|
| 1 | +# |
| 2 | +# Sample configuration file for the Samba suite for Debian GNU/Linux. |
| 3 | +# |
| 4 | +# |
| 5 | +# This is the main Samba configuration file. You should read the |
| 6 | +# smb.conf(5) manual page in order to understand the options listed |
| 7 | +# here. Samba has a huge number of configurable options most of which |
| 8 | +# are not shown in this example |
| 9 | +# |
| 10 | +# Some options that are often worth tuning have been included as |
| 11 | +# commented-out examples in this file. |
| 12 | +# - When such options are commented with ";", the proposed setting |
| 13 | +# differs from the default Samba behaviour |
| 14 | +# - When commented with "#", the proposed setting is the default |
| 15 | +# behaviour of Samba but the option is considered important |
| 16 | +# enough to be mentioned here |
| 17 | +# |
| 18 | +# NOTE: Whenever you modify this file you should run the command |
| 19 | +# "testparm" to check that you have not made any basic syntactic |
| 20 | +# errors. |
| 21 | + |
| 22 | +#======================= Global Settings ======================= |
| 23 | + |
| 24 | +[global] |
| 25 | + |
| 26 | +## Browsing/Identification ### |
| 27 | + |
| 28 | +# Change this to the workgroup/NT-domain name your Samba server will part of |
| 29 | + workgroup = WORKGROUP |
| 30 | + |
| 31 | +# server string is the equivalent of the NT Description field |
| 32 | + server string = %h server (Samba, Ubuntu) |
| 33 | + |
| 34 | +# Windows Internet Name Serving Support Section: |
| 35 | +# WINS Support - Tells the NMBD component of Samba to enable its WINS Server |
| 36 | +# wins support = no |
| 37 | + |
| 38 | +# WINS Server - Tells the NMBD components of Samba to be a WINS Client |
| 39 | +# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both |
| 40 | + |
| 41 | +# we comment the next two lines to check that we will consider only the uncommented server |
| 42 | +;wins server = 255.1.255.2 |
| 43 | +#wins server = 255.1.255.3 |
| 44 | + |
| 45 | +wins server = 255.1.255.1 |
| 46 | + |
| 47 | +# we comment the next two lines to check that we will not consider them |
| 48 | +;wins server = 255.1.255.4 |
| 49 | +#wins server = 255.1.255.5 |
| 50 | + |
| 51 | +# This will prevent nmbd to search for NetBIOS names through DNS. |
| 52 | + dns proxy = no |
| 53 | + |
| 54 | +#### Networking #### |
| 55 | + |
| 56 | +# The specific set of interfaces / networks to bind to |
| 57 | +# This can be either the interface name or an IP address/netmask; |
| 58 | +# interface names are normally preferred |
| 59 | +; interfaces = 127.0.0.0/8 eth0 |
| 60 | + |
| 61 | +# Only bind to the named interfaces and/or networks; you must use the |
| 62 | +# 'interfaces' option above to use this. |
| 63 | +# It is recommended that you enable this feature if your Samba machine is |
| 64 | +# not protected by a firewall or is a firewall itself. However, this |
| 65 | +# option cannot handle dynamic or non-broadcast interfaces correctly. |
| 66 | +; bind interfaces only = yes |
| 67 | + |
| 68 | + |
| 69 | + |
| 70 | +#### Debugging/Accounting #### |
| 71 | + |
| 72 | +# This tells Samba to use a separate log file for each machine |
| 73 | +# that connects |
| 74 | + log file = /var/log/samba/log.%m |
| 75 | + |
| 76 | +# Cap the size of the individual log files (in KiB). |
| 77 | + max log size = 1000 |
| 78 | + |
| 79 | +# If you want Samba to only log through syslog then set the following |
| 80 | +# parameter to 'yes'. |
| 81 | +# syslog only = no |
| 82 | + |
| 83 | +# We want Samba to log a minimum amount of information to syslog. Everything |
| 84 | +# should go to /var/log/samba/log.{smbd,nmbd} instead. If you want to log |
| 85 | +# through syslog you should set the following parameter to something higher. |
| 86 | + syslog = 0 |
| 87 | + |
| 88 | +# Do something sensible when Samba crashes: mail the admin a backtrace |
| 89 | + panic action = /usr/share/samba/panic-action %d |
| 90 | + |
| 91 | + |
| 92 | +####### Authentication ####### |
| 93 | + |
| 94 | +# Server role. Defines in which mode Samba will operate. Possible |
| 95 | +# values are "standalone server", "member server", "classic primary |
| 96 | +# domain controller", "classic backup domain controller", "active |
| 97 | +# directory domain controller". |
| 98 | +# |
| 99 | +# Most people will want "standalone sever" or "member server". |
| 100 | +# Running as "active directory domain controller" will require first |
| 101 | +# running "samba-tool domain provision" to wipe databases and create a |
| 102 | +# new domain. |
| 103 | + server role = standalone server |
| 104 | + |
| 105 | +# If you are using encrypted passwords, Samba will need to know what |
| 106 | +# password database type you are using. |
| 107 | + passdb backend = tdbsam |
| 108 | + |
| 109 | + obey pam restrictions = yes |
| 110 | + |
| 111 | +# This boolean parameter controls whether Samba attempts to sync the Unix |
| 112 | +# password with the SMB password when the encrypted SMB password in the |
| 113 | +# passdb is changed. |
| 114 | + unix password sync = yes |
| 115 | + |
| 116 | +# For Unix password sync to work on a Debian GNU/Linux system, the following |
| 117 | +# parameters must be set (thanks to Ian Kahan << [email protected]> for |
| 118 | +# sending the correct chat script for the passwd program in Debian Sarge). |
| 119 | + passwd program = /usr/bin/passwd %u |
| 120 | + passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* . |
| 121 | + |
| 122 | +# This boolean controls whether PAM will be used for password changes |
| 123 | +# when requested by an SMB client instead of the program listed in |
| 124 | +# 'passwd program'. The default is 'no'. |
| 125 | + pam password change = yes |
| 126 | + |
| 127 | +# This option controls how unsuccessful authentication attempts are mapped |
| 128 | +# to anonymous connections |
| 129 | + map to guest = bad user |
| 130 | + |
| 131 | +########## Domains ########### |
| 132 | + |
| 133 | +# |
| 134 | +# The following settings only takes effect if 'server role = primary |
| 135 | +# classic domain controller', 'server role = backup domain controller' |
| 136 | +# or 'domain logons' is set |
| 137 | +# |
| 138 | + |
| 139 | +# It specifies the location of the user's |
| 140 | +# profile directory from the client point of view) The following |
| 141 | +# required a [profiles] share to be setup on the samba server (see |
| 142 | +# below) |
| 143 | +; logon path = \\%N\profiles\%U |
| 144 | +# Another common choice is storing the profile in the user's home directory |
| 145 | +# (this is Samba's default) |
| 146 | +# logon path = \\%N\%U\profile |
| 147 | + |
| 148 | +# The following setting only takes effect if 'domain logons' is set |
| 149 | +# It specifies the location of a user's home directory (from the client |
| 150 | +# point of view) |
| 151 | +; logon drive = H: |
| 152 | +# logon home = \\%N\%U |
| 153 | + |
| 154 | +# The following setting only takes effect if 'domain logons' is set |
| 155 | +# It specifies the script to run during logon. The script must be stored |
| 156 | +# in the [netlogon] share |
| 157 | +# NOTE: Must be store in 'DOS' file format convention |
| 158 | +; logon script = logon.cmd |
| 159 | + |
| 160 | +# This allows Unix users to be created on the domain controller via the SAMR |
| 161 | +# RPC pipe. The example command creates a user account with a disabled Unix |
| 162 | +# password; please adapt to your needs |
| 163 | +; add user script = /usr/sbin/adduser --quiet --disabled-password --gecos "" %u |
| 164 | + |
| 165 | +# This allows machine accounts to be created on the domain controller via the |
| 166 | +# SAMR RPC pipe. |
| 167 | +# The following assumes a "machines" group exists on the system |
| 168 | +; add machine script = /usr/sbin/useradd -g machines -c "%u machine account" -d /var/lib/samba -s /bin/false %u |
| 169 | + |
| 170 | +# This allows Unix groups to be created on the domain controller via the SAMR |
| 171 | +# RPC pipe. |
| 172 | +; add group script = /usr/sbin/addgroup --force-badname %g |
| 173 | + |
| 174 | +############ Misc ############ |
| 175 | + |
| 176 | +# Using the following line enables you to customize your configuration |
| 177 | +# on a per machine basis. The %m gets replaced with the netbios name |
| 178 | +# of the machine that is connecting |
| 179 | +; include = /home/samba/etc/smb.conf.%m |
| 180 | + |
| 181 | +# Some defaults for winbind (make sure you're not using the ranges |
| 182 | +# for something else.) |
| 183 | +; idmap uid = 10000-20000 |
| 184 | +; idmap gid = 10000-20000 |
| 185 | +; template shell = /bin/bash |
| 186 | + |
| 187 | +# Setup usershare options to enable non-root users to share folders |
| 188 | +# with the net usershare command. |
| 189 | + |
| 190 | +# Maximum number of usershare. 0 (default) means that usershare is disabled. |
| 191 | +; usershare max shares = 100 |
| 192 | + |
| 193 | +# Allow users who've been granted usershare privileges to create |
| 194 | +# public shares, not just authenticated ones |
| 195 | + usershare allow guests = yes |
| 196 | + |
| 197 | +#======================= Share Definitions ======================= |
| 198 | + |
| 199 | +# Un-comment the following (and tweak the other settings below to suit) |
| 200 | +# to enable the default home directory shares. This will share each |
| 201 | +# user's home directory as \\server\username |
| 202 | +;[homes] |
| 203 | +; comment = Home Directories |
| 204 | +; browseable = no |
| 205 | + |
| 206 | +# By default, the home directories are exported read-only. Change the |
| 207 | +# next parameter to 'no' if you want to be able to write to them. |
| 208 | +; read only = yes |
| 209 | + |
| 210 | +# File creation mask is set to 0700 for security reasons. If you want to |
| 211 | +# create files with group=rw permissions, set next parameter to 0775. |
| 212 | +; create mask = 0700 |
| 213 | + |
| 214 | +# Directory creation mask is set to 0700 for security reasons. If you want to |
| 215 | +# create dirs. with group=rw permissions, set next parameter to 0775. |
| 216 | +; directory mask = 0700 |
| 217 | + |
| 218 | +# By default, \\server\username shares can be connected to by anyone |
| 219 | +# with access to the samba server. |
| 220 | +# Un-comment the following parameter to make sure that only "username" |
| 221 | +# can connect to \\server\username |
| 222 | +# This might need tweaking when using external authentication schemes |
| 223 | +; valid users = %S |
| 224 | + |
| 225 | +# Un-comment the following and create the netlogon directory for Domain Logons |
| 226 | +# (you need to configure Samba to act as a domain controller too.) |
| 227 | +;[netlogon] |
| 228 | +; comment = Network Logon Service |
| 229 | +; path = /home/samba/netlogon |
| 230 | +; guest ok = yes |
| 231 | +; read only = yes |
| 232 | + |
| 233 | +# Un-comment the following and create the profiles directory to store |
| 234 | +# users profiles (see the "logon path" option above) |
| 235 | +# (you need to configure Samba to act as a domain controller too.) |
| 236 | +# The path below should be writable by all users so that their |
| 237 | +# profile directory may be created the first time they log on |
| 238 | +;[profiles] |
| 239 | +; comment = Users profiles |
| 240 | +; path = /home/samba/profiles |
| 241 | +; guest ok = no |
| 242 | +; browseable = no |
| 243 | +; create mask = 0600 |
| 244 | +; directory mask = 0700 |
| 245 | + |
| 246 | +[printers] |
| 247 | + comment = All Printers |
| 248 | + browseable = no |
| 249 | + path = /var/spool/samba |
| 250 | + printable = yes |
| 251 | + guest ok = no |
| 252 | + read only = yes |
| 253 | + create mask = 0700 |
| 254 | + |
| 255 | +# Windows clients look for this share name as a source of downloadable |
| 256 | +# printer drivers |
| 257 | +[print$] |
| 258 | + comment = Printer Drivers |
| 259 | + path = /var/lib/samba/printers |
| 260 | + browseable = yes |
| 261 | + read only = yes |
| 262 | + guest ok = no |
| 263 | +# Uncomment to allow remote administration of Windows print drivers. |
| 264 | +# You may need to replace 'lpadmin' with the name of the group your |
| 265 | +# admin users are members of. |
| 266 | +# Please note that you also need to set appropriate Unix permissions |
| 267 | +# to the drivers directory for these users to have write rights in it |
| 268 | +; write list = root, @lpadmin |
| 269 | + |
0 commit comments