1 '\" te 2 .\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved. 3 .\" Copyright 2017, Nexenta Systems, Inc. All Rights Reserved. 4 .\" Copyright 2020, RackTop Systems, Inc. All Rights Reserved. 5 .\" The contents of this file are subject to the terms of the 6 .\" Common Development and Distribution License (the "License"). 7 .\" You may not use this file except in compliance with the License. 8 .\" 9 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 .\" or http://www.opensolaris.org/os/licensing. 11 .\" See the License for the specific language governing permissions 12 .\" and limitations under the License. 13 .\" 14 .\" When distributing Covered Code, include this CDDL HEADER in each 15 .\" file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 .\" If applicable, add the following below this CDDL HEADER, with the 17 .\" fields enclosed by brackets "[]" replaced with your own identifying 18 .\" information: Portions Copyright [yyyy] [name of copyright owner] 19 .\" 20 .TH SMB 4 "Apr 23, 2015" 21 .SH NAME 22 smb \- configuration properties for Solaris CIFS server 23 .SH DESCRIPTION 24 .LP 25 Behavior of the Solaris CIFS server is defined by property values that are 26 stored in the Service Management Facility, \fBsmf\fR(5). 27 .sp 28 .LP 29 An authorized user can use the \fBsharectl\fR(1M) command to set global values 30 for these properties in SMF. 31 .sp 32 .LP 33 The following list describes the properties: 34 .sp 35 .ne 2 36 .na 37 \fB\fBads_site\fR\fR 38 .ad 39 .sp .6 40 .RS 4n 41 Specifies the site configured in DNS to look up Active Directory information. 42 Sites provide a mechanism to partition or delegate administration and policy 43 management, which are typically used in large or complex domains. 44 .sp 45 The value should not be set if you do not have a local Active Directory site. 46 By default, no value is set. 47 .RE 48 49 .sp 50 .ne 2 51 .na 52 \fB\fBautohome_map\fR\fR 53 .ad 54 .sp .6 55 .RS 4n 56 Specifies the full path for the SMD autohome map file, \fBsmbautohome\fR. The 57 default path is \fB/etc\fR. 58 .RE 59 60 .sp 61 .ne 2 62 .na 63 \fB\fBbypass_traverse_checking\fR\fR 64 .ad 65 .sp .6 66 .RS 4n 67 When set, allows the SMB server to bypass ACL "traverse" checks. 68 The default value is \fBtrue\fR, for Windows compatibility. 69 If this parameter is \fBfalse\fR, ACL checks require that 70 "traverse" (directory execute) is granted on every directory 71 above the directory the SMB client tries to access. 72 Windows shares are normally setup with the higher level 73 directories not specifically granting such access. 74 .RE 75 76 .sp 77 .ne 2 78 .na 79 \fB\fBdisposition\fR\fR 80 .ad 81 .sp .6 82 .RS 4n 83 A value that controls whether to disconnect the share or proceed if the map 84 command fails. The disposition property only has meaning when the map property 85 has been set. Otherwise it will have no effect. 86 .sp 87 .in +2 88 .nf 89 disposition = [ continue | terminate ] 90 .fi 91 .in -2 92 .sp 93 94 .sp 95 .ne 2 96 .na 97 \fB\fBcontinue\fR\fR 98 .ad 99 .sp .6 100 .RS 4n 101 Proceed with share connection if the map command fails. This is the default in 102 the event that disposition is not specified. 103 .RE 104 105 .sp 106 .ne 2 107 .na 108 \fB\fBterminate\fR\fR 109 .ad 110 .sp .6 111 .RS 4n 112 Disconnect the share if the map command fails. 113 .RE 114 115 .RE 116 117 .sp 118 .ne 2 119 .na 120 \fB\fBddns_enable\fR\fR 121 .ad 122 .sp .6 123 .RS 4n 124 Enables or disables dynamic DNS updates. A value of \fBtrue\fR enables dynamic 125 updates, while a value of \fBfalse\fR disables dynamic updates. By default, the 126 value is \fBfalse\fR. 127 .RE 128 129 .sp 130 .ne 2 131 .na 132 \fB\fBencrypt\fR\fR 133 .ad 134 .sp .6 135 .RS 4n 136 Controls SMB3 Encryption. For requests on a particular share, the server's 137 behavior is controlled by the stricter of this option and the per-share 138 "encrypt" option. 139 .sp 140 When set to \fBdisabled\fR, the server will not ask clients to encrypt requests. 141 When set to \fBenabled\fR, the server will ask clients to encrypt requests, 142 but will not require that they do so. Any message that can be encrypted 143 will be encrypted. 144 When set to \fBrequired\fR, the server will deny access to or disconnect 145 any client that does not support encryption or fails to encrypt requests 146 that they should. 147 .sp 148 In other words, the \fBenabled\fR behavior is that any message that CAN 149 be encrypted SHOULD be encrypted, while the \fBrequired\fR behavior is that any 150 message that CAN be encrypted MUST be encrypted. 151 .RE 152 153 .sp 154 .ne 2 155 .na 156 \fB\fBencrypt_cipher\fR\fR 157 .ad 158 .sp .6 159 .RS 4n 160 Specifies SMB 3.1.1 Encryption Cipher. This property is only used when 161 encryption is On (see \fBencrypt\fR property) and negotiated SMB dialect 162 is 3.1.1 or higher (see \fBmax_protocol\fR property). Otherwise it is ignored. 163 If the property is not set the default encryption algorith is AES-128-GCM. 164 .sp 165 The property can be set to one of these values: 166 .sp 167 .ne 2 168 .na 169 \fBaes128-ccm\fR 170 .ad 171 .RS 13n 172 AES-128-CCM. This is the only cipher used for SMB 3.0.2 dialect. It is 173 deprecated by AES-128-GCM cipher. 174 .RE 175 176 .sp 177 .ne 2 178 .na 179 \fBaes128-gcm\fR 180 .ad 181 .RS 13n 182 AES-128-GCM. This is default cipher for SMB 3.1.1 dialect. 183 .RE 184 185 .RE 186 187 .sp 188 .ne 2 189 .na 190 \fB\fBipv6_enable\fR\fR 191 .ad 192 .sp .6 193 .RS 4n 194 Enables IPv6 Internet protocol support within the CIFS Service. Valid values 195 are \fBtrue\fR and \fBfalse\fR. The default value is \fBfalse\fR. 196 .RE 197 198 .sp 199 .ne 2 200 .na 201 \fB\fBkeep_alive\fR\fR 202 .ad 203 .sp .6 204 .RS 4n 205 Specifies the number of seconds before an idle SMB connection is dropped by the 206 Solaris CIFS server. If set to 0, idle connections are not dropped. Valid 207 values are 0 and from 20 seconds and above. The default value is 0. 208 .RE 209 210 .sp 211 .ne 2 212 .na 213 \fB\fBlmauth_level\fR\fR 214 .ad 215 .sp .6 216 .RS 4n 217 Specifies the LAN Manager (LM) authentication level. The LM compatibility level 218 controls the type of user authentication to use in workgroup mode or domain 219 mode. The default value is 3. 220 .sp 221 The following describes the behavior at each level. 222 .sp 223 .ne 2 224 .na 225 \fB2\fR 226 .ad 227 .RS 13n 228 In Windows workgroup mode, the Solaris CIFS server accepts LM, NTLM, LMv2, and 229 NTLMv2 requests. In domain mode, the SMB redirector on the Solaris CIFS server 230 sends NTLM requests. 231 .RE 232 233 .sp 234 .ne 2 235 .na 236 \fB3\fR 237 .ad 238 .RS 13n 239 In Windows workgroup mode, the Solaris CIFS server accepts LM, NTLM, LMv2, and 240 NTLMv2 requests. In domain mode, the SMB redirector on the Solaris CIFS server 241 sends LMv2 and NTLMv2 requests. 242 .RE 243 244 .sp 245 .ne 2 246 .na 247 \fB4\fR 248 .ad 249 .RS 13n 250 In Windows workgroup mode, the Solaris CIFS server accepts NTLM, LMv2, and 251 NTLMv2 requests. In domain mode, the SMB redirector on the Solaris CIFS server 252 sends LMv2 and NTLMv2 requests. 253 .RE 254 255 .sp 256 .ne 2 257 .na 258 \fB5\fR 259 .ad 260 .RS 13n 261 In Windows workgroup mode, the Solaris CIFS server accepts LMv2 and NTLMv2 262 requests. In domain mode, the SMB redirector on the Solaris CIFS server sends 263 LMv2 and NTLMv2 requests. 264 .RE 265 266 .RE 267 268 .sp 269 .ne 2 270 .na 271 \fB\fBmap\fR\fR 272 .ad 273 .sp .6 274 .RS 4n 275 The value is a command to be executed when connecting to the share. The command 276 can take the following arguments, which will be substituted when the command is 277 exec'd as described below: 278 .sp 279 .ne 2 280 .na 281 \fB\fB%U\fR\fR 282 .ad 283 .sp .6 284 .RS 4n 285 Windows username. 286 .RE 287 288 .sp 289 .ne 2 290 .na 291 \fB\fB%D\fR\fR 292 .ad 293 .sp .6 294 .RS 4n 295 Name of the domain or workgroup of \fB%U\fR. 296 .RE 297 298 .sp 299 .ne 2 300 .na 301 \fB\fB%h\fR\fR 302 .ad 303 .sp .6 304 .RS 4n 305 The server hostname. 306 .RE 307 308 .sp 309 .ne 2 310 .na 311 \fB\fB%M\fR\fR 312 .ad 313 .sp .6 314 .RS 4n 315 The client hostname, or \fB""\fR if not available. 316 .RE 317 318 .sp 319 .ne 2 320 .na 321 \fB\fB%L\fR\fR 322 .ad 323 .sp .6 324 .RS 4n 325 The server NetBIOS name. 326 .RE 327 328 .sp 329 .ne 2 330 .na 331 \fB\fB%m\fR\fR 332 .ad 333 .sp .6 334 .RS 4n 335 The client NetBIOS name, or \fB""\fR if not available. This option is only 336 valid for NetBIOS connections (port 139). 337 .RE 338 339 .sp 340 .ne 2 341 .na 342 \fB\fB%I\fR\fR 343 .ad 344 .sp .6 345 .RS 4n 346 The IP address of the client machine. 347 .RE 348 349 .sp 350 .ne 2 351 .na 352 \fB\fB%i\fR\fR 353 .ad 354 .sp .6 355 .RS 4n 356 The local IP address to which the client is connected. 357 .RE 358 359 .sp 360 .ne 2 361 .na 362 \fB\fB%S\fR\fR 363 .ad 364 .sp .6 365 .RS 4n 366 The name of the share. 367 .RE 368 369 .sp 370 .ne 2 371 .na 372 \fB\fB%P\fR\fR 373 .ad 374 .sp .6 375 .RS 4n 376 The root directory of the share. 377 .RE 378 379 .sp 380 .ne 2 381 .na 382 \fB\fB%u\fR\fR 383 .ad 384 .sp .6 385 .RS 4n 386 The UID of the Unix user. 387 .RE 388 389 .RE 390 391 .sp 392 .ne 2 393 .na 394 \fB\fBmax_protocol\fR\fR 395 .ad 396 .sp .6 397 .RS 4n 398 Specifies the maximum SMB protocol level that the SMB service 399 should allow clients to negotiate. The default value is \fB2.1\fR. 400 Valid settings include: \fB1\fR, \fB2.1\fR, \fB3.0\fR 401 .RE 402 403 .sp 404 .ne 2 405 .na 406 \fB\fBmin_protocol\fR\fR 407 .ad 408 .sp .6 409 .RS 4n 410 Specifies the minimum SMB protocol level that the SMB service 411 should allow clients to negotiate. The default value is \fB1\fR. 412 Valid settings include: \fB1\fR, \fB2.1\fR, \fB3.0\fR 413 .RE 414 415 .sp 416 .ne 2 417 .na 418 \fB\fBmax_workers\fR\fR 419 .ad 420 .sp .6 421 .RS 4n 422 Specifies the maximum number of worker threads that will be launched to process 423 incoming CIFS requests. The SMB \fBmax_mpx\fR value, which indicates to a 424 client the maximum number of outstanding SMB requests that it may have pending 425 on the server, is derived from the \fBmax_workers\fR value. To ensure 426 compatibility with older versions of Windows the lower 8-bits of \fBmax_mpx\fR 427 must not be zero. If the lower byte of \fBmax_workers\fR is zero, \fB64\fR is 428 added to the value. Thus the minimum value is \fB64\fR and the default value, 429 which appears in \fBsharectl\fR(1M) as \fB1024\fR, is \fB1088\fR. 430 .RE 431 432 .sp 433 .ne 2 434 .na 435 \fB\fBnetbios_scope\fR\fR 436 .ad 437 .sp .6 438 .RS 4n 439 Specifies the NetBIOS scope identifier, which identifies logical NetBIOS 440 networks that are on the same physical network. When you specify a NetBIOS 441 scope identifier, the server filters the number of machines that are listed in 442 the browser display to make it easier to find other hosts. The value is a text 443 string that represents a domain name. By default, no value is set. 444 .RE 445 446 .sp 447 .ne 2 448 .na 449 \fB\fBoplock_enable\fR\fR 450 .ad 451 .sp .6 452 .RS 4n 453 Controls whether "oplocks" may be granted by the SMB server. 454 The term "oplock" is short for "opportunistic lock", which is 455 the legacy name for cache delegations in SMB. 456 By default, oplocks are enabled. 457 Note that if oplocks are disabled, file I/O perfrormance may be 458 severely reduced. 459 .RE 460 461 .sp 462 .ne 2 463 .na 464 \fB\fBpdc\fR\fR 465 .ad 466 .sp .6 467 .RS 4n 468 Specifies the preferred IP address for the domain controller. This property is 469 sometimes used when there are multiple domain controllers to indicate which one 470 is preferred. If the specified domain controller responds, it is chosen even if 471 the other domain controllers are also available. By default, no value is set. 472 .RE 473 474 .sp 475 .ne 2 476 .na 477 \fB\fBrestrict_anonymous\fR\fR 478 .ad 479 .sp .6 480 .RS 4n 481 Disables anonymous access to IPC$, which requires that the client be 482 authenticated to get access to MSRPC services through IPC$. A value of 483 \fBtrue\fR disables anonymous access to IPC$, while a value of \fBfalse\fR 484 enables anonymous access. 485 .RE 486 487 .sp 488 .ne 2 489 .na 490 \fB\fBsigning_enabled\fR\fR 491 .ad 492 .sp .6 493 .RS 4n 494 Enables SMB signing. When signing is enabled but not required it is possible 495 for clients to connect regardless of whether or not the client supports SMB 496 signing. If a packet has been signed, the signature will be verified. If a 497 packet has not been signed it will be accepted without signature verification. 498 Valid values are \fBtrue\fR and \fBfalse\fR. The default value is \fBfalse\fR. 499 .RE 500 501 .sp 502 .ne 2 503 .na 504 \fB\fBsigning_required\fR\fR 505 .ad 506 .sp .6 507 .RS 4n 508 When SMB signing is required, all packets must be signed or they will be 509 rejected, and clients that do not support signing will be unable to connect to 510 the server. The \fBsigning_required\fR setting is only taken into account when 511 \fBsigning_enabled\fR is \fBtrue\fR. Valid values are \fBtrue\fR and 512 \fBfalse\fR. The default value is \fBfalse\fR. 513 .RE 514 515 .sp 516 .ne 2 517 .na 518 \fB\fBsystem_comment\fR\fR 519 .ad 520 .sp .6 521 .RS 4n 522 Specifies an optional description for the system, which is a text string. This 523 property value might appear in various places, such as Network Neighborhood or 524 Network Places on Windows clients. By default, no value is set. 525 .RE 526 527 .sp 528 .ne 2 529 .na 530 \fB\fBtraverse_mounts\fR\fR 531 .ad 532 .sp .6 533 .RS 4n 534 The \fBtraverse_mounts\fR setting determines how the SMB server 535 presents sub-mounts underneath an SMB share. When \fBtraverse_mounts\fR 536 is \fBtrue\fR (the default), sub-mounts are presented to SMB clients 537 like any other subdirectory. When \fBtraverse_mounts\fR is \fBfalse\fR, 538 sub-mounts are not shown to SMB clients. 539 .RE 540 541 .sp 542 .ne 2 543 .na 544 \fB\fBunmap\fR\fR 545 .ad 546 .sp .6 547 .RS 4n 548 The value is a command to be executed when disconnecting the share. The command 549 can take the same substitutions listed on the \fBmap\fR property. 550 .RE 551 552 .sp 553 .ne 2 554 .na 555 \fB\fBwins_exclude\fR\fR 556 .ad 557 .sp .6 558 .RS 4n 559 Specifies a comma-separated list of network interfaces that should not be 560 registered with WINS. NetBIOS host announcements are made on excluded 561 interfaces. 562 .RE 563 564 .sp 565 .ne 2 566 .na 567 \fB\fBwins_server_1\fR\fR 568 .ad 569 .sp .6 570 .RS 4n 571 Specifies the IP address of the primary WINS server. By default, no value is 572 set. 573 .RE 574 575 .sp 576 .ne 2 577 .na 578 \fB\fBwins_server_2\fR\fR 579 .ad 580 .sp .6 581 .RS 4n 582 Specifies the IP address of the secondary WINS server. By default, no value is 583 set. 584 .RE 585 586 .SH ATTRIBUTES 587 .LP 588 See the \fBattributes\fR(5) man page for descriptions of the following 589 attributes: 590 .sp 591 592 .sp 593 .TS 594 box; 595 c | c 596 l | l . 597 ATTRIBUTE TYPE ATTRIBUTE VALUE 598 _ 599 Interface Stability Uncommitted 600 .TE 601 602 .SH SEE ALSO 603 .LP 604 \fBsharectl\fR(1M), \fBsmbadm\fR(1M), \fBsmbd\fR(1M), \fBsmbstat\fR(1M), 605 \fBattributes\fR(5), \fBsmf\fR(5)