samba-tool

package: samba-dc-client

title: samba-tool(8)

summary: Main Samba administration tool.

text:
# samba-tool(8)

## NAME
samba-tool - Main Samba administration tool.

## SYNOPSIS
samba-tool [-h] [-W myworkgroup] [-U user] [-d debuglevel] [--v]

## DESCRIPTION
This tool is part of the samba(7) suite.

## OPTIONS
-h|--help

Show this help message and exit

-r|--realm=REALM

Set the realm for the domain. Note that specifying this parameter here will override the realm parameter in the /etc/samba/smb.conf file.

--simple-bind-dn=DN

DN to use for a simple bind.

--password

Specify the password on the commandline. Be cautious about including passwords in scripts or passing user-supplied values onto the command line. For security it is better to let the Samba client tool ask for the password if needed, or obtain the password once with kinit.

If --password is not specified, the tool will check the PASSWD environment variable, followed by PASSWD_FD which is expected to contain an open file descriptor (FD) number.

Finally it will check PASSWD_FILE (containing a file path to be opened). The file should only contain the password. Make certain that the permissions on the file restrict access from unwanted users!

While Samba will attempt to scrub the password from the process title (as seen in ps), this is after startup and so is subject to a race.

-U|--user=[DOMAIN\]USERNAME[%PASSWORD]

Sets the SMB username or username and password. If %PASSWORD is not specified, the user will be prompted. The client will first check the USER environment variable (which is also permitted to also contain the password separated by a %), then the LOGNAME variable (which is not permitted to contain a password) and if either exists, the value is used. If these environmental variables are not found, the username found in a Kerberos Credentials cache may be used.

A third option is to use a credentials file which contains the plaintext of the username and password. This option is mainly provided for scripts where the admin does not wish to pass the credentials on the command line or via environment variables. If this method is used, make certain that the permissions on the file restrict access from unwanted users. See the -A for more details.

Be cautious about including passwords in scripts or passing user-supplied values onto the command line. For security it is better to let the Samba client tool ask for the password if needed, or obtain the password once with kinit.

While Samba will attempt to scrub the password from the process title (as seen in ps), this is after startup and so is subject to a race.

-W|--workgroup=WORKGROUP

Set the SMB domain of the username. This overrides the default domain which is the domain defined in smb.conf. If the domain specified is the same as the servers NetBIOS name, it causes the client to log on using the servers local SAM (as opposed to the Domain SAM). Note that specifying this parameter here will override the workgroup parameter in the /etc/samba/smb.conf file.

-N|--no-pass

If specified, this parameter suppresses the normal password prompt from the client to the user. This is useful when accessing a service that does not require a password. Unless a password is specified on the command line or this parameter is specified, the client will request a password.

If a password is specified on the command line and this option is also defined the password on the command line will be silently ignored and no password will be used.

--use-kerberos=desired|required|off

This parameter determines whether Samba client tools will try to authenticate using Kerberos. For Kerberos authentication you need to use dns names instead of IP addresses when connecting to a service. Note that specifying this parameter here will override the client use kerberos parameter in the /etc/samba/smb.conf file.

--use-krb5-ccache=CCACHE

Specifies the credential cache location for Kerberos authentication. This will set --use-kerberos=required too.

-A|--authentication-file=filename

This option allows you to specify a file from which to read the username and password used in the connection. The format of the file is:

```
				username = <value>
				password = <value>
				domain   = <value>

```

Make certain that the permissions on the file restrict access from unwanted users!

--ipaddress=IPADDRESS

IP address of the server

--color=always|never|auto

Indicate whether samba-tool should use ANSI colour codes in its output. If 'auto' (the default), samba-tool will use colour when its output is directed toward a terminal, unless the NO_COLOR environment variable is set and non-empty. The values 'yes' and 'force' are accepted as synonyms for 'always'; 'no' and 'none' for 'never'; and 'tty' and 'if-tty' for 'auto'.

Note that asking for colour doesn't mean samba-tool will necessarily be very colourful. Many commands are very monochrome, particularly when successful.

-d|--debuglevel=DEBUGLEVEL

level is an integer from 0 to 10. The default value if this parameter is not specified is 1 for client applications. The higher this value, the more detail will be logged to the log files about the activities of the server. At level 0, only critical errors and serious warnings will be logged. Level 1 is a reasonable level for day-to-day running - it generates a small amount of information about operations carried out.

Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

Note that specifying this parameter here will override the log level parameter in the /etc/samba/smb.conf file.

--debug-stdout

This will redirect debug output to STDOUT. By default all clients are logging to STDERR.

## COMMANDS

### computer
Manage computer accounts.

### computer add computername [options]
Add a new computer to the Active Directory Domain.

The new computer name specified on the command is the sAMAccountName, with or without the trailing dollar sign.

--computerou=COMPUTEROU

DN of alternative location (with or without domainDN counterpart) to default CN=Computers in which new computer object will be created. E.g. 'OU=OUname'.

--description=DESCRIPTION

The new computers's description.

--ip-address=IP_ADDRESS_LIST

IPv4 address for the computer's A record, or IPv6 address for AAAA record, can be provided multiple times.

--service-principal-name=SERVICE_PRINCIPAL_NAME_LIST

Computer's Service Principal Name, can be provided multiple times.

--prepare-oldjoin

Prepare enabled machine account for oldjoin mechanism.

### computer create computername [options]
Add a new computer. This is a synonym for the samba-tool computer add command and is available for compatibility reasons only. Please use samba-tool computer add instead.

### computer delete computername [options]
Delete an existing computer account.

The computer name specified on the command is the sAMAccountName, with or without the trailing dollar sign.

### computer edit computername
Edit a computer AD object.

The computer name specified on the command is the sAMAccountName, with or without the trailing dollar sign.

--editor=EDITOR

Specifies the editor to use instead of the system default, or 'vi' if no system default is set.

### computer list
List all computers.

### computer move computername new_parent_dn [options]
This command moves a computer account into the specified organizational unit or container.

The computername specified on the command is the sAMAccountName, with or without the trailing dollar sign.

The name of the organizational unit or container can be specified as a full DN or without the domainDN component.

### computer show computername [options]
Display a computer AD object.

The computer name specified on the command is the sAMAccountName, with or without the trailing dollar sign.

--attributes=USER_ATTRS

Comma separated list of attributes, which will be printed.

### contact
Manage contacts.

### contact add [contactname] [options]
Add a new contact to the Active Directory Domain.

The name of the new contact can be specified by the first argument 'contactname' or the --given-name, --initial and --surname arguments. If no 'contactname' is given, contact's name will be made up of the given arguments by combining the given-name, initials and surname. Each argument is optional. A dot ('.') will be appended to the initials automatically.

--ou=OU

DN of alternative location (with or without domainDN counterpart) in which the new contact will be created. E.g. 'OU=OUname'. Default is the domain base.

--description=DESCRIPTION

The new contacts's description.

--surname=SURNAME

Contact's surname.

--given-name=GIVEN_NAME

Contact's given name.

--initials=INITIALS

Contact's initials.

--display-name=DISPLAY_NAME

Contact's display name.

--job-title=JOB_TITLE

Contact's job title.

--department=DEPARTMENT

Contact's department.

--company=COMPANY

Contact's company.

--mail-address=MAIL_ADDRESS

Contact's email address.

--internet-address=INTERNET_ADDRESS

Contact's home page.

--telephone-number=TELEPHONE_NUMBER

Contact's phone number.

--mobile-number=MOBILE_NUMBER

Contact's mobile phone number.

--physical-delivery-office=PHYSICAL_DELIVERY_OFFICE

Contact's office location.

### contact create [contactname] [options]
Add a new contact. This is a synonym for the samba-tool contact add command and is available for compatibility reasons only. Please use samba-tool contact add instead.

### contact delete contactname [options]
Delete an existing contact.

The contactname specified on the command is the common name or the distinguished name of the contact object. The distinguished name of the contact can be specified with or without the domainDN component.

### contact edit contactname
Modify a contact AD object.

The contactname specified on the command is the common name or the distinguished name of the contact object. The distinguished name of the contact can be specified with or without the domainDN component.

--editor=EDITOR

Specifies the editor to use instead of the system default, or 'vi' if no system default is set.

### contact list [options]
List all contacts.

--full-dn

Display contact's full DN instead of the name.

### contact move contactname new_parent_dn [options]
This command moves a contact into the specified organizational unit or container.

The contactname specified on the command is the common name or the distinguished name of the contact object. The distinguished name of the contact can be specified with or without the domainDN component.

### contact show contactname [options]
Display a contact AD object.

The contactname specified on the command is the common name or the distinguished name of the contact object. The distinguished name of the contact can be specified with or without the domainDN component.

--attributes=CONTACT_ATTRS

Comma separated list of attributes, which will be printed.

### contact rename contactname [options]
Rename a contact and related attributes.

This command allows to set the contact's name related attributes. The contact's CN will be renamed automatically. The contact's new CN will be made up by combining the given-name, initials and surname. A dot ('.') will be appended to the initials automatically, if required. Use the --force-new-cn option to specify the new CN manually and --reset-cn to reset this change.

Use an empty attribute value to remove the specified attribute.

The contact name specified on the command is the CN.

--surname=SURNAME

New surname.

--given-name=GIVEN_NAME

New given name.

--initials=INITIALS

New initials.

--force-new-cn=NEW_CN

Specify a new CN (RDN) instead of using a combination of the given name, initials and surname.

--reset-cn

Set the CN to the default combination of given name, initials and surname.

--display-name=DISPLAY_NAME

New display name.

--mail-address=MAIL_ADDRESS

New email address.

### dbcheck
Check the local AD database for errors.

### delegation
Manage Delegations.

### delegation add-service accountname principal [options]
Add a service principal as msDS-AllowedToDelegateTo.

### delegation del-service accountname principal [options]
Delete a service principal as msDS-AllowedToDelegateTo.

### delegation for-any-protocol accountname [(on|off)] [options]
Set/unset UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION (S4U2Proxy) for an account.

### delegation for-any-service accountname [(on|off)] [options]
Set/unset UF_TRUSTED_FOR_DELEGATION for an account.

### delegation show accountname [options]
Show the delegation setting of an account.

### dns
Manage Domain Name Service (DNS).

### dns add server zone name A|AAAA|PTR|CNAME|NS|MX|SRV|TXT data
Add a DNS record.

### dns delete server zone name A|AAAA|PTR|CNAME|NS|MX|SRV|TXT data
Delete a DNS record.

### dns query server zone name A|AAAA|PTR|CNAME|NS|MX|SRV|TXT|ALL [options] data
Query a name.

### dns roothints server [name] [options]
Query root hints.

### dns serverinfo server [options]
Query server information.

### dns update server zone name A|AAAA|PTR|CNAME|NS|MX|SRV|TXT olddata newdata
Update a DNS record.

### dns zonecreate server zone [options]
Create a zone.

### dns zonedelete server zone [options]
Delete a zone.

### dns zoneinfo server zone [options]
Query zone information.

### dns zonelist server [options]
List zones.

### domain
Manage Domain.

### domain backup
Create or restore a backup of the domain.

### domain backup offline
Backup (with proper locking) local domain directories into a tar file.

### domain backup online
Copy a running DC's current DB into a backup tar file.

### domain backup rename
Copy a running DC's DB to backup file, renaming the domain in the process.

### domain backup restore
Restore the domain's DB from a backup-file.

### domain auth policy list
List authentication policies on the domain.

-H, --URL

LDB URL for database or target server.

--json

View authentication policies as JSON instead of a list.

### domain auth policy view
View an authentication policy on the domain.

-H, --URL

LDB URL for database or target server.

--name

Name of the authentication policy to view (required).

### domain auth policy create
Create authentication policies on the domain.

-H, --URL

LDB URL for database or target server.

--name

Name of the authentication policy (required).

--description

Optional description for the authentication policy.

--protect

Protect authentication policy from accidental deletion. Cannot be used together with --unprotect.

--unprotect

Unprotect authentication policy from accidental deletion. Cannot be used together with --protect.

--audit

Only audit authentication policy. Cannot be used together with --enforce.

--enforce

Enforce authentication policy. Cannot be used together with --audit.

--strong-ntlm-policy

Strong NTLM Policy (Disabled, Optional, Required).

--user-tgt-lifetime

Ticket-Granting-Ticket lifetime for user accounts.

--user-allow-ntlm-auth

Allow NTLM network authentication when user is restricted to selected devices.

--service-tgt-lifetime

Ticket-Granting-Ticket lifetime for service accounts.

--service-allow-ntlm-auth

Allow NTLM network authentication when service is restricted to selected devices.

--computer-tgt-lifetime

Ticket-Granting-Ticket lifetime for computer accounts.

### domain auth policy modify
Modify authentication policies on the domain.

-H, --URL

LDB URL for database or target server.

--name

Name of the authentication policy (required).

--description

Optional description for the authentication policy.

--protect

Protect authentication policy from accidental deletion. Cannot be used together with --unprotect.

--unprotect

Unprotect authentication policy from accidental deletion. Cannot be used together with --protect.

--audit

Only audit authentication policy. Cannot be used together with --enforce.

--enforce

Enforce authentication policy. Cannot be used together with --audit.

--strong-ntlm-policy

Strong NTLM Policy (Disabled, Optional, Required).

--user-tgt-lifetime

Ticket-Granting-Ticket lifetime for user accounts.

--user-allow-ntlm-auth

Allow NTLM network authentication when user is restricted to selected devices.

--service-tgt-lifetime

Ticket-Granting-Ticket lifetime for service accounts.

--service-allow-ntlm-auth

Allow NTLM network authentication when service is restricted to selected devices.

--computer-tgt-lifetime

Ticket-Granting-Ticket lifetime for computer accounts.

### domain auth policy delete
Delete authentication policies on the domain.

-H, --URL

LDB URL for database or target server.

--name

Name of authentication policy to delete (required).

--force

Force authentication policy delete even if it is protected.

### domain auth silo list
List authentication silos on the domain.

-H, --URL

LDB URL for database or target server.

--json

View authentication silos as JSON instead of a list.

### domain auth silo view
View an authentication silo on the domain.

-H, --URL

LDB URL for database or target server.

--name

Name of the authentication silo to view (required).

### domain auth silo create
Create authentication silos on the domain.

-H, --URL

LDB URL for database or target server.

--name

Name of the authentication silo (required).

--description

Optional description for the authentication silo.

--policy

Use single policy for all principals in this silo.

--user-policy

User account policy.

--service-policy

Managed Service Account policy.

--computer-policy

Computer Account policy.

--protect

Protect authentication silo from accidental deletion. Cannot be used together with --unprotect.

--unprotect

Unprotect authentication silo from accidental deletion. Cannot be used together with --protect.

--audit

Only audit silo policies. Cannot be used together with --enforce.

--enforce

Enforce silo policies. Cannot be used together with --audit.

### domain auth silo modify
Modify authentication silos on the domain.

-H, --URL

LDB URL for database or target server.

--name

Name of the authentication silo (required).

--description

Optional description for the authentication silo.

--policy

Use single policy for all principals in this silo.

--user-policy

User account policy.

--service-policy

Managed Service Account policy.

--computer-policy

Computer Account policy.

--protect

Protect authentication silo from accidental deletion. Cannot be used together with --unprotect.

--unprotect

Unprotect authentication silo from accidental deletion. Cannot be used together with --protect.

--audit

Only audit silo policies. Cannot be used together with --enforce.

--enforce

Enforce silo policies. Cannot be used together with --audit.

### domain auth silo delete
Delete authentication silos on the domain.

-H, --URL

LDB URL for database or target server.

--name

Name of authentication silo to delete (required).

--force

Force authentication silo delete even if it is protected.

### domain auth silo member add
Add a member to an authentication silo.

-H, --URL

LDB URL for database or target server.

--name

Name of authentication silo (required).

--member

Member to add to the silo (DN or account name).

### domain auth silo member list
List members in an authentication silo.

-H, --URL

LDB URL for database or target server.

--name

Name of authentication silo (required).

--json

View members as JSON instead of a list.

### domain auth silo member remove
Remove a member from an authentication silo.

-H, --URL

LDB URL for database or target server.

--name

Name of authentication silo (required).

--member

Member to remove from the silo (DN or account name).

### domain claim claim-type list
List claim types on the domain.

-H, --URL

LDB URL for database or target server.

--json

View claim types as JSON instead of a list.

### domain claim claim-type view
View a single claim type on the domain.

-H, --URL

LDB URL for database or target server.

--name

Display name of claim type to view (required).

### domain claim claim-type create
Create claim types on the domain.

-H, --URL

LDB URL for database or target server.

--attribute

Attribute of claim type to create (required).

--class

Object classes to set claim type to. Example: --class=user --class=computer

--name

Optional display name or use attribute name.

--description

Optional description or use from attribute.

--enable

Enable claim type. Cannot be used together with --disable.

--disable

Disable claim type. Cannot be used together with --enable.

--protect

Protect claim type from accidental deletion. Cannot be used together with --unprotect.

--unprotect

Unprotect claim type from accidental deletion. Cannot be used together with --protect.

### domain claim claim-type modify
Modify claim types on the domain.

-H, --URL

LDB URL for database or target server.

--name

Display name of claim type to modify (required).

--class

Object classes to set claim type to. Example: --class=user --class=computer

--description

Set the claim type description.

--enable

Enable claim type. Cannot be used together with --disable.

--disable

Disable claim type. Cannot be used together with --enable.

--protect

Protect claim type from accidental deletion. Cannot be used together with --unprotect.

--unprotect

Unprotect claim type from accidental deletion. Cannot be used together with --protect.

### domain claim claim-type delete
Delete claim types on the domain.

-H, --URL

LDB URL for database or target server.

--name

Display name of claim type to delete (required).

--force

Force claim type delete even if it is protected.

### domain claim value-type list
List claim value types on the domain.

-H, --URL

LDB URL for database or target server.

--json

View claim value types as JSON instead of a list.

### domain claim value-type view
View a single claim value type on the domain.

-H, --URL

LDB URL for database or target server.

--name

Display name of claim value type to view (required).

### domain classicupgrade [options] classic_smb_conf
Upgrade from Samba classic (NT4-like) database to Samba AD DC database.

### domain dcpromo dnsdomain [DC|RODC] [options]
Promote an existing domain member or NT4 PDC to an AD DC.

### domain demote
Demote ourselves from the role of domain controller.

### domain exportkeytab keytab [options]
Dumps Kerberos keys of the domain into a keytab.

### domain info ip_address [options]
Print basic info about a domain and the specified DC.

### domain join dnsdomain [DC|RODC|MEMBER|SUBDOMAIN] [options]
Join a domain as either member or backup domain controller.

### domain level show|raise options [options]
Show/raise domain and forest function levels.

### domain passwordsettings show|set options [options]
Show/set password settings.

### domain passwordsettings pso
Manage fine-grained Password Settings Objects (PSOs).

### domain passwordsettings pso apply pso-name user-or-group-name [options]
Applies a PSO's password policy to a user or group.

### domain passwordsettings pso create pso-name precedence [options]
Creates a new Password Settings Object (PSO).

### domain passwordsettings pso delete pso-name [options]
Deletes a Password Settings Object (PSO).

### domain passwordsettings pso list [options]
Lists all Password Settings Objects (PSOs).

### domain passwordsettings pso set pso-name [options]
Modifies a Password Settings Object (PSO).

### domain passwordsettings pso show user-name [options]
Displays a Password Settings Object (PSO).

### domain passwordsettings pso show-user pso-name [options]
Displays the Password Settings that apply to a user.

### domain passwordsettings pso unapply pso-name user-or-group-name [options]
Updates a PSO to no longer apply to a user or group.

### domain provision
Promote an existing domain member or NT4 PDC to an AD DC.

### domain trust
Domain and forest trust management.

### domain trust create DOMAIN options [options]
Create a domain or forest trust.

### domain trust modify DOMAIN options [options]
Modify a domain or forest trust.

### domain trust delete DOMAIN options [options]
Delete a domain trust.

### domain trust list options [options]
List domain trusts.

### domain trust namespaces [DOMAIN] options [options]
Manage forest trust namespaces.

### domain trust show DOMAIN options [options]
Show trusted domain details.

### domain trust validate DOMAIN options [options]
Validate a domain trust.

### drs
Manage Directory Replication Services (DRS).

### drs bind
Show DRS capabilities of a server.

### drs kcc
Trigger knowledge consistency center run.

### drs options
Query or change options for NTDS Settings object of a domain controller.

### drs replicate destination_DC source_DC NC [options]
Replicate a naming context between two DCs.

### drs showrepl
Show replication status. The [--json] option results in JSON output, and with the [--summary] option produces very little output when the replication status seems healthy.

### dsacl
Administer DS ACLs

### dsacl delete
Delete an access list entry on a directory object.

### dsacl get
Print access list on a directory object.

### dsacl set
Modify access list on a directory object.

### forest
Manage Forest configuration.

### forest directory_service
Manage directory_service behaviour for the forest.

### forest directory_service dsheuristics VALUE
Modify dsheuristics directory_service configuration for the forest.

### forest directory_service show
Show current directory_service configuration for the forest.

### fsmo
Manage Flexible Single Master Operations (FSMO).

### fsmo seize [options]
Seize the role.

### fsmo show
Show the roles.

### fsmo transfer [options]
Transfer the role.

### gpo
Manage Group Policy Objects (GPO).

### gpo create displayname [options]
Create an empty GPO.

### gpo del gpo [options]
Delete GPO.

### gpo dellink container_dn gpo [options]
Delete GPO link from a container.

### gpo fetch gpo [options]
Download a GPO.

### gpo getinheritance container_dn [options]
Get inheritance flag for a container.

### gpo getlink container_dn [options]
List GPO Links for a container.

### gpo list username [options]
List GPOs for an account.

### gpo listall
List all GPOs.

### gpo listcontainers gpo [options]
List all linked containers for a GPO.

### gpo setinheritance container_dn block|inherit [options]
Set inheritance flag on a container.

### gpo setlink container_dn gpo [options]
Add or Update a GPO link to a container.

### gpo show gpo [options]
Show information for a GPO.

### gpo manage symlink list
List VGP Symbolic Link Group Policy from the sysvol

### gpo manage symlink add
Adds a VGP Symbolic Link Group Policy to the sysvol

### gpo manage symlink remove
Removes a VGP Symbolic Link Group Policy from the sysvol

### gpo manage files list
List VGP Files Group Policy from the sysvol

### gpo manage files add
Add VGP Files Group Policy to the sysvol

### gpo manage files remove
Remove VGP Files Group Policy from the sysvol

### gpo manage openssh list
List VGP OpenSSH Group Policy from the sysvol

### gpo manage openssh set
Sets a VGP OpenSSH Group Policy to the sysvol

### gpo manage sudoers add
Adds a Samba Sudoers Group Policy to the sysvol.

### gpo manage sudoers list
List Samba Sudoers Group Policy from the sysvol.

### gpo manage sudoers remove
Removes a Samba Sudoers Group Policy from the sysvol.

### gpo manage scripts startup list
List VGP Startup Script Group Policy from the sysvol

### gpo manage scripts startup add
Adds VGP Startup Script Group Policy to the sysvol

### gpo manage scripts startup remove
Removes VGP Startup Script Group Policy from the sysvol

### gpo manage motd list
List VGP MOTD Group Policy from the sysvol.

### gpo manage motd set
Sets a VGP MOTD Group Policy to the sysvol

### gpo manage issue list
List VGP Issue Group Policy from the sysvol.

### gpo manage issue set
Sets a VGP Issue Group Policy to the sysvol

### gpo manage access add
Adds a VGP Host Access Group Policy to the sysvol

### gpo manage access list
List VGP Host Access Group Policy from the sysvol

### gpo manage access remove
Remove a VGP Host Access Group Policy from the sysvol

### group
Manage groups.

### group add groupname [options]
Create a new AD group.

### group create groupname [options]
Add a new AD group. This is a synonym for the samba-tool group add command and is available for compatibility reasons only. Please use samba-tool group add instead.

### group addmembers groupname members [options]
Add members to an AD group.

### group delete groupname [options]
Delete an AD group.

### group edit groupname
Edit a group AD object.

--editor=EDITOR

Specifies the editor to use instead of the system default, or 'vi' if no system default is set.

### group list
List all groups.

### group listmembers groupname [options]
List all members of the specified AD group.

By default the sAMAccountNames are listed. If no sAMAccountName is available, the CN will be used instead.

--full-dn

List the distinguished names instead of the sAMAccountNames.

--hide-expired

Do not list expired group members.

--hide-disabled

Do not list disabled group members.

### group move groupname new_parent_dn [options]
This command moves a group into the specified organizational unit or container.

The groupname specified on the command is the sAMAccountName.

The name of the organizational unit or container can be specified as a full DN or without the domainDN component.

### group removemembers groupname members [options]
Remove members from the specified AD group.

### group show groupname [options]
Show group object and it's attributes.

### group stats [options]
Show statistics for overall groups and group memberships.

### group rename groupname [options]
Rename a group and related attributes.

This command allows to set the group's name related attributes. The group's CN will be renamed automatically. The group's CN will be the sAMAccountName. Use the --force-new-cn option to specify the new CN manually and the --reset-cn to reset this change.

Use an empty attribute value to remove the specified attribute.

The groupname specified on the command is the sAMAccountName.

--force-new-cn=NEW_CN

Specify a new CN (RDN) instead of using the sAMAccountName.

--reset-cn

Set the CN to the sAMAccountName.

--mail-address=MAIL_ADDRESS

New mail address

--samaccountname=SAMACCOUNTNAME

New account name (sAMAccountName/logon name)

### ldapcmp URL1 URL2 domain|configuration|schema|dnsdomain|dnsforest [options]
Compare two LDAP databases.

### ntacl
Manage NT ACLs.

### ntacl changedomsid original-domain-SID new-domain-SID file [options]
Change the domain SID for ACLs. Can be used to change all entries in acl_xattr when the machine's SID has accidentally changed or the data set has been copied to another machine either via backup/restore or rsync.

--use-ntvfs

Set the ACLs directly to the TDB or xattr. The POSIX permissions will NOT be changed, only the NT ACL will be stored.

--service=SERVICE

Specify the name of the smb.conf service to use. This option is required in combination with the --use-s3fs option.

--use-s3fs

Set the ACLs for use with the default s3fs file server via the VFS layer. This option requires a smb.conf service, specified by the --service=SERVICE option.

--xattr-backend=[native|tdb]

Specify the xattr backend type (native fs or tdb).

--eadb-file=EADB_FILE

Name of the tdb file where attributes are stored.

--recursive

Set the ACLs for directories and their contents recursively.

--follow-symlinks

Follow symlinks when --recursive is specified.

--verbose

Verbosely list files and ACLs which are being processed.

### ntacl get file [options]
Get ACLs on a file.

### ntacl set acl file [options]
Set ACLs on a file.

### ntacl sysvolcheck
Check sysvol ACLs match defaults (including correct ACLs on GPOs).

### ntacl sysvolreset
Reset sysvol ACLs to defaults (including correct ACLs on GPOs).

### ou
Manage organizational units (OUs).

### ou add ou_dn [options]
Add a new organizational unit.

The name of the organizational unit can be specified as a full DN or without the domainDN component.

--description=DESCRIPTION

Specify OU's description.

### ou create ou_dn [options]
Add a new organizational unit. This is a synonym for the samba-tool ou add command and is available for compatibility reasons only. Please use samba-tool ou add instead.

### ou delete ou_dn [options]
Delete an organizational unit.

The name of the organizational unit can be specified as a full DN or without the domainDN component.

--force-subtree-delete

Delete organizational unit and all children recursively.

### ou list [options]
List all organizational units.

--full-dn

Display DNs including the base DN.

### ou listobjects ou_dn [options]
List all objects in an organizational unit.

The name of the organizational unit can be specified as a full DN or without the domainDN component.

--full-dn

Display DNs including the base DN.

-r|--recursive

List objects recursively.

### ou move old_ou_dn new_parent_dn [options]
Move an organizational unit.

The name of the organizational units can be specified as a full DN or without the domainDN component.

### ou rename old_ou_dn new_ou_dn [options]
Rename an organizational unit.

The name of the organizational units can be specified as a full DN or without the domainDN component.

### rodc
Manage Read-Only Domain Controller (RODC).

### rodc preload SID|DN|accountname [options]
Preload one account for an RODC.

### schema
Manage and query schema.

### schema attribute modify attribute [options]
Modify the behaviour of an attribute in schema.

### schema attribute show attribute [options]
Display an attribute schema definition.

### schema attribute show_oc attribute [options]
Show objectclasses that MAY or MUST contain this attribute.

### schema objectclass show objectclass [options]
Display an objectclass schema definition.

### sites
Manage sites.

### sites list [options]
List sites.

--json

Output as JSON instead of a list

### sites view site [options]
View site details.

### sites create site [options]
Create a new site.

### sites remove site [options]
Delete an existing site.

### sites subnet list site [options]
List subnets for a site.

--json

Output as JSON instead of a list

### sites subnet view subnet [options]
View subnet details.

### sites subnet create subnet site-of-subnet [options]
Create a new subnet.

### sites subnet remove subnet [options]
Delete an existing subnet.

### sites subnet set-site subnet site-of-subnet [options]
Assign a subnet to a site.

### spn
Manage Service Principal Names (SPN).

### spn add name user [options]
Create a new SPN.

### spn delete name [user] [options]
Delete an existing SPN.

### spn list user [options]
List SPNs of a given user.

### testparm
Check the syntax of the configuration file.

### time
Retrieve the time on a server.

### user
Manage users.

### user add username [password]
Add a new user to the Active Directory Domain.

### user create username [password]
Add a new user. This is a synonym for the samba-tool user add command and is available for compatibility reasons only. Please use samba-tool user add instead.

### user delete username [options]
Delete an existing user account.

### user disable username
Disable a user account.

### user edit username
Edit a user account AD object.

--editor=EDITOR

Specifies the editor to use instead of the system default, or 'vi' if no system default is set.

### user enable username
Enable a user account.

### user list
List all users.

By default the user's sAMAccountNames are listed.

--full-dn

List user's distinguished names instead of the sAMAccountNames.

-b BASE_DN|--base-dn=BASE_DN

Specify base DN to use. Only users under the specified base DN will be listed.

--hide-expired

Do not list expired user accounts.

--hide-disabled

Do not list disabled user accounts.

### user setprimarygroup username primarygroupname
Set the primary group a user account.

### user getgroups username
Get the direct group memberships of a user account.

### user show username [options]
Display a user AD object.

--attributes=USER_ATTRS

Comma separated list of attributes, which will be printed.

### user move username new_parent_dn [options]
This command moves a user account into the specified organizational unit or container.

The username specified on the command is the sAMAccountName.

The name of the organizational unit or container can be specified as a full DN or without the domainDN component.

### user password [options]
Change password for a user account (the one provided in authentication).

### user rename username [options]
Rename a user and related attributes.

This command allows to set the user's name related attributes. The user's CN will be renamed automatically. The user's new CN will be made up by combining the given-name, initials and surname. A dot ('.') will be appended to the initials automatically, if required. Use the --force-new-cn option to specify the new CN manually and --reset-cn to reset this change.

Use an empty attribute value to remove the specified attribute.

The username specified on the command is the sAMAccountName.

--surname=SURNAME

New surname

--given-name=GIVEN_NAME

New given name

--initials=INITIALS

New initials

--force-new-cn=NEW_CN

Specify a new CN (RDN) instead of using a combination of the given name, initials and surname.

--reset-cn

Set the CN to the default combination of given name, initials and surname.

--display-name=DISPLAY_NAME

New display name

--mail-address=MAIL_ADDRESS

New email address

--samaccountname=SAMACCOUNTNAME

New account name (sAMAccountName/logon name)

--upn=UPN

New user principal name

### user setexpiry username [options]
Set the expiration of a user account.

### user setpassword username [options]
Sets or resets the password of a user account.

### user unlock username [options]
This command unlocks a user account in the Active Directory domain.

### user getpassword username [options]
Gets the password of a user account.

### user syncpasswords --cache-ldb-initialize [options]
Syncs the passwords of all user accounts, using an optional script.

Note that this command should run on a single domain controller only (typically the PDC-emulator).

### vampire [options] domain
Join and synchronise a remote AD domain to the local server. Please note that samba-tool vampire is deprecated, please use samba-tool domain join instead.

### visualize [options] subcommand
Produce graphical representations of Samba network state. To work out what is happening in a replication graph, it is sometimes helpful to use visualisations.

There are two subcommands, two graphical modes, and (roughly) two modes of operation with respect to the location of authority.

### MODES OF OPERATION
samba-tool visualize ntdsconn

Looks at NTDS connections.

samba-tool visualize reps

Looks at repsTo and repsFrom objects.

samba-tool visualize uptodateness

Looks at replication lag as shown by the uptodateness vectors.

### GRAPHICAL MODES
--distance

Distances between DCs are shown in a matrix in the terminal.

--dot

Generate Graphviz dot output (for ntdsconn and reps modes). When viewed using dot or xdot, this shows the network as a graph with DCs as vertices and connections edges. Certain types of degenerate edges are shown in different colours or line-styles.

--xdot

Generate Graphviz dot output as with [--dot] and attempt to view it immediately using /usr/bin/xdot.

-r

Normally, samba-tool talks to one database; with the [-r] option attempts are made to contact all the DCs known to the first database. This is necessary for samba-tool visualize uptodateness and for samba-tool visualize reps because the repsFrom/To objects are not replicated, and it can reveal replication issues in other modes.

### help
Gives usage information.

## VERSION
This man page is complete for version 4.19.9-alt12 of the Samba suite.

## AUTHOR
The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.


title: samba_downgrade_db(8)

summary: Samba tool for downgrading AD databases

text:
# samba_downgrade_db(8)

## NAME
samba_downgrade_db - Samba tool for downgrading AD databases

## SYNOPSIS
samba_downgrade_db [-H] [-s]

## DESCRIPTION
This tool is part of the samba(8) suite.

The format of the Samba Active Directory (AD) database changed in version 4.8 and 4.11. When downgrading a Samba AD Domain Controller (DC) to a release that is older than either of these versions (e.g. 4.11 to 4.10), the AD database must be manually downgraded before the Samba packages can be safely downgraded.

This tool downgrades a Samba sam.ldb database from the format used in version 4.19.9-alt12 to that of version 4.7. The v4.7 database format can safely be read by any version of Samba. If necessary, later versions of Samba will repack and reconfigure a v4.7-format database when the samba executable is first started.

Note that all Samba services must be stopped on the DC before running this tool. Once the tool has run, do not restart samba or modify the database before the Samba software package has been downgraded.

## OPTIONS
-H [sam.ldb file]

Link directly to a sam.ldb file instead of using path in system smb.conf

-s [smb.conf file]

Link directly to smb.conf file instead of system default (usually in /usr/local/samba/etc/smb.conf)

## VERSION
This man page is complete for version 4.19.9-alt12 of the Samba suite.

## AUTHOR
The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

The samba_downgrade_db tool was developed by the Samba team at Catalyst IT Ltd.


samba

package: samba-dc-common

title: samba(8)

text:
# samba(8)

## NAME
samba - Server to provide AD and SMB/CIFS services to clients

## SYNOPSIS
samba [-D|--daemon] [-F|--foreground] [-i|--interactive] [-M|--model=MODEL] [--maximum-runtime=seconds] [-b|--show-build] [--no-process-group] [-d|--debuglevel=DEBUGLEVEL] [--debug-stdout] [--configfile=CONFIGFILE] [--option=name=value] [-l|--log-basename=LOGFILEBASE] [--leak-report] [--leak-report-full] [-V|--version]

## DESCRIPTION
This program is part of the samba(7) suite.

samba is the server daemon that provides Active Directory, filesharing and printing services to clients. The server provides filespace and directory services to clients using the SMB (or CIFS) protocol and other related protocols such as DCE/RPC, LDAP and Kerberos.

Clients supported include MSCLIENT 3.0 for DOS, Windows for Workgroups, Windows 95/98/ME, Windows NT, Windows 2000/XP/2003, OS/2, DAVE for Macintosh, and cifsfs for Linux.

An extensive description of the services that the server can provide is given in the man page for the configuration file controlling the attributes of those services (see smb.conf(5). This man page will not describe the services, but will concentrate on the administrative aspects of running the server.

Please note that there are significant security implications to running this server, and the smb.conf(5) manual page should be regarded as mandatory reading before proceeding with installation.

## OPTIONS
-D|--daemon

If specified, this parameter causes the server to operate as a daemon. That is, it detaches itself and runs in the background, fielding requests on the appropriate ports. Operating the server as a daemon is the recommended way of running samba for servers that provide more than casual use file and print services. This switch is assumed if samba is executed on the command line of a shell.

-F|--foreground

If specified, this parameter causes the samba process to not daemonize, i.e. double-fork and disassociate with the terminal.

-i|--interactive

If this parameter is specified it causes the server to run "interactively", not as a daemon, even if the server is executed on the command line of a shell. Setting this parameter negates the implicit daemon mode when run from the command line. samba also logs to standard output, as if the -S parameter had been given.

-M|--model

This parameter can be used to specify the "process model" samba should use. This determines how concurrent clients are handled. Available process models include:

•single All Samba services run in a single process. This is not recommended for production configurations.

•standard A process is created for each Samba service, and for those services that support it (currently only LDAP and NETLOGON) a new processes is started for each new client connection.

Historically, this was the 'standard' way Samba behaved up until v4.10. Note that this model can be resource intensive if you have a large number of client connections.

•prefork The default. A process is started for each Samba service, and a fixed number of worker processes are started for those services that support it (currently LDAP, NETLOGON, and KDC). The client connections are then shared amongst the worker processes. Requests for services not supporting prefork are handled by a single process for that service.

The number of prefork worker processes started is controlled by the smb.conf(5) parameter prefork children, which defaults to 4.

--maximum-runtime=seconds

Set maximum runtime of the server process till autotermination in seconds.

-b|--show-build

Print information about how Samba was built.

-d|--debuglevel=DEBUGLEVEL, --debug-stdout

level is an integer from 0 to 10. The default value if this parameter is not specified is 0. The higher this value, the more detail will be logged to the log files about the activities of the server. At level 0, only critical errors and serious warnings will be logged. Level 1 is a reasonable level for day-to-day running - it generates a small amount of information about operations carried out.

Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

Note that specifying this parameter here will override the log level parameter in the /etc/samba/smb.conf file. This will redirect debug output to STDOUT. By default server daemons are logging to a log file.

--configfile=CONFIGFILE

The file specified contains the configuration details required by the server. The information in this file includes server-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide. See /etc/samba/smb.conf for more information. The default configuration file name is determined at compile time.

--option=<name>=<value>

Set the smb.conf(5) option "<name>" to value "<value>" from the command line. This overrides compiled-in defaults and options read from the configuration file. If a name or a value includes a space, wrap whole --option=name=value into quotes.

-l|--log-basename=logdirectory

Base directory name for log/debug files. The extension ".progname" will be appended (e.g. log.smbclient, log.smbd, etc...). The log file is never removed by the client.

--leak-report

Enable talloc leak reporting on exit.

--leak-report-full

Enable full talloc leak reporting on exit.

-V|--version

Prints the program version number.

-?|--help

Print a summary of command line options.

--usage

Display brief usage message.

## FILES
/etc/rc

or whatever initialization script your system uses. If running the server as a daemon at startup, this file will need to contain an appropriate startup sequence for the server.

/etc/services

If running the server via the meta-daemon inetd, this file must contain a mapping of service name (e.g., netbios-ssn) to service port (e.g., 139) and protocol type (e.g., tcp).

/usr/local/samba/lib/smb.conf

This is the default location of the smb.conf(5) server configuration file. Other common places that systems install this file are /usr/samba/lib/smb.conf and /etc/samba/smb.conf. This file describes all the services the server is to make available to clients. See smb.conf(5) for more information.

## DIAGNOSTICS
Most diagnostics issued by the server are logged in a specified log file. The log file name is specified at compile time, but may be overridden on the command line.

The number and nature of diagnostics available depends on the debug level used by the server. If you have problems, set the debug level to 3 and peruse the log files.

Most messages are reasonably self-explanatory. Unfortunately, at the time this man page was created, there are too many diagnostics available in the source code to warrant describing each and every diagnostic. At this stage your best bet is still to grep the source code and inspect the conditions that gave rise to the diagnostics you are seeing.

## VERSION
This man page is part of version 4.19.9-alt12 of the Samba suite.

## SEE ALSO
hosts_access(5) smb.conf(5), smbclient(8), samba-tool(8), smbd(8), nmbd(8), winbindd(1), and the Internet RFC's rfc1001.txt, rfc1002.txt. In addition the CIFS (formerly SMB) specification is available as a link from the Web page https://www.samba.org/cifs/.

## AUTHOR
The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.


samba-dcerpcd

package: samba-dcerpc

title: samba-dcerpcd(8)

summary: This is one of Samba\*(Aqs DCERPC server processes that can listen on sockets where RPC services are offered and is the parent process of the DCERPC services it invokes. Unless separately invoked it is started on demand from smbd or winbind and serves DCERPC only over named pipes (np) as a helper process. This will be the standard setup for most installations (standalone/member server/AD server) unless they modify their startup scripts. Note in when Samba is configured as an Active Directory Domain controller the samba process that invokes smbd will still provide its normal DCERPC services, not samba\-dcerpcd. When separately invoked by system startup scripts or a a daemon, the global smb.conf option \m[blue]rpc start on demand helpers = false\m[] MUST be set to allow samba\-dcerpcd to start standalone.

text:
# samba-dcerpcd(8)

## NAME
samba-dcerpcd - This is one of Samba's DCERPC server processes that can listen on sockets where RPC services are offered and is the parent process of the DCERPC services it invokes. Unless separately invoked it is started on demand from smbd or winbind and serves DCERPC only over named pipes (np) as a helper process. This will be the standard setup for most installations (standalone/member server/AD server) unless they modify their startup scripts. Note in when Samba is configured as an Active Directory Domain controller the samba process that invokes smbd will still provide its normal DCERPC services, not samba-dcerpcd. When separately invoked by system startup scripts or a a daemon, the global smb.conf option rpc start on demand helpers = false MUST be set to allow samba-dcerpcd to start standalone.

## SYNOPSIS
samba-dcerpcd [-D|--daemon] [-i|--interactive] [-F|--foreground] [--no-process-group] [-d <debug level>] [--debug-stdout] [--configfile=<configuration file>] [--option=<name>=<value>] [--leak-report] [--leak-report-full] [-V|--version] [--libexec-rpcds] [--np-helper] [--ready-signal-fd=<fd>] [<SERVICE_1>] [<SERVICE_2>] [<...>]

## DESCRIPTION
This tool is part of the samba(7) suite.

samba-dcerpcd can be used in two ways. In the normal case without startup script modification and the global smb.conf option rpc start on demand helpers = true is set (the default setting), it is invoked on demand from smbd or winbind with a command line containing --np-helper to serve DCERPC over named pipes (np). It can also be used in a standalone mode where it is started separately from smbd or winbind via system startup scripts. If invoked as a standalone daemon or started from system startup scripts the global smb.conf option rpc start on demand helpers = false MUST be set to false. If the global smb.conf option rpc start on demand helpers = true is set to true or left as default, samba-dcerpcd will fail to start and log an error message.

Note that when Samba is run in the Active Directory Domain Controller mode the samba AD code will still provide its normal DCERPC services whilst allowing samba-dcerpcd to provide services like SRVSVC in the same way that smbd used to in this configuration.

The standalone mode can also be useful for use outside of the Samba framework, for example, use with the Linux kernel SMB2 server ksmbd or possibly other SMB2 server implementations. In this mode it behaves like inetd and listens on sockets on behalf of RPC server implementations.

When a client connects, samba-dcerpcd will start the relevant RPC service binary on demand and hand over the connection to that service. When an RPC service has been idle for a while, samba-dcerpcd will ask it to shut down again.

## OPTIONS
-D|--daemon

If specified, this parameter causes the server to operate as a daemon. That is, it detaches itself and runs in the background, fielding requests on the appropriate port. Operating the server as a daemon is useful for running samba-dcerpcd outside of the Samba framework. However, it can also be used in this way within Samba for member servers if configured to start up via system startup scripts. This switch is assumed if samba-dcerpcd is executed on the command line of a shell.

-i|--interactive

If this parameter is specified it causes the server to run "interactively", not as a daemon, even if the server is executed on the command line of a shell. Setting this parameter negates the implicit daemon mode when run from the command line. samba-dcerpcd will only accept one connection and terminate. It will also log to standard output, as if the -S parameter had been given.

-F|--foreground

If specified, this parameter causes the main samba-dcerpcd process to not daemonize, i.e. double-fork and disassociate with the terminal. Child processes are still spawned as normal to service each connection request, but the main process does not exit. This operation mode is suitable for running samba-dcerpcd under process supervisors such as supervise and svscan from Daniel J. Bernstein's daemontools package, or the AIX process monitor.

--no-process-group

Do not create a new process group for samba-dcerpcd.

--libexec-rpcds

Offer RPC services for all daemons in Samba's LIBEXECDIR, all programs starting with "rpcd_" are assumed to offer RPC services. If you don't use the --libexec-rpcds option, you can explicitly list all RPC service helpers explicitly on the command line.

--np-helper

Run samba-dcerpcd on demand opening named pipe sockets as helpers for smbd or winbind. In order to run in this mode, the global smb.conf option rpc start on demand helpers = true must be set to true (this is the default setting).

--ready-signal-fd=<fd>

Report service readiness via this fd to smbd. Only for internal use.

## AUTHOR
The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.


samba-gpupdate

package: samba-gpupdate

title: samba-gpupdate(8)

summary: apply group policy

text:
# samba-gpupdate(8)

## NAME
samba-gpupdate - apply group policy

## SYNOPSIS
samba-gpupdate

samba-gpupdate [options]

## DESCRIPTION
This tool is part of the samba(1) suite.

samba-gpupdate a script for applying and unapplying Group Policy. This applies password policies (minimum/maximum password age, minimum password length, and password complexity), kerberos policies (user/service ticket lifetime and renew lifetime), smb.conf policies, hourly/daily/weekly/monthly cron scripts, Sudo Privileges, Message of the Day and Logon Prompt messages, etc.

## OPTIONS
-h, --help show this help message and exit

-H URL, --url=URL URL for the samdb

-X, --unapply Unapply Group Policy

--target {Computer | User}

--force Reapplies all policy settings

--rsop Print the Resultant Set of Policy

Samba Common Options:

-s FILE, --configfile=FILE Configuration file

-d DEBUGLEVEL, --debuglevel=DEBUGLEVEL debug level

--option=OPTION set smb.conf option from command line

--realm=REALM set the realm name

Version Options:

-V, --version Display version number

Credentials Options:

--simple-bind-dn=DN DN to use for a simple bind

--password=PASSWORD Password

-U USERNAME, --username=USERNAME Username

-W WORKGROUP, --workgroup=WORKGROUP Workgroup

-N, --no-pass Don't ask for a password

-k KERBEROS, --kerberos=KERBEROS Use Kerberos

--ipaddress=IPADDRESS IP address of server

-P, --machine-pass Use stored machine account password

## AUTHOR
The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.


title: smbspool_krb5_wrapper(8)

text:
# smbspool_krb5_wrapper(8)

## NAME
smbspool_krb5_wrapper - This is a CUPS printing backend which calls smbspool

## SYNOPSIS
smbspool_krb5_wrapper {job} {user} {title} {copies} {options} [filename]

## DESCRIPTION
This tool is part of the samba(7) suite.

smbspool_krb5_wrapper is a tool that can be used to print using Kerberos credentials. To get this working smbspool_krb5_wrapper needs to be the smb backend of CUPS. It needs to be owned by root and the permissions for the binary need to be 0700. Once smbspool_krb5_wrapper switched to the user trying to print it executes smbspool. It should not be called by a user.

## SEE ALSO
smbspool(8).

## AUTHOR
The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

The smbspool_krb5_wrapper manpage was written by Andreas Schneider.


package: samba-vfs-cephfs

title: vfs_ceph(8)

summary: Utilize features provided by CephFS

text:
# vfs_ceph(8)

## NAME
vfs_ceph - Utilize features provided by CephFS

## SYNOPSIS
vfs objects = ceph

## DESCRIPTION
This VFS module is part of the samba(8) suite.

The vfs_ceph VFS module exposes CephFS specific features for use by Samba.

Ceph is a distributed network file system designed to provide excellent performance, reliability, and scalability. This is a shared library allowing applications to access a Ceph distributed file system via a POSIX-like interface.

This module can be combined with other modules, but it should be the last module in the vfs objects list. Modules added to this list to the right of the ceph entry may not have any effect at all.

vfs_ceph performs mapping between Windows and POSIX Access Control Lists (ACLs). To ensure correct processing and enforcement of POSIX ACLs, the following Ceph configuration parameters are automatically applied:

```
		client acl type = posix_acl
		fuse default permissions = false

```

## CONFIGURATION
vfs_ceph requires that the underlying share path is a Ceph filesystem.

```
		[share]
		vfs objects = ceph
		path = /non-mounted/cephfs/path
		kernel share modes = no

```

Since vfs_ceph does not require a filesystem mount, the share path is treated differently: it is interpreted as an absolute path within the Ceph filesystem on the attached Ceph cluster. In a ctdb cluster environment where ctdb manages Samba, CTDB_SAMBA_SKIP_SHARE_CHECK=yes must be configured to disable local share path checks, otherwise ctdb will not reach a healthy state.

Note that currently kernel share modes have to be disabled in a share running with the CephFS vfs module for file serving to work properly.

## OPTIONS
ceph:config_file = path

Allows one to define a ceph configfile to use. Empty by default. Example: ceph:config_file = /etc/ceph/ceph.conf

ceph:user_id = name

Allows one to explicitly set the client ID used for the CephFS mount handle. Empty by default (use the libcephfs client default). Example: ceph:user_id = samba

ceph:filesystem = fs_name

Allows one to explicitly select the CephFS file system to use when the Ceph cluster supports more than one file system. Empty by default (use the default file system of the Ceph cluster). Example: ceph:filesystem = myfs2

## VERSION
This man page is part of version 4.19.9-alt12 of the Samba suite.

## AUTHOR
The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.


title: vfs_ceph_snapshots(8)

summary: Expose CephFS snapshots as shadow\-copies

text:
# vfs_ceph_snapshots(8)

## NAME
vfs_ceph_snapshots - Expose CephFS snapshots as shadow-copies

## SYNOPSIS
vfs objects = ceph_snapshots

## DESCRIPTION
This VFS module is part of the samba(8) suite.

The vfs_ceph_snapshots VFS module exposes CephFS snapshots for use by Samba. When enabled, SMB clients such as Windows Explorer's Previous Versions dialog, can enumerate snapshots and access them via "timewarp" tokens.

This module can be combined with vfs_ceph, but vfs_ceph_snapshots must be listed first in the vfs objects parameter list.

CephFS support for ceph.snap.btime virtual extended attributes is required for this module to work properly. This support was added via https://tracker.ceph.com/issues/38838.

## CONFIGURATION
When used atop vfs_ceph, path refers to an absolute path within the Ceph filesystem and should not be mounted locally:

```
		[share]
		vfs objects = ceph_snapshots ceph
		path = /non-mounted/cephfs/path
		kernel share modes = no

```

vfs_ceph_snapshots can also be used atop a kernel CephFS mounted share path, without vfs_ceph. In this case Samba's default VFS backend vfs_default is used:

```
		[share]
		vfs objects = ceph_snapshots
		path = /mnt/cephfs/

```

## OPTIONS
ceph:snapdir = subdirectory

Allows for the configuration of the special CephFS snapshot subdirectory name. This parameter should only be changed from the ".snap" default if the ceph.conf client snapdir or snapdirname mount option settings are changed from their matching ".snap" defaults. Default: ceph:snapdir = .snap

Example: ceph:snapdir = .snapshots

## VERSION
This man page is part of version 4.19.9-alt12 of the Samba suite.

## AUTHOR
The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.


package: samba-vfs-glusterfs

title: vfs_glusterfs(8)

summary: Utilize features provided by GlusterFS

text:
# vfs_glusterfs(8)

## NAME
vfs_glusterfs - Utilize features provided by GlusterFS

## SYNOPSIS
vfs objects = glusterfs

## DESCRIPTION
This VFS module is part of the samba(8) suite.

GlusterFS (http://www.gluster.org) is an Open Source clustered file system capable of scaling to several peta-bytes. With its FUSE based native client, GlusterFS is available as a POSIX compliant file system and can hence be shared by Samba without additional steps.

The vfs_glusterfs VFS module provides an alternative, and superior way to access a Gluster filesystem from Samba for sharing. It does not require a Gluster FUSE mount but directly accesses the GlusterFS daemon through its library libgfapi, thereby omitting the expensive kernel-userspace context switches and taking advantage of some of the more advanced features of GlusterFS.

This module can be combined with other modules, but it should be the last module in the vfs objects list. Modules added to this list to the right of the glusterfs entry may not have any effect at all.

## CONFIGURATION
A basic configuration looks like this.

```
		[share]
		vfs objects = glusterfs
		path = /relative/base/path
		glusterfs:volume = gv0
		kernel share modes = no

```

Note that since vfs_glusterfs does not require a Gluster mount, the share path is treated differently than for other shares: It is interpreted as the base path of the share relative to the gluster volume used. Because this is usually not at the same time a system path, in a ctdb cluster setup where ctdb manages Samba, you need to set CTDB_SAMBA_SKIP_SHARE_CHECK=yes in ctdb's configuration file. Otherwise ctdb will not get healthy.

Note that currently kernel share modes have to be disabled in a share running with the glusterfs vfs module for file serving to work properly.

## OPTIONS
glusterfs:logfile = path

Defines whether and where to store a vfs_glusterfs specific logfile. Client variable substitution is supported (i.e. %M, %m, %I), hence per client log file can be specified. Example: glusterfs:logfile = /var/log/samba/glusterfs-vol2.%M.log

glusterfs:loglevel = 0-9

Defines the level of logging, with higher numbers corresponding to more verbosity. 0 - No logs; 9 - Trace log level; 7 being the info log level is preferred. If this option is not defined with an explicit loglevel, the glusterfs default is used (currently loglevel 7).

glusterfs:volfile_server = servername

Defines which volfile server to use, defaults to localhost. It could be list of white space separated elements where each element could be 1. unix+/path/to/socket/file

2. [tcp+]IP|hostname|\[IPv6\][:port]

Note the restriction on naming a IPv6 host, it follows the same restriction that is based on IPv6 naming in URL as per RFC 2732.

glusterfs:volume = volumename

Defines the glusterfs volumename to use for this share.

## CAVEATS
The GlusterFS write-behind performance translator, when used with Samba, could be a source of data corruption. The translator, while processing a write call, immediately returns success but continues writing the data to the server in the background. This can cause data corruption when two clients relying on Samba to provide data consistency are operating on the same file.

The write-behind translator is enabled by default on GlusterFS. The vfs_glusterfs plugin will check for the presence of the translator and refuse to connect if detected. Please disable the write-behind translator for the GlusterFS volume to allow the plugin to connect to the volume. The write-behind translator can easily be disabled via calling

```
                        gluster volume set <volumename> performance.write-behind off

```

on the commandline.

With GlusterFS versions >= 9, we silently bypass write-behind translator during initial connect and failure is avoided.

## VERSION
This man page is part of version 4.19.9-alt12 of the Samba suite.

## AUTHOR
The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.


package: samba-vfs-snapper

title: vfs_snapper(8)

summary: Expose snapshots managed by snapper as shadow\-copies

text:
# vfs_snapper(8)

## NAME
vfs_snapper - Expose snapshots managed by snapper as shadow-copies

## SYNOPSIS
vfs objects = snapper

## DESCRIPTION
This VFS module is part of the samba(8) suite.

The vfs_snapper VFS module exposes snapshots managed by snapper for use by Samba. This provides the ability for remote SMB clients to access shadow-copies via Windows Explorer using the "previous versions" dialog.

Snapshots can also be created and remove remotely, using the File Server Remote VSS Protocol (FSRVP). Snapshot creation and deletion requests are forwarded to snapper via DBus.

This module is stackable.

## CONFIGURATION
The underlying share path must have a corresponding snapper configuration file. The snapshot directory tree must allow access for relevant users.

```
		[share]
		vfs objects = snapper

```

For remote snapshot creation and deletion, Samba's FSRVP server must be configured in the [global] section:

```
		[global]
		registry shares = yes
		include = registry

```

## PERMISSIONS
Snapper stores snapshots under a .snapshots subdirectory. This directory must permit traversal for any users wishing to access snapshots via the Windows Explorer previous versions dialog. By default, traversal is forbidden for all non-root users. Additionally, users must be granted permission to list snapshots managed by snapper, via snapper's ALLOW_USERS or ALLOW_GROUPS options. Snapper can grant these users and groups .snapshots traversal access automatically via the SYNC_ACL option.

Remote snapshot creation and deletion is only permitted by Samba for Active Directory administrators, backup operators, or users explicitly granted SeBackupPrivilege. Snapper must also permit creation and deletion for the appropriate user, via snapper's ALLOW_USERS or ALLOW_GROUPS options.

The DiskShadow.exe FSRVP client initially authenticates as the Active Directory computer account. This account must therefore be granted the same permissions as the user account issuing the snapshot creation and deletion requests.

## VERSION
This man page is part of version 4.19.9-alt12 of the Samba suite.

## AUTHOR
The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.


package: samba-winbind-clients

title: pam_winbind(8)

summary: PAM module for Winbind

text:
# pam_winbind(8)

## NAME
pam_winbind - PAM module for Winbind

## DESCRIPTION
This tool is part of the samba(7) suite.

pam_winbind is a PAM module that can authenticate users against the local domain by talking to the Winbind daemon.

## SYNOPSIS
Edit the PAM system config /etc/pam.d/service and modify it as the following example shows:

```
			    ...
			    auth      required        pam_env.so
			    auth      sufficient      pam_unix2.so
			+++ auth      required        pam_winbind.so  use_first_pass
			    account   requisite       pam_unix2.so
			+++ account   required        pam_winbind.so  use_first_pass
			+++ password  sufficient      pam_winbind.so
			    password  requisite       pam_pwcheck.so  cracklib
			    password  required        pam_unix2.so    use_authtok
			    session   required        pam_unix2.so
			+++ session   required        pam_winbind.so
			    ...

```

Make sure that pam_winbind is one of the first modules in the session part. It may retrieve kerberos tickets which are needed by other modules.

## OPTIONS
pam_winbind supports several options which can either be set in the PAM configuration files or in the pam_winbind configuration file situated at /etc/security/pam_winbind.conf. Options from the PAM configuration file take precedence to those from the configuration file. See pam_winbind.conf(5) for further details.

debug

Gives debugging output to syslog.

debug_state

Gives detailed PAM state debugging output to syslog.

require_membership_of=[SID or NAME]

If this option is set, pam_winbind will only succeed if the user is a member of the given SID or NAME. A SID can be either a group-SID, an alias-SID or even an user-SID. It is also possible to give a NAME instead of the SID. That name must have the form: MYDOMAIN\mygroup or MYDOMAIN\myuser (where '\' character corresponds to the value of winbind separator parameter). It is also possible to use a UPN in the form user@REALM or group@REALM. pam_winbind will, in that case, lookup the SID internally. Note that NAME may not contain any spaces. It is thus recommended to only use SIDs. You can verify the list of SIDs a user is a member of with wbinfo --user-sids=SID. This option must only be specified on a auth module declaration, as it only operates in conjunction with password authentication.

use_first_pass

By default, pam_winbind tries to get the authentication token from a previous module. If no token is available it asks the user for the old password. With this option, pam_winbind aborts with an error if no authentication token from a previous module is available.

try_first_pass

Same as the use_first_pass option (previous item), except that if the primary password is not valid, PAM will prompt for a password.

use_authtok

Set the new password to the one provided by the previously stacked password module. If this option is not set pam_winbind will ask the user for the new password.

try_authtok

Same as the use_authtok option (previous item), except that if the new password is not valid, PAM will prompt for a password.

krb5_auth

pam_winbind can authenticate using Kerberos when winbindd is talking to an Active Directory domain controller. Kerberos authentication must be enabled with this parameter. When Kerberos authentication can not succeed (e.g. due to clock skew), winbindd will fallback to samlogon authentication over MSRPC. When this parameter is used in conjunction with winbind refresh tickets, winbind will keep your Ticket Granting Ticket (TGT) up-to-date by refreshing it whenever necessary.

krb5_ccache_type=[type]

When pam_winbind is configured to try kerberos authentication by enabling the krb5_auth option, it can store the retrieved Ticket Granting Ticket (TGT) in a credential cache. The type of credential cache can be controlled with this option. The supported values are: KCM or KEYRING (when supported by the system's Kerberos library and operating system), FILE and DIR (when the DIR type is supported by the system's Kerberos library). In case of FILE a credential cache in the form of /tmp/krb5cc_UID will be created - in case of DIR you NEED to specify a directory which must exist, the UID directory will be created in the specified directory. In all cases UID is replaced with the numeric user id. Check the details of the Kerberos implementation. When using the KEYRING type, the supported mechanism is “KEYRING:persistent:UID”, which uses the Linux kernel keyring to store credentials on a per-UID basis. KEYRING has limitations. For example, it is secure kernel memory, so bulk storage of credentials is not possible.

When using the KCM type, the supported mechanism is “KCM:UID”, which uses a Kerberos credential manager to store credentials on a per-UID basis similar to KEYRING. This is the recommended choice on latest Linux distributions that offer a Kerberos Credential Manager. If not, we suggest to use KEYRING, as those are the most secure and predictable method.

It is also possible to define custom filepaths and use the "%u" pattern in order to substitute the numeric user id. Examples:

krb5_ccache_type = DIR:/run/user/%u/krb5cc

This will create a credential cache file in the specified directory.

krb5_ccache_type = FILE:/tmp/krb5cc_%u

This will create a credential cache file.

Leave empty to just do kerberos authentication without having a ticket cache after the logon has succeeded. This setting is empty by default.

cached_login

Winbind allows one to logon using cached credentials when winbind offline logon is enabled. To use this feature from the PAM module this option must be set.

silent

Do not emit any messages.

mkhomedir

Create homedirectory for a user on-the-fly, option is valid in PAM session block.

warn_pwd_expire

Defines number of days before pam_winbind starts to warn about passwords that are going to expire. Defaults to 14 days.

## PAM DATA EXPORTS
This section describes the data exported in the PAM stack which could be used in other PAM modules.

PAM_WINBIND_HOMEDIR

This is the Windows Home Directory set in the profile tab in the user settings on the Active Directory Server. This could be a local path or a directory on a share mapped to a drive.

PAM_WINBIND_LOGONSCRIPT

The path to the logon script which should be executed if a user logs in. This is normally a relative path to the script stored on the server.

PAM_WINBIND_LOGONSERVER

This exports the Active Directory server we are authenticating against. This can be used as a variable later.

PAM_WINBIND_PROFILEPATH

This is the profile path set in the profile tab in the user settings. Normally the home directory is synced with this directory on a share.

## SEE ALSO
pam_winbind.conf(5), wbinfo(1), winbindd(8), smb.conf(5)

## VERSION
This man page is part of version 4.19.9-alt12 of Samba.

## AUTHOR
The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

This manpage was written by Jelmer Vernooij and Guenther Deschner.


package: samba-winbind-common

title: idmap_ad(8)

summary: Samba\*(Aqs idmap_ad Backend for Winbind

text:
# idmap_ad(8)

## NAME
idmap_ad - Samba's idmap_ad Backend for Winbind

## DESCRIPTION
The idmap_ad plugin provides a way for Winbind to read id mappings from an AD server that uses RFC2307/SFU schema extensions. This module implements only the "idmap" API, and is READONLY. Mappings must be provided in advance by the administrator by adding the uidNumber attributes for users and gidNumber attributes for groups in the AD. Winbind will only map users that have a uidNumber and whose primary group have a gidNumber attribute set. It is however recommended that all groups in use have gidNumber attributes assigned, otherwise they are not working.

Currently, the ad backend does not work as the default idmap backend, but one has to configure it separately for each domain for which one wants to use it, using disjoint ranges. One usually needs to configure a writeable default idmap range, using for example the tdb or ldap backend, in order to be able to map the BUILTIN sids and possibly other trusted domains. The writeable default config is also needed in order to be able to create group mappings. This catch-all default idmap configuration should have a range that is disjoint from any explicitly configured domain with idmap backend ad. See the example below.

## IDMAP OPTIONS
range = low - high

Defines the available matching UID and GID range for which the backend is authoritative. Note that the range acts as a filter. If specified any UID or GID stored in AD that fall outside the range is ignored and the corresponding map is discarded. It is intended as a way to avoid accidental UID/GID overlaps between local and remotely defined IDs.

schema_mode = <rfc2307 | sfu | sfu20>

Defines the schema that idmap_ad should use when querying Active Directory regarding user and group information. This can be either the RFC2307 schema support included in Windows 2003 R2 or the Service for Unix (SFU) schema. For SFU 3.0 or 3.5 please choose "sfu", for SFU 2.0 please choose "sfu20". Please note that the behavior of primary group membership is controlled by the unix_primary_group option.

unix_primary_group = yes/no

Defines whether the user's primary group is fetched from the SFU attributes or the AD primary group. If set to yes the primary group membership is fetched from the LDAP attributes (gidNumber). If set to no the primary group membership is calculated via the "primaryGroupID" LDAP attribute. Default: no

unix_nss_info = yes/no

If set to yes winbind will retrieve the login shell and home directory from the LDAP attributes. If set to no or the AD LDAP entry lacks the SFU attributes the options template shell and template homedir are used. Default: no

deny ous

This parameter is a list of OUs from which objects will not be mapped via the ad idmap module. If deny ous is set but allow ous is not set, every object outside the OUs listed in deny ous is allowed. Default: none

allow ous

This parameter is a list of OUs from which objects will be mapped via the ad idmap module. If allow ous is set but deny ous is not set, every object outside the OUs allow ous is denied. If both allow ous and deny ous are set, deny ous is evaluated first, then allow ous is looked at. If an AD object matches neither, it is denied.

Default: none

## EXAMPLES
The following example shows how to retrieve idmappings from our principal and trusted AD domains. If trusted domains are present id conflicts must be resolved beforehand, there is no guarantee on the order conflicting mappings would be resolved at this point. This example also shows how to leave a small non conflicting range for local id allocation that may be used in internal backends like BUILTIN.

```
	[global]
	workgroup = CORP
	idmap config * : backend = tdb
	idmap config * : range = 1000000-1999999
	idmap config CORP : backend  = ad
	idmap config CORP : range = 1000-999999

```

## AUTHOR
The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.


title: idmap_autorid(8)

summary: Samba\*(Aqs idmap_autorid Backend for Winbind

text:
# idmap_autorid(8)

## NAME
idmap_autorid - Samba's idmap_autorid Backend for Winbind

## DESCRIPTION
The idmap_autorid backend provides a way to use an algorithmic mapping scheme to map UIDs/GIDs and SIDs that is more deterministic than idmap_tdb and easier to configure than idmap_rid.

The module works similar to idmap_rid, but it automatically configures the range to be used for each domain, so there is no need to specify a specific range for each domain in the forest, the only configuration that is needed is the range of uid/gids that shall be used for user/group mappings and an optional size of the ranges to be used.

The mappings of which domain is mapped to which range is stored in autorid.tdb, thus you should backup this database regularly.

Due to the algorithm being used, it is the module that is most easy to use as it only requires a minimal configuration.

## IDMAP OPTIONS
range = low - high

Defines the available matching uid and gid range for which the backend is authoritative. Note that the range acts as a filter. If algorithmically determined UID or GID fall outside the range, they are ignored and the corresponding map is discarded. It is intended as a way to avoid accidental UID/GID overlaps between local and remotely defined IDs. Note that the range should be a multiple of the rangesize and needs to be at least twice as large in order to have sufficient id range space for the mandatory BUILTIN domain. With a default rangesize of 100000 the range needs to span at least 200000. This would be: range = 100000 - 299999.

rangesize = numberofidsperrange

Defines the number of uids/gids available per domain range. The minimum needed value is 2000. SIDs with RIDs larger than this value will be mapped into extension ranges depending upon number of available ranges. If the autorid backend runs out of available ranges, mapping requests for new domains (or new extension ranges for domains already known) are ignored and the corresponding map is discarded. Example: with rangesize set to 10000, users/groups with a RID up to 10000 will be put into the first range for the domain. When attempting to map the an object with a RID of 25000, an extension range will be allocated that will then be used to map all RIDs from 20000-29999.

One range will be used for local users and groups and for non-domain well-known SIDs like Everyone (S-1-1-0) or Creator Owner (S-1-3-0). A chosen list of well-known SIDs will be preallocated on first start to create deterministic mappings for those.

Thus the number of local users and groups that can be created is limited by this option as well. If you plan to create a large amount of local users or groups, you will need set this parameter accordingly.

The default value is 100000.

read only = [ yes | no ]

Turn the module into read-only mode. No new ranges will be allocated nor will new mappings be created in the idmap pool. Defaults to no.

ignore builtin = [ yes | no ]

Ignore any mapping requests for the BUILTIN domain. Defaults to no.

## THE MAPPING FORMULAS
The Unix ID for a RID is calculated this way:

```
			ID =  REDUCED RID + IDMAP RANGE LOW VALUE + RANGE NUMBER * RANGE SIZE

```

where REDUCED RID = RID % RANGE_SIZE and a DOMAIN RANGE INDEX = RID / RANGE_SIZE is used together with the domain sid to determine the RANGE NUMBER (stored in the database).

Correspondingly, the formula for calculating the RID for a given Unix ID is this:

```
			RID = (ID - LOW ID) % RANGE SIZE + DOMAIN RANGE INDEX * RANGE SIZE

```

Where the DOMAIN RANGE INDEX is retrieved from the database along with the domain sid by the RANGE NUMBER = (ID - LOW ID) / RANGE SIZE .

## EXAMPLES
This example shows you the minimal configuration that will work for the principal domain and 19 trusted domains / range extensions.

```
	[global]
	security = ads
	workgroup = CUSTOMER
	realm = CUSTOMER.COM
	idmap config * : backend = autorid
	idmap config * : range = 1000000-1999999

```

This example shows how to configure idmap_autorid as default for all domains with a potentially large amount of users plus a specific configuration for a trusted domain that uses the SFU mapping scheme. Please note that idmap ranges and sfu ranges are not allowed to overlap.

```
	[global]
	security = ads
	workgroup = CUSTOMER
	realm = CUSTOMER.COM
	idmap config * : backend = autorid
	idmap config * : range = 1000000-19999999
	idmap config * : rangesize = 1000000
	idmap config TRUSTED : backend  = ad
	idmap config TRUSTED : range    = 50000 - 99999
	idmap config TRUSTED : schema_mode = sfu

```

## AUTHOR
The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.


title: idmap_hash(8)

summary: DO NOT USE THIS BACKEND

text:
# idmap_hash(8)

## NAME
idmap_hash - DO NOT USE THIS BACKEND

## DESCRIPTION
DO NOT USE THIS PLUGIN The idmap_hash plugin implements a hashing algorithm used to map SIDs for domain users and groups to 31-bit uids and gids, respectively. This plugin also implements the nss_info API and can be used to support a local name mapping files if enabled via the "winbind normalize names" and "winbind nss info" parameters in /etc/samba/smb.conf. The module divides the range into subranges for each domain that is being handled by the idmap config. The module needs the complete UID and GID range to be able to map all SIDs. The lowest value for the range should be the smallest ID available in the system. This is normally 1000. The highest ID should be set to 2147483647. A smaller range will lead to issues because of the hashing algorithm used. The overall range to map all SIDs is 0 - 2147483647. Any range smaller than 0 - 2147483647 will filter some SIDs. As we can normally only start with 1000, we are not able to map 1000 SIDs. This already can lead to issues. The smaller the range the less SIDs can be mapped. We do not recommend to use this plugin. It will be removed in a future release of Samba.

## IDMAP OPTIONS
name_map

Specifies the absolute path to the name mapping file used by the nss_info API. Entries in the file are of the form "unix name = qualified domain name". Mapping of both user and group names is supported.

## EXAMPLES
The following example utilizes the idmap_hash plugin for the idmap and nss_info information.

```
	[global]
	idmap config * : backend = hash
	idmap config * : range = 1000-2147483647
	winbind nss info = hash
	winbind normalize names = yes
	idmap_hash:name_map = /etc/samba/name_map.cfg

```

## AUTHOR
The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.


title: idmap_ldap(8)

summary: Samba\*(Aqs idmap_ldap Backend for Winbind

text:
# idmap_ldap(8)

## NAME
idmap_ldap - Samba's idmap_ldap Backend for Winbind

## DESCRIPTION
The idmap_ldap plugin provides a means for Winbind to store and retrieve SID/uid/gid mapping tables in an LDAP directory service.

In contrast to read only backends like idmap_rid, it is an allocating backend: This means that it needs to allocate new user and group IDs in order to create new mappings.

## IDMAP OPTIONS
ldap_base_dn = DN

Defines the directory base suffix to use for SID/uid/gid mapping entries. If not defined, idmap_ldap will default to using the "ldap idmap suffix" option from /etc/samba/smb.conf.

ldap_user_dn = DN

Defines the user DN to be used for authentication. The secret for authenticating this user should be stored with net idmap secret (see net(8)). If absent, the ldap credentials from the ldap passdb configuration are used, and if these are also absent, an anonymous bind will be performed as last fallback.

ldap_url = ldap://server/

Specifies the LDAP server to use for SID/uid/gid map entries. If not defined, idmap_ldap will assume that ldap://localhost/ should be used.

range = low - high

Defines the available matching uid and gid range for which the backend is authoritative.

## EXAMPLES
The following example shows how an ldap directory is used as the default idmap backend. It also configures the idmap range and base directory suffix. The secret for the ldap_user_dn has to be set with "net idmap secret '*' password".

```
	[global]
	idmap config * : backend      = ldap
	idmap config * : range        = 1000000-1999999
	idmap config * : ldap_url     = ldap://localhost/
	idmap config * : ldap_base_dn = ou=idmap,dc=example,dc=com
	idmap config * : ldap_user_dn = cn=idmap_admin,dc=example,dc=com

```

This example shows how ldap can be used as a readonly backend while tdb is the default backend used to store the mappings. It adds an explicit configuration for some domain DOM1, that uses the ldap idmap backend. Note that a range disjoint from the default range is used.

```
	[global]
	# "backend = tdb" is redundant here since it is the default
	idmap config * : backend = tdb
	idmap config * : range = 1000000-1999999
	idmap config DOM1 : backend = ldap
	idmap config DOM1 : range = 2000000-2999999
	idmap config DOM1 : read only = yes
	idmap config DOM1 : ldap_url = ldap://server/
	idmap config DOM1 : ldap_base_dn = ou=idmap,dc=dom1,dc=example,dc=com
	idmap config DOM1 : ldap_user_dn = cn=idmap_admin,dc=dom1,dc=example,dc=com

```

## NOTE
In order to use authentication against ldap servers you may need to provide a DN and a password. To avoid exposing the password in plain text in the configuration file we store it into a security store. The "net idmap " command is used to store a secret for the DN specified in a specific idmap domain.

## AUTHOR
The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.


title: idmap_nss(8)

summary: Samba\*(Aqs idmap_nss Backend for Winbind

text:
# idmap_nss(8)

## NAME
idmap_nss - Samba's idmap_nss Backend for Winbind

## DESCRIPTION
The idmap_nss plugin provides a means to map Unix users and groups to Windows accounts. This provides a simple means of ensuring that the SID for a Unix user named jsmith is reported as the one assigned to DOMAIN\jsmith which is necessary for reporting ACLs on files and printers stored on a Samba member server.

## EXAMPLES
This example shows how to use idmap_nss to obtain the local account ID's for its own domain (SAMBA) from NSS, whilst allocating new mappings for the default domain (*) and any trusted domains.

```
	[global]
	idmap config * : backend = tdb
	idmap config * : range = 1000000-1999999
	idmap config SAMBA : backend  = nss
	idmap config SAMBA : range = 1000-999999

```

## AUTHOR
The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.


title: idmap_rfc2307(8)

summary: Samba\*(Aqs idmap_rfc2307 Backend for Winbind

text:
# idmap_rfc2307(8)

## NAME
idmap_rfc2307 - Samba's idmap_rfc2307 Backend for Winbind

## DESCRIPTION
The idmap_rfc2307 plugin provides a way for winbind to read id mappings from records in an LDAP server as defined in RFC 2307. The LDAP server can be stand-alone or the LDAP server provided by the AD server. An AD server is always required to provide the mapping between name and SID, and the LDAP server is queried for the mapping between name and uid/gid. This module implements only the "idmap" API, and is READONLY.

Mappings must be provided in advance by the administrator by creating the user accounts in the Active Directory server and the posixAccount and posixGroup objects in the LDAP server. The names in the Active Directory server and in the LDAP server have to be the same.

This id mapping approach allows the reuse of existing LDAP authentication servers that store records in the RFC 2307 format.

When connecting to the LDAP server provided by an AD server, the parameter ldap ssl ads determines whether SSL should be used. When using a stand-alone LDAP server, ldap ssl applies.

## IDMAP OPTIONS
range = low - high

Defines the available matching UID and GID range for which the backend is authoritative. Note that the range acts as a filter. If specified any UID or GID stored in AD that fall outside the range is ignored and the corresponding map is discarded. It is intended as a way to avoid accidental UID/GID overlaps between local and remotely defined IDs.

ldap_server = <ad | stand-alone >

Defines the type of LDAP server to use. This can either be the LDAP server provided by the Active Directory server (ad) or a stand-alone LDAP server.

bind_path_user

Specifies the search base where user objects can be found in the LDAP server.

bind_path_group

Specifies the search base where group objects can be found in the LDAP server.

user_cn = <yes | no>

Query cn attribute instead of uid attribute for the user name in LDAP. This option is not required, the default is no.

realm

Append @realm to cn for groups (and users if user_cn is set) in LDAP queries. This option is not required, the default is not to append the realm.

ldap_domain

When using the LDAP server in the Active Directory server, this allows one to specify the domain where to access the Active Directory server. This allows using trust relationships while keeping all RFC 2307 records in one place. This parameter is optional, the default is to access the AD server in the current domain to query LDAP records.

ldap_url

When using a stand-alone LDAP server, this parameter specifies the ldap URL for accessing the LDAP server.

ldap_user_dn

Defines the user DN to be used for authentication. The secret for authenticating this user should be stored with net idmap secret (see net(8)). If absent, an anonymous bind will be performed.

## EXAMPLES
The following example shows how to retrieve id mappings from a stand-alone LDAP server. This example also shows how to leave a small non conflicting range for local id allocation that may be used in internal backends like BUILTIN.

```
	[global]
	idmap config * : backend = tdb
	idmap config * : range = 1000000-1999999
	idmap config DOMAIN : backend = rfc2307
	idmap config DOMAIN : range = 2000000-2999999
	idmap config DOMAIN : ldap_server = stand-alone
	idmap config DOMAIN : ldap_url = ldap://ldap1.example.com
	idmap config DOMAIN : ldap_user_dn = cn=ldapmanager,dc=example,dc=com
	idmap config DOMAIN : bind_path_user = ou=People,dc=example,dc=com
	idmap config DOMAIN : bind_path_group = ou=Group,dc=example,dc=com

```

## AUTHOR
The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.


title: idmap_rid(8)

summary: Samba\*(Aqs idmap_rid Backend for Winbind

text:
# idmap_rid(8)

## NAME
idmap_rid - Samba's idmap_rid Backend for Winbind

## DESCRIPTION
The idmap_rid backend provides a way to use an algorithmic mapping scheme to map UIDs/GIDs and SIDs. No database is required in this case as the mapping is deterministic.

Currently, there should to be an explicit idmap configuration for each domain that should use the idmap_rid backend, using disjoint ranges.

NOTE: The idmap_rid backend can NOT be used as the default backend. One usually needs to define a writeable default idmap range, using a backend like tdb or ldap that can create unix ids, in order to be able to map the BUILTIN sids and other domains, and also in order to be able to create group mappings. See the example below.

## IDMAP OPTIONS
range = low - high

Defines the available matching uid and gid range for which the backend is authoritative. Note that the range acts as a filter. If algorithmically determined UID or GID fall outside the range, they are ignored and the corresponding map is discarded. It is intended as a way to avoid accidental UID/GID overlaps between local and remotely defined IDs.

base_rid = INTEGER

Defines the base integer used to build SIDs out of a UID or a GID, and to rebase the UID or GID to be obtained from a SID. This means SIDs with a RID less than the base rid are filtered. The default is not to restrict the allowed rids at all, i.e. a base_rid value of 0. Use of this parameter is deprecated.

## THE MAPPING FORMULAS
The Unix ID for a RID is calculated this way:

```
			ID = RID - BASE_RID + LOW_RANGE_ID.

```

Correspondingly, the formula for calculating the RID for a given Unix ID is this:

```
			RID = ID + BASE_RID - LOW_RANGE_ID.

```

## EXAMPLES
This example shows how to configure two domains with idmap_rid, the principal domain and a trusted domain, leaving the default id mapping scheme at tdb. The example also demonstrates the use of the base_rid parameter for the trusted domain.

```
	[global]
	security = domain
	workgroup = MAIN
	idmap config * : backend        = tdb
	idmap config * : range          = 1000000-1999999
	idmap config MAIN : backend     = rid
	idmap config MAIN : range       = 10000 - 49999
	idmap config TRUSTED : backend  = rid
	idmap config TRUSTED : range    = 50000 - 99999
	idmap config TRUSTED : base_rid = 500000

```

## AUTHOR
The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.