SAMBA Share - Keep user from deleting a file

Question

I'm creating a hidden "Access Log" .txt file of employees accessing a program I've created and need to know how to make it so this file cannot be deleted.

Reason being, this program helps to automate a lot of tasks that we perform on workstations, and it can do a lot of damage as well. So I need to track who accesses it just in case it becomes an issue.

Reiterating the question, how do I keep anyone from deleting this file while still being able to write to it.

Answer 1

I guess that you have users that each time they start an application, this application keeps track of who started it by writing some information in a file located in the samba share accessible by all workstations. Since you're referring to "Access Log", I also guess that you only need to append to the file and not modify its contents.

If the file is on an ext2/3/4 file-system on the server side, then make sure that samba users don't have write permissions to its directory. This will avoid accidental or intensional deletion. Then enable the append-only attribute with chattr +a <filename>, so information can only be added and not removed/modified/truncated. The file can still have write permissions to everyone, so the application can append to it even with the users' privileges.

Note: chattr might work for other file-systems too, eg. xfs. I don't have an exact list.

Answer 2

Essentially, what you do here is logging, so you might prefer to use a remote logging daemon like rsyslogd to do your logging instead of hacking a file in a samba share.

This said, the deletion of a file is a change of the directory containing the file, not of the file. So, if you remove write permissions for your users on the directory, the file cannot be deleted. Of course, it can still be manipulated or accidentally truncated.

Answer 3

The goal of being able to write to a file and allow a group of users read-only access can be achieved by file ownership and permissions. Let's say all the users that need such access are in 'users' group and you alone have access to the root account on that system. Then do (as root):

touch /var/log/AccessLog
chown root:users /var/log/AccessLog
chmod 640 /var/log/AccessLog

From now on, only root will be able to modify the file but all users will be able to read it.

If instead you want to allow the users to write to the file, but need to keep track of who (and when) has modified it, you might use FAM (File Alteration Monitor). Above that, to keep a record of all previous versions of the file, you can put a Version Control System (like GIT for example)) - you can make it cooperate with FAM so that each file modification triggers a commit to the local repository. There probably can be easier ways to do it but nothing comes to my mind (at least nothing that would work on top of a filesystem).

Answer 4

If your files modified only first minutes after creation crontab next:

find /somedir -type f -user sambauser -mtime +3m -exec chown root:users {} \; -exec chmod 640 {} \;

Will find all files with time from last modification over 3 minutes and change owner/permissions.