1 '\" te
   2 .\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved.
   3 .\" Copyright 2017, Nexenta Systems, Inc. All Rights Reserved.
   4 .\" The contents of this file are subject to the terms of the
   5 .\" Common Development and Distribution License (the "License").
   6 .\" You may not use this file except in compliance with the License.
   7 .\"
   8 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9 .\" or http://www.opensolaris.org/os/licensing.
  10 .\" See the License for the specific language governing permissions
  11 .\" and limitations under the License.
  12 .\"
  13 .\" When distributing Covered Code, include this CDDL HEADER in each
  14 .\" file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15 .\" If applicable, add the following below this CDDL HEADER, with the
  16 .\" fields enclosed by brackets "[]" replaced with your own identifying
  17 .\" information: Portions Copyright [yyyy] [name of copyright owner]
  18 .\"
  19 .TH SMB 4 "May 16, 2020"
  20 .SH NAME
  21 smb \- configuration properties for Solaris CIFS server
  22 .SH DESCRIPTION
  23 Behavior of the Solaris CIFS server is defined by property values that are
  24 stored in the Service Management Facility, \fBsmf\fR(5).
  25 .sp
  26 .LP
  27 An authorized user can use the \fBsharectl\fR(1M) command to set global values
  28 for these properties in SMF.
  29 .sp
  30 .LP
  31 The following list describes the properties:
  32 .sp
  33 .ne 2
  34 .na
  35 \fB\fBads_site\fR\fR
  36 .ad
  37 .sp .6
  38 .RS 4n
  39 Specifies the site configured in DNS to look up Active Directory information.
  40 Sites provide a mechanism to partition or delegate administration and policy
  41 management, which are typically used in large or complex domains.
  42 .sp
  43 The value should not be set if you do not have a local Active Directory site.
  44 By default, no value is set.
  45 .RE
  46 
  47 .sp
  48 .ne 2
  49 .na
  50 \fB\fBautohome_map\fR\fR
  51 .ad
  52 .sp .6
  53 .RS 4n
  54 Specifies the full path for the SMD autohome map file, \fBsmbautohome\fR. The
  55 default path is \fB/etc\fR.
  56 .RE
  57 
  58 .sp
  59 .ne 2
  60 .na
  61 \fB\fBbypass_traverse_checking\fR\fR
  62 .ad
  63 .sp .6
  64 .RS 4n
  65 When set, allows the SMB server to bypass ACL "traverse" checks.
  66 The default value is \fBtrue\fR, for Windows compatibility.
  67 If this parameter is \fBfalse\fR, ACL checks require that
  68 "traverse" (directory execute) is granted on every directory
  69 above the directory the SMB client tries to access.
  70 Windows shares are normally setup with the higher level
  71 directories not specifically granting such access.
  72 .RE
  73 
  74 .sp
  75 .ne 2
  76 .na
  77 \fB\fBdisposition\fR\fR
  78 .ad
  79 .sp .6
  80 .RS 4n
  81 A value that controls whether to disconnect the share or proceed if the map
  82 command fails. The disposition property only has meaning when the map property
  83 has been set. Otherwise it will have no effect.
  84 .sp
  85 .in +2
  86 .nf
  87 disposition = [ continue | terminate ]
  88 .fi
  89 .in -2
  90 .sp
  91 
  92 .sp
  93 .ne 2
  94 .na
  95 \fB\fBcontinue\fR\fR
  96 .ad
  97 .sp .6
  98 .RS 4n
  99 Proceed with share connection if the map command fails. This is the default in
 100 the event that disposition is not specified.
 101 .RE
 102 
 103 .sp
 104 .ne 2
 105 .na
 106 \fB\fBterminate\fR\fR
 107 .ad
 108 .sp .6
 109 .RS 4n
 110 Disconnect the share if the map command fails.
 111 .RE
 112 
 113 .RE
 114 
 115 .sp
 116 .ne 2
 117 .na
 118 \fB\fBddns_enable\fR\fR
 119 .ad
 120 .sp .6
 121 .RS 4n
 122 Enables or disables dynamic DNS updates. A value of \fBtrue\fR enables dynamic
 123 updates, while a value of \fBfalse\fR disables dynamic updates. By default, the
 124 value is \fBfalse\fR.
 125 .RE
 126 
 127 .sp
 128 .ne 2
 129 .na
 130 \fB\fBencrypt\fR\fR
 131 .ad
 132 .sp .6
 133 .RS 4n
 134 Controls SMB3 Encryption. For requests on a particular share, the server's
 135 behavior is controlled by the stricter of this option and the per-share
 136 "encrypt" option.
 137 .sp
 138 When set to \fBdisabled\fR, the server will not ask clients to encrypt requests.
 139 When set to \fBenabled\fR, the server will ask clients to encrypt requests,
 140 but will not require that they do so. Any message that can be encrypted
 141 will be encrypted.
 142 When set to \fBrequired\fR, the server will deny access to or disconnect
 143 any client that does not support encryption or fails to encrypt requests
 144 that they should.
 145 .sp
 146 In other words, the \fBenabled\fR behavior is that any message that CAN
 147 be encrypted SHOULD be encrypted, while the \fBrequired\fR behavior is that any
 148 message that CAN be encrypted MUST be encrypted.
 149 .RE
 150 
 151 .sp
 152 .ne 2
 153 .na
 154 \fB\fBipv6_enable\fR\fR
 155 .ad
 156 .sp .6
 157 .RS 4n
 158 Enables IPv6 Internet protocol support within the CIFS Service. Valid values
 159 are \fBtrue\fR and \fBfalse\fR. The default value is \fBfalse\fR.
 160 .RE
 161 
 162 .sp
 163 .ne 2
 164 .na
 165 \fB\fBkeep_alive\fR\fR
 166 .ad
 167 .sp .6
 168 .RS 4n
 169 Specifies the number of seconds before an idle SMB connection is dropped by the
 170 Solaris CIFS server. If set to 0, idle connections are not dropped. Valid
 171 values are 0 and from 20 seconds and above. The default value is 0.
 172 .RE
 173 
 174 .sp
 175 .ne 2
 176 .na
 177 \fB\fBlmauth_level\fR\fR
 178 .ad
 179 .sp .6
 180 .RS 4n
 181 Specifies the LAN Manager (LM) authentication level. The LM compatibility level
 182 controls the type of user authentication to use in workgroup mode or domain
 183 mode. The default value is 3.
 184 .sp
 185 The following describes the behavior at each level.
 186 .sp
 187 .ne 2
 188 .na
 189 \fB2\fR
 190 .ad
 191 .RS 13n
 192 In Windows workgroup mode, the Solaris CIFS server accepts LM, NTLM, LMv2, and
 193 NTLMv2 requests. In domain mode, the SMB redirector on the Solaris CIFS server
 194 sends NTLM requests.
 195 .RE
 196 
 197 .sp
 198 .ne 2
 199 .na
 200 \fB3\fR
 201 .ad
 202 .RS 13n
 203 In Windows workgroup mode, the Solaris CIFS server accepts LM, NTLM, LMv2, and
 204 NTLMv2 requests. In domain mode, the SMB redirector on the Solaris CIFS server
 205 sends LMv2 and NTLMv2 requests.
 206 .RE
 207 
 208 .sp
 209 .ne 2
 210 .na
 211 \fB4\fR
 212 .ad
 213 .RS 13n
 214 In Windows workgroup mode, the Solaris CIFS server accepts NTLM, LMv2, and
 215 NTLMv2 requests. In domain mode, the SMB redirector on the Solaris CIFS server
 216 sends LMv2 and NTLMv2 requests.
 217 .RE
 218 
 219 .sp
 220 .ne 2
 221 .na
 222 \fB5\fR
 223 .ad
 224 .RS 13n
 225 In Windows workgroup mode, the Solaris CIFS server accepts LMv2 and NTLMv2
 226 requests. In domain mode, the SMB redirector on the Solaris CIFS server sends
 227 LMv2 and NTLMv2 requests.
 228 .RE
 229 
 230 .RE
 231 
 232 .sp
 233 .ne 2
 234 .na
 235 \fB\fBmap\fR\fR
 236 .ad
 237 .sp .6
 238 .RS 4n
 239 The value is a command to be executed when connecting to the share. The command
 240 can take the following arguments, which will be substituted when the command is
 241 exec'd as described below:
 242 .sp
 243 .ne 2
 244 .na
 245 \fB\fB%U\fR\fR
 246 .ad
 247 .sp .6
 248 .RS 4n
 249 Windows username.
 250 .RE
 251 
 252 .sp
 253 .ne 2
 254 .na
 255 \fB\fB%D\fR\fR
 256 .ad
 257 .sp .6
 258 .RS 4n
 259 Name of the domain or workgroup of \fB%U\fR.
 260 .RE
 261 
 262 .sp
 263 .ne 2
 264 .na
 265 \fB\fB%h\fR\fR
 266 .ad
 267 .sp .6
 268 .RS 4n
 269 The server hostname.
 270 .RE
 271 
 272 .sp
 273 .ne 2
 274 .na
 275 \fB\fB%M\fR\fR
 276 .ad
 277 .sp .6
 278 .RS 4n
 279 The client hostname, or \fB""\fR if not available.
 280 .RE
 281 
 282 .sp
 283 .ne 2
 284 .na
 285 \fB\fB%L\fR\fR
 286 .ad
 287 .sp .6
 288 .RS 4n
 289 The server NetBIOS name.
 290 .RE
 291 
 292 .sp
 293 .ne 2
 294 .na
 295 \fB\fB%m\fR\fR
 296 .ad
 297 .sp .6
 298 .RS 4n
 299 The client NetBIOS name, or \fB""\fR if not available. This option is only
 300 valid for NetBIOS connections (port 139).
 301 .RE
 302 
 303 .sp
 304 .ne 2
 305 .na
 306 \fB\fB%I\fR\fR
 307 .ad
 308 .sp .6
 309 .RS 4n
 310 The IP address of the client machine.
 311 .RE
 312 
 313 .sp
 314 .ne 2
 315 .na
 316 \fB\fB%i\fR\fR
 317 .ad
 318 .sp .6
 319 .RS 4n
 320 The local IP address to which the client is connected.
 321 .RE
 322 
 323 .sp
 324 .ne 2
 325 .na
 326 \fB\fB%S\fR\fR
 327 .ad
 328 .sp .6
 329 .RS 4n
 330 The name of the share.
 331 .RE
 332 
 333 .sp
 334 .ne 2
 335 .na
 336 \fB\fB%P\fR\fR
 337 .ad
 338 .sp .6
 339 .RS 4n
 340 The root directory of the share.
 341 .RE
 342 
 343 .sp
 344 .ne 2
 345 .na
 346 \fB\fB%u\fR\fR
 347 .ad
 348 .sp .6
 349 .RS 4n
 350 The UID of the Unix user.
 351 .RE
 352 
 353 .RE
 354 
 355 .sp
 356 .ne 2
 357 .na
 358 \fB\fBmax_protocol\fR\fR
 359 .ad
 360 .sp .6
 361 .RS 4n
 362 Specifies the maximum SMB protocol level that the SMB service
 363 should allow clients to negotiate.  The default value is \fB2.1\fR.
 364 Valid settings include: \fB1\fR, \fB2.1\fR, \fB3.0\fR
 365 .RE
 366 
 367 .sp
 368 .ne 2
 369 .na
 370 \fB\fBmin_protocol\fR\fR
 371 .ad
 372 .sp .6
 373 .RS 4n
 374 Specifies the minimum SMB protocol level that the SMB service
 375 should allow clients to negotiate.  The default value is \fB1\fR.
 376 Valid settings include: \fB1\fR, \fB2.1\fR, \fB3.0\fR
 377 .RE
 378 
 379 .sp
 380 .ne 2
 381 .na
 382 \fB\fBmax_workers\fR\fR
 383 .ad
 384 .sp .6
 385 .RS 4n
 386 Specifies the maximum number of worker threads that will be launched to process
 387 incoming CIFS requests. The SMB \fBmax_mpx\fR value, which indicates to a
 388 client the maximum number of outstanding SMB requests that it may have pending
 389 on the server, is derived from the \fBmax_workers\fR value. To ensure
 390 compatibility with older versions of Windows the lower 8-bits of \fBmax_mpx\fR
 391 must not be zero. If the lower byte of \fBmax_workers\fR is zero, \fB64\fR is
 392 added to the value. Thus the minimum value is \fB64\fR and the default value,
 393 which appears in \fBsharectl\fR(1M) as \fB1024\fR, is \fB1088\fR.
 394 .RE
 395 
 396 .sp
 397 .ne 2
 398 .na
 399 \fB\fBnetbios_scope\fR\fR
 400 .ad
 401 .sp .6
 402 .RS 4n
 403 Specifies the NetBIOS scope identifier, which identifies logical NetBIOS
 404 networks that are on the same physical network. When you specify a NetBIOS
 405 scope identifier, the server filters the number of machines that are listed in
 406 the browser display to make it easier to find other hosts. The value is a text
 407 string that represents a domain name. By default, no value is set.
 408 .RE
 409 
 410 .sp
 411 .ne 2
 412 .na
 413 \fB\fBoplock_enable\fR\fR
 414 .ad
 415 .sp .6
 416 .RS 4n
 417 Controls whether "oplocks" may be granted by the SMB server.
 418 The term "oplock" is short for "opportunistic lock", which is
 419 the legacy name for cache delegations in SMB.
 420 By default, oplocks are enabled.
 421 Note that if oplocks are disabled, file I/O performance may be
 422 severely reduced.
 423 .RE
 424 
 425 .sp
 426 .ne 2
 427 .na
 428 \fB\fBpdc\fR\fR
 429 .ad
 430 .sp .6
 431 .RS 4n
 432 Specifies the preferred IP address for the domain controller. This property is
 433 sometimes used when there are multiple domain controllers to indicate which one
 434 is preferred. If the specified domain controller responds, it is chosen even if
 435 the other domain controllers are also available. By default, no value is set.
 436 .RE
 437 
 438 .sp
 439 .ne 2
 440 .na
 441 \fB\fBrestrict_anonymous\fR\fR
 442 .ad
 443 .sp .6
 444 .RS 4n
 445 Disables anonymous access to IPC$, which requires that the client be
 446 authenticated to get access to MSRPC services through IPC$. A value of
 447 \fBtrue\fR disables anonymous access to IPC$, while a value of \fBfalse\fR
 448 enables anonymous access.
 449 .RE
 450 
 451 .sp
 452 .ne 2
 453 .na
 454 \fB\fBsigning_enabled\fR\fR
 455 .ad
 456 .sp .6
 457 .RS 4n
 458 Enables SMB signing. When signing is enabled but not required it is possible
 459 for clients to connect regardless of whether or not the client supports SMB
 460 signing. If a packet has been signed, the signature will be verified. If a
 461 packet has not been signed it will be accepted without signature verification.
 462 Valid values are \fBtrue\fR and \fBfalse\fR. The default value is \fBfalse\fR.
 463 .RE
 464 
 465 .sp
 466 .ne 2
 467 .na
 468 \fB\fBsigning_required\fR\fR
 469 .ad
 470 .sp .6
 471 .RS 4n
 472 When SMB signing is required, all packets must be signed or they will be
 473 rejected, and clients that do not support signing will be unable to connect to
 474 the server. The \fBsigning_required\fR setting is only taken into account when
 475 \fBsigning_enabled\fR is \fBtrue\fR. Valid values are \fBtrue\fR and
 476 \fBfalse\fR. The default value is \fBfalse\fR.
 477 .RE
 478 
 479 .sp
 480 .ne 2
 481 .na
 482 \fB\fBsystem_comment\fR\fR
 483 .ad
 484 .sp .6
 485 .RS 4n
 486 Specifies an optional description for the system, which is a text string. This
 487 property value might appear in various places, such as Network Neighborhood or
 488 Network Places on Windows clients. By default, no value is set.
 489 .RE
 490 
 491 .sp
 492 .ne 2
 493 .na
 494 \fB\fBtraverse_mounts\fR\fR
 495 .ad
 496 .sp .6
 497 .RS 4n
 498 The \fBtraverse_mounts\fR setting determines how the SMB server
 499 presents sub-mounts underneath an SMB share.  When \fBtraverse_mounts\fR
 500 is \fBtrue\fR (the default), sub-mounts are presented to SMB clients
 501 like any other subdirectory.   When \fBtraverse_mounts\fR is \fBfalse\fR,
 502 sub-mounts are not shown to SMB clients.
 503 .RE
 504 
 505 .sp
 506 .ne 2
 507 .na
 508 \fB\fBunmap\fR\fR
 509 .ad
 510 .sp .6
 511 .RS 4n
 512 The value is a command to be executed when disconnecting the share. The command
 513 can take the same substitutions listed on the \fBmap\fR property.
 514 .RE
 515 
 516 .sp
 517 .ne 2
 518 .na
 519 \fB\fBwins_exclude\fR\fR
 520 .ad
 521 .sp .6
 522 .RS 4n
 523 Specifies a comma-separated list of network interfaces that should not be
 524 registered with WINS. NetBIOS host announcements are made on excluded
 525 interfaces.
 526 .RE
 527 
 528 .sp
 529 .ne 2
 530 .na
 531 \fB\fBwins_server_1\fR\fR
 532 .ad
 533 .sp .6
 534 .RS 4n
 535 Specifies the IP address of the primary WINS server. By default, no value is
 536 set.
 537 .RE
 538 
 539 .sp
 540 .ne 2
 541 .na
 542 \fB\fBwins_server_2\fR\fR
 543 .ad
 544 .sp .6
 545 .RS 4n
 546 Specifies the IP address of the secondary WINS server. By default, no value is
 547 set.
 548 .RE
 549 
 550 .SH ATTRIBUTES
 551 See the \fBattributes\fR(5) man page for descriptions of the following
 552 attributes:
 553 .sp
 554 
 555 .sp
 556 .TS
 557 box;
 558 c | c
 559 l | l .
 560 ATTRIBUTE TYPE  ATTRIBUTE VALUE
 561 _
 562 Interface Stability     Uncommitted
 563 .TE
 564 
 565 .SH SEE ALSO
 566 \fBsharectl\fR(1M), \fBsmbadm\fR(1M), \fBsmbd\fR(1M), \fBsmbstat\fR(1M),
 567 \fBattributes\fR(5), \fBsmf\fR(5)