svcadm(1M)을 검색하려면 섹션에서 1M 을 선택하고, 맨 페이지 이름에 svcadm을 입력하고 검색을 누른다.
smbadm(8)
System Administration Commands smbadm(8)
NAME
smbadm - configure and manage SMB local groups and users, manage domain
membership, manage persistent password information, and issue various
commands
SYNOPSIS
smbadm add-key [-u username]
smbadm add-member -m member [[-m member] ...] group
smbadm change-dc
smbadm create-group [-d description] group
smbadm crypt
smbadm delete-group group
smbadm disable-user username
smbadm enable-user username
smbadm get-group [[-p property] ...] group
smbadm join -u username [-o organizational-unit] domain
smbadm join -w workgroup
smbadm lookup-server //server
smbadm lookup-user [-u username] name | SID
smbadm remove-key [-u username]
smbadm remove-member -m member [[-m member] ...] group
smbadm rename-group group new-group
smbadm set-group -p property=value [[-p property=value] ...] group
smbadm show-connections [-t] [-u username] [-c computername | -s sharename]
server
smbadm show-dcs
smbadm show-domains
smbadm show-files [-t] [-u username] server
smbadm show-groups [-m] [-p] [group]
smbadm show-sessions [-t] [-u username] server
smbadm show-shares [-t] [-A | -u username] server
DESCRIPTION
The smbadm command is used to configure SMB local groups, to manage
domain membership, to manage persistent password information, and issue
various commands. You can also use the smbadm command to enable or dis‐
able SMB password generation for individual local users.
SMB local groups can be used when Windows accounts must be members of
some local groups and when Windows-style privileges must be granted.
Solaris local groups cannot provide these functions.
There are two types of local groups: user defined and built-in. Built-
in local groups are predefined local groups to support common adminis‐
tration tasks.
In order to provide proper identity mapping between SMB local groups
and Solaris groups, an SMB local group must have a corresponding
Solaris group. This requirement has two consequences: first, the group
name must conform to the intersection of the Windows and Solaris group
name rules. Thus, an SMB local group name can be up to eight (8) char‐
acters long and contain only lowercase characters and numbers. Second,
a Solaris local group has to be created before an SMB local group can
be created.
Built-in groups are standard Windows groups and are predefined by the
SMB service. The built-in groups cannot be added, removed, or renamed,
and these groups do not follow the SMB local group naming conventions.
When the SMB server is started, the following built-in groups are
available:
Administrators
Group members can administer the system.
Backup Operators
Group members can bypass file access controls to back up and
restore files.
Power Users
Group members can share directories.
Solaris local users must have an SMB password for authentication and to
gain access to SMB resources. This password is created by using the
passwd(1) command when the pam_smb_password module is added to the sys‐
tem's PAM configuration. See the pam_smb_passwd(7) man page.
The disable-user and enable-user subcommands control SMB password-gen‐
eration for a specified local user. When disabled, the user is pre‐
vented from connecting to the Solaris SMB service. By default, SMB
password-generation is enabled for all local users.
To reenable a disabled user, you must use the enable-user subcommand
and then reset the user's password by using the passwd command. The
pam_smb_passwd.so.1 module must be added to the system's PAM configura‐
tion to generate an SMB password.
Escaping Backslash Character
For the add-member, remove-member, and join (with -u) subcommands, the
backslash character (\) is a valid separator between member or user
names and domain names. The backslash character is a shell special
character and must be quoted. For example, you might escape the back‐
slash character with another backslash character: domain\\username. For
more information about handling shell special characters, see the man
page for your shell.
OPERANDS
The smbadm command uses the following operands:
domain
Specifies the name of an existing Windows domain to join.
group
Specifies the name of the SMB local group.
username
Specifies the name of a Windows user. username can be specified in
any of the following formats:
domain\username[+password]
domain/username[+password]
username@domain
username
...where domain can be the NetBIOS or DNS domain name.
server
Specifies the name or IP address of the local host.
SUB-COMMANDS
The smbadm command includes these subcommands:
add-key [-u username]
Specifies persistent password information to be used for an SMB
server user account. When you specify this information, mounts can
be done without a password prompt in non-Kerberos configurations.
Kerberos sites should use Kerberos automatically, not prompt for a
password. If a default domain is available in SMF, the domain can
be omitted. If a user name is not specified, the Solaris user
account name is used. An encrypted (hashed) password can also be
used, see the crypt subcommand. The command can also read a pass‐
word from standard input, prompting if standard input is a TTY.
Passwords can also be stored for a specific server by using a
server name in place of the domain name.
The persistent password information will also be stored in
/var/smb/smbfspasswd for the user running the command.
add-member -m member [[-m member] ...] group
Adds the specified member to the specified SMB local group. The -m
member option specifies the name of an SMB local group member. The
member name must include an existing user name and an optional
domain name.
Specify the member name in either of the following formats:
[domain\]username
[domain/]username
For example, a valid member name might be sales\terry or
sales/terry, where sales is the Windows domain name and terry is
the name of a user in the sales domain.
change-dc
Requests a change to the currently selected Domain Controller.
create-group [-d description] group
Creates an SMB local group with the specified name. You can option‐
ally specify a description of the group by using the -d option.
crypt
Creates a hash of a password. This subcommand prompts for a pass‐
word and writes the hash to standard output. This hash value is
suitable for use as a value for the encrypted password option for
smbfs mount and various smbadm subcommands.
delete-group group
Deletes the specified SMB local group. The built-in groups cannot
be deleted.
disable-user username
Disables SMB password-generation capabilities for the specified
local user. A disabled local user is prevented from accessing the
system by means of the SMB service. When a local user account is
disabled, you cannot use the passwd command to modify the user's
SMB password until the user account is reenabled.
enable-user username
Enables SMB password-generation capabilities for the specified
local user. After the password-generation capabilities are reen‐
abled, you must use the passwd command to generate the SMB password
for the local user before they can connect to the SMB service.
The passwd command manages both the Solaris password and SMB pass‐
word for this user if the pam_smb_passwd module has been added to
the system's PAM configuration.
get-group [[-p property=value] ...] group
Retrieves property values for the specified group. If no property
is specified, all property values are shown.
join -u username [-o organizational-unit] domain
Joins a Windows domain or a workgroup.
The default mode for the SMB service is workgroup mode, which uses
the default workgroup name, WORKGROUP.
An authenticated user account is required to join a domain, so you
must specify a Windows user name with the -u option. If the pass‐
word is not specified on the command line, the user is prompted for
it. The following users are allowed to perform domain join:
o Domain administrator. Can join any number of systems to
the domain with machine trust accounts placed in any
containers.
o Delegated administrator with authority over one or more
OUs. Can join any number of systems to a domain with
machine account location designated in the OUs they are
responsible for.
o Normal user with machine accounts pre-staged by adminis‐
trator. Can join a system to the domain as pre-autho‐
rized by an administrator.
o Normal user. Normally authorized to join a limited num‐
ber of systems. For more details see the Active Direc‐
tory documentation and consult the Active Directory
domain administrator.
username and domain can be entered in any of the following formats:
username[+password] domain
domain\username[+password]
domain/username[+password]
username@domain
...where domain can be the NetBIOS or DNS domain name.
By default, a machine trust account for the system will be automat‐
ically created in the default container for computer accounts
(cn=Computers) as part of the domain join operation if the account
does not already exist in Active Directory.
The -o organizational-unit option specifies an alternative organi‐
zational unit in which the system's machine trust account will be
created.
If the system's computer account already exists, you do not need to
specify the -o option. A warning will be given if the OU specified
is not the one that the account is in.
The organizational-unit is specified as a comma-separated list of
one or more name-value pairs using the domain-relative distin‐
guished name (DN) format, for example, 'ou=innerOU,ou=outerOU'.
The following reserved characters when specified in an attribute
value must be escaped using the backslash character (\). The back‐
slash character is a shell special character and so distinguished
names that contain the following reserved characters must be
quoted. It is recommended to use single quotes as opposed to double
quotes because backslash enclosed by double quotes can retain its
special meaning in some cases. For more information about handling
shell special characters, see the man page for your shell.
---------+----------------------
Reserved |
Character| Description
---------+----------------------
, comma
+ plus sign
" double quote
\ backslash
< left angle bracket
> right angle bracket
; semicolon
= equals sign
# # character at the beginning of a string
For example, in the following hierarchy:
dc=com
dc=mycompany
ou=Departments
ou=Engineering
ou=Payables,Receivables,and Payroll
:
:
If the machine trust account is intended to be created in the sub-
OU named engineering, the organizational-unit should be specified
as:
ou=Engineering,ou=Departments
If the machine trust account is intended to be created in the sec‐
ond sub-OU, the organizational-unit should be specified with back‐
slashes and enclosed in single quotes as follows:
ou=Payables\,Receivables\,and Payroll,ou=Departments'
join -w workgroup
Joins a Windows domain or a workgroup.
The -w workgroup option specifies the name of the workgroup to
join when using the join subcommand.
lookup-server //server
Resolves the specified server to IP address, NetBIOS domain, and
NetBIOS server name. server can be one of the following:
o NetBIOS hostname
o DNS hostname
o IP address
lookup-user [-u username] name | SID
Resolves information about the name or SID of an account in the
current domain or any trusted domain.
remove-key [-u username]
Erases the passwords for the user running the command. The pass‐
words in /var/smb/smbfspasswd will also be deleted for the user
running the command.
The username and domain name portions of the name are optional. If
a default domain is available in SMF, the domain can be omitted. If
a username is not specified, all of the keys that are stored for
the user who is running the command will be deleted.
If the user's password is stored for a specific server, the server
name should be specified in place of the domain name.
remove-member -m member [[-m member] ...] group
Removes the specified member from the specified SMB local group.
The -m member option specifies the name of an SMB local group mem‐
ber. The member name must include an existing user name and an
optional domain name.
Specify the member name in either of the following formats:
[domain\]username
[domain/]username
For example, a valid member name might be sales\terry or
sales/terry, where sales is the Windows domain name and terry is
the name of a user in the sales domain.
rename-group group new-group
Renames the specified SMB local group. The group must already
exist. The built-in groups cannot be renamed.
set-group -p property=value [[-p property=value] ...] group
Sets configuration properties for an SMB local group. The descrip‐
tion and the privileges for the built-in groups cannot be changed.
The -p property=value option specifies the list of properties to
be set on the specified group.
The group-related properties are as follows:
backup=[on|off]
Specifies whether members of the SMB local group can bypass
file access controls to back up file system objects.
description=description-text
Specifies a text description for the SMB local group.
restore=[on|off]
Specifies whether members of the SMB local group can bypass
file access controls to restore file system objects.
take-ownership=[on|off]
Specifies whether members of the SMB local group can take own‐
ership of file system objects.
show-dcs
Shows information about the Active Directory Domain Controllers
that have been discovered. This option is only available in domain
mode. Information is displayed including the domain name, an AD
site name if configured, the current Domain Controller and its
state, the Preferred Domain Controller if configured, and a list of
Domain Controllers that have been found. If an AD site has been
configured then any Domain Controllers that are members of the site
are indicated as such.
show-domains
Shows information about the current workgroup or domain. The infor‐
mation typically includes the workgroup name or the primary domain
name. When in domain mode, the information includes domain con‐
troller names and trusted domain names.
Each entry in the output is identified by one of the following
tags:
o [*] Primary domain
o [.] Local domain
o [-] Other domains
o [+] Selected domain controller
show-groups [-m] [-p] [group]
Shows information about the specified SMB local group or groups. If
no group is specified, information is shown for all groups. If the
-m option is specified, the group members are also shown. If the -p
option is specified, the group privileges are also shown.
The following set of subcommands shows information about the user
shares, sessions, connections, and open files on a local or a remote
server.
An authenticated user account is required to show the types of data
listed above, so you must specify the Windows administrative user name
with the -u option. If the password is not specified on the command
line, the user is prompted for it. This user should be the domain
administrator or a user who has administrative privileges for the tar‐
get domain. If a user name is not specified, the Solaris user account
name is used.
The username can be in any of the formats described under "Operands".
show-connections [-t] [-u username] [-c computername | -s sharename]
server
Shows information about the SMB tree connections made on the
server. The -c option specifies the computer name for connections
of interest to the client. The -s option specifies the share name
for connections of interest to the client. The -t option specifies
the command header to be displayed.
show-files [-t] [-u username] server
Shows information about the files open over SMB on the server. The
-t option specifies the command header to be displayed.
show-sessions [-t] [-u username] server
Shows information about the SMB user sessions on the server. The -t
option specifies command header to be displayed.
show-shares [-t] [-A | -u username] server
Shows information about the SMB shares on the server. The -t option
specifies the command header to be displayed. The -A option speci‐
fies anonymous user.
EXIT STATUS
The following exit values are returned:
0 Successful completion.
>0 An error occurred.
ATTRIBUTES
See the attributes(7) man page for descriptions of the following
attributes:
tab() box; cw(2.75i) |cw(2.75i) lw(2.75i) |lw(2.75i) ATTRIBUTE TYPEAT‐
TRIBUTE VALUE _ Availabilitysystem/file-system/smb _ Utility Name and
OptionsUncommitted _ Utility Output FormatNot-An-Interface _ smbadm
joinObsolete
SEE ALSO
passwd(1), smb(5), smbautohome(5), attributes(7), pam_smb_passwd(7),
smf(7), groupadd(8), idmap(8), idmapd(8), kclient(8), mount_smbfs(8),
share(8), sharectl(8), smbd(8), smbstat(8)
Oracle Solaris 11.4 27 Nov 2017 smbadm(8)