password protected samba share

Question

I would like to have a few samba shares. Some of them should be available to everybody (this is already working) and some of them should be protected with a password (and username). For the password protected folders I created a new user, gave him a samba password and wrote his name under valid users = in my share. These were the commands:

useradd joe
passwd joe
smbpasswd -a joe
valid users = vivek raj joe

I followed this little guide: Samba Add a User. But it looks like it's not working, Windows 7 always tells me that the password is wrong.

Here is my samba config file:

[global]
  server string = bananapi
  workgroup = WORKGROUP
  netbios name = %h
  security = user
  guest account = root
  socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536
  smb ports = 445
  max protocol = SMB2
  min receivefile size = 16384
  deadtime = 30
  os level = 20
  mangled names = no
  syslog only = yes
  syslog = 2
  name resolve order = lmhosts wins bcast host
  preferred master = auto
  domain master = auto
  local master = yes
  printcap name = /dev/null
  load printers = no
  browseable = yes
  writeable = yes
  printable = no
  encrypt passwords = true
  enable core files = no
  passdb backend = smbpasswd
  smb encrypt = disabled
  use sendfile = yes
 
 
# Using the following configurations as a template allows you to add
# writable shares of disks and paths under /storage
 
[Share]
  path = /storage/share
  available = yes
  browsable = yes
  public = yes
  writable = yes
  root preexec = mkdir -p /storage/share
 
[username]
  path = /storage/username
  available = yes
  browsable = yes
  public = no
  writable = yes
  valid users = joe
  root preexec = mkdir -p /storage/username

Answer 1

https://www.samba.org/samba/docs/using_samba/ch09.html

you can configure a share using guest ok = yes to allow access to guest users.

This works only when using share-level security

when needing info on something, consider going to the source rather than some other website, here is the table of contents to samba: https://www.samba.org/samba/docs/using_samba/toc.html

you are using

[GLOBAL]
security = user

which is the most restrictive, and for anyone from a Microsoft Windows system to even access any samba share from your linux system they will need to either have or know an account on that linux system, and then know the password.

part of my smb.conf is this

[global]
        workgroup = WORKGROUP
        passdb backend = tdbsam
        security=user
        map to guest = Bad User
#       map to guest = nobody
        usershare allow guests = No
        server signing = auto

similiar to yours, the above will cause anyone on a windows system who does not have an account on the linux system to never connect, microsoft windows will respond with cannot access \\whatever_server_you_typed. This is because Map to Guest = Bad User where "Bad User" does not exist on the linux system as a user account, it is also syntactically invalid because it has a space.

Using Map to Guest = nobody where nobody however is a valid linux account will result in microsoft windows prompting for a username and password, and this will happen when the given username from microsoft windows is not also a username on the linux system running samba-server.

If you choose this method under Security = User you can use the method i described above to potentially satisfy your security needs. Otherwise you would need to do security = share to accomplish what you initially asked to do- where anyone on the network can access a specific folder without being prompted for a password.

For Security the choices are User, Share, Server, and Domain. The samba help documents will describe what functionality is and is not available under each.

And I recommend you undo the guest account = root

I did not track down the guest account = option in the help docs, I assume it is the same as Map to Guest (just like the Public option is really Guest OK = yes) and for obvious security implications you don't want to map some unknown user to the root account.

Answer 2

This is explained very well in this video.

https://www.youtube.com/watch?v=7Q0mnAT1MRg

I found it works better if you backup old smb.conf file and create a new one from scratch.

Go to /etc/samba folder.

sudo mv smb.conf smb.conf.bak

We can create a [global] settings in smb.conf file and a seperate file shares.conf for the individual folders.

Create a new smb.conf file.

sudo nano smb.conf

In smb.conf:

[global]
server string = File server
workgroup = WORKGROUP
security = user
map to guest = Bad User
name resolve order = bcast host
include = /etc/samba/shares.conf

Now create shares.conf file. Here i will show the password protected option since you already succeeded in public shares.

shares.conf:

[Private Share]

path=[give here the path to the folder to be shared]
force user = smbuser
force group = smbgroup
create mask = 0664
force create mode = 0664
directory mask = 0775
force directory mode = 0775
writable = yes

Create a system group smbuser.

sudo groupadd --system smbgroup

Now create a user smbuser,in smbgroup but do not create a home directory, and also deny the ability to log in to the system.

sudo useradd --system --no-create-home --group smbgroup -s /bin/false smbuser

Change the ownership of folder to be shared.

sudo chown -R smbuser:smbuser [folder path]

Give write access

sudo chmod -R g+w [folder path]

Add samba passwword to smbuser. This will be the password you have to give in windows for authentication to view the shared folder.

sudo smbpasswd -a smbuser
New SMB password:[password]
Retype new SMB password:[password]

Now restart smbd.

sudo systemctl restart smbd

In windows Run \\[ip address of samba system]

It will ask for username and password. Username is smbuser and the password is the one you gave.

Hope this was helpful.

Answer 3

You need to create a group with allowed users (like 'restrictedgroup') and specify in your smb.conf:

valid users = @restrictedgroup

Then only the users in the restricted group can access the folder.