1. Samba Optimization and Speed Tuning for
Performance
Calomel.org Home Page
Samba, like any other program can use a little speed boost. You want to get the most out of your
machines and optimizing your applications can extend their life by doing the job longer.
Samba needs to be tuned to your network because every enviorment offers its own unique set of
challenges. Here is a collection of hints and tricks from our professional experiences and from the
Samba group.
IMPORTANT LINK: Make sure to also check out our Samba config "how to" ( smb.conf ). We
cover how to setup Samba and a fully working example file.
Network Socket Options
The socket options configuration options are really host system tuning options, but they're set on
a per-connection basis, and can be reset by Samba on the sockets it employs by adding socket
options = option to the [global] section of your smb.conf file. This single line can gain you a 200%
throughput increase over default settings.
socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536
SO_SNDBUF=65536
TCP_NODELAY tells the server to send as many packets as necessary to keep delay low. This will
account for a 30 percent speedup by itself. In Samba 2.0 socket options = TCP_NODELAY became
the default value.
IPTOS_LOWDELAY is another option trading off throughput for lower delay, but which affects
routers and other systems, not the server. All the IPTOS options are new; they're not supported
by all operating systems and routers though. If they are supported, set IPTOS_LOWDELAY
whenever you set TCP_NODELAY. This option gives us a minor speed up around 20%.
SO_SNDBUF and SO_RCVBUF The send and receive buffers can often be the reset to a value
higher than that of the operating system. This yields a marginal increase of speed until it reaches
a point of diminishing returns. For a modern OpenBSD box serving shares to Windows xp/Vista or
Linux machines a SO_SNDBUF and SO_RCVBUF of 65536 increased throughput by as much as
20% by itself.
SO_KEEPALIVE initiates a periodic check every four(4) hours to see if the client is still there.
This option eventually arranges to close dead connections, returning unused memory and process-
table entries to the operating system. Using this option is conjunction with "deadtime = 15" to
close idle connection as fast as your working environment will allow.

2. Raw read and write
These are important performance configuration options; they enable Samba to use large reads
and writes to the network, of up to 64KB in a single SMB request. They also require the largest
SMB packet structures, SMBreadraw and SMBwriteraw, from which the options take their names.
In the past, some clients failed if you tried to use read raw. No clients suffer from this problem
now. Read and write raw default to yes, and should be left on unless you find you have one of the
ancient buggy clients.
Opportunistic locking
Opportunistic locks, or oplocks, allow clients to cache files locally, improving performance on the
order of 30 percent. This option is now enabled by default. For read-only files, the fake oplocks
provides the same functionality without actually doing any caching. If you have files that cannot
be cached, oplocks can be turned off. Database files should never be cached, nor should any files
that are updated both on the server and the client and whose changes must be immediately
visible. For these files, the veto oplock files option allows you to specify a list of individual files or
a pattern containing wild cards to avoid caching. oplocks can be turned off on a share-by-share
basis if you have large groups of files you don't want cached on clients.
Log level
Samba produces a lot of debugging messages at level 3 and above, and writing them to disk or
syslog is a slow operation. Much of the disk I/O would be wasted on debugging messages. Reduce
the logging level to 2 or under.
Want more speed? Make sure to also check out the Network Speed and Performance
Guide. With a little time and understanding you could easily double your firewall's
throughput.
Options to watch closely
The following Samba options will affect performance if they are not set correctly.
hide files provide a pattern to identify files hidden by the Windows client hide files will result in
any file matching the pattern being passed to the client with the DOS hidden attribute set. It
requires a pattern match per file when listing directories, and slows the server noticeably.
lpq cache time is used if your lpq (printer queue contents) command takes a long time to
complete, you should increase lpq cache time to a value higher than the actual time required for
lpq to execute, so as to keep Samba from starting a new query when one's already running. The
default is 10 seconds, which is reasonable.
strict locking sets the strict locking option and causes Samba to check for locks on every access,
not just when asked to by the client. The option is primarily a bug-avoidance feature, and can
prevent ill-behaved DOS and Windows applications from corrupting shared files. However, it is
slow and should typically be avoided.

3. strict sync sets strict sync and will cause Samba to write each packet to disk and wait for the
write to complete whenever the client sets the sync bit in a packet. Windows 98 Explorer sets the
bit in all packets transmitted, so if you turn this on, anyone with Windows 98 will think Samba
servers are horribly slow.
sync always us used to "sync always" and causes Samba to flush every write to disk. This is
good if your server crashes constantly, but the performance costs are immense. SMB servers
normally use oplocks and automatic reconnection to avoid the ill effects of crashes, so setting this
option is not normally necessary.
wide links acts by turning off wide links prevents Samba from following symbolic links in one file
share to files that are not in the share. It is turned on by default, since following links in Unix is
not a security problem. Turning it off requires extra processing on every file open. If you do turn
off wide links, be sure to turn on getwd cache to cache some of the required data. There is also a
follow symlinks option that can be turned off to prevent following any symbolic links at all.
However, this option does not pose a performance problem.
getwd cache option caches the path to the current directory, avoiding long tree-walks to
discover it. It's a nice performance improvement on a printer server or if you've turned off wide
links.
Samba config "how to" ( smb.conf )
Calomel.org Home Page
Samba is a daemon you can use on a Linux or BSD box to serve shared files with windows
systems. Samba is also significantly more robust than NFS and can be used
Samba is an Open Source/Free Software suite that provides seamless file and print services to
SMB/CIFS clients. Samba is freely available, unlike other SMB/CIFS implementations, and allows
for interoperability between Linux/Unix servers and Windows-based clients.
Samba is software that can be run on a platform other than Microsoft Windows, for example,
UNIX, Linux, IBM System 390, OpenVMS, and other operating systems. Samba uses the TCP/IP
protocol that is installed on the host server. When correctly configured, it allows that host to
interact with a Microsoft Windows client or server as if it is a Windows file and print server.
The goal behind the project is one of removing barriers to interoperability. Samba.org
IMPORTANT: Make sure to also check out the Samba Optimization and Speed Tuning for
Performance page. Samba, like any other program can always use a little speed boost.
Getting Started
In this excersise we are going to be setting up a very simple samba server on a openbsd box. It
will server out data from two(2) directories. The "archive" directory will be read only for items we
want everyone to see, but never change. The "incoming" directory will be read/write for all users.
Sort of a /tmp on a windows share allowing users to make data available to others. The incoming
directory will also be a place the windows machines can put data that an admin can move to the
archive section manually. This is a perfect solution for a home LAN or small corporate network.

4. Here is the smb.conf file in a scrollable window. Before using the config file take
a look it below. You are welcome to cut/paste this smb.conf for your server.
#######################################################
### Calomel.org smb.conf BEGIN
#######################################################
#============= Global Settings =======================#
[global]
bind interfaces only = yes
deadtime = 15
default case = lower
disable netbios = yes
dns proxy = no
domain master = yes
encrypt passwords = true
guest ok = yes
guest only = yes
hosts allow = 10.10.10.0/255.255.255.255 127.0.0.1
hosts deny = all
interfaces = em1
invalid users = nobody root
load printers = no
max connections = 10
netbios name = samba
preferred master = yes
preserve case = no
printable = no

5. security = share
server string = Samba Share
socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536
strict sync = no
sync always = no
syslog = 1
syslog only = yes
workgroup = WORKGROUP
#============ Share Definitions =======================#
[incoming]
create mask = 0400
directory mask = 0700
path = /big_disk/incoming
writeable = yes
[archive]
path = /big_disk/archive
writeable = no
#######################################################
### Calomel.org smb.conf END
#######################################################

6. Configuration options: step by step
bind interfaces only = yes say that samba will only bind to the default ip of an interface.
deadtime = 15 is the amount of minutes samba will concider an idle connection with a windows
machine to be dead.
default case = lower means all file and directory names will be forced into lower case format.
disable netbios = yes we do not need netbios broadcasts for the windows shares so we can
disable it. Our clients will be told where the share is located. Clients that only support netbios
won't be able to see your samba server when netbios support is disabled.
dns proxy = no is disabled. If enabled, this specifies that nmbd when acting as a WINS server
and finding that a NetBIOS name has not been registered, should treat the NetBIOS name word-
for-word as a DNS name and do a lookup with the DNS server for that name on behalf of the
name-querying client.
domain master = yes this means the samba server will take over as the "domain master" no
mater what the vote is from windows machines. On the test network the samba server is the only
server so this is fine. Tell smbd(8) to enable WAN-wide browse list collation. Setting this option
causes nmbd to claim a special domain specific NetBIOS name that identifies it as a domain
master browser for its given workgroup. Local master browsers in the same workgroup on
broadcast-isolated subnets will give this nmbd their local browse lists, and then ask smbd(8) for a
complete copy of the browse list for the whole wide area network. Browser clients will then
contact their local master browser, and will receive the domain-wide browse list, instead of just
the list for their broadcast-isolated subnet.
encrypt passwords = true you will need to encrypt passwords to talk to windows 200/xp/vista
machines. This boolean controls whether encrypted passwords will be negotiated with the client.
Note that Windows NT 4.0 SP3 and above and also Windows 98 will by default expect encrypted
passwords unless a registry entry is changed. To use encrypted passwords in Samba see the
chapter "User Database" in the Samba HOWTO Collection. MS Windows clients that expect
Microsoft encrypted passwords and that do not have plain text password support enabled will be
able to connect only to a Samba server that has encrypted password support enabled and for
which the user accounts have a valid encrypted password. Refer to the smbpasswd command man
page for information regarding the creation of encrypted passwords for user accounts. The use of
plain text passwords is NOT advised as support for this feature is no longer maintained in
Microsoft Windows products. If you want to use plain text passwords you must set this parameter
to no.
guest ok = yes allow "guest" access on the samba share. This mean users will _not_ have to log
in.
guest only = yes all machines accessing the shares will be guests.
hosts allow = 10.10.10.0/255.255.255.255 127.0.0.1 We are going to allow the entire
10.10.10/24 network as well as localhost.
hosts deny = all is to deny any host not listed in "hosts allow".
interfaces = em1 says that we want to bind to the interface em1. Note: if we also used "bind
interfaces only" then samba will bind to the primary ip on the em1 interface.

7. invalid users = admin_user root No windows share should ever try to log in with the names
"admin_user" or "root".
load printers = no in the example we do not have any printers, so we will disable this feature.
By disabling printers the share will not show up to the clients and this reduces confusion.
max connections = 10 limits the amount of clients samba will allow access to, to no more than
10.
netbios name = samba is the name in the "()" windows clients will see. If the name of our
server was "Samba Share (samba)".
preferred master = yes says that the samba server will always win the vote for the master
server on a windows network. This boolean parameter controls if nmbd(8) is a preferred master
browser for its workgroup. If this is set to yes, on startup, nmbd will force an election, and it will
have a slight advantage in winning the election. It is recommended that this parameter is used in
conjunction with domain master = yes, so that nmbd can guarantee becoming a domain master.
Use this option with caution, because if there are several hosts (whether Samba servers, Windows
95 or NT) that are preferred master browsers on the same subnet, they will each periodically and
continuously attempt to become the local master browser. This will result in unnecessary
broadcast traffic and reduced browsing capabilities.
preserve case = no goes with "default case = lower" and means samba will not keep the uppper
case characters.
printable = no goes with "load printers = no" as we do not have any printers on this server.
security = share is the security level of the windows shares. With share-level security, the
server accepts only a password without an explicit username from the client. The server expects a
password for each share, independent of the username. There have been recent reports that
Microsoft Windows clients have compatibility issues with share-level security servers. Samba
developers strongly discourage use of share-level security.
server string = Samba Share is the name windows clients will see. If the name of our server
was "Samba Share (samba)".
socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536
SO_SNDBUF=65536 are specifically speed up options for samba to windows connectivity.
Socket options are controls on the networking layer of the operating systems which allow the
connection to be tuned. This option will typically be used to tune your Samba server for optimal
performance for your local network. There is no way that Samba can know what the optimal
parameters are for your net, so you must experiment and choose them yourself. We strongly
suggest you read the appropriate documentation for your operating system first (perhaps man
setsockopt will help). You may find that on some systems Samba will say "Unknown socket
option" when you supply an option. This means you either incorrectly typed it or you need to add
an include file to includes.h for your OS. Any of the supported socket options may be combined in
any way you like, as long as your OS allows it.
strict syn = no and sync always = no are disabled to speed up samba. Strict syncing is
normally used if you are paranoid about data lose in the transfer of files. We have never seen this
problem in the real world.
syslog = 1 says we are going to log to the syslog fascility.

8. syslog only = yes means that only the syslog facility will be receiving logs from samba.
workgroup = WORKGROUP This controls what workgroup your server will appear to be in when
queried by clients. Note that this parameter also controls the Domain name used with the security
= domain setting.
Share Definitions
incoming: The masks are the creating permissions for new files and directories. The directive
"path" is the mount point samba will allow clients to see. "writeable = yes" means this mount
point is read/write enabled.
archive: The directive "path" is the mont point samba will allow clients to see and "writeable =
no" means this is a read only share.
Starting the install
Step 1: Install samba from package or from source. For the example we are using the package
from OpenBSD which is Samba v3.01.
Step 2: Place the smb.conf file from above into the /etc/samba/ directory named smb.conf . You
should backup the default smb.conf file the package places there for future reference if you want
to.
Step 3: Setup the directories we are going to share files from. The two directories "archive" and
"incoming" are under /big_disk in the example. The windows machines are going to access samba
shares as the "nobody" user. Thusly, all files and directories we want the windows share to access
must be accessible by the user "nobody". For admin purposes we also are going to use the user
"admin_user". The admin_user can do cleanup and move files from "incoming" to "archive" for
read only access if needed.
• achive: chmod 750 and chown admin_user:nobody
• incoming: chmod 770 and chown admin_user:nobody
This is what our example structure would look like. admin_user@machine: ls -la
/big_disk/
drwxr-xr-x 11 root wheel 512 Jan 10 10:20 .
drwxr-xr-x 16 root wheel 512 Jan 10 10:20 ..
drwxr-x--- 8 admin_user nobody 512 Jan 10 10:20 archive
drwxrwx--- 2 admin_user nobody 512 Jan 10 10:20 incoming
Executing the deamon
To start samba now that it is installed and the smb.conf from above is in place we
can use the following lines. Two daemons actually make up the samba service, smbd
and nmbd. You can execute the following lines by hand to start samba now.
/usr/local/libexec/smbd /etc/samba/smb.conf

9. /usr/local/libexec/nmbd /etc/samba/smb.conF
To start samba at boot, place the following in your /etc/rc.local # samba (
/etc/rc.local )
if [ -x /usr/local/libexec/smbd ]; then
echo -n ' samba'
/usr/local/libexec/smbd /etc/samba/smb.conf
/usr/local/libexec/nmbd /etc/samba/smb.conf
fi
Re-read the smb.conf after making any changes
After you make any modifications to the smb.conf file you will need to notify the
smbd and nmbd daemons of the changes. To do this, you can restart Samba by manually
killing smbd/nmbd and starting them again or send a HUP to smbd/nmbd. The HUP will
tell both daemons to reread the config file without actually having to restart.
Either option will work. ## Option: manually kill and start on OpenBSD
pkill smbd;pkill nmbd
/usr/local/libexec/smbd /etc/samba/smb.conf
/usr/local/libexec/nmbd /etc/samba/smb.conf
## Option: HUP on OpenBSD
kill -HUP `cat /var/run/smbd.pid`
kill -HUP `cat /var/run/nmbd.pid`
Mounting a smbfs/cifs network export
To mount the samba partion to a linux or BSD box on the network you can use the following line.
Place it in the /etc/fstab on the machine you want to mount from.
In this example we have two machines, samba_box which runs samba and another
machine called BSD_box where we want to see the files from. This line will mount
the directory /big_disk/archive from //samba_box to /dir_name on BSD_box. The mount
will be read only and log in as guest. This works fine with the example smb.conf
from above. ## /etc/fstab
## Samba mount (from BSD_box to samba_box)
//samba_box/big_disk/archive /dir_name cifs ro,username=guest,password=guest
0 0