2
.\" Author: [see the "AUTHOR" section]
3
.\" Generator: DocBook XSL Stylesheets v1.74.0 <http://docbook.sf.net/>
5
.\" Manual: System Administration tools
9
.TH "NET" "8" "10/29/2009" "Samba 3\&.4" "System Administration tools"
10
.\" -----------------------------------------------------------------
11
.\" * (re)Define some macros
12
.\" -----------------------------------------------------------------
13
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
14
.\" toupper - uppercase a string (locale-aware)
15
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
17
.tr aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ
19
.tr aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz
21
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
22
.\" SH-xref - format a cross-reference to an SH section
23
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
32
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
33
.\" SH - level-one heading that works better for non-TTY output
34
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
36
.\" put an extra blank line of space above the head in non-TTY output
43
.nr an-prevailing-indent \\n[IN]
47
.HTML-TAG ".NH \\n[an-level]"
49
.nr an-no-space-flag 1
51
\." make the size of the head bigger
56
.\" if n (TTY output), use uppercase
61
.\" if not n (not TTY), use normal case (not uppercase)
65
.\" if not n (not TTY), put a border/line under subheading
70
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
71
.\" SS - level-two heading that works better for non-TTY output
72
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
77
.nr an-prevailing-indent \\n[IN]
82
.nr an-no-space-flag 1
85
\." make the size of the head bigger
91
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
92
.\" BB/BE - put background/screen (filled box) around block of text
93
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
106
.if "\\$2"adjust-for-leading-newline" \{\
114
.nr BW \\n(.lu-\\n(.i
117
.ie "\\$2"adjust-for-leading-newline" \{\
118
\M[\\$1]\h'1n'\v'+.5v'\D'P \\n(BWu 0 0 \\n(BHu -\\n(BWu 0 0 -\\n(BHu'\M[]
121
\M[\\$1]\h'1n'\v'-.5v'\D'P \\n(BWu 0 0 \\n(BHu -\\n(BWu 0 0 -\\n(BHu'\M[]
132
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
133
.\" BM/EM - put colored marker in margin next to block of text
134
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
151
\M[\\$1]\D'P -.75n 0 0 \\n(BHu -(\\n[.i]u - \\n(INu - .75n) 0 0 -\\n(BHu'\M[]
159
.\" -----------------------------------------------------------------
160
.\" * set default formatting
161
.\" -----------------------------------------------------------------
162
.\" disable hyphenation
164
.\" disable justification (adjust text to left margin only)
166
.\" -----------------------------------------------------------------
167
.\" * MAIN CONTENT STARTS HERE *
168
.\" -----------------------------------------------------------------
170
net \- Tool for administration of Samba and remote CIFS servers\&.
174
\FCnet\F[] {<ads|rap|rpc>} [\-h] [\-w\ workgroup] [\-W\ myworkgroup] [\-U\ user] [\-I\ ip\-address] [\-p\ port] [\-n\ myname] [\-s\ conffile] [\-S\ server] [\-l] [\-P] [\-d\ debuglevel] [\-V] [\-\-request\-timeout\ seconds]
178
This tool is part of the
182
The Samba net utility is meant to work just like the net utility available for windows and DOS\&. The first argument should be used to specify the protocol to use when executing a certain command\&. ADS is used for ActiveDirectory, RAP is using for old (Win9x/NT3) clients and RPC can be used for NT4 and Windows 2000\&. If this argument is omitted, net will try to determine it automatically\&. Not all commands are available on all protocols\&.
187
Print a summary of command line options\&.
190
\-w target\-workgroup
192
Sets target workgroup or domain\&. You have to specify either this option or the IP address or the name of a server\&.
197
Sets client workgroup or domain
207
IP address of target server to use\&. You have to specify either this option or a target workgroup or a target server\&.
212
Port on the target server to connect to (usually 139 or 445)\&. Defaults to trying 445 first, then 139\&.
215
\-n <primary NetBIOS name>
217
This option allows you to override the NetBIOS name that Samba uses for itself\&. This is identical to setting the
218
\m[blue]\fBnetbios name\fR\m[]
221
file\&. However, a command line setting will take precedence over settings in
225
\-s <configuration file>
227
The file specified contains the configuration details required by the server\&. The information in this file includes server\-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See
229
for more information\&. The default configuration file name is determined at compile time\&.
234
Name of target server\&. You should specify either this option or a target workgroup or a target IP address\&.
239
When listing data, give more information on each item\&.
244
Make queries to the external server using the machine account of the local server\&.
247
\-\-request\-timeout 30
249
Let client requests timeout after 30 seconds the default is 10 seconds\&.
252
\-d|\-\-debuglevel=level
255
is an integer from 0 to 10\&. The default value if this parameter is not specified is 0\&.
257
The higher this value, the more detail will be logged to the log files about the activities of the server\&. At level 0, only critical errors and serious warnings will be logged\&. Level 1 is a reasonable level for day\-to\-day running \- it generates a small amount of information about operations carried out\&.
259
Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem\&. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic\&.
261
Note that specifying this parameter here will override the
262
\m[blue]\fBlog level\fR\m[]
270
This command allows the Samba machine account password to be set from an external application to a machine account password that has already been stored in Active Directory\&. DO NOT USE this command unless you know exactly what you are doing\&. The use of this command requires that the force flag (\-f) be used also\&. There will be NO command prompt\&. Whatever information is piped into stdin, either by typing at the command line or otherwise, will be stored as the literal machine password\&. Do NOT use this without care and attention as it will overwrite a legitimate machine password without warning\&. YOU HAVE BEEN WARNED\&.
275
command allows you to view the time on a remote server or synchronise the time on the local server with the time on the remote server\&.
278
Without any options, the
280
command displays the time on the remote server\&.
283
Displays the time on the remote server in a format ready for
287
Tries to set the date and time of the local server to that on the remote server using
291
Displays the timezone in hours from GMT on the remote computer\&.
292
.SS "[RPC|ADS] JOIN [TYPE] [\-U username[%password]] [createupn=UPN] [createcomputer=OU] [options]"
294
Join a domain\&. If the account already exists on the server, and [TYPE] is MEMBER, the machine will attempt to join automatically\&. (Assuming that the machine has been created in server manager) Otherwise, a password will be prompted for, and a new account may be created\&.
296
[TYPE] may be PDC, BDC or MEMBER to specify the type of server joining the domain\&.
298
[UPN] (ADS only) set the principalname attribute during the join\&. The default format is host/netbiosname@REALM\&.
300
[OU] (ADS only) Precreate the computer account in a specific OU\&. The OU string reads from top to bottom without RDNs, and is delimited by a \'/\'\&. Please note that \'\e\' is used for escape by both the shell and ldap, so it may need to be doubled or quadrupled to pass through, and it is not used as a delimiter\&.
301
.SS "[RPC] OLDJOIN [options]"
303
Join a domain\&. Use the OLDJOIN option to join the domain using the old style of domain joining \- you need to create a trust account in server manager first\&.
308
.SS "[RPC|ADS] USER DELETE target"
310
Delete specified user
311
.SS "[RPC|ADS] USER INFO target"
313
List the domain groups of the specified user\&.
314
.SS "[RPC|ADS] USER RENAME oldname newname"
316
Rename specified user\&.
317
.SS "[RPC|ADS] USER ADD name [password] [-F user flags] [-C comment]"
319
Add specified user\&.
320
.SS "[RPC|ADS] GROUP"
321
.SS "[RPC|ADS] GROUP [misc options] [targets]"
324
.SS "[RPC|ADS] GROUP DELETE name [misc. options]"
326
Delete specified group\&.
327
.SS "[RPC|ADS] GROUP ADD name [-C comment]"
329
Create specified group\&.
330
.SS "[RAP|RPC] SHARE"
331
.SS "[RAP|RPC] SHARE [misc. options] [targets]"
333
Enumerates all exported resources (network shares) on target server\&.
334
.SS "[RAP|RPC] SHARE ADD name=serverpath [-C comment] [-M maxusers] [targets]"
336
Adds a share from a server (makes the export active)\&. Maxusers specifies the number of users that can be connected to the share simultaneously\&.
337
.SS "SHARE DELETE sharename"
339
Delete specified share\&.
343
List all open files on remote server\&.
344
.SS "[RPC|RAP] FILE CLOSE fileid"
346
Close file with specified
349
.SS "[RPC|RAP] FILE INFO fileid"
351
Print information on specified
352
\fIfileid\fR\&. Currently listed are: file\-id, username, locks, path, permissions\&.
353
.SS "[RAP|RPC] FILE USER user"
355
List files opened by specified
356
\fIuser\fR\&. Please note that
357
\FCnet rap file user\F[]
358
does not work against Samba servers\&.
362
Without any other options, SESSION enumerates all active SMB/CIFS sessions on the target server\&.
363
.SS "RAP SESSION DELETE|CLOSE CLIENT_NAME"
365
Close the specified sessions\&.
366
.SS "RAP SESSION INFO CLIENT_NAME"
368
Give a list with all the open files in specified session\&.
369
.SS "RAP SERVER \fIDOMAIN\fR"
371
List all servers in specified domain or workgroup\&. Defaults to local domain\&.
374
Lists all domains and workgroups visible on the current network\&.
376
.SS "RAP PRINTQ INFO QUEUE_NAME"
378
Lists the specified print queue and print jobs on the server\&. If the
380
is omitted, all queues are listed\&.
381
.SS "RAP PRINTQ DELETE JOBID"
383
Delete job with specified id\&.
384
.SS "RAP VALIDATE \fIuser\fR [\fIpassword\fR]"
386
Validate whether the specified user can log in to the remote server\&. If the password is not specified on the commandline, it will be prompted\&.
393
.nr an-no-space-flag 1
401
Currently NOT implemented\&.
405
.SS "RAP GROUPMEMBER"
406
.SS "RAP GROUPMEMBER LIST GROUP"
408
List all members of the specified group\&.
409
.SS "RAP GROUPMEMBER DELETE GROUP USER"
411
Delete member from group\&.
412
.SS "RAP GROUPMEMBER ADD GROUP USER"
414
Add member to group\&.
415
.SS "RAP ADMIN \fIcommand\fR"
417
Execute the specified
419
on the remote server\&. Only works with OS/2 servers\&.
426
.nr an-no-space-flag 1
434
Currently NOT implemented\&.
439
.SS "RAP SERVICE START NAME [arguments...]"
441
Start the specified service on the remote server\&. Not implemented yet\&.
448
.nr an-no-space-flag 1
456
Currently NOT implemented\&.
460
.SS "RAP SERVICE STOP"
462
Stop the specified service on the remote server\&.
469
.nr an-no-space-flag 1
477
Currently NOT implemented\&.
481
.SS "RAP PASSWORD \fIUSER\fR \fIOLDPASS\fR \fINEWPASS\fR"
490
.SS "LOOKUP HOST HOSTNAME [TYPE]"
492
Lookup the IP address of the given host with the specified type (netbios suffix)\&. The type defaults to 0x20 (workstation)\&.
493
.SS "LOOKUP LDAP [DOMAIN]"
495
Give IP address of LDAP server of specified
496
\fIDOMAIN\fR\&. Defaults to local domain\&.
497
.SS "LOOKUP KDC [REALM]"
499
Give IP address of KDC for the specified
500
\fIREALM\fR\&. Defaults to local realm\&.
501
.SS "LOOKUP DC [DOMAIN]"
503
Give IP\'s of Domain Controllers for specified
504
\fI DOMAIN\fR\&. Defaults to local domain\&.
505
.SS "LOOKUP MASTER DOMAIN"
507
Give IP of master browser for specified
509
or workgroup\&. Defaults to local domain\&.
512
Samba uses a general caching interface called \'gencache\'\&. It can be controlled using \'NET CACHE\'\&.
514
All the timeout parameters support the suffixes:
530
.SS "CACHE ADD key data time-out"
532
Add specified key+data to the cache with the given timeout\&.
535
Delete key from the cache\&.
536
.SS "CACHE SET key data time-out"
538
Update data of existing cache entry\&.
539
.SS "CACHE SEARCH PATTERN"
541
Search for the specified pattern in the cache data\&.
544
List all current items in the cache\&.
547
Remove all the current items from the cache\&.
548
.SS "GETLOCALSID [DOMAIN]"
550
Prints the SID of the specified domain, or if the parameter is omitted, the SID of the local server\&.
551
.SS "SETLOCALSID S\-1\-5\-21\-x\-y\-z"
553
Sets SID for the local server to the specified SID\&.
556
Prints the local machine SID and the SID of the current domain\&.
559
Sets the SID of the current domain\&.
562
Manage the mappings between Windows group SIDs and UNIX groups\&. Common options include:
572
unixgroup \- Name of the UNIX group
583
ntgroup \- Name of the Windows NT group (must be resolvable to a SID
594
rid \- Unsigned 32\-bit integer
605
sid \- Full SID in the form of "S\-1\-\&.\&.\&."
616
type \- Type of the group; either \'domain\', \'local\', or \'builtin\'
627
comment \- Freeform text description of the group
632
Add a new group mapping entry:
643
.BB lightgray adjust-for-leading-newline
646
net groupmap add {rid=int|sid=string} unixgroup=string \e
647
[type={domain|local}] [ntgroup=string] [comment=string]
648
.EB lightgray adjust-for-leading-newline
660
.SS "GROUPMAP DELETE"
662
Delete a group mapping entry\&. If more than one group name matches, the first entry found is deleted\&.
664
net groupmap delete {ntgroup=string|sid=SID}
665
.SS "GROUPMAP MODIFY"
667
Update en existing group entry\&.
680
.BB lightgray adjust-for-leading-newline
683
net groupmap modify {ntgroup=string|sid=SID} [unixgroup=string] \e
684
[comment=string] [type={domain|local}]
685
.EB lightgray adjust-for-leading-newline
699
List existing group mapping entries\&.
701
net groupmap list [verbose] [ntgroup=string] [sid=SID]
704
Prints out the highest RID currently in use on the local server (by the active \'passdb backend\')\&.
707
Print information about the domain of the remote server, such as domain name, domain sid and number of users and groups\&.
708
.SS "[RPC|ADS] TESTJOIN"
710
Check whether participation in a domain is still valid\&.
711
.SS "[RPC|ADS] CHANGETRUSTPW"
713
Force change of domain trust password\&.
715
.SS "RPC TRUSTDOM ADD DOMAIN"
717
Add a interdomain trust account for
718
\fIDOMAIN\fR\&. This is in fact a Samba account named
720
with the account flag
722
(interdomain trust account)\&. If the command is used against localhost it has the same effect as
723
\FCsmbpasswd \-a \-i DOMAIN\F[]\&. Please note that both commands expect a appropriate UNIX account\&.
724
.SS "RPC TRUSTDOM DEL DOMAIN"
726
Remove interdomain trust account for
727
\fIDOMAIN\fR\&. If it is used against localhost it has the same effect as
728
\FCsmbpasswd \-x DOMAIN$\F[]\&.
729
.SS "RPC TRUSTDOM ESTABLISH DOMAIN"
731
Establish a trust relationship to a trusting domain\&. Interdomain account must already be created on the remote PDC\&.
732
.SS "RPC TRUSTDOM REVOKE DOMAIN"
734
Abandon relationship to trusted domain
735
.SS "RPC TRUSTDOM LIST"
737
List all current interdomain trust relationships\&.
740
This subcommand is used to view and manage Samba\'s rights assignments (also referred to as privileges)\&. There are three options currently available:
743
\fIrevoke\fR\&. More details on Samba\'s privilege model and its use can be found in the Samba\-HOWTO\-Collection\&.
744
.SS "RPC ABORTSHUTDOWN"
746
Abort the shutdown of a remote server\&.
747
.SS "RPC SHUTDOWN [\-t timeout] [\-r] [\-f] [\-C message]"
749
Shut down the remote server\&.
753
Reboot after shutdown\&.
758
Force shutting down all applications\&.
763
Timeout before system will be shut down\&. An interactive user of the system can use this time to cancel the shutdown\&.
769
Display the specified message on the screen to announce the shutdown\&.
773
Print out sam database of remote server\&. You need to run this against the PDC, from a Samba machine joined as a BDC\&.
776
Export users, aliases and groups from remote server to local server\&. You need to run this against the PDC, from a Samba machine joined as a BDC\&.
777
.SS "RPC VAMPIRE KEYTAB"
779
Dump remote SAM database to local Kerberos keytab file\&.
780
.SS "RPC VAMPIRE LDIF"
782
Dump remote SAM database to local LDIF file or standard output\&.
785
Fetch domain SID and store it in the local
786
\FCsecrets\&.tdb\F[]\&.
789
Make the remote host leave the domain it is part of\&.
792
Print out status of machine account of the local machine in ADS\&. Prints out quite some debug info\&. Aimed at developers, regular users should use
793
\FCNET ADS TESTJOIN\F[]\&.
795
.SS "ADS PRINTER INFO [PRINTER] [SERVER]"
800
\fISERVER\fR\&. The printer name defaults to "*", the server name defaults to the local host\&.
801
.SS "ADS PRINTER PUBLISH PRINTER"
803
Publish specified printer using ADS\&.
804
.SS "ADS PRINTER REMOVE PRINTER"
806
Remove specified printer from ADS directory\&.
807
.SS "ADS SEARCH \fIEXPRESSION\fR \fIATTRIBUTES\&.\&.\&.\fR"
809
Perform a raw LDAP search on a ADS server and dump the results\&. The expression is a standard LDAP search expression, and the attributes are a list of LDAP fields to show in the results\&.
812
\fBnet ads search \'(objectCategory=group)\' sAMAccountName\fR
813
.SS "ADS DN \fIDN\fR \fI(attributes)\fR"
815
Perform a raw LDAP search on a ADS server and dump the results\&. The DN standard LDAP DN, and the attributes are a list of LDAP fields to show in the result\&.
818
\fBnet ads dn \'CN=administrator,CN=Users,DC=my,DC=domain\' SAMAccountName\fR
821
Print out workgroup name for specified kerberos realm\&.
822
.SS "SAM CREATEBUILTINGROUP <NAME>"
824
(Re)Create a BUILTIN group\&. Only a wellknown set of BUILTIN groups can be created with this command\&. This is the list of currently recognized group names: Administrators, Users, Guests, Power Users, Account Operators, Server Operators, Print Operators, Backup Operators, Replicator, RAS Servers, Pre\-Windows 2000 compatible Access\&. This command requires a running Winbindd with idmap allocation properly configured\&. The group gid will be allocated out of the winbindd range\&.
825
.SS "SAM CREATELOCALGROUP <NAME>"
827
Create a LOCAL group (also known as Alias)\&. This command requires a running Winbindd with idmap allocation properly configured\&. The group gid will be allocated out of the winbindd range\&.
828
.SS "SAM DELETELOCALGROUP <NAME>"
830
Delete an existing LOCAL group (also known as Alias)\&.
831
.SS "SAM MAPUNIXGROUP <NAME>"
833
Map an existing Unix group and make it a Domain Group, the domain group will have the same name\&.
834
.SS "SAM UNMAPUNIXGROUP <NAME>"
836
Remove an existing group mapping entry\&.
837
.SS "SAM ADDMEM <GROUP> <MEMBER>"
839
Add a member to a Local group\&. The group can be specified only by name, the member can be specified by name or SID\&.
840
.SS "SAM DELMEM <GROUP> <MEMBER>"
842
Remove a member from a Local group\&. The group and the member must be specified by name\&.
843
.SS "SAM LISTMEM <GROUP>"
845
List Local group members\&. The group must be specified by name\&.
846
.SS "SAM LIST <users|groups|localgroups|builtin|workstations> [verbose]"
848
List the specified set of accounts by name\&. If verbose is specified, the rid and description is also provided for each account\&.
849
.SS "SAM RIGHTS LIST"
851
List all available privileges\&.
852
.SS "SAM RIGHTS GRANT <NAME> <PRIVILEGE>"
854
Grant one or more privileges to a user\&.
855
.SS "SAM RIGHTS REVOKE <NAME> <PRIVILEGE>"
857
Revoke one or more privileges from a user\&.
858
.SS "SAM SHOW <NAME>"
860
Show the full DOMAIN\e\eNAME the SID and the type for the corresponding account\&.
861
.SS "SAM SET HOMEDIR <NAME> <DIRECTORY>"
863
Set the home directory for a user account\&.
864
.SS "SAM SET PROFILEPATH <NAME> <PATH>"
866
Set the profile path for a user account\&.
867
.SS "SAM SET COMMENT <NAME> <COMMENT>"
869
Set the comment for a user or group account\&.
870
.SS "SAM SET FULLNAME <NAME> <FULL NAME>"
872
Set the full name for a user account\&.
873
.SS "SAM SET LOGONSCRIPT <NAME> <SCRIPT>"
875
Set the logon script for a user account\&.
876
.SS "SAM SET HOMEDRIVE <NAME> <DRIVE>"
878
Set the home drive for a user account\&.
879
.SS "SAM SET WORKSTATIONS <NAME> <WORKSTATIONS>"
881
Set the workstations a user account is allowed to log in from\&.
882
.SS "SAM SET DISABLE <NAME>"
884
Set the "disabled" flag for a user account\&.
885
.SS "SAM SET PWNOTREQ <NAME>"
887
Set the "password not required" flag for a user account\&.
888
.SS "SAM SET AUTOLOCK <NAME>"
890
Set the "autolock" flag for a user account\&.
891
.SS "SAM SET PWNOEXP <NAME>"
893
Set the "password do not expire" flag for a user account\&.
894
.SS "SAM SET PWDMUSTCHANGENOW <NAME> [yes|no]"
896
Set or unset the "password must change" flag for a user account\&.
897
.SS "SAM POLICY LIST"
899
List the available account policies\&.
900
.SS "SAM POLICY SHOW <account policy>"
902
Show the account policy value\&.
903
.SS "SAM POLICY SET <account policy> <value>"
905
Set a value for the account policy\&. Valid values can be: "forever", "never", "off", or a number\&.
908
Only available if ldapsam:editposix is set and winbindd is running\&. Properly populates the ldap tree with the basic accounts (Administrator) and groups (Domain Users, Domain Admins, Domain Guests) on the ldap tree\&.
909
.SS "IDMAP DUMP <local tdb file name>"
911
Dumps the mappings contained in the local tdb file specified\&. This command is useful to dump only the mappings produced by the idmap_tdb backend\&.
912
.SS "IDMAP RESTORE [input file]"
914
Restore the mappings from the specified file or stdin\&.
915
.SS "IDMAP SECRET <DOMAIN>|ALLOC <secret>"
917
Store a secret for the specified domain, used primarily for domains that use idmap_ldap as a backend\&. In this case the secret is used as the password for the user DN used to bind to the ldap server\&.
920
Starting with version 3\&.0\&.23, a Samba server now supports the ability for non\-root users to add user-defined shares to be exported using the "net usershare" commands\&.
922
Members of the UNIX group "sambashare" can create user-defined shares on demand using the commands below\&.
924
The usershare commands are:
926
net usershare add sharename path [comment] [acl] [guest_ok=[y|n]] \- to add or change a user defined share\&.
929
net usershare delete sharename \- to delete a user defined share\&.
932
net usershare info [\-l|\-\-long] [wildcard sharename] \- to print info about a user defined share\&.
935
net usershare list [\-l|\-\-long] [wildcard sharename] \- to list user defined shares\&.
937
.SS "USERSHARE ADD sharename path [comment] [acl] [guest_ok=[y|n]]"
939
Add or replace a new user defined share, with name "sharename"\&.
941
"path" specifies the absolute pathname on the system to be exported\&. Restrictions may be put on this, see the global smb\&.conf parameters: "usershare owner only", "usershare prefix allow list", and "usershare prefix deny list"\&.
943
The optional "comment" parameter is the comment that will appear on the share when browsed to by a client\&.
945
The optional "acl" field specifies which users have read and write access to the entire share\&. Note that guest connections are not allowed unless the smb\&.conf parameter "usershare allow guests" has been set\&. The definition of a user defined share acl is: "user:permission", where user is a valid username on the system and permission can be "F", "R", or "D"\&. "F" stands for "full permissions", ie\&. read and write permissions\&. "D" stands for "deny" for a user, ie\&. prevent this user from accessing this share\&. "R" stands for "read only", ie\&. only allow read access to this share (no creation of new files or directories or writing to files)\&.
947
The default if no "acl" is given is "Everyone:R", which means any authenticated user has read\-only access\&.
949
The optional "guest_ok" has the same effect as the parameter of the same name in smb\&.conf, in that it allows guest access to this user defined share\&. This parameter is only allowed if the global parameter "usershare allow guests" has been set to true in the smb\&.conf\&.
952
There is no separate command to modify an existing user defined share,
953
just use the "net usershare add [sharename]" command using the same
954
sharename as the one you wish to modify and specify the new options
955
you wish\&. The Samba smbd daemon notices user defined share modifications
956
at connect time so will see the change immediately, there is no need
957
to restart smbd on adding, deleting or changing a user defined share\&.
958
.SS "USERSHARE DELETE sharename"
960
Deletes the user defined share by name\&. The Samba smbd daemon immediately notices this change, although it will not disconnect any users currently connected to the deleted share\&.
961
.SS "USERSHARE INFO [-l|--long] [wildcard sharename]"
963
Get info on user defined shares owned by the current user matching the given pattern, or all users\&.
965
net usershare info on its own dumps out info on the user defined shares that were created by the current user, or restricts them to share names that match the given wildcard pattern (\'*\' matches one or more characters, \'?\' matches only one character)\&. If the \'\-l\' or \'\-\-long\' option is also given, it prints out info on user defined shares created by other users\&.
967
The information given about a share looks like: [foobar] path=/home/jeremy comment=testme usershare_acl=Everyone:F guest_ok=n And is a list of the current settings of the user defined share that can be modified by the "net usershare add" command\&.
968
.SS "USERSHARE LIST [-l|--long] wildcard sharename"
970
List all the user defined shares owned by the current user matching the given pattern, or all users\&.
972
net usershare list on its own list out the names of the user defined shares that were created by the current user, or restricts the list to share names that match the given wildcard pattern (\'*\' matches one or more characters, \'?\' matches only one character)\&. If the \'\-l\' or \'\-\-long\' option is also given, it includes the names of user defined shares created by other users\&.
975
Starting with version 3\&.2\&.0, a Samba server can be configured by data stored in registry\&. This configuration data can be edited with the new "net conf" commands\&.
977
The deployment of this configuration data can be activated in two levels from the
979
file: Share definitions from registry are activated by setting
980
\fIregistry shares\fR
983
in the [global] section and global configuration options are activated by setting
984
\m[blue]\fBinclude = registry\fR\m[]
985
in the [global] section for a mixed configuration or by setting
986
\m[blue]\fBconfig backend = registry\fR\m[]
987
in the [global] section for a registry\-only configuration\&. See the
989
manpage for details\&.
991
The conf commands are:
993
net conf list \- Dump the complete configuration in smb\&.conf like
997
net conf import \- Import configuration from file in smb\&.conf
1001
net conf listshares \- List the registry shares\&.
1004
net conf drop \- Delete the complete configuration from
1008
net conf showshare \- Show the definition of a registry share\&.
1011
net conf addshare \- Create a new registry share\&.
1014
net conf delshare \- Delete a registry share\&.
1017
net conf setparm \- Store a parameter\&.
1020
net conf getparm \- Retrieve the value of a parameter\&.
1023
net conf delparm \- Delete a parameter\&.
1026
net conf getincludes \- Show the includes of a share definition\&.
1029
net conf setincludes \- Set includes for a share\&.
1032
net conf delincludes \- Delete includes from a share definition\&.
1036
Print the configuration data stored in the registry in a smb\&.conf\-like format to standard output\&.
1037
.SS "CONF IMPORT [--test|-T] filename [section]"
1039
This command imports configuration from a file in smb\&.conf format\&. If a section encountered in the input file is present in registry, its contents is replaced\&. Sections of registry configuration that have no counterpart in the input file are not affected\&. If you want to delete these, you will have to use the "net conf drop" or "net conf delshare" commands\&. Optionally, a section may be specified to restrict the effect of the import command to that specific section\&. A test mode is enabled by specifying the parameter "\-T" on the commandline\&. In test mode, no changes are made to the registry, and the resulting configuration is printed to standard output instead\&.
1040
.SS "CONF LISTSHARES"
1042
List the names of the shares defined in registry\&.
1045
Delete the complete configuration data from registry\&.
1046
.SS "CONF SHOWSHARE sharename"
1048
Show the definition of the share or section specified\&. It is valid to specify "global" as sharename to retrieve the global configuration options from registry\&.
1049
.SS "CONF ADDSHARE sharename path [writeable={y|N} [guest_ok={y|N} [comment]]] "
1051
Create a new share definition in registry\&. The sharename and path have to be given\&. The share name may
1053
be "global"\&. Optionally, values for the very common options "writeable", "guest ok" and a "comment" may be specified\&. The same result may be obtained by a sequence of "net conf setparm" commands\&.
1054
.SS "CONF DELSHARE sharename"
1056
Delete a share definition from registry\&.
1057
.SS "CONF SETPARM section parameter value"
1059
Store a parameter in registry\&. The section may be global or a sharename\&. The section is created if it does not exist yet\&.
1060
.SS "CONF GETPARM section parameter"
1062
Show a parameter stored in registry\&.
1063
.SS "CONF DELPARM section parameter"
1065
Delete a parameter stored in registry\&.
1066
.SS "CONF GETINCLUDES section"
1068
Get the list of includes for the provided section (global or share)\&.
1070
Note that due to the nature of the registry database and the nature of include directives, the includes need special treatment: Parameters are stored in registry by the parameter name as valuename, so there is only ever one instance of a parameter per share\&. Also, a specific order like in a text file is not guaranteed\&. For all real parameters, this is perfectly ok, but the include directive is rather a meta parameter, for which, in the smb\&.conf text file, the place where it is specified between the other parameters is very important\&. This can not be achieved by the simple registry smbconf data model, so there is one ordered list of includes per share, and this list is evaluated after all the parameters of the share\&.
1072
Further note that currently, only files can be included from registry configuration\&. In the future, there will be the ability to include configuration data from other registry keys\&.
1073
.SS "CONF SETINCLUDES section [filename]+"
1075
Set the list of includes for the provided section (global or share) to the given list of one or more filenames\&. The filenames may contain the usual smb\&.conf macros like %I\&.
1076
.SS "CONF DELINCLUDES section"
1078
Delete the list of includes from the provided section (global or share)\&.
1081
Starting with version 3\&.4\&.0 net can read, dump, import and export native win32 eventlog files (usually *\&.evt)\&. evt files are used by the native Windows eventviewer tools\&.
1083
The import and export of evt files can only succeed when
1089
manpage for details\&.
1091
The eventlog commands are:
1093
net eventlog dump \- Dump a eventlog *\&.evt file on the screen\&.
1096
net eventlog import \- Import a eventlog *\&.evt into the samba internal
1097
tdb based representation of eventlogs\&.
1100
net eventlog export \- Export the samba internal tdb based representation
1101
of eventlogs into an eventlog *\&.evt file\&.
1103
.SS "EVENTLOG DUMP filename"
1105
Prints a eventlog *\&.evt file to standard output\&.
1106
.SS "EVENTLOG IMPORT filename eventlog"
1108
Imports a eventlog *\&.evt file defined by
1110
into the samba internal tdb representation of eventlog defined by
1113
needs to part of the
1115
defined in smb\&.conf\&. See the
1117
manpage for details\&.
1118
.SS "EVENTLOG EXPORT filename eventlog"
1120
Exports the samba internal tdb representation of eventlog defined by
1122
to a eventlog *\&.evt file defined by
1125
needs to part of the
1127
defined in smb\&.conf\&. See the
1129
manpage for details\&.
1132
Starting with version 3\&.2\&.0 Samba has support for remote join and unjoin APIs, both client and server\-side\&. Windows supports remote join capabilities since Windows 2000\&.
1134
In order for Samba to be joined or unjoined remotely an account must be used that is either member of the Domain Admins group, a member of the local Administrators group or a user that is granted the SeMachineAccountPrivilege privilege\&.
1136
The client side support for remote join is implemented in the net dom commands which are:
1138
net dom join \- Join a remote computer into a domain\&.
1141
net dom unjoin \- Unjoin a remote computer from a domain\&.
1144
net dom renamecomputer \- Renames a remote computer joined to a domain\&.
1146
.SS "DOM JOIN domain=DOMAIN ou=OU account=ACCOUNT password=PASSWORD reboot"
1148
Joins a computer into a domain\&. This command supports the following additional parameters:
1152
\h'-04'\(bu\h'+03'\c
1159
can be a NetBIOS domain name (also known as short domain name) or a DNS domain name for Active Directory Domains\&. As in Windows, it is also possible to control which Domain Controller to use\&. This can be achieved by appending the DC name using the \e separator character\&. Example: MYDOM\eMYDC\&. The
1161
parameter cannot be NULL\&.
1166
\h'-04'\(bu\h'+03'\c
1173
can be set to a RFC 1779 LDAP DN, like
1174
\fIou=mymachines,cn=Users,dc=example,dc=com\fR
1175
in order to create the machine account in a non\-default LDAP containter\&. This optional parameter is only supported when joining Active Directory Domains\&.
1180
\h'-04'\(bu\h'+03'\c
1187
defines a domain account that will be used to join the machine to the domain\&. This domain account needs to have sufficient privileges to join machines\&.
1192
\h'-04'\(bu\h'+03'\c
1199
defines the password for the domain account defined with
1205
\h'-04'\(bu\h'+03'\c
1212
is an optional parameter that can be set to reboot the remote machine after successful join to the domain\&.
1216
Note that you also need to use standard net parameters to connect and authenticate to the remote machine that you want to join\&. These additional parameters include: \-S computer and \-U user\&.
1218
Example: net dom join \-S xp \-U XP\e\eadministrator%secret domain=MYDOM account=MYDOM\e\eadministrator password=topsecret reboot\&.
1220
This example would connect to a computer named XP as the local administrator using password secret, and join the computer into a domain called MYDOM using the MYDOM domain administrator account and password topsecret\&. After successful join, the computer would reboot\&.
1221
.SS "DOM UNJOIN account=ACCOUNT password=PASSWORD reboot"
1223
Unjoins a computer from a domain\&. This command supports the following additional parameters:
1227
\h'-04'\(bu\h'+03'\c
1234
defines a domain account that will be used to unjoin the machine from the domain\&. This domain account needs to have sufficient privileges to unjoin machines\&.
1239
\h'-04'\(bu\h'+03'\c
1246
defines the password for the domain account defined with
1252
\h'-04'\(bu\h'+03'\c
1259
is an optional parameter that can be set to reboot the remote machine after successful unjoin from the domain\&.
1263
Note that you also need to use standard net parameters to connect and authenticate to the remote machine that you want to unjoin\&. These additional parameters include: \-S computer and \-U user\&.
1265
Example: net dom unjoin \-S xp \-U XP\e\eadministrator%secret account=MYDOM\e\eadministrator password=topsecret reboot\&.
1267
This example would connect to a computer named XP as the local administrator using password secret, and unjoin the computer from the domain using the MYDOM domain administrator account and password topsecret\&. After successful unjoin, the computer would reboot\&.
1268
.SS "DOM RENAMECOMPUTER newname=NEWNAME account=ACCOUNT password=PASSWORD reboot"
1270
Renames a computer that is joined to a domain\&. This command supports the following additional parameters:
1274
\h'-04'\(bu\h'+03'\c
1281
defines the new name of the machine in the domain\&.
1286
\h'-04'\(bu\h'+03'\c
1293
defines a domain account that will be used to rename the machine in the domain\&. This domain account needs to have sufficient privileges to rename machines\&.
1298
\h'-04'\(bu\h'+03'\c
1305
defines the password for the domain account defined with
1311
\h'-04'\(bu\h'+03'\c
1318
is an optional parameter that can be set to reboot the remote machine after successful rename in the domain\&.
1322
Note that you also need to use standard net parameters to connect and authenticate to the remote machine that you want to rename in the domain\&. These additional parameters include: \-S computer and \-U user\&.
1324
Example: net dom renamecomputer \-S xp \-U XP\e\eadministrator%secret newname=XPNEW account=MYDOM\e\eadministrator password=topsecret reboot\&.
1326
This example would connect to a computer named XP as the local administrator using password secret, and rename the joined computer to XPNEW using the MYDOM domain administrator account and password topsecret\&. After successful rename, the computer would reboot\&.
1327
.SS "HELP [COMMAND]"
1329
Gives usage information for the specified command\&.
1332
This man page is complete for version 3 of the Samba suite\&.
1335
The original Samba software and related utilities were created by Andrew Tridgell\&. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed\&.
1337
The net manpage was written by Jelmer Vernooij\&.
added
removed
.pc/fix-manpages-warnings.patch/docs/manpages/net.8
