0

I am having some problems accessing my Ubuntu Server 14.04 over Samba. I am trying to access from my Ubuntu Gnome 14.04 desktop and other Linux desktops. I would like to have fine access control in the server where some users can read and write to shares and other users can only read but not write/delete files. I am not sure that I am doing this the right way but I realize there are usually many ways to do something on Linux. I have created the folders through the command line and am using Samba through Webmin to share them.

I believe that file level ACL is where my current problem is. For example I have two folders on the server one I can read and write to and one I cannot write to but can read.

Getfacl lists their properties like this:

john@Server:~$ getfacl /exports/Stuff

getfacl: Removing leading '/' from absolute path names

file: exports/Stuff

owner: root

group: root

user::rwx

group::r-x

other::r-x

default:user::rwx

default:user:john:rw-

default:user:wife:rw-

default:user:daughter:rw-

default:group::r-x

default:group:users:r--

default:mask::rwx

default:other::r-x

john@Server:~$ getfacl /exports/Photos

getfacl: Removing leading '/' from absolute path names

file: exports/Photos

owner: john

group: root

user::rwx

group::r-x

other::r-x

default:user::rwx

default:user:john:rw-

default:user:wife:rw-

default:group::r-x

default:group:users:r--

default:mask::rwx

default:other::r-x

Now I see that I am the owner of Photos and root is the owner of folder Stuff an that seems to be the largest difference between them.

Another user on the network also using Ubuntu Gnome can access the Photos folder but cannot write, this is the behavior I wanted and I imagine Samba is controlling this as she is not listed in the ACL’s but is listed in Samba security.

Would the best approach be to delete the file system acls with setfacl and then just use samba to control user access or should I set them to both match?

Am I going about this in the right way? What is the best practice to handle something like this? All clients are on Linux so If you had shares that some would view and never write to, while others would read and write, how would you control access?

1 Answer 1

0

Webmin is outdated and has security problems and should not be used.

I had the same problem on 14.04. Many people answered my question and said Samba was not so screwed up on previous versions of Ubuntu. But this is a function and alias I add to my $HOME/.bashrc.

####################
# $1 is parameter for function
function fAdduser
{
if [ -z $1 ]; then
    echo "ERROR: No user given.";
    echo "Usage: cradduser USER";
    echo "Sets permissions and groups for home dir of user.";
    echo "Also sets up samba for user.";
    echo " ";
    return;
fi

# Add new user $1 and add to group 'users'.
# -m = make home dir
# -G GROUP = assign to group
sudo useradd -m -G users $1 || { echo "Error in useradd"; return 1; };
sudo usermod -p $1 $1;
echo "fAdduser: Their password is now the same as their username."
sudo passwd -u $1;
echo "fAdduser: Now enter their password.";
sudo passwd $1; 

# Now add to samba users. This linux user uses this password for Samba.
# The user is the same, the Samba password is not. 
# -a = add user
# -e = enable user
sudo smbpasswd -ae $1;

# Now change permissions for Samba on their home dir.
TDIR=/home/$1;
echo "Changing permissions and group on $TDIR files for Samba...";
sudo chmod a+rw $TDIR;
sudo chmod -R a+rw $TDIR/*;
sudo chgrp users $TDIR;
sudo chgrp -R users $TDIR/*;
echo "These are the users in group 'users'";
getent group users;
echo "Added user $1";
}


alias myadduser='fAdduser'
alias mysambareset='sudo restart smbd; sudo restart nmbd; sudo service smbd restart'

Edit and save your .bashrc, then do this: source $HOME/.bashrc to make the changes into effect. The function fAdduser adds a new user and sets them up for Samba. Review the steps here and see if you did them all.

To set up a Samba user do this: myadduser USERNAME.

If you change your Samba config file, save it and do this: mysambareset.

After much conflicting advice, and much trial and error, this is what works for me.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .