· 8 years ago · Jan 07, 2018, 02:32 AM
1#
2# Sample configuration file for the Samba suite for Debian GNU/Linux.
3#
4#
5# This is the main Samba configuration file. You should read the
6# smb.conf(5) manual page in order to understand the options listed
7# here. Samba has a huge number of configurable options most of which
8# are not shown in this example
9#
10# Some options that are often worth tuning have been included as
11# commented-out examples in this file.
12# - When such options are commented with ";", the proposed setting
13# differs from the default Samba behaviour
14# - When commented with "#", the proposed setting is the default
15# behaviour of Samba but the option is considered important
16# enough to be mentioned here
17#
18# NOTE: Whenever you modify this file you should run the command
19# "testparm" to check that you have not made any basic syntactic
20# errors.
21# A well-established practice is to name the original file
22# "smb.conf.master" and create the "real" config file with
23# testparm -s smb.conf.master >smb.conf
24# This minimizes the size of the really used smb.conf file
25# which, according to the Samba Team, impacts performance
26# However, use this with caution if your smb.conf file contains nested
27# "include" statements. See Debian bug #483187 for a case
28# where using a master file is not a good idea.
29#
30
31#======================= Global Settings =======================
32
33[global]
34
35## Browsing/Identification ###
36
37# Change this to the workgroup/NT-domain name your Samba server will part of
38 workgroup = WORKGROUP
39
40# server string is the equivalent of the NT Description field
41 server string = %h server (Samba, Ubuntu)
42
43# Windows Internet Name Serving Support Section:
44# WINS Support - Tells the NMBD component of Samba to enable its WINS Server
45 wins support = yes
46
47# WINS Server - Tells the NMBD components of Samba to be a WINS Client
48# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
49; wins server = w.x.y.z
50
51# This will prevent nmbd to search for NetBIOS names through DNS.
52 dns proxy = no
53
54# What naming service and in what order should we use to resolve host names
55# to IP addresses
56 name resolve order = lmhosts host wins bcast
57
58#### Networking ####
59
60# The specific set of interfaces / networks to bind to
61# This can be either the interface name or an IP address/netmask;
62# interface names are normally preferred
63 interfaces = 127.0.0.0/8 eth0
64
65# Only bind to the named interfaces and/or networks; you must use the
66# 'interfaces' option above to use this.
67# It is recommended that you enable this feature if your Samba machine is
68# not protected by a firewall or is a firewall itself. However, this
69# option cannot handle dynamic or non-broadcast interfaces correctly.
70; bind interfaces only = yes
71
72
73
74#### Debugging/Accounting ####
75
76# This tells Samba to use a separate log file for each machine
77# that connects
78 log file = /var/log/samba/log.%m
79
80# Cap the size of the individual log files (in KiB).
81 max log size = 1000
82
83# If you want Samba to only log through syslog then set the following
84# parameter to 'yes'.
85# syslog only = no
86
87# We want Samba to log a minimum amount of information to syslog. Everything
88# should go to /var/log/samba/log.{smbd,nmbd} instead. If you want to log
89# through syslog you should set the following parameter to something higher.
90 syslog = 0
91
92# Do something sensible when Samba crashes: mail the admin a backtrace
93 panic action = /usr/share/samba/panic-action %d
94
95
96####### Authentication #######
97
98# "security = user" is always a good idea. This will require a Unix account
99# in this server for every user accessing the server. See
100# /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/ServerType.html
101# in the samba-doc package for details.
102 security = user
103
104# You may wish to use password encryption. See the section on
105# 'encrypt passwords' in the smb.conf(5) manpage before enabling.
106 encrypt passwords = true
107
108# If you are using encrypted passwords, Samba will need to know what
109# password database type you are using.
110 passdb backend = tdbsam
111
112 obey pam restrictions = yes
113
114# This boolean parameter controls whether Samba attempts to sync the Unix
115# password with the SMB password when the encrypted SMB password in the
116# passdb is changed.
117 unix password sync = yes
118
119# For Unix password sync to work on a Debian GNU/Linux system, the following
120# parameters must be set (thanks to Ian Kahan <<kahan@informatik.tu-muenchen.de> for
121# sending the correct chat script for the passwd program in Debian Sarge).
122 passwd program = /usr/bin/passwd %u
123 passwd chat = *Entersnews*spassword:* %nn *Retypesnews*spassword:* %nn *passwordsupdatedssuccessfully* .
124
125# This boolean controls whether PAM will be used for password changes
126# when requested by an SMB client instead of the program listed in
127# 'passwd program'. The default is 'no'.
128 pam password change = yes
129
130# This option controls how unsuccessful authentication attempts are mapped
131# to anonymous connections
132 map to guest = bad user
133
134########## Domains ###########
135
136# Is this machine able to authenticate users. Both PDC and BDC
137# must have this setting enabled. If you are the BDC you must
138# change the 'domain master' setting to no
139#
140; domain logons = yes
141#
142# The following setting only takes effect if 'domain logons' is set
143# It specifies the location of the user's profile directory
144# from the client point of view)
145# The following required a [profiles] share to be setup on the
146# samba server (see below)
147; logon path = \%Nprofiles%U
148# Another common choice is storing the profile in the user's home directory
149# (this is Samba's default)
150# logon path = \%N%Uprofile
151
152# The following setting only takes effect if 'domain logons' is set
153# It specifies the location of a user's home directory (from the client
154# point of view)
155; logon drive = H:
156# logon home = \%N%U
157
158# The following setting only takes effect if 'domain logons' is set
159# It specifies the script to run during logon. The script must be stored
160# in the [netlogon] share
161# NOTE: Must be store in 'DOS' file format convention
162; logon script = logon.cmd
163
164# This allows Unix users to be created on the domain controller via the SAMR
165# RPC pipe. The example command creates a user account with a disabled Unix
166# password; please adapt to your needs
167; add user script = /usr/sbin/adduser --quiet --disabled-password --gecos "" %u
168
169# This allows machine accounts to be created on the domain controller via the
170# SAMR RPC pipe.
171# The following assumes a "machines" group exists on the system
172; add machine script = /usr/sbin/useradd -g machines -c "%u machine account" -d /var/lib/samba -s /bin/false %u
173
174# This allows Unix groups to be created on the domain controller via the SAMR
175# RPC pipe.
176; add group script = /usr/sbin/addgroup --force-badname %g
177
178########## Printing ##########
179
180# If you want to automatically load your printer list rather
181# than setting them up individually then you'll need this
182# load printers = yes
183
184# lpr(ng) printing. You may wish to override the location of the
185# printcap file
186; printing = bsd
187; printcap name = /etc/printcap
188
189# CUPS printing. See also the cupsaddsmb(8) manpage in the
190# cupsys-client package.
191; printing = cups
192; printcap name = cups
193
194############ Misc ############
195
196# Using the following line enables you to customise your configuration
197# on a per machine basis. The %m gets replaced with the netbios name
198# of the machine that is connecting
199; include = /home/samba/etc/smb.conf.%m
200
201# Most people will find that this option gives better performance.
202# See smb.conf(5) and /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/speed.html
203# for details
204# You may want to add the following on a Linux system:
205# SO_RCVBUF=8192 SO_SNDBUF=8192
206# socket options = TCP_NODELAY
207
208# The following parameter is useful only if you have the linpopup package
209# installed. The samba maintainer and the linpopup maintainer are
210# working to ease installation and configuration of linpopup and samba.
211; message command = /bin/sh -c '/usr/bin/linpopup "%f" "%m" %s; rm %s' &
212
213# Domain Master specifies Samba to be the Domain Master Browser. If this
214# machine will be configured as a BDC (a secondary logon server), you
215# must set this to 'no'; otherwise, the default behavior is recommended.
216# domain master = auto
217
218# Some defaults for winbind (make sure you're not using the ranges
219# for something else.)
220; idmap uid = 10000-20000
221; idmap gid = 10000-20000
222; template shell = /bin/bash
223
224# The following was the default behaviour in sarge,
225# but samba upstream reverted the default because it might induce
226# performance issues in large organizations.
227# See Debian bug #368251 for some of the consequences of *not*
228# having this setting and smb.conf(5) for details.
229; winbind enum groups = yes
230; winbind enum users = yes
231
232# Setup usershare options to enable non-root users to share folders
233# with the net usershare command.
234
235# Maximum number of usershare. 0 (default) means that usershare is disabled.
236; usershare max shares = 100
237
238# Allow users who've been granted usershare privileges to create
239# public shares, not just authenticated ones
240 usershare allow guests = yes
241
242#======================= Share Definitions =======================
243
244# Un-comment the following (and tweak the other settings below to suit)
245# to enable the default home directory shares. This will share each
246# user's home director as \serverusername
247;[homes]
248; comment = Home Directories
249; browseable = no
250
251# By default, the home directories are exported read-only. Change the
252# next parameter to 'no' if you want to be able to write to them.
253; read only = yes
254
255# File creation mask is set to 0700 for security reasons. If you want to
256# create files with group=rw permissions, set next parameter to 0775.
257; create mask = 0700
258
259# Directory creation mask is set to 0700 for security reasons. If you want to
260# create dirs. with group=rw permissions, set next parameter to 0775.
261; directory mask = 0700
262
263# By default, \serverusername shares can be connected to by anyone
264# with access to the samba server. Un-comment the following parameter
265# to make sure that only "username" can connect to \serverusername
266# The following parameter makes sure that only "username" can connect
267#
268# This might need tweaking when using external authentication schemes
269; valid users = %S
270
271# Un-comment the following and create the netlogon directory for Domain Logons
272# (you need to configure Samba to act as a domain controller too.)
273;[netlogon]
274; comment = Network Logon Service
275; path = /home/samba/netlogon
276; guest ok = yes
277; read only = yes
278
279# Un-comment the following and create the profiles directory to store
280# users profiles (see the "logon path" option above)
281# (you need to configure Samba to act as a domain controller too.)
282# The path below should be writable by all users so that their
283# profile directory may be created the first time they log on
284;[profiles]
285; comment = Users profiles
286; path = /home/samba/profiles
287; guest ok = no
288; browseable = no
289; create mask = 0600
290; directory mask = 0700
291
292[printers]
293 comment = All Printers
294 browseable = no
295 path = /var/spool/samba
296 printable = yes
297 guest ok = no
298 read only = yes
299 create mask = 0700
300
301# Windows clients look for this share name as a source of downloadable
302# printer drivers
303[print$]
304 comment = Printer Drivers
305 path = /var/lib/samba/printers
306 browseable = yes
307 read only = yes
308 guest ok = no
309# Uncomment to allow remote administration of Windows print drivers.
310# You may need to replace 'lpadmin' with the name of the group your
311# admin users are members of.
312# Please note that you also need to set appropriate Unix permissions
313# to the drivers directory for these users to have write rights in it
314; write list = root, @lpadmin
315
316# A sample share for sharing your CD-ROM with others.
317;[cdrom]
318; comment = Samba server's CD-ROM
319; read only = yes
320; locking = no
321; path = /cdrom
322; guest ok = yes
323
324# The next two parameters show how to auto-mount a CD-ROM when the
325# cdrom share is accesed. For this to work /etc/fstab must contain
326# an entry like this:
327#
328# /dev/scd0 /cdrom iso9660 defaults,noauto,ro,user 0 0
329#
330# The CD-ROM gets unmounted automatically after the connection to the
331#
332# If you don't want to use auto-mounting/unmounting make sure the CD
333# is mounted on /cdrom
334#
335; preexec = /bin/mount /cdrom
336; postexec = /bin/umount /cdrom
337
338
339[Public Files]
340 comment = Public Files
341 path = /files/public
342 browseable = yes
343 writable = yes
344 read only = no
345 guest ok = yes
346
347[Steve's Files]
348 comment = Steve's Files
349 path = /files/steve
350 browseable = yes
351 writable = yes
352 read only = no
353 guest ok = no
354 valid users = steve
355
356#################################################
357# Sample OpenVPN 2.0 config file for #
358# multi-client server. #
359# #
360# This file is for the server side #
361# of a many-clients <-> one-server #
362# OpenVPN configuration. #
363# #
364# OpenVPN also supports #
365# single-machine <-> single-machine #
366# configurations (See the Examples page #
367# on the web site for more info). #
368# #
369# This config should work on Windows #
370# or Linux/BSD systems. Remember on #
371# Windows to quote pathnames and use #
372# double backslashes, e.g.: #
373# "C:\Program Files\OpenVPN\config\foo.key" #
374# #
375# Comments are preceded with '#' or ';' #
376#################################################
377
378# Which local IP address should OpenVPN
379# listen on? (optional)
380;local a.b.c.d
381
382# Which TCP/UDP port should OpenVPN listen on?
383# If you want to run multiple OpenVPN instances
384# on the same machine, use a different port
385# number for each one. You will need to
386# open up this port on your firewall.
387port 1194
388
389# TCP or UDP server?
390;proto tcp
391proto udp
392
393# "dev tun" will create a routed IP tunnel,
394# "dev tap" will create an ethernet tunnel.
395# Use "dev tap0" if you are ethernet bridging
396# and have precreated a tap0 virtual interface
397# and bridged it with your ethernet interface.
398# If you want to control access policies
399# over the VPN, you must create firewall
400# rules for the the TUN/TAP interface.
401# On non-Windows systems, you can give
402# an explicit unit number, such as tun0.
403# On Windows, use "dev-node" for this.
404# On most systems, the VPN will not function
405# unless you partially or fully disable
406# the firewall for the TUN/TAP interface.
407;dev tap
408dev tun
409
410# Windows needs the TAP-Win32 adapter name
411# from the Network Connections panel if you
412# have more than one. On XP SP2 or higher,
413# you may need to selectively disable the
414# Windows firewall for the TAP adapter.
415# Non-Windows systems usually don't need this.
416;dev-node MyTap
417
418# SSL/TLS root certificate (ca), certificate
419# (cert), and private key (key). Each client
420# and the server must have their own cert and
421# key file. The server and all clients will
422# use the same ca file.
423#
424# See the "easy-rsa" directory for a series
425# of scripts for generating RSA certificates
426# and private keys. Remember to use
427# a unique Common Name for the server
428# and each of the client certificates.
429#
430# Any X509 key management system can be used.
431# OpenVPN can also use a PKCS #12 formatted key file
432# (see "pkcs12" directive in man page).
433ca ca.crt
434cert server.crt
435key server.key # This file should be kept secret
436
437# Diffie hellman parameters.
438# Generate your own with:
439# openssl dhparam -out dh1024.pem 1024
440# Substitute 2048 for 1024 if you are using
441# 2048 bit keys.
442dh dh2048.pem
443
444# Configure server mode and supply a VPN subnet
445# for OpenVPN to draw client addresses from.
446# The server will take 10.8.0.1 for itself,
447# the rest will be made available to clients.
448# Each client will be able to reach the server
449# on 10.8.0.1. Comment this line out if you are
450# ethernet bridging. See the man page for more info.
451server 10.8.0.0 255.255.255.0
452
453# Maintain a record of client <-> virtual IP address
454# associations in this file. If OpenVPN goes down or
455# is restarted, reconnecting clients can be assigned
456# the same virtual IP address from the pool that was
457# previously assigned.
458ifconfig-pool-persist ipp.txt
459
460# Configure server mode for ethernet bridging.
461# You must first use your OS's bridging capability
462# to bridge the TAP interface with the ethernet
463# NIC interface. Then you must manually set the
464# IP/netmask on the bridge interface, here we
465# assume 10.8.0.4/255.255.255.0. Finally we
466# must set aside an IP range in this subnet
467# (start=10.8.0.50 end=10.8.0.100) to allocate
468# to connecting clients. Leave this line commented
469# out unless you are ethernet bridging.
470;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
471
472# Configure server mode for ethernet bridging
473# using a DHCP-proxy, where clients talk
474# to the OpenVPN server-side DHCP server
475# to receive their IP address allocation
476# and DNS server addresses. You must first use
477# your OS's bridging capability to bridge the TAP
478# interface with the ethernet NIC interface.
479# Note: this mode only works on clients (such as
480# Windows), where the client-side TAP adapter is
481# bound to a DHCP client.
482;server-bridge
483
484# Push routes to the client to allow it
485# to reach other private subnets behind
486# the server. Remember that these
487# private subnets will also need
488# to know to route the OpenVPN client
489# address pool (10.8.0.0/255.255.255.0)
490# back to the OpenVPN server.
491;push "route 192.168.10.0 255.255.255.0"
492;push "route 192.168.20.0 255.255.255.0"
493
494# To assign specific IP addresses to specific
495# clients or if a connecting client has a private
496# subnet behind it that should also have VPN access,
497# use the subdirectory "ccd" for client-specific
498# configuration files (see man page for more info).
499
500# EXAMPLE: Suppose the client
501# having the certificate common name "Thelonious"
502# also has a small subnet behind his connecting
503# machine, such as 192.168.40.128/255.255.255.248.
504# First, uncomment out these lines:
505;client-config-dir ccd
506;route 192.168.40.128 255.255.255.248
507# Then create a file ccd/Thelonious with this line:
508# iroute 192.168.40.128 255.255.255.248
509# This will allow Thelonious' private subnet to
510# access the VPN. This example will only work
511# if you are routing, not bridging, i.e. you are
512# using "dev tun" and "server" directives.
513
514# EXAMPLE: Suppose you want to give
515# Thelonious a fixed VPN IP address of 10.9.0.1.
516# First uncomment out these lines:
517;client-config-dir ccd
518;route 10.9.0.0 255.255.255.252
519# Then add this line to ccd/Thelonious:
520# ifconfig-push 10.9.0.1 10.9.0.2
521
522# Suppose that you want to enable different
523# firewall access policies for different groups
524# of clients. There are two methods:
525# (1) Run multiple OpenVPN daemons, one for each
526# group, and firewall the TUN/TAP interface
527# for each group/daemon appropriately.
528# (2) (Advanced) Create a script to dynamically
529# modify the firewall in response to access
530# from different clients. See man
531# page for more info on learn-address script.
532;learn-address ./script
533
534# If enabled, this directive will configure
535# all clients to redirect their default
536# network gateway through the VPN, causing
537# all IP traffic such as web browsing and
538# and DNS lookups to go through the VPN
539# (The OpenVPN server machine may need to NAT
540# or bridge the TUN/TAP interface to the internet
541# in order for this to work properly).
542push "redirect-gateway def1 bypass-dhcp"
543
544# Certain Windows-specific network settings
545# can be pushed to clients, such as DNS
546# or WINS server addresses. CAVEAT:
547# http://openvpn.net/faq.html#dhcpcaveats
548# The addresses below refer to the public
549# DNS servers provided by opendns.com.
550push "dhcp-option DNS 208.67.222.222"
551push "dhcp-option DNS 208.67.220.220"
552
553# Uncomment this directive to allow different
554# clients to be able to "see" each other.
555# By default, clients will only see the server.
556# To force clients to only see the server, you
557# will also need to appropriately firewall the
558# server's TUN/TAP interface.
559;client-to-client
560
561# Uncomment this directive if multiple clients
562# might connect with the same certificate/key
563# files or common names. This is recommended
564# only for testing purposes. For production use,
565# each client should have its own certificate/key
566# pair.
567#
568# IF YOU HAVE NOT GENERATED INDIVIDUAL
569# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,
570# EACH HAVING ITS OWN UNIQUE "COMMON NAME",
571# UNCOMMENT THIS LINE OUT.
572;duplicate-cn
573
574# The keepalive directive causes ping-like
575# messages to be sent back and forth over
576# the link so that each side knows when
577# the other side has gone down.
578# Ping every 10 seconds, assume that remote
579# peer is down if no ping received during
580# a 120 second time period.
581keepalive 10 120
582
583# For extra security beyond that provided
584# by SSL/TLS, create an "HMAC firewall"
585# to help block DoS attacks and UDP port flooding.
586#
587# Generate with:
588# openvpn --genkey --secret ta.key
589#
590# The server and each client must have
591# a copy of this key.
592# The second parameter should be '0'
593# on the server and '1' on the clients.
594;tls-auth ta.key 0 # This file is secret
595
596# Select a cryptographic cipher.
597# This config item must be copied to
598# the client config file as well.
599;cipher BF-CBC # Blowfish (default)
600;cipher AES-128-CBC # AES
601;cipher DES-EDE3-CBC # Triple-DES
602
603# Enable compression on the VPN link.
604# If you enable it here, you must also
605# enable it in the client config file.
606comp-lzo
607
608# The maximum number of concurrently connected
609# clients we want to allow.
610;max-clients 100
611
612# It's a good idea to reduce the OpenVPN
613# daemon's privileges after initialization.
614#
615# You can uncomment this out on
616# non-Windows systems.
617user nobody
618group nogroup
619
620# The persist options will try to avoid
621# accessing certain resources on restart
622# that may no longer be accessible because
623# of the privilege downgrade.
624persist-key
625persist-tun
626
627# Output a short status file showing
628# current connections, truncated
629# and rewritten every minute.
630status openvpn-status.log
631
632# By default, log messages will go to the syslog (or
633# on Windows, if running as a service, they will go to
634# the "Program FilesOpenVPNlog" directory).
635# Use log or log-append to override this default.
636# "log" will truncate the log file on OpenVPN startup,
637# while "log-append" will append to it. Use one
638# or the other (but not both).
639;log openvpn.log
640;log-append openvpn.log
641
642# Set the appropriate level of log
643# file verbosity.
644#
645# 0 is silent, except for fatal errors
646# 4 is reasonable for general usage
647# 5 and 6 can help to debug connection problems
648# 9 is extremely verbose
649verb 3
650
651# Silence repeating messages. At most 20
652# sequential messages of the same message
653# category will be output to the log.
654;mute 20
655
656eth0 Link encap:Ethernet HWaddr c8:60:00:57:49:28
657 inet addr:192.168.0.106 Bcast:192.168.0.255 Mask:255.255.255.0
658 inet6 addr: fe80::ca60:ff:fe57:4928/64 Scope:Link
659 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
660 RX packets:23424 errors:0 dropped:0 overruns:0 frame:0
661 TX packets:12176 errors:0 dropped:0 overruns:0 carrier:0
662 collisions:0 txqueuelen:1000
663 RX bytes:17121761 (17.1 MB) TX bytes:1518283 (1.5 MB)
664
665lo Link encap:Local Loopback
666 inet addr:127.0.0.1 Mask:255.0.0.0
667 inet6 addr: ::1/128 Scope:Host
668 UP LOOPBACK RUNNING MTU:65536 Metric:1
669 RX packets:11 errors:0 dropped:0 overruns:0 frame:0
670 TX packets:11 errors:0 dropped:0 overruns:0 carrier:0
671 collisions:0 txqueuelen:0
672 RX bytes:1520 (1.5 KB) TX bytes:1520 (1.5 KB)
673
674tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
675 inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255
676 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
677 RX packets:312 errors:0 dropped:0 overruns:0 frame:0
678 TX packets:379 errors:0 dropped:0 overruns:0 carrier:0
679 collisions:0 txqueuelen:100
680 RX bytes:43035 (43.0 KB) TX bytes:250742 (250.7 KB)
681
682Kernel IP routing table
683Destination Gateway Genmask Flags Metric Ref Use Iface
6840.0.0.0 192.168.0.1 0.0.0.0 UG 100 0 0 eth0
68510.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
68610.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
687192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
688
689Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.6.3]
690 Sharename Type Comment
691 --------- ---- -------
692 print$ Disk Printer Drivers
693 Public Files Disk Public Files
694 Steve's Files Disk Steve's Files
695 IPC$ IPC IPC Service (heiinhei server (Samba, Ubuntu))
696Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.6.3]
697
698 Server Comment
699 --------- -------
700 HEIINHEI heiinhei server (Samba, Ubuntu)
701
702 Workgroup Master
703 --------- -------
704 WORKGROUP HEIINHEI