F. Sample Configuration File

This appendix gives an example of a production smb.conf file and looks at how many of the options are used in practice. The following is a slightly disguised version of one we used at a corporation with five Linux servers, five Windows for Workgroups clients and three NT Workstation clients:


# smb.conf -- File Server System for: 1 Example.COM  BSC & Management Office 

[globals]

	workgroup = 1EG_BSC

	interfaces = 10.10.1.14/24

We provide this service on only one of the machine's interfaces. The interfaces option sets its address and netmask, where /24 is the same as using the netmask 255.255.255.0:


	comment = Samba ver. %v

	preexec = csh -c `echo /usr/samba/bin/smbclient \

                     -M %m -I %I` &

We use the preexec command to log information about all connections by machine name (%m) and IP address (%I):


	# smbstatus will output various info on current status

	status = yes

	browseable = yes

	printing = bsd



	# the username that will be used for access to services

	# specified with 'guest = ok'

	guest account = samba

The default guest account was nobody, uid -1, which produced log messages on one of our machines saying "your server is being unfriendly," so we created a specific Samba guest account for browsing and printing:


	# superuser account - admin privilages to shares, with no

	# restrictions

	# WARNING - use this with care: files can be modified,

	# regardless of file permissions

	admin users = root



	# who is NOT allowed to connect to ANY service

	invalid users = @wheel, mail, deamon, adt

Daemons can't use Samba, only people. The invalid users option closes a security hole; it prevents intruders from breaking in by pretending to be a daemon process.


	# hosts that are ALLOWED or DENIED from connecting to ANY service

	hosts allow = 10.10.1.

	hosts deny = 10.10.1.6

	

	# where the lock files will be located

	lock directory = /var/lock/samba/locks

		

	# debug log files 

	# %m = separate log for each NetBIOS name (each machine)

	log file = /var/log/samba/log.%m



	# We send priority 0, 1 and 2 messages to the system logs

	syslog = 2

		

	# If a WinPopup message is sent to the server,

	# redirect it to a user via e-mail

	

	message command = /bin/mail -s 'message from #% on %m' \

						 pkelly < %s; rm %s



# ---------------------------------------------------

# [globals] Performance Tuning

# ---------------------------------------------------

	

	# caching algorithm to reduce time doing getwd() calls.  

	getwd cache = yes



	socket options = TCP_NODELAY



	# tell the server whether the client is present and

	# responding in seconds

	keep alive = 60



	# num minutes of inactivity before a connection is

	# considered dead

	dead time = 30 



	read prediction = yes

	share modes = yes

	max xmit = 17384 

	read size = 512

The share modes, max, xinit, and read size options are machine-specific (see Appendix B, Samba Performance Tuning):


	# locking is done by the server

	locking = yes



	# control whether dos style attributes should be mapped

	# to unix execute bits

	map hidden = yes

	map archive = yes

	map system = yes

The three map options will work only on shares with a create mode that includes the execute bits (0111). Our homes and printers shares won't honor them, but the [www] share will:


# ---------------------------------------------------------

# [globals] Security and Domain Logon Services

# ---------------------------------------------------------	

# connections are made with UID and GID, not as shares

	security = user



# boolean variable that controls whether passwords

# will be encrypted

	encrypt passwords = yes

	passwd chat = "*New password:*" %n\r "*New password (again):*" %n\r \ "*Password changed*"

	passwd program = /usr/bin/passwd %u

	

# Always become the local master browser

	domain master = yes

	preferred master = yes

	os level = 34

	

# For domain logons to work correctly. Samba acts as a

# primary domain controller.

	domain logons = yes

	

# Logon script to run for user off the server each time

# username (%U) logs in.  Set the time, connect to shares,

# virus checks, etc.

	logon script = scripts\%U.bat



[netlogon]

	comment = "Domain Logon Services"

	path = /u/netlogon

	writable = yes

	create mode = 444

	guest ok = no

	volume = "Network"

This share, discussed in Chapter 6, Users, Security, and Domains, is required for Samba to work smoothly in a Windows NT domain:


# -----------------------------------------------------------

# [homes] User Home Directories

# -----------------------------------------------------------

[homes]

	comment = "Home Directory for : %u "

	path = /u/users/%u

The password file of the Samba server specifies each person's home directory as /home/machine_name/person, which NFS converts to point to the actual physicl location under /u/users. The path option in the [homes] share tells Samba the actual (non-NFS) location:


	guest ok = no

	read only = no

	create mode = 644

	writable = yes

	browseable = no 



# -----------------------------------------------------------

# [printers] System Printers

# -----------------------------------------------------------

[printers]

	comment = "Printers"

	path = /var/spool/lpd/samba

	printcap name = /etc/printcap

	printable = yes

	public = no 

	writable = no



	lpq command = /usr/bin/lpq -P%p

	lprm command = /usr/bin/lprm -P%p %j

	lppause command = /usr/sbin/lpc stop %p

	lpresume command = /usr/sbin/lpc start %p



	create mode = 0700



	browseable = no 

	load printers = yes  



# -----------------------------------------------------------

# Specific Descriptions: [programs] [data] [retail]

# -----------------------------------------------------------

[programs]

	comment = "Shared Programs %T"

	volume = "programs"

Shared Programs shows up in the Network Neighborhood, and programs is the volume name you specify when an installation program wants to know the label of the CD-ROM from which it thinks it's loading:


	path = /u/programs

	public = yes

	writeable = yes

	printable = no

	create mode = 664

[cdrom]

	comment = "Unix CDROM"

	path = /u/cdrom

	public = no 

	writeable = no 

	printable = no

	volume = "cdrom"



[data]

	comment =  "Data Directories %T"

	path = /u/data

	public = no

	create mode = 770

	writeable = yes

	volume = "data"



[nt4]

	comment =  "NT4 Server"

	path = /u/systems/nt4

	public = yes 

	create mode = 770

	writeable = yes

	volume = "nt4_server"



[www]

	comment =  "WWW System"

	path = /usr/www/http

	public = yes 

	create mode = 775

	writeable = yes

	volume = "www_system"

The [www] share is the directory used on the Unix server to serve web pages. Samba makes the directory available to local PC users so the art department can update web pages.


D. Downloading Samba with CVS

Using Samba

F. Sample Configuration File