Table of Contents
Binary packages of Samba are included in almost any Linux or UNIX distribution. There are also some packages available at the Samba home page. Refer to the manual of your operating system for details on installing packages for your specific operating system.
If you need to compile Samba from source, check How to Compile Samba.
Samba's configuration is stored in the smb.conf file, which usually resides in
/etc/samba/smb.conf or /usr/local/samba/lib/smb.conf. You can either
edit this file yourself or do it using one of the many graphical tools that are available, such as the
Web-based interface SWAT, that is included with Samba.
The smb.conf file uses the same syntax as the various old .ini files in Windows
3.1: Each file consists of various sections, which are started by putting the section name between brackets
([]) on a new line. Each contains zero or more key/value pairs separated by an equality
sign (=). The file is just a plaintext file, so you can open and edit it with your favorite
editing tool.
Each section in the smb.conf file represents either a share or a meta-service on the Samba server. The
section [global] is special, since it contains settings that apply to the whole Samba
server. Samba supports a number of meta-services, each of which serves its own purpose. For example, the
[homes] share is a meta-service that causes Samba to provide a personal home share for
each user. The [printers] share is a meta-service that establishes print queue support
and that specifies the location of the intermediate spool directory into which print jobs are received
from Windows clients prior to being dispatched to the UNIX/Linux print spooler.
The printers meta-service will cause every printer that is either specified in a
printcap file, via the lpstat, or via the CUPS API, to be
published as a shared print queue. The printers stanza in the smb.conf file can
be set as not browseable. If it is set to be browseable, then it will be visible as if it is a share.
That makes no sense given that this meta-service is responsible only for making UNIX system printers
available as Windows print queues. If a comment parameter is specified, the value
of it will be displayed as part of the printer name in Windows Explorer browse lists.
Each section of the smb.conf file that specifies a share, or a meta-service, is called a stanza.
The global stanza specifies settings that affect all the other stanzas in the
smb.conf file. Configuration parameters are documented in the smb.conf man page. Some parameters
can be used only in the global stanza, some only in share or meta-service stanzas,
and some can be used globally or just within a share or meta-service stanza.
A minimal smb.conf contains a very minimal smb.conf.
This section contains brief descriptions of the databases that are used by Samba-3.
The directory in which Samba stores the tdb files is determined by compile-time directives. Samba-3 stores tdb files in two locations. The best way to determine these locations is to execute the following command:
root# smbd -b | grep PRIVATE_DIR
PRIVATE_DIR: /etc/samba/private
This means that the confidential tdb files are stored in the /etc/samba/private
directory. Samba-3 also uses a number of tdb files that contain more mundane data. The location of
these files can be found by executing:
root# smbd -b | grep LOCKDIR
LOCKDIR: /var/lib/samba
Therefore the remaining control files will, in the example shown, be stored in the
/var/lib/samba directory.
The persistent tdb files are described in the Persistent TDB File
Descriptions table. All persistent tdb files should be regularly backed up. Use the
tdbbackup utility to backup the tdb files. All persistent tdb files must be
preserved during machine migrations, updates and upgrades.
The temporary tdb files do not need to be backed up, nor do they need to be preseved across machine migrations, updates or upgrades. The temporary tdb files are described in the Temporary TDB File Descriptions.
Table 1.1. Persistent TDB File Descriptions
| Name | Description |
|---|---|
| account_policy | Samba/NT account policy settings, includes password expiration settings. |
| group_mapping | Mapping table from Windows groups/SID to UNIX groups. |
| ntdrivers | Stores per-printer installed driver information. |
| ntforms | Stores per-printer installed forms information. |
| ntprinters | Stores the per-printer devmode configuration settings. |
| passdb | Exists only when the tdbsam passwd backend is used. This file stores the SambaSAMAccount information. Note: This file requires that user POSIX account information is available from either the /etc/passwd file, or from an alternative system source. |
| registry | Read-only Samba database of a Windows registry skeleton that provides support for exporting various database tables via the winreg RPCs. |
| secrets | This file stores the Workgroup/Domain/Machine SID, the LDAP directory update password, and a further collection of critical environmental data that is necessary for Samba to operate correctly. This file contains very sensitive information that must be protected. It is stored in the PRIVATE_DIR directory. |
| share_info | Stores per-share ACL information. |
| winbindd_idmap | Winbindd's local IDMAP database. |
Table 1.2. Temporary TDB File Descriptions
| Name | Description | Backup |
|---|---|---|
| brlock | Byte-range locking information. | No |
| connections | A temporary cache for current connection information used to enforce max connections. | no |
| eventlog/*tdb | Records of eventlog entries. In most circumstances this is just a cache of system logs. | no |
| gencache | Generic caching database for dead WINS servers and trusted domain data. | no |
| login_cache | A temporary cache for login information, in particular bad password attempts. | no |
| messages | Temporary storage of messages being processed by smbd. | no |
| netsamlogon_cache | Caches user net_info_3 structure data from net_samlogon requests (as a domain member). | no |
| perfmon/*.tdb | Performance counter information. | no |
| printing/*.tdb | Cached output from lpq command created on a per-print-service basis. | no |
| schannel_store | A confidential file, stored in the PRIVATE_DIR, containing crytographic connection information so that clients that have temporarily disconnected can reconnect without needing to renegotiate the connection setup process. | no |
| sessionid | Temporary cache for miscellaneous session information and for utmp handling. | no |
| unexpected | Stores packets received for which no process is actively listening. | no |
| winbindd_cache | Cache of Identity information received from an NT4 domain or from ADS. Includes user lists, etc. | yes |
Samba essentially consists of two or three daemons. A daemon is a UNIX application that runs in the background and provides services.
An example of a service is the Apache Web server for which the daemon is called httpd. In the case of Samba there
are three daemons, two of which are needed as a minimum.
The Samba server is made up of the following daemons:
This daemon handles all name registration and resolution requests. It is the primary vehicle involved
in network browsing. It handles all UDP-based protocols. The nmbd daemon should
be the first command started as part of the Samba startup process.
This daemon handles all TCP/IP-based connection services for file- and print-based operations. It also
manages local authentication. It should be started immediately following the startup of nmbd.
This daemon should be started when Samba is a member of a Windows NT4 or ADS domain. It is also needed when
Samba has trust relationships with another domain. The winbindd daemon will check the
smb.conf file for the presence of the idmap uid and idmap gid
parameters. If they are are found, winbindd will use the values specified for
for UID and GID allocation. If these parameters are not specified, winbindd
will start but it will not be able to allocate UIDs or GIDs.
When Samba has been packaged by an operating system vendor, the startup process is typically a custom feature of its
integration in">
Binary packages of Samba are included in almost any Linux or UNIX distribution. There are also some packages available at the Samba home page. Refer to the manual of your operating system for details on installing packages for your specific operating system.
If you need to compile Samba from source, check How to Compile Samba.
Samba's configuration is stored in the smb.conf file, which usually resides in
/etc/samba/smb.conf or /usr/local/samba/lib/smb.conf. You can either
edit this file yourself or do it using one of the many graphical tools that are available, such as the
Web-based interface SWAT, that is included with Samba.
The smb.conf file uses the same syntax as the various old .ini files in Windows
3.1: Each file consists of various sections, which are started by putting the section name between brackets
([]) on a new line. Each contains zero or more key/value pairs separated by an equality
sign (=). The file is just a plaintext file, so you can open and edit it with your favorite
editing tool.
Each section in the smb.conf file represents either a share or a meta-service on the Samba server. The
section [global] is special, since it contains settings that apply to the whole Samba
server. Samba supports a number of meta-services, each of which serves its own purpose. For example, the
[homes] share is a meta-service that causes Samba to provide a personal home share for
each user. The [printers] share is a meta-service that establishes print queue support
and that specifies the location of the intermediate spool directory into which print jobs are received
from Windows clients prior to being dispatched to the UNIX/Linux print spooler.
The printers meta-service will cause every printer that is either specified in a
printcap file, via the lpstat, or via the CUPS API, to be
published as a shared print queue. The printers stanza in the smb.conf file can
be set as not browseable. If it is set to be browseable, then it will be visible as if it is a share.
That makes no sense given that this meta-service is responsible only for making UNIX system printers
available as Windows print queues. If a comment parameter is specified, the value
of it will be displayed as part of the printer name in Windows Explorer browse lists.
Each section of the smb.conf file that specifies a share, or a meta-service, is called a stanza.
The global stanza specifies settings that affect all the other stanzas in the
smb.conf file. Configuration parameters are documented in the smb.conf man page. Some parameters
can be used only in the global stanza, some only in share or meta-service stanzas,
and some can be used globally or just within a share or meta-service stanza.
A minimal smb.conf contains a very minimal smb.conf.
This section contains brief descriptions of the databases that are used by Samba-3.
The directory in which Samba stores the tdb files is determined by compile-time directives. Samba-3 stores tdb files in two locations. The best way to determine these locations is to execute the following command:
root# smbd -b | grep PRIVATE_DIR
PRIVATE_DIR: /etc/samba/private
This means that the confidential tdb files are stored in the /etc/samba/private
directory. Samba-3 also uses a number of tdb files that contain more mundane data. The location of
these files can be found by executing:
root# smbd -b | grep LOCKDIR
LOCKDIR: /var/lib/samba
Therefore the remaining control files will, in the example shown, be stored in the
/var/lib/samba directory.
The persistent tdb files are described in the Persistent TDB File
Descriptions table. All persistent tdb files should be regularly backed up. Use the
tdbbackup utility to backup the tdb files. All persistent tdb files must be
preserved during machine migrations, updates and upgrades.
The temporary tdb files do not need to be backed up, nor do they need to be preseved across machine migrations, updates or upgrades. The temporary tdb files are described in the Temporary TDB File Descriptions.
Table 1.1. Persistent TDB File Descriptions
| Name | Description |
|---|---|
| account_policy | Samba/NT account policy settings, includes password expiration settings. |
| group_mapping | Mapping table from Windows groups/SID to UNIX groups. |
| ntdrivers | Stores per-printer installed driver information. |
| ntforms | Stores per-printer installed forms information. |
| ntprinters | Stores the per-printer devmode configuration settings. |
| passdb | Exists only when the tdbsam passwd backend is used. This file stores the SambaSAMAccount information. Note: This file requires that user POSIX account information is available from either the /etc/passwd file, or from an alternative system source. |
| registry | Read-only Samba database of a Windows registry skeleton that provides support for exporting various database tables via the winreg RPCs. |
| secrets | This file stores the Workgroup/Domain/Machine SID, the LDAP directory update password, and a further collection of critical environmental data that is necessary for Samba to operate correctly. This file contains very sensitive information that must be protected. It is stored in the PRIVATE_DIR directory. |
| share_info | Stores per-share ACL information. |
| winbindd_idmap | Winbindd's local IDMAP database. |
Table 1.2. Temporary TDB File Descriptions
| Name | Description | Backup |
|---|---|---|
| brlock | Byte-range locking information. | No |
| connections | A temporary cache for current connection information used to enforce max connections. | no |
| eventlog/*tdb | Records of eventlog entries. In most circumstances this is just a cache of system logs. | no |
| gencache | Generic caching database for dead WINS servers and trusted domain data. | no |
| login_cache | A temporary cache for login information, in particular bad password attempts. | no |
| messages | Temporary storage of messages being processed by smbd. | no |
| netsamlogon_cache | Caches user net_info_3 structure data from net_samlogon requests (as a domain member). | no |
| perfmon/*.tdb | Performance counter information. | no |
| printing/*.tdb | Cached output from lpq command created on a per-print-service basis. | no |
| schannel_store | A confidential file, stored in the PRIVATE_DIR, containing crytographic connection information so that clients that have temporarily disconnected can reconnect without needing to renegotiate the connection setup process. | no |
| sessionid | Temporary cache for miscellaneous session information and for utmp handling. | no |
| unexpected | Stores packets received for which no process is actively listening. | no |
| winbindd_cache | Cache of Identity information received from an NT4 domain or from ADS. Includes user lists, etc. | yes |
Samba essentially consists of two or three daemons. A daemon is a UNIX application that runs in the background and provides services.
An example of a service is the Apache Web server for which the daemon is called httpd. In the case of Samba there
are three daemons, two of which are needed as a minimum.
The Samba server is made up of the following daemons:
This daemon handles all name registration and resolution requests. It is the primary vehicle involved
in network browsing. It handles all UDP-based protocols. The nmbd daemon should
be the first command started as part of the Samba startup process.
This daemon handles all TCP/IP-based connection services for file- and print-based operations. It also
manages local authentication. It should be started immediately following the startup of nmbd.
This daemon should be started when Samba is a member of a Windows NT4 or ADS domain. It is also needed when
Samba has trust relationships with another domain. The winbindd daemon will check the
smb.conf file for the presence of the idmap uid and idmap gid
parameters. If they are are found, winbindd will use the values specified for
for UID and GID allocation. If these parameters are not specified, winbindd
will start but it will not be able to allocate UIDs or GIDs.
When Samba has been packaged by an operating system vendor, the startup process is typically a custom feature of its
integration in">