /run/samba/ncalrpc Example: ncalrpc dir = /var/run/samba/ncalrpc netbios aliases (G) NetBIOS nmbd () . (browse lists) . browse server logon server browse server logon server . Default: netbios aliases = # empty string (no additional names) Example: netbios aliases = TEST TEST1 TEST2 netbios name (G) NetBIOS . DNS . browse server logon server ( DNS ) . NetBIOS () . () netbios name PIPE . PIPE . Default: netbios name = # machine DNS name Example: netbios name = MYNAME netbios scope (G) (scope) . (LAN) . Default: netbios scope = neutralize nt4 emulation (G) winbindd NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION NT4 (Domain Controller) . . NT4 AD . netbios 'neutralize nt4 emulation:NETBIOSDOMAIN = yes' . Default: neutralize nt4 emulation = no nmbd bind explicit broadcast (G) nmbd(8) (broadcast) (bind) . nmbd socket address . . Default: nmbd bind explicit broadcast = yes nsupdate command (G) nsupdate DNS GSS-TSIG . Default: nsupdate command = /usr/bin/nsupdate -g nt hash store (G) samba(8) AD DC NT NTLM NTLMv2 . ( ) NT ( sam.ldb). (unsalted) . arcfour-hmac-md5 KDC - AES . : NT ( ) . : . . (salt) sAMAccountName userAccountControl userPrincipalName . . : o always - NT ( NT ). ntlm auth disabled . o never - NT . o auto - NT ntlm auth disabled . Default: nt hash store = always nt acl support (S) (boolean) smbd(8) (ACL) NT . ACL . 2.2.2 (global) . Default: nt acl support = yes ntlm auth (G) smbd(8) NTLM passdb (SAM ) . NTLM LanMan passdb . NTLM NTLMv2-only . NTLM DC . ntlm auth ntlmv2-only NTLMv2 . NTLMv2 . NTLMv1 MSCHAPv2 (VPN) 802.1x . : o ntlmv1-permitted ( yes) - NTLMv1 . lanman auth . o ntlmv2-only ( no) - NTLMv1 NTLMv2. o mschapv2-and-ntlmv2-only - NTLMv1 MSCHAPv2 ( ntlm_auth). o disabled - NTLM ( LanMan) NTLM. : (Read Only Domain Controllers RODCs) Microsoft Windows LDAP (Plain-text LDAP Simple Bind) DC NTLMv2 . disabled . nt hash store auto NT sam.ldb ( ). Samba 4.5 yes no . Samba 4.7 ntlmv2-only . Default: ntlm auth = ntlmv2-only nt pipe support (G) smbd(8) Windows NT (pipes) NT SMB IPC$ . . Default: nt pipe support = yes ntp signd socket directory (G) NTP . ntpsigndsocket ntp.conf NTP . Default: ntp signd socket directory = /var/lib/samba/ntp_signd nt status support (G) smbd(8) NT Windows NT/2k/XP . . no DOS Samba 2.2.3 . . Default: nt status support = yes ntvfs handler (S) NTVFS . o unixuid: POSIX gid/uid . o cifs: CIFS . . o nbench: nbench . o ipc: SMB (IPC) . IPC$ . o posix: POSIX NT . o print: SMB . LANMAN spoolss DCE/RPC Windows . NTVFS . s3fs () . Default: ntvfs handler = unixuid, default null passwords (G) (null) . : smbpasswd(5). Default: null passwords = no obey pam restrictions (G) Samba 3.0 PAM ( --with-pam) (session) PAM . PAM (clear text) . encrypt passwords = yes PAM . PAM / (challenge/response) SMB . Default: obey pam restrictions = no old password allowed period (G) NTLM . . server role Active Directory Domain Controller . Default: old password allowed period = 60 oplock break wait time (G) Windows 9x WinNT . SMB oplock . ( ) oplock () . (Warning) OPLOCK . Default: oplock break wait time = 0 oplocks (S) smbd (oplocks) . oplock ( ) . (cache) ( Windows NT ). (Oplocks) . veto oplock files . oplock . NFS UNIX . kernel oplocks . Default: oplocks = yes os2 driver map (G) Windows NT OS/2 . : = . HP LaserJet 5 : HP LaserJet 5L = LASERJET.HP LaserJet 5L. << >> (Classical Printing) Samba3-HOWTO . OS/2 Samba3-HOWTO . Default: os2 driver map = os level (G) (browse elections) () . nmbd(8) (local master browser) workgroup (broadcast) . : Windows NT 4.0/2000 Domain Controller . . Samba-3 . << >> (Network Browsing) Samba-3 HOWTO . : . ! Default: os level = 20 Example: os level = 65 pam password change (G) PAM Samba 2.2 PAM . SMB passwd program PAM . passwd chat . Default: pam password change = no panic action (G) (crash) smbd(8) nmbd(8) . . Default: panic action = Example: panic action = /bin/sleep 90000 passdb backend (G) . . : <<>> . : . : o smbpasswd - passdb (plaintext). passdb Samba . smbpasswd . o tdbsam - TDB. TDB ( passdb.tdb private dir ). o ldapsam - passdb LDAP. URL LDAP ( ldap://localhost) LDAP . Start-TLS ( ldap ssl) ldaps:// URL . (double-quotes) . (syntax) LDAP . : passdb backend = tdbsam:/etc/samba/private/passdb.tdb URL LDAP OpenLDAP: passdb backend = ldapsam:"ldap://ldap-1.example.com ldap://ldap-2.example.com" URL LDAP LDAP Netscape: passdb backend = ldapsam:"ldap://ldap-1.example.com ldap-2.example.com" Default: passdb backend = tdbsam passdb expand explicit (G) Samba %- passdb . %G_osver% %G . Default: passdb expand explicit = no passwd chat (G) "chat" smbd(8) . - smbd(8) passwd program . . . unix password sync yes . SMB smbpasswd (cleartext) AS ROOT ( ) . (root) . %n . (%o) encrypt passwords . \n \r \t \s . '*' . . "." . . pam password change yes PAM . \n PAM . Default: passwd chat = *new*password* %n\n *new*password* %n\n *changed* Example: passwd chat = "*Enter NEW password*" %n\n "*Reenter NEW password*" %n\n "*Password changed*" passwd chat debug (G) passwd chat debug () . passwd chat smbd(8) debug level . smbd . Samba passwd chat passwd program . pam password change . . Default: passwd chat debug = no passwd chat timeout (G) smbd passwd chat . . . Default: passwd chat timeout = 2 passwd program (G) UNIX . %u . . passwd . ( Windows for Workgroups) . unix password sync yes SMB smbpasswd AS ROOT ( ) . UNIX smbd SMB ( ). unix password sync . unix password sync no . Default: passwd program = Example: passwd program = /bin/passwd %u password hash gpg key ids (G) samba Domain Controller Active Directory (cleartext) PGP/OpenGPG . (key id) (user id) . . 'Primary:SambaGPG' supplementalCredentials . Domain Controller . Domain Controller Samba . samba gpgme . samba GNUPGHOME export . . . ( samba-tool user getpassword) OpenLDAP ( samba-tool user syncpasswords). Domain Controller samba-tool user syncpasswords Domain Controller ( PDC PDC-emulator). Default: password hash gpg key ids = Example: password hash gpg key ids = 4952E40301FAB41A Example: password hash gpg key ids = selftest@samba.example.com Example: password hash gpg key ids = selftest@samba.example.com, 4952E40301FAB41A password hash userPassword schemes (G) samba(8) Active Directory Domain Controller () . 'Primary:userPassword' supplementalCredentials . (hash type) . : o CryptSHA256 o CryptSHA512 . crypt(3) . (rounds) ':rounds=xxxx' CryptSHA512:rounds=4500 SHA512 . crypt(3) . Domain Controller . Samba . NT Hash . NT Hash NT Hash . . samba-tool user . ( samba-tool user getpassword ) OpenLDAP ( samba-tool user syncpasswords ). : unix password sync Default: password hash userPassword schemes = Example: password hash userPassword schemes = CryptSHA256 Example: password hash userPassword schemes = CryptSHA256 CryptSHA512 Example: password hash userPassword schemes = CryptSHA256:rounds=5000 CryptSHA512:rounds=7000 password server (G) Domain Controller security = [ads|domain] Samba / . '*' Samba AD DC . ( Domain Controller) smb.conf . RPC . '*' DC IP . '*' password server smbd . . /IP '*' Domain Controller DC . Samba DC . name resolve order . Default: password server = * Example: password server = NT-PDC, NT-BDC1, NT-BDC2, * Example: password server = windc.mydomain.com:389 192.168.1.101 * directory path . path (S) . (printable) (spool) . (guest) (readonly) (world-writeable) (sticky bit) . . %u UNIX . %m NetBIOS . . root dir . Default: path = Example: path = /home/fred perfcount module (G) (backend) perfcount SMB . perfcount API smb_perfcount_handler smb.h . pid directory (G) pid . Default: pid directory = /run Example: pid directory = /var/run/ posix locking (S) smbd(8) SMB . POSIX . SMB POSIX SMB ( NFS ) . "no" NFS . Default: posix locking = yes postexec (S) . . root . (unmount ) : postexec = /etc/umount /cdrom Default: postexec = Example: postexec = echo \"%u disconnected from %S from %m (%I)\" >> /tmp/log exec preexec . preexec (S) . . . (message of the day) : preexec = csh -c 'echo \"Welcome to %S!\" | /usr/local/samba/bin/smbclient -M %m -I %I' & :-) : preexec close postexec. Default: preexec = Example: preexec = echo \"%u connected to %S from %m (%I)\" >> /tmp/log preexec close (S) (boolean) preexec . Default: preexec close = no prefered master preferred master . preferred master (G) nmbd(8) (preferred master browser) (workgroup) . yes nmbd (election) . domain master = yes nmbd Domain Master . ( Samba Windows 95 NT) (subnet) (local master browser) . (broadcast) . Default: preferred master = auto prefork backoff increment (G) (master) (worker) prefork . prefork backoff increment "prefork maximum backoff" . "prefork backoff increment: service name" "prefork backoff increment:ldap = 2" . . Default: prefork backoff increment = 10 prefork children (G) (worker processes) prefork ( samba(8) -M). prefork prefork ( ldap kdc netlogon). prefork . CPU . prefork <> <> ldap. Default: prefork children = 4 prefork maximum backoff (G) pre-fork . Default: prefork maximum backoff = 120 preload modules (G) smbd . smbd . Default: preload modules = Example: preload modules = /usr/lib/samba/passdb/mysql.so preserve case (S) default case . NAME MANGLING . Default: preserve case = yes print ok printable . printable (S) yes (spool) . printable ( ) . read only . Default: printable = no printcap cache time (G) . 0 . Default: printcap cache time = 750 Example: printcap cache time = 600 printcap printcap name . printcap name (G) printcap ( /etc/printcap) . [printers] . CUPS printcap name = cups . printing = cups [global] . printcap name = cups printcap (dummy) CUPS CUPS . System V lpstat printcap name = lpstat . Samba SYSV ( System V) . printcap name lpstat Samba lpstat -v (parse) . printcap : print1|My Printer 1 print2|My Printer 2 print3|My Printer 3 print4|My Printer 4 print5|My Printer 5 '|' . Samba . AIX printcap /etc/qconfig . qconfig printcap Samba qconfig AIX . Default: printcap name = /etc/printcap Example: printcap name = /etc/myprintcap print command (S) (spooling) system() . . . print command . : %s, %f - %p - %J - _. %J '%J' CVE-2026-4480 . %c - ( ). %z - ( ) print command %s %f %p . %p . [global] (printable) print command . ( ) . UNIX nobody . guest account [global] . . . ';' . print command = echo Printing %s >> /tmp/print.log; lpr -P %p %s; rm %s . printing . Default: For printing = BSD, AIX, QNX, LPRNG or PLP : print command = lpr -r -P%p %s For printing = SYSV or HPUX : print command = lp -c -d%p %s; rm %s For printing = SOFTQ : print command = lp -d%p -s %s; rm %s For printing = CUPS : Samba libcups printcap = cups CUPS API . System V -oraw lp -c -d%p -oraw; rm %s . printing = cups Samba libcups . Example: print command = /usr/local/samba/bin/myprintscript %p %s printer printer name . printer name (S) (printable) . [global] . printer name lp . Default: printer name = Example: printer name = laserwriter printing (S) . [global] print command lpq command lppause command lpresume command lprm command . . BSD AIX LPRNG PLP SYSV HPUX QNX SOFTQ CUPS IPRINT. CUPS IPRINT CUPS Samba . testparm(1) . . ( print command lpq command ) printing . [printers] . testparm -v. . Default: printing = # Depends on the operating system printjob username (S) . (domain prefix) . Default: printjob username = %U Example: printjob username = %D\%U print notify backchannel (S) Windows SMB (backchannel) . (timeout) SMB . Samba . Default: print notify backchannel = no private directory private dir. . private dir (G) smbd smbpasswd secrets.tdb. . Default: private dir = /var/lib/samba/private queuepause command (S) (pause) . . Windows for Workgroups Printers Windows 95 NT . %p . . PATH . Default: queuepause command = # determined by printing parameter Example: queuepause command = disable %p queueresume command (S) (resume). (queuepause command) . . Windows for Workgroups Printers Windows 95 NT . %p . . PATH . Default: queueresume command = # determined by printing parameter Example: queueresume command = enable %p raw NTLMv2 auth (G) 4.13 NTLMv2 NTLMSSP Samba . raw NTLMv2 auth = no . smbd(8) SMB1 ( SPNEGO) NTLMv2 . lanman auth ntlm auth SPNEGO . NTLMv2 NTLMSSP . Default: raw NTLMv2 auth = no read list (S) (read-only) . read only . invalid users . Default: read list = Example: read list = mary, @students read only (S) writeable . yes . (printable = yes) ( ) (spooling). Default: read only = yes read raw (G) async smb echo handler SMB (raw read) . . . . . Default: read raw = yes realm (G) (realm) . ADS NT4 . DNS . Default: realm = Example: realm = mysambabox.mycompany.com registry shares (G) . smb.conf . . no config backend registry yes . Default: registry shares = no Example: registry shares = yes reject aes netlogon servers (G) winbindd netlogon ServerAuthenticateKerberos . ServerAuthenticateKerberos Windows Server 2025 Active Directory 4.22 'server support krb5 netlogon = yes' . : NETLOGON_NEG_PASSWORD_SET2 NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH NETLOGON_NEG_AUTHENTICATED_RPC. ServerAuthenticateKerberos yes . (downgrade attacks) . NetBIOS 'reject aes netlogon servers:NETBIOSDOMAIN = no' . reject md5 servers . client use krb5 netlogon ( ) . Default: reject aes netlogon servers = no reject md5 clients (G) <> ( ). netlogon ( 'active directory domain controller') NETLOGON_NEG_SUPPORTS_AES . NETLOGON_NEG_SUPPORTS_AES Server 2008R2 Windows 7 Samba 4.0 NetApp ONTAP RC4 (HMAC-MD5) https://www.samba.org/samba/security/CVE-2022-38023.html . CVE-2022-38023 'no' 'yes' https://bugzilla.samba.org/show_bug.cgi?id=15240. ! 'server reject md5 schannel:COMPUTERACCOUNT' ! CVE-2022-38023 https://bugzilla.samba.org/show_bug.cgi?id=15240. (legacy) 'server reject md5 schannel:COMPUTERACCOUNT = no' Samba 0 . 'server reject md5 schannel:COMPUTERACCOUNT = no' . ( 'CVE_2022_38023:error_debug_level = 1' ). <> 'server reject md5 schannel:COMPUTERACCOUNT = no' . 'yes' 'allow nt4 crypto:COMPUTERACCOUNT' 'allow nt4 crypto' 'allow nt4 crypto:COMPUTERACCOUNT = no' . 'yes' 'server reject aes schannel:COMPUTERACCOUNT' / 'server reject aes schannel' (override) . Default: reject md5 clients = yes server reject md5 schannel:COMPUTERACCOUNT (G) <> 'server reject md5 schannel:COMPUTERACCOUNT = no' . COMPUTERACCOUNT sAMAccountName ( '$' ). <> Samba 0 . ( 'CVE_2022_38023:warn_about_unused_debug_level = 1' ). Samba 5 . CVE-2022-38023, https://bugzilla.samba.org/show_bug.cgi?id=15240. reject md5 clients . 'yes' 'allow nt4 crypto:COMPUTERACCOUNT' 'allow nt4 crypto' 'allow nt4 crypto:COMPUTERACCOUNT = no' . 'yes' 'server reject aes schannel:COMPUTERACCOUNT' / 'server reject aes schannel' (override) . 'server reject md5 schannel:COMPUTERACCOUNT = no' 'server reject aes schannel:COMPUTERACCOUNT = no' . server reject md5 schannel:LEGACYCOMPUTER1$ = no server reject aes schannel:LEGACYCOMPUTER1$ = no server reject md5 schannel:NASBOX$ = no server reject aes schannel:NASBOX$ = no server reject md5 schannel:LEGACYCOMPUTER2$ = no server reject aes schannel:LEGACYCOMPUTER2$ = no No default reject md5 servers (G) winbindd aes netlogon . : NETLOGON_NEG_ARCFOUR NETLOGON_NEG_SUPPORTS_AES NETLOGON_NEG_PASSWORD_SET2 NETLOGON_NEG_AUTHENTICATED_RPC. (domain controllers) aes yes . (downgrade attacks) . netbios 'reject md5 servers:NETBIOSDOMAIN = no' . CVE-2022-38023 'no' 'yes' https://bugzilla.samba.org/show_bug.cgi?id=15240 reject aes netlogon servers (override) . require strong key . Default: reject md5 servers = yes remote announce (G) nmbd(8) workgroup IP . Samba (browse propagation) . IP . : remote announce = 192.168.2.255/SERVERS 192.168.4.255/STAFF nmbd workgroup IP . workgroup . IP (broadcast) IP (browse masters) . (Network Browsing) Samba-HOWTO . Default: remote announce = remote browse sync (G) nmbd(8) (browse lists) Samba . . Samba . Samba . IP . : remote browse sync = 192.168.2.255 192.168.4.255 nmbd . IP (broadcast) IP . IP Samba . remote browse sync WINS WINS . Default: remote browse sync = rename user script (G) (root) smbd(8) . (admin authority) SeAddUserPrivilege ( : NT4 User Manager for Domains) POSIX . %uold %unew . 0 . posix . . tdbsam smbpasswd POSIX (home directory). . ldapsam LDAP . samba (uid) . Default: rename user script = require strong key (G) winbindd md5 netlogon . : NETLOGON_NEG_STRONG_KEYS NETLOGON_NEG_ARCFOUR NETLOGON_NEG_AUTHENTICATED_RPC. des no . (downgrade attacks) . netbios 'require strong key:NETBIOSDOMAIN = no' . active directory 'yes' . reject md5 servers (override) . client schannel . Default: require strong key = yes reset on zero vc (G) SMB1 IP . Windows 2003 . (yes) (share modes) . . VC Windows 2003 IP . . (masquerading router) SMB2 SMB3 . Default: reset on zero vc = no restrict anonymous (G) DCERPC SAMR LSA . Windows Server : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\RestrictAnonymous (browse) Netbios . . restrict anonymous = 1 SAMR . restrict anonymous = 2 SAMR IPC$ . guest ok = yes . Default: restrict anonymous = 0 root root directory . root dir root directory . root directory (G) chroot() ( ). . . (soft links) <<..>> ( wide links). root directory <> . root directory . root directory (mirror) . /etc/passwd ( ) ( ) . . Default: root directory = Example: root directory = /homes/smb root postexec (S) postexec root . (unmount) ( CDROM) . Default: root postexec = root preexec (S) preexec root . (mount) ( CDROM) . Default: root preexec = root preexec close (S) preexec close root . Default: root preexec close = no rpc big endian (G) RPC big endian () . little endian () . (endianness) . Default: rpc big endian = no rpc server dynamic port range (G) RPC LSA SAM Netlogon tcp . . RPC (server roles) . Default: rpc server dynamic port range = 49152-65535 rpc server port (G) DCE/RPC TCP/IP . NETLOGON . rpc server dynamic port range 49152. NETLOGON 49153. ( ) rpc server port:netlogon = 4000 . RPC rpc server port:drsuapi = 5000. samba(8) (Active Directory Domain Controller) . 0 rpc server dynamic port range . Default: rpc server port = 0 rpc start on demand helpers (G) samba-dcerpcd (on demand) (np) DCE-RPC smbd winbindd . samba-dcerpcd . samba-dcerpcd systemd "no" samba-dcerpcd . Default: rpc start on demand helpers = yes samba kcc command (G) Samba KCC . (replication topology replication) . samba_kcc . Default: samba kcc command = /build/samba/src/samba-4.24.6/source4/scripting/bin/samba_kcc Example: samba kcc command = /usr/local/bin/kcc security (G) smb.conf . server role security = user (standalone) DC . security = user security = ads security = domain (Windows domain) . ( guest shares) security = user map to guest . . . SECURITY = AUTO server role ( ) . SECURITY = USER server role . (user-level security) << >> ( username map ). ( encrypt passwords ) . force user guest only . . guest account . map to guest . SECURITY = DOMAIN net(8) Windows NT . encrypt passwords yes . / (PDC BDC) Windows NT Windows NT Server . . security = domain security = user . . . guest account . map to guest . password server encrypt passwords . SECURITY = ADS (realm) ADS . (Kerberos) net ADS . (Active Directory Domain Controller) . require strong key = yes client schannel = yes . (Domain Membership) HOWTO . Default: security = AUTO Example: security = DOMAIN security mask (S) Samba 4.0.0 . server addresses (S) (per-share) IP . (Multi-homed) . . Default: server addresses = max protocol server max protocol . protocol server max protocol . server max protocol (G) ( ) . : o LANMAN1: . . o LANMAN2: Lanman1. o NT1: . Windows NT. CIFS. o SMB2: SMB. Windows Vista . SMB2 . o SMB2_02: SMB2. o SMB2_10: SMB2 Windows 7. SMB2 SMB2_10 . o SMB3: SMB2. Windows 8. SMB3 . o SMB3_00: SMB3 Windows 8. o SMB3_02: SMB3 Windows 8.1. o SMB3_11: SMB3 Windows 10. SMB3 SMB3_11 . SMB . Default: server max protocol = SMB3 Example: server max protocol = LANMAN1 min protocol server min protocol . server min protocol (G) . SMB SMB1 . : server max protocol . Default: server min protocol = SMB2_02 Example: server min protocol = NT1 server multi channel support (G) smbd(8) (multi-channel) SMB3 . 4.4 . 4.14 . API FreeBSD Linux FreeBSD . force:server multi channel support=yes . 4.15 ( Linux FreeBSD). Default: server multi channel support = yes server reject aes schannel (G) ! netlogon ( 'active directory domain controller') ServerAuthenticateKerberos . ServerAuthenticateKerberos Server 2025 Samba 4.22 'server support krb5 netlogon = yes' 'client use krb5 netlogon = yes' . CVE_2022_38023 (debug level) . 'server reject aes schannel:COMPUTERACCOUNT = no' 0 . 'server reject aes schannel:COMPUTERACCOUNT = no' . ( 'CVE_2022_38023:error_debug_level = 1' ). 'server reject aes schannel:COMPUTERACCOUNT = no' 5 . 'server reject aes schannel:COMPUTERACCOUNT = no' . ( 'NETLOGON_AES:usage_debug_level = 0' ). 'server reject aes schannel = yes' . 'server reject aes schannel:COMPUTERACCOUNT = no/yes' . 'yes' 'server reject md5 schannel:COMPUTERACCOUNT' 'reject md5 clients' 'server reject md5 schannel:COMPUTERACCOUNT = no' . 'server support krb5 netlogon' . 'server reject aes schannel' (EXPERIMENTAL) . Default: server reject aes schannel = no Example: server reject aes schannel = yes server reject aes schannel:COMPUTERACCOUNT (G) ServerAuthenticateKerberos "server reject aes schannel = yes" . 'server reject aes schannel:COMPUTERACCOUNT = no' . COMPUTERACCOUNT sAMAccountName ( '$' ). CVE_2022_38023 . "no" 0 . ( 'CVE_2022_38023:warn_about_unused_debug_level = 1' ). 5 . server reject aes schannel . 'yes' 'server reject md5 schannel:COMPUTERACCOUNT' 'reject md5 clients' 'server reject md5 schannel:COMPUTERACCOUNT = no' . server reject aes schannel:LEGACYCOMPUTER1$ = no server reject aes schannel:NASBOX$ = no server reject aes schannel:LEGACYCOMPUTER2$ = no server reject aes schannel:HIGHPRIVACYSRV$ = yes server role (G) Samba smb.conf . server role = auto Samba security . server role = standalone server role = member server Samba Windows server role = domain controller Samba Windows . ( guest shares) server role = standalone map to guest . . SERVER ROLE = AUTO Samba Samba security ( ) Samba . SERVER ROLE = STANDALONE security Samba . (standalone) ( username map ) (log-on) . ( encrypt passwords ) . force user guest only UNIX . SERVER ROLE = MEMBER SERVER net(8) Windows . encrypt passwords yes . Samba / Windows Samba Windows Server . UNIX Samba UNIX . Winbind . SERVER ROLE = CLASSIC PRIMARY DOMAIN CONTROLLER (PDC) Samba Windows Samba NT4 . . NetBIOS ( WINS ) PDC . SERVER ROLE = CLASSIC BACKUP DOMAIN CONTROLLER (BDC) Samba Windows Samba NT4 . BDC Samba (redundant) NetBIOS . SERVER ROLE = ACTIVE DIRECTORY DOMAIN CONTROLLER Samba Active Directory Windows Samba . Samba4 HOWTO . SERVER ROLE = IPA PRIMARY DOMAIN CONTROLLER Samba () IPA (forest trust) Active Directory . IPA . Default: server role = AUTO Example: server role = ACTIVE DIRECTORY DOMAIN CONTROLLER server schannel (G) "yes" ( ). ! 'server require schannel:COMPUTERACCOUNT = no' ! 'server require schannel:COMPUTERACCOUNT = no' Samba . 'server require schannel:COMPUTERACCOUNT = no' . ( 'CVE_2020_1472:error_debug_level = 1' ). "auto" (grace period) 'server require schannel:COMPUTERACCOUNT = no' . : CVE-2020-1472(ZeroLogon) https://bugzilla.samba.org/show_bug.cgi?id=14497. server require schannel:COMPUTERACCOUNT ( ) . 'yes' 'server schannel require seal:COMPUTERACCOUNT' / 'server schannel require seal' . Default: server schannel = yes server require schannel:COMPUTERACCOUNT (G) "server schannel = auto" 'server require schannel:COMPUTERACCOUNT = no' . COMPUTERACCOUNT sAMAccountName ( '$' ) . "no" netlogon ( schannel) Samba . ( 'CVE_2020_1472:warn_about_unused_debug_level = 1' ). Samba . : CVE-2020-1472(ZeroLogon) https://bugzilla.samba.org/show_bug.cgi?id=14497. server schannel . 'yes' 'server schannel require seal:COMPUTERACCOUNT' / 'server schannel require seal' . 'server require schannel:COMPUTERACCOUNT = no' 'server schannel require seal:COMPUTERACCOUNT = no' . server require schannel:LEGACYCOMPUTER1$ = no server require schannel seal:LEGACYCOMPUTER1$ = no server require schannel:NASBOX$ = no server require schannel seal:NASBOX$ = no server require schannel:LEGACYCOMPUTER2$ = no server require schannel seal:LEGACYCOMPUTER2$ = no server schannel require seal (G) "yes" ( ). netlogon netlogon / (privacy/encryption) . Windows . HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\RequireSeal=2 ! 'server schannel require seal:COMPUTERACCOUNT' ! CVE-2022-38023 : https://bugzilla.samba.org/show_bug.cgi?id=15240. 'server schannel require seal:COMPUTERACCOUNT = no' Samba . 'server schannel require seal:COMPUTERACCOUNT = no' . ( 'CVE_2022_38023:error_debug_level = 1' ). "no" (grace period) 'server schannel require seal:COMPUTERACCOUNT = no' . 'yes' 'server require schannel:COMPUTERACCOUNT' 'server schannel' 'server require schannel:COMPUTERACCOUNT = yes' . server schannel require seal:COMPUTERACCOUNT () . Default: server schannel require seal = yes server schannel require seal:COMPUTERACCOUNT (G) "server schannel require seal = no" 'server schannel require seal:COMPUTERACCOUNT = no' . COMPUTERACCOUNT sAMAccountName ( '$' ) . "no" Samba . ( 'CVE_2022_38023:warn_about_unused_debug_level = 1' ). Samba . : CVE-2022-38023 https://bugzilla.samba.org/show_bug.cgi?id=15240. 'server schannel require seal' . 'yes' 'server require schannel:COMPUTERACCOUNT' 'server schannel' 'server require schannel:COMPUTERACCOUNT = yes' . server require schannel seal:LEGACYCOMPUTER1$ = no server require schannel seal:NASBOX$ = no server require schannel seal:LEGACYCOMPUTER2$ = no server services (G) Samba . smb.conf + - . Default: server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl, ft_scanner, winbindd, ntp_signd, kcc, dnsupdate, dns Example: server services = -s3fs, +smb server signing (G) SMB1 SMB2 . default auto mandatory disabled. smb signing default smb server role active directory domain controller (disabled) . auto SMB1 . mandatory SMB1 disabled SMB . SMB2 . SMB2 (negotiate) disabled auto . mandatory SMB2 . Default: server signing = default server smb encrypt (S) SMB . SMB1 SMB2 : o SMB1 Samba SMB Samba 3.2 Unix . o SMB2 SMB SMB 3.0 Windows 8 . . off if_required desired required. default if_required . SMB1 Samba SMB1 SMB UNIX . SMB GSSAPI ( SSPI Windows) / SMB . SMB/CIFS ssh SMB/CIFS . smbclient Samba 3.2 Linux CIFSFS MacOS/X . Windows . . mandatory . "access denied" . (/ UNIX ) . SMB SMB Windows ( server signing ) GSSAPI . auto default SMB . mandatory SMB disabled SMB . SMB3.0 SMB SMB 3.0 . Samba server max protocol SMB3 . Windows 8 Windows server 2012 smbclient Samba 4.1 . : o SMB . o . . . o . . o . . (tree connections) . server smb encrypt : o default if_required . o desired . o required . . o off . server smb encrypt = required ( off ) . o desired . o required . Samba Windows : Windows RejectUnencryptedAccess . Samba server smb encrypt if_required required . Samba required desired Windows . o off if_required . Default: server smb encrypt = default server smb3 encryption algorithms (G) SMB3_11 . '-' . (hardcoded) . : AES-128-CCM SMB3_00 SMB3_02 . Default: server smb3 encryption algorithms = AES-128-GCM, AES-128-CCM, AES-256-GCM, AES-256-CCM Example: server smb3 encryption algorithms = AES-256-GCM Example: server smb3 encryption algorithms = -AES-128-GCM -AES-128-CCM server smb encryption over quic (G) SMB QUIC SMB . server smb encrypt SMB3.0 . server smb encryption over quic no QUIC ( TLS) server smb encrypt SMB QUIC . . server smb encryption over quic yes TCP QUIC server smb encrypt . QUIC TLS . SMB Windows . server smb encryption over quic . SMB DisableSmbEncryptionOnSecureConnection Set-SmbServerConfiguration . Default: server smb encryption over quic = yes server smb3 signing algorithms (G) (signing algorithms) SMB3_11 . '-' . (hardcoded) . : AES-128-CMAC SMB3_00 SMB3_02 HMAC-SHA256 SMB2_02 SMB2_10 . Default: server smb3 signing algorithms = AES-128-GMAC, AES-128-CMAC, HMAC-SHA256 Example: server smb3 signing algorithms = AES-128-CMAC, HMAC-SHA256 Example: server smb3 signing algorithms = -AES-128-CMAC server smb transports (G) SMB (transports) (listen ). mDNS 'tcp' 'nbt' . 'tcp' TCP SMB PDU . 'tcp' 445 . ':' 'tcp:1445'. 'nbt' NetBIOS TCP SMB PDU . 'nbt' 139 . ':' 'nbt:1139'. 'quic' QUIC UDP . 'quic' 443 . ':' 'quic:1443'. : tls enabled, tls cafile, tls certfile tls keyfile. tls cafile, tls certfile tls keyfile (self-signed) TLS . : 'quic' quic.ko Linux https://github.com/lxin/quic ( Linux 6.14 ). . 'tcp' '139' 'nbt' . . Default: server smb transports = tcp, nbt Example: server smb transports = 445 Example: server smb transports = tcp, tcp:1445 Example: server smb transports = 8000, nbt:1139 Example: server smb transports = tcp, quic, nbt Example: server smb transports = +quic smb ports (G) server smb transports . No default server string (G) (print manager) IPC net view . . (browse lists) . %v Samba . %h (hostname) . Default: server string = Samba %v Example: server string = University of GNUs Samba Server server support krb5 netlogon (G) ! netlogon ( 'active directory domain controller') ServerAuthenticateKerberos . ServerAuthenticateKerberos Server 2025 Windows Samba 4.22 'server support krb5 netlogon = yes' 'client use krb5 netlogon = yes' . 'server reject aes schannel:COMPUTERACCOUNT = yes' 'server reject aes schannel = yes' . Default: server support krb5 netlogon = no Example: server support krb5 netlogon = yes set primary group script (G) Posix NT Windows (auxiliary groups) (primary group) . (windows user manager) SAM net rpc vampire unix . %u . %g . Default: set primary group script = Example: set primary group script = /usr/sbin/usermod -g '%g' '%u' set quota command (G) set quota command API Samba . Samba quota . (quota) . : o 1 - . ( ) . o 2 - o 1 - (user quotas) o 2 - (uid = -1) o 3 - (group quotas) o 4 - (gid = -1) o 3 - id ( uid gid -1 ) o 4 - (0 = 1 = 2 = ) o 5 - (block softlimit) o 6 - (block hardlimit) o 7 - inode (inode softlimit) o 8 - inode (inode hardlimit) o 9() - 1024 . Default: set quota command = Example: set quota command = /usr/local/sbin/set_quota share:fake_fscaps (S) sparse files ( ) (block reflink copy) . share:fake_fscaps = 64 SPARSE_FILES (0x40) . share:fake_fscaps = 134217728 SUPPORTS_BLOCK_REFCOUNTING (0x8000000) . BTRFS XFS ZFS. MS-FSCC 2.5.1 FileFsAttributeInformation . (decimal) . Default: share:fake_fscaps = 0 short preserve case (S) (boolean) 8.3 ( ) default case . preserve case = yes / . NAME MANGLING . Default: short preserve case = yes show add printer wizard (G) MS-RPC Windows NT/2000 Samba 2.2 ""Printers..."" Samba . MS Add Printer Wizard (APW) . . Windows NT/2000 OpenPrinterEx() Administrator (handle) . ( root SePrintOperatorPrivilege ) OpenPrinterEx() . APW . show add printer wizard OpenPrinterEx() . APW . . Default: show add printer wizard = yes shutdown script (G) smbd(8) (shutdown) . SeRemoteShutdownPrivilege root . %z %t %r %f : o %z . o %t . o %r -r . NT (reboot) . o %f -f . NT . shutdown: #!/bin/bash time=$2 let time="${time} / 60" let time="${time} + 1" /sbin/shutdown $3 $4 +$time $1 & shutdown ( ) (background) . Default: shutdown script = Example: shutdown script = /usr/local/samba/sbin/shutdown %m %t %r %f unix extensions smb1 unix extensions . smb1 unix extensions (G) Samba SMB1/CIFS HP . Samba (symbolic links) (hard links) SMB1/CIFS . Windows . wide links . allow insecure wide links . Default: smb1 unix extensions = yes smb2 disable lock sequence checking (G) smbd(8) (lock sequence checking) (multi-channel) durable handles . [MS-SMB2] ( 3.3.5.14 Receiving an SMB2 LOCK Request) Open.IsResilient Open.IsDurable Open.IsPersistent TRUE Connection.Dialect SMB 3.x Connection.ServerCapabilities SMB2_GLOBAL_CAP_MULTI_CHANNEL . Windows Server ( v2004) Open.IsResilient Open.IsPersistent . [MS-SMB2] . Samba multi-channel . : Open.IsResilient Open.IsPersistent Windows Server . : . : Samba Open.IsResilient Open.IsPersistent . Default: smb2 disable lock sequence checking = no Example: smb2 disable lock sequence checking = yes smb2 disable oplock break retry (G) smbd(8) server multi channel support = yes oplock SMB2 . [MS-SMB2] oplock SMB2 . Windows Server ( 2019) oplock SMB2 . [MS-SMB2] . Samba oplock SMB2 . : Windows Server . : . : oplock SMB2 leases . Default: smb2 disable oplock break retry = no Example: smb2 disable oplock break retry = yes smb2 leases (G) smbd SMB2 leases . (Leasing) SMB2 oplock SMB1 . oplocks = yes kernel oplocks = no . Default: smb2 leases = yes smb2 max credits (G) SMB2 Samba . max mux SMB1 . . 8192 (credits) SMB2 Windows 2008R2 . Default: smb2 max credits = 8192 smb2 max read (G) smbd(8) (read) SMB2 . (8MiB) Windows Server 2012 r2 . 8MiB / (dialect) smb2 ( SMB == 2.0 SMB >= 2.1 LargeMTU). Large MTU NBT ( tcp ) . Default: smb2 max read = 8388608 smb2 max trans (G) smbd(8) QUERY_INFO SMB2 . (8MiB) Windows Server 2012 r2 . 8MiB / (dialect) smb2 ( SMB == 2.0 SMB >= 2.1 LargeMTU). Large MTU NBT ( tcp ) . Default: smb2 max trans = 8388608 smb2 max write (G) smbd(8) (write) SMB2 . (8MiB) Windows Server 2012 r2 . 8MiB / (dialect) smb2 ( SMB == 2.0 SMB => 2.1 LargeMTU). Large MTU NBT ( tcp ) . Default: smb2 max write = 8388608 smb3 directory leases (G) (directory leases) SMB3 smbd . Directory Leasing SMB3 ( ) . smb3 directory leases yes no auto auto . auto clustering . clustering smb3 directory leases . smb3 directory leases smb2 leases = yes oplocks = yes kernel oplocks = no . smb3 directory leases strict rename . Default: smb3 directory leases = auto smb3 share cap:CONTINUOUS AVAILABILITY (S) SMB3 SMB2_SHARE_CAP_CONTINUOUS_AVAILABILITY . ( ) . : (disk shares) . ctdb (continuously available) (persistent handles) . SMB2_SHARE_CAP_CONTINUOUS_AVAILABILITY SMB2_CAP_PERSISTENT_HANDLES . SMB2_SHARE_CAP_CONTINUOUS_AVAILABILITY SMB2_SHARE_CAP_CLUSTER . . smb3 share cap:CONTINUOUS AVAILABILITY SMB2_SHARE_CAP_CONTINUOUS_AVAILABILITY . : ! smb3 share cap:CONTINUOUS AVAILABILITY = yes No default smb3 share cap:SCALE OUT (S) SMB3 SMB2_SHARE_CAP_SCALEOUT . / (retry/reconnect) . : . ctdb (node) SMB2_SHARE_CAP_SCALEOUT . smb3 share cap:SCALE OUT SMB2_SHARE_CAP_SCALEOUT clustering yes . clustering = yes smb3 share cap: SCALE OUT = no No default smb3 share cap:CLUSTER (S) SMB3 SMB2_SHARE_CAP_CLUSTER . witness [MS-SWN] . : . rpcd_witness samba-dcerpcd(8) (on demand helper) ctdb . SMB2_SHARE_CAP_CLUSTER clustering yes rpc start on demand helpers no . smb3 share cap:SCALE OUT SMB2_SHARE_CAP_CLUSTER clustering rpc start on demand helpers . Example SMB2_SHARE_CAP_CLUSTER: clustering = yes rpc start on demand helpers = no smb3 share cap: CLUSTER = no Example SMB2_SHARE_CAP_CLUSTER: smb3 share cap: CLUSTER = yes Example witness smb3 share cap:CONTINUOUS AVAILABILITY (USE AT YOUR OWN RISK!): clustering = yes rpc start on demand helpers = no # This is the default with the above: # smb3 share cap: CLUSTER = yes # # Use at you own risk! smb3 share cap: CONTINUOUS AVAILABILITY = yes No default smb3 share cap:ASYMMETRIC (S) SMB3_02 SMB2_SHARE_CAP_ASYMMETRIC . (transport) witness . net witness share-move . : . ctdb SMB2_SHARE_CAP_ASYMMETRIC . smb3 share cap:ASYMMETRIC SMB2_SHARE_CAP_ASYMMETRIC . Example SMB2_SHARE_CAP_ASYMMETRIC: smb3 share cap: ASYMMETRIC = yes Example witness smb3 share cap:CONTINUOUS AVAILABILITY (USE AT YOUR OWN RISK!): clustering = yes rpc start on demand helpers = no # This is the default with the above: # smb3 share cap: CLUSTER = yes # # Use at you own risk! smb3 share cap: CONTINUOUS AVAILABILITY = yes smb3 share cap: ASYMMETRIC = yes No default smb3 unix extensions (S) SMB 3.1.1 Unix Extensions. Default: smb3 unix extensions = yes smbd async dosmode (S) (sync) (async) DOS . . Default: smbd async dosmode = no smbd getinfo ask sharemode (S) (file write time) locking.tdb . . Default: smbd getinfo ask sharemode = yes smbd max async dosmode (S) DOS . Default: smbd max async dosmode = aio max threads * 2 smbd max xattr size (S) (extended attributes) EA (alternate data streams) vfs_streams_xattr . Samba . Linux VFS 64 KiB . FreeBSD pread() pwrite() extattr FreeBSD MiB . Samba STATUS_FILESYSTEM_LIMITATION . xattr . MacOS AFP_Resource vfs_fruit AFP_Resource . vfs_fruit . Default: smbd max xattr size = 65536 smbd profiling share (S) (per-share profiling) . . smbd profiling level . Default: smbd profiling share = no smbd profiling level (G) . off count on. Default: smbd profiling level = off Example: smbd profiling level = on smbd search ask sharemode (S) locking.tdb . . Default: smbd search ask sharemode = yes smb encrypt (S) server smb encrypt . Default: smb encrypt = default smb passwd file (G) smbpasswd . smbpasswd Samba . : smb passwd file = /etc/samba/smbpasswd Default: smb passwd file = /var/lib/samba/private/smbpasswd socket options (G) socket options . (auto-tuning) . TCP/IP . . . . (tune) . Samba . Samba . ( man setsockopt ). Samba "Unknown socket option" . include includes.h . (patch) samba-technical@lists.samba.org . . : o SO_KEEPALIVE o SO_REUSEADDR o SO_BROADCAST o TCP_NODELAY o TCP_KEEPCNT * o TCP_KEEPIDLE * o TCP_KEEPINTVL * o IPTOS_LOWDELAY o IPTOS_THROUGHPUT o SO_REUSEPORT o SO_SNDBUF * o SO_RCVBUF * o SO_SNDLOWAT * o SO_RCVLOWAT * o SO_SNDTIMEO * o SO_RCVTIMEO * o TCP_FASTACK * o TCP_QUICKACK o TCP_NODELAYACK o TCP_KEEPALIVE_THRESHOLD * o TCP_KEEPALIVE_ABORT_THRESHOLD * o TCP_DEFER_ACCEPT * o TCP_USER_TIMEOUT * '*' . 1 0 1 0 . SOME_OPTION = VALUE SO_SNDBUF = 8192. = . : socket options = IPTOS_LOWDELAY : socket options = IPTOS_LOWDELAY TCP_NODELAY (WAN) IPTOS_THROUGHPUT . Samba . ! Default: socket options = TCP_NODELAY Example: socket options = IPTOS_LOWDELAY spn update command (G) servicePrincipalName spn_update_list . Default: spn update command = /build/samba/src/samba-4.24.6/source4/scripting/bin/samba_spnupdate Example: spn update command = /usr/local/sbin/spnupdate spoolss: architecture (G) spoolss . spoolss . Default: spoolss: architecture = Windows x64 Example: spoolss: architecture = Windows NT x86 spoolss: os_major (G) . (build number) . : 5.0.2195 (Windows 2000). 6.1.7601 (Windows 2008 R2) . Default: spoolss: os_major = 5 Example: spoolss: os_major = 6 spoolss: os_minor (G) . (build number) . : 5.0.2195 (Windows 2000). 6.1.7601 (Windows 2008 R2) . Default: spoolss: os_minor = 0 Example: spoolss: os_minor = 1 spoolss: os_build (G) . (build number) . : 5.0.2195 (Windows 2000). 6.1.7601 (Windows 2008 R2) . Default: spoolss: os_build = 2195 Example: spoolss: os_build = 7601 spoolss_client: os_major (G) . (build number) . : 6.1.7007 (Windows 7 Windows Server 2008 R2). Default: spoolss_client: os_major = 6 spoolss_client: os_minor (G) . (build number) . : 6.1.7007 (Windows 7 Windows Server 2008 R2). Default: spoolss_client: os_minor = 1 spoolss_client: os_build (G) . (build number) . : 6.1.7007 (Windows 7 Windows Server 2008 R2). Default: spoolss_client: os_build = 7007 spotlight (S) Spotlight . Tracker . Spotlight : o Spotlight . o Tracker Tracker . https://wiki.samba.org/index.php/Spotlight . Default: spotlight = no spotlight backend (S) Spotlight. : o noindex - . o tracker - Gnome Tracker. o elasticsearch - JSON REST HTTP(s) Elasticsearch . Default: spotlight backend = noindex stat cache (G) smbd(8) () . . Default: stat cache = yes state directory (G) TDB lock directory . 3.4.0 TDB TDB state directory cache directory . TDB . Default: state directory = /var/lib/samba Example: state directory = /var/run/samba/locks/state store dos attributes (S) DOS ( map hidden map readonly ) DOS ( SYSTEM HIDDEN ARCHIVE READ-ONLY) . DOS . map hidden map system map archive map readonly off . DOS "user.DOSATTRIB" . smbd EA . mount user_xattr . 3.5.0 "user.DOSATTRIB" DOS (create time) . 3.5.0 DOS . NTFS POSIX . 4.9.0 yes . Default: store dos attributes = yes strict allocate (S) . yes . (sparse files) . (extent-based). ( ext3) . (timeout) . (unwritten extents) timeout strict allocate . strict allocate () (out of quota) . (fragmentation) . : XFS ext4 btrfs ocfs2 JFS2 AIX . . ext3 ZFS HFS+ . Default: strict allocate = no strict locking (S) . yes . . strict locking Auto () oplock . oplock . strict locking . . strict locking = Auto strict locking = no . Default: strict locking = Auto strict rename (S) SMB . POSIX . . "yes" . . "no" smbd smbd . "no" . (POSIX pathnames) . smb3 directory leases strict rename . Default: strict rename = no strict sync (S) SMB . yes smbd . no smbd . 4.7.0 no yes SMB2/3 smbd . (flush) SMB2/3 smbd yes smbd . ( ) . no smbd(8) . smbd SMB1 XP ( ) . . Default: strict sync = yes svcctl list (G) init smbd Win32 ServiceControl API . MS Management Console . svcctl $(libdir) (symbolic links) init /etc/init.d/ . svcctl list . Default: svcctl list = Example: svcctl list = cups postfix portmap httpd sync always (S) . no ( ). yes fsync() . strict sync yes . Default: sync always = no sync machine password script (G) winbindd(8) . keytab . /usr/share/ctdb/scripts/winbind_ctdb_updatekeytab.sh . 46.update-keytabs.script ctdb ctdb recovered keytab : onnode all ctdb event script enable legacy 46.update-keytabs.script Default: sync machine password script = Example: sync machine password script = /usr/share/ctdb/scripts/winbind_ctdb_updatekeytab.sh sync machine password to keytab (G) keytab : wbinfo --change-secret rpcclient --machine-pass -c change_trust_pw net rpc changetrustpw net ads changetrustpw winbindd ( machine password timeout) keytab keytab 'disabled' . : absolute_path_to_keytab:spn_spec[:spn_spec]*[:sync_etypes][:sync_kvno][:netbios_aliases][:additional_dns_hostnames][:machine_password] spn_spec ( ':' ) spn_spec : account_name sync_account_name sync_upn sync_spns spn_prefixes=value1[,value2[...]] spns=value1[,value2[...]] keytab principal : account_name - COMPUTER$@REALM sync_account_name - "sAMAccountName" AD sync_upn - "userPrincipalName" ( AD) sync_spns - "servicePrincipalName" ( AD) spn_prefixes - principal : prefix/netbios name@REALM prefix/dns hostname@REALM :netbios_aliases netbiosalias netbios aliases prefix/netbiosalias@REALM prefix/netbiosalias.dnsdomain@REALM :additional_dns_hostnames additionaldnshostname additional dns hostnames prefix/additionaldnshostname@REALM - 'host' principal spn_prefixes spns - principal 'account_name' 'sync_account_name' (secrets.tdb AD). : sync_etypes - "msDS-SupportedEncryptionTypes" AD AD KRB5 . sync_kvno - "msDS-KeyVersionNumber" AD KVNO . KVNO -1 . netbios_aliases - spn_prefixes ( ). additional_dns_hostnames - spn_prefixes ( ). machine_password - . . Example: "/path/to/keytab0:account_name:machine_password", "/path/to/keytab1:account_name:sync_etypes:sync_kvno:machine_password", "/path/to/keytab2:sync_spns:machine_password", "/path/to/keytab3:sync_spns:sync_kvno:machine_password", "/path/to/keytab4:spn_prefixes=imap,smtp:machine_password", "/path/to/keytab5:spn_prefixes=imap,smtp:netbios_aliases:additional_dns_hostnames:sync_kvno:machine_password", "/path/to/keytab6:spns=wurst/brot@REALM:machine_password", "/path/to/keytab7:spns=wurst/brot@REALM,wurst2/brot@REALM:sync_kvno:machine_password", "/path/to/keytab8:sync_account_name:sync_upn:sync_spns:spn_prefixes=host,cifs,http:spns=wurst/brot@REALM:sync_kvno:machine_password" sync_etypes sync_kvno sync_spns winbind DC . << >> (offline domain join) . kerberos method 'secrets only' winbind net : o winbind : /path/to/keytab:host:account_name:sync_spns:sync_kvno:machine_password keytab krb5 dedicated keytab file . o net changesecretpw -f 'disabled' . o net 'disabled' . 'disabled' . FreeIPA keytab . kerberos method 'secrets only' . sync machine password script . No default syslog (G) syslog . LOG_ERR syslog LOG_WARNING LOG_NOTICE LOG_INFO . LOG_DEBUG . syslog . syslog . syslog only log.[sn]mbd . logging . logging syslog . Default: syslog = 1 syslog only (G) syslog . syslog only log.[sn]mbd . logging . logging syslog only . Default: syslog only = no template homedir (G) Windows NT winbindd(8) . %D Windows NT . %U Windows NT . Default: template homedir = /home/%D/%U template shell (G) Windows NT winbindd(8) (login shell) . Default: template shell = /bin/false time server (G) nmbd(8) Windows . Default: time server = no debug timestamp timestamp logs . timestamp logs (G) . debug level . . Default: timestamp logs = yes tls ca directories (G) ( PEM) CA CA CA . No default tls cafile (G) ( PEM) CA CA CA . / private dir . Default: tls cafile = tls/ca.pem tls certfile (G) ( PEM) RSA TLS . (handshake) TLS . / private dir . Default: tls certfile = tls/cert.pem tls crlfile (G) (CRL) . / private dir . Default: tls crlfile = tls dh params file (G) Diffie-Hellman DH . / private dir . Default: tls dh params file = tls enabled (G) yes TLS . Default: tls enabled = yes tls keyfile (G) ( PEM) RSA . (passphrase) . / private dir . Default: tls keyfile = tls/key.pem tls priority (G) TLS GnuTLS AD DC . GnuTLS . GNUTLS http://gnutls.org/manual/html_node/Priority-Strings.html . SSL3.0 . Default: tls priority = NORMAL:-VERS-SSL3.0 tls trust system cas (G) CA SSL/TLS . CA ! Default: tls trust system cas = no tls verify peer (G) . ( ) : no_check ca_only ca_and_name_if_available ca_and_name as_strict_as_possible. no_check (man-in-the- middle) . ca_only CA tls ca file . tls ca directories tls trust system cas . CA . . tls crl file CRL CA . ca_and_name_if_available ca_only . IP . ca_and_name ca_and_name_if_available . IP . as_strict_as_possible ca_and_name . tls crl file . . Default: tls verify peer = as_strict_as_possible unicode (G) unicode . false ASCII . Default: unicode = yes unix charset (G) (charset) . SMB . . Default: unix charset = UTF-8 Example: unix charset = ASCII unix password sync (G) SMB smbpasswd UNIX SMB . yes passwd program AS ROOT ( /) - UNIX UNIX ( SMB ). samba (Active Directory Domain Controller) password hash gpg key ids samba-tool user syncpasswords . Default: unix password sync = no use client driver (S) Windows NT/2000 . Windows 95/98/ME . Windows NT/2000 . . disable spoolss = yes . NT/2000 MS-RPC . OpenPrinterEx() . (administrator) root ( ) OpenPrinterEx() . "Access Denied; Unable to connect" ( ). PRINTER_ACCESS_ADMINISTER PRINTER_ACCESS_USE . OpenPrinterEx() . . Default: use client driver = no use mmap (G) tdb mmap . (cache) mmap / (read-write) . OpenBSD HPUX no . . tdb . Default: use mmap = yes username level (G) UNIX <<>> DOS . UNIX . . UNIX . . UNIX AstrangeUser . UNIX . Default: username level = 0 Example: username level = 5 username map (G) . . DOS Windows UNIX . . (user mode security) username map . (domain ads) (fully qualified) ( biddle = DOMAIN\foo). . UNIX '=' . @group UNIX . '*' (wildcard) . . '=' . . . '#' ';' . '!' . . '!' (wildcard) . admin administrator root : root = admin administrator system sys : sys = @system username map . NIS NETGROUP netgroup /etc/group . Windows (space) . : tridge = "Andrew Tridgell" "Andrew Tridgell" "tridge" . mary fred sys guest . '!' : !sys = mary fred guest = * . \\server\fred fred mary \\server\mary mary fred. ( ) . . . . PrintManager WfWg . 3.0.8 Kerberos (: DOMAIN\user) username map . NTLM[SSP] . . 3.0.8 : username map . smbd username map ( DOMAIN\user) . : username map = /usr/local/samba/lib/users.map Default: username map = # no username map username map cache time (G) username map username map script . . username map script . username map cache time () . username map . 0 . Default: username map cache time = 0 Example: username map cache time = 60 username map script (G) username map . ( ) ( ) . LDAP . Default: username map script = Example: username map script = /etc/samba/scripts/mapusers.sh usershare allow guests (G) . guest ok = yes . off () . Default: usershare allow guests = no usershare max shares (G) usershare . () . Default: usershare max shares = 0 usershare owner only (G) . True () smbd usershare . False . Default: usershare owner only = yes usershare path (G) . root (other) . <> ( /tmp ). usershare . usershare /usr/local/samba/lib/usershares . ls -ld /usr/local/samba/lib/usershares/ drwxrwx--T 2 root power_users 4096 2006-05-05 12:27 /usr/local/samba/lib/usershares/ <> . Default: usershare path = /var/lib/samba/usershares usershare prefix allow list (G) . . . <> <> deny allow . Default: usershare prefix allow list = Example: usershare prefix allow list = /home /data /space usershare prefix deny list (G) . . usershare . . <> <> deny allow . Default: usershare prefix deny list = Example: usershare prefix deny list = /etc /dev /private usershare template share (G) path guest ok . <<>> () usershare . <> usershare . <<-valid = False>> . usershare . Default: usershare template share = Example: usershare template share = template_share use sendfile (S) yes sendfile() SMB ( ReadAndX ReadRaw) oplock sendfile . Samba . NT LM 0.12 Windows 9x ( sendfile ). Default: use sendfile = no utmp (G) (boolean) --with-utmp . yes utmp utmpx ( ) . . utmp . n^2 . . Default: utmp = no utmp directory (G) --with-utmp . utmp utmpx ( ) . utmp ( /var/run/utmp ). Default: utmp directory = # Determined automatically Example: utmp directory = /var/run/utmp -valid (S) . false . . . Default: -valid = yes valid users (S) . '@' '+' '&' invalid users . () . invalid users . %S . [homes] . : [global] . : MASTER BROWSER (: local master os level domain master preferred master) (workstations) . Default: valid users = # No valid users list (anyone can login) Example: valid users = greg, @pcusers veto files (S) . '/' . '*' '?' (wildcards) . veto files NAME veto files : NAME = valid users . . <> [global] [global] . '/' . case sensitive . veto files . delete veto files yes . . : ; Security ; .tmp ; root. veto files = /*Security*/*.tmp/*root*/ ; veto files = /vetoforall1/ veto files : USER = /vetotoforuser/ veto files : GROUP = /vetoforgroup/ veto files : UNIVERSITY\Alumnis = /somefile.txt/ veto files : john@university.org = /anotherfile.txt/ veto files : S-1-5-21-123-456-789-1000 = /secretfile.txt/ ; Apple ; NetAtalk . veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/ Default: veto files = # No files or directories are vetoed veto oplock files (S) oplocks . oplock (wildcard) wildcard veto files. . SMB NetBench .SEM . oplock ( [global] NetBench) . : veto oplock files = /.*SEM/ Default: veto oplock files = # No files are vetoed for oplock grants vfs mkdir use tmp name (S) SMB ! DOS . ! (enumerated) . yes '.::TMPNAME:D:$SERVERID:' ( $SERVERID ). Auto () no : inherit acls inherit owner inherit permissions nt acl support store dos attributes. OpenBSD Auto () no : https://bugzilla.samba.org/show_bug.cgi?id=15801. (re-export) SMB/CIFS vfs mkdir use tmp name = no . vfs mkdir use tmp name = Auto . Default: vfs mkdir use tmp name = Auto vfs object vfs objects . vfs objects (S) (backend) / (I/O) VFS . / VFS ( VFS objects) . vfs objects (overwrite) . Default: vfs objects = Example: vfs objects = extd_audit recycle volume (S) (volume label) . CDROM . Default: volume = # the name of the share volume serial number (S) (volume serial number - ) . -1 () . Default: volume serial number = -1 Example: volume serial number = 0xabcdefgh wide links (S) UNIX . . : (UNIX extensions) UNIX (symbolic links) . . unix extensions ( ) . allow insecure wide links . Default: wide links = no winbind cache time (G) winbindd(8) Windows NT () . (real time) winbind offline logon . Default: winbind cache time = 300 winbindd socket directory (G) winbind . ( nss_winbind ) . WINBINDD_SOCKET_DIR . Default: winbindd socket directory = /run/samba/winbindd winbind enum groups (G) winbindd(8) (enumeration) setgrent() getgrent() endgrent() . winbind enum groups no getgrent() . (Warning) . Default: winbind enum groups = no winbind enum users (G) winbindd(8) (enumeration) setpwent() getpwent() endpwent() . winbind enum users no getpwent . (Warning) . finger . Default: winbind enum users = no winbind expand groups (G) winbindd (flattening) . winbind nested groups Windows NT4 . <> . . <> winbind . winbindd (group unrolling) NSS . Samba 4.2 . ( newgrp sg) <> . winbindd SAMR (Domain Controllers) . Default: winbind expand groups = 0 winbind:ignore domains (G) winbind ( ). (DCs) . Default: winbind:ignore domains = Example: winbind:ignore domains = DOMAIN1, DOMAIN2 winbind max clients (G) winbindd(8) . (hard limit) . winbindd(8) (idle) . Default: winbind max clients = 200 winbind max domain connections (G) winbindd(8) (domain controller) . winbind . winbindd . winbind offline logon Yes DC . Default: winbind max domain connections = 1 Example: winbind max domain connections = 10 winbind nested groups (G) yes (nested groups) . (local groups) (aliases) . Windows : ( SAM DC ) (global groups) SAM . nss_winbind . Default: winbind nested groups = yes winbind normalize names (G) winbindd (whitespace) (_) . "Space Kadet" "space_kadet" . Unix . (name aliasing) nss_info . API (non-qualified) . idmap nss_info . ( ). Default: winbind normalize names = no Example: winbind normalize names = yes winbind nss info (G) (Name Service Information) Winbind (login shell) . : o template - template shell template homedir) o - Samba security = ads Domain Controller LDAP "Services for Unix" (SFU) winbind . SFU 3.0 3.5 "sfu" SFU 2.0 "sfu20" . idmap idmap_ad idmap . idmap . Default: winbind nss info = template Example: winbind nss info = sfu winbind offline logon (G) Winbind pam_winbind (Cached Credentials) . winbindd . Default: winbind offline logon = no Example: winbind offline logon = yes winbind reconnect delay (G) winbindd(8) Domain Controller . Default: winbind reconnect delay = 30 winbind refresh tickets (G) Winbind Kerberos pam_winbind (refresh) . Default: winbind refresh tickets = no Example: winbind refresh tickets = yes winbind request timeout (G) winbindd(8) (idle) (hung) . Default: winbind request timeout = 60 winbind rpc only (G) yes winbindd Domain Controller LDAP RPC . Default: winbind rpc only = no winbind scan trusted domains (G) security domain ads . yes winbindd (trusted domains) winbindd . wbinfo --trusted-domains --verbose . yes Samba 4.7 . . winbindd SMB idmap autorid tdb ad. idmap . pam_winbind . winbind scan trusted domains = no . Default: winbind scan trusted domains = no winbind sealed pipes (G) winbindd (pipes) Domain Controller (sealed) . . NetBIOS 'winbind sealed pipes:NETBIOSDOMAIN = no' . Default: winbind sealed pipes = yes winbind separator (G) DOMAIN \user . pam_winbind.so nss_winbind.so UNIX . + glibc + NIS /etc/group . Default: winbind separator = \ Example: winbind separator = + winbind use default domain (G) winbindd(8) . winbindd . Windows SSH FTP Unix . . . winbind /etc/passwd . Default: winbind use default domain = no Example: winbind use default domain = yes winbind use krb5 enterprise principals (G) winbindd Kerberos pam_winbind krb5_auth wbinfo -K/--krb5auth= . winbindd ( domain member) (trust topology DC ) . uPNSuffixes msDS-SPNSuffixes AD . winbind scan trusted domains = no winbindd . . [K]DC ( PRIMARY.A.EXAMPLE.COM) enterprise principal upnfromB@B.EXAMPLE.COM@PRIMARY.A.EXAMPLE.COM WRONG_REALM DC . userfromB@INTERNALB.EXAMPLE.PRIVATE . winbind use krb5 enterprise principals = yes (enterprise principals) winbindd . Default: winbind use krb5 enterprise principals = yes Example: winbind use krb5 enterprise principals = no winbind varlink service (G) winbind(8) / nss-systemd(8) Varlink nss_winbind . / Varlink https://systemd.io/USER_GROUP_API nss-systemd (8) . (Warning) Systemd(1) winbind separator '\' GetMemberhips . '+' . (Warning) systemd(1) . Default: winbind varlink service = no winsdb:local_owner (G) winsOwner winsRecord . IP . winsdb:dbnosync (G) ()fsync WINS . Default: winsdb:dbnosync = no wins hook (G) WINS WINS . DNS (dynamic DNS) . wins hook : wins_hook operation name nametype ttl IP_list o <> <> <> . . <> add . o NetBIOS . wins hook . (hyphen) (underscore) . o NetBIOS . o TTL ( ) . o IP . . DNS BIND nsupdate examples . wins proxy (G) nmbd(8) (broadcast) . yes . Default: wins proxy = no wins server (G) IP ( DNS: IP ) WINS nmbd(8) . WINS IP WINS . (multi-subnet) WINS . wins (<>) . () . ip . (cross-subnet browsing) WINS . (Network Browsing) Samba3-HOWTO . Default: wins server = Example: wins server = mary:192.9.200.1 fred:192.168.3.199 mary:192.168.2.61 # 192.19.200.1 192.168.2.61. 192.168.3.199 . Example: wins server = 192.9.200.1 192.168.2.61 wins support (G) nmbd(8) WINS . yes nmbd WINS . yes . Default: wins support = no workgroup (G) (workgroup) . (Domain name) security = domain . Default: workgroup = WORKGROUP Example: workgroup = MYGROUP wreplsrv:periodic_interval (G) wins.ldb push push . wins_config.ldb . Default: wreplsrv:periodic_interval = 15 wreplsrv:propagate name releases (G) ( ) ( /scavenging) SPECIAL GROUP (2) MULTIHOMED (3) . SPECIAL GROUP (2) (replica) . . SPECIAL GROUP (2) MULTIHOMED (3) SPECIAL GROUP (2) MULTIHOMED (3) . . Default: wreplsrv:propagate name releases = no wreplsrv:scavenging_interval (G) (scavenging) WINS . wreplsrv:renew_interval . wreplsrv:tombstone_extra_timeout (G) tombstone ( ) . . Default: wreplsrv:tombstone_extra_timeout = 259200 wreplsrv:tombstone_interval (G) WINS tombstone . . Default: wreplsrv:tombstone_interval = 518400 wreplsrv:tombstone_timeout (G) tombstone WINS . . Default: wreplsrv:tombstone_timeout = 86400 wreplsrv:verify_interval (G) replica WINS . . . Default: wreplsrv:verify_interval = 2073600 writable writeable . write ok writeable . writeable (S) read only. Default: writeable = no write list (S) - . read only . @group . . Default: write list = Example: write list = admin, root, @staff write raw (G) async smb echo handler SMB (raw write) . . . . ( ). Default: write raw = yes wsp property file (G) wsp property file. WSP ( - Windows Search Protocol) . csv . . Property Name System.ItemUrl. GUID guid propertyset . prop ID GUID . inInverted Index () TRUE . isColumn WSP TRUE . type BooleanBufferByteDateTimeDoubleInt32StringUInt16UInt32UInt64 MaxSize . Vector Property TRUE . Description . Default: wsp property file = wtmp directory (G) --with-utmp . wtmp wtmpx ( UNIX) . utmp (logout) . utmp ( /var/run/wtmp ). Default: wtmp directory = Example: wtmp directory = /var/log/wtmp (WARNINGS) . - . - DOS - . smbd(8) . . [homes] [printers] . . spool . (VERSION) 4.24.6 Samba . (SEE ALSO) samba(7), smbpasswd(8), smbd(8), nmbd(8), winbindd(8), samba(8), samba- tool(8), smbclient(1), nmblookup(1), testparm(1). (AUTHOR) Samba Andrew Tridgell . Samba (Samba Team) (Open Source) . Samba 4.24.6 08/16/2026 SMB.CONF(5)