Linuxconf:SAMBA Homes Interface Original Author: Andrew Tridgell (Samba Team) Linuxconf ver- sion by: Joshua Lamorie (jlamorie@engsoc.carleton.ca) 11.. OOvveerrvviieeww 22.. DDeeffaauulltt SSeettuupp ffoorr UUsseerrss'' HHoommee 22..11.. CCoommmmeenntt//ddeessccrriippttiioonn This is a text field that is seen next to a share when a client does a net view to list what shares are available. If you want to set the string that is displayed next to the machine name, see the server string command. DDeeffaauulltt:: No comment string EExxaammppllee:: comment = Fred's Files 22..22.. TThhiiss sshhaarree iiss eennaabblleedd This enables the share to be viewable from browse lists automatically. 22..33.. BBrroowwssaabbllee This controls whether this share is seen in the list of available shares in a net view and in the browse list. DDeeffaauulltt:: On 33.. AAcccceessss 33..11.. PPuubblliicc AAcccceessss If this parameter is OOnn for a service, then no password is required to connect to the service. Privileges will be those of the guest account. DDeeffaauulltt:: Off 33..22.. WWrriitteeaabbllee If this parameter is OOffff, then users of a service may not create or modify files in the service's directory. DDeeffaauulltt:: Off 33..33.. AAllllooww hhoossttss This parameter is a comma-delimited set of hosts which are permitted to access a service. If specified in the [global] section then it will apply to all services, regardless of whether the individual service has a different setting. You can specify the hosts by name or IP number. For example, you could restrict access to only the hosts on a Class C subnet with something like "allow hosts = 150.203.5.". The full syntax of the list is described in the man page hosts_access(5). You can also specify hosts by network/netmask pairs and by netgroup names if your system supports netgroups. The EXCEPT keyword can also be used to limit a wildcard list. The following examples may provide some help: EExxaammppllee 11 allow all IPs in 150.203.*.* except one Allow Hosts: 150.203. EXCEPT 150.203.6.66 EExxaammppllee 22 allow hosts that match the given network/netmask Allow Hosts: 150.203.15.0/255.255.255.0 EExxaammppllee 33 allow a couple of hosts Allow Hosts: lapland, arvidsjaur EExxaammppllee 44 allow only hosts in netgroup "foonet" or localhost, but deny access from one particular host Allow Hosts: @foonet, localhost Note that access still requires suitable user-level passwords. See testparm(1) for a way of testing your host access to see if it does what you expect. DDeeffaauulltt:: None (i.e., all hosts permitted access) EExxaammppllee:: 150.203.5. myhost.mynet.edu.au 33..44.. DDeennyy hhoossttss The opposite of Allow Hosts - hosts listed here are nnoott permitted access to services unless the specific services have their own lists to override this one. Where the lists conflict, the Allow osts list takes precedence. DDeeffaauulltt:: None (i.e., no hosts specifically excluded) EExxaammppllee:: 150.203.4. badhost.mynet.edu.au 44.. UUsseerrss 44..11.. UUsseerr lliisstt Multiple users may be specified in a comma-delimited list, in which case the supplied password will be tested against each username in turn (left to right). The User List is needed only when the PC is unable to supply its own username. This is the case for the coreplus protocol or where your users have different WfWg usernames to UNIX usernames. In both these cases you may also be better off using the \\server\share%user syntax instead. The User List is not a great solution in many cases, as it means Samba will try to validate the supplied password against each of the usernames in the User List in turn. This is slow and a bad idea for lots of users in case of duplicate passwords. You may get timeouts or security breaches using this parameter unwisely. Samba relies on the underlying UNIX security. This parameter does not restrict who can login, it just offers hints to the Samba server as to what usernames might correspond to the supplied password. Users can login as whoever they please, and they will be able to do no more damage than if they started a Telnet session. The daemon runs as the user that they log in as, so they cannot do anything that that user cannot do. To restrict a service to a particular set of users you can use the Valid Users field. If any of the usernames begin with a @ then the name will be looked up in the groups file and will expand to a list of all users in the group of that name. Note that searching though a groups file can take quite some time, and some clients may time out during the search. DDeeffaauulltt:: The guest account if a guest service, otherwise the name of the service. EExxaammpplleess:: fred, mary, jack, jane, @users, @pcgroup 44..22.. OOnnllyy uusseerr mmaayy ccoonnnneecctt This is a boolean parameter that controls whether connections with usernames not in the User List will be allowed. By default this option is disabled so a client can supply a username to be used by the server. Note that this also means Samba won't try to deduce usernames from the service name. This can be annoying for the Homes section. To get around this you could use "user = %S" which means your "user" list will be just the service name, which for home directories is the name of the user. DDeeffaauulltt:: Off 44..33.. WWrriittee lliisstt This is a list of users that are given read-write access to a service. If the connecting user is in this list then he will be given write access, no matter what the Writable option is set to. The list can include group names using the @group syntax. Note that if a user is in both the read list and the write list then they will be given write access. DDeeffaauulltt:: None EExxaammppllee:: admin, root, @staff 44..44.. VVaalliidd uusseerrss This is a list of users that should be allowed to login to this service. A name starting with @ is interpreted as a UNIX group. If this is empty (the default) then any user can login. If a username is in both this list and the Invalid users list then access is denied for that user. The current servicename is substituted for %S. This is useful in the [homes] section. See also Invalid users. DDeeffaauulltt:: No valid users list (anyone can login) EExxaammppllee:: greg, @pcusers 44..55.. IInnvvaalliidd uusseerrss This is a list of users that should not be allowed to login to this service. This is really a "paranoid" check to absolutely ensure an improper setting does not breach your security. A name starting with @ is interpreted as a UNIX group. The current servicename is substituted for %S. This is useful in the Homes section. See also Valid users. DDeeffaauulltt:: No invalid users. EExxaammppllee:: root fred admin @wheel 44..66.. MMaaxx.. ccoonnnneeccttiioonnss This option allows the number of simultaneous connections to a service to be limited. If Max connections is greater than 0 then connections will be refused if this number of connections to the service are already open. A value of zero means an unlimited number of connections may be made. Record lock files are used to implement this feature. The lock files will be stored in the directory specified by the "lock directory" option. DDeeffaauulltt:: 0 EExxaammppllee:: 10 44..77.. RReeaadd oonnllyy uusseerr lliisstt This is a list of users that are given read-only access to a service. If the connecting user is in this list then they will not be given write access, no matter what the Writable option is set to. The list can include group names using the @group syntax. See also the Write list option DDeeffaauulltt:: None EExxaammppllee:: mary, @students 55.. SSccrriippttss Some scripts may be executed as share connection/disconnection time. 55..11.. SSeettuupp CCoommmmaanndd ((AAKKAA pprreeeexxeecc)) This option specifies a command to be run whenever the service is connected to. It takes the usual substitutions. An interesting example is to send the users a welcome message every time they log in. Perhaps a message of the day? Here is an example: csh -c 'echo \"Welcome to %S!\" | \ /usr/local/samba/bin/smbclient -M %m -I %I' & Of course, this could get annoying after a while :-) See also Cleanup Command. DDeeffaauulltt:: None (no command executed) EExxaammppllee:: echo \"%u connected to %S from %m (%I)\" >> /tmp/log 55..22.. SSeettuupp CCoommmmaanndd ((rroooott)) This is the same as Setup Command except that the command is run as root. This is useful for mounting filesystems (such as CD-ROMs) before a connection is finalized. 55..33.. CClleeaannuupp CCoommmmaanndd This option specifies a command to be run whenever the service is disconnected. It takes the usual substitutions. The command may be run as root on some systems. An interesting example may be: /sbin/umount /mnt/cdrom See also Setup Command. DDeeffaauulltt:: None (no command executed) EExxaammppllee:: echo \"%u disconnected from %S from %m (%I)\" >> /tmp/log 55..44.. CClleeaannuupp CCoommmmaanndd ((rroooott)) This is the same as postexec except that the command is run as root. This is useful for unmounting filesystems (such as CD-ROMs) after a connection is closed.