14.1 Configuring the Server

The central Samba configuration file is smb.conf , and it is usually located in Samba's lib directory (for example, /usr/local/lib ). However, some distributions put the configuration file in an etc directory, such as /etc/samba or /usr/local/etc . The smb.conf file breaks down into several sections denoted with square brackets (such as [global] and [printers] ).

The [global] section in smb.conf contains general options that apply to the entire server and all shares. These options pertain primarily to network configuration and access control. Here is a sample [global] section that shows you how to set the server name , description, and workgroup:

 [global]   # server name   netbios name =  name  # server description   server string = My server via Samba   # workgroup   workgroup = MYNETWORK

These parameters work as follows :

netbios name The server name. If you omit this parameter, Samba uses the Unix hostname.
server string A short description of the server. The default is the Samba version number.
workgroup The SMB workgroup name. If you're on a Windows NT domain, set this parameter to the name of your domain.

14.1.1 Server Access Control

There are a few options that you can add to your smb.conf file to put limits on the machines and users that can access your Samba server. The following list includes many options that you can set in your [global] section, as well as in the other sections that control individual shares (described later in the chapter):

interfaces Set this to have Samba listen on the given networks or interfaces. Here are two examples:
```
 interfaces = 10.23.2.0/255.255.255.0     interfaces = eth0 
```
bind interfaces only Set this to yes when using the interfaces parameter in order to limit access to machines that you can reach on those interfaces.
valid users Set this to allow the given users access. For example:
```
 valid users = jruser, bill 
```
guest ok Set this parameter to true if you would like a share to be available to anonymous users on the network.
guest only Set this parameter to true to allow anonymous access only.
browseable Set this to make shares available in Samba's browseable share list. If you set this parameter to no for any or all shares, you will still be able to access shares on the Samba server, but they will not be browseable, and therefore you will need to know their exact names .

14.1.2 Passwords

In general, you only want to allow access to your Samba server with password authentication. Unfortunately, the basic password system on Unix is different than that on Windows, so unless you specify clear-text network passwords or authenticate passwords with a Windows server, you must set up an alternative password file. This section shows you how.

Assuming that your Samba configuration directory is /etc/samba , you can use these entries in your [global] section to define the Samba password file as /etc/samba/passwd_smb :

 # use a separate password file for Samba to enable encrypted passwords    security = user    encrypt passwords = yes    smb passwd file = /etc/samba/passwd_smb

With these lines in place, you can manipulate the passwd_smb password file with the smbpasswd program.

Note

If you have access to a Windows NT domain, you can set security = domain , to make Samba use the domain's usernames and eliminate the need for an SMB password file. However, in order for domain users to access the machine running Samba, each domain user must have a local account with the same username on the machine running Samba.

Adding and Deleting Users

The first thing you need to do in order to give a Windows user access to your Samba server is to add the user to the passwd_smb file with the smbpasswd -a command:

 smbpasswd -a  username

The username parameter to the smbpasswd command must be a valid username on your Linux system.

Much like the regular system's passwd program would, smbpasswd asks you to enter the new user's password twice. If the Samba password file does not exist, smbpasswd creates it for you, then confirms that it has created the new user.

To remove a user, use the -x option to smbpasswd :

 smbpasswd -x  username

At times, you may not necessarily want to delete a user, but rather, temporarily deactivate the user. The -d option disables a user; and -e re-enables the user:

 smbpasswd -d  username  smbpasswd -e  username

Changing Passwords

You can change a Samba password as the superuser by using smbpasswd with no options or keywords other than the username:

 smbpasswd  username

However, if the Samba server is running, any user can change their own Samba password by entering smbpasswd by itself on the command line.