2

I'm running Debian 7.7, intended to be used as a server. I've got Apache installed and I'd like to share its /var/www directory and access it from Windows machines. I've followed the instructions on the Debian wiki and a few other places, but I'm unable to get write access to the folders from Windows.

I apt-get installed samba, disabled home folder sharing, set security = user, added aalaap to the users list using smbpasswd -a and added the following share at the end of smb.conf:

[www]
    comment = Apache web root
    read only = no
    writable = yes
    valid users = @aalaap
    locking = no
    path = /var/www
    guest ok = yes

But when I access \\debian\www, I'm still unable to write to it (permission denied). Also, I can still see the \\debian\aalaap home profile, in spite of having disabled it.

I tried to map the www share in Windows and tried to login using aalaap, but Windows doesn't let me specify or disable the domain part, so it continues to log me in as SURFACEPRO\aalaap.

Needless to say, I've restarted Samba after nearly every step.

Update: I found another similar question with a working answer, but that required chmodding the folder 0777. It works, but that's obviously not secure, so I'd like to know what a better permissions set is.

  • 1
    Is aalaap a group? If not, does it help to remove the "@" symbol from "valid users"? – Andy Nov 23 '14 at 12:25
  • I'm not sure, but I assumed that a group with the name of the user would include just that group. I haven't tried removing this, because it has worked fine after chmodding 0777. Just looking for a more secure way now... – aalaap Nov 23 '14 at 12:34
1

For now, I would suggest to just add the apache group (typically www-data) as a secondary group to every user in the aalaap group (or just the aalaap user)

See 3rd section: Add a existing user to www-data group

sudo usermod -a -G www-data aalaap
sudo usermod -a -G www-data aalaap2

Assuming you have made apache the owner of www, and having set the needed permissions for the apache group, it seems to me more secure than authorizing everybody.

>ls -al /var  
... www-data www-data 4096 juin  18 22:53 www

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.