Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm trying to achieve the following, in order to access samba shares from a Windows XP box:

Live users get a home directory which can be accessed with full permissions through samba if they are authenticated as the owner. I have this working with the following samba config settings:

####### Authentication #######

   security = user
   encrypt passwords = yes
   passdb backend = tdbsam
   obey pam restrictions = yes
   unix password sync = yes
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdate$
   pam password change = yes
   map to guest = bad user

####### Shares #######

[homes]
   comment = %S
   path = /home/%S
   allow hosts = 127. 192.168.1.
   valid users = %S
   browseable = yes
   writable = yes
   create mask = 0700
   directory mask = 0700

This is pretty much working a expected, apart from the right permissions being set when I create files and directories. But I read some other answers that talk about tinkering with different mask variants. So I'll probably get that fixed, so: so far so good.

What I'd like to have additionally, is another folder (music) that can be accessed with full permissions by me (let's say myusername), and only read permissions by guests (that don't need to authenticate to access these folders).

I created a group called music and a user called music with a home directory /home/music, and also added myusername to the group music. Then I tried the following samba config:

[music]
   comment = %S
   path = /home/music
   allow hosts = 127. 192.168.1.
   browsable = yes
   writable = yes
   read list = @music
   write list = myusername
   create mask = 0700
   directory mask = 0700

However, logging in on this samba directory as myusername from Windows XP didn't let me create files and/or directories. Could this be because of conflicts with the [homes] setting (since it is already referring to directories in /home as well)? Or am I misunderstanding the principles of user/group permissions?

Apart from that, I also started thinking: do I even need to create the group and user music to begin with? It appears to be a bit redundant when they wouldn't have write access to begin with anyway. Couldn't I simply create the directory /home/music with sudo (or another suggestion perhaps?), and use the above samba settings.

Whichever way, I do like to have this folder on the /home partition (it's on a separate HDD being the only partition on that HDD). I consider this kind of as my 'data' partition, not merely 'user data'. Or is that frowned upon, in general?

As you can see, I'm having a bit of difficulty with thinking of a good permissions strategy and coming up with the right samba config setting.

Could you shed some light on how I could best achieve what I am trying to accomplish?

share|improve this question
add comment

1 Answer 1

OK, so thus far I've managed to, kind of, get what I wanted by creating a directory in myusername called music. I deleted the group and user music (and its home directory) altogether.

So now my home structure is:

- /home
   - /myusername
     - /music
   - /otherusername
   - /andanotherusername

And I managed to get fully accessible user home directories with (as I already had):

[homes]
   comment = %S
   path = /home/%S
   allow hosts = 127. 192.168.1.
   valid users = %S
   browseable = no
   writable = yes
   create mask = 0700
   directory mask = 0700

And a directory music being read only for guests and fully accessible for myusername with:

[music]
   comment = %S
   path = /home/myusername/music
   allow hosts = 127. 192.168.1.
   browsable = yes
   guest ok = yes
   guest account = nobody
   read list = nobody
   write list = myusername
   create mask = 0755
   directory mask = 0700

It still feels a bit weird to have to have a subdirectory in the myusername home directory though. Preferably I'd like to have the music directory not being tied to myself.

I wanted to answer my own question as a suggestion for others who might want to achieve similar things.

I'd still welcome better suggestions though.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.