illumos: manual page: smb.5

SMB(5) Standards, Environments, and Macros SMB(5)

NAME

smb - configuration properties for Solaris CIFS server

DESCRIPTION

Behavior of the Solaris CIFS server is defined by property values that
are stored in the Service Management Facility, smf(7).

An authorized user can use the sharectl(8) command to set global values
for these properties in SMF.

The following list describes the properties:

ads_site

Specifies the site configured in DNS to look up Active Directory
information. Sites provide a mechanism to partition or delegate
administration and policy management, which are typically used in
large or complex domains.

The value should not be set if you do not have a local Active
Directory site. By default, no value is set.

autohome_map

Specifies the full path for the SMD autohome map file, smbautohome.
The default path is /etc.

bypass_traverse_checking

When set, allows the SMB server to bypass ACL "traverse" checks. The
default value is true, for Windows compatibility. If this parameter
is false, ACL checks require that "traverse" (directory execute) is
granted on every directory above the directory the SMB client tries
to access. Windows shares are normally setup with the higher level
directories not specifically granting such access.

disposition

A value that controls whether to disconnect the share or proceed if
the map command fails. The disposition property only has meaning when
the map property has been set. Otherwise it will have no effect.

disposition = [ continue | terminate ]

continue

Proceed with share connection if the map command fails. This is
the default in the event that disposition is not specified.

terminate

Disconnect the share if the map command fails.

ddns_enable

Enables or disables dynamic DNS updates. A value of true enables
dynamic updates, while a value of false disables dynamic updates. By
default, the value is false.

encrypt

Controls SMB3 Encryption. For requests on a particular share, the
server's behavior is controlled by the stricter of this option and
the per-share "encrypt" option.

When set to disabled, the server will not ask clients to encrypt
requests. When set to enabled, the server will ask clients to
encrypt requests, but will not require that they do so. Any message
that can be encrypted will be encrypted. When set to required, the
server will deny access to or disconnect any client that does not
support encryption or fails to encrypt requests that they should.

In other words, the enabled behavior is that any message that CAN be
encrypted SHOULD be encrypted, while the required behavior is that
any message that CAN be encrypted MUST be encrypted.

encrypt_cipher

Specifies a list of enabled SMB 3.1.1 encryption ciphers. This
property is only used when encryption is On (see encrypt property)
and negotiated SMB dialect is 3.1.1 or higher (see max_protocol
property). Otherwise it is ignored.

When the property is set, a list of comma separated ciphers should be
specified, or the value all should be used instead to enable all
supported ciphers. By default, when the property is empty, it is
equivalent to value all - all available ciphers will be enabled.

The list of ciphers should contain these values:

aes128-ccm
AES-128-CCM cipher is enabled. It is the only cipher
used for SMB 3.0.2 dialect.

aes128-gcm
AES-128-GCM cipher is enabled. preferred.

all
All ciphers are enabled.

ipv6_enable

Enables IPv6 Internet protocol support within the CIFS Service. Valid
values are true and false. The default value is false.

keep_alive

Specifies the number of seconds before an idle SMB connection is
dropped by the Solaris CIFS server. If set to 0, idle connections are
not dropped. Valid values are 0 and from 20 seconds and above. The
default value is 0.

lmauth_level

Specifies the LAN Manager (LM) authentication level. The LM
compatibility level controls the type of user authentication to use
in workgroup mode or domain mode. The default value is 3.

The following describes the behavior at each level.

2
In Windows workgroup mode, the Solaris CIFS server
accepts LM, NTLM, LMv2, and NTLMv2 requests. In domain
mode, the SMB redirector on the Solaris CIFS server
sends NTLM requests.

3
In Windows workgroup mode, the Solaris CIFS server
accepts LM, NTLM, LMv2, and NTLMv2 requests. In domain
mode, the SMB redirector on the Solaris CIFS server
sends LMv2 and NTLMv2 requests.

4
In Windows workgroup mode, the Solaris CIFS server
accepts NTLM, LMv2, and NTLMv2 requests. In domain mode,
the SMB redirector on the Solaris CIFS server sends LMv2
and NTLMv2 requests.

5
In Windows workgroup mode, the Solaris CIFS server
accepts LMv2 and NTLMv2 requests. In domain mode, the
SMB redirector on the Solaris CIFS server sends LMv2 and
NTLMv2 requests.

map

The value is a command to be executed when connecting to the share.
The command can take the following arguments, which will be
substituted when the command is exec'd as described below:

%U

Windows username.

%D

Name of the domain or workgroup of %U.

%h

The server hostname.

%M

The client hostname, or "" if not available.

%L

The server NetBIOS name.

%m

The client NetBIOS name, or "" if not available. This option is
only valid for NetBIOS connections (port 139).

%I

The IP address of the client machine.

%i

The local IP address to which the client is connected.

%S

The name of the share.

%P

The root directory of the share.

%u

The UID of the Unix user.

max_protocol

Specifies the maximum SMB protocol level that the SMB service should
allow clients to negotiate. The default value is 3.11. Valid
settings include: 1, 2.1, 3.0, 3.02, 3.11

min_protocol

Specifies the minimum SMB protocol level that the SMB service should
allow clients to negotiate. The default value is 1. Valid settings
include: 1, 2.1, 3.0

max_workers

Specifies the maximum number of worker threads that will be launched
to process incoming CIFS requests. The SMB max_mpx value, which
indicates to a client the maximum number of outstanding SMB requests
that it may have pending on the server, is derived from the
max_workers value. To ensure compatibility with older versions of
Windows the lower 8-bits of max_mpx must not be zero. If the lower
byte of max_workers is zero, 64 is added to the value. Thus the
minimum value is 64 and the default value, which appears in
sharectl(8) as 1024, is 1088.

netbios_scope

Specifies the NetBIOS scope identifier, which identifies logical
NetBIOS networks that are on the same physical network. When you
specify a NetBIOS scope identifier, the server filters the number of
machines that are listed in the browser display to make it easier to
find other hosts. The value is a text string that represents a domain
name. By default, no value is set.

oplock_enable

Controls whether "oplocks" may be granted by the SMB server. The
term "oplock" is short for "opportunistic lock", which is the legacy
name for cache delegations in SMB. By default, oplocks are enabled.
Note that if oplocks are disabled, file I/O performance may be
severely reduced.

pdc

Specifies the preferred IP address for the domain controller. This
property is sometimes used when there are multiple domain controllers
to indicate which one is preferred. If the specified domain
controller responds, it is chosen even if the other domain
controllers are also available. By default, no value is set.

restrict_anonymous

Disables anonymous access to IPC$, which requires that the client be
authenticated to get access to MSRPC services through IPC$. A value
of true disables anonymous access to IPC$, while a value of false
enables anonymous access.

signing_enabled

Enables SMB signing. When signing is enabled but not required it is
possible for clients to connect regardless of whether or not the
client supports SMB signing. If a packet has been signed, the
signature will be verified. If a packet has not been signed it will
be accepted without signature verification. Valid values are true
and false. The default value is false.

signing_required

When SMB signing is required, all packets must be signed or they will
be rejected, and clients that do not support signing will be unable
to connect to the server. The signing_required setting is only taken
into account when signing_enabled is true. Valid values are true and
false. The default value is false.

system_comment

Specifies an optional description for the system, which is a text
string. This property value might appear in various places, such as
Network Neighborhood or Network Places on Windows clients. By
default, no value is set.

traverse_mounts

The traverse_mounts setting determines how the SMB server presents
sub-mounts underneath an SMB share. When traverse_mounts is true
(the default), sub-mounts are presented to SMB clients like any other
subdirectory. When traverse_mounts is false, sub-mounts are not
shown to SMB clients.

unmap

The value is a command to be executed when disconnecting the share.
The command can take the same substitutions listed on the map
property.

wins_exclude

Specifies a comma-separated list of network interfaces that should
not be registered with WINS. NetBIOS host announcements are made on
excluded interfaces.

wins_server_1

Specifies the IP address of the primary WINS server. By default, no
value is set.

wins_server_2

Specifies the IP address of the secondary WINS server. By default, no
value is set.

ATTRIBUTES

NAME

DESCRIPTION

ATTRIBUTES

SEE ALSO