This content was auto-generated from Fusion SMB documentation and is pending SME review. Please verify accuracy before using in partner-facing contexts.
CLI Tools Reference
Fusion SMB ships with seven documented command-line utilities for managing, diagnosing, and operating the server. This page provides a support-focused overview of each tool with practical diagnostic workflows.
Tool Summary
| Command | Installed at | Purpose |
|---|---|---|
tsmb-server | /usr/sbin | Start the Fusion SMB server |
tsmb-status | /usr/bin | Query server status and runtime statistics |
tsmb-cfg | /usr/bin | Manage configuration at runtime |
tsmb-passwd | /usr/bin | Manage users and groups (file-backed database) |
tsmb-acls | /usr/bin | Inspect and set Windows-style ACLs on files |
tsmb-privilege | /usr/bin | Grant or revoke Windows privileges |
tsmb-migrate | /usr/bin | Import Winbind ID mappings from Samba |
Fusion SMB is delivered as a .deb, an .rpm, or a compressed archive of the binaries plus configuration templates — the archive being the option for environments where installing a distribution package is not allowed.
The package also installs /usr/bin/tsmb-tickle-ack, a cluster failover helper. It has no CLI reference page and is absent from the documented Package Contents table, so you will not find it in the product docs — but you will meet it on a clustered node. Treat its behaviour as unverified and ask Tuxera before relying on it in a case.
tsmb-server — Server Startup
tsmb-server [<parameter>,...]
Starts the Fusion SMB server process.
| Flag | Description |
|---|---|
-B | Run in background (daemonize) |
-c <path> | Path to config file (default: /etc/tsmb.conf) |
-p | Persistent configuration mode — makes runtime changes via tsmb-cfg survive restarts |
-i <id> | Server instance ID for persistent FileIDs (useful for non-Corosync clusters) |
-v | Print version and exit |
-h | Print help |
Support use: Always start troubleshooting by confirming the version:
tsmb-server -v
Check the output against the version lifecycle to verify the customer is running a supported release.
tsmb-status — Server Statistics
tsmb-status [<option>,...] [<subcommand> [<parameter>,...]]
Queries always-on diagnostic metrics from the running server. No configuration is required — statistics are collected automatically.
| Option | Description |
|---|---|
stats | Show server statistics |
stats --category <cat> | Filter: all (default), connection, session |
stats --format <fmt> | Output: tabular (default) or json |
stats --verbose | Include internal statistics |
Diagnostic Workflow: Identify Connected Users
# List all active sessions with connection details
tsmb-status stats --category session --format json | jq '.session[] | {Username, "Session ID", Guest, "Signing required", "Encryption required"}'
Diagnostic Workflow: Check Connection Health
# Capture full stats snapshot for a support case
tsmb-status stats --format json > /tmp/fusion-stats-$(date +%Y%m%d-%H%M%S).json
# Find connections using older dialects
tsmb-status stats --category connection --format json | jq '.connection[] | select(.Dialect != "3.1.1") | {Dialect, "Src Address", "Dst Address"}'
Diagnostic Workflow: Find Slow Operations
# Identify operations with high average duration
tsmb-status stats --format json | jq '.connection[].Operations | to_entries[] | select(.value.Count > 0) | {op: .key, count: .value.Count, total_duration: .value."Total Duration"}'
tsmb-cfg — Runtime Configuration
tsmb-cfg [<option>,...] <command> [<parameter>,...]
Manages server configuration while the server is running. By default, changes are not persistent across restarts unless the server was started with tsmb-server -p. This applies to every tsmb-cfg change, including SMB dialect limits — a customer who changes a dialect at runtime and then restarts the server will silently revert to the value in tsmb.conf.
Common option: -c <path> to specify config file (default: /etc/tsmb.conf).
Global Configuration
| Command | Description |
|---|---|
tsmb-cfg global list | List current global configuration |
tsmb-cfg global list --format json | List in JSON format |
tsmb-cfg global update <flag> <value> | Update a global parameter |
tsmb-cfg global add <flag> <value> | Add a global parameter value (e.g. a listen entry) |
tsmb-cfg global del <flag> <value> | Remove a global parameter value |
Global parameters are addressed by flag, not by their tsmb.conf parameter name — e.g. --log-level for log_level, --dialect_max for dialect_max, --require-signing for require_message_signing.
Checking which dialects a server accepts:
tsmb-cfg global list --format json | jq '.dialects, .dialect_max'
As of 3026.4.1, SMB1 is accepted as a dialects value for legacy estates that cannot be upgraded. It is off by default — SMB1 is excluded from the default dialect set and is not reached by a dialect_max range, so setting dialect_max to a higher dialect will never enable it. It turns on only when SMB1 is named explicitly in dialects (or dialect_max is set to SMB1 itself).
Enabling it makes the server log:
SMB1 (CIFS) is enabled by the dialect configuration. This protocol is deprecated and has known security vulnerabilities. If you enabled it intentionally (e.g. for legacy clients), this warning can be ignored.
If you find that line in a customer's log, SMB1 was switched on deliberately or by misadventure — establish which. Note dialects and dialect_max are mutually exclusive.
The public documentation does not cover this yet — it still states SMB1 support was discontinued. Confirm with Tuxera rather than pointing a customer at the docs.
Support use — change log level at runtime:
# Increase verbosity for troubleshooting
sudo tsmb-cfg global update --log-level 5
# Target a specific subsystem (idmap debugging)
sudo tsmb-cfg global update --log-level "4 idmap:40"
# Revert to production level when done
sudo tsmb-cfg global update --log-level 3
Share Management
| Command | Description |
|---|---|
tsmb-cfg share list | List all configured shares |
tsmb-cfg share list --format json | List shares in JSON format |
tsmb-cfg share list -n <name> | Show only the named share |
tsmb-cfg share add -n <name> -p <path> [options] | Add a new share |
tsmb-cfg share del -n <name> | Remove a share |
tsmb-cfg share update -n <name> <flag> <value> | Update a share parameter |
-n selects, it does not renameOn tsmb-cfg share update, -n/--name identifies which share to modify, by its netname. It does not rename the share — the netname cannot be changed with tsmb-cfg share update. Pass the parameter you actually want to change as an additional flag, e.g. --remark or --hidden.
Support use — verify share configuration:
# List all shares and their paths
tsmb-cfg share list --format json | jq '.[] | {name: .netname, path: .path, audit_level: .audit_level}'
tsmb-passwd — User and Group Management
tsmb-passwd [<option>,...] <command> [<parameter>,...]
Manages the file-backed user database. Used when Fusion SMB is not joined to Active Directory, or for managing local service accounts alongside AD.
| Command | Description |
|---|---|
--add <user> | Add a user (-s reads password from stdin, -H for NT hash, -G for guest) |
--update <user> | Update a user (-e enable, -d disable, --create to upsert) |
--remove <user> | Remove a user |
--add-member <user> <group> | Add user to a group |
--remove-member <user> <group> | Remove user from a group |
--list | List all users and groups (JSON output) |
--list-members <group> | List members of a group |
--lookup <name-or-SID> | Lookup account by name or SID |
--translate | Convert between SID, UID, and GID |
--group | With --add or --remove, operate on groups instead of users |
--set-ldap-passwd | Store the LDAP bind password in obfuscated form in a keytab file |
Common option: -c <path> to specify config file.
Encrypted LDAP bind password (3026.4.0 and later): rather than keeping the bind password as readable text in tsmb.conf via ldap_bind_pw, it can be stored in a keytab file referenced by the ldap_bind_keytab parameter. Both ldap_bind_dn and ldap_bind_keytab must be set in the config file; the command prompts for the password interactively unless --stdin is used.
# Write the bind password to the configured keytab
sudo tsmb-passwd --set-ldap-passwd
The obfuscation relies on a key embedded in the Fusion SMB binary, so the keytab file alone cannot be used to recover the password — but it is not a substitute for restricting access to the file with POSIX permissions. ldap_bind_pw remains supported for compatibility.
Support use — check user accounts:
# List all local users
tsmb-passwd --list | jq '.users[]'
# Check if a specific user exists and is enabled
tsmb-passwd --lookup myuser
# Map a POSIX user to a local account
tsmb-passwd --add svcaccount -z posix_user -s <<< "password"
tsmb-acls — ACL Management
tsmb-acls [<option>,...] [<command> [<parameter>,...]]
Inspects and sets Windows-style Access Control Lists on filesystem objects. Essential for diagnosing permission issues.
| Command | Description |
|---|---|
--get <path> | Retrieve ACLs for a file or directory |
--set <path> <SDDL> | Set ACLs using an SDDL (Security Descriptor Definition Language) string |
--stdin | Read security descriptor from stdin as hex (with --get only) |
--map-acls <method> | ACL storage method: xattr:raw (native Windows) or xattr:v3 (Samba-compatible) |
Support use — diagnose permission issues:
# Check ACLs on a file a user cannot access
tsmb-acls --get /export/share/protected-file.docx
# Check ACLs on a share root directory
tsmb-acls --get /export/share/
The output shows the security descriptor in SDDL format, which encodes the owner, group, and access control entries. Compare against the expected permissions when a user reports "access denied" errors.
tsmb-privilege — Windows Privilege Management
tsmb-privilege [<option>,...] <command> [<parameter>,...]
Controls Windows privileges granted to users. These privileges affect administrative operations on the server.
| Command | Description |
|---|---|
grant <privilege> <user> | Grant a privilege to a user |
revoke <privilege> <user> | Revoke a privilege from a user |
list | List all granted privileges |
Available Privileges
| Privilege | Effect |
|---|---|
SeSecurityPrivilege | Manage auditing and security logs |
SeTakeOwnershipPrivilege | Take ownership of files and objects |
TsmbServerOperatorsPrivilege | Server operator access |
TsmbServerShareOperatorsPrivilege | Share management access |
TsmbServerOpenOperatorsPrivilege | Open file operations access |
TsmbServerSessionOperatorsPrivilege | Session management access |
Support use — check privilege grants:
# List all privilege assignments
tsmb-privilege list
# Grant share management to a service account
tsmb-privilege grant TsmbServerShareOperatorsPrivilege DOMAIN\\svcadmin
tsmb-migrate — Winbind ID Migration
tsmb-migrate [<option>,...] [<command> [<parameter>,...]]
Imports configuration and user data from an existing Samba/Winbind installation into Fusion SMB. Used during migrations from Samba to preserve identity mappings and avoid permission breakage.
| Command | Description |
|---|---|
idmap (tdb|autorid) | Import the Winbind ID mapping table from the named persistent backend. The imported table is written to the file configured with the userdb_idmap_table global parameter. |
machine-password [<domain>] | Import the machine account password used for connecting to Netlogon, optionally scoped to a domain |
users | Import local SAM user accounts |
| Option | Description |
|---|---|
-c <path> / --config <path> | Path to the configuration file |
-p <path> / --samba-private-dir <path> | Path to the Samba private directory |
--samba-state-dir <path> | Path to the Samba state directory |
-f / --force | Overwrite existing files |
Support use: This tool is relevant when a customer is migrating from a Samba deployment and needs to preserve existing identity mappings so that file ownership and permissions remain consistent. If a post-migration customer reports that file ownership looks wrong or that domain users resolve to unexpected UIDs, confirm which of these imports were actually run.
Support Diagnostic Playbook
When a customer reports an issue, use these tools in sequence:
# 1. Confirm version
tsmb-server -v
# 2. Check server is running and capture statistics
tsmb-status stats --format json > /tmp/diag-stats.json
# 3. Review current configuration
tsmb-cfg global list --format json > /tmp/diag-config.json
tsmb-cfg share list --format json > /tmp/diag-shares.json
# 4. If permission issue — check ACLs on affected path
tsmb-acls --get /path/to/problem/file
# 5. If auth issue — check local user database
tsmb-passwd --list
tsmb-privilege list
# 6. Increase log verbosity for active diagnosis
sudo tsmb-cfg global update --log-level "5 idmap:40"
# 7. Reproduce the issue, then collect logs
# (see Log Collection & Analysis page)
# 8. Revert log level
sudo tsmb-cfg global update --log-level 3
Reference: For complete parameter documentation for each command, see the CLI Reference on docs.tuxera.com.