smbadm

- configure and manage SMB local groups and users, manage domain membership, manage persistent password information, and issue various commands

Synopsis

smbadm add-key [-u username]

smbadm add-member -m member [[-m member] …] group

smbadm create-group [-d description] group

smbadm crypt

smbadm delete-group group

smbadm disable-user username

smbadm enable-user username

smbadm get-group [[-p property] …] group

smbadm join -u username [-o organizational-unit] domain

smbadm join -w workgroup

smbadm lookup-server //server

smbadm lookup-user [-u username] name | SID

smbadm print [-u username] //server/share {print_file|-}

smbadm remove-key [-u username]

smbadm remove-member -m member [[-m member] …] group

smbadm rename-group group new-group

smbadm set-group -p property=value [[-p property=value] …] group

smbadm show-connections [-t] [-u username] [-c computername | -s sharename]
     server

smbadm show-domains

smbadm show-files [-t] [-u username] server

smbadm show-groups [-m] [-p] [group]

smbadm show-sessions [-t] [-u username] server

smbadm show-shares [-t] [-A | -u username] server

Description

The smbadm command is used to configure SMB local groups, to manage domain membership, to manage persistent password information, and issue various commands. You can also use the smbadm command to enable or disable SMB password generation for individual local users.

SMB local groups can be used when Windows accounts must be members of some local groups and when Windows-style privileges must be granted. Solaris local groups cannot provide these functions.

There are two types of local groups: user defined and built-in. Built-in local groups are predefined local groups to support common administration tasks.

In order to provide proper identity mapping between SMB local groups and Solaris groups, an SMB local group must have a corresponding Solaris group. This requirement has two consequences: first, the group name must conform to the intersection of the Windows and Solaris group name rules. Thus, an SMB local group name can be up to eight (8) characters long and contain only lowercase characters and numbers. Second, a Solaris local group has to be created before an SMB local group can be created.

Built-in groups are standard Windows groups and are predefined by the SMB service. The built-in groups cannot be added, removed, or renamed, and these groups do not follow the SMB local group naming conventions.

When the SMB server is started, the following built-in groups are available:

Administrators

Group members can administer the system.

Backup Operators

Group members can bypass file access controls to back up and restore files.

Power Users

Group members can share directories.

Solaris local users must have an SMB password for authentication and to gain access to SMB resources. This password is created by using the passwd(1) command when the pam_smb_password module is added to the system's PAM configuration. See the pam_smb_passwd(5) man page.

The disable-user and enable-user subcommands control SMB password-generation for a specified local user. When disabled, the user is prevented from connecting to the Solaris SMB service. By default, SMB password-generation is enabled for all local users.

To reenable a disabled user, you must use the enable-user subcommand and then reset the user's password by using the passwd command. The pam_smb_passwd.so.1 module must be added to the system's PAM configuration to generate an SMB password.

Escaping Backslash Character

For the add-member, remove-member, and join (with -u) subcommands, the backslash character (\) is a valid separator between member or user names and domain names. The backslash character is a shell special character and must be quoted. For example, you might escape the backslash character with another backslash character: domain\\username. For more information about handling shell special characters, see the man page for your shell.

Operands

The smbadm command uses the following operands:

domain

Specifies the name of an existing Windows domain to join.

group

Specifies the name of the SMB local group.

username

Specifies the name of a Windows user. username can be specified in any of the following formats:

domain\username[+password]
domain/username[+password]
username@domain
username

...where domain can be the NetBIOS or DNS domain name.

server

Specifies the name or IP address of the local host.

Sub-commands

The smbadm command includes these subcommands:

add-key [-u username]

Specifies persistent password information to be used for an SMB server user account. When you specify this information, mounts can be done without a password prompt in non-Kerberos configurations. Kerberos sites should use Kerberos automatically, not prompt for a password. If a default domain is available in SMF, the domain can be omitted. If a user name is not specified, the Solaris user account name is used. An encrypted (hashed) password can also be used, see the crypt subcommand. The command can also read a password from standard input, prompting if standard input is a TTY.

Passwords can also be stored for a specific server by using a server name in place of the domain name.

The persistent password information will also be stored in /var/smb/smbfspasswd for the user running the command.

add-member -m member [[-m member] …] group

Adds the specified member to the specified SMB local group. The -m member option specifies the name of an SMB local group member. The member name must include an existing user name and an optional domain name.

Specify the member name in either of the following formats:

[domain\]username
[domain/]username

For example, a valid member name might be sales\terry or sales/terry, where sales is the Windows domain name and terry is the name of a user in the sales domain.

create-group [-d description] group

Creates an SMB local group with the specified name. You can optionally specify a description of the group by using the -d option.

crypt

Creates a hash of a password. This subcommand prompts for a password and writes the hash to standard output. This hash value is suitable for use as a value for the encrypted password option for smbfs mount and various smbadm subcommands.

delete-group group

Deletes the specified SMB local group. The built-in groups cannot be deleted.

disable-user username

Disables SMB password-generation capabilities for the specified local user. A disabled local user is prevented from accessing the system by means of the SMB service. When a local user account is disabled, you cannot use the passwd command to modify the user's SMB password until the user account is reenabled.

enable-user username

Enables SMB password-generation capabilities for the specified local user. After the password-generation capabilities are reenabled, you must use the passwd command to generate the SMB password for the local user before he can connect to the SMB service.

The passwd command manages both the Solaris password and SMB password for this user if the pam_smb_passwd module has been added to the system's PAM configuration.

get-group [[-p property=value] …] group

Retrieves property values for the specified group. If no property is specified, all property values are shown.

join -u username [-o organizational-unit] domain

Joins a Windows domain or a workgroup.

The default mode for the SMB service is workgroup mode, which uses the default workgroup name, WORKGROUP.

An authenticated user account is required to join a domain, so you must specify a Windows user name with the -u option. If the password is not specified on the command line, the user is prompted for it. The following users are allowed to perform domain join:

• Domain administrator. Can join any number of systems to the domain with machine trust accounts placed in any containers.

• Delegated administrator with authority over one or more OUs. Can join any number of systems to a domain with machine account location designated in the OUs they are responsible for.

• Normal user with machine accounts pre-staged by administrator. Can join a system to the domain as pre-authorized by an administrator.

• Normal user. Normally authorized to join a limited number of systems. For more details see the Active Directory documentation and consult the Active Directory domain administrator.

username and domain can be entered in any of the following formats:

username[+password] domain
domain\username[+password]
domain/username[+password]
username@domain

...where domain can be the NetBIOS or DNS domain name.

By default, a machine trust account for the system will be automatically created in the default container for computer accounts (cn=Computers) as part of the domain join operation if the account does not already exist in Active Directory.

The -o organizational-unit option specifies an alternative organizational unit in which the system's machine trust account will be created.

If the system's computer account already exists, you do not need to specify the -o option. A warning will be given if the OU specified is not the one that the account is in.

The organizational-unit is specified as a comma-separated list of one or more name-value pairs using the domain-relative distinguished name (DN) format, for example, 'ou=innerOU,ou=outerOU'.

The following reserved characters when specified in an attribute value must be escaped using the backslash character (\). The backslash character is a shell special character and so distinguished names that contain the following reserved characters must be quoted. It is recommended to use single quotes as opposed to double quotes because backslash enclosed by double quotes can retain its special meaning in some cases. For more information about handling shell special characters, see the man page for your shell.

---------+----------------------
Reserved |
Character|    Description
---------+----------------------
 ,            comma
 +            plus sign
 "            double quote
 \            backslash
 <            left angle bracket
 >            right angle bracket
 ;            semicolon
 =            equals sign
 #            # character at the beginning of a string

For example, in the following hierarchy:

dc=com
            dc=mycompany
               ou=Departments
                  ou=Engineering
                  ou=Payables,Receivables,and Payroll
                  :
                  :

If the machine trust account is intended to be created in the sub-OU named engineering, the organizational-unit should be specified as:

ou=Engineering,ou=Departments

If the machine trust account is intended to be created in the second sub-OU, the organizational-unit should be specified with backslashes and enclosed in single quotes as follows:

ou=Payables\,Receivables\,and Payroll,ou=Departments'

join -w workgroup

Joins a Windows domain or a workgroup.

The -w workgroup option specifies the name of the workgroup to join when using the join subcommand.

lookup-server //server

Resolves the specified server to IP address, NetBIOS domain, and NetBIOS server name. server can be one of the following:

• NetBIOS hostname

• DNS hostname

• IP address

lookup-user [-u username] name | SID

Resolves information about the name or SID of an account in the current domain or any trusted domain.

print [-u username] //server/share {print_file|-}

Print file to the specified remote printer. If print_file is a hyphen (-), read standard input. If a default domain is available in SMF, the domain can be omitted. If a user name is not specified, the Solaris user account name is used. An encrypted (hashed) password can also be used, see crypt subcommand. The command can also take a password through redirection.

remove-key [-u username]

Erases the passwords for the user running the command. The passwords in /var/smb/smbfspasswd will also be deleted for the user running the command.

The username and domain name portions of the name are optional. If a default domain is available in SMF, the domain can be omitted. If a username is not specified, all of the keys that are stored for the user who is running the command will be deleted.

If the user's password is stored for a specific server, the server name should be specified in place of the domain name.

remove-member -m member [[-m member] …] group

Removes the specified member from the specified SMB local group. The -m member option specifies the name of an SMB local group member. The member name must include an existing user name and an optional domain name.

Specify the member name in either of the following formats:

[domain\]username
[domain/]username

For example, a valid member name might be sales\terry or sales/terry, where sales is the Windows domain name and terry is the name of a user in the sales domain.

rename-group group new-group

Renames the specified SMB local group. The group must already exist. The built-in groups cannot be renamed.

set-group -p property=value [[-p property=value] …] group

Sets configuration properties for an SMB local group. The description and the privileges for the built-in groups cannot be changed.

The -p property=value option specifies the list of properties to be set on the specified group.

The group-related properties are as follows:

backup=[on|off]

Specifies whether members of the SMB local group can bypass file access controls to back up file system objects.

description=description-text

Specifies a text description for the SMB local group.

restore=[on|off]

Specifies whether members of the SMB local group can bypass file access controls to restore file system objects.

take-ownership=[on|off]

Specifies whether members of the SMB local group can take ownership of file system objects.

show-domains

Shows information about the current workgroup or domain. The information typically includes the workgroup name or the primary domain name. When in domain mode, the information includes domain controller names and trusted domain names.

Each entry in the output is identified by one of the following tags:

• [*] Primary domain

• [.] Local domain

• [-] Other domains

• [+] Selected domain controller

show-groups [-m] [-p] [group]

Shows information about the specified SMB local group or groups. If no group is specified, information is shown for all groups. If the -m option is specified, the group members are also shown. If the -p option is specified, the group privileges are also shown.

The following set of subcommands shows information about the user shares, sessions, connections, and open files on a local or a remote server.

An authenticated user account is required to show the types of data listed above, so you must specify the Windows administrative user name with the -u option. If the password is not specified on the command line, the user is prompted for it. This user should be the domain administrator or a user who has administrative privileges for the target domain. If a user name is not specified, the Solaris user account name is used.

The username can be in any of the formats described under “Operands”.

show-connections [-t] [-u username] [-c computername | -s sharename] server

Shows information about the SMB tree connections made on the server. The -c option specifies the computer name for connections of interest to the client. The -s option specifies the share name for connections of interest to the client. The -t option specifies the command header to be displayed.

show-files [-t] [-u username] server

Shows information about the files open over SMB on the server. The -t option specifies the command header to be displayed.

show-sessions [-t] [-u username] server

Shows information about the SMB user sessions on the server. The -t option specifies command header to be displayed.

show-shares [-t] [-A | -u username] server

Shows information about the SMB shares on the server. The -t option specifies the command header to be displayed. The -A option specifies anonymous user.

Exit Status

The following exit values are returned:

0

Successful completion.

>0

An error occurred.

Attributes

See the attributes(5) man page for descriptions of the following attributes:

See Also

passwd(1), groupadd(1M), idmap(1M), idmapd(1M), kclient(1M), mount_smbfs(1M), share(1M), sharectl(1M), smbd(1M), smbstat(1M), smb(4), smbautohome(4), attributes(5), pam_smb_passwd(5), smf(5)