SMB(5) File Formats and Configurations SMB(5)
NAME
smb - configuration properties for illumos CIFS server
DESCRIPTION
Behavior of the illumos CIFS server is defined by property values that are
stored in the Service Management Facility,
smf(7).
An authorized user can use the
sharectl(8) command to set global values for
these properties in SMF.
The following list describes the properties:
ads_site Specifies the site configured in DNS to look up Active Directory
information. Sites provide a mechanism to partition or delegate
administration and policy management, which are typically used in large
or complex domains.
The value should not be set if you do not have a local Active Directory
site. By default, no value is set.
autohome_map Specifies the full path for the SMD autohome map file,
smbautohome. The
default path is
/etc.
bypass_traverse_checking When set, allows the SMB server to bypass ACL "traverse" checks. The
default value is `true', for Windows compatibility. If this parameter
is `false', ACL checks require that "traverse" (directory execute) is
granted on every directory above the directory the SMB client tries to
access. Windows shares are normally setup with the higher level
directories not specifically granting such access.
disposition A value that controls whether to disconnect the share or proceed if the
map command fails. The disposition property only has meaning when the
map property has been set. Otherwise it will have no effect.
disposition = [ continue | terminate ]
continue Proceed with share connection if the map command fails. This
is the default in the event that disposition is not
specified.
terminate Disconnect the share if the map command fails.
ddns_enable Enables or disables dynamic DNS updates. A value of `true' enables
dynamic updates, while a value of `false' disables dynamic updates. By
default, the value is `false'.
encrypt Controls SMB3 Encryption. For requests on a particular share, the
server's behavior is controlled by the stricter of this option and the
per-share "encrypt" option.
When set to `disabled', the server will not ask clients to encrypt
requests. Note that this setting does not actually disable encryption,
but leaves the decision about whether to encrypt up to the client and/or
the per-share options. When set to `enabled', the server will ask
clients to encrypt requests, but will not require that they do so. Any
message that can be encrypted will be encrypted. When set to
`required', the server will deny access to or disconnect any client that
does not support encryption or fails to encrypt requests that they
should.
In other words, the `enabled' behavior is that any message that
can be
encrypted
should be encrypted, while the `required' behavior is that any
message that
can be encrypted
must be encrypted.
encrypt_ciphers Specifies a list of enabled SMB 3.1.1 encryption ciphers. This property
is only used when encryption is `enabled' (see
encrypt property) and
negotiated SMB dialect is 3.1.1 or higher (see
max_protocol property).
Otherwise it is ignored.
When the property is set, a list of comma separated ciphers should be
specified, or the value `all' should be used instead to enable all
supported ciphers. When the property is empty, it is equivalent to
value `all' -- all supported ciphers are enabled.
The list of ciphers should contain these values:
aes128-ccm AES-128-CCM cipher is enabled. It is the only cipher used
for SMB 3.0.2 dialect.
aes128-gcm AES-128-GCM cipher is enabled.
aes256-ccm AES-256-CCM cipher is enabled.
aes256-gcm AES-256-GCM cipher is enabled.
all All ciphers are enabled.
ipv6_enable Enables IPv6 Internet protocol support within the CIFS Service. Valid
values are `true' and `false'. The default value is `false'.
keep_alive Specifies the number of seconds before an idle SMB connection is dropped
by the illumos CIFS server. If set to `0', idle connections are not
dropped. Valid values are `0' and from `20' seconds and above. The
default value is `0'.
lmauth_level Specifies the LAN Manager (LM) authentication level. The LM
compatibility level controls the type of user authentication to use in
workgroup mode or domain mode. The default value is 4.
The following describes the behavior at each level.
2 In Windows workgroup mode, the illumos CIFS server accepts LM, NTLM,
LMv2, and NTLMv2 requests. In domain mode, the SMB redirector on the
illumos CIFS server sends NTLM requests.
3 In Windows workgroup mode, the illumos CIFS server accepts LM, NTLM,
LMv2, and NTLMv2 requests. In domain mode, the SMB redirector on the
illumos CIFS server sends LMv2 and NTLMv2 requests.
4 In Windows workgroup mode, the illumos CIFS server accepts NTLM,
LMv2, and NTLMv2 requests. In domain mode, the SMB redirector on the
illumos CIFS server sends LMv2 and NTLMv2 requests.
5 In Windows workgroup mode, the illumos CIFS server accepts LMv2 and
NTLMv2 requests. In domain mode, the SMB redirector on the illumos
CIFS server sends LMv2 and NTLMv2 requests.
map The value is a command to be executed when connecting to the share. The
command can take the following arguments, which will be substituted when
the command is exec'd as described below:
%U Windows username.
%D Name of the domain or workgroup of
%U.
%h The server hostname.
%M The client hostname, or "" if not available.
%L The server NetBIOS name.
%m The client NetBIOS name, or "" if not available. This option is
only valid for NetBIOS connections (port 139).
%I The IP address of the client machine.
%i The local IP address to which the client is connected.
%S The name of the share.
%P The root directory of the share.
%u The UID of the Unix user.
max_protocol Specifies the maximum SMB protocol level that the SMB service should
allow clients to negotiate. The default value is `3.11'. Valid
settings include: `1', `2.1', `3.0', `3.02', `3.11'.
min_protocol Specifies the minimum SMB protocol level that the SMB service should
allow clients to negotiate. The default value is `1'. Valid settings
include: `1', `2.1', `3.0'.
max_workers Specifies the maximum number of worker threads that will be launched to
process incoming CIFS requests. The SMB
max_mpx value, which indicates
to a client the maximum number of outstanding SMB requests that it may
have pending on the server, is derived from the
max_workers value. To
ensure compatibility with older versions of Windows the lower 8-bits of
max_mpx must not be zero. If the lower byte of
max_workers is zero,
`64' is added to the value. Thus the minimum value is `64' and the
default value, which appears in
sharectl(8) as `1024', is `1088'.
netbios_scope Specifies the NetBIOS scope identifier, which identifies logical NetBIOS
networks that are on the same physical network. When you specify a
NetBIOS scope identifier, the server filters the number of machines that
are listed in the browser display to make it easier to find other hosts.
The value is a text string that represents a domain name. By default,
no value is set.
oplock_enable Controls whether "oplocks" may be granted by the SMB server. The term
"oplock" is short for "opportunistic lock", which is the legacy name for
cache delegations in SMB. By default, oplocks are enabled. Note that
if oplocks are disabled, file I/O performance may be severely reduced.
pdc Specifies the preferred IP address for the domain controller. This
property is sometimes used when there are multiple domain controllers to
indicate which one is preferred. If the specified domain controller
responds, it is chosen even if the other domain controllers are also
available. By default, no value is set.
restrict_anonymous Disables anonymous access to
IPC$, which requires that the client be
authenticated to get access to MSRPC services through
IPC$. A value of
`true' disables anonymous access to
IPC$, while a value of `false'
enables anonymous access.
short_names Enables the use of "short names" by SMB clients. The default value is
`false' because modern SMB clients do not need short names, and using
short names has some performance cost while listing directories and
opening or renaming files.
signing_enabled Enables SMB signing. When signing is enabled but not required it is
possible for clients to connect regardless of whether or not the client
supports SMB signing. If a packet has been signed, the signature will
be verified. If a packet has not been signed it will be accepted
without signature verification. Valid values are `true' and `false'.
The default value is `true'.
signing_required When SMB signing is required, all packets must be signed or they will be
rejected, and clients that do not support signing will be unable to
connect to the server. The
signing_required setting is only taken into
account when
signing_enabled is `true'. Valid values are `true' and
`false'. The default value is `true'.
system_comment Specifies an optional description for the system, which is a text
string. This property value might appear in various places, such as
Network Neighborhood or Network Places on Windows clients. By default,
no value is set.
traverse_mounts The
traverse_mounts setting determines how the SMB server presents sub-
mounts underneath an SMB share. When
traverse_mounts is `true' (the
default), sub-mounts are presented to SMB clients like any other
subdirectory. When
traverse_mounts is `false', sub-mounts are not shown
to SMB clients.
unmap The value is a command to be executed when disconnecting the share. The
command can take the same substitutions listed on the
map property.
wins_exclude Specifies a comma-separated list of network interfaces that should not
be registered with WINS. NetBIOS host announcements are made on
excluded interfaces. By default, no value is set.
wins_server_1 Specifies the IP address of the primary WINS server. By default, no
value is set.
wins_server_2 Specifies the IP address of the secondary WINS server. By default, no
value is set.
INTERFACE STABILITY
Uncommitted
SEE ALSO
attributes(7),
smf(7),
sharectl(8),
smbadm(8),
smbd(8),
smbstat(8)illumos March 13, 2023 illumos