1<name_of_this_server>   
  2  
  3  
  4  
  5# server string is the equivalent of the NT Description field   
  6  
  7server string = Samba Server %v   
  8  
  9  
 10  
 11# Message command is run by samba when a "popup" message is sent to it.   
 12  
 13# The example below is for use with LinPopUp:   
 14  
 15; message command = /usr/bin/linpopup "%f" "%m" %s; rm %s   
 16  
 17  
 18  
 19# 2. Printing Options:   
 20  
 21# CHANGES TO ENABLE PRINTING ON ALL CUPS PRINTERS IN THE NETWORK   
 22  
 23# (as cups is now used in linux-mandrake 7.2 by default)   
 24  
 25# if you want to automatically load your printer list rather   
 26  
 27# than setting them up individually then you'll need this   
 28  
 29printcap name = cups   
 30  
 31load printers = yes   
 32  
 33  
 34  
 35# It should not be necessary to spell out the print system type unless   
 36  
 37# yours is non-standard. Currently supported print systems include:   
 38  
 39# bsd, sysv, plp, lprng, aix, hpux, qnx, cups   
 40  
 41printing = cups   
 42  
 43  
 44  
 45# Samba 2.2 supports the Windows NT-style point-and-print feature. To   
 46  
 47# use this, you need to be able to upload print drivers to the samba   
 48  
 49# server. The printer admins (or root) may install drivers onto samba.   
 50  
 51# Note that this feature uses the print$ share, so you will need to   
 52  
 53# enable it below.   
 54  
 55# printer admin = @<group> <user>   
 56  
 57printer admin = @adm   
 58  
 59# This should work well for winbind:   
 60  
 61; printer admin = @"Domain Admins"   
 62  
 63  
 64  
 65# 3. Logging Options:   
 66  
 67# this tells Samba to use a separate log file for each machine   
 68  
 69# that connects   
 70  
 71log file = /var/log/samba/log.%m   
 72  
 73  
 74  
 75# Put a capping on the size of the log files (in Kb).   
 76  
 77max log size = 50   
 78  
 79  
 80  
 81# Set the log (verbosity) level (0 &lt;= log level &lt;= 10)   
 82  
 83; log level = 3   
 84  
 85  
 86  
 87# 4. Security and Domain Membership Options:   
 88  
 89# This option is important for security. It allows you to restrict   
 90  
 91# connections to machines which are on your local network. The   
 92  
 93# following example restricts access to two C class networks and   
 94  
 95# the "loopback" interface. For more examples of the syntax see   
 96  
 97# the smb.conf man page. Do not enable this if (tcp/ip) name resolution does   
 98  
 99# not work for all the hosts in your network.   
100  
101; hosts allow = 192.168.1. 192.168.2. 127.   
102  
103  
104  
105# Uncomment this if you want a guest account, you must add this to /etc/passwd   
106  
107# otherwise the user "nobody" is used   
108  
109; guest account = pcguest   
110  
111# Allow users to map to guest:   
112  
113map to guest = bad user   
114  
115  
116  
117# Security mode. Most people will want user level security. See   
118  
119# security_level.txt for details.   
120  
121security = user   
122  
123# Use password server option only with security = server or security = domain   
124  
125# When using security = domain, you should use password server = *   
126  
127; password server = <nt-server-name>   
128  
129; password server = *   
130  
131  
132  
133# Password Level allows matching of _n_ characters of the password for   
134  
135# all combinations of upper and lower case.   
136  
137; password level = 8   
138  
139; username level = 8   
140  
141  
142  
143# You may wish to use password encryption. Please read   
144  
145# ENCRYPTION.txt, Win95.txt and WinNT.txt in the Samba documentation.   
146  
147# Do not enable this option unless you have read those documents   
148  
149# Encrypted passwords are required for any use of samba in a Windows NT domain   
150  
151# The smbpasswd file is only required by a server doing authentication, thus   
152  
153# members of a domain do not need one.   
154  
155encrypt passwords = yes   
156  
157smb passwd file = /etc/samba/smbpasswd   
158  
159  
160  
161# The following are needed to allow password changing from Windows to   
162  
163# also update the Linux system password.   
164  
165# NOTE: Use these with 'encrypt passwords' and 'smb passwd file' above.   
166  
167# NOTE2: You do NOT need these to allow workstations to change only   
168  
169# the encrypted SMB passwords. They allow the Unix password   
170  
171# to be kept in sync with the SMB password.   
172  
173; unix password sync = Yes   
174  
175# You either need to setup a passwd program and passwd chat, or   
176  
177# enable pam password change   
178  
179; pam password change = yes   
180  
181; passwd program = /usr/bin/passwd %u   
182  
183; passwd chat = *New*UNIX*password* %n\n *Re*ype*new*UNIX*password* %n\n \   
184  
185;*passwd:*all*authentication*tokens*updated*successfully*   
186  
187  
188  
189# Unix users can map to different SMB User names   
190  
191; username map = /etc/samba/smbusers   
192  
193  
194  
195# Using the following line enables you to customise your configuration   
196  
197# on a per machine basis. The %m gets replaced with the netbios name   
198  
199# of the machine that is connecting   
200  
201; include = /etc/samba/smb.conf.%m   
202  
203  
204  
205# Options for using winbind. Winbind allows you to do all account and   
206  
207# authentication from a Windows or samba domain controller, creating   
208  
209# accounts on the fly, and maintaining a mapping of Windows RIDs to unix uid's   
210  
211# and gid's. winbind uid and winbind gid are the only required parameters.   
212  
213#   
214  
215# winbind uid is the range of uid's winbind can use when mapping RIDs to uid's   
216  
217; winbind uid = 10000-20000   
218  
219#   
220  
221# winbind gid is the range of uid's winbind can use when mapping RIDs to gid's   
222  
223; winbind gid = 10000-20000   
224  
225#   
226  
227# winbind separator is the character a user must use between their domain   
228  
229# name and username, defaults to "\"   
230  
231; winbind separator = +   
232  
233#   
234  
235# winbind use default domain allows you to have winbind return usernames   
236  
237# in the form user instead of DOMAIN+user for the domain listed in the   
238  
239# workgroup parameter.   
240  
241; winbind use default domain = yes   
242  
243#   
244  
245# template homedir determines the home directory for winbind users, with   
246  
247# %D expanding to their domain name and %U expanding to their username:   
248  
249; template homedir = /home/%D/%U   
250  
251  
252  
253# When using winbind, you may want to have samba create home directories   
254  
255# on the fly for authenticated users. Ensure that /etc/pam.d/samba is   
256  
257# using 'service=system-auth-winbind' in pam_stack modules, and then   
258  
259# enable obedience of pam restrictions below:   
260  
261; obey pam restrictions = yes   
262  
263  
264  
265#   
266  
267# template shell determines the shell users authenticated by winbind get   
268  
269; template shell = /bin/bash   
270  
271  
272  
273# 5. Browser Control and Networking Options:   
274  
275# Most people will find that this option gives better performance.   
276  
277# See speed.txt and the manual pages for details   
278  
279socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192   
280  
281  
282  
283# Configure Samba to use multiple interfaces   
284  
285# If you have multiple network interfaces then you must list them   
286  
287# here. See the man page for details.   
288  
289; interfaces = 192.168.12.2/24 192.168.13.2/24   
290  
291  
292  
293# Configure remote browse list synchronisation here   
294  
295# request announcement to, or browse list sync from:   
296  
297# a specific host or from / to a whole subnet (see below)   
298  
299; remote browse sync = 192.168.3.25 192.168.5.255   
300  
301# Cause this host to announce itself to local subnets here   
302  
303; remote announce = 192.168.1.255 192.168.2.44   
304  
305  
306  
307# set local master to no if you don't want Samba to become a master   
308  
309# browser on your network. Otherwise the normal election rules apply   
310  
311; local master = no   
312  
313  
314  
315# OS Level determines the precedence of this server in master browser   
316  
317# elections. The default value should be reasonable   
318  
319; os level = 33   
320  
321  
322  
323# Domain Master specifies Samba to be the Domain Master Browser. This   
324  
325# allows Samba to collate browse lists between subnets. Don't use this   
326  
327# if you already have a Windows NT domain controller doing this job   
328  
329; domain master = yes   
330  
331  
332  
333# Preferred Master causes Samba to force a local browser election on startup   
334  
335# and gives it a slightly higher chance of winning the election   
336  
337; preferred master = yes   
338  
339  
340  
341# 6. Domain Control Options:   
342  
343# Enable this if you want Samba to be a domain logon server for   
344  
345# Windows95 workstations or Primary Domain Controller for WinNT and Win2k   
346  
347; domain logons = yes   
348  
349  
350  
351# if you enable domain logons then you may want a per-machine or   
352  
353# per user logon script   
354  
355# run a specific logon batch file per workstation (machine)   
356  
357; logon script = %m.bat   
358  
359# run a specific logon batch file per username   
360  
361; logon script = %U.bat   
362  
363  
364  
365# Where to store roaming profiles for WinNT and Win2k   
366  
367# %L substitutes for this servers netbios name, %U is username   
368  
369# You must uncomment the [Profiles] share below   
370  
371; logon path = \\\%L\Profiles\%U   
372  
373  
374  
375# Where to store roaming profiles for Win9x. Be careful with this as it also   
376  
377# impacts where Win2k finds it's /HOME share   
378  
379; logon home = \\\%L\%U\\.profile   
380  
381  
382  
383  
384  
385# The add user script is used by a domain member to add local user accounts   
386  
387# that have been authenticated by the domain controller, or when adding   
388  
389# users via the Windows NT Tools (ie User Manager for Domains).   
390  
391  
392  
393# Scripts for file (passwd, smbpasswd) backend:   
394  
395; add user script = /usr/sbin/useradd -s /bin/false '%u'   
396  
397; delete user script = /usr/sbin/userdel '%s'   
398  
399; add user to group script = /usr/bin/gpasswd -a '%u' '%g'   
400  
401; delete user from group script = /usr/bin/gpasswd -d '%u' '%g'   
402  
403; set primary group script = /usr/sbin/usermod -g '%g' '%u'   
404  
405; add group script = /usr/sbin/groupadd %g &amp;&amp; getent group '%g'|awk -F: '{print $3}'   
406  
407; delete group script = /usr/sbin/groupdel '%g'   
408  
409  
410  
411# Scripts for LDAP backend (assumes nss_ldap is in use on the domain controller,   
412  
413# and needs configuration in smbldap_conf.pm   
414  
415; add user script = /usr/share/samba/scripts/smbldap-useradd.pl '%u'   
416  
417; delete user script = /usr/share/samba/scripts/smbldap-userdel.pl '%u'   
418  
419; add user to group script = /usr/share/samba/scripts/smbldap-groupmod.pl -m '%u' '%g'   
420  
421; delete user from group script = /usr/share/samba/scripts/smbldap-groupmod.pl -x '%u' '%g'   
422  
423; set primary group script = /usr/share/samba/scripts/smbldap-usermod.pl -g '%g' '%u'   
424  
425; add group script = /usr/share/samba/scripts/smbldap-groupadd.pl '%g' &amp;&amp; /usr/share/samba/scripts/smbldap-groupshow.pl %g|awk '/^gidNumber:/ {print $2}'   
426  
427; delete group script = /usr/share/samba/scripts/smbldap-userdel.pl '%g'   
428  
429  
430  
431  
432  
433# The add machine script is use by a samba server configured as a domain   
434  
435# controller to add local machine accounts when adding machines to the domain.   
436  
437# The script must work from the command line when replacing the macros,   
438  
439# or the operation will fail. Check that groups exist if forcing a group.   
440  
441# Script for domain controller for adding machines:   
442  
443; add machine script = /usr/sbin/useradd -d /dev/null -g machines -c 'Machine Account' -s /bin/false -M %u   
444  
445# Script for domain controller with LDAP backend for adding machines (please   
446  
447# configure in /etc/samba/smbldap_conf.pm first):   
448  
449; add machine script = /usr/share/samba/scripts/smbldap-useradd.pl -w -d /dev/null -g machines -c 'Machine Account' -s /bin/false %u   
450  
451  
452  
453# Domain groups:   
454  
455# Domain groups are now configured by using the 'net groupmap' tool   
456  
457  
458  
459# Samba Password Database configuration:   
460  
461# Samba now has runtime-configurable password database backends. Multiple   
462  
463# passdb backends may be used, but users will only be added to the first one   
464  
465# Default:   
466  
467; passdb backend = smbpasswd guest   
468  
469# TDB backen with fallback to smbpasswd and guest   
470  
471; passdb backend = tdbsam smbpasswd guest   
472  
473# LDAP with fallback to smbpasswd guest   
474  
475# Enable SSL by using an ldaps url, or enable tls with 'ldap ssl' below.   
476  
477; passdb backend = ldapsam:ldaps://ldap.mydomain.com smbpasswd guest   
478  
479# Use the samba2 LDAP schema:   
480  
481; passdb backend = ldapsam_compat:ldaps://ldap.mydomain.com smbpasswd guest   
482  
483  
484  
485# Idmap settings:   
486  
487# Idmap backend to use:   
488  
489; idmap backend = ldap:ldap://ldap.mydomain.com   
490  
491  
492  
493# This is a range of unix user-id's that samba will map non-unix RIDs to,   
494  
495# such as when using Winbind   
496  
497; idmap uid = 10000-20000   
498  
499; idmap gid = 10000-20000   
500  
501  
502  
503# LDAP configuration for Domain Controlling:   
504  
505# The account (dn) that samba uses to access the LDAP server   
506  
507# This account needs to have write access to the LDAP tree   
508  
509# You will need to give samba the password for this dn, by   
510  
511# running 'smbpasswd -w mypassword'   
512  
513; ldap admin dn = cn=root,dc=mydomain,dc=com   
514  
515; ldap ssl = start_tls   
516  
517# start_tls should run on 389, but samba defaults incorrectly to 636   
518  
519; ldap port = 389   
520  
521; ldap suffix = dc=mydomain,dc=com   
522  
523# Seperate suffixes are available for machines, users, groups, and idmap, if   
524  
525# ldap suffix appears first, it is appended to the specific suffix.   
526  
527# Example for a unix-ish directory layout:   
528  
529; ldap machine suffix = ou=Hosts   
530  
531; ldap user suffix = ou=People   
532  
533; ldap group suffix = ou=Group   
534  
535; ldap idmap suffix = ou=Idmap   
536  
537# Example for AD-ish layout:   
538  
539; ldap machine suffix = cn=Computers   
540  
541; ldap user suffix = cn=Users   
542  
543; ldap group suffix = cn=Groups   
544  
545; ldap idmap suffix = cn=Idmap   
546  
547  
548  
549  
550  
551# 7. Name Resolution Options:   
552  
553# All NetBIOS names must be resolved to IP Addresses   
554  
555# 'Name Resolve Order' allows the named resolution mechanism to be specified   
556  
557# the default order is "host lmhosts wins bcast". "host" means use the unix   
558  
559# system gethostbyname() function call that will use either /etc/hosts OR   
560  
561# DNS or NIS depending on the settings of /etc/host.config, /etc/nsswitch.conf   
562  
563# and the /etc/resolv.conf file. "host" therefore is system configuration   
564  
565# dependant. This parameter is most often of use to prevent DNS lookups   
566  
567# in order to resolve NetBIOS names to IP Addresses. Use with care!   
568  
569# The example below excludes use of name resolution for machines that are NOT   
570  
571# on the local network segment   
572  
573# - OR - are not deliberately to be known via lmhosts or via WINS.   
574  
575; name resolve order = wins lmhosts bcast   
576  
577  
578  
579# Windows Internet Name Serving Support Section:   
580  
581# WINS Support - Tells the NMBD component of Samba to enable it's WINS Server   
582  
583; wins support = yes   
584  
585  
586  
587# WINS Server - Tells the NMBD components of Samba to be a WINS Client   
588  
589# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both   
590  
591; wins server = w.x.y.z   
592  
593  
594  
595# WINS Proxy - Tells Samba to answer name resolution queries on   
596  
597# behalf of a non WINS capable client, for this to work there must be   
598  
599# at least one WINS Server on the network. The default is NO.   
600  
601; wins proxy = yes   
602  
603  
604  
605# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names   
606  
607# via DNS nslookups. The built-in default for versions 1.9.17 is yes,   
608  
609# this has been changed in version 1.9.18 to no.   
610  
611dns proxy = no   
612  
613  
614  
615# 8. File Naming Options:   
616  
617# Case Preservation can be handy - system default is _no_   
618  
619# NOTE: These can be set on a per share basis   
620  
621; preserve case = no   
622  
623; short preserve case = no   
624  
625# Default case is normally upper case for all DOS files   
626  
627; default case = lower   
628  
629# Be very careful with case sensitivity - it can break things!   
630  
631; case sensitive = no   
632  
633  
634  
635# Enabling internationalization:   
636  
637# you can match a Windows code page with a UNIX character set.   
638  
639# Windows: 437 (US), 737 (GREEK), 850 (Latin1 - Western European),   
640  
641# 852 (Eastern Eu.), 861 (Icelandic), 932 (Cyrillic - Russian),   
642  
643# 936 (Japanese - Shift-JIS), 936 (Simpl. Chinese), 949 (Korean Hangul),   
644  
645# 950 (Trad. Chin.).   
646  
647# UNIX: ISO8859-1 (Western European), ISO8859-2 (Eastern Eu.),   
648  
649# ISO8859-5 (Russian Cyrillic), KOI8-R (Alt-Russ. Cyril.)   
650  
651# This is an example for french users:   
652  
653; dos charset = 850   
654  
655; unix charset = ISO8859-1   
656  
657  
658  
659  
660  
661#============================ Share Definitions ==============================   
662  
663[homes]   
664  
665comment = Home Directories   
666  
667browseable = no   
668  
669writable = yes   
670  
671# You can enable VFS recycle bin on a per share basis:   
672  
673# Uncomment the next 2 lines (make sure you create a   
674  
675# .recycle folder in the base of the share and ensure   
676  
677# all users will have write access to it. See   
678  
679# examples/VFS/recycle/REAME in samba-doc for details   
680  
681; vfs object = /usr/lib/samba/vfs/recycle.so   
682  
683  
684  
685# Un-comment the following and create the netlogon directory for Domain Logons   
686  
687; [netlogon]   
688  
689; comment = Network Logon Service   
690  
691; path = /var/lib/samba/netlogon   
692  
693; guest ok = yes   
694  
695; writable = no   
696  
697  
698  
699#Uncomment the following 2 lines if you would like your login scripts to   
700  
701#be created dynamically by ntlogon (check that you have it in the correct   
702  
703#location (the default of the ntlogon rpm available in contribs)   
704  
705;root preexec = /usr/bin/ntlogon -u %U -g %G -o %a -d /var/lib/samba/netlogon   
706  
707;root postexec = rm -f /var/lib/samba/netlogon/%U.bat   
708  
709  
710  
711# Un-comment the following to provide a specific roving profile share   
712  
713# the default is to use the user's home directory   
714  
715;[Profiles]   
716  
717; path = /var/lib/samba/profiles   
718  
719; browseable = no   
720  
721; guest ok = yes   
722  
723# This script can be enabled to create profile directories on the fly   
724  
725# You may want to turn off guest acces if you enable this, as it   
726  
727# hasn't been thoroughly tested.   
728  
729;root preexec = PROFILE=/var/lib/samba/profiles/%u; if [ !</nt-server-name></user></group></name_of_this_server>