Skip to content

Latest commit

 

History

History
906 lines (512 loc) · 25.7 KB

REFERENCE.md

File metadata and controls

906 lines (512 loc) · 25.7 KB
Raw

Reference

Table of Contents

Classes

Defined types

Classes

samba

For all main options, see the smb.conf(5) and samba(7) man pages. Default values for all parameters can be found at https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html. For the SELinux related options, see smbd_selinux(8).

Sample Usage : include samba

Parameters

The following parameters are available in the samba class:

packages

Data type:

Struct[{
      server => Array[String[1]],
      client => Array[String[1]],
      utils  => Array[String[1]],
  }]

Names of the server, client and utility pacakges to be installed when managing Samba.

package_manage

Data type: Boolean

Should this module manage the installation/removal of the $packages?

package_ensure

Data type: Stdlib::Ensure::Package

The installation state of $packages.

config_file

Data type: String

The Augeas lens to use for managing the smb.conf file.

config_lens

Data type: String

The Augeas lens to use for managing the smb.conf file.

service_enable

Data type: Variant[Enum[mask, manual], Boolean]

Enable/disable the Samba service on reboot.

service_ensure

Data type: Enum[stopped, running]

The value of ensure for package resources.

service_manage

Data type: Boolean

Should the Samba service be managd by this module?

service_name

Data type: Array[String]

The name of the Samba service.

service_ports

Data type:

Array[
    Struct[
      {
        port  => Integer[0, 65535],
        proto => Enum[tcp, udp],
      }
    ]
  ]

The service ports to be added to the firewall (if managed).

firewall_manage

Data type: Boolean

Manage the firewall rules for the Samba services.

workgroup

Data type: Variant[Undef, String]

This controls what workgroup your server will appear to be in when queried by clients.

Default value: 'WORKGROUP'

server_string

Data type: Variant[Undef, String]

This controls what string will show up in the printer comment box in print manager and next to the IPC connection in net view.

Default value: '%h server (Samba Server Version %v)'

netbios_name

Data type: Variant[Undef, String]

This sets the NetBIOS name by which a Samba server is known.

Default value: '%{facts.networking.hostname}'

domain_master

Data type: Variant[Boolean, String]

Tell smbd(8) to enable WAN-wide browse list collation.

Default value: 'auto'

preferred_master

Data type: Variant[Boolean, String]

This boolean parameter controls if nmbd(8) is a preferred master browser for its workgroup.

Default value: 'auto'

local_master

Data type: Variant[Undef, Boolean]

This option allows nmbd(8) to try and become a local master browser on a subnet.

Default value: true

os_level

Data type: Variant[Undef, Integer[0, 255]]

This integer value controls what level Samba advertises itself as for browse elections.

Default value: 20

wins_support

Data type: Variant[Undef, Boolean]

This boolean controls if the nmbd(8) process in Samba will act as a WINS server.

Default value: false

wins_server

Data type: Variant[Undef, String]

This specifies the IP address (or DNS name: IP address for preference) of the WINS server that nmbd(8) should register with.

Default value: undef

name_resolve_order

Data type: Variant[Undef, String]

This option is used by the programs in the Samba suite to determine what naming services to use and in what order to resolve host names to IP addresses.

Default value: 'lmhosts wins host bcast'

server_min_protocol

Data type: Variant[Undef, String]

This setting controls the minimum protocol version that the server will allow the client to use.

Default value: 'SMB2_10'

client_max_protocol

Data type: Variant[Undef, String]

The value of the parameter (a string) is the highest protocol level that will be supported for IPC$ connections as DCERPC transport.

Default value: 'SMB3'

client_min_protocol

Data type: Variant[Undef, String]

This setting controls the minimum protocol version that the client will attempt to use.

Default value: 'SMB2_10'

hosts_allow

Data type: Array[String]

This parameter is a comma, space, or tab delimited set of hosts which are permitted to access a service.

Default value: []

hosts_deny

Data type: Array[String]

The opposite of hosts allow - hosts listed here are NOT permitted access to services unless the specific services have their own lists to override this one.

Default value: ['ALL']

interfaces

Data type: Array[String]

default: interfaces =

Default value: []

bind_interfaces_only

Data type: Variant[Undef, Boolean]

This global parameter allows the Samba admin to limit what interfaces on a machine will serve SMB requests.

Default value: false

log_file

Data type: Variant[Undef, String]

This option allows you to override the name of the Samba log file (also known as the debug file).

Default value: '/var/log/samba/log.%m'

max_log_size

Data type: Variant[Undef, Integer]

This option (an integer in kilobytes) specifies the max size the log file should grow to.

Default value: 10000

passdb_backend

Data type: Variant[Undef, String]

This option allows the administrator to chose which backend will be used for storing user and possibly group information.

Default value: 'tdbsam'

domain_logons

Data type: Variant[Undef, Boolean]

DEPRECATED: This parameter has been deprecated since Samba 4.13 and support for NT4-style domain logons(as distinct from the Samba AD DC) will be removed in a future Samba release.

Default value: false

map_to_guest

Data type: Variant[Undef, String]

This parameter can take four different values, which tell smbd(8) what to do with user login requests that don't match a valid UNIX user in some way.

Default value: 'Never'

security

Data type: Variant[Undef, String]

This option affects how clients respond to Samba.

Default value: 'auto'

encrypt_passwords

Data type: Variant[Undef, Boolean]

DEPRECATED: This boolean controls whether encrypted passwords will be negotiated with the client

Default value: true

unix_password_sync

Data type: Variant[Undef, Boolean]

This boolean parameter controls whether Samba attempts to synchronize the UNIX password with the SMB password when the encrypted SMB password in the smbpasswd file is changed.

Default value: false

socket_options

Data type: Variant[Undef, String]

This option allows you to set socket options to be used when talking with the client.

Default value: 'TCP_NODELAY'

syslog

Data type: Variant[Undef, String]

This parameter maps how Samba debug messages are logged onto the system syslog logging levels.

Default value: undef

ntlm_auth

Data type: Variant[Enum['ntlmv1-permitted', 'ntlmv2-only', 'mschapv2-and-ntlmv2-only', 'disabled'], Boolean]

This parameter determines whether or not smbd(8) will attempt to authenticate users using the NTLM encrypted password response for this local passdb (SAM or account database).

Default value: false

machine_password_timeout

Data type: Variant[Undef, Integer]

This parameter specifies how often the MACHINE ACCOUNT password will be changed, in seconds.

Default value: 604800

realm

Data type: Variant[Undef, String]

This option specifies the kerberos realm to use.

Default value: undef

kerberos_method

Data type: Variant[Undef, String]

Controls how kerberos tickets are verified.

Default value: 'default'

dedicated_keytab_file

Data type: Variant[Undef, String]

Specifies the absolute path to the kerberos keytab file when kerberos method is set to "dedicated keytab".

Default value: undef

obey_pam_restrictions

Data type: Variant[Undef, Boolean]

This parameter will control whether or not Samba should obey PAM's account and session management directives.

Default value: false

shares

Data type: Hash

A hash of share names, their path(s) and other parameters.

Default value: {}

additional_config

Data type: Variant[Undef, Hash]

Additional configuration options to be added to the server smb.conf file.

Default value: {}

idmap_config

Data type: Variant[Undef, Hash]

The mapping between Windows SIDs and Unix user and group IDs.

Default value: {}

samba::client

@summary: This module installs the SAMBA/CIFS client. samba::client

Parameters

The following parameters are available in the samba::client class:

packages

Data type:

Struct[{
      server => Array[String[1]],
      client => Array[String[1]],
      utils  => Array[String[1]],
  }]

The name of the Samba client package.

Default value: $samba::packages

package_manage

Data type: Boolean

Should the Samba client package be managed by this module?

Default value: $samba::package_manage

package_ensure

Data type: Stdlib::Ensure::Package

The installation state of the Samba client package

Default value: $samba::package_ensure

samba::config

@summary: Creates the [global] config section in smb.conf file.

samba::firewall

@summary: Manage the firewall

samba::install

samba::install

samba::service

samba::service

Defined types

samba::option

Manages smb.conf options.

Parameters

The following parameters are available in the samba::option defined type:

key

Data type: String

This is the Samba configuration parameter to be set.

Default value: $title

value

Data type: Variant[Boolean, Integer, String, Array[String], Undef]

The value of $key in the smb.conf file.

Default value: undef

config_file

Data type: String

The path to the Samba configuration file. eg: /etc/samba/smb.conf.

Default value: $samba::config_file

lens

Data type: String

The Augeas lens used to manage the entries in the $config_file.

Default value: $samba::config_lens

target

Data type: String

The Augeas target for the key/value pair settings.

Default value: $samba::target

samba::share

== Define samba::share

Parameters

The following parameters are available in the samba::share defined type:

comment

Data type: Optional[String]

This is a text field that is seen next to a share when a client does a queries the server, either via the network neighborhood or via net view to list what shares are available.

Default value: undef

path

Data type: Optional[Stdlib::Absolutepath]

This parameter specifies a directory to which the user of the service is to be given access.

Default value: undef

writable

Data type: Optional[Boolean]

If this parameter is true (ie: yes) then users of a service may create or modify files in the service's directory.

Default value: undef

available

Data type: Optional[Boolean]

This parameter lets you "turn off" a service. If available = false (ie, no), then ALL attempts to connect to the service will fail.

Default value: undef

browseable

Data type: Optional[Boolean]

This controls whether this share is seen in the list of available shares in a net view and in the browse list.

Default value: undef

inherit_acl

Data type: Optional[Boolean]

The inherit acl parameter in Samba controls whether Access Control Lists (ACLs) set on parent directories are automatically inherited by new files and subdirectories created within them.

Default value: undef

host_msdfs

Data type: Optional[Boolean]

The host msdfs parameter controls whether the Samba server acts as an MSDFS root, facilitating redirection of file shares in a distributed file system.

Default value: undef

hosts_allow

Data type: Optional[Array[String]]

The hosts allow parameter limit access to these ip-addresses.

Default value: undef

hosts_deny

Data type: Optional[Array[String]]

The hosts deny parameter deny access to these ip-addresses.

Default value: undef

copy

Data type: Optional[String]

This parameter allows you to "clone" service entries. The specified service is simply duplicated under the current service's name.

Default value: undef

create_mask

Data type: Optional[String]

This parameter is a bit-wise MASK for the UNIX modes of a file.

Default value: undef

directory_mask

Data type: Optional[String]

This parameter is the octal modes which are used when converting DOS modes to UNIX modes when creating UNIX directories.

Default value: undef

force_create_mode

Data type: Optional[String]

This parameter specifies a set of UNIX mode bit permissions that will always be set on a file created by Samba.

Default value: undef

force_directory_mode

Data type: Optional[String]

This parameter specifies a set of UNIX mode bit permissions that will always be set on a directory created by Samba.

Default value: undef

force_group

Data type: Optional[String]

This specifies a UNIX group name that will be assigned as the default primary group for all users connecting to this service.

Default value: undef

force_user

Data type: Optional[String]

This specifies a UNIX user name that will be assigned as the default user for all users connecting to this service.

Default value: undef

guest_account

Data type: Optional[String]

This is a username which will be used for access to services which are specified as $guest_ok (see below).

Default value: undef

guest_ok

Data type: Optional[Boolean]

If this parameter is true (ie: yes) for a service, then no password is required to connect to the service.

Default value: undef

guest_only

Data type: Optional[Boolean]

If this parameter is true (ie: yes) for a service, then only guest connections to the service are permitted

Default value: undef

hide_unreadable

Data type: Optional[Boolean]

This parameter prevents clients from seeing the existence of files that cannot be read.

Default value: undef

inherit_owner

Data type: Optional[Boolean]

The ownership of new files and directories is normally governed by effective uid of the connected user.

Default value: undef

inherit_permissions

Data type: Optional[Boolean]

The permissions on new files and directories are normally governed by create mask, directory mask, force create mode and force directory mode

Default value: undef

read_only

Data type: Optional[Boolean]

If this parameter is true (ie: yes) then users of a service may not create or modify files in the service's directory.

Default value: undef

public

Data type: Optional[Boolean]

If this parameter is true (ie: yes) for a service, then no password is required to connect to the service.

Default value: undef

printable

Data type: Optional[Boolean]

If this parameter is true (ie: yes) then clients may open, write to and submit spool files on the directory specified for the service.

Default value: undef

valid_users

Data type: Optional[Array[String]]

This is a list of users that should be allowed to login to this service.

Default value: undef

follow_symlinks

Data type: Optional[Boolean]

This parameter allows the Samba administrator to stop smbd(8) from following symbolic links in a particular share.

Default value: undef

wide_links

Data type: Optional[Boolean]

This parameter controls whether or not links in the UNIX file system may be followed by the server

Default value: undef

map_acl_inherit

Data type: Optional[Boolean]

this parameter controls whether smbd(8) will attempt to map the 'protected' (don't inherit) flags of the Windows ACLs into an extended attribute called user.SAMBA_PAI (POSIX draft ACL Inheritance).

Default value: undef

store_dos_attributes

Data type: Optional[Boolean]

When set, DOS attributes will be stored onto an extended attribute in the UNIX filesystem, associated with the file or directory.

Default value: undef

strict_allocate

Data type: Optional[Boolean]

When this is set to yes the server will change from UNIX behaviour of not committing real disk storage blocks when a file is extended to the Windows behaviour of actually forcing the disk system to allocate real storage blocks when a file is created or extended to be a given size. In UNIX terminology this means that Samba will stop creating sparse files.

Default value: undef

oplocks

Data type: Optional[String]

This boolean option tells smbd whether to issue oplocks (opportunistic locks) to file open requests on this share.

Default value: undef

level2_oplocks

Data type: Optional[String]

This parameter controls whether Samba supports level2 (read-only) oplocks on a share.

Default value: undef

veto_oplock_files

Data type: Optional[String]

This parameter allows the Samba administrator to selectively turn off the granting of oplocks on selected files that match a wildcarded list, similar to the wildcarded list used in the veto files parameter.

Default value: undef

write_list

Data type: Optional[String]

This is a list of users that are given read-write access to a service.

Default value: undef

ensure

Data type: Enum[present, absent]

The absent/present state of the key/value parameter.

Default value: present