usr/src/man/man1m/smbadm.1m

'\" te
.\" Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
.\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved.
.\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
.\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
.TH SMBADM 1M "April 9, 2016"
.SH NAME
smbadm \- configure and manage CIFS local groups and users, and manage domain
membership
.SH SYNOPSIS
.LP
.nf
\fBsmbadm add-member\fR -m \fImember\fR [[-m \fImember\fR] \&.\|.\|.] \fIgroup\fR
.fi

.LP
.nf
\fBsmbadm create\fR [-d \fIdescription\fR] \fIgroup\fR
.fi

.LP
.nf
\fBsmbadm delete\fR \fIgroup\fR
.fi

.LP
.nf
\fBsmbadm disable-user\fR \fIusername\fR
.fi

.LP
.nf
\fBsmbadm enable-user\fR \fIusername\fR
.fi

.LP
.nf
\fBsmbadm get\fR [[-p \fIproperty\fR] \&.\|.\|.] \fIgroup\fR
.fi

.LP
.nf
\fBsmbadm join\fR [-y] -u \fIusername\fR \fIdomain\fR
.fi

.LP
.nf
\fBsmbadm join\fR [-y] -w \fIworkgroup\fR
.fi

.LP
.nf
\fBsmbadm list\fR
.fi

.LP
.nf
\fBsmbadm lookup\fR \fIaccount-name\fR [\fIaccount-name\fR [\&.\|.\|.]]
.fi

.LP
.nf
\fBsmbadm remove-member\fR -m \fImember\fR [[-m \fImember\fR] \&.\|.\|.] \fIgroup\fR
.fi

.LP
.nf
\fBsmbadm rename\fR \fIgroup\fR \fInew-group\fR
.fi

.LP
.nf
\fBsmbadm set\fR -p \fIproperty\fR=\fIvalue\fR [[-p \fIproperty\fR=\fIvalue\fR] \&.\|.\|.] \fIgroup\fR
.fi

.LP
.nf
\fBsmbadm show\fR [-m] [-p] [\fIgroup\fR]
.fi

.SH DESCRIPTION
.LP
The \fBsmbadm\fR command is used to configure \fBCIFS\fR local groups and to
manage domain membership. You can also use the \fBsmbadm\fR command to enable
or disable SMB password generation for individual local users.
.sp
.LP
\fBCIFS\fR local groups can be used when Windows accounts must be members of
some local groups and when Windows style privileges must be granted. Solaris
local groups cannot provide these functions.
.sp
.LP
There are two types of local groups: user defined and built-in. Built-in local
groups are predefined local groups to support common administration tasks.
.sp
.LP
In order to provide proper identity mapping between \fBCIFS\fR local groups and
Solaris groups, a \fBCIFS\fR local group must have a corresponding Solaris
group. This requirement has two consequences: first, the group name must
conform to the intersection of the Windows and Solaris group name rules. Thus,
a \fBCIFS\fR local group name can be up to eight (8) characters long and
contain only lowercase characters and numbers. Second, a Solaris local group
has to be created before a \fBCIFS\fR local group can be created.
.sp
.LP
Built-in groups are standard Windows groups and are predefined by the
\fBCIFS\fR service. The built-in groups cannot be added, removed, or renamed,
and these groups do not follow the \fBCIFS\fR local group naming conventions.
.sp
.LP
When the \fBCIFS\fR server is started, the following built-in groups are
available:
.sp
.ne 2
.na
\fBAdministrators\fR
.ad
.sp .6
.RS 4n
Group members can administer the system.
.RE

.sp
.ne 2
.na
\fBBackup Operators\fR
.ad
.sp .6
.RS 4n
Group members can bypass file access controls to back up and restore files.
.RE

.sp
.ne 2
.na
\fBPower Users\fR
.ad
.sp .6
.RS 4n
Group members can share directories.
.RE

.sp
.LP
Solaris local users must have an SMB password for authentication and to gain
access to CIFS resources. This password is created by using the \fBpasswd\fR(1)
command when the \fBpam_smb_password\fR module is added to the system's PAM
configuration. See the \fBpam_smb_passwd\fR(5) man page.
.sp
.LP
The \fBdisable-user\fR and \fBenable-user\fR subcommands control SMB
password-generation for a specified local user. When disabled, the user is
prevented from connecting to the Solaris CIFS service. By default, SMB
password-generation is enabled for all local users.
.sp
.LP
To reenable a disabled user, you must use the \fBenable-user\fR subcommand and
then reset the user's password by using the \fBpasswd\fR command. The
\fBpam_smb_passwd.so.1\fR module must be added to the system's PAM
configuration to generate an SMB password.
.SS "Escaping Backslash Character"
.LP
For the \fBadd-member\fR, \fBremove-member\fR, and \fBjoin\fR (with \fB-u\fR)
subcommands, the backslash character (\fB\e\fR) is a valid separator between
member or user names and domain names. The backslash character is a shell
special character and must be quoted. For example, you might escape the
backslash character with another backslash character:
\fIdomain\fR\fB\e\e\fR\fIusername\fR. For more information about handling shell
special characters, see the man page for your shell.
.SH OPERANDS
.LP
The \fBsmbadm\fR command uses the following operands:
.sp
.ne 2
.na
\fB\fIdomain\fR\fR
.ad
.sp .6
.RS 4n
Specifies the name of an existing Windows domain to join.
.RE

.sp
.ne 2
.na
\fB\fIgroup\fR\fR
.ad
.sp .6
.RS 4n
Specifies the name of the \fBCIFS\fR local group.
.RE

.sp
.ne 2
.na
\fB\fIusername\fR\fR
.ad
.sp .6
.RS 4n
Specifies the name of a Solaris local user.
.RE

.SH SUBCOMMANDS
.LP
The \fBsmbadm\fR command includes these subcommands:
.sp
.ne 2
.na
\fB\fBadd-member\fR -m \fImember\fR [[-m \fImember\fR] \&.\|.\|.]
\fIgroup\fR\fR
.ad
.sp .6
.RS 4n
Adds the specified member to the specified \fBCIFS\fR local group. The \fB-m\fR
\fImember\fR option specifies the name of a \fBCIFS\fR local group member. The
member name must include an existing user name and an optional domain name.
.sp
Specify the member name in either of the following formats:
.sp
.in +2
.nf
[\fIdomain\fR\e]\fIusername\fR
[\fIdomain\fR/]\fIusername\fR
.fi
.in -2
.sp

For example, a valid member name might be \fBsales\eterry\fR or
\fBsales/terry\fR, where \fBsales\fR is the Windows domain name and \fBterry\fR
is the name of a user in the \fBsales\fR domain.
.RE

.sp
.ne 2
.na
\fB\fBcreate\fR [\fB-d\fR \fIdescription\fR] \fIgroup\fR\fR
.ad
.sp .6
.RS 4n
Creates a \fBCIFS\fR local group with the specified name. You can optionally
specify a description of the group by using the \fB-d\fR option.
.RE

.sp
.ne 2
.na
\fB\fBdelete\fR \fIgroup\fR\fR
.ad
.sp .6
.RS 4n
Deletes the specified \fBCIFS\fR local group. The built-in groups cannot be
deleted.
.RE

.sp
.ne 2
.na
\fB\fBdisable\fR \fIusername\fR\fR
.ad
.sp .6
.RS 4n
Disables SMB password-generation capabilities for the specified local user. A
disabled local user is prevented from accessing the system by means of the CIFS
service. When a local user account is disabled, you cannot use the \fBpasswd\fR
command to modify the user's SMB password until the user account is reenabled.
.RE

.sp
.ne 2
.na
\fB\fBenable\fR \fIusername\fR\fR
.ad
.sp .6
.RS 4n
Enables SMB password-generation capabilities for the specified local user.
After the password-generation capabilities are reenabled, you must use the
\fBpasswd\fR command to generate the SMB password for the local user before he
can connect to the CIFS service.
.sp
The \fBpasswd\fR command manages both the Solaris password and SMB password for
this user if the \fBpam_smb_passwd\fR module has been added to the system's PAM
configuration.
.RE

.sp
.ne 2
.na
\fB\fBget\fR [[\fB-p\fR \fIproperty\fR=\fIvalue\fR] \&.\|.\|.] \fIgroup\fR\fR
.ad
.sp .6
.RS 4n
Retrieves property values for the specified group. If no property is specified,
all property values are shown.
.RE

.sp
.ne 2
.na
\fB\fBjoin\fR \fB[-y] -u\fR \fIusername\fR \fIdomain\fR\fR
.ad
.sp .6
.RS 4n
Joins a Windows domain or a workgroup.
.sp
The default mode for the \fBCIFS\fR service is workgroup mode, which uses the
default workgroup name, \fBWORKGROUP\fR.
.sp
An authenticated user account is required to join a domain, so you must specify
the Windows administrative user name with the \fB-u\fR option. If the password
is not specified on the command line, the user is prompted for it. This user
should be the domain administrator or any user who has administrative
privileges for the target domain.
.sp
\fIusername\fR and \fIdomain\fR can be entered in any of the following formats:
.sp
.in +2
.nf
\fIusername\fR[+\fIpassword\fR] \fIdomain\fR
\fIdomain\fR\e\fIusername\fR[+\fIpassword\fR]
\fIdomain\fR/\fIusername\fR[+\fIpassword\fR]
\fIusername\fR@\fIdomain\fR
.fi
.in -2
.sp

\&...where \fIdomain\fR can be the NetBIOS or DNS domain name.
.sp
If a machine trust account for the system already exists on a domain
controller, any authenticated user account can be used when joining the domain.
However, if the machine trust account does \fBnot\fR already exist, an account
that has administrative privileges on the domain is required to join the
domain.
Specifying \fB-y\fR will bypass the smb service restart prompt.
.RE

.sp
.ne 2
.na
\fB\fBjoin\fR \fB[-y] -w\fR \fIworkgroup\fR\fR
.ad
.sp .6
.RS 4n
Joins a Windows domain or a workgroup.
.sp
The \fB-w\fR \fIworkgroup\fR option specifies the name of the workgroup to join
when using the \fBjoin\fR subcommand.
Specifying \fB-y\fR will bypass the smb service restart prompt.
.RE

.sp
.ne 2
.na
\fB\fBlist\fR\fR
.ad
.sp .6
.RS 4n
Shows information about the current workgroup or domain. The information
typically includes the workgroup name or the primary domain name. When in
domain mode, the information includes domain controller names and trusted
domain names.
.sp
Each entry in the output is identified by one of the following tags:
.sp
.ne 2
.na
\fB\fB- [*] -\fR\fR
.ad
.RS 11n
Primary domain
.RE

.sp
.ne 2
.na
\fB\fB- [.] -\fR\fR
.ad
.RS 11n
Local domain
.RE

.sp
.ne 2
.na
\fB\fB- [-] -\fR\fR
.ad
.RS 11n
Other domains
.RE

.sp
.ne 2
.na
\fB\fB- [+] -\fR\fR
.ad
.RS 11n
Selected domain controller
.RE

.RE

.sp
.ne 2
.na
\fB\fBlookup\fR\fR \fIaccount-name\fR [\fIaccount-name\fR [\&.\|.\|.]]

.ad
.sp .6
.RS 4n
Lookup the SID for the given \fIaccount-name\fR, or lookup the
\fIaccount-name\fR for the given SID.  This subcommand is
primarily for diagnostic use, to confirm whether the server
can lookup domain accounts and/or SIDs.
.RE

.sp
.ne 2
.na
\fB\fBremove-member\fR -m \fImember\fR [[-m \fImember\fR] \&.\|.\|.]
\fIgroup\fR\fR
.ad
.sp .6
.RS 4n
Removes the specified member from the specified \fBCIFS\fR local group. The
\fB-m\fR \fImember\fR option specifies the name of a \fBCIFS\fR local group
member. The member name must include an existing user name and an optional
domain name.
.sp
Specify the member name in either of the following formats:
.sp
.in +2
.nf
[\fIdomain\fR\e]\fIusername\fR
[\fIdomain\fR/]\fIusername\fR
.fi
.in -2
.sp

For example, a valid member name might be \fBsales\eterry\fR or
\fBsales/terry\fR, where \fBsales\fR is the Windows domain name and \fBterry\fR
is the name of a user in the \fBsales\fR domain.
.RE

.sp
.ne 2
.na
\fB\fBrename\fR \fIgroup\fR \fInew-group\fR\fR
.ad
.sp .6
.RS 4n
Renames the specified \fBCIFS\fR local group. The group must already exist. The
built-in groups cannot be renamed.
.RE

.sp
.ne 2
.na
\fB\fBset\fR \fB-p\fR \fIproperty\fR=\fIvalue\fR [[\fB-p\fR
\fIproperty\fR=\fIvalue\fR] \&.\|.\|.] \fIgroup\fR\fR
.ad
.sp .6
.RS 4n
Sets configuration properties for a \fBCIFS\fR local group. The description and
the privileges for the built-in groups cannot be changed.
.sp
The \fB-p\fR \fIproperty\fR\fB=\fR\fIvalue\fR option specifies the list of
properties to be set on the specified group.
.sp
The group-related properties are as follows:
.sp
.ne 2
.na
\fB\fBbackup=[on|off]\fR\fR
.ad
.sp .6
.RS 4n
Specifies whether members of the \fBCIFS\fR local group can bypass file access
controls to back up file system objects.
.RE

.sp
.ne 2
.na
\fB\fBdescription=\fR\fIdescription-text\fR\fR
.ad
.sp .6
.RS 4n
Specifies a text description for the \fBCIFS\fR local group.
.RE

.sp
.ne 2
.na
\fB\fBrestore=[on|off]\fR\fR
.ad
.sp .6
.RS 4n
Specifies whether members of the \fBCIFS\fR local group can bypass file access
controls to restore file system objects.
.RE

.sp
.ne 2
.na
\fB\fBtake-ownership=[on|off]\fR\fR
.ad
.sp .6
.RS 4n
Specifies whether members of the \fBCIFS\fR local group can take ownership of
file system objects.
.RE

.RE

.sp
.ne 2
.na
\fB\fBshow\fR [\fB-m\fR] [\fB-p\fR] [\fIgroup\fR]\fR
.ad
.sp .6
.RS 4n
Shows information about the specified \fBCIFS\fR local group or groups. If no
group is specified, information is shown for all groups. If the \fB-m\fR option
is specified, the group members are also shown. If the \fB-p\fR option is
specified, the group privileges are also shown.
.RE

.SH EXIT STATUS
.LP
The following exit values are returned:
.sp
.ne 2
.na
\fB0\fR
.ad
.RS 13n
Successful completion.
.RE

.sp
.ne 2
.na
\fB>0\fR
.ad
.RS 13n
An error occurred.
.RE

.SH ATTRIBUTES
.LP
See the \fBattributes\fR(5) man page for descriptions of the following
attributes:
.sp

.sp
.TS
box;
c | c
l | l .
ATTRIBUTE TYPE	ATTRIBUTE VALUE
_
Utility Name and Options	Uncommitted
_
Utility Output Format	Not-An-Interface
_
\fBsmbadm join\fR	Obsolete
.TE

.SH SEE ALSO
.LP
\fBpasswd\fR(1), \fBgroupadd\fR(1M), \fBidmap\fR(1M), \fBidmapd\fR(1M),
\fBkclient\fR(1M), \fBshare\fR(1M), \fBsharectl\fR(1M), \fBsharemgr\fR(1M),
\fBsmbd\fR(1M), \fBsmbstat\fR(1M), \fBsmb\fR(4), \fBsmbautohome\fR(4),
\fBattributes\fR(5), \fBpam_smb_passwd\fR(5), \fBsmf\fR(5)