1<HTML> 2<HEAD> 3<TITLE> 4[Appendix F] Sample Configuration File 5</title> 6<META NAME="DC.title" CONTENT=""> 7<META NAME="DC.creator" CONTENT=""> 8<META NAME="DC.publisher" CONTENT="O'Reilly & Associates, Inc."> 9<META NAME="DC.date" CONTENT="1999-11-08T16:28:53Z"> 10<META NAME="DC.type" CONTENT="Text.Monograph"> 11<META NAME="DC.format" CONTENT="text/html" SCHEME="MIME"> 12<META NAME="DC.source" CONTENT="" SCHEME="ISBN"> 13<META NAME="DC.language" CONTENT="en-US"> 14<META NAME="generator" CONTENT="Jade 1.1/O'Reilly DocBook 3.0 to HTML 4.0"> 15</head> 16 17<BODY BGCOLOR="#FFFFFF" TEXT="#000000" link="#990000" vlink="#0000CC"> 18 19<table BORDER="0" CELLPADDING="0" CELLSPACING="0" width="90%"> 20<tr> 21<td width="25%" valign="TOP"> 22<A HREF="index.html"> 23<img hspace=10 vspace=10 src="gifs/samba.s.gif" 24alt="Using Samba" align=left valign=top border=0> 25</a> 26</td> 27<td height="105" valign="TOP"> 28<br> 29<H2>Using Samba</H2> 30<font size="-1"> 31Robert Eckstein, David Collier-Brown, Peter Kelly 32<br>1st Edition November 1999 33<br>1-56592-449-5, Order Number: 4495 34<br>416 pages, $34.95 35</font> 36<p> <a href="http://www.oreilly.com/catalog/samba/">Buy the hardcopy</a> 37<p><a href="index.html">Table of Contents</a> 38</td> 39</tr> 40</table> 41 42<hr size=1 noshade> 43<!--sample chapter begins --> 44 45<center> 46<DIV CLASS="htmlnav"> 47 48<TABLE WIDTH="515" BORDER="0" CELLSPACING="0" CELLPADDING="0"> 49<TR> 50<TD ALIGN="LEFT" VALIGN="TOP" WIDTH="172"> 51<A CLASS="appendix" HREF="appd_01.html" TITLE="D. Downloading Samba with CVS"> 52<IMG SRC="gifs/txtpreva.gif" ALT="Previous: D. Downloading Samba with CVS" BORDER="0"></a></td><TD ALIGN="CENTER" VALIGN="TOP" WIDTH="171"> 53<B> 54<FONT FACE="ARIEL,HELVETICA,HELV,SANSERIF" SIZE="-1"> 55Appendix F</font></b></td><TD ALIGN="RIGHT" VALIGN="TOP" WIDTH="172"> 56 </td></tr></table> 57 58<hr noshade size=1></center> 59 60</div> 61<blockquote> 62<div class="samplechapter"> 63<H1 CLASS="appendix"> 64<A CLASS="title" NAME="appf-10509"> 65F. Sample Configuration File</a></h1><P CLASS="para">This appendix gives an example of a production <I CLASS="filename"> 66smb.conf</i> file and looks at how many of the options are used in practice. The following is a slightly disguised version of one we used at a corporation with five Linux servers, five Windows for Workgroups clients and three NT Workstation clients:</p><PRE CLASS="programlisting"> 67# smb.conf -- File Server System for: 1 Example.COM BSC & Management Office 68[globals] 69 workgroup = 1EG_BSC 70 interfaces = 10.10.1.14/24 </pre><P CLASS="para"> 71We provide this service on only one of the machine's interfaces. The <CODE CLASS="literal"> 72interfaces</code> option sets its address and netmask, where <CODE CLASS="literal"> 73/24</code> is the same as using the netmask 255.255.255.0:</p><PRE CLASS="programlisting"> 74 comment = Samba ver. %v 75 preexec = csh -c `echo /usr/samba/bin/smbclient \ 76 -M %m -I %I` &</pre><P CLASS="para"> 77We use the <KBD CLASS="command"> 78preexec</kbd> command to log information about all connections by machine name (<CODE CLASS="literal">%m</code>) and IP address (<CODE CLASS="literal">%I)</code>:</p><PRE CLASS="programlisting"> 79 # smbstatus will output various info on current status 80 status = yes 81 browseable = yes 82 printing = bsd 83 84 # the username that will be used for access to services 85 # specified with 'guest = ok' 86 guest account = samba </pre><P CLASS="para"> 87The default guest account was <CODE CLASS="literal"> 88nobody</code>, uid -1, which produced log messages on one of our machines saying "your server is being unfriendly," so we created a specific Samba guest account for browsing and printing:</p><PRE CLASS="programlisting"> 89 # superuser account - admin privilages to shares, with no 90 # restrictions 91 # WARNING - use this with care: files can be modified, 92 # regardless of file permissions 93 admin users = root 94 95 # who is NOT allowed to connect to ANY service 96 invalid users = @wheel, mail, deamon, adt</pre><P CLASS="para"> 97Daemons can't use Samba, only people. The <CODE CLASS="literal"> 98invalid</code> <CODE CLASS="literal"> 99users</code> option closes a security hole; it prevents intruders from breaking in by pretending to be a daemon process.</p><PRE CLASS="programlisting"> 100 # hosts that are ALLOWED or DENIED from connecting to ANY service 101 hosts allow = 10.10.1. 102 hosts deny = 10.10.1.6 103 104 # where the lock files will be located 105 lock directory = /var/lock/samba/locks 106 107 # debug log files 108 # %m = separate log for each NetBIOS name (each machine) 109 log file = /var/log/samba/log.%m 110 111 # We send priority 0, 1 and 2 messages to the system logs 112 syslog = 2 113 114 # If a WinPopup message is sent to the server, 115 # redirect it to a user via e-mail 116 117 message command = /bin/mail -s 'message from #% on %m' \ 118 pkelly < %s; rm %s 119 120# --------------------------------------------------- 121# [globals] Performance Tuning 122# --------------------------------------------------- 123 124 # caching algorithm to reduce time doing getwd() calls. 125 getwd cache = yes 126 127 socket options = TCP_NODELAY 128 129 # tell the server whether the client is present and 130 # responding in seconds 131 keep alive = 60 132 133 # num minutes of inactivity before a connection is 134 # considered dead 135 dead time = 30 136 137 read prediction = yes 138 share modes = yes 139 max xmit = 17384 140 read size = 512</pre><P CLASS="para"> 141The <CODE CLASS="literal"> 142share</code> <CODE CLASS="literal"> 143modes</code>, <CODE CLASS="literal"> 144max</code>, <CODE CLASS="literal"> 145xinit</code>, and <CODE CLASS="literal"> 146read</code> <CODE CLASS="literal"> 147size</code> options are machine-specific (see <a href="appb_01.html"><b>Appendix B, <CITE CLASS="appendix">Samba Performance Tuning</cite></b></a>): </p><PRE CLASS="programlisting"> 148 # locking is done by the server 149 locking = yes 150 151 # control whether dos style attributes should be mapped 152 # to unix execute bits 153 map hidden = yes 154 map archive = yes 155 map system = yes</pre><P CLASS="para"> 156The three <CODE CLASS="literal"> 157map</code> options will work only on shares with a create mode that includes the execute bits (0111). Our <CODE CLASS="literal"> 158homes</code> and <CODE CLASS="literal"> 159printers</code> shares won't honor them, but the [<CODE CLASS="literal">www]</code> share will:</p><PRE CLASS="programlisting"> 160# --------------------------------------------------------- 161# [globals] Security and Domain Logon Services 162# --------------------------------------------------------- 163# connections are made with UID and GID, not as shares 164 security = user 165 166# boolean variable that controls whether passwords 167# will be encrypted 168 encrypt passwords = yes 169 passwd chat = "*New password:*" %n\r "*New password (again):*" %n\r \ "*Password changed*" 170 passwd program = /usr/bin/passwd %u 171 172# Always become the local master browser 173 domain master = yes 174 preferred master = yes 175 os level = 34 176 177# For domain logons to work correctly. Samba acts as a 178# primary domain controller. 179 domain logons = yes 180 181# Logon script to run for user off the server each time 182# username (%U) logs in. Set the time, connect to shares, 183# virus checks, etc. 184 logon script = scripts\%U.bat 185 186[netlogon] 187 comment = "Domain Logon Services" 188 path = /u/netlogon 189 writable = yes 190 create mode = 444 191 guest ok = no 192 volume = "Network"</pre><P CLASS="para"> 193This share, discussed in <a href="ch06_01.html"><b>Chapter 6, <CITE CLASS="chapter">Users, Security, and Domains</cite></b></a>, is required for Samba to work smoothly in a Windows NT domain:</p><PRE CLASS="programlisting"> 194# ----------------------------------------------------------- 195# [homes] User Home Directories 196# ----------------------------------------------------------- 197[homes] 198 comment = "Home Directory for : %u " 199 path = /u/users/%u</pre><P CLASS="para"> 200The password file of the Samba server specifies each person's home directory as <EM CLASS="emphasis"> 201/home/</em><CODE CLASS="replaceable"><I>machine_name</i></code><EM CLASS="emphasis">/</em><CODE CLASS="replaceable"><I>person</i></code>, which NFS converts to point to the actual physicl location under <EM CLASS="emphasis"> 202/u/users</em>. The <CODE CLASS="literal"> 203path</code> option in the <CODE CLASS="literal"> 204[homes]</code> share tells Samba the actual (non-NFS) location:</p><PRE CLASS="programlisting"> 205 guest ok = no 206 read only = no 207 create mode = 644 208 writable = yes 209 browseable = no 210 211# ----------------------------------------------------------- 212# [printers] System Printers 213# ----------------------------------------------------------- 214[printers] 215 comment = "Printers" 216 path = /var/spool/lpd/samba 217 printcap name = /etc/printcap 218 printable = yes 219 public = no 220 writable = no 221 222 lpq command = /usr/bin/lpq -P%p 223 lprm command = /usr/bin/lprm -P%p %j 224 lppause command = /usr/sbin/lpc stop %p 225 lpresume command = /usr/sbin/lpc start %p 226 227 create mode = 0700 228 229 browseable = no 230 load printers = yes 231 232# ----------------------------------------------------------- 233# Specific Descriptions: [programs] [data] [retail] 234# ----------------------------------------------------------- 235[programs] 236 comment = "Shared Programs %T" 237 volume = "programs"</pre><P CLASS="para"> 238Shared Programs shows up in the Network Neighborhood, and <CODE CLASS="literal"> 239programs</code> is the volume name you specify when an installation program wants to know the label of the CD-ROM from which it thinks it's loading:</p><PRE CLASS="programlisting"> 240 path = /u/programs 241 public = yes 242 writeable = yes 243 printable = no 244 create mode = 664 245[cdrom] 246 comment = "Unix CDROM" 247 path = /u/cdrom 248 public = no 249 writeable = no 250 printable = no 251 volume = "cdrom" 252 253[data] 254 comment = "Data Directories %T" 255 path = /u/data 256 public = no 257 create mode = 770 258 writeable = yes 259 volume = "data" 260 261[nt4] 262 comment = "NT4 Server" 263 path = /u/systems/nt4 264 public = yes 265 create mode = 770 266 writeable = yes 267 volume = "nt4_server" 268 269[www] 270 comment = "WWW System" 271 path = /usr/www/http 272 public = yes 273 create mode = 775 274 writeable = yes 275 volume = "www_system"</pre><P CLASS="para"> 276The <CODE CLASS="literal"> 277[www]</code> share is the directory used on the Unix server to serve web pages. Samba makes the directory available to local PC users so the art department can update web pages.</p></div></blockquote> 278<div> 279<center> 280<hr noshade size=1><TABLE WIDTH="515" BORDER="0" CELLSPACING="0" CELLPADDING="0"> 281<TR> 282<TD ALIGN="LEFT" VALIGN="TOP" WIDTH="172"> 283<A CLASS="appendix" HREF="appd_01.html" TITLE="D. Downloading Samba with CVS"> 284<IMG SRC="gifs/txtpreva.gif" ALT="Previous: D. Downloading Samba with CVS" BORDER="0"></a></td><TD ALIGN="CENTER" VALIGN="TOP" WIDTH="171"> 285<A CLASS="book" HREF="index.html" TITLE=""> 286<IMG SRC="gifs/txthome.gif" ALT="" BORDER="0"></a></td><TD ALIGN="RIGHT" VALIGN="TOP" WIDTH="172"> </td></tr><TR> 287<TD ALIGN="LEFT" VALIGN="TOP" WIDTH="172"> 288D. Downloading Samba with CVS</td><TD ALIGN="CENTER" VALIGN="TOP" WIDTH="171"> 289<A CLASS="index" HREF="inx.html" TITLE="Book Index"> 290<IMG SRC="gifs/index.gif" ALT="Book Index" BORDER="0"></a></td><TD ALIGN="RIGHT" VALIGN="TOP" WIDTH="172"> 291 </td></tr></table><hr noshade size=1></center> 292</div> 293 294<!-- End of sample chapter --> 295<CENTER> 296<FONT SIZE="1" FACE="Verdana, Arial, Helvetica"> 297<A HREF="http://www.oreilly.com/"> 298<B>O'Reilly Home</B></A> <B> | </B> 299<A HREF="http://www.oreilly.com/sales/bookstores"> 300<B>O'Reilly Bookstores</B></A> <B> | </B> 301<A HREF="http://www.oreilly.com/order_new/"> 302<B>How to Order</B></A> <B> | </B> 303<A HREF="http://www.oreilly.com/oreilly/contact.html"> 304<B>O'Reilly Contacts<BR></B></A> 305<A HREF="http://www.oreilly.com/international/"> 306<B>International</B></A> <B> | </B> 307<A HREF="http://www.oreilly.com/oreilly/about.html"> 308<B>About O'Reilly</B></A> <B> | </B> 309<A HREF="http://www.oreilly.com/affiliates.html"> 310<B>Affiliated Companies</B></A><p> 311<EM>© 1999, O'Reilly & Associates, Inc.</EM> 312</FONT> 313</CENTER> 314</BODY> 315</html> 316
