summaryrefslogtreecommitdiffstats
path: root/docs-xml/using_samba/appf.xml
blob: 81ea0a968c730601826af7c1b99a557358d55df1 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
<appendix label="F" id="SAMBA-AP-F">
<title>Sample Configuration File</title>




<para>
<indexterm id="appf-idx-993481-0" class="startofrange"><primary>configuration files</primary><secondary>sample of</secondary></indexterm>This appendix gives an example of a production <filename>smb.conf</filename> file and looks at how many of the options are used in practice. The following is a slightly disguised version of one we used at a corporation with five Linux servers, five Windows for Workgroups clients and three NT Workstation clients:</para>


<programlisting># smb.conf -- File Server System for: 1 Example.COM  BSC &amp; Management Office
[globals]
	workgroup = 1EG_BSC
	interfaces = 10.10.1.14/24</programlisting>


<para>We provide this service on only one of the machine's interfaces. The <literal>interfaces</literal> option sets its address and netmask, where <literal>/24</literal> is the same as using the netmask 255.255.255.0:</para>


<programlisting>comment = Samba ver. %v
	preexec = csh -c `echo /usr/samba/bin/smbclient \
                     -M %m -I %I` &amp;</programlisting>


<para>We use the <command>preexec</command> command to log information about all connections by machine name (<literal>%m</literal>) and IP address (<literal>%I)</literal>:</para>


<programlisting># smbstatus will output various info on current status
	status = yes
	browseable = yes
	printing = bsd

	# the username that will be used for access to services
	# specified with 'guest = ok'
	guest account = samba</programlisting>


<para>The default guest account was <literal>nobody</literal>, uid -1, which produced log messages on one of our machines saying "your server is being unfriendly," so we created a specific Samba guest account for browsing and printing:</para>


<programlisting># superuser account - admin privileges to shares, with no
	# restrictions
	# WARNING - use this with care: files can be modified,
	# regardless of file permissions
	admin users = root

	# who is NOT allowed to connect to ANY service
	invalid users = @wheel, mail, deamon, adt</programlisting>


<para>Daemons can't use Samba, only people. The <literal>invalid</literal> <literal>users</literal> option closes a security hole; it prevents intruders from breaking in by pretending to be a daemon process.</para>


<programlisting># hosts that are ALLOWED or DENIED from connecting to ANY service
	hosts allow = 10.10.1.
	hosts deny = 10.10.1.6

	# where the lock files will be located
	lock directory = /var/lock/samba/locks

	# debug log files
	# %m = separate log for each NetBIOS name (each machine)
	log file = /var/log/samba/log.%m

	# We send priority 0, 1 and 2 messages to the system logs
	syslog = 2

	# If a WinPopup message is sent to the server,
	# redirect it to a user via e-mail

	message command = /bin/mail -s 'message from #% on %m' \
                               pkelly &lt; %s; rm %s

# ---------------------------------------------------
# [globals] Performance Tuning
# ---------------------------------------------------

	# caching algorithm to reduce time doing getwd() calls.
	getwd cache = yes

	socket options = TCP_NODELAY

	# tell the server whether the client is present and
	# responding in seconds
	keep alive = 60

	# num minutes of inactivity before a connection is
	# considered dead
	dead time = 30

	read prediction = yes
	max xmit = 17384
	read size = 512</programlisting>


<para>The <literal>share</literal> <literal>modes</literal>, <literal>max</literal>, <literal>xinit</literal>, and <literal>read</literal> <literal>size</literal> options are machine-specific (see <link linkend="SAMBA-AP-B">Appendix B</link>):</para>


<programlisting># locking is done by the server
	locking = yes

	# control whether dos style attributes should be mapped
	# to unix execute bits
	map hidden = yes
	map archive = yes
	map system = yes</programlisting>


<para>The three <literal>map</literal> options will work only on shares with a create mode that includes the execute bits (0111). Our <literal>homes</literal> and <literal>printers</literal> shares won't honor them, but the [<literal>www]</literal> share will:</para>


<programlisting># ---------------------------------------------------------
# [globals] Security and Domain Logon Services
# ---------------------------------------------------------
# connections are made with UID and GID, not as shares
	security = user

# boolean variable that controls whether passwords
# will be encrypted
	encrypt passwords = yes
	passwd chat = "*New password:*" %n\r "*New password (again):*" %n\r \ "*Password changed*"
	passwd program = /usr/bin/passwd %u

# Always become the local master browser
	domain master = yes
	preferred master = yes
	os level = 34

# For domain logons to work correctly. Samba acts as a
# primary domain controller.
	domain logons = yes

# Logon script to run for user off the server each time
# username (%U) logs in.  Set the time, connect to shares,
# virus checks, etc.
	logon script = scripts\%U.bat

[netlogon]
	comment = "Domain Logon Services"
	path = /u/netlogon
	writable = yes
	create mode = 444
	guest ok = no
	volume = "Network"</programlisting>


<para>This share, discussed in <link linkend="SAMBA-CH-6">Chapter 6</link>, is required for Samba to work smoothly in a Windows NT domain:</para>


<programlisting># -----------------------------------------------------------
# [homes] User Home Directories
# -----------------------------------------------------------
[homes]
	comment = "Home Directory for : %u "
	path = /u/users/%u</programlisting>


<para>The password file of the Samba server specifies each person's home directory as   <emphasis>/home/</emphasis><replaceable>machine_name</replaceable><emphasis>/</emphasis><replaceable>person</replaceable>, which NFS converts to point to the actual physicl location under <emphasis>/u/users</emphasis>. The <literal>path</literal> option in the <literal>[homes]</literal> share tells Samba the actual (non-NFS) location:</para>


<programlisting>guest ok = no
	read only = no
	create mode = 644
	writable = yes
	browseable = no

# -----------------------------------------------------------
# [printers] System Printers
# -----------------------------------------------------------
[printers]
	comment = "Printers"
	path = /var/spool/lpd/samba
	printcap name = /etc/printcap
	printable = yes
	public = no
	writable = no

	lpq command = /usr/bin/lpq -P%p
	lprm command = /usr/bin/lprm -P%p %j
	lppause command = /usr/sbin/lpc stop %p
	lpresume command = /usr/sbin/lpc start %p

	create mode = 0700

	browseable = no
	load printers = yes

# -----------------------------------------------------------
# Specific Descriptions: [programs] [data] [retail]
# -----------------------------------------------------------
[programs]
	comment = "Shared Programs %T"
	volume = "programs"</programlisting>


<para>Shared Programs shows up in the Network Neighborhood, and <literal>programs</literal> is the volume name you specify when an installation program wants to know the label of the CD-ROM from which it thinks it's loading:</para>


<programlisting>path = /u/programs
	public = yes
	writeable = yes
	printable = no
	create mode = 664
[cdrom]
	comment = "Unix CDROM"
	path = /u/cdrom
	public = no
	writeable = no
	printable = no
	volume = "cdrom"

[data]
	comment =  "Data Directories %T"
	path = /u/data
	public = no
	create mode = 770
	writeable = yes
	volume = "data"

[nt4]
	comment =  "NT4 Server"
	path = /u/systems/nt4
	public = yes
	create mode = 770
	writeable = yes
	volume = "nt4_server"

[www]
	comment =  "WWW System"
	path = /usr/www/http
	public = yes
	create mode = 775
	writeable = yes
	volume = "www_system"</programlisting>


<para>The <literal>[www]</literal> share is the directory used on the Unix server to serve web pages. Samba makes the directory available to local PC users so the art department can update web pages.</para>











</appendix>