4

I've set up a service to run samba as non-root user, where the config file for the daemon and the service are on my home directory (on the proper subdirectories). But I keep getting samba starts and samba stops and the process exists without any information. (Both on systemctl or journalctl).

Can samba be run as a service and non-root user?

Improve this question
10
  • I've read your question and the accepted answer ( which I'm not challenging ) but I'm confused. You are trying to run smbd.service as a non-root user? Why would you want to do that? Or, is the question can a non-root user create a samba share? If this is the case the answer is yes. It's called a samba usershare and it allows any user the ability to share any folder he owns. You can create it from Nautilus graphically or via the command line.
    – Morbius1
    May 23, 2021 at 11:49
  • @Morbius1 Thanks. Normally i try to avoid to run any program with root privileges, and in this case it's not possible. If you do it using nautilus (which I'm not trying to cause this is a test for running on a server afterwards) I think the root password is required. I've just been able to run it after 2 days (the next error was I use VPNs on all my devices..)
    – user1032811
    May 23, 2021 at 12:21
  • A nautilus share does not require root permissions. That is the whole point of it. And samba isn't a program.
    – Morbius1
    May 23, 2021 at 13:16
  • I'm not interested in nautilus @Morbius1, but also then this should be wrong: "Samba listens to ports below 1024 (135, 445 namely), and convention requires that only root can bind ports below 1024."
    – user1032811
    May 23, 2021 at 16:52
  • net usershare add TestShare $HOME/Test "My Test" Everyone:F guest_ok=y && chmod 777 $HOME/TestI just created a samba usershare in a terminal on an Debian server. It's share definition is in /var/lib/samba/usershares. The ability to do that is limited to users who are members of the sambashare group. No Nautilus. No sudo.
    – Morbius1
    May 23, 2021 at 18:03

1 Answer 1

Reset to default
5

No.

Samba listens to ports below 1024 (135, 445 namely), and convention requires that only root can bind ports below 1024.

However, Linux has a capability interface that can be used to allow services to bind to ports that are below 1024 without root:

sudo /sbin/setcap 'cap_net_bind_service=ep' /usr/sbin/smbd
Improve this answer
7
  • wish i was that clever. thanks a lot. Would you then place all files in the root (system wide) directories?
    – user1032811
    May 22, 2021 at 15:47
  • 3
    I'm wondering if this is a misunderstanding. The root user and root directory have nothing to do with eachother. And Samba supports file permissions and users. I think it's better that you describe what you want to achieve, as I believe this is a X-Y question.
    – vidarlo
    May 22, 2021 at 15:54
  • if i put the service on a user folder, then it will only run with systemd --user and hence it won't work for samba, then the configuration file for systemd has to be on the root user folder, basically /etc/systemd/.... Is this wrong?
    – user1032811
    May 22, 2021 at 16:22
  • 1
    "convention requires", yes, but convention can be overridden, although it can lead to security issues if Samba is configured to listen to any ports that are designed to be trusted (e.g. SSH and stealing passwords)
    – lights0123
    May 23, 2021 at 0:38
  • 1
    The systemd way to do it would be to set AmbientCapabilities=CAP_NET_BIND_SERVICE in the unit file. That way samba only runs with privileges when it's started as a unit, with the configuration in the unit file.
    – timuzhti
    May 23, 2021 at 18:10

You must log in to answer this question.