Next Previous Contents

2. Default Setup for Users' Home

2.1 Comment/description

This is a text field that is seen next to a share when a client does a net view to list what shares are available.

If you want to set the string that is displayed next to the machine name then see the server string command.

Default: No comment string

Example: comment = Fred's Files

2.2 This share is enabled

This enables the share to be viewable from browse lists automatically.

2.3 Public Access

If this parameter is On for a service, then no password is required to connect to the service. Privileges will be those of the guest account.

Default: Off

2.4 Writeable

If this parameter is Off, then users of a service may not create or modify files in the service's directory.

Default: Off

2.5 Browsable

This controls whether this share is seen in the list of available shares in a net view and in the browse list.

Default: On

2.6 Write List

This is a list of users that are given read-write access to a service. If the connecting user is in this list then they will be given write access, no matter what the Writable option is set to. The list can include group names using the @group syntax.

Note that if a user is in both the read list and the write list then they will be given write access.

Default: None

Example: admin, root, @staff

2.7 Setup Command (AKA preexec)

This option specifies a command to be run whenever the service is connected to. It takes the usual substitutions.

An interesting example is to send the users a welcome mes­ sage every time they log in. Maybe a message of the day? Here is an example:

csh -c 'echo \"Welcome to %S!\" | \ /usr/local/samba/bin/smbclient -M %m -I %I' &

Of course, this could get annoying after a while :-)

See also Cleanup Command.

Default: None (no command executed)

Example: echo \"%u connected to %S from %m (%I)\" >> /tmp/log

2.8 Setup Command (root)

This is the same as Setup Command except that the command is run as root. This is useful for mounting filesystems (such as cdroms) before a connection is finalised.

2.9 Cleanup Command

This option specifies a command to be run whenever the service is disconnected. It takes the usual substitutions. The command may be run as the root on some systems.

An interesting example may be do unmount server resources:

/etc/umount /cdrom

See also Setup Command.

Default: None (no command executed)

Example: echo \"%u disconnected from %S from %m (%I)\" >> /tmp/log

2.10 Cleanup Command (root)

This is the same as postexec except that the command is run as root. This is useful for unmounting filesystems (such as cdroms) after a connection is closed.

2.11 Allow hosts

This parameter is a comma delimited set of hosts which are permitted to access a service.

If specified in the [global] section then it will apply to all services, regardless of whether the individual service has a different setting.

You can specify the hosts by name or IP number. For example, you could restrict access to only the hosts on a Class C subnet with something like "allow hosts = 150.203.5.". The full syntax of the list is described in the man page hosts_access(5).

You can also specify hosts by network/netmask pairs and by netgroup names if your system supports netgroups. The EXCEPT keyword can also be used to limit a wildcard list. The following examples may provide some help:

Example 1: allow all IPs in 150.203.*.* except one

Allow Hosts: 150.203. EXCEPT 150.203.6.66

Example 2: allow hosts that match the given network/net­ mask

Allow Hosts: 150.203.15.0/255.255.255.0

Example 3: allow a couple of hosts

Allow Hosts: lapland, arvidsjaur

Example 4: allow only hosts in netgroup "foonet" or local­ host, but deny access from one particular host

Allow Hosts: @foonet, localhost

Deny Hosts: pirate

Note that access still requires suitable user-level passwords.

See testparm(1) for a way of testing your host access to see if it does what you expect.

Default: None (i.e., all hosts permitted access)

Example: 150.203.5. myhost.mynet.edu.au

2.12 Deny hosts

The opposite of Allow Hosts - hosts listed here are not permitted access to services unless the specific services have their own lists to override this one. Where the lists conflict, the Allow Hosts list takes precedence.

Default: None (i.e., no hosts specifically excluded)

Example: 150.203.4. badhost.mynet.edu.au

2.13 Valid users

This is a list of users that should be allowed to login to this service. A name starting with @ is interpreted as a UNIX group.

If this is empty (the default) then any user can login. If a username is in both this list and the Invalid users list then access is denied for that user.

The current servicename is substituted for %S. This is useful in the [homes] section.

See also Invalid users.

Default: No valid users list. (anyone can login)

Example: greg, @pcusers

2.14 Invalid users

This is a list of users that should not be allowed to login to this service. This is really a "paranoid" check to absolutely ensure an improper setting does not breach your security.

A name starting with @ is interpreted as a UNIX group.

The current servicename is substituted for %S. This is useful in the Homes section.

See also Valid users.

Default: No invalid users.

Example: root fred admin @wheel

2.15 Max. connections

This option allows the number of simultaneous connections to a service to be limited. If Max connections is greater than 0 then connections will be refused if this number of connections to the service are already open. A value of zero mean an unlimited number of connections may be made.

Record lock files are used to implement this feature. The lock files will be stored in the directory specified by the "lock directory" option.

Default: 0

Example: 10

2.16 User list

Multiple users may be specified in a comma-delimited list, in which case the supplied password will be tested against each username in turn (left to right).

The User List is needed only when the PC is unable to supply its own username. This is the case for the coreplus protocol or where your users have different WfWg usernames to UNIX usernames. In both these cases you may also be better using the \\server\share%user syntax instead.

The User List is not a great solution in many cases as it means Samba will try to validate the supplied password against each of the usernames in the User List in turn. This is slow and a bad idea for lots of users in case of duplicate passwords. You may get timeouts or security breaches using this parameter unwisely.

Samba relies on the underlying UNIX security. This parameter does not restrict who can login, it just offers hints to the Samba server as to what usernames might correspond to the supplied password. Users can login as whoever they please and they will be able to do no more damage than if they started a telnet session. The daemon runs as the user that they log in as, so they cannot do anything that user cannot do.

To restrict a service to a particular set of users you can use the Valid Users field.

If any of the usernames begin with a @ then the name will be looked up in the groups file and will expand to a list of all users in the group of that name. Note that search­ ing though a groups file can take quite some time, and some clients may time out during the search.

Default: The guest account if a guest service, else the nameof the service.

Examples: fred, mary, jack, jane, @users, @pcgroup

2.17 Read only user list

This is a list of users that are given read-only access to a service. If the connecting user is in this list then they will not be given write access, no matter what the Writable option is set to. The list can include group names using the @group syntax.

See also the Write list option

Default: None

Example: mary, @students

2.18 Only user may connect

This is a boolean parameter that controls whether connections with usernames not in the User List will be allowed. By default this option is disabled so a client can supply a username to be used by the server.

Note that this also means Samba won't try to deduce user­ names from the service name. This can be annoying for the Homes section. To get around this you could use "user = %S" which means your "user" list will be just the service name, which for home directories is the name of the user.

Default: Off


Next Previous Contents