I am having some problems accessing my Ubuntu Server 14.04 over Samba. I am trying to access from my Ubuntu Gnome 14.04 desktop and other Linux desktops. I would like to have fine access control in the server where some users can read and write to shares and other users can only read but not write/delete files. I am not sure that I am doing this the right way but I realize there are usually many ways to do something on Linux. I have created the folders through the command line and am using Samba through Webmin to share them.
I believe that file level ACL is where my current problem is. For example I have two folders on the server one I can read and write to and one I cannot write to but can read.
Getfacl lists their properties like this:
john@Server:~$ getfacl /exports/Stuff
getfacl: Removing leading '/' from absolute path names
file: exports/Stuff
owner: root
group: root
user::rwx
group::r-x
other::r-x
default:user::rwx
default:user:john:rw-
default:user:wife:rw-
default:user:daughter:rw-
default:group::r-x
default:group:users:r--
default:mask::rwx
default:other::r-x
john@Server:~$ getfacl /exports/Photos
getfacl: Removing leading '/' from absolute path names
file: exports/Photos
owner: john
group: root
user::rwx
group::r-x
other::r-x
default:user::rwx
default:user:john:rw-
default:user:wife:rw-
default:group::r-x
default:group:users:r--
default:mask::rwx
default:other::r-x
Now I see that I am the owner of Photos and root is the owner of folder Stuff an that seems to be the largest difference between them.
Another user on the network also using Ubuntu Gnome can access the Photos folder but cannot write, this is the behavior I wanted and I imagine Samba is controlling this as she is not listed in the ACL’s but is listed in Samba security.
Would the best approach be to delete the file system acls with setfacl and then just use samba to control user access or should I set them to both match?
Am I going about this in the right way? What is the best practice to handle something like this? All clients are on Linux so If you had shares that some would view and never write to, while others would read and write, how would you control access?