From 3bb3f2d0ce1165d0cac683f507d838d20c8c743b Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Sat, 14 Nov 1998 03:01:40 +0000 Subject: Update for 2.0beta1. Jeremy. (This used to be commit 598d0255d40da29ebab3d1a3c9eb66ba654db7b5) --- docs/htmldocs/lmhosts.5.html | 26 ++-- docs/htmldocs/make_smbcodepage.1.html | 20 +-- docs/htmldocs/nmbd.8.html | 56 ++++---- docs/htmldocs/nmblookup.1.html | 30 ++-- docs/htmldocs/samba.7.html | 19 +-- docs/htmldocs/smb.conf.5.html | 262 +++++++++++++++++----------------- docs/htmldocs/smbclient.1.html | 40 +++--- docs/htmldocs/smbd.8.html | 67 +++++---- docs/htmldocs/smbpasswd.5.html | 32 +++-- docs/htmldocs/smbpasswd.8.html | 36 ++--- docs/htmldocs/smbrun.1.html | 4 +- docs/htmldocs/smbstatus.1.html | 4 +- docs/htmldocs/smbtar.1.html | 4 +- docs/htmldocs/swat.8.html | 84 +++-------- docs/htmldocs/testparm.1.html | 8 +- docs/htmldocs/testprns.1.html | 8 +- 16 files changed, 332 insertions(+), 368 deletions(-) (limited to 'docs/htmldocs') diff --git a/docs/htmldocs/lmhosts.5.html b/docs/htmldocs/lmhosts.5.html index f518c187137..d3ffedaff60 100644 --- a/docs/htmldocs/lmhosts.5.html +++ b/docs/htmldocs/lmhosts.5.html @@ -3,7 +3,7 @@ -lmhosts +lmhosts (5) @@ -11,7 +11,7 @@
-

lmhosts

+

lmhosts (5)

Samba

23 Oct 1998

@@ -29,7 +29,7 @@

DESCRIPTION


This file is part of the Samba suite. -


lmhosts is the Samba NetBIOS name to IP address mapping file. It +


lmhosts is the Samba NetBIOS name to IP address mapping file. It is very similar to the /etc/hosts file format, except that the hostname component must correspond to the NetBIOS naming format.


@@ -49,18 +49,12 @@ returned for all names that match the given name, whatever the NetBIOS name type in the lookup.



An example follows : -


-
-
-#
-# Sample Samba lmhosts file.
-#
-192.9.200.1	TESTPC
-192.9.200.20	NTSERVER#20
-192.9.200.21	SAMBASERVER
-
-
- +


#
+# Sample Samba lmhosts file.
+#
+192.9.200.1 TESTPC
+192.9.200.20 NTSERVER#20
+192.9.200.21 SAMBASERVER


Contains three IP to NetBIOS name mappings. The first and third will be returned for any queries for the names "TESTPC" and "SAMBASERVER" respectively, whatever the type component of the @@ -84,7 +78,7 @@ as the smb.conf file.

AUTHOR


The original Samba software and related utilities were created by -Andrew Tridgell (samba-bugs@samba.anu.edu.au). Samba is now developed +Andrew Tridgell samba-bugs@samba.anu.edu.au. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.


The original Samba man pages were written by Karl Auer. The man page diff --git a/docs/htmldocs/make_smbcodepage.1.html b/docs/htmldocs/make_smbcodepage.1.html index 34466d62160..10615deb864 100644 --- a/docs/htmldocs/make_smbcodepage.1.html +++ b/docs/htmldocs/make_smbcodepage.1.html @@ -3,7 +3,7 @@ -make_smbcodepage +make_smbcodepage (1) @@ -11,7 +11,7 @@


-

make_smbcodepage

+

make_smbcodepage (1)

Samba

23 Oct 1998

@@ -36,15 +36,15 @@ with the internationalization features of Samba 2.0



EXAMPLES

-


nmblookup can be used to query a WINS server (in the same way .B -nslookup is used to query DNS servers). To query a WINS server, -nmblookup must be called like this: +


nmblookup can be used to query a WINS server (in the same way +nslookup is used to query DNS servers). To query a WINS server, +nmblookup must be called like this:


nmblookup -U server -R 'name'


For example, running :


nmblookup -U samba.anu.edu.au -R IRIX#1B' @@ -129,7 +131,7 @@ browser (1B name type) for the IRIX workgroup.

AUTHOR


The original Samba software and related utilities were created by -Andrew Tridgell (samba-bugs@samba.anu.edu.au). Samba is now developed +Andrew Tridgell samba-bugs@samba.anu.edu.au. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.


The original Samba man pages were written by Karl Auer. The man page diff --git a/docs/htmldocs/samba.7.html b/docs/htmldocs/samba.7.html index 1408b2163df..1f6b8a0ae51 100644 --- a/docs/htmldocs/samba.7.html +++ b/docs/htmldocs/samba.7.html @@ -2,7 +2,7 @@ -Samba +Samba (7) @@ -10,7 +10,7 @@


-

Samba

+

Samba (7)

Samba

23 Oct 1998

@@ -28,7 +28,7 @@

DESCRIPTION


The Samba software suite is a collection of programs that implements -the Server Message Block(commenly abbreviated as SMB) protocol for +the Server Message Block(commonly abbreviated as SMB) protocol for UNIX systems. This protocol is sometimes also referred to as the Common Internet File System (CIFS), LanManager or NetBIOS protocol.


@@ -38,7 +38,8 @@ Common Internet File System (CIFS), LanManager or NetBIOS protocol. described in a separate manual page. It is strongly recommended that you read the documentation that comes with Samba and the manual pages of those components that you use. If the manual pages aren't clear -enough then please send a patch to samba-bugs@samba.anu.edu.au. +enough then please send a patch or bug report +to samba-bugs@samba.anu.edu.au.



Note that the [printers] service MUST be printable - if you specify otherwise, the server will refuse to load the configuration file. -


Typically the path specified would be that of a world-writable spool +


Typically the path specified would be that of a world-writeable spool directory with the sticky bit set on it. A typical [printers] entry would look like this:


 
  	[printers]
  		path = /usr/spool/public
- 		writable = no
+ 		writeable = no
  		guest ok = yes
  		printable = yes 
 
@@ -221,7 +221,7 @@ this:
 
 


Each alias should be an acceptable printer name for your printing subsystem. In the [global] section, specify the new -file as your printcap. The server will then only recognise names +file as your printcap. The server will then only recognize names found in your pseudo-printcap, which of course can contain whatever aliases you like. The same technique could be used simply to limit access to a subset of your local printers. @@ -233,15 +233,15 @@ of a printcap record. Records are separated by newlines, components defined on the system you may be able to use "printcap name = lpstat" to automatically obtain a list of printers. See the "printcap name" option for -more detils. +more details.



PARAMETERS


Parameters define the specific attributes of sections.


Some parameters are specific to the [global] section -(eg., security). Some parameters are usable in -all sections (eg., create mode). All others are +(e.g., security). Some parameters are usable in +all sections (e.g., create mode). All others are permissible only in normal sections. For the purposes of the following descriptions the [homes] and [printers] sections will be considered normal. @@ -250,7 +250,7 @@ specific to the [global] s indicates that a parameter can be specified in a service specific section. Note that all 'S' parameters can also be specified in the [global] section - in which case they will define -the default behaviour for all services. +the default behavior for all services.


Parameters are arranged here in alphabetical order - this may not create best bedfellows, but at least you can find them! Where there are synonyms, the preferred synonym is described, others refer to the @@ -308,8 +308,8 @@ negotiation. It can be one of CORE, COREPLUS, LANMAN1, LANMAN2 or NT1.

  • %d = The process id of the current server process.


  • %a = the architecture of the remote -machine. Only some are recognised, and those may not be 100% -reliable. It currently recognises Samba, WfWg, WinNT and +machine. Only some are recognized, and those may not be 100% +reliable. It currently recognizes Samba, WfWg, WinNT and Win95. Anything else will be known as "UNKNOWN". If it gets it wrong then sending a level 3 log to samba-bugs@samba.anu.edu.au should allow it to be fixed. @@ -717,7 +717,7 @@ regardless if the owner of the file is the currently logged on user or not.


    This specifies what type of server nmbd will announce itself as, to a network neighborhood browse list. By default this is set to Windows NT. The valid options are : "NT", "Win95" or -"WfW" meaining Windows NT, Windows 95 and Windows for Workgroups +"WfW" meaning Windows NT, Windows 95 and Windows for Workgroups respectively. Do not change this parameter unless you have a specific need to stop Samba appearing as an NT server as this may prevent Samba servers from participating as browser servers correctly. @@ -784,7 +784,7 @@ the interface list given in the 'in parameter. This restricts the networks that smbd will serve to packets coming in those interfaces. Note that you should not use this parameter for machines that are serving PPP or -other intermittant or non-broadcast network interfaces as it will not +other intermittent or non-broadcast network interfaces as it will not cope with non-permanent interfaces.


    In addition, to change a users SMB password, the smbpasswd by default connects to the @@ -820,13 +820,8 @@ request immediately if the lock range cannot be obtained.


    Example: blocking locks = False


    -

  • broweable (S) -


    This controls whether this share is seen in the list of available -shares in a net view and in the browse list. -


    Default: - browsable = Yes -


    Example: - browsable = No +

  • browseable (S) +


    Synonym for browseable.


  • browse list(G)


    This controls whether smbd will serve a browse @@ -836,7 +831,12 @@ should never need to change this. browse list = Yes


  • browseable -


    Synonym for browsable. +


    This controls whether this share is seen in the list of available +shares in a net view and in the browse list. +


    Default: + browseable = Yes +


    Example: + browseable = No


  • case sensitive (G)


    See the discussion in the section NAME MANGLING. @@ -907,7 +907,7 @@ described more fully in the manual page , tell smbd how to map lower to upper case characters to provide the case insensitivity of filenames that Windows clients expect. -


    Samba currenly ships with the following code page files : +


    Samba currently ships with the following code page files :



    • Code Page 437 - MS-DOS Latin US


    • Code Page 737 - Windows '95 Greek @@ -960,10 +960,10 @@ codes. Shift-JIS to JUNET code with different shift-in, shift out codes.


    • EUC Convert an incoming Shift-JIS character to EUC code.


    • HEX Convert an incoming Shift-JIS character to a 3 byte hex -representation, ie. :AB. +representation, i.e. :AB.


    • CAP Convert an incoming Shift-JIS character to the 3 byte hex -representation used by the Columbia Appletalk Program (CAP), -ie. :AB. This is used for compatibility between Samba and CAP. +representation used by the Columbia AppleTalk Program (CAP), +i.e. :AB. This is used for compatibility between Samba and CAP.



  • comment (S) @@ -1005,7 +1005,7 @@ in the configuration file than the service doing the copying.


  • create mask (S)


    A synonym for this parameter is 'create mode'. -


    When a file is created, the neccessary permissions are calculated +


    When a file is created, the necessary permissions are calculated according to the mapping from DOS modes to UNIX permissions, and the resulting UNIX mode is then bit-wise 'AND'ed with this parameter. This parameter may be thought of as a bit-wise MASK for the UNIX modes @@ -1123,7 +1123,7 @@ you want. delete any files and directories within the vetoed directory. This can be useful for integration with file serving systems such as NetAtalk, which create meta-files within directories you might normally veto -DOS/Windows users from seeing (eg. .AppleDouble) +DOS/Windows users from seeing (e.g. .AppleDouble)


    Setting 'delete veto files = True' allows these directories to be transparently deleted when the parent directory is deleted (so long as the user has permissions to do so). @@ -1161,7 +1161,7 @@ second should be the number of available blocks. An optional third return value can give the block size in bytes. The default blocksize is 1024 bytes.


    Note: Your script should NOT be setuid or setgid and should be -owned by (and writable only by) root! +owned by (and writeable only by) root!


    Default: By default internal routines for determining the disk capacity and remaining space will be used. @@ -1192,7 +1192,7 @@ path names on some systems.

  • directory mask (S)


    This parameter is the octal modes which are used when converting DOS modes to UNIX modes when creating UNIX directories. -


    When a directory is created, the neccessary permissions are calculated +


    When a directory is created, the necessary permissions are calculated according to the mapping from DOS modes to UNIX permissions, and the resulting UNIX mode is then bit-wise 'AND'ed with this parameter. This parameter may be thought of as a bit-wise MASK for the UNIX modes @@ -1203,7 +1203,7 @@ write bits from the UNIX mode, allowing only the user who owns the directory to modify it.


    Following this Samba will bit-wise 'OR' the UNIX mode created from this parameter with the value of the "force directory mode" -parameter. This parameter is set to 000 by default (ie. no extra mode +parameter. This parameter is set to 000 by default (i.e. no extra mode bits are added).


    See the "force directory mode" parameter to cause particular mode bits to always be set on created directories. @@ -1236,7 +1236,7 @@ DNS name lookup requests, as doing a name lookup is a blocking action.


    This is an EXPERIMENTAL parameter that is part of the unfinished Samba NT Domain Controller Code. It may be removed in a later release. To work with the latest code builds that may have more support for -Samba NT Domain Controller functionality please subscibe to the +Samba NT Domain Controller functionality please subscribe to the mailing list Samba-ntdom available by sending email to listproc@samba.anu.edu.au


    @@ -1244,7 +1244,7 @@ mailing list Samba-ntdom available by sending email to


    This is an EXPERIMENTAL parameter that is part of the unfinished Samba NT Domain Controller Code. It may be removed in a later release. To work with the latest code builds that may have more support for -Samba NT Domain Controller functionality please subscibe to the +Samba NT Domain Controller functionality please subscribe to the mailing list Samba-ntdom available by sending email to listproc@samba.anu.edu.au


    @@ -1257,7 +1257,7 @@ files. It is left behind for compatibility reasons.


    This is an EXPERIMENTAL parameter that is part of the unfinished Samba NT Domain Controller Code. It may be removed in a later release. To work with the latest code builds that may have more support for -Samba NT Domain Controller functionality please subscibe to the +Samba NT Domain Controller functionality please subscribe to the mailing list Samba-ntdom available by sending email to listproc@samba.anu.edu.au


    @@ -1265,7 +1265,7 @@ mailing list Samba-ntdom available by sending email to


    This is an EXPERIMENTAL parameter that is part of the unfinished Samba NT Domain Controller Code. It may be removed in a later release. To work with the latest code builds that may have more support for -Samba NT Domain Controller functionality please subscibe to the +Samba NT Domain Controller functionality please subscribe to the mailing list Samba-ntdom available by sending email to listproc@samba.anu.edu.au


    @@ -1273,7 +1273,7 @@ mailing list Samba-ntdom available by sending email to


    This is an EXPERIMENTAL parameter that is part of the unfinished Samba NT Domain Controller Code. It may be removed in a later release. To work with the latest code builds that may have more support for -Samba NT Domain Controller functionality please subscibe to the +Samba NT Domain Controller functionality please subscribe to the mailing list Samba-ntdom available by sending email to listproc@samba.anu.edu.au


    @@ -1284,7 +1284,7 @@ details on setting up this feature see the file DOMAINS.txt in the Samba documentation directory docs/ shipped with the source code.


    Note that Win95/98 Domain logons are NOT the same as Windows NT Domain logons. NT Domain logons require a Primary Domain Controller -(PDC) for the Domain. It is inteded that in a future release Samba +(PDC) for the Domain. It is intended that in a future release Samba will be able to provide this functionality for Windows NT clients also.


    Default: @@ -1292,7 +1292,7 @@ also.


  • domain master (G)


    Tell nmbd to enable WAN-wide browse list -collation.Setting this option causes nmbd to +collation. Setting this option causes nmbd to claim a special domain specific NetBIOS name that identifies it as a domain master browser for its given workgroup. Local master browsers in the same @@ -1305,7 +1305,7 @@ list, instead of just the list for their broadcast-isolated subnet.


    Note that Windows NT Primary Domain Controllers expect to be able to claim this workgroup specific special NetBIOS name that identifies them as domain master browsers for that -workgroup by default (ie. there is no way to +workgroup by default (i.e. there is no way to prevent a Windows NT PDC from attempting to do this). This means that if this parameter is set and nmbd claims the special name for a workgroup before a Windows NT @@ -1315,7 +1315,7 @@ and may fail. domain master = no


  • dont descend (S) -


    There are certain directories on some systems (eg., the /proc tree +


    There are certain directories on some systems (e.g., the /proc tree under Linux) that are either not of interest to clients or are infinitely deep (recursive). This parameter allows you to specify a comma-delimited list of directories that the server should always show @@ -1329,7 +1329,7 @@ just "/proc". Experimentation is the best policy :-) dont descend = /proc,/dev


  • dos filetime resolution (S) -


    Under the DOS and Windows FAT filesystem, the finest granulatity on +


    Under the DOS and Windows FAT filesystem, the finest granularity on time resolution is two seconds. Setting this parameter for a share causes Samba to round the reported time down to the nearest two second boundary when a query call that requires one second resolution is made @@ -1355,7 +1355,7 @@ the timestamp on it. Under POSIX semantics, only the owner of the file or root may change the timestamp. By default, Samba runs with POSIX semantics and refuses to change the timestamp on a file if the user smbd is acting on behalf of is not the file owner. Setting this option -to True allows DOS semantics and smbd will change the file timstamp as +to True allows DOS semantics and smbd will change the file timestamp as DOS requires.


    Default: dos filetimes = False @@ -1435,16 +1435,16 @@ same time you can get data corruption. Use this option carefully! particular share. Setting this parameter to "No" prevents any file or directory that is a symbolic link from being followed (the user will get an error). This option is very useful to stop users from -adding a symbolic link to /etc/pasword in their home directory for +adding a symbolic link to /etc/passwd in their home directory for instance. However it will slow filename lookups down slightly. -


    This option is enabled (ie. smbd will follow +


    This option is enabled (i.e. smbd will follow symbolic links) by default.


  • force create mode (S)


    This parameter specifies a set of UNIX mode bit permissions that will *always* be set on a file created by Samba. This is done by bitwise 'OR'ing these bits onto the mode bits of a file that is being -created. The default for this parameter is (in octel) 000. The modes +created. The default for this parameter is (in octal) 000. The modes in this parameter are bitwise 'OR'ed onto the file mode after the mask set in the "create mask" parameter is applied.


    See also the parameter "create mask" for details @@ -1461,7 +1461,7 @@ the 'user'.


    This parameter specifies a set of UNIX mode bit permissions that will *always* be set on a directory created by Samba. This is done by bitwise 'OR'ing these bits onto the mode bits of a directory that is -being created. The default for this parameter is (in octel) 0000 which +being created. The default for this parameter is (in octal) 0000 which will not add any extra permission bits to a created directory. This operation is done after the mode mask in the parameter "directory mask" is applied. @@ -1516,7 +1516,7 @@ Windows NT but this can be changed to other strings such as "Samba" or fstype = Samba


  • getwd cache (G) -


    This is a tuning option. When this is enabled a cacheing algorithm +


    This is a tuning option. When this is enabled a caching algorithm will be used to reduce the time taken for getwd() calls. This can have a significant impact on performance, especially when the widelinks parameter is set to False. @@ -1584,8 +1584,8 @@ directories that match.


    Each entry in the list must be separated by a '/', which allows spaces to be included in the entry. '*' and '?' can be used to specify multiple files or directories as in DOS wildcards. -


    Each entry must be a unix path, not a DOS path and must not include the -unix directory separator '/'. +


    Each entry must be a Unix path, not a DOS path and must not include the +Unix directory separator '/'.


    Note that the case sensitivity option is applicable in hiding files.


    Setting this parameter will affect the performance of Samba, as it will be forced to check all files and directories for a match as they @@ -1719,7 +1719,7 @@ parameter allows the use of them to be turned on or off.


    Kernel oplocks support allows Samba oplocks to be broken whenever a local UNIX process or NFS operation accesses a file that smbd has oplocked. This allows complete -data consistancy between SMB/CIFS, NFS and local file access (and is a +data consistency between SMB/CIFS, NFS and local file access (and is a very cool feature :-).


    This parameter defaults to "On" on systems that have the support, and "off" on systems that don't. You should never need to touch @@ -1832,7 +1832,7 @@ will be loaded for browsing by default. See the "printers" section for more details.


    Default: load printers = yes -


    bg(Example:) +


    Example: load printers = no


  • local master (G) @@ -1926,14 +1926,14 @@ preferences and directories to be loaded onto the Windows 95/98 client. The share must be writeable when the logs in for the first time, in order that the Windows 95/98 client can create the user.dat and other directories. -


    Thereafter, the directories and any of contents can, if required, be -made read-only. It is not adviseable that the USER.DAT file be made +


    Thereafter, the directories and any of the contents can, if required, be +made read-only. It is not advisable that the USER.DAT file be made read-only - rename it to USER.MAN to achieve the desired effect (a MANdatory profile).


    Windows clients can sometimes maintain a connection to the [homes] share, even though there is no user logged in. Therefore, it is vital that the logon path does not include a reference to the homes share -(i.e setting this parameter to \\%N\HOMES\profile_path will cause +(i.e. setting this parameter to \\%N\HOMES\profile_path will cause problems).


    This option takes the standard substitutions, allowing you to have separate logon scripts for each user or machine. @@ -1956,7 +1956,7 @@ file that will be downloaded is:


    /usr/local/samba/netlogon/STARTUP.BAT


    The contents of the batch file is entirely your choice. A suggested command would be to add NET TIME \\SERVER /SET /YES, to force every -machine to synchronise clocks with the same time server. Another use +machine to synchronize clocks with the same time server. Another use would be to add NET USE U: \\SERVER\UTILS for commonly used utilities, or NET USE Q: \\SERVER\ISO9001_QA for example.


    Note that it is particularly important not to allow write access to @@ -2010,7 +2010,7 @@ the lpq command in use. previous identical lpq command will be used if the cached data is less than 10 seconds old. A large value may be advisable if your lpq command is very slow. -


    A value of 0 will disable cacheing completely. +


    A value of 0 will disable caching completely.


    See also the "printing" parameter.


    Default: lpq cache time = 10 @@ -2135,8 +2135,8 @@ end.


    See the section on "NAME MANGLING".


  • mangled map (S) -


    This is for those who want to directly map UNIX file names which are -not representable on Windows/DOS. The mangling of names is not always +


    This is for those who want to directly map UNIX file names which can +not be represented on Windows/DOS. The mangling of names is not always what is needed. In particular you may have documents with file extensions that differ between DOS and UNIX. For example, under UNIX it is common to use ".html" for HTML files, whereas under @@ -2144,7 +2144,7 @@ Windows/DOS ".htm" is more commonly used.


    So to map "html" to "htm" you would use:


    mangled map = (*.html *.htm)


    One very useful case is to remove the annoying ";1" off the ends -of filenames on some CDROMS (only visible under some UNIXes). To do +of filenames on some CDROMS (only visible under some UNIXs). To do this use a map of (*;1 *).


    default: no mangled map @@ -2233,7 +2233,7 @@ becoming executable under UNIX. This can be quite annoying for shared source code, documents, etc...


    Note that this requires the "create mask" parameter to be set such that owner execute bit is not masked out -(ie. it must include 100). See the parameter "create +(i.e. it must include 100). See the parameter "create mask" for details.


    Default: map archive = yes @@ -2244,7 +2244,7 @@ mask"
    for details.


    This controls whether DOS style hidden files should be mapped to the UNIX world execute bit.


    Note that this requires the "create mask" to be -set such that the world execute bit is not masked out (ie. it must +set such that the world execute bit is not masked out (i.e. it must include 001). See the parameter "create mask" for details.


    Default: @@ -2256,7 +2256,7 @@ for details.


    This controls whether DOS style system files should be mapped to the UNIX group execute bit.


    Note that this requires the "create mask" to be -set such that the group execute bit is not masked out (ie. it must +set such that the group execute bit is not masked out (i.e. it must include 010). See the parameter "create mask" for details.


    Default: @@ -2266,7 +2266,7 @@ for details.


  • map to guest (G)


    This parameter is only useful in security modes -other than "security=share" - ie. user, +other than "security=share" - i.e. user, server, and domain.


    This parameter can take three different values, which tell smbd what to do with user login requests that @@ -2282,7 +2282,7 @@ account"
    .


  • "Bad Password" - Means user logins with an invalid password are treated as a guest login and mapped into the "guest account". Note that this can -cause problems as it means that any user mistyping their +cause problems as it means that any user incorrectly typing their password will be silently logged on a "guest" - and will not know the reason they cannot access files they think they should - there will have been no message given to them @@ -2358,7 +2358,7 @@ never need to set this parameter.


    This parameter limits the maximum number of open files that one smbd file serving process may have open for a client at any one time. The default for this parameter is set -very high (10,000) as Samba uses only one bit per un-opened file. +very high (10,000) as Samba uses only one bit per unopened file.


    The limit of the number of open files is usually set by the UNIX per-process file descriptor limit rather than this parameter so you should never need to touch this parameter. @@ -2542,7 +2542,7 @@ system and the Samba server with this option must also be a nis homedir = true


  • nt pipe support (G) -


    This boolean parameter controlls whether smbd +


    This boolean parameter controls whether smbd will allow Windows NT clients to connect to the NT SMB specific IPC$ pipes. This is a developer debugging option and can be left alone. @@ -2550,7 +2550,7 @@ alone. nt pipe support = yes


  • nt smb support (G) -


    This boolean parameter controlls whether smbd +


    This boolean parameter controls whether smbd will negotiate NT specific SMB support with Windows NT clients. Although this is a developer debugging option and should be left alone, benchmarking has discovered that Windows NT clients give @@ -2607,14 +2607,14 @@ of the user.

  • oplocks (S)


    This boolean option tells smbd whether to issue oplocks (opportunistic locks) to file open requests on this share. The oplock code can -dramatically (approx 30% or more) improve the speed of access to files -on Samba servers. It allows the clients to agressively cache files +dramatically (approx. 30% or more) improve the speed of access to files +on Samba servers. It allows the clients to aggressively cache files locally and you may want to disable this option for unreliable network environments (it is turned on by default in Windows NT Servers). For more information see the file Speed.txt in the Samba docs/ directory.


    Oplocks may be selectively turned off on certain files on a per share basis. -See the 'veto oplock files' parameter. On some systems oplocks are recognised -by the underlying operating system. This allows data synchronisation between +See the 'veto oplock files' parameter. On some systems oplocks are recognized +by the underlying operating system. This allows data synchronization between all access to oplocked files, whether it be via Samba or NFS or a local UNIX process. See the kernel oplocks parameter for details. @@ -2645,7 +2645,7 @@ old smb.conf files.


    This is a Samba developer option that allows a system command to be called when either smbd or nmbd crashes. This is usually used to draw -attention to the fact that a problem occured. +attention to the fact that a problem occurred.


    Default: panic action = <empty string>


    @@ -2710,7 +2710,7 @@ program".

  • passwd program (G)


    The name of a program that can be used to set UNIX user passwords. Any occurrences of %u will be replaced with the -user name. The user name is checked for existance before calling the +user name. The user name is checked for existence before calling the password changing program.


    Also note that many passwd programs insist in "reasonable" passwords, such as a minimum length, or the inclusion of mixed case @@ -2719,7 +2719,7 @@ Windows for Workgroups) uppercase the password before sending it.


    Note that if the "unix password sync" parameter is set to "True" then this program is called *AS ROOT* before the SMB password in the -smbpassswd file is changed. If this UNIX +smbpasswd file is changed. If this UNIX password change fails, then smbd will fail to change the SMB password also (this is by design).


    If the "unix password sync" parameter is @@ -2789,8 +2789,8 @@ better restrict them with hosts allow!


    If the "security" parameter is set to "domain", then the list of machines in this option must be a list of Primary or Backup Domain controllers for the -Domain, as the Samba server is cryptographically -in that domain, and will use crpytographically authenticated RPC calls +Domain, as the Samba server is cryptographicly +in that domain, and will use cryptographicly authenticated RPC calls to authenticate the user logging on. The advantage of using "security=domain" is that if you list several hosts in the "password server" option then @@ -2827,7 +2827,7 @@ is to be given access. In the case of printable services, this is where print data will spool prior to being submitted to the host for printing.


    For a printable service offering guest access, the service should be -readonly and the path should be world-writable and have the sticky bit +readonly and the path should be world-writeable and have the sticky bit set. This is not mandatory of course, but you probably won't get the results you expect if you do otherwise.


    Any occurrences of %u in the path will be replaced @@ -2948,11 +2948,11 @@ have its own print command specified.


    If there is neither a specified print command for a printable service nor a global print command, spool files will be created but not processed and (most importantly) not removed. -


    Note that printing may fail on some UNIXes from the "nobody" +


    Note that printing may fail on some UNIXs from the "nobody" account. If this happens then create an alternative guest account that can print and set the "guest account" in the "[global]" section. -


    You can form quite complex print commands by realising that they are +


    You can form quite complex print commands by realizing that they are just passed to a shell. For example the following will log a print job, print the file, then remove it. Note that ';' is the usual separator for command in shell scripts. @@ -3144,7 +3144,7 @@ command as the PATH may not be available to the server.

  • queueresume command (S)


    This parameter specifies the command to be executed on the server host in order to resume the printerqueue. It is the command to undo the -behaviour that is caused by the previous parameter +behavior that is caused by the previous parameter ("queuepause command).


    This command should be a program or script which takes a printer name as its only parameter and resumes the printerqueue, such that queued @@ -3182,8 +3182,8 @@ the "invalid users"


  • read only (S)


    Note that this is an inverted synonym for -"writable" and "write ok". -


    See also "writable" and "write +"writeable" and "write ok". +


    See also "writeable" and "write ok".


  • read prediction (G) @@ -3256,7 +3256,7 @@ browse masters if your network config is that stable.


  • remote browse sync (G)


    This option allows you to setup nmbd to -periodically request synchronisation of browse lists with the master +periodically request synchronization of browse lists with the master browser of a samba server that is on a remote segment. This option will allow you to gain browse lists for multiple workgroups across routed networks. This is done in a manner that does not work with any @@ -3268,7 +3268,7 @@ send IP packets to.


    For example:


    remote browse sync = 192.168.2.255 192.168.4.255


    the above line would cause nmbd to request the -master browser on the specified subnets or addresses to synchronise +master browser on the specified subnets or addresses to synchronize their browse lists with the local server.


    The IP addresses you choose would normally be the broadcast addresses of the remote networks, but can also be the IP addresses of known @@ -3304,7 +3304,7 @@ automatic access as the same username.


    Synonym for "root directory".


  • root directory (G) -


    The server will "chroot()" (ie. Change it's root directory) to +


    The server will "chroot()" (i.e. Change it's root directory) to this directory on startup. This is not strictly necessary for secure operation. Even without it the server will deny access to files not in one of the service entries. It may also check for, and deny access to, @@ -3335,7 +3335,7 @@ filesystems (such as cdroms) after a connection is closed.

  • root preexec (S)


    This is the same as the "preexec" parameter except that the command is run as root. This is useful for mounting -filesystems (such as cdroms) before a connection is finalised. +filesystems (such as cdroms) before a connection is finalized.


    See also "preexec".


  • security (G) @@ -3356,7 +3356,7 @@ PREVIOUS VERSIONS OF SAMBA *******.


    In previous versions of Samba the default was "security=share" mainly because that was the only option at one stage. -


    There is a bug in WfWg that has relevence to this setting. When in +


    There is a bug in WfWg that has relevance to this setting. When in user or server level security a WfWg client will totally ignore the password you type in the "connect drive" dialog box. This makes it very difficult (if not impossible) to connect to a Samba service as @@ -3371,7 +3371,7 @@ shares). This is commonly used for a shared printer server. It is more difficult to setup guest shares with security=user, see the "map to guest"parameter for details. -


    It is possible to use smbd in a "hybred +


    It is possible to use smbd in a "hybrid mode" where it is offers both user and share level security under different NetBIOS aliases. See the NetBIOS aliases and the @@ -3436,7 +3436,7 @@ be used in this security mode. Parameters such as are then applied and may change the UNIX user to use on this connection, but only after the user has been successfully authenticated. -


    Note that the the name of the resource being requested is +


    Note that the name of the resource being requested is *not* sent to the server until after the server has successfully authenticated the client. This is why guest shares don't work in user level security without allowing the server to automatically map unknown @@ -3458,7 +3458,7 @@ directory ENCRYPTION.txt for details on how to set this up. the same as "security=user". It only affects how the server deals with the authentication, it does not in any way affect what the client sees. -


    Note that the the name of the resource being requested is +


    Note that the name of the resource being requested is *not* sent to the server until after the server has successfully authenticated the client. This is why guest shares don't work in server level security without allowing the server to automatically map unknown @@ -3485,7 +3485,7 @@ UNIX account to map file access to. the same as "security=user". It only affects how the server deals with the authentication, it does not in any way affect what the client sees. -


    Note that the the name of the resource being requested is +


    Note that the name of the resource being requested is *not* sent to the server until after the server has successfully authenticated the client. This is why guest shares don't work in domain level security without allowing the server to automatically map unknown @@ -3497,7 +3497,7 @@ doing this. set usernames. The communication with a Domain Controller must be done in UNICODE and Samba currently does not widen multi-byte user names to UNICODE correctly, thus a multi-byte -username will not be recognised correctly at the Domain Controller. +username will not be recognized correctly at the Domain Controller. This issue will be addressed in a future release.


    See also the section "NOTE ABOUT USERNAME/PASSWORD VALIDATION". @@ -3533,7 +3533,7 @@ client. See the Pathworks documentation for details. set directory = yes


  • share modes (S) -


    This enables or disables the honouring of the "share modes" during a +


    This enables or disables the honoring of the "share modes" during a file open. These modes are used by clients to gain exclusive read or write access to a file.


    These open modes are not directly supported by UNIX, so they are @@ -3611,9 +3611,9 @@ experiment and choose them yourself. We strongly suggest you read the appropriate documentation for your operating system first (perhaps "man setsockopt" will help).


    You may find that on some systems Samba will say "Unknown socket -option" when you supply an option. This means you either mis-typed it -or you need to add an include file to includes.h for your OS. If the -latter is the case please send the patch to +option" when you supply an option. This means you either incorrectly +typed it or you need to add an include file to includes.h for your OS. +If the latter is the case please send the patch to samba-bugs@samba.anu.edu.au.


    Any of the supported socket options may be combined in any way you like, as long as your OS allows it. @@ -3673,7 +3673,7 @@ option "--with-ssl" was given at configure time.


    Note that for export control reasons this code is **NOT** enabled by default in any current binary version of Samba.


    This variable defines where to look up the Certification -Autorities. The given directory should contain one file for each CA +Authorities. The given directory should contain one file for each CA that samba will trust. The file name must be the hash value over the "Distinguished Name" of the CA. How this directory is set up is explained later in this document. All files within the directory that @@ -3692,7 +3692,7 @@ enabled by default in any current binary version of Samba. certificates of the trusted CAs are collected in one big file and this variable points to the file. You will probably only use one of the two ways to define your CAs. The first choice is preferable if you have -many CAs or want to be flexible, the second is perferable if you only +many CAs or want to be flexible, the second is preferable if you only have one CA and want to keep things simple (you won't need to create the hashed file names). You don't need this variable if you don't verify client certificates. @@ -3868,7 +3868,7 @@ change this parameter.


    Default: status = yes


    -dir(strict locking (S)) +

  • strict locking (S)


    This is a boolean that controls the handling of file locking in the server. When this is set to "yes" the server will check every read and write access for file locks, and deny access if locks exist. This can @@ -3888,7 +3888,7 @@ preferable. seem to confuse flushing buffer contents to disk with doing a sync to disk. Under UNIX, a sync call forces the process to be suspended until the kernel has ensured that all outstanding data in kernel disk -buffers has been safely stored onto stable storate. This is very slow +buffers has been safely stored onto stable storage. This is very slow and should only be done rarely. Setting this parameter to "no" (the default) means that smbd ignores the Windows applications requests for a sync call. There is only a possibility of losing data if the @@ -3923,16 +3923,16 @@ set to "yes" in order for this parameter to have any affect.


    See also the "strict sync" parameter.


    Default: sync always = no -


    xample: +


    Example: sync always = yes


  • syslog (G)


    This parameter maps how Samba debug messages are logged onto the system syslog logging levels. Samba debug level zero maps onto syslog LOG_ERR, debug level one maps onto LOG_WARNING, debug level two maps -to LOG_NOTICE, debug level three maps onto LOG_INFO. The paramter +to LOG_NOTICE, debug level three maps onto LOG_INFO. The parameter sets the threshold for doing the mapping, all Samba debug messages -above this threashold are mapped to syslog LOG_DEBUG messages. +above this threshold are mapped to syslog LOG_DEBUG messages.


    Default: syslog = 1


    @@ -3969,7 +3969,7 @@ parameter allows the timestamping to be turned off. timestamp logs = False


  • unix password sync (G) -


    This boolean parameter controlls whether Samba attempts to synchronise +


    This boolean parameter controls whether Samba attempts to synchronize the UNIX password with the SMB password when the encrypted SMB password in the smbpasswd file is changed. If this is set to true the program specified in the "passwd program" @@ -4095,7 +4095,7 @@ as many DOS clients send an all-uppercase username. By default Samba tries all lowercase, followed by the username with the first letter capitalized, and fails if the username is not found on the UNIX machine. -


    If this parameter is set to non-zero the behaviour changes. This +


    If this parameter is set to non-zero the behavior changes. This parameter is a number that specifies the number of uppercase combinations to try whilst trying to determine the UNIX user name. The higher the number the more combinations will be tried, but the slower @@ -4107,7 +4107,7 @@ strange usernames on your UNIX machine, such as "AstrangeUser". username level = 5


  • username map (G) -


    This option allows you to to specify a file containing a mapping of +


    This option allows you to specify a file containing a mapping of usernames from the clients to the server. This can be used for several purposes. The most common is to map usernames that users use on DOS or Windows machines to those that the UNIX box uses. The other is to map @@ -4206,13 +4206,13 @@ overwritten.

     
     	Samba defaults to using a reasonable set of valid characters
    -	for english systems
    +	for English systems
     
     


    Example valid chars = 0345:0305 0366:0326 0344:0304 -


    The above example allows filenames to have the swedish characters in +


    The above example allows filenames to have the Swedish characters in them.


    NOTE: It is actually quite difficult to correctly produce a "valid chars" line for a particular system. To automate the process @@ -4354,32 +4354,16 @@ network.


  • workgroup (G)


    This controls what workgroup your server will appear to be in when -queried by clients. Note that this parameter also controlls the Domain +queried by clients. Note that this parameter also controls the Domain name used with the "security=domain" setting.


    Default: set at compile time to WORKGROUP -


    .B Example: +


    Example: workgroup = MYGROUP


  • writable (S) -


    An inverted synonym is "read only". -


    If this parameter is "no", then users of a service may not create -or modify files in the service's directory. -


    Note that a printable service ("printable = yes") -will *ALWAYS* allow writing to the directory (user privileges -permitting), but only via spooling operations. -


    Default: - writable = no -


    Examples: -

    -
    - 	read only = no
    - 	writable = yes
    - 	write ok = yes
    -
    -
    - +


    Synonym for "writeable" for people who can't spell :-).


  • write list (S)


    This is a list of users that are given read-write access to a @@ -4396,7 +4380,7 @@ they will be given write access. write list = admin, root, @staff


  • write ok (S) -


    Synonym for writable. +


    Synonym for writeable.


  • write raw (G)


    This parameter controls whether or not the server will support raw @@ -4406,7 +4390,23 @@ need to change this parameter. write raw = yes


  • writeable -


    Synonym for "writable" for people who can't spell :-). +


    An inverted synonym is "read only". +


    If this parameter is "no", then users of a service may not create +or modify files in the service's directory. +


    Note that a printable service ("printable = yes") +will *ALWAYS* allow writing to the directory (user privileges +permitting), but only via spooling operations. +


    Default: + writeable = no +


    Examples: +

    +
    + 	read only = no
    + 	writeable = yes
    + 	write ok = yes
    +
    +
    +


    WARNINGS

    diff --git a/docs/htmldocs/smbclient.1.html b/docs/htmldocs/smbclient.1.html index 8e480a2beab..533066c500a 100644 --- a/docs/htmldocs/smbclient.1.html +++ b/docs/htmldocs/smbclient.1.html @@ -3,7 +3,7 @@ -smbclient +smbclient (1) @@ -11,7 +11,7 @@
    -

    smbclient

    +

    smbclient (1)

    Samba

    23 Oct 1998

    @@ -105,7 +105,7 @@ methods as it depends on the target host being on a locally connected subnet. To specify a particular broadcast address the -B option may be used.


    -


    If this parameter is not set then the name resolver order defined +


    If this parameter is not set then the name resolve order defined in the smb.conf file parameter (name resolve order) will be used. @@ -219,7 +219,7 @@ that it must be a valid NetBIOS name. the environment variable USER or LOGNAME in that order. If no username is supplied and neither environment variable exists the username "GUEST" will be used. -


    If the USER environment variable containts a '%' character, +


    If the USER environment variable contains a '%' character, everything after that will be treated as a password. This allows you to set the environment variable to be USER=username%password so that a password is not passed on the command line (where it may be @@ -269,7 +269,7 @@ tested and may have some problems. Samba source code for the complete list.


  • -m max protocol level With the new code in Samba2.0, -smbclient allways attempts to connect at the maximum +smbclient always attempts to connect at the maximum protocols level the server supports. This parameter is preserved for backwards compatibility, but any string following the -m will be ignored. @@ -291,11 +291,11 @@ share. The secondary tar flags that can be given to this option are : share. Unless the -D option is given, the tar files will be restored from the top level of the share. Must be followed by the name of the tar file, device or "-" for standard input. Mutually exclusive - with the c flag. Restored files have theuir creation times (mtime) + with the c flag. Restored files have their creation times (mtime) set to the date saved in the tar file. Directories currently do not get their creation dates restored properly.


  • I Include files and directories. Is the default - behaviour when filenames are specified above. Causes tar files to + behavior when filenames are specified above. Causes tar files to be included in an extract or create (and therefore everything else to be excluded). See example below. Filename globbing does not work for included files for extractions (yet). @@ -364,12 +364,12 @@ commands are case-insensitive. Parameters to commands may or may not be case sensitive, depending on the command.


    You can specify file names which have spaces in them by quoting the name with double quotes, for example "a long file name". -


    Parameters shown in square brackets (eg., "[parameter]") are +


    Parameters shown in square brackets (e.g., "[parameter]") are optional. If not given, the command will use suitable -defaults. Parameters shown in angle brackets (eg., "<parameter>") are +defaults. Parameters shown in angle brackets (e.g., "<parameter>") are required.


    Note that all commands operating on the server are actually performed -by issuing a request to the server. Thus the behaviour may vary from +by issuing a request to the server. Thus the behavior may vary from server to server, depending on how the server was implemented.


    The commands available are given here in alphabetical order.


      @@ -459,7 +459,7 @@ from the local machine through a printable service on the server. mode to suit either binary data (such as graphical information) or text. Subsequent print commands will use the currently set print mode. -


      dir(prompt) Toggle prompting for filenames during +


    • prompt Toggle prompting for filenames during operation of the mget and mput commands.


      When toggled ON, the user will be prompted to confirm the transfer of @@ -470,12 +470,12 @@ file called "local file name" from the machine running the client to the server. If specified, name the remote copy "remote file name". Note that all transfers in smbclient are binary. See also the lowercase command. -


      dir(queue) Displays the print queue, showing the job +


    • queue Displays the print queue, showing the job id, name, size and current status.


    • quit See the exit command. -


      dir(rd <directory name>) See the rmdir +


    • rd <directory name> See the rmdir command. -


      dir(recurse) Toggle directory recursion for the +


    • recurse Toggle directory recursion for the commands mget and mput.


      When toggled ON, these commands will process all directories in the source directory (i.e., the directory they are copying .IR from ) and @@ -488,12 +488,12 @@ directory on the source machine that match the mask specified to the mget or mput commands will be copied, and any mask specified using the mask command will be ignored. -


      dir(rm <mask>) Remove all files matching mask from +


    • rm <mask> Remove all files matching mask from the current working directory on the server.


    • rmdir <directory name> Remove the specified directory (user access privileges permitting) from the server.


    • tar <c|x>[IXbgNa] Performs a tar operation - see -the -T command line option above. Behaviour may be +the -T command line option above. Behavior may be affected by the tarmode command (see below). Using g (incremental) and N (newer) will affect tarmode settings. Note that using the "-" option with tar x may not work - use the command line @@ -501,8 +501,8 @@ option instead.


    • blocksize <blocksize> Blocksize. Must be followed by a valid (greater than zero) blocksize. Causes tar file to be written out in blocksize*TBLOCK (usually 512 byte) blocks. -


      dir(tarmode <full|inc|reset|noreset>) Changes tar's -behaviour with regard to archive bits. In full mode, tar will back up +


    • tarmode <full|inc|reset|noreset> Changes tar's +behavior with regard to archive bits. In full mode, tar will back up everything regardless of the archive bit setting (this is the default mode). In incremental mode, tar will only back up files with the archive bit set. In reset mode, tar will reset the archive bit on all @@ -516,7 +516,7 @@ of the DOS attrib command to set file permissions. For example:

      NOTES


      Some servers are fussy about the case of supplied usernames, -passwords, share names (aka service names) and machine names. If you +passwords, share names (AKA service names) and machine names. If you fail to connect try giving all parameters in uppercase.


      It is often necessary to use the -n option when connecting to some types of servers. For example OS/2 LanManager insists on a valid @@ -544,7 +544,7 @@ readable by all, writeable only by root. The client program itself should be executable by all. The client should NOT be setuid or setgid!


      The client log files should be put in a directory readable and -writable only by the user. +writeable only by the user.


      To test the client, you will need to know the name of a running SMB/CIFS server. It is possible to run smbd (8) an ordinary user - running that server as a daemon on a diff --git a/docs/htmldocs/smbd.8.html b/docs/htmldocs/smbd.8.html index cd00af3b276..a6e0f32e124 100644 --- a/docs/htmldocs/smbd.8.html +++ b/docs/htmldocs/smbd.8.html @@ -3,7 +3,7 @@ -smbd +smbd (8) @@ -11,7 +11,7 @@


      -

      smbd

      +

      smbd (8)

      Samba

      23 Oct 1998

      @@ -29,7 +29,8 @@

      DESCRIPTION


      This program is part of the Samba suite. -


      smbd is the server daemon that provides filesharing services to +


      smbd is the server daemon that provides filesharing and printing +services to Windows clients. The server provides filespace and printer services to clients using the SMB (or CIFS) protocol. This is compatible with the LanManager protocol, and can service LanManager clients. These @@ -37,16 +38,18 @@ include MSCLIENT 3.0 for DOS, Windows for Workgroups, Windows 95, Windows NT, OS/2, DAVE for Macintosh, and smbfs for Linux.


      An extensive description of the services that the server can provide is given in the man page for the configuration file controlling the -attributes of those services (see smb.conf (5)). This man page +attributes of those services (see +smb.conf (5). This man page will not describe the services, but will concentrate on the administrative aspects of running the server.


      Please note that there are significant security implications to -running this server, and the smb.conf (5) manpage should be +running this server, and the +smb.conf (5) manpage should be regarded as mandatory reading before proceeding with installation.


      A session is created whenever a client requests one. Each client gets a copy of the server for each session. This copy then services all connections made by the client during that session. When all -connections from its client are are closed, the copy of the server for +connections from its client are closed, the copy of the server for that client terminates.


      The configuration file, and any files that it includes, are automatically reloaded every minute, if they change. You can force a @@ -116,13 +119,13 @@ rfc1002.txt section 4.3.5.


      This parameter is not normally specified except in the above situation.


      -

    • -s configuration file The default configuration file name is -determined at compile time. -


      The file specified contains the configuration details required by the +

    • -s configuration file +The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide. See smb.conf (5) for more information. +The default configuration file name is determined at compile time.


    • -i scope This specifies a NetBIOS scope that the server will use to communicate with when generating NetBIOS names. For details on the @@ -142,23 +145,23 @@ out. Used for debugging by the developers only.


      /etc/inetd.conf


      If the server is to be run by the inetd meta-daemon, this file must contain suitable startup information for the meta-daemon. See the -section INSTALLATION below. +section INSTALLATION below.


      /etc/rc -


      (or whatever initialisation script your system uses). +


      (or whatever initialization script your system uses).


      If running the server as a daemon at startup, this file will need to contain an appropriate startup sequence for the server. See the -section INSTALLATION below. +section INSTALLATION below.


      /etc/services


      If running the server via the meta-daemon inetd, this file must -contain a mapping of service name (eg., netbios-ssn) to service port -(eg., 139) and protocol type (eg., tcp). See the section -INSTALLATION below. +contain a mapping of service name (e.g., netbios-ssn) to service port +(e.g., 139) and protocol type (e.g., tcp). See the section +INSTALLATION below.


      /usr/local/samba/lib/smb.conf


      This is the default location of the smb.conf server configuration file. Other common places that systems install this file are /usr/samba/lib/smb.conf and /etc/smb.conf.


      This file describes all the services the server is to make available -to clients. See smb.conf (5) for more information. +to clients. See smb.conf (5) for more information.


      LIMITATIONS

      @@ -196,10 +199,10 @@ at the time this was written. It is possible that this hole only exists in Linux, as testing on other systems has thus far shown them to be immune.


      The server log files should be put in a directory readable and -writable only by root, as the log files may contain sensitive +writeable only by root, as the log files may contain sensitive information.


      The configuration file should be placed in a directory readable and -writable only by root, as the configuration file controls security for +writeable only by root, as the configuration file controls security for the services offered by the server. The configuration file can be made readable by all if desired, but this is not necessary for correct operation of the server and is not recommended. A sample configuration @@ -218,8 +221,9 @@ faster. If run from a meta-daemon some memory will be saved and utilities such as the tcpd TCP-wrapper may be used for extra security. For serious use as file server it is recommended that smbd be run as a daemon. -


      When you've decided, continue with either RUNNING THE SERVER AS A -DAEMON or RUNNING THE SERVER ON REQUEST. +


      When you've decided, continue with either +RUNNING THE SERVER AS A DAEMON or +RUNNING THE SERVER ON REQUEST.


      RUNNING THE SERVER AS A DAEMON

      @@ -239,17 +243,17 @@ files. Wherever appropriate (for example, in /etc/rc), insert the following line, substituting port number, log file location, configuration file location and debug level as desired:


      /usr/local/samba/bin/smbd -D -l /var/adm/smblogs/log -s /usr/local/samba/lib/smb.conf -


      (The above should appear in your initialisation script as a single line. +


      (The above should appear in your initialization script as a single line. Depending on your terminal characteristics, it may not appear that way in this man page. If the above appears as more than one line, please treat any newlines or indentation as a single space or TAB character.)


      If the options used at compile time are appropriate for your system, -all parameters except the desired debug level and -D may be -omitted. See the section OPTIONS above. +all parameters except -D may be +omitted. See the section OPTIONS above.


      RUNNING THE SERVER ON REQUEST

      -


      If your system uses a meta-daemon such as inetd, you can arrange to +


      If your system uses a meta-daemon such as inetd, you can arrange to have the smbd server started whenever a process attempts to connect to it. This requires several changes to the startup files on the host machine. If you are experimenting as an ordinary user rather than as @@ -284,10 +288,10 @@ start with, the following two services should be all you need: [homes] - writable = yes + writeable = yes [printers] - writable = no + writeable = no printable = yes path = /tmp public = yes @@ -307,7 +311,8 @@ tables if they receive a HUP signal.


      If your machine's name is "fred" and your name is "mary", you should now be able to connect to the service \\fred\mary.


      To properly test and experiment with the server, we recommend using -the smbclient program (see smbclient (1)) and also going through +the smbclient program (see +smbclient (1)) and also going through the steps outlined in the file DIAGNOSIS.txt in the docs/ directory of your Samba installation.


      @@ -323,8 +328,8 @@ overridden on the command line.


      The number and nature of diagnostics available depends on the debug level used by the server. If you have problems, set the debug level to 3 and peruse the log files. -


      Most messages are reasonably self-explanatory. Unfortunately, at time -of creation of this man page there are too many diagnostics available +


      Most messages are reasonably self-explanatory. Unfortunately, at the time +this man page was created, there are too many diagnostics available in the source code to warrant describing each and every diagnostic. At this stage your best bet is still to grep the source code and inspect the conditions that gave rise to the diagnostics you are seeing. @@ -335,7 +340,7 @@ the conditions that gave rise to the diagnostics you are seeing. configuration file within a short period of time.


      To shut down a users smbd process it is recommended that SIGKILL (-9) NOT be used, except as a last resort, as this may leave the shared -memory area in an inconsistant state. The safe way to terminate an +memory area in an inconsistent state. The safe way to terminate an smbd is to send it a SIGTERM (-15) signal and wait for it to die on its own.


      The debug log level of smbd may be raised @@ -363,7 +368,7 @@ specification is available as a link from the Web page :

      AUTHOR


      The original Samba software and related utilities were created by -Andrew Tridgell (samba-bugs@samba.anu.edu.au). Samba is now developed +Andrew Tridgell samba-bugs@samba.anu.edu.au. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.


      The original Samba man pages were written by Karl Auer. The man page diff --git a/docs/htmldocs/smbpasswd.5.html b/docs/htmldocs/smbpasswd.5.html index 35649e689bc..6c4081fc4d7 100644 --- a/docs/htmldocs/smbpasswd.5.html +++ b/docs/htmldocs/smbpasswd.5.html @@ -3,7 +3,7 @@ -smbpasswd +smbpasswd (5) @@ -11,7 +11,7 @@


      -

      smbpasswd

      +

      smbpasswd (5)

      Samba

      23 Oct 1998

      @@ -30,7 +30,7 @@


      This file is part of the Samba suite.


      smbpasswd is the Samba encrypted password file. It contains -the username, unix user id and the SMB hashed passwords of the +the username, Unix user id and the SMB hashed passwords of the user, as well as account flag information and the time the password was last changed. This file format has been evolving with Samba and has had several different formats in the past. @@ -38,7 +38,7 @@ and has had several different formats in the past.

      FILE FORMAT


      The format of the smbpasswd file used by Samba 2.0 is very similar to -the familiar unix passwd (5) file. It is an ASCII file containing +the familiar Unix passwd (5) file. It is an ASCII file containing one line for each user. Each field within each line is separated from the next by a colon. Any entry beginning with # is ignored. The smbpasswd file contains the following information for each user: @@ -50,7 +50,9 @@ smbpasswd file contains the following information for each user:


    • uid


      This is the UNIX uid. It must match the uid field for the same - user entry in the standard UNIX passwd file. + user entry in the standard UNIX passwd file. If this does not + match then Samba will refuse to recognize this smbpasswd file entry + as being valid for a user.


    • Lanman Password Hash


      This is the LANMAN hash of the users password, encoded as 32 hex @@ -58,7 +60,7 @@ smbpasswd file contains the following information for each user: string with the users password as the DES key. This is the same password used by Windows 95/98 machines. Note that this password hash is regarded as weak as it is vulnerable to dictionary attacks and if - two users choose the same password this entry will be identical (ie. + two users choose the same password this entry will be identical (i.e. the password is not "salted" as the UNIX password is). If the user has a null password this field will contain the characters "NO PASSWORD" as the start of the hex string. If the hex string @@ -67,7 +69,7 @@ smbpasswd file contains the following information for each user: server.


      WARNING !!. Note that, due to the challenge-response nature of the SMB/CIFS authentication protocol, anyone with a knowledge of this - password hash will be able to impersonate the user of the network. + password hash will be able to impersonate the user on the network. For this reason these hashes are known as "plain text equivalent" and must NOT be made available to anyone but the root user. To protect these passwords the smbpasswd file is placed in a @@ -84,11 +86,11 @@ smbpasswd file contains the following information for each user: Password Hash
      as it preserves the case of the password and uses a much higher quality hashing algorithm. However, it is still the case that if two users choose the same password this - entry will be identical (ie. the password is not "salted" as the + entry will be identical (i.e. the password is not "salted" as the UNIX password is).


      WARNING !!. Note that, due to the challenge-response nature of the SMB/CIFS authentication protocol, anyone with a knowledge of this - password hash will be able to impersonate the user of the network. + password hash will be able to impersonate the user on the network. For this reason these hashes are known as "plain text equivalent" and must NOT be made available to anyone but the root user. To protect these passwords the smbpasswd file is placed in a @@ -104,8 +106,8 @@ smbpasswd file contains the following information for each user: any of the characters.



        -

      • 'U' This means this is a "User" account, ie. an ordinary - user. Only User and Worskstation Trust accounts are +
      • 'U' This means this is a "User" account, i.e. an ordinary + user. Only User and Workstation Trust accounts are currently supported in the smbpasswd file.


      • 'N' This means the account has no password (the passwords @@ -115,7 +117,7 @@ smbpasswd file contains the following information for each user: null passwords parameter is set in the smb.conf (5) config file.


        -

      • 'D' This means the account is diabled and no SMB/CIFS logins +
      • 'D' This means the account is disabled and no SMB/CIFS logins will be allowed for this user.


      • 'W' This means this account is a "Workstation Trust" account. @@ -177,12 +179,14 @@ algorithm.

        AUTHOR


        The original Samba software and related utilities were created by -Andrew Tridgell (samba-bugs@samba.anu.edu.au). Samba is now developed +Andrew Tridgell samba-bugs@samba.anu.edu.au. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.


        The original Samba man pages were written by Karl Auer. The man page sources were converted to YODL format (another excellent piece of Open -Source software) and updated for the Samba2.0 release by Jeremy +Source software, available at +ftp://ftp.icce.rug.nl/pub/unix/) +and updated for the Samba2.0 release by Jeremy Allison, samba-bugs@samba.anu.edu.au.


        See samba (7) to find out how to get a full list of contributors and details on how to submit bug reports, diff --git a/docs/htmldocs/smbpasswd.8.html b/docs/htmldocs/smbpasswd.8.html index 066004be212..6bfd8cdb440 100644 --- a/docs/htmldocs/smbpasswd.8.html +++ b/docs/htmldocs/smbpasswd.8.html @@ -3,7 +3,7 @@ -smbpasswd +smbpasswd (8) @@ -11,7 +11,7 @@


        -

        smbpasswd

        +

        smbpasswd (8)

        Samba

        23 Oct 1998

        @@ -35,7 +35,7 @@ user it allows the user to change the password used for their SMB sessions on any machines that store SMB passwords.


        By default (when run with no arguments) it will attempt to change the current users SMB password on the local machine. This is similar to -the way the passwd (1) program works. smbpasswd differs from +the way the passwd (1) program works. smbpasswd differs from how the passwd program works however in that it is not setuid root but works in a client-server mode and communicates with a locally running smbd. As a consequence in order for this @@ -49,13 +49,13 @@ correctly. No passwords will be echoed on the screen whilst being typed. If you have a blank smb password (specified by the string "NO PASSWORD" in the smbpasswd file) then just press the <Enter> key when asked for your old password. -


        smbpasswd also can be used by a normal user to change their SMB +


        smbpasswd can also be used by a normal user to change their SMB password on remote machines, such as Windows NT Primary Domain Controllers. See the (-r) and -U options below.


        When run by root, smbpasswd allows new users to be added and deleted in the smbpasswd file, as well as -changes to the attributes of the user in this file to be made. When +allows changes to the attributes of the user in this file to be made. When run by root, smbpasswd accesses the local smbpasswd file directly, thus enabling changes to be made even if smbd is not running. @@ -69,8 +69,8 @@ be added to the local smbpasswd the new password typed (type <Enter> for the old password). This option is ignored if the username following already exists in the smbpasswd file and it is treated like a -regular change password command. Note that the user to be added .B -must already exist in the system password file (usually /etc/passwd) +regular change password command. Note that the user to be added +must already exist in the system password file (usually /etc/passwd) else the request to add the user will fail.


        This option is only available when running smbpasswd as root. @@ -142,6 +142,9 @@ username. specified must be the Primary Domain Controller for the domain (Backup Domain Controllers only have a read-only copy of the user account database and will not allow the password change). +


        Note that Windows 95/98 do not have a real password database +so it is not possible to change passwords specifying a Win95/98 +machine as remote machine target.


      • -R name resolve order This option allows the user of smbclient to determine what name resolution services to use when @@ -155,11 +158,12 @@ resolved as follows :


      • host : Do a standard host name to IP address resolution, using the system /etc/hosts, NIS, or DNS lookups. This method of name -resolution is operating system depended for instance on IRIX or -Solaris this may be controlled by the /etc/nsswitch.conf file). +resolution is operating system dependent. For instance on IRIX or +Solaris, this may be controlled by the /etc/nsswitch.conf file).


        -

      • wins : Query a name with the IP address listed in the wins -server parameter in the smb.conf file. If +
      • wins : Query a name with the IP address listed in the +wins server parameter in the +smb.conf file. If no WINS server has been specified this method will be ignored.


      • bcast : Do a broadcast on each of the known local interfaces @@ -168,7 +172,7 @@ in the smb.conf file. This is the least reliable of the name resolution methods as it depends on the target host being on a locally connected subnet.


      -


      If this parameter is not set then the name resolver order defined +


      If this parameter is not set then the name resolve order defined in the smb.conf file parameter name resolve order will be used. @@ -202,7 +206,7 @@ Controller for the Domain (found in the the machine account password used to create the secure Domain communication. This password is then stored by smbpasswd in a file, read only by root, called <Domain>.<Machine>.mac where -<Domain> is the name of the Domain we are joining and tt<Machine> +<Domain> is the name of the Domain we are joining and <Machine> is the primary NetBIOS name of the machine we are running on.


      Once this operation has been performed the smb.conf file may be updated to set the @@ -224,19 +228,19 @@ different systems to change these passwords.

    • -h This option prints the help string for smbpasswd, selecting the correct one for running as root or as an ordinary user.


      -

    • -s This option causes smbpasswd to be silent (ie. not +
    • -s This option causes smbpasswd to be silent (i.e. not issue prompts) and to read it's old and new passwords from standard input, rather than from /dev/tty (like the passwd (1) program does). This option is to aid people writing scripts to drive smbpasswd


      -dir(username) This specifies the username for all of the root +

    • username This specifies the username for all of the root only options to operate on. Only root can specify this parameter as only root has the permission needed to modify attributes directly in the local smbpasswd file.


      NOTES

      -


      As smbpasswd works in client-server mode communicating with a +


      Since smbpasswd works in client-server mode communicating with a local smbd for a non-root user then the smbd daemon must be running for this to work. A common problem is to add a restriction to the hosts that may access the smbd running on the diff --git a/docs/htmldocs/smbrun.1.html b/docs/htmldocs/smbrun.1.html index b8d1021d562..9db9b7e7833 100644 --- a/docs/htmldocs/smbrun.1.html +++ b/docs/htmldocs/smbrun.1.html @@ -3,7 +3,7 @@ -smbrun +smbrun (1) @@ -11,7 +11,7 @@


      -

      smbrun

      +

      smbrun (1)

      Samba

      23 Oct 1998

      diff --git a/docs/htmldocs/smbstatus.1.html b/docs/htmldocs/smbstatus.1.html index 3c46e55fdf2..cc48f29d883 100644 --- a/docs/htmldocs/smbstatus.1.html +++ b/docs/htmldocs/smbstatus.1.html @@ -3,7 +3,7 @@ -smbstatus +smbstatus (1) @@ -11,7 +11,7 @@
      -

      smbstatus

      +

      smbstatus (1)

      Samba

      23 Oct 1998

      diff --git a/docs/htmldocs/smbtar.1.html b/docs/htmldocs/smbtar.1.html index 47a2d26b108..610ead88df8 100644 --- a/docs/htmldocs/smbtar.1.html +++ b/docs/htmldocs/smbtar.1.html @@ -3,7 +3,7 @@ -smbtar +smbtar (1) @@ -11,7 +11,7 @@
      -

      smbtar

      +

      smbtar (1)

      Samba

      23 Oct 1998

      diff --git a/docs/htmldocs/swat.8.html b/docs/htmldocs/swat.8.html index 4a2eeec3d51..31afec1a89e 100644 --- a/docs/htmldocs/swat.8.html +++ b/docs/htmldocs/swat.8.html @@ -3,7 +3,7 @@ -swat +swat (8) @@ -11,7 +11,7 @@
      -

      swat

      +

      swat (8)

      Samba

      23 Oct 1998

      @@ -34,8 +34,7 @@ addition, a swat configuration page has help links to all the configurable options in the smb.conf file allowing an administrator to easily look up the effects of any change. -


      swat can be run as a stand-alone daemon, from inetd, -or invoked via CGI from a Web server. +


      swat is run from inetd


      OPTIONS

      @@ -51,13 +50,10 @@ of all the services that the server is to provide. See for more information.


    • -a -


      This option is only used if swat is running as it's own mini-web -server (see the INSTALLATION section below). -


      This option removes the need for authentication needed to modify the -smb.conf file. **THIS IS ONLY MEANT FOR -DEMOING SWAT AND MUST NOT BE SET IN NORMAL SYSTEMS** as it would -allow *ANYONE* to modify the smb.conf -file, thus giving them root access. +


      This option disables authentication and puts swat in demo mode. In +that mode anyone will be able to modify the +smb.conf file. +


      Do NOT enable this option on a production server.



    INSTALLATION

    @@ -73,14 +69,11 @@ would put these in:
  • -


    -

    RUNNING VIA INETD

    +


    +

    INETD INSTALLATION


    You need to edit your /etc/inetd.conf and /etc/services to -enable SWAT to be launched via inetd. Note that swat can also -be launched via the cgi-bin mechanisms of a web server (such as -apache) and that is described below in the section RUNNING VIA -CGI-BIN. +enable SWAT to be launched via inetd.


    In /etc/services you need to add a line like this:


    swat 901/tcp


    Note for NIS/YP users - you may need to rebuild the NIS service maps @@ -91,67 +84,26 @@ presents an obscure security hole depending on the implementation details of your inetd daemon).


    In /etc/inetd.conf you should add a line like this:


    swat stream tcp nowait.400 root /usr/local/samba/bin/swat swat -


    If you just want to see a demo of how swat works and don't want to be -able to actually change any Samba config via swat then you may chose -to change "root" to some other user that does not have permission -to write to smb.conf.


    One you have edited /etc/services and /etc/inetd.conf you need to send a HUP signal to inetd. To do this use "kill -1 PID" where PID is the process ID of the inetd daemon. -


    -

    RUNNING VIA CGI-BIN

    - -


    To run swat via your web servers cgi-bin capability you need to -copy the swat binary to your cgi-bin directory. Note that you -should run swat either via inetd or via -cgi-bin but not both. -


    Then you need to create a swat/ directory in your web servers root -directory and copy the images/* and help/* files found in the -swat/ directory of your Samba source distribution into there so -that they are visible via the URL http://your.web.server/swat/ -


    Next you need to make sure you modify your web servers authentication -to require a username/pssword for the URL -http://your.web.server/cgi-bin/swat. **Don't forget this -step!** If you do forget it then you will be allowing anyone to edit -your Samba configuration which would allow them to easily gain root -access on your machine. -


    After testing the authentication you need to change the ownership and -permissions on the swat binary. It should be owned by root wth the -setuid bit set. It should be ONLY executable by the user that the web -server runs as. Make sure you do this carefully! -


    for example, the following would be correct if the web server ran as -group "nobody". -


    -rws--x--- 1 root nobody -


    You must also realise that this means that any user who can run -programs as the "nobody" group can run swat and modify your -Samba config. Be sure to think about this!


    LAUNCHING

    -


    To launch swat just run your favourite web browser and point it at -http://localhost:901/ or http://localhost/cgi-bin/swat/ -depending on how you installed it. -


    Note that you can attach to swat from any IP connected machine but +


    To launch swat just run your favorite web browser and point it at +http://localhost:901/. +


    Note that you can attach to swat from any IP connected machine but connecting from a remote machine leaves your connection open to password sniffing as passwords will be sent in the clear over the -wire. -


    If installed via inetd then you should be prompted for a -username/password when you connect. You will need to provide the -username "root" and the correct root password. More sophisticated -authentication options are planned for future versions of swat. -


    If installed via cgi-bin then you should receive whatever -authentication request you configured in your web server. +wire.


    FILES


    /etc/inetd.conf -


    If the server is to be run by the inetd meta-daemon, this file must -contain suitable startup information for the meta-daemon. See the -section RUNNING VIA INETD above. +


    This file must contain suitable startup information for the +meta-daemon.


    /etc/services -


    If running the server via the meta-daemon inetd, this file must -contain a mapping of service name (eg., swat) to service port -(eg., 901) and protocol type (eg., tcp). See the section -RUNNING VIA INETD above. +


    This file must contain a mapping of service name (e.g., swat) to +service port (e.g., 901) and protocol type (e.g., tcp).


    /usr/local/samba/lib/smb.conf


    This is the default location of the smb.conf server configuration file that swat edits. Other common places that systems install diff --git a/docs/htmldocs/testparm.1.html b/docs/htmldocs/testparm.1.html index d969131b8f9..cd7b08232a7 100644 --- a/docs/htmldocs/testparm.1.html +++ b/docs/htmldocs/testparm.1.html @@ -3,7 +3,7 @@ -testparm +testparm (1) @@ -11,7 +11,7 @@


    -

    testparm

    +

    testparm (1)

    Samba

    23 Oct 1998

    @@ -53,9 +53,9 @@ then testparm will examine the "hos allow" and "hosts deny" parameters in the smb.conf file to determine if the hostname -with this IP address would be allowed acces to the +with this IP address would be allowed access to the smbd server. If this parameter is supplied, the -hostIP parameter must also be supplied. +hostIP parameter must also be supplied.


  • hostIP This is the IP address of the host specified in the previous parameter. This address must be supplied if the hostname diff --git a/docs/htmldocs/testprns.1.html b/docs/htmldocs/testprns.1.html index ef027385f56..62d71a29f2b 100644 --- a/docs/htmldocs/testprns.1.html +++ b/docs/htmldocs/testprns.1.html @@ -3,7 +3,7 @@ -testparm +testprns (1) @@ -11,7 +11,7 @@
    -

    testparm

    +

    testprns (1)

    Samba

    23 Oct 1998

    @@ -20,7 +20,7 @@


    NAME

    - testparm - check printer name for validity with smbd + testprns - check printer name for validity with smbd


    SYNOPSIS

    @@ -43,7 +43,7 @@ would be wisest to always specify the printcap file to use.
  • printername The printer name to validate.


    Printer names are taken from the first field in each record in the printcap file, single printer names and sets of aliases separated by -vertical bars ("|") are recognised. Note that no validation or +vertical bars ("|") are recognized. Note that no validation or checking of the printcap syntax is done beyond that required to extract the printer name. It may be that the print spooling system is more forgiving or less forgiving than testprns. However, if -- cgit