2

I recently set up Samba on a Linux server and discovered the shared drive on a Windows machine with ease, but was not able to copy files to that drive as it would ask for extra permissions.

I was able to write to sub-folders with 777 permissions, but the main drive had 775.

As i am advised that 777 permissions are highly un-secure, how can I modify groups to include users browsing in from Windows who do not have user-level permissions in the Linux server?

This is a home network, and access to the Samba server is limited through a global setting that prevents access from outside the network (by adding the following lines to /etc/samba/smb.conf)

[global]
hosts allow = 192.168.0.
hosts deny = ALL

Therefore I am not concerned about security within the network - if a user is on the 192.168.0.x subnet I am happy to assume that they are legitimate and do not want to add further authentication steps at the moment.

8
  • The permissions should be based off of the user you are logging in with. Does that user own the shared directory? – nullmeta May 12 '17 at 23:18
  • Maybe reference this guide to see if you missed a step in configuring samba. Otherwise include how you setup samba, how your share looks in smb.conf, if your logging in with a local user (on the Linux machine) and what user/group the share belongs to – nullmeta May 12 '17 at 23:35
  • Who is supposed to have write access on the share and the files and directories below it? A set of users, one or more user groups, everyone or even anonymous users (i. e. "guests")? – David Foerster May 13 '17 at 0:46
  • @nullmeta The user I administrate the Linux Samba server owns the directory and has full read/write access - the problem I have is that I cannot then write to the drive from a Windows machine on the same network (I can read fine though) – Tombas May 13 '17 at 9:36
  • @DavidFoerster The ideal is that any user that is on my local network should be able to have full read/write access to the drive (I have tried to limit to home network by adding 'hosts allow =' and 'hosts deny =' to the [global] section; I assume that this works). – Tombas May 13 '17 at 9:38
0

Typically one doesn't want to give everyone with network access write access to a directory. There often better solutions to share files among a user group, e. g. giving everybody their own network share with (partial) read access for everybody else. That's where the recommendation to not use world-writable access permissions comes from.

However, in your case that seems to be exactly what you want. So go ahead and use chmod -R 0777 /path/to/share along with appropriate Samba configuration entries like writable = yes.

3
  • But that doesn't answer the question. He needs to know how to be able to write files from Windows over the network without giving 777 permissions. As do I. Is it possible to add a Windows user to a Linux usergroup? – Mark Kramer Jun 22 '17 at 2:39
  • @MarkKramer: Sometimes a suitable answer requires to side-step the question and challenge its underlying assumptions. Apparently my answer solved the implicit question underlying the explicit one here or OP wouldn't have accepted it. – David Foerster Jun 22 '17 at 9:22
  • Yeah, I thought that was strange. Anyway, I found an answer answer here. – Mark Kramer Jun 22 '17 at 15:35
2

I see what you want. All users/computers on your LAN should be 'guests' and have full 'read/write' access to the file share.

Steps:

Check Samba config. Does the share include these:

[Share]
available = yes
browsable = yes
public = yes
writeable = yes

Check POSIX permissions. Example ls -lh:

drwxrws---+ 1 nobody nogroup  252 May 12 14:55 Music

You will want to have the sticky bit there otherwise the fileshare won't behave like you would expect in windows. chmod 2770 [dir]... To apply with permission to all the directories use find. Example

find . -type d -exec chmod 2770 {} \;
find . -type f -exec chmod 2760 {} \;

You will also want to set the group to be nogroup, which is the default guest group for samba.

Finally acls. Use getfacl and setfacl. You'll want to setup defaults for the user nobody and the group nogroup. Once you've done that, anything that gets created via samba will inherit good permissions. Here's an example directory ACL:

# file: Downloads
# owner: nobody
# group: nogroup
# flags: -s-
user::rwx
group::rwx
mask::rwx
other::---
default:user::rwx
default:group::rwx
default:mask::rwx
default:other::---

To get some defaults going, use find:

find . -type d -exec setfacl -d -m u::rwx {} \;
find . -type d -exec setfacl -d -m g::rwx {} \;

To fix up existing files:

find . -type f -exec chgrp nogroup {} \;
find . -type f -exec chmod 660 {} \;
find . -type f -exec setfacl -m g::rw {} \;

WANT MORE !

Let's just say that you don't want to change the POSIX group. Then you can use the ACL to explicitly add the group. Example:

setfacl -m g:linuxgroup:rw [filename]

With these settings I share between ubuntu, windows, RPi, android, and other linux apps.

1
  • Awesome answer, thanks! I have +1'd it but it won't show yet... I may get back to you for more once I understand what you have written lol! – Tombas May 15 '17 at 8:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.