我的Samba服务器的配置文件，请各位指导
作者 TOLLY
发表于: Thu 2004-12-30 11:20:40 发表主题: 我的Samba服务器的配置文件，请各位指导
--------------------------------------------------------------------------------
硬件：主储存/scsi2 (Raid5)，备份储存 /scsi1 (Raid5)，备份储存 /ata1 (NFS的Raid5)，其它略
软件：FreeBSD R5.2.1 + Samba 2.2.8a
功能：公司大约50台机的主域控制器，文件服务器，所有工作文件均放在服务器上
配置文件以及简单说明：
代码:
# This is the main Samba configuration file. You should read the
# smb.conf(5) manual page in order to understand the options listed
# here. Samba has a huge number of configurable options (perhaps too
# many!) most of which are not shown in this example
#
# Any line which starts with a ; (semi-colon) or a # (hash)
# is a comment and is ignored. In this example we will use a #
# for commentry and a ; for parts of the config file that you
# may wish to enable
#
# NOTE: Whenever you modify this file you should run the command "testparm"
# to check that you have not many any basic syntactic errors.
#
#======================= Global Settings =====================================
[global]
##
## Basic Server Settings
##
# workgroup = NT-Domain-Name or Workgroup-Name, eg: REDHAT4
# 工作组名称
workgroup = WINLAND
# server string is the equivalent of the NT Description field
# 服务器的“计算机描述”
server string = XX公司服务器
# This option is important for security. It allows you to restrict
# connections to machines which are on your local network. The
# following example restricts access to two C class networks and
# the "loopback" interface. For more examples of the syntax see
# the smb.conf man page
# 指定特定的网段才能访问
hosts allow = 192.168.xx./24 192.168.xx./24
# Uncomment this if you want a guest account, you must add this to /etc/passwd
# otherwise the user "nobody" is used
# 指定客人所用的帐户
guest account = guest
# add by tolly
# 指定管理员帐户
admin users = root,xxx,xxxx
#invalid users = @wheel, mail, deamon
# this tells Samba to use a separate log file for each machine
# that connects
# 指定日志文件
log file = /usr/local/samba/var/log.%m
# How much information do you want to see in the logs?
# default is only to log critical messages
; log level = 1
# Put a capping on the size of the log files (in Kb).
# 指定日志文件的上限
max log size = 10000
# Security mode. Most people will want user level security. See
# security_level.txt for details.
# 指定安全等级
security = user
# Using the following line enables you to customise your configuration
# on a per machine basis. The %m gets replaced with the netbios name
# of the machine that is connecting.
# Note: Consider carefully the location in the configuration file of
# this line. The included file is read at that point.
; include = /usr/local/samba/lib/smb.conf.%m
# Most people will find that this option gives better performance.
# See speed.txt and the manual pages for details
# You may want to add the following on a Linux system:
# SO_RCVBUF=8192 SO_SNDBUF=8192
#socket options = TCP_NODELAY
# 加了这个听说能改善网络性能
socket options = IPTOS_LOWDELAY TCP_NODELAY
# Add by tolly
# 这些都是优化选项，不一一解释了，block size要慢慢调，调出最适合的
getwd cache = yes
locking = yes
kernel oplocks = yes
null passwords = yes
block size = 32768
set directory = yes
# Configure Samba to use multiple interfaces
# If you have multiple network interfaces and want to limit smbd will
# use, list the ones desired here. Otherwise smbd & nmbd will bind to all
# active interfaces on the system. See the man page for details.
# 指定使用的网络接口（网卡）
interfaces = 192.168.xx.1/24 192.168.xx.1/24
# Should smbd report that it has MS-DFS Capabilities? Only available
# if --with-msdfs was passed to ./configure
; host msdfs = yes
# Chinese Support??? add by tolly
# 加这个对中文支持（不确定）
client code page=936
# Add by tolly
# 让服务器当时间服务器
time server = yes
# Windows server version, by tolly
# 指定Windows NT的版本，呵呵
announce version = 4.9
# add by tolly
# 指定特定的机器不能访问
hosts deny = 192.168.xx.xx
##
## Network Browsing
##
# Add by tolly for windows dc
# 服务器的机器名
netbios name = SERVER
# set local master to no if you don't want Samba to become a master
# browser on your network. Otherwise the normal election rules apply
#local master = no
# 指定为本地主域浏览器
local master = yes
# OS Level determines the precedence of this server in master browser
# elections. The default value (20) should be reasonable
; os level = 20
# 指定系统的等级，等级越高，优先权越高，最高好象是64
os level = 64
# Domain Master specifies Samba to be the Domain Master Browser. This
# allows Samba to collate browse lists between subnets. Don't use this
# if you already have a Windows NT domain controller doing this job
; domain master = yes
# 指定为主域浏览器
domain master = yes
# Preferred Master causes Samba to force a local browser election on startup
# and gives it a slightly higher chance of winning the election
; preferred master = yes
preferred master = yes
##
## WINS & Name Resolution
##
# Windows Internet Name Serving Support Section:
# WINS Support - Tells the NMBD component of Samba to enable it's WINS Server
; wins support = yes
# 支持WINS
wins support = yes
# WINS Server - Tells the NMBD components of Samba to be a WINS Client
# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
# WINS Proxy - Tells Samba to answer name resolution queries on
# behalf of a non WINS capable client, for this to work there must be
# at least one WINS Server on the network. The default is NO.
; wins proxy = yes
# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
# via DNS nslookups.
dns proxy = no
##
## Passwords & Authentication
##
# Use password server option only with security = server
# The argument list may include:
# password server = My_PDC_Name [My_BDC_Name] [My_Next_BDC_Name]
# or to auto-locate the domain controller/s
; password server = *
; password server = <NT-Server-Name>
#password server = SERVER
# You may wish to use password encryption. Please read
# ENCRYPTION.txt, Win95.txt and WinNT.txt in the Samba documentation.
# Do not enable this option unless you have read those documents
# 加密传输密码
encrypt passwords = yes
# Should smbd obey the session and account lines in /etc/pam.d/samba ?
# only available if --with-pam was used at compile time
; obey pam restrictions = yes
# 是否同步unix和samba的密码
unix password sync = no
# how should smbd talk to the local system when changing a UNIX
# password? See smb.conf(5) for details
; passwd chat = <custom chat string>
# This is only available if you compiled Samba to include --with-pam
# Use PAM for changing the password
; pam password change = yes
##
## Domain Control
##
# Enable this if you want Samba act as a domain controller.
# make sure you have read the Samba-PDC-HOWTO included in the documentation
# before enabling this parameter
; domain logons = yes
# 支持域登录
domain logons = yes
# if you enable domain logons then you may want a per-machine or
# per user logon script
# run a specific logon batch file per workstation (machine)
; logon script = %m.bat
# run a specific logon batch file per username
; logon script = %U.bat
# 指定登录脚本
logon script = logon.bat
# Where to store roving profiles (only for Win95 and WinNT)
# %L substitutes for this servers netbios name, %U is username
# You must uncomment the [Profiles] share below
; logon path = \\%L\Profiles\%U
# 登录的路径
logon path = \\%L\Profiles\%U
# UNC path specifying the network location of the user's home directory
# only used when acting as a DC for WinNT/2k/XP. Ignored by Win9x clients
; logon home = \\%L\%U
# What drive should the "logon home" be mounted at upon login ?
# only used when acting as a DC for WinNT/2k/XP. Ignored by Win9x clients
; logon drive = H:
add user script = /usr/sbin/pw useradd -g 198 -d /dev/null -s /dev/null -w none -n %u
# Add by tolly
# 指定acl的版本和管理员的组
acl compatibility = Win2k
domain admin group = @admin
##
## Printing
##
# If you want to automatically load your printer list rather
# than setting them up individually then you'll need this
; load printers = yes
# you may wish to override the location of the printcap file
; printcap name = /etc/printcap
# on SystemV system setting printcap name to lpstat should allow
# you to automatically obtain a printer list from the SystemV spool
# system
; printcap name = lpstat
# It should not be necessary to specify the print system type unless
# it is non-standard. Currently supported print systems include:
# bsd, sysv, plp, lprng, aix, hpux, qnx
; printing = bsd
# Enable this to make Samba 2.2 behavior just like Samba 2.0
# not recommended nuless you are sure of what you are doing
; disable spoolss = yes
# list of users and groups which should be able to remotely manage
# printer drivers installed on the server
; printer admin = root, +ntadmin
##
## Winbind
##
# specify the uid range which can be used by winbindd
# to allocate uids for Windows users as necessary
; winbind uid = 10000-65000
# specify the uid range which can be used by winbindd
# to allocate uids for Windows users as necessary
; winbind gid = 10000-65000
# Define a home directory to be given to passwd(5) style entries
# generated by libnss_winbind.so. You can use variables here
; winbind template homedir = /home/%D/%U
# Specify a shell for all winbind user entries return by the
# libnss_winbind.so library.
; winbind template shell = /bin/sh
# What character should be used to separate the DOMAIN and Username
# for a Windows user. The default is DOMAIN\user, but many people
# prefer DOMAIN+user
; winbind separator = +
#============================ Share Definitions ==============================
#[homes]
# comment = Home Directories
# browseable = no
# writable = yes
# valid users = %S
# Un-comment the following and create the netlogon directory for Domain Logons
; [netlogon]
; comment = Network Logon Service
; path = /usr/local/samba/lib/netlogon
; guest ok = yes
; writable = no
; share modes = no
[netlogon]
comment = Network Logon Service
path = /usr/local/samba/netlogon
guest ok = yes
writable = yes
create mode = 444
volume = "Network"
browsable = no
share modes = no
write list = ntadmin
# Un-comment the following to provide a specific roving profile share
# the default is to use the user's home directory
[Profiles]
path = /usr/local/samba/profiles
create mask = 0600
directory mask = 0700
nt acl support = yes
read only = no
browsable = no
# NOTE: If you have a BSD-style print system there is no need to
# specifically define each individual printer
#[printers]
# comment = All Printers
# path = /usr/spool/samba
# browseable = no
# # Set public = yes to allow user 'guest account' to print
# guest ok = no
# writable = no
# printable = yes
# This one is useful for people to share files
#[tmp]
# comment = Temporary file space
# path = /tmp
# read only = no
# public = yes
# MS-DFS support is only available if Samba was compiled to
# include --with-msdfs
;[dfsroot]
; dfs root = yes
# A publicly accessible directory, but read only, except for people in
# the "staff" group
[pub]
comment = XX公司工作目录
path = /scsi2/pub
public = yes
guest ok = no
writable = yes
dos filetimes = yes
dos filetime resolution = yes
write cache size = 2097152
max connections = 9000
#create mode = 0660
#directory mode = 0770
force directory mode = 775
force create mode = 664
inherit permissions = yes
hide dot files = yes
follow symlinks = no
wide links = no
oplocks = yes
map archive = yes
case sensitive = no
volume = "FILE"
hide files = /Folder.htt/Desktop.ini/
veto files = /*.eml/*.nws/riched20.dll/
[pub2]
comment = 镜像备份目录
path = /scsi1/pub2
public = yes
guest ok = no
read only = yes
read list = @all
hide dot files = yes
follow symlinks = no
wide links = no
[pub3]
comment = 增量备份目录
path = /scsi1/pub3
public = yes
guest ok = no
read only = yes
read list = @all
hide dot files = yes
follow symlinks = no
wide links = no
[pub4]
comment = SERVER2镜像备份目录
path = /ata1/pub
public = yes
guest ok = no
read only = yes
read list = @all
hide dot files = yes
follow symlinks = no
wide links = no
[other]
comment = 软件以及其它
path = /scsi2/other
public = yes
guest ok = no
writable = yes
write list = tolly, xxxx
create mask = 0765
[admin]
comment = 系统管理专用
path = /usr/home/admin
#public = yes
guest ok = no
read only = yes
valid users = root,xxx,xxx
hide dot files = no
follow symlinks = yes
wide links = yes
#browsable = no
作者 TOLLY
发表于: Thu 2004-12-30 11:20:40 发表主题: 我的Samba服务器的配置文件，请各位指导
--------------------------------------------------------------------------------
硬件：主储存/scsi2 (Raid5)，备份储存 /scsi1 (Raid5)，备份储存 /ata1 (NFS的Raid5)，其它略
软件：FreeBSD R5.2.1 + Samba 2.2.8a
功能：公司大约50台机的主域控制器，文件服务器，所有工作文件均放在服务器上
配置文件以及简单说明：
代码:
# This is the main Samba configuration file. You should read the
# smb.conf(5) manual page in order to understand the options listed
# here. Samba has a huge number of configurable options (perhaps too
# many!) most of which are not shown in this example
#
# Any line which starts with a ; (semi-colon) or a # (hash)
# is a comment and is ignored. In this example we will use a #
# for commentry and a ; for parts of the config file that you
# may wish to enable
#
# NOTE: Whenever you modify this file you should run the command "testparm"
# to check that you have not many any basic syntactic errors.
#
#======================= Global Settings =====================================
[global]
##
## Basic Server Settings
##
# workgroup = NT-Domain-Name or Workgroup-Name, eg: REDHAT4
# 工作组名称
workgroup = WINLAND
# server string is the equivalent of the NT Description field
# 服务器的“计算机描述”
server string = XX公司服务器
# This option is important for security. It allows you to restrict
# connections to machines which are on your local network. The
# following example restricts access to two C class networks and
# the "loopback" interface. For more examples of the syntax see
# the smb.conf man page
# 指定特定的网段才能访问
hosts allow = 192.168.xx./24 192.168.xx./24
# Uncomment this if you want a guest account, you must add this to /etc/passwd
# otherwise the user "nobody" is used
# 指定客人所用的帐户
guest account = guest
# add by tolly
# 指定管理员帐户
admin users = root,xxx,xxxx
#invalid users = @wheel, mail, deamon
# this tells Samba to use a separate log file for each machine
# that connects
# 指定日志文件
log file = /usr/local/samba/var/log.%m
# How much information do you want to see in the logs?
# default is only to log critical messages
; log level = 1
# Put a capping on the size of the log files (in Kb).
# 指定日志文件的上限
max log size = 10000
# Security mode. Most people will want user level security. See
# security_level.txt for details.
# 指定安全等级
security = user
# Using the following line enables you to customise your configuration
# on a per machine basis. The %m gets replaced with the netbios name
# of the machine that is connecting.
# Note: Consider carefully the location in the configuration file of
# this line. The included file is read at that point.
; include = /usr/local/samba/lib/smb.conf.%m
# Most people will find that this option gives better performance.
# See speed.txt and the manual pages for details
# You may want to add the following on a Linux system:
# SO_RCVBUF=8192 SO_SNDBUF=8192
#socket options = TCP_NODELAY
# 加了这个听说能改善网络性能
socket options = IPTOS_LOWDELAY TCP_NODELAY
# Add by tolly
# 这些都是优化选项，不一一解释了，block size要慢慢调，调出最适合的
getwd cache = yes
locking = yes
kernel oplocks = yes
null passwords = yes
block size = 32768
set directory = yes
# Configure Samba to use multiple interfaces
# If you have multiple network interfaces and want to limit smbd will
# use, list the ones desired here. Otherwise smbd & nmbd will bind to all
# active interfaces on the system. See the man page for details.
# 指定使用的网络接口（网卡）
interfaces = 192.168.xx.1/24 192.168.xx.1/24
# Should smbd report that it has MS-DFS Capabilities? Only available
# if --with-msdfs was passed to ./configure
; host msdfs = yes
# Chinese Support??? add by tolly
# 加这个对中文支持（不确定）
client code page=936
# Add by tolly
# 让服务器当时间服务器
time server = yes
# Windows server version, by tolly
# 指定Windows NT的版本，呵呵
announce version = 4.9
# add by tolly
# 指定特定的机器不能访问
hosts deny = 192.168.xx.xx
##
## Network Browsing
##
# Add by tolly for windows dc
# 服务器的机器名
netbios name = SERVER
# set local master to no if you don't want Samba to become a master
# browser on your network. Otherwise the normal election rules apply
#local master = no
# 指定为本地主域浏览器
local master = yes
# OS Level determines the precedence of this server in master browser
# elections. The default value (20) should be reasonable
; os level = 20
# 指定系统的等级，等级越高，优先权越高，最高好象是64
os level = 64
# Domain Master specifies Samba to be the Domain Master Browser. This
# allows Samba to collate browse lists between subnets. Don't use this
# if you already have a Windows NT domain controller doing this job
; domain master = yes
# 指定为主域浏览器
domain master = yes
# Preferred Master causes Samba to force a local browser election on startup
# and gives it a slightly higher chance of winning the election
; preferred master = yes
preferred master = yes
##
## WINS & Name Resolution
##
# Windows Internet Name Serving Support Section:
# WINS Support - Tells the NMBD component of Samba to enable it's WINS Server
; wins support = yes
# 支持WINS
wins support = yes
# WINS Server - Tells the NMBD components of Samba to be a WINS Client
# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
# WINS Proxy - Tells Samba to answer name resolution queries on
# behalf of a non WINS capable client, for this to work there must be
# at least one WINS Server on the network. The default is NO.
; wins proxy = yes
# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
# via DNS nslookups.
dns proxy = no
##
## Passwords & Authentication
##
# Use password server option only with security = server
# The argument list may include:
# password server = My_PDC_Name [My_BDC_Name] [My_Next_BDC_Name]
# or to auto-locate the domain controller/s
; password server = *
; password server = <NT-Server-Name>
#password server = SERVER
# You may wish to use password encryption. Please read
# ENCRYPTION.txt, Win95.txt and WinNT.txt in the Samba documentation.
# Do not enable this option unless you have read those documents
# 加密传输密码
encrypt passwords = yes
# Should smbd obey the session and account lines in /etc/pam.d/samba ?
# only available if --with-pam was used at compile time
; obey pam restrictions = yes
# 是否同步unix和samba的密码
unix password sync = no
# how should smbd talk to the local system when changing a UNIX
# password? See smb.conf(5) for details
; passwd chat = <custom chat string>
# This is only available if you compiled Samba to include --with-pam
# Use PAM for changing the password
; pam password change = yes
##
## Domain Control
##
# Enable this if you want Samba act as a domain controller.
# make sure you have read the Samba-PDC-HOWTO included in the documentation
# before enabling this parameter
; domain logons = yes
# 支持域登录
domain logons = yes
# if you enable domain logons then you may want a per-machine or
# per user logon script
# run a specific logon batch file per workstation (machine)
; logon script = %m.bat
# run a specific logon batch file per username
; logon script = %U.bat
# 指定登录脚本
logon script = logon.bat
# Where to store roving profiles (only for Win95 and WinNT)
# %L substitutes for this servers netbios name, %U is username
# You must uncomment the [Profiles] share below
; logon path = \\%L\Profiles\%U
# 登录的路径
logon path = \\%L\Profiles\%U
# UNC path specifying the network location of the user's home directory
# only used when acting as a DC for WinNT/2k/XP. Ignored by Win9x clients
; logon home = \\%L\%U
# What drive should the "logon home" be mounted at upon login ?
# only used when acting as a DC for WinNT/2k/XP. Ignored by Win9x clients
; logon drive = H:
add user script = /usr/sbin/pw useradd -g 198 -d /dev/null -s /dev/null -w none -n %u
# Add by tolly
# 指定acl的版本和管理员的组
acl compatibility = Win2k
domain admin group = @admin
##
## Printing
##
# If you want to automatically load your printer list rather
# than setting them up individually then you'll need this
; load printers = yes
# you may wish to override the location of the printcap file
; printcap name = /etc/printcap
# on SystemV system setting printcap name to lpstat should allow
# you to automatically obtain a printer list from the SystemV spool
# system
; printcap name = lpstat
# It should not be necessary to specify the print system type unless
# it is non-standard. Currently supported print systems include:
# bsd, sysv, plp, lprng, aix, hpux, qnx
; printing = bsd
# Enable this to make Samba 2.2 behavior just like Samba 2.0
# not recommended nuless you are sure of what you are doing
; disable spoolss = yes
# list of users and groups which should be able to remotely manage
# printer drivers installed on the server
; printer admin = root, +ntadmin
##
## Winbind
##
# specify the uid range which can be used by winbindd
# to allocate uids for Windows users as necessary
; winbind uid = 10000-65000
# specify the uid range which can be used by winbindd
# to allocate uids for Windows users as necessary
; winbind gid = 10000-65000
# Define a home directory to be given to passwd(5) style entries
# generated by libnss_winbind.so. You can use variables here
; winbind template homedir = /home/%D/%U
# Specify a shell for all winbind user entries return by the
# libnss_winbind.so library.
; winbind template shell = /bin/sh
# What character should be used to separate the DOMAIN and Username
# for a Windows user. The default is DOMAIN\user, but many people
# prefer DOMAIN+user
; winbind separator = +
#============================ Share Definitions ==============================
#[homes]
# comment = Home Directories
# browseable = no
# writable = yes
# valid users = %S
# Un-comment the following and create the netlogon directory for Domain Logons
; [netlogon]
; comment = Network Logon Service
; path = /usr/local/samba/lib/netlogon
; guest ok = yes
; writable = no
; share modes = no
[netlogon]
comment = Network Logon Service
path = /usr/local/samba/netlogon
guest ok = yes
writable = yes
create mode = 444
volume = "Network"
browsable = no
share modes = no
write list = ntadmin
# Un-comment the following to provide a specific roving profile share
# the default is to use the user's home directory
[Profiles]
path = /usr/local/samba/profiles
create mask = 0600
directory mask = 0700
nt acl support = yes
read only = no
browsable = no
# NOTE: If you have a BSD-style print system there is no need to
# specifically define each individual printer
#[printers]
# comment = All Printers
# path = /usr/spool/samba
# browseable = no
# # Set public = yes to allow user 'guest account' to print
# guest ok = no
# writable = no
# printable = yes
# This one is useful for people to share files
#[tmp]
# comment = Temporary file space
# path = /tmp
# read only = no
# public = yes
# MS-DFS support is only available if Samba was compiled to
# include --with-msdfs
;[dfsroot]
; dfs root = yes
# A publicly accessible directory, but read only, except for people in
# the "staff" group
[pub]
comment = XX公司工作目录
path = /scsi2/pub
public = yes
guest ok = no
writable = yes
dos filetimes = yes
dos filetime resolution = yes
write cache size = 2097152
max connections = 9000
#create mode = 0660
#directory mode = 0770
force directory mode = 775
force create mode = 664
inherit permissions = yes
hide dot files = yes
follow symlinks = no
wide links = no
oplocks = yes
map archive = yes
case sensitive = no
volume = "FILE"
hide files = /Folder.htt/Desktop.ini/
veto files = /*.eml/*.nws/riched20.dll/
[pub2]
comment = 镜像备份目录
path = /scsi1/pub2
public = yes
guest ok = no
read only = yes
read list = @all
hide dot files = yes
follow symlinks = no
wide links = no
[pub3]
comment = 增量备份目录
path = /scsi1/pub3
public = yes
guest ok = no
read only = yes
read list = @all
hide dot files = yes
follow symlinks = no
wide links = no
[pub4]
comment = SERVER2镜像备份目录
path = /ata1/pub
public = yes
guest ok = no
read only = yes
read list = @all
hide dot files = yes
follow symlinks = no
wide links = no
[other]
comment = 软件以及其它
path = /scsi2/other
public = yes
guest ok = no
writable = yes
write list = tolly, xxxx
create mask = 0765
[admin]
comment = 系统管理专用
path = /usr/home/admin
#public = yes
guest ok = no
read only = yes
valid users = root,xxx,xxx
hide dot files = no
follow symlinks = yes
wide links = yes
#browsable = no
