0

I have multiple user accounts on my Ubuntu Desktop 14.04 install. I have my a Samba share mounted under my administrator account using Nautilus (Ctrl+L) using credentials (smb://user@server/share). I switched to a standard user account and performed the same operation except without credentials (smb://server/share) and I was able to access everything that the administrator account had access to. Is this a bug or a configuration mistake?

Samba Configuration:

[global]
   workgroup = WORKGROUP  
   admin users = nick  
   log level = all:2  
   inherit permissions = yes  
   inherit acls = yes  
   map acl inherit = yes  
   server string = %h  
   dns proxy = no  
   name resolve order = lmhosts host wins bcast  
   interfaces = eth0  
   bind interfaces only = yes  
   log file = /var/log/samba/log.%m  
   max log size = 1000  
   syslog = 0  
   panic action = /usr/share/samba/panic-action %d  
   security = user  
   encrypt passwords = true  
   passdb backend = tdbsam  
   obey pam restrictions = yes  
   unix password sync = yes  
   passwd program = /usr/bin/passwd %u  
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully*  
   pam password change = yes  
   map to guest = bad user  
   socket options = TCP_NODELAY  
   usershare allow guests = no  

include = /etc/samba/shares.conf

[printers]  
   comment = All Printers  
   browseable = yes  
   path = /var/spool/samba  
   printable = yes  
   guest ok = yes  
   read only = yes  
   create mask = 0700  

[print$]  
   comment = Printer Drivers  
   path = /var/lib/samba/printers  
   browseable = yes  
   read only = yes  
   guest ok = yes

Shares Conf:

[Home]
   comment = Home Directory  
   path = /home  
   guest ok = no  
   browseable = no  
   writeable = yes  
   inherit owner = yes  
   inherit permissions = yes  
   valid users = nick,brittany  

[Shares]
   comment = Default shares  
   path = /shares  
   guest ok = yes  
   browseable = yes  
   writeable = yes  
   inherit acls = yes  
   inherit permissions = no  
   hide unreadable = yes  
   directory mask = 755  
   force directory mode = 1750  
   force directory security mode = 700  
   create mask = 755  
   force create mode = 1750  
   force security mode = 700  
   security mask = 077  
   directory security mask = 077
Improve this question
2
  • 1
    Hard to know from what little you posted. The permissions are set server side, so you will need to post the samba server config
    – Panther
    Sep 11, 2015 at 23:43
  • I've added the Samba configuration to the question.
    – N.Thompson
    Sep 12, 2015 at 12:50

1 Answer 1

Reset to default
0

With the additional information you posted, it is a misconfiguration server side.

The behavior you are seeing is because the server is configured to allow fairly unrestricted access.

Under [Shares] you have

guest ok = yes

from http://www.cyberciti.biz/tips/how-do-i-set-permissions-to-samba-shares.html

guest ok: If this parameter is set to yes, the users will have access to the share without having to enter a password. This can pose security risk.

Depending on how you wish to configure your share you have a number of options to be more restrictive.

I suggest

guest ok = no

You may also want 

browseable = no

Sort of depends on exactly what access you wish for which shares.

See

https://help.ubuntu.com/community/Samba/SambaServerGuide

http://www.cyberciti.biz/tips/how-do-i-set-permissions-to-samba-shares.html

http://beginlinux.com/blog/2010/01/samba-tutorial-create-private-user-shares/

and How can I set up Samba shares to only be accessed by certain users?

Improve this answer
3
  • Right, I have the guest ok option enabled to allow my kids access to the shares without having credentials and the permissions are controlled with ACLs. However, when I've got the share mapped under my login with my credentials (admin) and I switch to my kids' account and map to the share using Nautilus (Ctrl + L), I can access everything in the share as if I'm logged in with my account. I checked to ensure nothing was already mapped under the kids login as well. I can attach some screen shots to show if it will help explain better.
    – N.Thompson
    Sep 13, 2015 at 2:22
  • Make a private share, the behavior you describe is the direct result of the "guest ok = yes" option. See the link I gave you above.
    – Panther
    Sep 13, 2015 at 2:44
  • This was total user error. Complete ID10T error. I had previously logged in to the share under my kid's account with my credentials and chose the "Remember password until I logout" option... Thanks for all of your assistance and time with this bodhi.
    – N.Thompson
    Sep 14, 2015 at 3:11

Not the answer you're looking for? Browse other questions tagged .