홈
제품
Red Hat Enterprise Linux
10
Configuring and using network file services
1.20. Frequently used Samba command-line utilities

1.20. Frequently used Samba command-line utilities

This chapter describes frequently used commands when working with a Samba server.

1.20.1. Using the net ads join and net rpc join commands
링크 복사

Using the join subcommand of the net utility, you can join Samba to an AD or NT4 domain. To join the domain, you must create the /etc/samba/smb.conf file manually, and optionally update additional configurations, such as PAM.

중요

Red Hat recommends using the realm utility to join a domain. The realm utility automatically updates all involved configuration files.

Procedure

Manually create the /etc/samba/smb.conf file with the following settings:

For an AD domain member:

[global]
workgroup = domain_name
security = ads
passdb backend = tdbsam
realm = AD_REALM

For an NT4 domain member:

[global]
workgroup = domain_name
security = user
passdb backend = tdbsam

Add an ID mapping configuration for the * default domain and for the domain you want to join to the [global] section in the /etc/samba/smb.conf file.
Verify the /etc/samba/smb.conf file:
```
# testparm
```
Join the domain as the domain administrator:
- To join an AD domain:
  # net ads join -U "DOMAIN\administrator"
- To join an NT4 domain:
  # net rpc join -U "DOMAIN\administrator"
Append the winbind source to the passwd and group database entry in the /etc/nsswitch.conf file:
```
passwd:     files winbind
group:      files winbind
```
Enable and start the winbind service:
```
# systemctl enable --now winbind
```
Optional: Configure PAM using the authselect utility.
For details, see the authselect(8) man page on your system.
Optional: For AD environments, configure the Kerberos client.
For details, see the documentation of your Kerberos client.

1.20.2. Using the net rpc rights command
링크 복사

In Windows, you can assign privileges to accounts and groups to perform special operations, such as setting ACLs on a share or upload printer drivers. On a Samba server, you can use the net rpc rights command to manage privileges.

Listing privileges you can set

To list all available privileges and their owners, use the net rpc rights list command. For example:

# net rpc rights list -U "DOMAIN\administrator"
Enter DOMAIN\administrator's password:
     SeMachineAccountPrivilege  Add machines to domain
      SeTakeOwnershipPrivilege  Take ownership of files or other objects
             SeBackupPrivilege  Back up files and directories
            SeRestorePrivilege  Restore files and directories
     SeRemoteShutdownPrivilege  Force shutdown from a remote system
      SePrintOperatorPrivilege  Manage printers
           SeAddUsersPrivilege  Add users and groups to the domain
       SeDiskOperatorPrivilege  Manage disk shares
           SeSecurityPrivilege  System security

Granting privileges

To grant a privilege to an account or group, use the net rpc rights grant command.

For example, grant the SePrintOperatorPrivilege privilege to the DOMAIN\printadmin group:

# net rpc rights grant "DOMAIN\printadmin" SePrintOperatorPrivilege -U "DOMAIN\administrator"
Enter DOMAIN\administrator's password:
Successfully granted rights.

Revoking privileges

To revoke a privilege from an account or group, use the net rpc rights revoke command.

For example, to revoke the SePrintOperatorPrivilege privilege from the DOMAIN\printadmin group:

# net rpc rights remoke "DOMAIN\printadmin" SePrintOperatorPrivilege -U "DOMAIN\administrator"
Enter DOMAIN\administrator's password:
Successfully revoked rights.

1.20.3. Using the net rpc share command
링크 복사

The net rpc share command provides the capability to list, add, and remove shares on a local or remote Samba or Windows server.

Listing shares

To list the shares on an SMB server, use the net rpc share list command. Optionally, pass the -S server_name parameter to the command to list the shares of a remote server. For example:

# net rpc share list -U "DOMAIN\administrator" -S server_name
Enter DOMAIN\administrator's password:
IPC$
share_1
share_2
...

참고

Shares hosted on a Samba server that have browseable = no set in their section in the /etc/samba/smb.conf file are not displayed in the output.

Adding a share

The net rpc share add command enables you to add a share to an SMB server.

For example, to add a share named example on a remote Windows server that shares the C:\example\ directory:

# net rpc share add example="C:\example" -U "DOMAIN\administrator" -S server_name

참고

You must omit the trailing backslash in the path when specifying a Windows directory name.

To use the command to add a share to a Samba server:

The user specified in the -U parameter must have the SeDiskOperatorPrivilege privilege granted on the destination server.
You must write a script that adds a share section to the /etc/samba/smb.conf file and reloads Samba. The script must be set in the add share command parameter in the [global] section in /etc/samba/smb.conf. For further details, see the add share command description in the smb.conf(5) man page on your system.

Removing a share

The net rpc share delete command enables you to remove a share from an SMB server.

For example, to remove the share named example from a remote Windows server:

# net rpc share delete example -U "DOMAIN\administrator" -S server_name

To use the command to remove a share from a Samba server:

The user specified in the -U parameter must have the SeDiskOperatorPrivilege privilege granted.
You must write a script that removes the share’s section from the /etc/samba/smb.conf file and reloads Samba. The script must be set in the delete share command parameter in the [global] section in /etc/samba/smb.conf. For further details, see the delete share command description in the smb.conf(5) man page on your system.

1.20.4. Using the net user command
링크 복사

The net user command enables you to perform the following actions on an AD DC or NT4 PDC:

List all user accounts
Add users
Remove Users

참고

Specifying a connection method, such as ads for AD domains or rpc for NT4 domains, is only required when you list domain user accounts. Other user-related subcommands can auto-detect the connection method.

Pass the -U user_name parameter to the command to specify a user that is allowed to perform the requested action.

Listing domain user accounts

To list all users in an AD domain:

# net ads user -U "DOMAIN\administrator"

To list all users in an NT4 domain:

# net rpc user -U "DOMAIN\administrator"

Adding a user account to the domain

On a Samba domain member, you can use the net user add command to add a user account to the domain.

For example, add the user account to the domain:

Add the account:

# net user add user password -U "DOMAIN\administrator"
User user added

Optional: Use the remote procedure call (RPC) shell to enable the account on the AD DC or NT4 PDC. For example:

# net rpc shell -U DOMAIN\administrator -S DC_or_PDC_name
Talking to domain DOMAIN (S-1-5-21-1424831554-512457234-5642315751)

net rpc> user edit disabled user: no
Set user's disabled flag from [yes] to [no]

net rpc> exit

Deleting a user account from the domain

On a Samba domain member, you can use the net user delete command to remove a user account from the domain.

For example, to remove the user account from the domain:

# net user delete user -U "DOMAIN\administrator"
User user deleted

1.20.5. Using the rpcclient utility
링크 복사

The rpcclient utility enables you to manually execute client-side Microsoft Remote Procedure Call (MS-RPC) functions on a local or remote SMB server. However, most of the features are integrated into separate utilities provided by Samba. Use rpcclient only for testing MS-PRC functions.

Prerequisites

The samba-client package is installed.

Procedure

You can use the rpcclient utility to:

Manage the printer Spool Subsystem (SPOOLSS) by assigning a driver to a printer:

# rpcclient server_name -U "DOMAIN\administrator" -c 'setdriver "printer_name" "driver_name"'
Enter DOMAIN\administrators password:
Successfully set printer_name to driver driver_name.

Retrieve information about an SMB server by listing all file shares and shared printers:

# rpcclient server_name -U "DOMAIN\administrator" -c 'netshareenum'
Enter DOMAIN\administrators password:
netname: Example_Share
	remark:
	path:   C:\srv\samba\example_share\
	password:
netname: Example_Printer
	remark:
	path:   C:\var\spool\samba\
	password:

Perform actions using the Security Account Manager Remote (SAMR) protocol by listing Users on an SMB Server:
```
# rpcclient server_name -U "DOMAIN\administrator" -c 'enumdomusers'
Enter DOMAIN\administrators password:
user:[user1] rid:[0x3e8]
user:[user2] rid:[0x3e9]
```
If you run the command against a standalone server or a domain member, it lists the users in the local database. Running the command against an AD DC or NT4 PDC lists the domain users.
For more information, please see the rpcclient(1) man page on your system.

1.20.6. Using the samba-regedit application
링크 복사

Certain settings, such as printer configurations, are stored in the registry on the Samba server. You can use the ncurses-based samba-regedit application to edit the registry of a Samba server.

samba regedit

Prerequisites

The samba-client package is installed.

Procedure

To start the application, enter:
```
# samba-regedit
```
Use the following keys:
Cursor up and cursor down: Navigate through the registry tree and the values.
Enter: Opens a key or edits a value.
Tab: Switches between the Key and Value pane.
Ctrl+C: Closes the application.

1.20.7. Using the smbcontrol utility
링크 복사

The smbcontrol utility enables you to send command messages to the smbd, nmbd, winbindd, or all of these services. These control messages instruct the service, for example, to reload its configuration.

Prerequisites

The samba-common-tools package is installed.

Procedure

Reload the configuration of the smbd, nmbd, winbindd services by sending the reload-config message type to the all destination:
```
# smbcontrol all reload-config
```
For more information, see the smbcontrol(1) man page on your system.

1.20.8. Using the smbpasswd utility
링크 복사

The smbpasswd utility manages user accounts and passwords in the local Samba database. For more information, see the smbpasswd(8) man page on your system.

Prerequisites

The samba-common-tools package is installed.

Procedure

If you run the command as a user, smbpasswd changes the Samba password of the user who run the command. For example:
```
[user@server ~]$ smbpasswd
New SMB password: password
Retype new SMB password: password
```

If you run smbpasswd as the root user, you can use the utility, for example, to:

Create a new user:
```
[root@server ~]# smbpasswd -a user_name
New SMB password: password
Retype new SMB password: password
Added user user_name.
```
참고
Before you can add a user to the Samba database, you must create the account in the local operating system.

Enable a Samba user:

[root@server ~]# smbpasswd -e user_name
Enabled user user_name.

Disable a Samba user:

[root@server ~]# smbpasswd -x user_name
Disabled user user_name

Delete a user:

[root@server ~]# smbpasswd -x user_name
Deleted user user_name.

1.20.9. Using the smbstatus utility
링크 복사

The smbstatus utility reports on:

Connections per PID of each smbd daemon to the Samba server. This report includes the user name, primary group, SMB protocol version, encryption, and signing information.
Connections per Samba share. This report includes the PID of the smbd daemon, the IP of the connecting machine, the time stamp when the connection was established, encryption, and signing information.
A list of locked files. The report entries include further details, such as opportunistic lock (oplock) types

Prerequisites

The samba package is installed.
The smbd service is running.

Procedure

Run the smbstatus utility:

# smbstatus

Samba version 4.15.2
PID  Username              Group                Machine                            Protocol Version  Encryption  Signing
....-------------------------------------------------------------------------------------------------------------------------
963  DOMAIN\administrator  DOMAIN\domain users  client-pc  (ipv4:192.0.2.1:57786)  SMB3_02           -           AES-128-CMAC

Service  pid  Machine    Connected at                  Encryption  Signing:
....---------------------------------------------------------------------------
example  969  192.0.2.1  Thu Nov  1 10:00:00 2018 CEST  -           AES-128-CMAC

Locked files:
Pid  Uid    DenyMode   Access    R/W     Oplock      SharePath           Name      Time
....--------------------------------------------------------------------------------------------------------
969  10000  DENY_WRITE 0x120089  RDONLY  LEASE(RWH)  /srv/samba/example  file.txt  Thu Nov  1 10:00:00 2018

For more information, see the smbstatus(1) man page on your system.

1.20.10. Using the smbtar utility
링크 복사

The smbtar utility backs up the content of an SMB share or a subdirectory of it and stores the content in a tar archive. Alternatively, you can write the content to a tape device. For more information, see the smbtar(1) man page on your system.

Prerequisites

The samba-client package is installed.

Procedure

Use the following command to back up the content of the demo directory on the //server/example/ share and store the content in the /root/example.tar archive:
```
# smbtar -s server -x example -u user_name -p password -t /root/example.tar
```

1.20.11. Using the wbinfo utility
링크 복사

The wbinfo utility queries and returns information created and used by the winbindd service. For more information, see the wbinfo(1) man page on your system.

Prerequisites

The samba-winbind-clients package is installed.

Procedure

You can use wbinfo, for example, to:

List domain users:

# wbinfo -u
AD\administrator
AD\guest
...

List domain groups:

# wbinfo -g
AD\domain computers
AD\domain admins
AD\domain users
...

Display the SID of a user:

# wbinfo --name-to-sid="AD\administrator"
S-1-5-21-1762709870-351891212-3141221786-500 SID_USER (1)

Display information about domains and trusts:

# wbinfo --trusted-domains --verbose
Domain Name   DNS Domain            Trust Type  Transitive  In   Out
BUILTIN                             None        Yes         Yes  Yes
server                              None        Yes         Yes  Yes
DOMAIN1       domain1.example.com   None        Yes         Yes  Yes
DOMAIN2       domain2.example.com   External    No          Yes  Yes

1.20. Frequently used Samba command-line utilities

1.20.1. Using the net ads join and net rpc join commands
링크 복사

1.20.2. Using the net rpc rights command
링크 복사

1.20.4. Using the net user command
링크 복사

1.20.5. Using the rpcclient utility
링크 복사

1.20.6. Using the samba-regedit application
링크 복사

1.20.7. Using the smbcontrol utility
링크 복사

1.20.8. Using the smbpasswd utility
링크 복사

1.20.9. Using the smbstatus utility
링크 복사

1.20.10. Using the smbtar utility
링크 복사

1.20.11. Using the wbinfo utility
링크 복사

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat 소개

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

1.20. Frequently used Samba command-line utilities

1.20.1. Using the net ads join and net rpc join commands링크 복사링크가 클립보드에 복사되었습니다!

1.20.2. Using the net rpc rights command링크 복사링크가 클립보드에 복사되었습니다!

1.20.3. Using the net rpc share command링크 복사링크가 클립보드에 복사되었습니다!

1.20.4. Using the net user command링크 복사링크가 클립보드에 복사되었습니다!

1.20.5. Using the rpcclient utility링크 복사링크가 클립보드에 복사되었습니다!

1.20.6. Using the samba-regedit application링크 복사링크가 클립보드에 복사되었습니다!

1.20.7. Using the smbcontrol utility링크 복사링크가 클립보드에 복사되었습니다!

1.20.8. Using the smbpasswd utility링크 복사링크가 클립보드에 복사되었습니다!

1.20.9. Using the smbstatus utility링크 복사링크가 클립보드에 복사되었습니다!

1.20.10. Using the smbtar utility링크 복사링크가 클립보드에 복사되었습니다!

1.20.11. Using the wbinfo utility링크 복사링크가 클립보드에 복사되었습니다!

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat 소개

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

1.20.1. Using the net ads join and net rpc join commands
링크 복사

1.20.2. Using the net rpc rights command
링크 복사

1.20.3. Using the net rpc share command
링크 복사

1.20.4. Using the net user command
링크 복사

1.20.5. Using the rpcclient utility
링크 복사

1.20.6. Using the samba-regedit application
링크 복사

1.20.7. Using the smbcontrol utility
링크 복사

1.20.8. Using the smbpasswd utility
링크 복사

1.20.9. Using the smbstatus utility
링크 복사

1.20.10. Using the smbtar utility
링크 복사

1.20.11. Using the wbinfo utility
링크 복사