Hallo, dies ist ein Test.

PWD: /www/data-lst1/unixsoft/unixsoft/kaempfer/.public_html

Running in File Mode
Relative path: ././../../../../../../usr/man/man8/smbadm.8
Real path: /usr/share/man/man8/smbadm.8
Zurück

'\" te .\" Copyright (c) 2009, 2023, Oracle and/or its affiliates. .TH smbadm 8 "20 July 2023" "Oracle Solaris 11.4" "System Administration Commands" .SH NAME smbadm \- configure and manage SMB local groups and users, manage domain membership, manage persistent password information, and issue various commands .SH SYNOPSIS .LP .nf \fBsmbadm add-key\fR [\fB-u\fR \fIusername\fR] .fi .LP .nf \fBsmbadm add-member\fR \fB-m\fR \fImember\fR [[\fB-m\fR \fImember\fR] ...] \fIgroup\fR .fi .LP .nf \fBsmbadm change-dc\fR .fi .LP .nf \fBsmbadm create-group\fR [\fB-d\fR \fIdescription\fR] \fIgroup\fR .fi .LP .nf \fBsmbadm crypt\fR .fi .LP .nf \fBsmbadm delete-group\fR \fIgroup\fR .fi .LP .nf \fBsmbadm disable-user\fR \fIusername\fR .fi .LP .nf \fBsmbadm enable-user\fR \fIusername\fR .fi .LP .nf \fBsmbadm get-group\fR [[\fB-p\fR \fIproperty\fR] ...] \fIgroup\fR .fi .LP .nf \fBsmbadm join\fR \fB-u\fR \fIusername\fR [\fB-o\fR \fIorganizational-unit\fR] \fIdomain\fR .fi .LP .nf \fBsmbadm join\fR \fB-w\fR \fIworkgroup\fR .fi .LP .nf \fBsmbadm lookup-server\fR //\fIserver\fR .fi .LP .nf \fBsmbadm lookup-user\fR [\fB-u\fR \fIusername\fR] \fIname\fR | \fISID\fR .fi .LP .nf \fBsmbadm remove-key\fR [\fB-u\fR \fIusername\fR] .fi .LP .nf \fBsmbadm remove-member\fR \fB-m\fR \fImember\fR [[\fB-m\fR \fImember\fR] ...] \fIgroup\fR .fi .LP .nf \fBsmbadm rename-group\fR \fIgroup\fR \fInew-group\fR .fi .LP .nf \fBsmbadm set-group\fR \fB-p\fR \fIproperty\fR=\fIvalue\fR [[\fB-p\fR \fIproperty\fR=\fIvalue\fR] ...] \fIgroup\fR .fi .LP .nf \fBsmbadm show-connections\fR [\fB-t\fR] [\fB-u\fR \fIusername\fR] [\fB-c\fR \fIcomputername\fR | -s \fIsharename\fR] \fIserver\fR .fi .LP .nf \fBsmbadm show-dcs\fR .fi .LP .nf \fBsmbadm show-domains\fR .fi .LP .nf \fBsmbadm show-files\fR [\fB-t\fR] [\fB-u\fR \fIusername\fR] \fIserver\fR .fi .LP .nf \fBsmbadm show-groups\fR [\fB-m\fR] [\fB-p\fR] [\fIgroup\fR] .fi .LP .nf \fBsmbadm show-sessions\fR [\fB-t\fR] [\fB-u\fR \fIusername\fR] \fIserver\fR .fi .LP .nf \fBsmbadm show-shares\fR [\fB-t\fR] [\fB-A\fR | \fB-u\fR \fIusername\fR] \fIserver\fR .fi .SH DESCRIPTION .sp .LP The \fBsmbadm\fR command is used to configure \fBSMB\fR local groups, to manage domain membership, to manage persistent password information, and issue various commands. You can also use the \fBsmbadm\fR command to enable or disable SMB password generation for individual local users. .sp .LP \fBSMB\fR local groups can be used when Windows accounts must be members of some local groups and when Windows-style privileges must be granted. Solaris local groups cannot provide these functions. .sp .LP There are two types of local groups: user defined and built-in. Built-in local groups are predefined local groups to support common administration tasks. .sp .LP In order to provide proper identity mapping between \fBSMB\fR local groups and Solaris groups, an \fBSMB\fR local group must have a corresponding Solaris group. This requirement has two consequences: first, the group name must conform to the intersection of the Windows and Solaris group name rules. Thus, an \fBSMB\fR local group name can be up to eight (8) characters long and contain only lowercase characters and numbers. Second, a Solaris local group has to be created before an \fBSMB\fR local group can be created. .sp .LP Built-in groups are standard Windows groups and are predefined by the \fBSMB\fR service. The built-in groups cannot be added, removed, or renamed, and these groups do not follow the \fBSMB\fR local group naming conventions. .sp .LP When the \fBSMB\fR server is started, the following built-in groups are available: .sp .ne 2 .mk .na \fBAdministrators\fR .ad .br .sp .6 .RS 4n Group members can administer the system. .RE .sp .ne 2 .mk .na \fBBackup Operators\fR .ad .br .sp .6 .RS 4n Group members can bypass file access controls to back up and restore files. .RE .sp .ne 2 .mk .na \fBPower Users\fR .ad .br .sp .6 .RS 4n Group members can share directories. .RE .sp .LP Solaris local users must have an SMB password for authentication and to gain access to SMB resources. This password is created by using the \fBpasswd\fR(1) command when the \fBpam_smb_password\fR module is added to the system's PAM configuration. See the \fBpam_smb_passwd\fR(7) man page. .sp .LP The \fBdisable-user\fR and \fBenable-user\fR subcommands control SMB password-generation for a specified local user. When disabled, the user is prevented from connecting to the Solaris SMB service. By default, SMB password-generation is enabled for all local users. .sp .LP To reenable a disabled user, you must use the \fBenable-user\fR subcommand and then reset the user's password by using the \fBpasswd\fR command. The \fBpam_smb_passwd.so.1\fR module must be added to the system's PAM configuration to generate an SMB password. .SS "Escaping Backslash Character" .sp .LP For the \fBadd-member\fR, \fBremove-member\fR, and \fBjoin\fR (with \fB-u\fR) subcommands, the backslash character (\fB\e\fR) is a valid separator between member or user names and domain names. The backslash character is a shell special character and must be quoted. For example, you might escape the backslash character with another backslash character: \fIdomain\fR\fB\e\e\fR\fIusername\fR. For more information about handling shell special characters, see the man page for your shell. .SH OPERANDS .sp .LP The \fBsmbadm\fR command uses the following operands: .sp .ne 2 .mk .na \fB\fIdomain\fR\fR .ad .br .sp .6 .RS 4n Specifies the name of an existing Windows domain to join. .RE .sp .ne 2 .mk .na \fB\fIgroup\fR\fR .ad .br .sp .6 .RS 4n Specifies the name of the \fBSMB\fR local group. .RE .sp .ne 2 .mk .na \fB\fIusername\fR\fR .ad .br .sp .6 .RS 4n Specifies the name of a Windows user. \fIusername\fR can be specified in any of the following formats: .sp .sp .in +2 .nf \fIdomain\fR\e\fIusername\fR[+\fIpassword\fR] \fIdomain\fR/\fIusername\fR[+\fIpassword\fR] \fIusername\fR@\fIdomain\fR \fIusername\fR .fi .in -2 .sp \&...where \fIdomain\fR can be the NetBIOS or DNS domain name. .RE .sp .ne 2 .mk .na \fB\fIserver\fR\fR .ad .br .sp .6 .RS 4n Specifies the name or IP address of the local host. .RE .SH SUB-COMMANDS .sp .LP The \fBsmbadm\fR command includes these subcommands: .sp .ne 2 .mk .na \fB\fBadd-key\fR [\fB-u\fR \fIusername\fR]\fR .ad .br .sp .6 .RS 4n Specifies persistent password information to be used for an SMB server user account. When you specify this information, mounts can be done without a password prompt in non-Kerberos configurations. Kerberos sites should use Kerberos automatically, not prompt for a password. If a default domain is available in SMF, the domain can be omitted. If a user name is not specified, the Solaris user account name is used. An encrypted (hashed) password can also be used, see the \fBcrypt\fR subcommand. The command can also read a password from standard input, prompting if standard input is a TTY. .sp Passwords can also be stored for a specific server by using a server name in place of the domain name. .sp The persistent password information will also be stored in \fB/var/smb/smbfspasswd\fR for the user running the command. .RE .sp .ne 2 .mk .na \fB\fBadd-member\fR \fB-m\fR \fImember\fR [[\fB-m\fR \fImember\fR] ...] \fIgroup\fR\fR .ad .br .sp .6 .RS 4n Adds the specified member to the specified \fBSMB\fR local group. The \fB-m\fR \fImember\fR option specifies the name of an \fBSMB\fR local group member. The member name must include an existing user name and an optional domain name. .sp Specify the member name in either of the following formats: .sp .sp .in +2 .nf [\fIdomain\fR\e]\fIusername\fR [\fIdomain\fR/]\fIusername\fR .fi .in -2 .sp For example, a valid member name might be \fBsales\eterry\fR or \fBsales/terry\fR, where \fBsales\fR is the Windows domain name and \fBterry\fR is the name of a user in the \fBsales\fR domain. .RE .sp .ne 2 .mk .na \fB\fBchange-dc\fR\fR .ad .br .sp .6 .RS 4n Requests a change to the currently selected Domain Controller. .RE .sp .ne 2 .mk .na \fB\fBcreate-group\fR [\fB-d\fR \fIdescription\fR] \fIgroup\fR\fR .ad .br .sp .6 .RS 4n Creates an \fBSMB\fR local group with the specified name. You can optionally specify a description of the group by using the \fB-d\fR option. .RE .sp .ne 2 .mk .na \fB\fBcrypt\fR\fR .ad .br .sp .6 .RS 4n Creates a hash of a password. This subcommand prompts for a password and writes the hash to standard output. This hash value is suitable for use as a value for the encrypted password option for \fBsmbfs\fR mount and various \fBsmbadm\fR subcommands. .RE .sp .ne 2 .mk .na \fB\fBdelete-group\fR \fIgroup\fR\fR .ad .br .sp .6 .RS 4n Deletes the specified \fBSMB\fR local group. The built-in groups cannot be deleted. .RE .sp .ne 2 .mk .na \fB\fBdisable-user\fR \fIusername\fR\fR .ad .br .sp .6 .RS 4n Disables SMB password-generation capabilities for the specified local user. A disabled local user is prevented from accessing the system by means of the SMB service. When a local user account is disabled, you cannot use the \fBpasswd\fR command to modify the user's SMB password until the user account is reenabled. .RE .sp .ne 2 .mk .na \fB\fBenable-user\fR \fIusername\fR\fR .ad .br .sp .6 .RS 4n Enables SMB password-generation capabilities for the specified local user. After the password-generation capabilities are reenabled, you must use the \fBpasswd\fR command to generate the SMB password for the local user before they can connect to the SMB service. .sp The \fBpasswd\fR command manages both the Solaris password and SMB password for this user if the \fBpam_smb_passwd\fR module has been added to the system's PAM configuration. .RE .sp .ne 2 .mk .na \fB\fBget-group\fR [[\fB-p\fR \fIproperty\fR=\fIvalue\fR] ...] \fIgroup\fR\fR .ad .br .sp .6 .RS 4n Retrieves property values for the specified group. If no property is specified, all property values are shown. .RE .sp .ne 2 .mk .na \fB\fBjoin\fR \fB-u\fR \fIusername\fR [\fB-o\fR \fIorganizational-unit\fR] \fIdomain\fR\fR .ad .br .sp .6 .RS 4n Joins a Windows domain or a workgroup. .sp The default mode for the \fBSMB\fR service is workgroup mode, which uses the default workgroup name, \fBWORKGROUP\fR. .sp An authenticated user account is required to join a domain, so you must specify a Windows user name with the \fB-u\fR option. If the password is not specified on the command line, the user is prompted for it. The following users are allowed to perform domain join: .sp .RS +4 .TP .ie t \(bu .el o Domain administrator. Can join any number of systems to the domain with machine trust accounts placed in any containers. .RE .RS +4 .TP .ie t \(bu .el o Delegated administrator with authority over one or more OUs. Can join any number of systems to a domain with machine account location designated in the OUs they are responsible for. .RE .RS +4 .TP .ie t \(bu .el o Normal user with machine accounts pre-staged by administrator. Can join a system to the domain as pre-authorized by an administrator. .RE .RS +4 .TP .ie t \(bu .el o Normal user. Normally authorized to join a limited number of systems. For more details see the Active Directory documentation and consult the Active Directory domain administrator. .RE \fIusername\fR and \fIdomain\fR can be entered in any of the following formats: .sp .sp .in +2 .nf \fIusername\fR[+\fIpassword\fR] \fIdomain\fR \fIdomain\fR\e\fIusername\fR[+\fIpassword\fR] \fIdomain\fR/\fIusername\fR[+\fIpassword\fR] \fIusername\fR@\fIdomain\fR .fi .in -2 .sp \&...where \fIdomain\fR can be the NetBIOS or DNS domain name. .sp By default, a machine trust account for the system will be automatically created in the default container for computer accounts (\fBcn=Computers\fR) as part of the domain join operation if the account does not already exist in Active Directory. .sp The \fB-o\fR \fIorganizational-unit\fR option specifies an alternative organizational unit in which the system's machine trust account will be created. .sp If the system's computer account already exists, you do not need to specify the \fB-o\fR option. A warning will be given if the OU specified is not the one that the account is in. .sp The \fIorganizational-unit\fR is specified as a comma-separated list of one or more name-value pairs using the domain-relative distinguished name (DN) format, for example, \fB'ou=innerOU,ou=outerOU'\fR. .sp The following reserved characters when specified in an attribute value must be escaped using the backslash character (\e). The backslash character is a shell special character and so distinguished names that contain the following reserved characters must be quoted. It is recommended to use single quotes as opposed to double quotes because backslash enclosed by double quotes can retain its special meaning in some cases. For more information about handling shell special characters, see the man page for your shell. .sp .sp .in +2 .nf ---------+---------------------- Reserved | Character| Description ---------+---------------------- , comma + plus sign " double quote \e backslash < left angle bracket > right angle bracket ; semicolon = equals sign # # character at the beginning of a string .fi .in -2 .sp For example, in the following hierarchy: .sp .sp .in +2 .nf dc=com dc=mycompany ou=Departments ou=Engineering ou=Payables,Receivables,and Payroll : : .fi .in -2 .sp If the machine trust account is intended to be created in the sub-OU named \fBengineering\fR, the organizational-unit should be specified as: .sp .sp .in +2 .nf ou=Engineering,ou=Departments .fi .in -2 .sp If the machine trust account is intended to be created in the second sub-OU, the \fIorganizational-unit\fR should be specified with backslashes and enclosed in single quotes as follows: .sp .in +2 .nf ou=Payables\e,Receivables\e,and Payroll,ou=Departments' .fi .in -2 .sp .RE .sp .ne 2 .mk .na \fB\fBjoin\fR \fB-w\fR \fIworkgroup\fR\fR .ad .br .sp .6 .RS 4n Joins a Windows domain or a workgroup. .sp The \fB-w\fR \fIworkgroup\fR option specifies the name of the workgroup to join when using the \fBjoin\fR subcommand. .RE .sp .ne 2 .mk .na \fB\fBlookup-server\fR //\fIserver\fR\fR .ad .br .sp .6 .RS 4n Resolves the specified server to IP address, NetBIOS domain, and NetBIOS server name. \fIserver\fR can be one of the following: .RS +4 .TP .ie t \(bu .el o NetBIOS hostname .RE .RS +4 .TP .ie t \(bu .el o DNS hostname .RE .RS +4 .TP .ie t \(bu .el o IP address .RE .RE .sp .ne 2 .mk .na \fB\fBlookup-user\fR [\fB-u\fR \fIusername\fR] \fIname\fR | \fISID\fR\fR .ad .br .sp .6 .RS 4n Resolves information about the name or SID of an account in the current domain or any trusted domain. .RE .sp .ne 2 .mk .na \fB\fBremove-key\fR [\fB-u\fR \fIusername\fR]\fR .ad .br .sp .6 .RS 4n Erases the passwords for the user running the command. The passwords in \fB/var/smb/smbfspasswd\fR will also be deleted for the user running the command. .sp The username and domain name portions of the name are optional. If a default domain is available in SMF, the domain can be omitted. If a \fIusername\fR is not specified, all of the keys that are stored for the user who is running the command will be deleted. .sp If the user's password is stored for a specific server, the server name should be specified in place of the domain name. .RE .sp .ne 2 .mk .na \fB\fBremove-member\fR \fB-m\fR \fImember\fR [[\fB-m\fR \fImember\fR] ...] \fIgroup\fR\fR .ad .br .sp .6 .RS 4n Removes the specified member from the specified \fBSMB\fR local group. The \fB-m\fR \fImember\fR option specifies the name of an \fBSMB\fR local group member. The member name must include an existing user name and an optional domain name. .sp Specify the member name in either of the following formats: .sp .sp .in +2 .nf [\fIdomain\fR\e]\fIusername\fR [\fIdomain\fR/]\fIusername\fR .fi .in -2 .sp For example, a valid member name might be \fBsales\eterry\fR or \fBsales/terry\fR, where \fBsales\fR is the Windows domain name and \fBterry\fR is the name of a user in the \fBsales\fR domain. .RE .sp .ne 2 .mk .na \fB\fBrename-group\fR \fIgroup\fR \fInew-group\fR\fR .ad .br .sp .6 .RS 4n Renames the specified \fBSMB\fR local group. The group must already exist. The built-in groups cannot be renamed. .RE .sp .ne 2 .mk .na \fB\fBset-group\fR \fB-p\fR \fIproperty\fR=\fIvalue\fR [[\fB-p\fR \fIproperty\fR=\fIvalue\fR] ...] \fIgroup\fR\fR .ad .br .sp .6 .RS 4n Sets configuration properties for an \fBSMB\fR local group. The description and the privileges for the built-in groups cannot be changed. .sp The \fB-p\fR \fIproperty\fR\fB=\fR\fIvalue\fR option specifies the list of properties to be set on the specified group. .sp The group-related properties are as follows: .sp .ne 2 .mk .na \fB\fBbackup=[on|off]\fR\fR .ad .br .sp .6 .RS 4n Specifies whether members of the \fBSMB\fR local group can bypass file access controls to back up file system objects. .RE .sp .ne 2 .mk .na \fB\fBdescription=\fR\fIdescription-text\fR\fR .ad .br .sp .6 .RS 4n Specifies a text description for the \fBSMB\fR local group. .RE .sp .ne 2 .mk .na \fB\fBrestore=[on|off]\fR\fR .ad .br .sp .6 .RS 4n Specifies whether members of the \fBSMB\fR local group can bypass file access controls to restore file system objects. .RE .sp .ne 2 .mk .na \fB\fBtake-ownership=[on|off]\fR\fR .ad .br .sp .6 .RS 4n Specifies whether members of the \fBSMB\fR local group can take ownership of file system objects. .RE .RE .sp .ne 2 .mk .na \fB\fBshow-dcs\fR\fR .ad .br .sp .6 .RS 4n Shows information about the Active Directory Domain Controllers that have been discovered. This option is only available in domain mode. Information is displayed including the domain name, an AD site name if configured, the current Domain Controller and its state, the Preferred Domain Controller if configured, and a list of Domain Controllers that have been found. If an AD site has been configured then any Domain Controllers that are members of the site are indicated as such. .RE .sp .ne 2 .mk .na \fB\fBshow-domains\fR\fR .ad .br .sp .6 .RS 4n Shows information about the current workgroup or domain. The information typically includes the workgroup name or the primary domain name. When in domain mode, the information includes domain controller names and trusted domain names. .sp Each entry in the output is identified by one of the following tags: .RS +4 .TP .ie t \(bu .el o \fB[*]\fR Primary domain .RE .RS +4 .TP .ie t \(bu .el o \fB[.]\fR Local domain .RE .RS +4 .TP .ie t \(bu .el o \fB[-]\fR Other domains .RE .RS +4 .TP .ie t \(bu .el o \fB[+]\fR Selected domain controller .RE .RE .sp .ne 2 .mk .na \fB\fBshow-groups\fR [\fB-m\fR] [\fB-p\fR] [\fIgroup\fR]\fR .ad .br .sp .6 .RS 4n Shows information about the specified \fBSMB\fR local group or groups. If no group is specified, information is shown for all groups. If the \fB-m\fR option is specified, the group members are also shown. If the \fB-p\fR option is specified, the group privileges are also shown. .RE .sp .LP The following set of subcommands shows information about the user shares, sessions, connections, and open files on a local or a remote server. .sp .LP An authenticated user account is required to show the types of data listed above, so you must specify the Windows administrative user name with the \fB-u\fR option. If the password is not specified on the command line, the user is prompted for it. This user should be the domain administrator or a user who has administrative privileges for the target domain. If a user name is not specified, the Solaris user account name is used. .sp .LP The \fIusername\fR can be in any of the formats described under "Operands". .sp .ne 2 .mk .na \fB\fBshow-connections\fR [\fB-t\fR] [\fB-u\fR \fIusername\fR] [\fB-c\fR \fIcomputername\fR | \fB-s\fR \fIsharename\fR] \fIserver\fR\fR .ad .br .sp .6 .RS 4n Shows information about the SMB tree connections made on the server. The \fB-c\fR option specifies the computer name for connections of interest to the client. The \fB-s\fR option specifies the share name for connections of interest to the client. The \fB-t\fR option specifies the command header to be displayed. .RE .sp .ne 2 .mk .na \fB\fBshow-files\fR [\fB-t\fR] [\fB-u\fR \fIusername\fR] \fIserver\fR\fR .ad .br .sp .6 .RS 4n Shows information about the files open over SMB on the server. The \fB-t\fR option specifies the command header to be displayed. .RE .sp .ne 2 .mk .na \fB\fBshow-sessions\fR [\fB-t\fR] [\fB-u\fR \fIusername\fR] \fIserver\fR\fR .ad .br .sp .6 .RS 4n Shows information about the SMB user sessions on the server. The \fB-t\fR option specifies command header to be displayed. .RE .sp .ne 2 .mk .na \fB\fBshow-shares\fR [\fB-t\fR] [\fB-A\fR | \fB-u\fR \fIusername\fR] \fIserver\fR\fR .ad .br .sp .6 .RS 4n Shows information about the SMB shares on the server. The \fB-t\fR option specifies the command header to be displayed. The \fB-A\fR option specifies anonymous user. .RE .SH EXIT STATUS .sp .LP The following exit values are returned: .sp .ne 2 .mk .na \fB0\fR .ad .RS 13n .rt Successful completion. .RE .sp .ne 2 .mk .na \fB>0\fR .ad .RS 13n .rt An error occurred. .RE .SH ATTRIBUTES .sp .LP See the \fBattributes\fR(7) man page for descriptions of the following attributes: .sp .TS tab( ) box; cw(2.75i) |cw(2.75i) lw(2.75i) |lw(2.75i) . ATTRIBUTE TYPE ATTRIBUTE VALUE _ Availability system/file-system/smb/common _ Utility Name and Options Uncommitted _ Utility Output Format Not-An-Interface _ \fBsmbadm join\fR Obsolete .TE .sp .SH SEE ALSO .sp .LP \fBpasswd\fR(1), \fBsmb\fR(5), \fBsmbautohome\fR(5), \fBattributes\fR(7), \fBpam_smb_passwd\fR(7), \fBsmf\fR(7), \fBgroupadd\fR(8), \fBidmap\fR(8), \fBidmapd\fR(8), \fBkclient\fR(8), \fBmount_smbfs\fR(8), \fBshare\fR(8), \fBsharectl\fR(8), \fBsmbd\fR(8), \fBsmbstat\fR(8)