1# This is the main Samba configuration file. You should read the 2# smb.conf(5) manual page in order to understand the options listed 3# here. Samba has a huge number of configurable options (perhaps too 4# many!) most of which are not shown in this example 5# 6# Any line which starts with a ; (semi-colon) or a # (hash) 7# is a comment and is ignored. In this example we will use a # 8# for commentry and a ; for parts of the config file that you 9# may wish to enable 10# 11# NOTE: Whenever you modify this file you should run the command #"testparm" # to check that you have not made any basic syntactic #errors. 12# 13#======================= Global Settings ===================================== 14[global] 15 16# 1. Server Naming Options: 17# workgroup = NT-Domain-Name or Workgroup-Name 18 19 workgroup = MDKGROUP 20 21# netbios name is the name you will see in "Network Neighbourhood", 22# but defaults to your hostname 23 24; netbios name = <name_of_this_server> 25 26# server string is the equivalent of the NT Description field 27 28 server string = Samba Server %v 29 30# Message command is run by samba when a "popup" message is sent to it. 31# The example below is for use with LinPopUp: 32; message command = /usr/bin/linpopup "%f" "%m" %s; rm %s 33 34# 2. Printing Options: 35# CHANGES TO ENABLE PRINTING ON ALL CUPS PRINTERS IN THE NETWORK 36# (as cups is now used in linux-mandrake 7.2 by default) 37# if you want to automatically load your printer list rather 38# than setting them up individually then you'll need this 39 40 printcap name = lpstat 41 load printers = yes 42 43# It should not be necessary to spell out the print system type unless 44# yours is non-standard. Currently supported print systems include: 45# bsd, sysv, plp, lprng, aix, hpux, qnx, cups 46 47 printing = cups 48 49# Samba 2.2 supports the Windows NT-style point-and-print feature. To 50# use this, you need to be able to upload print drivers to the samba 51# server. The printer admins (or root) may install drivers onto samba. 52# Note that this feature uses the print$ share, so you will need to 53# enable it below. 54# This parameter works like domain admin group: 55# printer admin = @<group> <user> 56; printer admin = @adm 57# This should work well for winbind: 58; printer admin = @"Domain Admins" 59 60# 3. Logging Options: 61# this tells Samba to use a separate log file for each machine 62# that connects 63 64 log file = /var/log/samba/log.%m 65 66# Put a capping on the size of the log files (in Kb). 67 max log size = 50 68 69# Set the log (verbosity) level (0 <= log level <= 10) 70; log level = 3 71 72# 4. Security and Domain Membership Options: 73# This option is important for security. It allows you to restrict 74# connections to machines which are on your local network. The 75# following example restricts access to two C class networks and 76# the "loopback" interface. For more examples of the syntax see 77# the smb.conf man page. Do not enable this if (tcp/ip) name resolution #does 78# not work for all the hosts in your network. 79; hosts allow = 192.168.1. 192.168.2. 127. 80 81 hosts allow = 127. //note this is only my private IP address 82 83# Uncomment this if you want a guest account, you must add this to 84# /etc/passwd 85# otherwise the user "nobody" is used 86; guest account = pcguest 87 88# Security mode. Most people will want user level security. See 89# security_level.txt for details. 90 91 security = user 92 93# Use password server option only with security = server or security = # domain 94# When using security = domain, you should use password server = * 95; password server = 96; password server = * 97 98# Password Level allows matching of _n_ characters of the password for 99# all combinations of upper and lower case. 100 101 password level = 8 102 103; username level = 8 104 105# You may wish to use password encryption. Please read 106# ENCRYPTION.txt, Win95.txt and WinNT.txt in the Samba documentation. 107# Do not enable this option unless you have read those documents 108# Encrypted passwords are required for any use of samba in a Windows NT #domain 109# The smbpasswd file is only required by a server doing authentication, #thus members of a domain do not need one. 110 111 encrypt passwords = yes 112 smb passwd file = /etc/samba/smbpasswd 113 114# The following are needed to allow password changing from Windows to 115# also update the Linux system password. 116# NOTE: Use these with 'encrypt passwords' and 'smb passwd file' above. 117# NOTE2: You do NOT need these to allow workstations to change only 118# the encrypted SMB passwords. They allow the Unix password 119# to be kept in sync with the SMB password. 120; unix password sync = Yes 121# You either need to setup a passwd program and passwd chat, or 122# enable pam password change 123; pam password change = yes 124; passwd program = /usr/bin/passwd %u 125; passwd chat = *New*UNIX*password* %n\n *ReType*new*UNIX*password* 126# %n\n 127;*passwd:*all*authentication*tokens*updated*successfully* 128 129# Unix users can map to different SMB User names 130; username map = /etc/samba/smbusers 131 132# Using the following line enables you to customize your configuration 133# on a per machine basis. The %m gets replaced with the netbios name 134# of the machine that is connecting 135; include = /etc/samba/smb.conf.%m 136 137# Options for using winbind. Winbind allows you to do all account and 138# authentication from a Windows or samba domain controller, creating 139# accounts on the fly, and maintaining a mapping of Windows RIDs to 140# unix uid's 141# and gid's. winbind uid and winbind gid are the only required 142# parameters. 143# 144# winbind uid is the range of uid's winbind can use when mapping RIDs #to uid's 145; winbind uid = 10000-20000 146# 147# winbind gid is the range of uid's winbind can use when mapping RIDs 148# to gid's 149; winbind gid = 10000-20000 150# 151# winbind separator is the character a user must use between their 152# domain name and username, defaults to "\" 153; winbind separator = + 154# 155# winbind use default domain allows you to have winbind return 156# usernames in the form user instead of DOMAIN+user for the domain 157# listed in the workgroup parameter. 158; winbind use default domain = yes 159# 160# template homedir determines the home directory for winbind users, 161# with %D expanding to their domain name and %U expanding to their 162# username: 163; template homedir = /home/%D/%U 164 165# When using winbind, you may want to have samba create home 166# directories on the fly for authenticated users. Ensure that 167# /etc/pam.d/samba is using 'service=system-auth-winbind' in pam_stack 168# modules, and then enable obedience of pam restrictions below: 169; obey pam restrictions = yes 170 171# 172# template shell determines the shell users authenticated by winbind #get 173; template shell = /bin/bash 174 175# 5. Browser Control and Networking Options: 176# Most people will find that this option gives better performance. 177# See speed.txt and the manual pages for details 178 179 socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 180 181# Configure Samba to use multiple interfaces 182# If you have multiple network interfaces then you must list them 183# here. See the man page for details. 184; interfaces = 192.168.12.2/24 192.168.13.2/24 185 186# Configure remote browse list synchronisation here 187# request announcement to, or browse list sync from: 188# a specific host or from / to a whole subnet (see below) 189; remote browse sync = 192.168.3.25 192.168.5.255 190# Cause this host to announce itself to local subnets here 191; remote announce = 192.168.1.255 192.168.2.44 192 193# set local master to no if you don't want Samba to become a master 194# browser on your network. Otherwise the normal election rules apply 195; local master = no 196 197# OS Level determines the precedence of this server in master browser 198# elections. The default value should be reasonable 199; os level = 33 200 201# Domain Master specifies Samba to be the Domain Master Browser. This 202# allows Samba to collate browse lists between subnets. Don't use this 203# if you already have a Windows NT domain controller doing this job 204; domain master = yes 205 206# Preferred Master causes Samba to force a local browser election on 207# startup and gives it a slightly higher chance of winning the election 208; preferred master = yes 209 210# 6. Domain Control Options: 211# Enable this if you want Samba to be a domain logon server for 212# Windows95 workstations or Primary Domain Controller for WinNT and 213# Win2k 214 215; domain logons = yes 216 217 218# if you enable domain logons then you may want a per-machine or 219# per user logon script 220# run a specific logon batch file per workstation (machine) 221; logon script = %m.bat 222# run a specific logon batch file per username 223; logon script = %U.bat 224 225# Where to store roaming profiles for WinNT and Win2k 226# %L substitutes for this servers netbios name, %U is username 227# You must uncomment the [Profiles] share below 228; logon path = \\%L\Profiles\%U 229 230# Where to store roaming profiles for Win9x. Be careful with this as it 231# also impacts where Win2k finds it's /HOME share 232; logon home = \\%L\%U\.profile 233 234# The add user script is used by a domain member to add local user 235# accounts that have been authenticated by the domain controller, or by 236# the domain controller to add local machine accounts when adding 237# machines to the domain. 238# The script must work from the command line when replacing the macros, 239# or the operation will fail. Check that groups exist if forcing a 240# group. 241# Script for domain controller for adding machines: 242; add user script = /usr/sbin/useradd -d /dev/null -g machines –c 243# 'Machine Account' -s /bin/false -M %u 244# Script for domain controller with LDAP backend for adding machines 245#(please 246# configure in /etc/samba/smbldap_conf.pm first): 247; add user script = /usr/share/samba/scripts/smbldap-useradd.pl -w –d 248# /dev/null -g machines -c 'Machine Account' -s /bin/false %u 249# Script for domain member for adding local accounts for authenticated 250# users: 251; add user script = /usr/sbin/useradd -s /bin/false %u 252 253# Domain groups: 254# domain admin group is a list of unix users or groups who are made 255# members 256# of the Domain Admin group 257; domain admin group = root @wheel 258# 259# domain guest groups is a list of unix users or groups who are made 260# members 261# of the Domain Guests group 262; domain guest group = nobody @guest 263 264# LDAP configuration for Domain Controlling: 265# The account (dn) that samba uses to access the LDAP server 266# This account needs to have write access to the LDAP tree 267# You will need to give samba the password for this dn, by 268# running 'smbpasswd -w mypassword' 269; ldap admin dn = cn=root,dc=mydomain,dc=com 270; ldap ssl = start_tls 271# start_tls should run on 389, but samba defaults incorrectly to 636 272; ldap port = 389 273; ldap suffix = dc=mydomain,dc=com 274; ldap server = ldap.mydomain.com 275 276 277# 7. Name Resolution Options: 278# All NetBIOS names must be resolved to IP Addresses 279# 'Name Resolve Order' allows the named resolution mechanism to be 280# specified the default order is "host lmhosts wins bcast". "host" 281# means use the unix system gethostbyname() function call that will use 282# either /etc/hosts OR DNS or NIS depending on the settings of 283# /etc/host.config, /etc/nsswitch.conf 284# and the /etc/resolv.conf file. "host" therefore is system 285# configuration dependent. This parameter is most often of use to 286# prevent DNS lookups 287# in order to resolve NetBIOS names to IP Addresses. Use with care! 288# The example below excludes use of name resolution for machines that 289# are NOT on the local network segment - OR - are not deliberately to 290# be known via lmhosts or via WINS. 291; name resolve order = wins lmhosts bcast 292 293# Windows Internet Name Serving Support Section: 294# WINS Support - Tells the NMBD component of Samba to enable it's WINS 295# Server 296; wins support = yes 297 298# WINS Server - Tells the NMBD components of Samba to be a WINS Client 299# Note: Samba can be either a WINS Server, or a WINS Client, but 300# NOT both 301; wins server = w.x.y.z 302 303# WINS Proxy - Tells Samba to answer name resolution queries on 304# behalf of a non WINS capable client, for this to work there must be 305# at least one WINS Server on the network. The default is NO. 306; wins proxy = yes 307 308# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS 309# names via DNS nslookups. The built-in default for versions 1.9.17 is 310# yes, this has been changed in version 1.9.18 to no. 311 312 dns proxy = no 313 314# 8. File Naming Options: 315# Case Preservation can be handy - system default is _no_ 316# NOTE: These can be set on a per share basis 317; preserve case = no 318; short preserve case = no 319# Default case is normally upper case for all DOS files 320; default case = lower 321# Be very careful with case sensitivity - it can break things! 322; case sensitive = no 323 324# Enabling internationalization: 325# you can match a Windows code page with a UNIX character set. 326# Windows: 437 (US), 737 (GREEK), 850 (Latin1 - Western European), 327# 852 (Eastern Eu.), 861 (Icelandic), 932 (Cyrillic - Russian), 328# 936 (Japanese - Shift-JIS), 936 (Simpl. Chinese), 949 (Korean 329# Hangul), 330# 950 (Trad. Chin.). 331# UNIX: ISO8859-1 (Western European), ISO8859-2 (Eastern Eu.), 332# ISO8859-5 (Russian Cyrillic), KOI8-R (Alt-Russ. Cyril.) 333# This is an example for french users: 334; client code page = 850 335; character set = ISO8859-1 336 337#============================ Share Definitions ============================== 338 339[homes] 340 comment = Home Directories 341 browseable = no 342 writable = yes 343 344# You can enable VFS recycle bin on a per share basis: 345# Uncomment the next 2 lines (make sure you create a 346# .recycle folder in the base of the share and ensure 347# all users will have write access to it. See 348# examples/VFS/recycle/REAME in samba-doc for details 349; vfs object = /usr/lib/samba/vfs/recycle.so 350; vfs options= /etc/samba/recycle.conf 351 352# Un-comment the following and create the netlogon directory for Domain 353# Logons 354; [netlogon] 355; comment = Network Logon Service 356; path = /var/lib/samba/netlogon 357; guest ok = yes 358; writable = no 359 360#Uncomment the following 2 lines if you would like your login scripts 361# to be created dynamically by ntlogon (check that you have it in the 362# correct location (the default of the ntlogon rpm available in 363# contribs) 364 365;root preexec = /usr/bin/ntlogon -u %U -g %G -o %a -d /var/lib/samba/netlogon 366;root postexec = rm -f /var/lib/samba/netlogon/%U.bat 367 368# Un-comment the following to provide a specific roving profile share 369# the default is to use the user's home directory 370;[Profiles] 371; path = /var/lib/samba/profiles 372; browseable = no 373; guest ok = yes 374 375 376# NOTE: If you have a CUPS print system there is no need to 377# specifically define each individual printer. 378# You must configure the samba printers with the appropriate Windows 379# drivers on your Windows clients. On the Samba server no filtering is 380# done. If you wish that the server provides the driver and the clients 381# send PostScript ("Generic PostScript Printer" under Windows), you 382# have to swap the 'print command' line below with the commented one. 383 384[printers] 385 comment = All Printers 386 path = /var/spool/samba 387 browseable = no 388# to allow user 'guest account' to print. 389 guest ok = yes 390 writable = no 391 printable = yes 392 create mode = 0700 393 394# ===================================== 395# print command: see above for details. 396# ===================================== 397 398 print command = lpr-cups -P %p -o raw %s -r 399# using client side printer drivers. 400; print command = lpr-cups -P %p %s 401# using cups own drivers (use generic PostScript on clients). 402# The following two commands are the samba defaults for printing=cups 403# change them only if you need different options: 404; lpq command = lpq -P %p 405; lprm command = cancel %p-%j 406 407# This share is used for Windows NT-style point-and-print support. 408# To be able to install drivers, you need to be either root, or listed 409# in the printer admin parameter above. Note that you also need write 410# access to the directory and share definition to be able to upload the 411# drivers. 412# For more information on this, please see the Printing Support Section 413# of /usr/share/doc/samba-/docs/Samba-HOWTO-Collection.pdf 414 415[print$] 416 path = /var/lib/samba/printers 417 browseable = yes 418 read only = yes 419 write list = @adm root 420 421# A useful application of samba is to make a PDF-generation service 422# To streamline this, install windows postscript drivers (preferably 423# colour)on the samba server, so that clients can automatically install 424# them. 425 426[pdf-generator] 427 path = /var/tmp 428 guest ok = No 429 printable = Yes 430 comment = PDF Generator (only valid users) 431 #print command = /usr/share/samba/scripts/print-pdf file path win_path recipient IP & 432 print command = /usr/share/samba/scripts/print-pdf %s ~%u \\\\\\\\%L\\\\%u %m %I & 433 434# This one is useful for people to share files 435[tmp] 436 comment = Temporary file space 437 path = /tmp 438 read only = no 439 public = yes 440 echo command = cat %s; rm %s 441 442# A publicly accessible directory, but read only, except for people in 443# the "staff" group 444 445 446 447 448;[public] 449; comment = Public Stuff 450; path = /home/samba/public 451; public = yes 452; writable = no 453; write list = @staff 454# Audited directory through experimental VFS audit.so module: 455# Uncomment next line. 456; vfs object = /usr/lib/samba/vfs/audit.so 457 458# Other examples. 459# 460# A private printer, usable only by Fred. Spool data will be placed in 461# Fred's 462# home directory. Note that fred must have write access to the spool 463# directory, 464# wherever it is. 465;[fredsprn] 466; comment = Fred's Printer 467; valid users = fred 468; path = /homes/fred 469; printer = freds_printer 470; public = no 471; writable = no 472; printable = yes 473 474 475----------------------------------------------------------- 476# A private directory, usable only by Fred. Note that Fred requires 477# write access to the directory. 478 479;[fredsdir] 480 481 [Agustin] 482; comment = Fred's Service 483 comment = Agustin Private Files 484; path = /usr/somewhere/private 485 path = /home/agustin/Documents 486; valid users = fred 487 valid users = agustin 488; public = no 489; writable = yes 490 writable = yes 491; printable = no 492 493 494----------------------------------------------------------- 495 496# a service which has a different directory for each machine that 497# connects this allows you to tailor configurations to incoming 498# machines. You could also use the %u option to tailor it by user name. 499# The %m gets replaced with the machine name that is connecting. 500;[pchome] 501; comment = PC Directories 502; path = /usr/pc/%m 503; public = no 504; writable = yes 505 506 507----------------------------------------------------------- 508# A publicly accessible directory, read/write to all users. Note that 509# all files created in the directory by users will be owned by the 510# default user, so any user with access can delete any other user's 511# files. Obviously this directory must be writable by the default user. 512# Another user could of course be specified, in which case all files 513# would be owned by that user instead. 514 515;[public] 516; path = /usr/somewhere/else/public 517; public = yes 518; only guest = yes 519; writable = yes 520; printable = no 521 522----------------------------------------------------------- 523 524# The following two entries demonstrate how to share a directory so 525# that two users can place files there that will be owned by the 526# specific users. In this setup, the directory should be writable by 527# both users and should have the sticky bit set on it to prevent abuse. 528# Obviously this could be extended to as many users as required. 529 530;[myshare] 531; comment = Mary's and Fred's stuff 532; path = /usr/somewhere/shared 533; valid users = mary fred 534; public = no 535; writable = yes 536; printable = no 537; create mask = 0765 538