SMBCLIENT(1)

📦
version 4.24.7 · 27 versions
, in fedora 44

💖 smbclient(1) — User Commands 💖

okay bestie, buckle up, we're doing the smbclient(1) page and it is LONG, so we're doing it in parts. part 1 starts now, no skimming, i need you to actually read this 🫶

✨ NAME ✨

smbclient — it's an ftp-like client for accessing SMB/CIFS resources on servers. yes like ftp but make it SMB. iconic behavior honestly 💅

🌸 SYNOPSIS 🌸

smbclient [-M|--message=HOST] [-I|--ip-address=IP] [-E|--stderr]
 [-L|--list=HOST] [-T|--tar=<c|x>IXFvgbNan] [-D|--directory=DIR]
 [-b|--send-buffer=BYTES] [-t|--timeout=SECONDS] [-p|--port=PORT]
 [-g|--grepable] [-q|--quiet] [-B|--browse] [-?|--help] [--usage]
 [-d|--debuglevel=DEBUGLEVEL] [--debug-stdout]
 [-s|--configfile=CONFIGFILE] [--option=name=value]
 [-l|--log-basename=LOGFILEBASE] [--leak-report] [--leak-report-full]
 [-R|--name-resolve=NAME-RESOLVE-ORDER]
 [-O|--socket-options=SOCKETOPTIONS] [-m|--max-protocol=MAXPROTOCOL]
 [-n|--netbiosname=NETBIOSNAME] [--netbios-scope=SCOPE]
 [-W|--workgroup=WORKGROUP] [--realm=REALM]
 [-U|--user=[DOMAIN/]USERNAME%[PASSWORD]] [-N|--no-pass]
 [--password=STRING] [--pw-nt-hash] [-A|--authentication-file=FILE]
 [-P|--machine-pass] [--simple-bind-dn=DN]
 [--use-kerberos=desired|required|off] [--use-krb5-ccache=CCACHE]
 [--use-winbind-ccache] [--client-protection=sign|encrypt|off]
 [-V|--version] [-c|--command=STRING]

look at all those flags. she's got RANGE. 🎀

🦋 DESCRIPTION 🦋

This tool is part of the samba(7) suite. (yes, the whole squad. we love a family.)

smbclient is a client that can 'talk' to an SMB/CIFS server. it gives you an interface similar to the one ftp gives you (go peek at ftp(1) if you wanna compare notes), and the ops are the usual suspects: getting files off the server onto your machine, putting files from your machine up to the server, pulling directory info back down from the server, that whole vibe. 💖

👑 OPTIONS 👑

🌈 servicename

servicename is the name of the service you wanna use on the server. a service name looks like //server/service, where server is the NetBIOS name of the SMB/CIFS server offering the service you want, and service is the name of the service being offered. so like, to connect to the service "printer" on the SMB/CIFS server "smbserver", you'd use the servicename //smbserver/printer

⚠️ bestie, listen. the server name you need is NOT necessarily the IP (DNS) host name of the server! the name required is a NetBIOS server name, which may or may not be the same as the IP hostname of the machine running the server. i know. i know. stay with me.

the server name gets looked up according to either the -R|--name-resolve parameter to smbclient, or by using the name resolve order parameter in the smb.conf(5) file — which lets an administrator change the order and the methods by which server names are looked up. (admin main character energy, honestly.)

🔐 password

The password required to access the specified service on the specified server. If this parameter is supplied, the -N option (suppress password prompt) is assumed. ✨

There is no default password. If no password is supplied on the command line — whether by using this parameter or by adding a password to the -U option (see below) — and the -N option is not specified, the client will prompt for a password, even if the desired service does not require one. (if no password is required, just press ENTER to provide a null password. it's giving "no thoughts, head empty, still valid".)

💀 Note: some servers (including OS/2 and Windows for Workgroups) insist on an uppercase password. lowercase or mixed case passwords may be rejected by these servers. they're dramatic like that.
🙈 Be cautious about including passwords in scripts. fr fr. don't leave your secrets lying around.

💌 -M|--message NetBIOS name

This option lets you send messages, using the "WinPopup" protocol, to another computer. Once a connection is established you then type your message, pressing ^D (control-D) to end. (like leaving a voicemail but for 1998.)

If the receiving computer is running WinPopup the user will receive the message and probably a beep. If they are not running WinPopup the message will be lost, and no error message will occur. 😭 just silence.

The message is also automatically truncated if the message is over 1600 bytes, as this is the limit of the protocol. so keep it snappy.

One useful trick is to pipe the message through smbclient. For example:

smbclient -M FRED < mymessage.txt

will send the message in the file mymessage.txt to the machine FRED. 🎀

You may also find the -U and -I options useful, as they allow you to control the FROM and TO parts of the message.

See the message command parameter in the smb.conf(5) for a description of how to handle incoming WinPopup messages in Samba.

💅 Note: Copy WinPopup into the startup group on your WfWg PCs if you want them to always be able to receive messages.

🚪 -p|--port port

This number is the TCP port number that will be used when making connections to the server. The standard (well-known) TCP port number for an SMB/CIFS server is 139, which is the default. 🫶

🍓 -g|--grepable

This parameter provides combined with -L easy parseable output that allows processing with utilities such as grep and cut. so you can pipe it into your little pipeline. slay. ✨

📈 -m|--max-protocol protocol

This allows the user to select the highest SMB protocol level that smbclient will use to connect to the server. By default this is set to highest available SMB3 protocol version. To connect using SMB2 or SMB1 protocol, use the strings SMB2 or NT1 respectively. Note that to connect to a Windows 2012 server with encrypted transport selecting a max-protocol of SMB3 is required. 🔥

🖥️ -P|--machine-pass

Make queries to the external server using the machine account of the local server. (borrowing your friend's ID. legally. machine edition.)

🌐 -I|--ip-address IP-address

IP address is the address of the server to connect to. It should be specified in standard "a.b.c.d" notation.

Normally the client would attempt to locate a named SMB/CIFS server by looking it up via the NetBIOS name resolution mechanism described above in the name resolve order parameter above. Using this parameter will force the client to assume that the server is on the machine with the specified IP address, and the NetBIOS name component of the resource being connected to will be ignored.

There is no default for this parameter. If not supplied, it will be determined automatically by the client as described above. 💜

📢 -E|--stderr

This parameter causes the client to write messages to the standard error stream (stderr) rather than to the standard output stream.

By default, the client writes messages to standard output — typically the user's tty. 🦋

📋 -L|--list

This option allows you to look at what services are available on a server. You use it as smbclient -L host and a list should appear. The -I option may be useful if your NetBIOS names don't match your TCP/IP DNS host names or if you are trying to reach a host on another network. no cap, that one saves lives.

📦 -b|--send-buffer buffersize

When sending or receiving files, smbclient uses an internal buffer sized by the maximum number of allowed requests to the connected server. This command allows this size to be set to any range between 0 (which means use the default server controlled size) bytes and 16776960 (0xFFFF00) bytes. Using the server controlled size is the most efficient, as smbclient will pipeline as many simultaneous reads or writes as needed to keep the server as busy as possible. Setting this to any other size will slow down the transfer. This can also be set using the iosize command inside smbclient.

⚠️ so like, 0 = let the server cook. anything else = you're the bottleneck bestie.

🔍 -B|--browse

Browse SMB servers using DNS. short, sweet, does what it says. ⭐

⏱️ -t|--timeout <timeout-seconds>

This allows the user to tune the default timeout used for each SMB request. The default setting is 20 seconds. Increase it if requests to the server sometimes time out. This can happen when SMB3 encryption is selected and smbclient is overwhelming the server with requests. This can also be set using the timeout command inside smbclient. 😤 give the poor server a minute.

🗄️ -T|--tar tar options

smbclient may be used to create tar(1) compatible backups of all the files on an SMB/CIFS share. The secondary tar flags that can be given to this option are:

  • c — Create a tar backup archive on the local system. Must be followed by the name of a tar file, tape device or "-" for standard output. If using standard output you must turn the log level to its lowest value -d0 to avoid corrupting your tar file. This flag is mutually exclusive with the x flag.
  • n — In combination with the c flag, do not actually create the archive, instead perform a dry run that attempts everything that involved in creation other than writing the file.
  • x — Extract (restore) a local tar file back to a share. Unless the -D option is given, the tar files will be restored from the top level of the share. Must be followed by the name of the tar file, device or "-" for standard input. Mutually exclusive with the c flag. Restored files have their creation times (mtime) set to the date saved in the tar file. Directories currently do not get their creation dates restored properly. 😭 (bug behavior, noted, moving on.)
  • I — Include files and directories. Is the default behavior when filenames are specified above. Causes files to be included in an extract or create (and therefore everything else to be excluded). See example below. Filename globbing works in one of two ways. See r below.
  • X — Exclude files and directories. Causes files to be excluded from an extract or create. See example below. Filename globbing works in one of two ways. See r below.
  • F — File containing a list of files and directories. The F causes the name following the tarfile to create to be read as a filename that contains a list of files and directories to be included in an extract or create (and therefore everything else to be excluded). See example below. Filename globbing works in one of two ways. See r below.
  • b — Blocksize. Must be followed by a valid (greater than zero) blocksize. Causes tar file to be written out in blocksize*TBLOCK (512 byte) blocks.
  • g — Incremental. Only back up files that have the archive bit set. Useful only with the c flag.
  • v — Verbose. Makes tar print out the files being processed. By default tar is not verbose. This is the same as tarmode verbose.
  • r — Use wildcard matching to include or exclude. Deprecated.

okay that's part 1 bestie, hold on, there's more coming and i am NOT leaving you halfway. 🧚💖

  • N — Newer than ✨. You gotta follow it with the name of a file, and that file's date gets compared against the files found on the share during a create. Only the files that are newer than the one you named get backed up into the tar file. Lowkey only useful with the c flag, iykyk.
  • a — Set the archive bit 💅. This makes the archive bit get reset once a file is backed up. Useful with the g and c flags.

🌈 Tar Long File Names 🌈

okay so smbclient's tar option now supports long file names, both on backup and on restore. Slay. BUT — the full path name of the file has to be less than 1024 bytes, no cap. Also, when a tar archive is created, smbclient's tar option places all files in the archive with relative names, not absolute names. Just so you know bestie.

🎀 Tar Filenames 🎀

Every single file name can be given as a DOS path name (with '\' as the component separator) or as a UNIX path name (with '/' as the component separator). Either vibe works 💖.

🦋 Examples 🦋

Restore from tar file backup.tar into myshare on mypc (no password on share):

smbclient //mypc/myshare "" -N -Tx backup.tar

Restore everything except users/docs:

smbclient //mypc/myshare "" -N -TXx backup.tar users/docs

Create a tar file of the files beneath users/docs:

smbclient //mypc/myshare "" -N -Tc backup.tar users/docs

Create the same tar file as above, but now use a DOS path name:

smbclient //mypc/myshare "" -N -Tc backup.tar users\edocs

Create a tar file of the files listed in the file tarlist:

smbclient //mypc/myshare "" -N -TcF backup.tar tarlist

Create a tar file of all the files and directories in the share:

smbclient //mypc/myshare "" -N -Tc backup.tar *
  • -D|--directory initial directory — Changes to initial directory before it even starts, so it's already in position 🫶. Probably only of any use with the tar -T option, ngl.
  • -c|--command command string — command string is a semicolon-separated list of commands to run instead of prompting from stdin. And heads up: -N is implied by -c. Super useful in scripts and for printing stdin to the server, like -c 'print -' ✨.
  • -?|--help — Prints a summary of command line options. The classic "help me pls" move 💅.
  • --usage — Displays a brief usage message. Short and sweet.
  • -d|--debuglevel=level — level is an integer from 0 to 10. The default value if you don't specify this parameter is 1 for client applications.

The higher this value goes, the more detail gets logged to the log files about what the server's been up to. At level 0, only critical errors and serious warnings get logged. Level 1 is a reasonable level for day-to-day running — it generates a small amount of info about operations carried out.

Levels above 1 will generate a considerable amount of log data, and should only be used when you're investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic 😭.

Note: specifying this parameter here will override the log level parameter in the /etc/samba/smb.conf file.
  • --debug-stdout — This will redirect debug output to STDOUT. By default all clients are logging to STDERR. So if you want the tea in your stdout, this is the one 💖.
  • --configfile=<configuration file> — The file specified contains the configuration details required by the client. The information in this file can be general for client and server, or only provide client specific stuff like options such as client smb encrypt. See /etc/samba/smb.conf for more info. The default configuration file name is determined at compile time.
  • --option=<name>=<value> — Set the smb.conf(5) option "<name>" to value "<value>" straight from the command line. This overrides compiled-in defaults and options read from the configuration file. If a name or a value includes a space, wrap the whole --option=name=value into quotes ✨.
  • -l|--log-basename=logdirectory — Base directory name for log/debug files. The extension ".progname" will be appended (e.g. log.smbclient, log.smbd, etc...). And no cap: the log file is never removed by the client.
  • --leak-report — Enable talloc leak reporting on exit. Snitching on leaks 💀.
  • --leak-report-full — Enable full talloc leak reporting on exit. The deluxe version.
  • -V|--version — Prints the program version number. Main character energy, but make it a version string 👑.
  • -R|--name-resolve=NAME-RESOLVE-ORDER — This option determines what naming services get used, and in what order, to resolve host names to IP addresses. The option takes a space-separated string of different name resolution options. Best practice: wrap the whole --name-resolve=NAME-RESOLVE-ORDER into quotes 🫶.

The options are: "lmhosts", "host", "wins" and "bcast". They cause names to be resolved as follows:

  • lmhosts: Lookup an IP address in the Samba lmhosts file. If the line in lmhosts has no name type attached to the NetBIOS name (see the lmhosts(5) for details) then any name type matches for lookup.
  • host: Do a standard host name to IP address resolution, using the system /etc/hosts, NIS, or DNS lookups. This method of name resolution is operating system dependent — for instance on IRIX or Solaris this may be controlled by the /etc/nsswitch.conf file). Note that this method is only used if the NetBIOS name type being queried is the 0x20 (server) name type, otherwise it is ignored.
  • wins: Query a name with the IP address listed in the wins server parameter. If no WINS server has been specified this method will be ignored.
  • bcast: Do a broadcast on each of the known local interfaces listed in the interfaces parameter. This is the least reliable of the name resolution methods, because it depends on the target host being on a locally connected subnet.

If this parameter is not set then the name resolve order defined in the /etc/samba/smb.conf file parameter (name resolve order) will be used.

The default order is lmhosts, host, wins, bcast. Without this parameter or any entry in the name resolve order parameter of the /etc/samba/smb.conf file, the name resolution methods will be attempted in this order 💖.

  • -O|--socket-options=SOCKETOPTIONS — TCP socket options to set on the client socket. See the socket options parameter in the /etc/samba/smb.conf manual page for the list of valid options ✨.
  • -m|--max-protocol=MAXPROTOCOL — The value of the parameter (a string) is the highest protocol level that will be supported by the client.
Note: specifying this parameter here will override the client max protocol parameter in the /etc/samba/smb.conf file.
  • -n|--netbiosname=NETBIOSNAME — This option lets you override the NetBIOS name that Samba uses for itself. Identical to setting the netbios name parameter in the /etc/samba/smb.conf file. BUT — a command line setting will take precedence over settings in /etc/samba/smb.conf 💅.
  • --netbios-scope=SCOPE — This specifies a NetBIOS scope that nmblookup will use to communicate with when generating NetBIOS names. For details on the use of NetBIOS scopes, see rfc1001.txt and rfc1002.txt. NetBIOS scopes are very rarely used — only set this parameter if you're the system administrator in charge of all the NetBIOS systems you communicate with, bestie 🙈.
  • -W|--workgroup=WORKGROUP — Set the SMB domain of the username. This overrides the default domain, which is the domain defined in smb.conf. If the domain specified is the same as the server's NetBIOS name, it causes the client to log on using the server's local SAM (as opposed to the Domain SAM).
Note: specifying this parameter here will override the workgroup parameter in the /etc/samba/smb.conf file.
  • -r|--realm=REALM — Set the realm for the domain.
Note: specifying this parameter here will override the realm parameter in the /etc/samba/smb.conf file.
  • -U|--user=[DOMAIN\]USERNAME[%PASSWORD] — Sets the SMB username, or username and password.

If %PASSWORD is not specified, the user will be prompted. The client will first check the USER environment variable (which is also permitted to also contain the password separated by a %), then the LOGNAME variable (which is not permitted to contain a password), and if either exists, the value is used. If these environmental variables are not found, the username found in a Kerberos Credentials cache may be used.

A third option is to use a credentials file which contains the plaintext of the username and password. This option is mainly provided for scripts where the admin doesn't wish to pass the credentials on the command line or via environment variables. If this method is used, make certain that the permissions on the file restrict access from unwanted users. See the -A for more details.

Be cautious about including passwords in scripts or passing user-supplied values onto the command line. For security it is better to let the Samba client tool ask for the password if needed, or obtain the password once with kinit.

While Samba will attempt to scrub the password from the process title (as seen in ps), this is after startup and so is subject to a race 😭.

  • -N|--no-pass — If specified, this parameter suppresses the normal password prompt from the client to the user. Super useful when you're accessing a service that doesn't require a password 🫶.

Unless a password is specified on the command line or this parameter is specified, the client will request a password.

If a password is specified on the command line and this option is also defined, the password on the command line will be silently ignored and no password will be used. Periodt.

  • --password — Specify the password on the commandline.
Be cautious about including passwords in scripts or passing user-supplied values onto the command line. For security it is better to let the Samba client tool ask for the password if needed, or obtain the password once with kinit.

If --password is not specified, the tool will check the PASSWD environment variable, followed by PASSWD_FD which is expected to contain an open file descriptor (FD) number.

Finally it will check PASSWD_FILE (containing a file path to be opened). The file should only contain the password. Make certain that the permissions on the file restrict access from unwanted users! 🔥

While Samba will attempt to scrub the password from the process title (as seen in ps), this is after startup and so is subject to a race. (yes bestie, there's a tiny window there — noted, moving on 💅)

  • --pw-nt-hash — the password you handed over is the NT hash. Like, that's the whole vibe. 🎀
  • -A|--authentication-file=filename — this lets you point at a file to read the username and password used in the connection from. The format of that file is exactly this:
username = <value>
password = <value>
domain   = <value>
Make certain that the permissions on the file restrict access from unwanted users! 🔒 Not me begging you to chmod this thing. fr fr.
  • -P|--machine-pass — use the stored machine account password.
  • --simple-bind-dn=DN — the DN to use for a simple bind.
  • --use-kerberos=desired|required|off — this parameter decides whether Samba client tools will try to authenticate using Kerberos. For Kerberos auth you should use DNS names instead of IP addresses when connecting to a service. By default Samba client tools will try to use the default Kerberos credential cache (ccache). In case the ccache doesn't exist or the -U|--user option was specified, clients will ask you to enter a password and will obtain a Kerberos ticket (kinit) for you. If you want to use an alternative Kerberos credentical cache, use the --use-krb5-ccache option.

Note that specifying this parameter here will override the client use kerberos parameter in the /etc/samba/smb.conf file. ✨

  • --use-krb5-ccache=CCACHE — specifies the credential cache location for Kerberos authentication.

This will enforce --use-kerberos=required. 😤

  • --use-winbind-ccache — try to use the credential cache by winbind.
  • --client-protection=sign|encrypt|off — sets the connection protection the client tool should use. 🛡️

Note that specifying this parameter here will override the client protection parameter in the /etc/samba/smb.conf file.

In case you need more fine grained control you can use: --option=clientsmbencrypt=OPTION, --option=clientipcsigning=OPTION, --option=clientsigning=OPTION.

🦋 OPERATIONS 🦋

Once the client is running, the user is presented with a prompt :

smb:\>

The backslash (\) indicates the current working directory on the server, and will change if the current working directory is changed. it's literally your little location pin bestie 📍

The prompt indicates that the client is ready and waiting to carry out a user command. Each command is a single word, optionally followed by parameters specific to that command. Command and parameters are space-delimited unless these notes specifically state otherwise. All commands are case-insensitive. Parameters to commands may or may not be case sensitive, depending on the command. 🙈

You can specify file names which have spaces in them by quoting the name with double quotes, for example "a long file name".

Parameters shown in square brackets (e.g., "[parameter]") are optional. If not given, the command will use suitable defaults. Parameters shown in angle brackets (e.g., "<parameter>") are required.

Note that all commands operating on the server are actually performed by issuing a request to the server. Thus the behavior may vary from server to server, depending on how the server was implemented. no cap, your mileage really does vary here

The commands available are given here in alphabetical order. ⭐

  • ? [command] — if command is specified, the ? command will display a brief informative message about the specified command. If no command is specified, a list of available commands will be displayed.
  • ! [shell command] — if shell command is specified, the ! command will execute a shell locally and run the specified shell command. If no command is specified, a local shell will be run.
  • allinfo file — the client will request that the server return all known information about a file or directory (including streams).
  • altname file — the client will request that the server return the "alternate" name (the 8.3 name) for a file or directory.
  • archive <number> — sets the archive level when operating on files. 0 means ignore the archive bit, 1 means only operate on files with this bit set, 2 means only operate on files with this bit set and reset it after operation, 3 means operate on all files and reset it after operation. The default is 0.
  • backup — toggle the state of the "backup intent" flag sent to the server on directory listings and file opens. If the "backup intent" flag is true, the server will try and bypass some file system checks if the user has been granted SE_BACKUP or SE_RESTORE privileges. This state is useful when performing a backup or restore operation. 💾
  • blocksize <number> — sets the blocksize parameter for a tar operation. The default is 20. Causes tar file to be written out in blocksize*TBLOCK (normally 512 byte) units.
  • cancel jobid0 [jobid1] ... [jobidN] — the client will request that the server cancel the printjobs identified by the given numeric print job ids.
  • case_sensitive — toggles the setting of the flag in SMB packets that tells the server to treat filenames as case sensitive. Set to OFF by default (tells file server to treat filenames as case insensitive). Only currently affects Samba 3.0.5 and above file servers with the case sensitive parameter set to auto in the smb.conf.
  • cd <directory name> — if "directory name" is specified, the current working directory on the server will be changed to the directory specified. This operation will fail if for any reason the specified directory is inaccessible.

If no directory name is specified, the current working directory on the server will be reported.

  • chmod file mode in octal — this command depends on the server supporting the CIFS UNIX extensions and will fail if the server does not. The client requests that the server change the UNIX permissions to the given octal mode, in standard UNIX format.
  • chown file uid gid — this command depends on the server supporting the CIFS UNIX extensions and will fail if the server does not. The client requests that the server change the UNIX user and group ownership to the given decimal values. Note there is currently no way to remotely look up the UNIX uid and gid values for a given name. This may be addressed in future versions of the CIFS UNIX extensions.
  • close <fileid> — closes a file explicitly opened by the open command. Used for internal Samba testing purposes.
  • del <mask> — the client will request that the server attempt to delete all files matching mask from the current working directory on the server.
  • deltree <mask> — the client will request that the server attempt to delete all files and directories matching mask from the current working directory on the server. Note this will recursively delete files and directories within the directories selected even without the recurse command being set. If any of the delete requests fail the command will stop processing at that point, leaving files and directories not yet processed untouched. This is by design. ⚠️ yes it really deletes stuff, read that twice
  • dir <mask> — a list of the files matching mask in the current working directory on the server will be retrieved from the server and displayed.
  • du <filename> — does a directory listing and then prints out the current disk usage and free space on a share.
  • echo <number> <data> — does an SMBecho request to ping the server. Used for internal Samba testing purposes.
  • exit — terminate the connection with the server and exit from the program. 👋
  • get <remote file name> [local file name] — copy the file called remote file name from the server to the machine running the client. If specified, name the local copy local file name. Note that all transfers in smbclient are binary. See also the lowercase command.
  • getfacl <filename> — requires the server support the UNIX extensions. Requests and prints the POSIX ACL on a file.
  • hardlink <src> <dest> — creates a hardlink on the server using Windows CIFS semantics.
  • help [command] — see the ? command above.
  • history — displays the command history. 🕰️
  • iosize <bytes> — when sending or receiving files, smbclient uses an internal buffer sized by the maximum number of allowed requests to the connected server. This command allows this size to be set to any range between 0 (which means use the default server controlled size) bytes and 16776960 (0xFFFF00) bytes. Using the server controlled size is the most efficient as smbclient will pipeline as many simultaneous reads or writes needed to keep the server as busy as possible. Setting this to any other size will slow down the transfer. so like, maybe just leave it alone bestie 😭
  • lcd [directory name] — if directory name is specified, the current working directory on the local machine will be changed to the directory specified. This operation will fail if for any reason the specified directory is inaccessible.

If no directory name is specified, the name of the current working directory on the local machine will be reported.

  • link target linkname — this command depends on the server supporting the CIFS UNIX extensions and will fail if the server does not. The client requests that the server create a hard link between the linkname and target files. The linkname file must not exist.
  • listconnect — show the current connections held for DFS purposes.
  • lock <filenum> <r|w> <hex-start> <hex-len> — this command depends on the server supporting the CIFS UNIX extensions and will fail if the server does not. Tries to set a POSIX fcntl lock of the given type on the given range. Used for internal Samba testing purposes.
  • logon <username> <password> — establishes a new vuid for this session by logging on again. Replaces the current vuid. Prints out the new vuid. Used for internal Samba testing purposes.
  • logoff — logs the user off the server, closing the session. Used for internal Samba testing purposes.
  • lowercase — toggle lowercasing of filenames for the get and mget commands.

When lowercasing is toggled ON, local filenames are converted to lowercase when using the get and mget commands. This is often useful when copying (say) MSDOS files from a server, because lowercase filenames are the norm on UNIX systems. 💅

  • ls <mask> — see the dir command above.
  • mask <mask> — this command allows the user to set up a mask which will be used during recursive operation of the mget and mput commands.

The masks you hand to mget and mput act as filters for directories, not files, when recursion is toggled ON. 🫶

So the mask you set with the mask command is what actually filters the files inside those directories. Like, picture this: mask given to mget is "source*", mask set with the mask command is "*.c", recursion is toggled ON — now mget will pull every file matching "*.c" in all directories below, and including, every directory matching "source*" in the current working directory. ✨

Lowkey important: mask defaults to blank (which is the same thing as "*") and it just... stays that way until you run the mask command to change it. And then it keeps the most recently specified value indefinitely, fr fr. So to avoid unexpected results, it'd be wise to set mask back to "*" after you're done using mget or mput. 💅

  • md <directory name> — go look at the mkdir command, bestie. 💖
  • mget <mask> — copy every file matching mask from the server over to the machine running the client. 🦋

Heads up that mask gets interpreted differently depending on whether you're in recursive or non-recursive operation — go read up on the recurse and mask commands for that tea. Also, every transfer in smbclient is binary. And see also the lowercase command.

  • mkdir <directory name> — create a brand new directory on the server with the name you give it (user access privileges permitting, obviously). 👑
  • more <file name> — fetch a remote file and view it using whatever's inside your PAGER environment variable.
  • mput <mask> — copy every file matching mask from the current working directory on your local machine up to the current working directory on the server.

Same warning as before: mask is interpreted differently in recursive vs non-recursive operation — check recurse and mask. And again, all transfers in smbclient are binary.

  • notify <dir name> — query a directory for change notifications. This one issues a recursive filechangenotify call for all possible changes, and as changes roll in it prints one line per change. For a description of the action numbers it prints, see https://msdn.microsoft.com/en-us/library/dn392331.aspx
This command never ends. It waits for an event indefinitely. Like, forever. Set it up in its own terminal and go live your life. 😭
  • posix — query the remote server to see if it supports the CIFS UNIX extensions and print out the list of capabilities it supports. If it does, this turns on POSIX pathname processing and large file read/writes (if available).
  • posix_encrypt <domain> <username> <password> — this one depends on the server supporting the CIFS UNIX extensions, and it will fail if the server doesn't. It attempts to negotiate SMB encryption on this connection. If smbclient connected with kerberos credentials (-k), the arguments to this command get ignored and the kerberos credentials are used to negotiate GSSAPI signing and sealing instead. See also the -e option to smbclient to force encryption on initial connection. This command is new with Samba 3.2. 🔥
  • posix_open <filename> <octal mode> — depends on the server supporting the CIFS UNIX extensions and will fail if it doesn't. Opens a remote file using the CIFS UNIX extensions and prints a fileid. Used for internal Samba testing purposes.
  • posix_mkdir <directoryname> <octal mode> — depends on the server supporting the CIFS UNIX extensions and will fail if it doesn't. Creates a remote directory using the CIFS UNIX extensions with the given mode.
  • posix_rmdir <directoryname> — depends on the server supporting the CIFS UNIX extensions and will fail if it doesn't. Deletes a remote directory using the CIFS UNIX extensions.
  • posix_unlink <filename> — depends on the server supporting the CIFS UNIX extensions and will fail if it doesn't. Deletes a remote file using the CIFS UNIX extensions.
  • posix_whoami — query the remote server for the user token using the CIFS UNIX extensions WHOAMI call. Prints out the guest status, user, group, group list and sid list that the remote server is using on behalf of the logged on user. 🎀
  • print <file name> — print the specified file from your local machine through a printable service on the server.
  • prompt — toggle prompting for filenames while mget and mput are running.

Toggled ON → you get asked to confirm the transfer of each individual file during those commands. Toggled OFF → all the specified files just transfer, no prompting, no interruptions. 💅

  • put <local file name> [remote file name] — copy the file called local file name from the machine running the client over to the server. If you give it, name the remote copy remote file name. Note that all transfers in smbclient are binary. See also the lowercase command.
  • queue — displays the print queue, showing the job id, name, size and current status. 👀
  • quit — see the exit command.
  • readlink symlinkname — depends on the server supporting the CIFS UNIX extensions and will fail if it doesn't. Prints the value of the symlink "symlinkname".
  • rd <directory name> — see the rmdir command.
  • recurse — toggle directory recursion for the mget and mput commands. 🌈

Toggled ON → those commands will process all directories in the source directory (i.e. the directory they're copying from) and will recurse into any that match the mask specified to the command. Only files matching the mask specified using the mask command get retrieved. See also the mask command.

Toggled OFF → only files from the current working directory on the source machine that match the mask specified to the mget or mput commands get copied, and any mask specified using the mask command gets ignored entirely.

  • rename <old filename> <new filename> [-f] — rename files in the current working directory on the server from old filename to new filename. The optional -f switch lets you supersede the destination file, if it exists. This is supported by the NT1 protocol dialect and the SMB2 protocol family. ✨
  • rm <mask> — remove all files matching mask from the current working directory on the server.
  • rmdir <directory name> — remove the specified directory (user access privileges permitting) from the server.
  • scopy <source filename> <destination filename> — attempt to copy a file on the server using the most efficient server-side copy calls. Falls back to using read then write if the server doesn't support server-side copy.
  • setmode <filename> <perm=[+|\-]rsha> — basically a version of the DOS attrib command, but for setting file permissions. For example:
setmode myfile +r

would make myfile read only. 🔒

  • showconnect — show the currently active connection held for DFS purposes.
  • stat file — depends on the server supporting the CIFS UNIX extensions and will fail if it doesn't. The client requests the UNIX basic info level and prints out the same info that the Linux stat command would about the file. That includes the size, blocks used on disk, file type, permissions, inode number, number of links, and finally the three timestamps (access, modify and change). If the file is a special file (symlink, character or block device, fifo or socket) then extra information may also be printed. 🧚
  • symlink target linkname — depends on the server supporting the CIFS UNIX extensions and will fail if it doesn't. The client asks the server to create a symbolic hard link between the target and linkname files. The linkname file must not exist. Note that the server will not create a link to any path that lies outside the currently connected share — this is enforced by the Samba server. 🚫
  • tar <c|x>[IXbgNa] — performs a tar operation — see the -T command line option above. Behavior may be affected by the tarmode command (see below). Using g (incremental) and N (newer) will affect tarmode settings. Note that using the "-" option with tar x may not work — use the command line option instead. 💀
  • blocksize <blocksize> — blocksize. Must be followed by a valid (greater than zero) blocksize. Causes the tar file to be written out in blocksize*TBLOCK (512 byte) blocks.
  • tarmode <full|inc|reset|noreset|system|nosystem|hidden|nohidden|verbose|noverbose> — changes tar's behavior with regard to DOS attributes. There are 4 modes which can be turned on or off. 🎀
    • Incremental mode (default off). When off (using full), tar will back up everything regardless of the archive bit setting. When on (using inc), tar will only back up files with the archive bit set.
    • Reset mode (default off). When on (using reset), tar will remove the archive bit on all files it backs up (implies read/write share). Use noreset to turn off.
    • System mode (default on). When off, tar will not backup system files. Use nosystem to turn off.
    • Hidden mode (default on). When off, tar will not backup hidden files. Use nohidden to turn off.
  • timeout <per-operation timeout in seconds> — lets you tune the default timeout used for each SMB request. The default setting is 20 seconds. Increase it if requests to the server sometimes time out. That can happen when SMB3 encryption is selected and smbclient is overwhelming the server with requests. 😮‍💨
  • unlock <filenum> <hex-start> <hex-len> — depends on the server supporting the CIFS UNIX extensions and will fail if it doesn't. Tries to unlock a POSIX fcntl lock on the given range. Used for internal Samba testing purposes.
  • volume — prints the current volume name of the share.
  • vuid <number> — changes the currently used vuid in the protocol to the given arbitrary number. Without an argument it prints out the current vuid being used. Used for internal Samba testing purposes.
  • tcon <sharename> — establishes a new tree connect (connection to a share). Replaces the current tree connect. Prints the new tid (tree id). Used for internal Samba testing purposes.
  • tdis — close the current share connection (tree disconnect). Used for internal Samba testing purposes.
  • tid <number> — swaps the current tree id (tid) in the protocol out for whatever random number you feel like. Call it with no argument and it just tells you the tid you're rocking right now. This one exists purely for internal Samba testing, bestie — it's a lab rat, not a lifestyle.
  • utimes <filename> <create time> <access time> <write time> < change time> — rewrites the timestamps on a file, identified by name. Times go in as [YY]YY:MM:DD-HH:MM:SS, or -1 if you want that particular stamp left alone. ✨

📝 NOTES 📝

Some servers are SO picky about the case of the usernames, passwords, share names (aka service names) and machine names you hand them. If your connection just will not go through, try yelling all your parameters IN UPPERCASE. 😤

The -n option is often lowkey mandatory for certain types of servers. Like, OS/2 LanManager insists on a valid NetBIOS name being used, so you have to supply a valid name that the server would actually recognise. No fake names, it will know. 💀

Good news though: smbclient supports long file names wherever the server speaks LANMAN2 protocol or above. We love an upgrade. 🦋

🌱 ENVIRONMENT VARIABLES 🌱

Check out the --user and --password options — they've got the whole scoop on how to pass a username and password in through an environment variable. Go read those, fr fr. 💜

📦 INSTALLATION 📦

Where the client program actually lives is a call for each individual system administrator to make. So everything below? Suggestions only. Not gospel. 🫶

The recommendation is that the smbclient software goes in the /usr/local/samba/bin/ or /usr/samba/bin/ directory — that directory readable by everyone, writeable only by root. The client program itself should be executable by all.

⚠️ The client should NOT be setuid or setgid! Not negotiable, babes. Don't do it. 🙈

The client log files should be dropped into a directory that is readable and writeable only by the user. Keep that private, okay? 🎀

To test the client, you'll need to know the name of a running SMB/CIFS server. Fun fact: you can run smbd(8) as an ordinary user — running that server as a daemon on a user-accessible port (typically any port number over 1024) gives you a perfectly suitable test server. Science! 🧚

🩺 DIAGNOSTICS 🩺

Most of the diagnostics the client spits out get logged into a specified log file. The log file name is set at compile time, but you can override it on the command line. Iconic, honestly.

How many diagnostics you get and what they say depends on the debug level the client is running at. If things are going sideways, set the debug level to 3 and go peruse the log files. Sherlock mode: activated. 🔍

🏷️ VERSION 🏷️

This man page is part of version 4.24.7 of the Samba suite. Yes, we keep receipts. ⭐

👑 AUTHOR 👑

The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project — similar to the way the Linux kernel is developed. Community-built, community-loved, that's the vibe. 💖

And that's the whole page, bestie!! 🎉 This one's from the Samba 4.24.7 era, dated 09/09/2026, and it's SMBCLIENT(1) in all her glory. Go forth and smbclient responsibly. 💅🌸

📦 where this page comes from