diff options
| author | Ivo De Decker <ivo.dedecker@ugent.be> | 2013-05-10 13:33:02 +0200 |
|---|---|---|
| committer | Ivo De Decker <ivo.dedecker@ugent.be> | 2013-05-10 13:33:02 +0200 |
| commit | 31202ad025bcdeb2585d18dc3f4641b5cf9c0ec4 (patch) | |
| tree | 32c20d66684ac97b86e55495146e9a676bfae85a /docs/htmldocs/manpages/smbcacls.1.html | |
| parent | 2865eba17fddda6c49f1209ca92d539111e7ff93 (diff) | |
| download | samba-31202ad025bcdeb2585d18dc3f4641b5cf9c0ec4.tar.gz | |
Imported Upstream version 4.0.0+dfsg1upstream/4.0.0+dfsg1
Diffstat (limited to 'docs/htmldocs/manpages/smbcacls.1.html')
| -rw-r--r-- | docs/htmldocs/manpages/smbcacls.1.html | 125 |
1 files changed, 0 insertions, 125 deletions
diff --git a/docs/htmldocs/manpages/smbcacls.1.html b/docs/htmldocs/manpages/smbcacls.1.html deleted file mode 100644 index 42f3f60156..0000000000 --- a/docs/htmldocs/manpages/smbcacls.1.html +++ /dev/null @@ -1,125 +0,0 @@ -<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>smbcacls</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" title="smbcacls"><a name="smbcacls.1"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>smbcacls — Set or get ACLs on an NT file or directory names</p></div><div class="refsynopsisdiv" title="Synopsis"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="literal">smbcacls</code> {//server/share} {/filename} [-D|--delete acls] [-M|--modify acls] [-a|--add acls] [-S|--set acls] [-C|--chown name] [-G|--chgrp name] [-I allow|romove|copy] [--numeric] [-t] [-U username] [-h] [-d]</p></div></div><div class="refsect1" title="DESCRIPTION"><a name="id265699"></a><h2>DESCRIPTION</h2><p>This tool is part of the <a class="citerefentry" href="samba.7.html"><span class="citerefentry"><span class="refentrytitle">samba</span>(7)</span></a> suite.</p><p>The <code class="literal">smbcacls</code> program manipulates NT Access Control - Lists (ACLs) on SMB file shares. </p></div><div class="refsect1" title="OPTIONS"><a name="id265727"></a><h2>OPTIONS</h2><p>The following options are available to the <code class="literal">smbcacls</code> program. - The format of ACLs is described in the section ACL FORMAT </p><div class="variablelist"><dl><dt><span class="term">-a|--add acls</span></dt><dd><p>Add the ACLs specified to the ACL list. Existing - access control entries are unchanged. </p></dd><dt><span class="term">-M|--modify acls</span></dt><dd><p>Modify the mask value (permissions) for the ACLs - specified on the command line. An error will be printed for each - ACL specified that was not already present in the ACL list - </p></dd><dt><span class="term">-D|--delete acls</span></dt><dd><p>Delete any ACLs specified on the command line. - An error will be printed for each ACL specified that was not - already present in the ACL list. </p></dd><dt><span class="term">-S|--set acls</span></dt><dd><p>This command sets the ACLs on the file with - only the ones specified on the command line. All other ACLs are - erased. Note that the ACL specified must contain at least a revision, - type, owner and group for the call to succeed. </p></dd><dt><span class="term">-C|--chown name</span></dt><dd><p>The owner of a file or directory can be changed - to the name given using the <em class="parameter"><code>-C</code></em> option. - The name can be a sid in the form S-1-x-y-z or a name resolved - against the server specified in the first argument. </p><p>This command is a shortcut for -M OWNER:name. - </p></dd><dt><span class="term">-G|--chgrp name</span></dt><dd><p>The group owner of a file or directory can - be changed to the name given using the <em class="parameter"><code>-G</code></em> - option. The name can be a sid in the form S-1-x-y-z or a name - resolved against the server specified n the first argument. - </p><p>This command is a shortcut for -M GROUP:name.</p></dd><dt><span class="term">-I|--inherit allow|remove|copy</span></dt><dd><p>Set or unset the windows "Allow inheritable - permissions" check box using the <em class="parameter"><code>-I</code></em> - option. To set the check box pass allow. To unset the check - box pass either remove or copy. Remove will remove all - inherited acls. Copy will copy all the inherited acls. - </p></dd><dt><span class="term">--numeric</span></dt><dd><p>This option displays all ACL information in numeric - format. The default is to convert SIDs to names and ACE types - and masks to a readable string format. </p></dd><dt><span class="term">-t|--test-args</span></dt><dd><p> - Don't actually do anything, only validate the correctness of - the arguments. - </p></dd><dt><span class="term">-h|--help</span></dt><dd><p>Print a summary of command line options. -</p></dd><dt><span class="term">-d|--debuglevel=level</span></dt><dd><p><em class="replaceable"><code>level</code></em> is an integer -from 0 to 10. The default value if this parameter is -not specified is 0.</p><p>The higher this value, the more detail will be -logged to the log files about the activities of the -server. At level 0, only critical errors and serious -warnings will be logged. Level 1 is a reasonable level for -day-to-day running - it generates a small amount of -information about operations carried out.</p><p>Levels above 1 will generate considerable -amounts of log data, and should only be used when -investigating a problem. Levels above 3 are designed for -use only by developers and generate HUGE amounts of log -data, most of which is extremely cryptic.</p><p>Note that specifying this parameter here will -override the <a class="link" href="smb.conf.5.html#" target="_top"></a> parameter -in the <code class="filename">smb.conf</code> file.</p></dd><dt><span class="term">-V|--version</span></dt><dd><p>Prints the program version number. -</p></dd><dt><span class="term">-s|--configfile <configuration file></span></dt><dd><p>The file specified contains the -configuration details required by the server. The -information in this file includes server-specific -information such as what printcap file to use, as well -as descriptions of all the services that the server is -to provide. See <code class="filename">smb.conf</code> for more information. -The default configuration file name is determined at -compile time.</p></dd><dt><span class="term">-l|--log-basename=logdirectory</span></dt><dd><p>Base directory name for log/debug files. The extension -<code class="constant">".progname"</code> will be appended (e.g. log.smbclient, -log.smbd, etc...). The log file is never removed by the client. -</p></dd><dt><span class="term">-N|--no-pass</span></dt><dd><p>If specified, this parameter suppresses the normal -password prompt from the client to the user. This is useful when -accessing a service that does not require a password. </p><p>Unless a password is specified on the command line or -this parameter is specified, the client will request a -password.</p><p>If a password is specified on the command line and this -option is also defined the password on the command line will -be silently ingnored and no password will be used.</p></dd><dt><span class="term">-k|--kerberos</span></dt><dd><p> -Try to authenticate with kerberos. Only useful in -an Active Directory environment. -</p></dd><dt><span class="term">-C|--use-ccache</span></dt><dd><p> -Try to use the credentials cached by winbind. -</p></dd><dt><span class="term">-A|--authentication-file=filename</span></dt><dd><p>This option allows -you to specify a file from which to read the username and -password used in the connection. The format of the file is -</p><pre class="programlisting"> -username = <value> -password = <value> -domain = <value> -</pre><p>Make certain that the permissions on the file restrict -access from unwanted users. </p></dd><dt><span class="term">-U|--user=username[%password]</span></dt><dd><p>Sets the SMB username or username and password. </p><p>If %password is not specified, the user will be prompted. The -client will first check the <code class="envar">USER</code> environment variable, then the -<code class="envar">LOGNAME</code> variable and if either exists, the -string is uppercased. If these environmental variables are not -found, the username <code class="constant">GUEST</code> is used. </p><p>A third option is to use a credentials file which -contains the plaintext of the username and password. This -option is mainly provided for scripts where the admin does not -wish to pass the credentials on the command line or via environment -variables. If this method is used, make certain that the permissions -on the file restrict access from unwanted users. See the -<em class="parameter"><code>-A</code></em> for more details. </p><p>Be cautious about including passwords in scripts. Also, on -many systems the command line of a running process may be seen -via the <code class="literal">ps</code> command. To be safe always allow -<code class="literal">rpcclient</code> to prompt for a password and type -it in directly. </p></dd></dl></div></div><div class="refsect1" title="ACL FORMAT"><a name="id307265"></a><h2>ACL FORMAT</h2><p>The format of an ACL is one or more ACL entries separated by - either commas or newlines. An ACL entry is one of the following: </p><pre class="programlisting"> -REVISION:<revision number> -OWNER:<sid or name> -GROUP:<sid or name> -ACL:<sid or name>:<type>/<flags>/<mask> -</pre><p>The revision of the ACL specifies the internal Windows - NT ACL revision for the security descriptor. - If not specified it defaults to 1. Using values other than 1 may - cause strange behaviour. </p><p>The owner and group specify the owner and group sids for the - object. If a SID in the format S-1-x-y-z is specified this is used, - otherwise the name specified is resolved using the server on which - the file or directory resides. </p><p>ACLs specify permissions granted to the SID. This SID again - can be specified in S-1-x-y-z format or as a name in which case - it is resolved against the server on which the file or directory - resides. The type, flags and mask values determine the type of - access granted to the SID. </p><p>The type can be either ALLOWED or DENIED to allow/deny access - to the SID. The flags values are generally zero for file ACLs and - either 9 or 2 for directory ACLs. Some common flags are: </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p><code class="constant">#define SEC_ACE_FLAG_OBJECT_INHERIT 0x1</code></p></li><li class="listitem"><p><code class="constant">#define SEC_ACE_FLAG_CONTAINER_INHERIT 0x2</code></p></li><li class="listitem"><p><code class="constant">#define SEC_ACE_FLAG_NO_PROPAGATE_INHERIT 0x4</code></p></li><li class="listitem"><p><code class="constant">#define SEC_ACE_FLAG_INHERIT_ONLY 0x8</code></p></li></ul></div><p>At present flags can only be specified as decimal or - hexadecimal values.</p><p>The mask is a value which expresses the access right - granted to the SID. It can be given as a decimal or hexadecimal value, - or by using one of the following text strings which map to the NT - file permissions of the same name. </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p><span class="emphasis"><em>R</em></span> - Allow read access </p></li><li class="listitem"><p><span class="emphasis"><em>W</em></span> - Allow write access</p></li><li class="listitem"><p><span class="emphasis"><em>X</em></span> - Execute permission on the object</p></li><li class="listitem"><p><span class="emphasis"><em>D</em></span> - Delete the object</p></li><li class="listitem"><p><span class="emphasis"><em>P</em></span> - Change permissions</p></li><li class="listitem"><p><span class="emphasis"><em>O</em></span> - Take ownership</p></li></ul></div><p>The following combined permissions can be specified:</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p><span class="emphasis"><em>READ</em></span> - Equivalent to 'RX' - permissions</p></li><li class="listitem"><p><span class="emphasis"><em>CHANGE</em></span> - Equivalent to 'RXWD' permissions - </p></li><li class="listitem"><p><span class="emphasis"><em>FULL</em></span> - Equivalent to 'RWXDPO' - permissions</p></li></ul></div></div><div class="refsect1" title="EXIT STATUS"><a name="id307406"></a><h2>EXIT STATUS</h2><p>The <code class="literal">smbcacls</code> program sets the exit status - depending on the success or otherwise of the operations performed. - The exit status may be one of the following values. </p><p>If the operation succeeded, smbcacls returns and exit - status of 0. If <code class="literal">smbcacls</code> couldn't connect to the specified server, - or there was an error getting or setting the ACLs, an exit status - of 1 is returned. If there was an error parsing any command line - arguments, an exit status of 2 is returned. </p></div><div class="refsect1" title="VERSION"><a name="id307433"></a><h2>VERSION</h2><p>This man page is correct for version 3 of the Samba suite.</p></div><div class="refsect1" title="AUTHOR"><a name="id307443"></a><h2>AUTHOR</h2><p>The original Samba software and related utilities - were created by Andrew Tridgell. Samba is now developed - by the Samba Team as an Open Source project similar - to the way the Linux kernel is developed.</p><p><code class="literal">smbcacls</code> was written by Andrew Tridgell - and Tim Potter.</p><p>The conversion to DocBook for Samba 2.2 was done - by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done - by Alexander Bokovoy.</p></div></div></body></html> |