1 '\" te
   2 .\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved.
   3 .\" Copyright 2017, Nexenta Systems, Inc. All Rights Reserved.
   4 .\" The contents of this file are subject to the terms of the
   5 .\" Common Development and Distribution License (the "License").
   6 .\" You may not use this file except in compliance with the License.
   7 .\"
   8 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9 .\" or http://www.opensolaris.org/os/licensing.
  10 .\" See the License for the specific language governing permissions
  11 .\" and limitations under the License.
  12 .\"
  13 .\" When distributing Covered Code, include this CDDL HEADER in each
  14 .\" file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15 .\" If applicable, add the following below this CDDL HEADER, with the
  16 .\" fields enclosed by brackets "[]" replaced with your own identifying
  17 .\" information: Portions Copyright [yyyy] [name of copyright owner]
  18 .\"
  19 .TH SMB 4 "Apr 23, 2015"
  20 .SH NAME
  21 smb \- configuration properties for Solaris CIFS server
  22 .SH DESCRIPTION
  23 .LP
  24 Behavior of the Solaris CIFS server is defined by property values that are
  25 stored in the Service Management Facility, \fBsmf\fR(5).
  26 .sp
  27 .LP
  28 An authorized user can use the \fBsharectl\fR(1M) command to set global values
  29 for these properties in SMF.
  30 .sp
  31 .LP
  32 The following list describes the properties:
  33 .sp
  34 .ne 2
  35 .na
  36 \fB\fBads_site\fR\fR
  37 .ad
  38 .sp .6
  39 .RS 4n
  40 Specifies the site configured in DNS to look up Active Directory information.
  41 Sites provide a mechanism to partition or delegate administration and policy
  42 management, which are typically used in large or complex domains.
  43 .sp
  44 The value should not be set if you do not have a local Active Directory site.
  45 By default, no value is set.
  46 .RE
  47 
  48 .sp
  49 .ne 2
  50 .na
  51 \fB\fBautohome_map\fR\fR
  52 .ad
  53 .sp .6
  54 .RS 4n
  55 Specifies the full path for the SMD autohome map file, \fBsmbautohome\fR. The
  56 default path is \fB/etc\fR.
  57 .RE
  58 
  59 .sp
  60 .ne 2
  61 .na
  62 \fB\fBbypass_traverse_checking\fR\fR
  63 .ad
  64 .sp .6
  65 .RS 4n
  66 When set, allows the SMB server to bypass ACL "traverse" checks.
  67 The default value is \fBtrue\fR, for Windows compatibility.
  68 If this parameter is \fBfalse\fR, ACL checks require that
  69 "traverse" (directory execute) is granted on every directory
  70 above the directory the SMB client tries to access.
  71 Windows shares are normally setup with the higher level
  72 directories not specifically granting such access.
  73 .RE
  74 
  75 .sp
  76 .ne 2
  77 .na
  78 \fB\fBdisposition\fR\fR
  79 .ad
  80 .sp .6
  81 .RS 4n
  82 A value that controls whether to disconnect the share or proceed if the map
  83 command fails. The disposition property only has meaning when the map property
  84 has been set. Otherwise it will have no effect.
  85 .sp
  86 .in +2
  87 .nf
  88 disposition = [ continue | terminate ]
  89 .fi
  90 .in -2
  91 .sp
  92 
  93 .sp
  94 .ne 2
  95 .na
  96 \fB\fBcontinue\fR\fR
  97 .ad
  98 .sp .6
  99 .RS 4n
 100 Proceed with share connection if the map command fails. This is the default in
 101 the event that disposition is not specified.
 102 .RE
 103 
 104 .sp
 105 .ne 2
 106 .na
 107 \fB\fBterminate\fR\fR
 108 .ad
 109 .sp .6
 110 .RS 4n
 111 Disconnect the share if the map command fails.
 112 .RE
 113 
 114 .RE
 115 
 116 .sp
 117 .ne 2
 118 .na
 119 \fB\fBddns_enable\fR\fR
 120 .ad
 121 .sp .6
 122 .RS 4n
 123 Enables or disables dynamic DNS updates. A value of \fBtrue\fR enables dynamic
 124 updates, while a value of \fBfalse\fR disables dynamic updates. By default, the
 125 value is \fBfalse\fR.
 126 .RE
 127 
 128 .sp
 129 .ne 2
 130 .na
 131 \fB\fBencrypt\fR\fR
 132 .ad
 133 .sp .6
 134 .RS 4n
 135 Controls SMB3 Encryption. For requests on a particular share, the server's
 136 behavior is controlled by the stricter of this option and the per-share
 137 "encrypt" option.
 138 .sp
 139 When set to \fBdisabled\fR, the server will not ask clients to encrypt requests.
 140 When set to \fBenabled\fR, the server will ask clients to encrypt requests,
 141 but will not require that they do so. Any message that can be encrypted
 142 will be encrypted.
 143 When set to \fBrequired\fR, the server will deny access to or disconnect
 144 any client that does not support encryption or fails to encrypt requests
 145 that they should.
 146 .sp
 147 In other words, the \fBenabled\fR behavior is that any message that CAN
 148 be encrypted SHOULD be encrypted, while the \fBrequired\fR behavior is that any
 149 message that CAN be encrypted MUST be encrypted.
 150 .RE
 151 
 152 .sp
 153 .ne 2
 154 .na
 155 \fB\fBipv6_enable\fR\fR
 156 .ad
 157 .sp .6
 158 .RS 4n
 159 Enables IPv6 Internet protocol support within the CIFS Service. Valid values
 160 are \fBtrue\fR and \fBfalse\fR. The default value is \fBfalse\fR.
 161 .RE
 162 
 163 .sp
 164 .ne 2
 165 .na
 166 \fB\fBkeep_alive\fR\fR
 167 .ad
 168 .sp .6
 169 .RS 4n
 170 Specifies the number of seconds before an idle SMB connection is dropped by the
 171 Solaris CIFS server. If set to 0, idle connections are not dropped. Valid
 172 values are 0 and from 20 seconds and above. The default value is 0.
 173 .RE
 174 
 175 .sp
 176 .ne 2
 177 .na
 178 \fB\fBlmauth_level\fR\fR
 179 .ad
 180 .sp .6
 181 .RS 4n
 182 Specifies the LAN Manager (LM) authentication level. The LM compatibility level
 183 controls the type of user authentication to use in workgroup mode or domain
 184 mode. The default value is 3.
 185 .sp
 186 The following describes the behavior at each level.
 187 .sp
 188 .ne 2
 189 .na
 190 \fB2\fR
 191 .ad
 192 .RS 13n
 193 In Windows workgroup mode, the Solaris CIFS server accepts LM, NTLM, LMv2, and
 194 NTLMv2 requests. In domain mode, the SMB redirector on the Solaris CIFS server
 195 sends NTLM requests.
 196 .RE
 197 
 198 .sp
 199 .ne 2
 200 .na
 201 \fB3\fR
 202 .ad
 203 .RS 13n
 204 In Windows workgroup mode, the Solaris CIFS server accepts LM, NTLM, LMv2, and
 205 NTLMv2 requests. In domain mode, the SMB redirector on the Solaris CIFS server
 206 sends LMv2 and NTLMv2 requests.
 207 .RE
 208 
 209 .sp
 210 .ne 2
 211 .na
 212 \fB4\fR
 213 .ad
 214 .RS 13n
 215 In Windows workgroup mode, the Solaris CIFS server accepts NTLM, LMv2, and
 216 NTLMv2 requests. In domain mode, the SMB redirector on the Solaris CIFS server
 217 sends LMv2 and NTLMv2 requests.
 218 .RE
 219 
 220 .sp
 221 .ne 2
 222 .na
 223 \fB5\fR
 224 .ad
 225 .RS 13n
 226 In Windows workgroup mode, the Solaris CIFS server accepts LMv2 and NTLMv2
 227 requests. In domain mode, the SMB redirector on the Solaris CIFS server sends
 228 LMv2 and NTLMv2 requests.
 229 .RE
 230 
 231 .RE
 232 
 233 .sp
 234 .ne 2
 235 .na
 236 \fB\fBmap\fR\fR
 237 .ad
 238 .sp .6
 239 .RS 4n
 240 The value is a command to be executed when connecting to the share. The command
 241 can take the following arguments, which will be substituted when the command is
 242 exec'd as described below:
 243 .sp
 244 .ne 2
 245 .na
 246 \fB\fB%U\fR\fR
 247 .ad
 248 .sp .6
 249 .RS 4n
 250 Windows username.
 251 .RE
 252 
 253 .sp
 254 .ne 2
 255 .na
 256 \fB\fB%D\fR\fR
 257 .ad
 258 .sp .6
 259 .RS 4n
 260 Name of the domain or workgroup of \fB%U\fR.
 261 .RE
 262 
 263 .sp
 264 .ne 2
 265 .na
 266 \fB\fB%h\fR\fR
 267 .ad
 268 .sp .6
 269 .RS 4n
 270 The server hostname.
 271 .RE
 272 
 273 .sp
 274 .ne 2
 275 .na
 276 \fB\fB%M\fR\fR
 277 .ad
 278 .sp .6
 279 .RS 4n
 280 The client hostname, or \fB""\fR if not available.
 281 .RE
 282 
 283 .sp
 284 .ne 2
 285 .na
 286 \fB\fB%L\fR\fR
 287 .ad
 288 .sp .6
 289 .RS 4n
 290 The server NetBIOS name.
 291 .RE
 292 
 293 .sp
 294 .ne 2
 295 .na
 296 \fB\fB%m\fR\fR
 297 .ad
 298 .sp .6
 299 .RS 4n
 300 The client NetBIOS name, or \fB""\fR if not available. This option is only
 301 valid for NetBIOS connections (port 139).
 302 .RE
 303 
 304 .sp
 305 .ne 2
 306 .na
 307 \fB\fB%I\fR\fR
 308 .ad
 309 .sp .6
 310 .RS 4n
 311 The IP address of the client machine.
 312 .RE
 313 
 314 .sp
 315 .ne 2
 316 .na
 317 \fB\fB%i\fR\fR
 318 .ad
 319 .sp .6
 320 .RS 4n
 321 The local IP address to which the client is connected.
 322 .RE
 323 
 324 .sp
 325 .ne 2
 326 .na
 327 \fB\fB%S\fR\fR
 328 .ad
 329 .sp .6
 330 .RS 4n
 331 The name of the share.
 332 .RE
 333 
 334 .sp
 335 .ne 2
 336 .na
 337 \fB\fB%P\fR\fR
 338 .ad
 339 .sp .6
 340 .RS 4n
 341 The root directory of the share.
 342 .RE
 343 
 344 .sp
 345 .ne 2
 346 .na
 347 \fB\fB%u\fR\fR
 348 .ad
 349 .sp .6
 350 .RS 4n
 351 The UID of the Unix user.
 352 .RE
 353 
 354 .RE
 355 
 356 .sp
 357 .ne 2
 358 .na
 359 \fB\fBmax_protocol\fR\fR
 360 .ad
 361 .sp .6
 362 .RS 4n
 363 Specifies the maximum SMB protocol level that the SMB service
 364 should allow clients to negotiate.  The default value is \fB2.1\fR.
 365 Valid settings include: \fB1\fR, \fB2.1\fR, \fB3.0\fR
 366 .RE
 367 
 368 .sp
 369 .ne 2
 370 .na
 371 \fB\fBmin_protocol\fR\fR
 372 .ad
 373 .sp .6
 374 .RS 4n
 375 Specifies the minimum SMB protocol level that the SMB service
 376 should allow clients to negotiate.  The default value is \fB1\fR.
 377 Valid settings include: \fB1\fR, \fB2.1\fR, \fB3.0\fR
 378 .RE
 379 
 380 .sp
 381 .ne 2
 382 .na
 383 \fB\fBmax_workers\fR\fR
 384 .ad
 385 .sp .6
 386 .RS 4n
 387 Specifies the maximum number of worker threads that will be launched to process
 388 incoming CIFS requests. The SMB \fBmax_mpx\fR value, which indicates to a
 389 client the maximum number of outstanding SMB requests that it may have pending
 390 on the server, is derived from the \fBmax_workers\fR value. To ensure
 391 compatibility with older versions of Windows the lower 8-bits of \fBmax_mpx\fR
 392 must not be zero. If the lower byte of \fBmax_workers\fR is zero, \fB64\fR is
 393 added to the value. Thus the minimum value is \fB64\fR and the default value,
 394 which appears in \fBsharectl\fR(1M) as \fB1024\fR, is \fB1088\fR.
 395 .RE
 396 
 397 .sp
 398 .ne 2
 399 .na
 400 \fB\fBnetbios_scope\fR\fR
 401 .ad
 402 .sp .6
 403 .RS 4n
 404 Specifies the NetBIOS scope identifier, which identifies logical NetBIOS
 405 networks that are on the same physical network. When you specify a NetBIOS
 406 scope identifier, the server filters the number of machines that are listed in
 407 the browser display to make it easier to find other hosts. The value is a text
 408 string that represents a domain name. By default, no value is set.
 409 .RE
 410 
 411 .sp
 412 .ne 2
 413 .na
 414 \fB\fBoplock_enable\fR\fR
 415 .ad
 416 .sp .6
 417 .RS 4n
 418 Controls whether "oplocks" may be granted by the SMB server.
 419 The term "oplock" is short for "opportunistic lock", which is
 420 the legacy name for cache delegations in SMB.
 421 By default, oplocks are enabled.
 422 Note that if oplocks are disabled, file I/O perfrormance may be
 423 severely reduced.
 424 .RE
 425 
 426 .sp
 427 .ne 2
 428 .na
 429 \fB\fBpdc\fR\fR
 430 .ad
 431 .sp .6
 432 .RS 4n
 433 Specifies the preferred IP address for the domain controller. This property is
 434 sometimes used when there are multiple domain controllers to indicate which one
 435 is preferred. If the specified domain controller responds, it is chosen even if
 436 the other domain controllers are also available. By default, no value is set.
 437 .RE
 438 
 439 .sp
 440 .ne 2
 441 .na
 442 \fB\fBrestrict_anonymous\fR\fR
 443 .ad
 444 .sp .6
 445 .RS 4n
 446 Disables anonymous access to IPC$, which requires that the client be
 447 authenticated to get access to MSRPC services through IPC$. A value of
 448 \fBtrue\fR disables anonymous access to IPC$, while a value of \fBfalse\fR
 449 enables anonymous access.
 450 .RE
 451 
 452 .sp
 453 .ne 2
 454 .na
 455 \fB\fBsigning_enabled\fR\fR
 456 .ad
 457 .sp .6
 458 .RS 4n
 459 Enables SMB signing. When signing is enabled but not required it is possible
 460 for clients to connect regardless of whether or not the client supports SMB
 461 signing. If a packet has been signed, the signature will be verified. If a
 462 packet has not been signed it will be accepted without signature verification.
 463 Valid values are \fBtrue\fR and \fBfalse\fR. The default value is \fBfalse\fR.
 464 .RE
 465 
 466 .sp
 467 .ne 2
 468 .na
 469 \fB\fBsigning_required\fR\fR
 470 .ad
 471 .sp .6
 472 .RS 4n
 473 When SMB signing is required, all packets must be signed or they will be
 474 rejected, and clients that do not support signing will be unable to connect to
 475 the server. The \fBsigning_required\fR setting is only taken into account when
 476 \fBsigning_enabled\fR is \fBtrue\fR. Valid values are \fBtrue\fR and
 477 \fBfalse\fR. The default value is \fBfalse\fR.
 478 .RE
 479 
 480 .sp
 481 .ne 2
 482 .na
 483 \fB\fBsystem_comment\fR\fR
 484 .ad
 485 .sp .6
 486 .RS 4n
 487 Specifies an optional description for the system, which is a text string. This
 488 property value might appear in various places, such as Network Neighborhood or
 489 Network Places on Windows clients. By default, no value is set.
 490 .RE
 491 
 492 .sp
 493 .ne 2
 494 .na
 495 \fB\fBtraverse_mounts\fR\fR
 496 .ad
 497 .sp .6
 498 .RS 4n
 499 The \fBtraverse_mounts\fR setting determines how the SMB server
 500 presents sub-mounts underneath an SMB share.  When \fBtraverse_mounts\fR
 501 is \fBtrue\fR (the default), sub-mounts are presented to SMB clients
 502 like any other subdirectory.   When \fBtraverse_mounts\fR is \fBfalse\fR,
 503 sub-mounts are not shown to SMB clients.
 504 .RE
 505 
 506 .sp
 507 .ne 2
 508 .na
 509 \fB\fBunmap\fR\fR
 510 .ad
 511 .sp .6
 512 .RS 4n
 513 The value is a command to be executed when disconnecting the share. The command
 514 can take the same substitutions listed on the \fBmap\fR property.
 515 .RE
 516 
 517 .sp
 518 .ne 2
 519 .na
 520 \fB\fBwins_exclude\fR\fR
 521 .ad
 522 .sp .6
 523 .RS 4n
 524 Specifies a comma-separated list of network interfaces that should not be
 525 registered with WINS. NetBIOS host announcements are made on excluded
 526 interfaces.
 527 .RE
 528 
 529 .sp
 530 .ne 2
 531 .na
 532 \fB\fBwins_server_1\fR\fR
 533 .ad
 534 .sp .6
 535 .RS 4n
 536 Specifies the IP address of the primary WINS server. By default, no value is
 537 set.
 538 .RE
 539 
 540 .sp
 541 .ne 2
 542 .na
 543 \fB\fBwins_server_2\fR\fR
 544 .ad
 545 .sp .6
 546 .RS 4n
 547 Specifies the IP address of the secondary WINS server. By default, no value is
 548 set.
 549 .RE
 550 
 551 .SH ATTRIBUTES
 552 .LP
 553 See the \fBattributes\fR(5) man page for descriptions of the following
 554 attributes:
 555 .sp
 556 
 557 .sp
 558 .TS
 559 box;
 560 c | c
 561 l | l .
 562 ATTRIBUTE TYPE  ATTRIBUTE VALUE
 563 _
 564 Interface Stability     Uncommitted
 565 .TE
 566 
 567 .SH SEE ALSO
 568 .LP
 569 \fBsharectl\fR(1M), \fBsmbadm\fR(1M), \fBsmbd\fR(1M), \fBsmbstat\fR(1M),
 570 \fBattributes\fR(5), \fBsmf\fR(5)