Appendix B. Samba Configuration Option Quick Reference

Allowable values: command

Default: NULL

Specifies a command that stops the shutdown procedure started by shutdown script. The command will be run with the UID of the connected user. New in Samba 3.0.

Allowable values: positive integer

Default: 1000

Specifies the base value that Samba uses when calculating Windows domain security identifier equivalents to Unix UIDs. See also non unix account range. New in Samba 3.0.

Allowable values: NT, Win95, Wf W

Default: NT

Has Samba announce itself as something other than an NT server. Discouraged because it interferes with serving browse lists.

Allowable values: two numbers separated by a dot character

Default: 4.5

Instructs Samba to announce itself as a different version SMB server. Discouraged.

Allowable values: YES, NO

Default: YES

If YES, honors byte range lock requests with time limits. Samba will queue the requests and retry them until the time period expires.

Allowable values: YES, NO

Default: YES

If YES, serves the browse list to other systems on the network. Avoid changing.

Allowable values: YES, NO

Default: YES

Synonym for browsable.

Allowable values: YES, NO

Default: NO

If YES, uses the exact case the client supplied when trying to resolve a filename. If NO, matches either upper- or lowercase name. Avoid changing. Also called casesignames.

Allowable values: YES, NO

Default: NO

Synonym for case sensitive.

Allowable values: positive number

Default: 60

Sets the number of seconds between checks when a client asks for notification of changes in a directory. Avoid lowering.

Allowable values: string

Default: NULL

Sets the comment corresponding to a share. The comment appears in places such as a net view listing or through the Network Neighborhood. See also the server string configuration option.

Allowable values: octal value from 0 to 0777

Default: 0744

Synonym for create mask.

Allowable values: YES, NO

Default: YES

Timestamps all log messages. Can be turned off when it's not useful (e.g., in debugging ). Also called timestamp logs.

Allowable values: number

Default: 0

Sets the logging level used. Values of 3 or more slow Samba noticeably. Also called log level. Recommended value is 1.

Allowable values: share name

Default: NULL

Specifies the name of a service (share) to provide if someone requests a service he doesn't have permission to use or that doesn't exist. The path is set from the name the client specified, with any underscore ( _ ) characters changed to slash ( / ) characters, allowing access to any directory on the Samba server. Use is discouraged. See also load printers. Also called default service.

Allowable values: LOWER, UPPER

Default: LOWER

Sets the case in which to store new filenames. LOWER indicates lowercase, and UPPER indicates uppercase.

Allowable values: share name

Default: NULL

Synonym for default.

Allowable values: NO, YES

Default: NO

If set to YES, allows delete requests to remove read-only files. This is not allowed in MS-DOS/Windows, but it is normal in Unix, which has separate directory permissions. Used with programs such as RCS.

Allowable values: command

Default: varies

Specifies a command to run on the server to return free disk space. Not needed unless the Samba host system's dfree command does not work properly.

Allowable values: octal value from 0 to 0777

Default: 0755

Synonym for directory mask.

Allowable values: octal value from 0 to 0777

Default: same as directory mode

Controls which permission bits can be changed if a user edits the Unix permissions of directories on the Samba server from a Windows system. Any bit that is set in the mask can be changed by the user; any bit that is clear remains the same on the directory even if the user tries to change it. Requires nt acl support = YES.

Allowable values: YES, NO

Default: NO

If set to YES, Windows NT/2000/XP systems will downgrade to Lanman-style printing. Prevents printer driver uploading and downloading from working. Use with care. See also use client driver.

Allowable values: YES, NO

Default: YES

If set to YES and if wins server = YES, looks up hostnames in DNS when they are not found using WINS.

Allowable values: YES, NO

Default: NO

Causes Samba to serve domain logons. This is one of the basic functions required when Samba is acting as the PDC.

Allowable values: list of directories

Default: NULL

Prohibits a change directory or search in the directories specified. This is a browsing-convenience option; it doesn't provide any extra security.

Allowable values: YES, NO

Default: NO

Allows anyone with write permissions to change permissions on a file, as allowed by MS-DOS.

Allowable values: YES, NO

Default: NO

Sets file times on Unix to match MS-DOS standards (rounding to the next even second). Recommended if using Visual C++ or a PC make program to avoid remaking the programs unnecessarily. Use with the dos filetimes option.

Allowable values: YES, NO

Default: NO

Allows nonowners to change file times if they can write to the files, matching the behavior of MS-DOS and Windows. See also dos filetime resolution.

Allowable values: YES, NO

Default: NO in Samba 2.2, YES in Samba 3.0

If enabled, Samba will use password encryption. Requires an smbpasswd file on the Samba server.

Allowable values: command

Default: NULL

Sets a command to run as the user before connecting to the share. Synonym for preexec. See also the postexec, root preexec, and root postexec options.

Allowable values: YES, NO

Default: NO

If set, returns YES whenever a client asks if it can lock a file and cache it locally but does not enforce the lock on the server. Results in performance improvement for read-only shares. Never use with read/write shares! See also oplocks and veto oplock files.

Allowable values: octal value from 0 to 0777

Default: 0

Takes effect when a user on a Windows client creates a file that resides on the Samba server. This option ensures that bits set in this mask will always be set on the new file. Used with the create mask configuration option.

Allowable values: octal value from 0 to 0777

Default: 0

Takes effect when a user on a Windows client creates a directory on the Samba server. This option ensures that bits set in the mask will be set on every newly created directory. Used with directory mask.

Allowable values: octal value from 0 to 0777

Default: same as force directory mode

Takes effect when a user on a Windows client edits the Unix permissions of a directory on the Samba server. This option ensures that bits set in this mask will be set on the directory. Requires nt acl support = YES.

Allowable values: octal value from 0 to 0777

Default: same as force create mode

Takes effect when a user on a Windows client edits the Unix permissions of a file on the Samba server. This option ensures that bits set in the mask will always be set on the file. Requires nt acl support = YES. See also force directory security mode for directories.

Allowable values: a single username

Default: NULL

Sets the effective username assigned to all users accessing a share. Discouraged.

Allowable values: NTFS, FAT, Samba

Default: NTFS

Sets the filesystem type reported to the client. Avoid changing.

Allowable values: a Unix group name

Default: NULL

Synonym for force group.

Allowable values: a single username

Default: varies

Sets the name of the unprivileged Unix account to use for tasks such as printing and for accessing shares marked with guest ok. The default is specified at compile time and is usually set to nobody.

Allowable values: YES, NO

Default: NO

If set to YES, doesn't need passwords for this share. Used with security = share. Synonym for public.

Allowable values: YES, NO

Default: NO

Forces users of a share to log on as the guest account. Requires guest ok or public to be YES. Also called only guest.

Allowable values: patterns, separated by / characters

Default: NULL

Specifies a list of file or directory names on which to set the MS-DOS hidden attribute. Names can contain ? or * pattern characters and % variables. See also hide dot files and veto files.

Allowable values: YES, NO

Default: NO

If set to YES, hides Unix-specific dummy accounts (root, wheel, floppy, etc.) from clients.

Allowable values: YES, NO

Default: NO

If set to YES, hides all unreadable files.

Allowable values: NIS map name

Default: NONE

Used with nis homedir to locate a user's Unix home directory from Sun NIS (not NIS+).

Allowable values: list of hosts or networks

Default: NULL

Specifies a list of systems that cannot connect to the share. Synonym for deny hosts.

Allowable values: name of file

Default: NULL

Specifies the path to a file of trusted systems from which passwordless logons are allowed. Strongly discouraged because Windows NT/2000/XP users can always override the username—the only security in this scheme.

Allowable values: name of file

Default: NULL

Includes the named file in smb.conf at the line where it appears. This option accepts most variables, but not %u (user), %P (current share's root directory), or %S (current share's name) because they are not set at the time the file is read.

Allowable values: interface list

Default: NULL (all interfaces except 127.0.0.1)

Sets the interfaces to which Samba will respond. The default is the system's primary interface only. Recommended on multihomed systems or to override erroneous addresses and netmasks. Allows interface names such as eth0, DNS names, address/netmask pairs, and broadcast/netmask pairs. See also bind interfaces only.

Allowable values: user list

Default: NULL

Specifies a list of users not permitted access to the share.

Allowable values: number of seconds

Default: 300

Sets the number of seconds between checks for a crashed client. The value of 0 causes no checks to be performed. Setting keepalive = 3600 will turn on checks every hour. A value of 600 (every 10 minutes) is recommended if you want more frequent checks. See also socket options for another approach.

Allowable values: YES, NO

Default: YES

Breaks the oplock when a local Unix process or NFS operation accesses an oplocked file, thus preventing corruption. This works only on operating systems that support kernel-based oplocks, such as Linux 2.4 and Irix. Avoid changing. See also oplocks and level2 oplocks.

Allowable values: YES, NO

Default: YES

If set to YES, allows clients to use the (weak) LANMAN password hash used by Windows 95/98/Me. If set to NO, allows only the better NT1 hash used by Windows NT/2000/XP.

Allowable values: YES, NO

Default: NO in Samba 2.2, YES in Samba 3.0

If set to YES, allows Windows 2000/XP to read and write 64KB at a time to improve performance. Requires Samba to be hosted by a 64-bit OS, such as Linux 2.4, Irix, or Solaris. Somewhat experimental.

Allowable values: YES, NO

Default: YES

Allows files to be cached read-only on the client when multiple clients have opened the file. This allows executables to be cached locally, improving performance.

Allowable values: AUTO, YES, NO

Default: AUTO

Produces OS/2 SMB broadcasts at an interval specified by the lm interval option. YES/NO turns them on/off unconditionally. AUTO causes the Samba server to wait for a LAN manager announcement from another client before sending one out. Required for OS/2 client browsing.

Allowable values: number of seconds

Default: 60

Sets the time period, in seconds, between OS/2 SMB broadcast announcements.

Allowable values: name of directory

Default: /usr/local/samba/var/locks

Synonym for lock directory.

Allowable values: name of directory

Default: /usr/local/samba/var/locks

Sets a directory in which to keep lock files. The directory must be writable by Samba and readable by everyone. Also called lock dir.

Allowable values: positive integer

Default: 2

Sets the number of attempts to attain a byte range lock. See also lock spin time.

Allowable values: number of microseconds

Default: 10

Sets the number of microseconds between attempts to attain a lock. See also lock spin count.

Allowable values: number

Default: 0

Sets the logging level used. Values of 3 or more slow the system noticeably. Recommended value is 1. Synonym for debug level.

Allowable values: MS-DOS drive name

Default: Z:

Sets the drive to be used as a home directory for domain logons by Windows NT/2000/XP clients. See also logon home.

Allowable values: UNC of shared file

Default: NULL

Sets the pathname (relative to the [netlogon] share) of an MS-DOS/NT command to run on the client at logon time. Allows all % variables.

Allowable values: number of seconds

Default: 10

Sets how long to keep print queue status cached, in seconds.

Allowable values: number of seconds

Default: 604800 (1 week)

Sets the period between (NT domain) computer account password changes.

Allowable values: name of file

Default: command.out

Sets the output file for the magic scripts option. Default is the command name, followed by the .out extension.

Allowable values: name of file

Default: NULL

Sets a filename for execution via a shell whenever the file is closed from the client, allowing clients to run commands on the server. The scripts will be deleted on completion, if permissions allow. Use is discouraged.

Allowable values: list of to/from pairs

Default: NULL

Sets up a table of names to remap (e.g., .html to .htm).

Allowable values: YES, NO

Default: YES

Sets Samba to abbreviate to the MS-DOS 8.3 style names that are too long or have unsupported characters.

Allowable values: number

Default: 50

Sets the size of the cache of recently mangled filenames.

Allowable values: character

Default: ~

Sets the unique mangling character used in all mangled names.

Allowable values: hash, hash2

Default: hash

Sets the algorithm used to mangle filenames. The hash2 method is a newer method introduced in Samba 2.2.x, and it creates different filenames than the hash method.

Allowable values: YES, NO

Default: YES

If YES, Samba sets the executable-by-user (0100) bit on Unix files if the MS-DOS archive attribute is set. If used, the create mask must contain the 0100 bit.

Allowable values: YES, NO

Default: NO

If YES, Samba sets the executable-by-other (0001) bit on Unix files if the MS-DOS hidden attribute is set. If used, the create mask option must contain the 0001 bit.

Allowable values: YES, NO

Default: NO

If YES, Samba sets the executable-by-group (0010) bit on Unix files if the MS-DOS system attribute is set. If used, the create mask must contain the 0010 bit.

Allowable values: Never, Bad User, Bad Password

Default: Never

If set to Bad User, allows users without accounts on the Samba system to log in and be assigned the guest account. This option can be used as part of making public shares for anyone to use. If set to Bad Password, users who mistype their passwords will be logged in to the guest account instead of their own. Because no warning is given, the Bad Password value can be extremely confusing: we recommend against it. The default setting of Never prevents users without accounts from logging in.

Allowable values: size in MB

Default: 0 (no limit)

Sets the maximum disk size/free-space size (in megabytes) to return to the client. Some clients or applications can't understand large maximum disk sizes.

Allowable values: number

Default: 50

Sets the number of simultaneous SMB operations that Samba clients can make. Avoid changing.

Allowable values: number

Default: 10000

Limits the number of files a Samba process will try to keep open at one time. Samba allows you to set this to less than the maximum imposed by the Unix host operating system. Avoid changing.

Allowable values: CORE, COREPLUS, LANMAN1, LANMAN2, NT1

Default: NT1

If set, limits the negotiation to the protocol specified, or older. See min protocol. Avoid using.

Allowable values: integer

Default: 0 (no limit)

Limits the number of users who can connect to the server. Used to prevent degraded service under an overload, at the cost of refusing services entirely.

Allowable values: number of seconds

Default: 518400 (6 days)

Limits the TTL, in seconds, of a NetBIOS name in the nmbd WINS cache. Avoid changing. See also min wins ttl.

Allowable values: size in bytes

Default: 65535

Sets the maximum packet size negotiated by Samba. This is a tuning parameter for slow links and bugs in older clients. Values less than 2048 are discouraged.

Allowable values: command

Default: NULL

Sets the command to run on the server when a WinPopup message arrives from a client. If it does not complete quickly, the command must end in & to allow immediate return. Honors all % variables except %u (user) and supports the extra variables %s (filename the message is in), %t (destination system), and %f (from).

Allowable values: integer

Default: 5

Sets the shortest Unix password allowed by Samba when updating a user's password on its system. Also called min passwd length.

Allowable values: space in kilobytes

Default: 0 (unlimited)

Sets the minimum spool space required before accepting a print request.

Allowable values: CORE, COREPLUS, LANMAN1, LANMAN2, NT1

Default: CORE

If set, prevents use of old (less secure) protocols. Using NT1 disables MS-DOS clients. See also lanman auth.

Allowable values: YES, NO

Default: NO

Makes the share a Dfs root. Requires the --with-msdfs configure option. Any symbolic links of the form msdfs:server\share will be seen as Dfs links. See also host msdfs.

Allowable values: lmhosts, wins, host, bcast

Default: lmhosts, host, wins, bcast

Sets the order of lookup when trying to get IP addresses from names. The host parameter carries out a regular name lookup using the server's normal sources: /etc/hosts, DNS, NIS, or a combination of these.

Allowable values: list of NetBIOS names

Default: NULL

Adds additional NetBIOS names by which the Samba server will advertise itself.

Allowable values: local hostname

Default: DNS name of system

Sets the NetBIOS name by which a Samba server is known, or the primary name if NetBIOS aliases exist. See also netbios aliases.

Allowable values: string

Default: NULL

Sets the NetBIOS scope string, an early predecessor of workgroups. Samba will not communicate with a system with a different scope. This option is not recommended.