2

I have a headless server running Debian 10 with Samba 4.9.5. On it I want to share a folder where any user has full read/write access. Here is my entire smb.conf file:

[global]
workgroup = WORKGROUP
netbios name = MyServerName
security = user
map to guest = bad user
guest account = myuser
dns proxy = no
log level = 4

[Stuff]
path = /home/myuser/share
force user = myuser
force group = myuser
browseable = yes
guest ok = yes
write list = myuser
read only = no

myuser has read / write access for all files and read / write / execute access for all folders in /home/myuser/share. However, some of the files don't have write access for their group or other permissions. i.e. their permissions are 755, 644, etc.

For whatever reason, those files and folders are not writable by any client that connects to the share, even though I have force user set to myuser.

I also just noticed that map to guest doesn't seem to be working correctly either. If I connect with an invalid user name, it rejects it rather than mapping it to the myuser account and allowing access to Stuff.

Could someone help me figure out why this isn't working?

I did search around for similar questions and found this: How to create a Samba share that is writable from Windows without 777 permissions, but the accepted solution there is to use force user, which is precisely what I'm doing, but for some reason it's still not working.

Bri Bri
  • 121
  • 1
  • 1
  • 6
  • Does `myuser` have access to the file and directories? Also, add the output of `grep -B3 browseable /etc/samba/smb.conf` to your question. – Nasir Riley Jul 23 '20 at 19:24
  • @NasirRiley Yes, I stated in my question that `myuser` has full access to all of the files and folders in the shared directory. Also, I included my entire smb.conf file in my question, so no need to add the output of grep; you can see that the share has `browseable = yes`. (I did edit the question to make it more clear that this is more entire smb.conf file.) – Bri Bri Jul 23 '20 at 19:54
  • Does it say `browseable = yes` under `[homes]` in `/etc/samba/smb.conf`? That's why I asked you add the output of `grep -B3 browseable /etc/samba/smb.conf` to your question. – Nasir Riley Jul 23 '20 at 20:09
  • @NasirRiley There is no [homes] section in `/etc/samba/smb.conf`. What I included in my question is the entire contents of the file. – Bri Bri Jul 23 '20 at 20:13
  • There should be more than that in `/etc/samba/smb.conf`. I have Samba installed on a Debian 10 VM right now and it has far more than what you have. – Nasir Riley Jul 23 '20 at 20:24
  • @NasirRiley Should there? I wrote the whole file manually because this is a dead simple set up. As far as I understand smb.conf, if you only have one share, you only need two sections: `global` and one for the share itself. I don't think there's any need to have more sections or include sections that would be present in automatically generated files, though I could be wrong. So it is certainly possible that I missed something. If you can make a recommendation as to what I should add, I'm willing to try it. – Bri Bri Jul 23 '20 at 20:28
  • Delete the file and reinstall Samba to generate a new one. Change `[homes]` to `browseable = no` and `read only = no`. See if the users can write to it that way. – Nasir Riley Jul 23 '20 at 20:31
  • Before I go and generate a new smb.conf I want to see if someone can help me fix the one I've got, or at least help me understand why it's not working as expected. – Bri Bri Jul 23 '20 at 20:33

3 Answers3

7

I think I'm encountering the same problem you have. For some reason force user seems to require group write permissions. It does not appear to require world write permissions though, so as a workaround you should be able to get away with 660/770 permissions rather than 777. This shouldn't reduce security; it's just annoying to move files into it outside of samba since you need to make them group-writeable.

Put this in your smb.conf under [Stuff]:

force user = myuser
create mask = 0660
directory mask = 0770

Then run this on your share folder:

sudo chown -R myuser:myuser /home/myuser/share
sudo chmod -R 0660 /home/myuser/share
sudo chmod -R ug+X /home/myuser/share

Then restart smbd. The above will set all files to 660 and all directories to 770, for currently existing files and for files newly created through samba. Note that you don't need force group; by default it matches the primary group of force user. Also note that I'm denying world permissions entirely here. You could probably use 0664, 0775 and ugw+X instead if you want them world-readable.

Unfortunately I haven't been able to make it work without group write permissions. I suspect it's a bug in samba. The recent samba bug #14617 prevented deleting files via force user. It's possible this is another related bug but I don't know enough about it to report it. If you figure out how to get it working with 0644/0755 please let me know!

ludocode
  • 71
  • 1
  • 3
1

OK, have you created users with 'smbpasswd -a username' (needs to be run as root) ? If you haven't, then your guest account 'myuser' will not work. This means that no one will be able to access your share. Authentication (based on your smb.conf) works like this: A user connects to Samba and if the user is known and supplies the correct password, they are allowed access to your share, but anything they save will be saved as if belonging to 'myuser', but they will be able to read and write files. If they are a known user, but supply a wrong password, then the connection is silently dropped. Because you have 'map to guest = bad user' in global and 'guest ok = yes' in the share, an unknown user that connects to Samba will be mapped to the guest account 'myuser' before it gets anywhere near the share and as they are now a known user, they will be allowed access to the share. As for the smb.conf being too short, well, yours could be even shorter. You do not need the 'force group' line, the 'force user' will do that for you, also as 'myuser' has write permissions by default, you do not need the 'write list' line. Finally, you never need to set 'browseable = yes' anywhere, it is a default setting.

Rowland Penny
  • 141
  • 2
  • While this 'answer' may contain some useful tips for the OP and readers, it doesn't seem to attempt to answer the question at hand. – Parker Kemp Nov 25 '20 at 19:59
  • Yes it does, unless 'myuser' is a valid Unix user, guest access will not work and if it is a valid user, all files will end up belonging to 'myuser'. I also take it that, as the question was answered months ago, the user has fixed his problem. Surely he would said if he didn't understand. – Rowland Penny Nov 27 '20 at 19:01
0

I spent two full days trying to get this working and only after I followed ludocode's instructions I finally can access the share. Thank you so much!

Some additional remarks (which I am posting here as answer since I still got a score below 50 and can't comment):

  • As ludocode correctly mentioned, force group is not needed if the guest users's primary group is correctly set.

  • write list = myuser is also not needed as you only have a single unix user. read only = no (or write ok = yes aka writeable = yes aka writable = yes) is sufficient.

  • I'd suggest two more parameters if you're making use of the archive bit on your Windows machines, e.g. to mark files that have not been backed up, or want full support for the file creation time:

     dos filemode = yes
 store dos attributes = yes

See Samba Wiki for details (dos filemode, store dos attributes). Note that the latter is default since Samba 4.0.9. You must use a file system that supports extended attributes. BTRFS does support this by default, you must not add user_xattr as a mount option in /etc/fstab.

It is understood that this does not directly answer the question. But now you have a complete smb.conf file ready to use and all the information that you need for a simple Samba standalone setup on one page.

duise
  • 21
  • 3