1

I want to set up a small server for the office such that users can store their own files which also has separate directories set up for groups to share files. I also have users and clients who would like to mount over internet. I want to be able to specify access and permissions for individual directories for them too. Some may be using Windoze.

I originally tried setting up a LAN with CIFS. On the server I set up accounts for myself (simon) and another user created as guest. I installed system-config-samba. I then configured shares using the Samba Server Configuration Tool which allows users to be added along with the passwords used in their credentials. This is how the /etc/samba/smb.conf looked:

# Sample configuration file for the Samba suite for Debian GNU/Linux.
#
#
# This is the main Samba configuration file. You should read the
# smb.conf(5) manual page in order to understand the options listed
# here. Samba has a huge number of configurable options most of which 
# are not shown in this example
#
# Some options that are often worth tuning have been included as
# commented-out examples in this file.
#  - When such options are commented with ";", the proposed setting
#    differs from the default Samba behaviour
#  - When commented with "#", the proposed setting is the default
#    behaviour of Samba but the option is considered important
#    enough to be mentioned here
#
# NOTE: Whenever you modify this file you should run the command
# "testparm" to check that you have not made any basic syntactic 
# errors. 

#======================= Global Settings =======================

[global]

## Browsing/Identification ###

# Change this to the workgroup/NT-domain name your Samba server will part of
    workgroup = gannet

# server string is the equivalent of the NT Description field
    server string = %h server (Samba, Ubuntu)

# Windows Internet Name Serving Support Section:
# WINS Support - Tells the NMBD component of Samba to enable its WINS Server
#   wins support = no

# WINS Server - Tells the NMBD components of Samba to be a WINS Client
# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
;   wins server = w.x.y.z

# This will prevent nmbd to search for NetBIOS names through DNS.
    dns proxy = no

#### Networking ####

# The specific set of interfaces / networks to bind to
# This can be either the interface name or an IP address/netmask;
# interface names are normally preferred
;   interfaces = 127.0.0.0/8 eth0

# Only bind to the named interfaces and/or networks; you must use the
# 'interfaces' option above to use this.
# It is recommended that you enable this feature if your Samba machine is
# not protected by a firewall or is a firewall itself.  However, this
# option cannot handle dynamic or non-broadcast interfaces correctly.
;   bind interfaces only = yes



#### Debugging/Accounting ####

# This tells Samba to use a separate log file for each machine
# that connects
    log file = /var/log/samba/log.%m

# Cap the size of the individual log files (in KiB).
    max log size = 1000

# If you want Samba to only log through syslog then set the following
# parameter to 'yes'.
#   syslog only = no

# We want Samba to log a minimum amount of information to syslog. Everything
# should go to /var/log/samba/log.{smbd,nmbd} instead. If you want to log
# through syslog you should set the following parameter to something higher.
    syslog = 0

# Do something sensible when Samba crashes: mail the admin a backtrace
    panic action = /usr/share/samba/panic-action %d


####### Authentication #######

# Server role. Defines in which mode Samba will operate. Possible
# values are "standalone server", "member server", "classic primary
# domain controller", "classic backup domain controller", "active
# directory domain controller". 
#
# Most people will want "standalone sever" or "member server".
# Running as "active directory domain controller" will require first
# running "samba-tool domain provision" to wipe databases and create a
# new domain.
    server role = standalone server

# If you are using encrypted passwords, Samba will need to know what
# password database type you are using.  
;   passdb backend = tdbsam

    obey pam restrictions = yes

# This boolean parameter controls whether Samba attempts to sync the Unix
# password with the SMB password when the encrypted SMB password in the
# passdb is changed.
    unix password sync = yes

# For Unix password sync to work on a Debian GNU/Linux system, the following
# parameters must be set (thanks to Ian Kahan <<kahan@informatik.tu-muenchen.de> for
# sending the correct chat script for the passwd program in Debian Sarge).
    passwd program = /usr/bin/passwd %u
    passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .

# This boolean controls whether PAM will be used for password changes
# when requested by an SMB client instead of the program listed in
# 'passwd program'. The default is 'no'.
    pam password change = yes

# This option controls how unsuccessful authentication attempts are mapped
# to anonymous connections
    map to guest = bad user

########## Domains ###########

#
# The following settings only takes effect if 'server role = primary
# classic domain controller', 'server role = backup domain controller'
# or 'domain logons' is set 
#

# It specifies the location of the user's
# profile directory from the client point of view) The following
# required a [profiles] share to be setup on the samba server (see
# below)
;   logon path = \\%N\profiles\%U
# Another common choice is storing the profile in the user's home directory
# (this is Samba's default)
#   logon path = \\%N\%U\profile

# The following setting only takes effect if 'domain logons' is set
# It specifies the location of a user's home directory (from the client
# point of view)
;   logon drive = H:
#   logon home = \\%N\%U

# The following setting only takes effect if 'domain logons' is set
# It specifies the script to run during logon. The script must be stored
# in the [netlogon] share
# NOTE: Must be store in 'DOS' file format convention
;   logon script = logon.cmd

# This allows Unix users to be created on the domain controller via the SAMR
# RPC pipe.  The example command creates a user account with a disabled Unix
# password; please adapt to your needs
; add user script = /usr/sbin/adduser --quiet --disabled-password --gecos "" %u

# This allows machine accounts to be created on the domain controller via the 
# SAMR RPC pipe.  
# The following assumes a "machines" group exists on the system
; add machine script  = /usr/sbin/useradd -g machines -c "%u machine account" -d /var/lib/samba -s /bin/false %u

# This allows Unix groups to be created on the domain controller via the SAMR
# RPC pipe.  
; add group script = /usr/sbin/addgroup --force-badname %g

############ Misc ############

# Using the following line enables you to customise your configuration
# on a per machine basis. The %m gets replaced with the netbios name
# of the machine that is connecting
;   include = /home/samba/etc/smb.conf.%m

# Some defaults for winbind (make sure you're not using the ranges
# for something else.)
;   idmap uid = 10000-20000
;   idmap gid = 10000-20000
;   template shell = /bin/bash

# Setup usershare options to enable non-root users to share folders
# with the net usershare command.

# Maximum number of usershare. 0 (default) means that usershare is disabled.
;   usershare max shares = 100

# Allow users who've been granted usershare privileges to create
# public shares, not just authenticated ones
    usershare allow guests = yes
    username map = /etc/samba/smbusers
    security = user
;   encrypt passwords = yes
;   guest ok = no
;   guest account = nobody

#======================= Share Definitions =======================

# Un-comment the following (and tweak the other settings below to suit)
# to enable the default home directory shares. This will share each
# user's home directory as \\server\username
;[homes]
;   comment = Home Directories
;   browseable = no

# By default, the home directories are exported read-only. Change the
# next parameter to 'no' if you want to be able to write to them.
;   read only = yes

# File creation mask is set to 0700 for security reasons. If you want to
# create files with group=rw permissions, set next parameter to 0775.
;   create mask = 0700

# Directory creation mask is set to 0700 for security reasons. If you want to
# create dirs. with group=rw permissions, set next parameter to 0775.
;   directory mask = 0700

# By default, \\server\username shares can be connected to by anyone
# with access to the samba server.
# Un-comment the following parameter to make sure that only "username"
# can connect to \\server\username
# This might need tweaking when using external authentication schemes
;   valid users = %S

# Un-comment the following and create the netlogon directory for Domain Logons
# (you need to configure Samba to act as a domain controller too.)
;[netlogon]
;   comment = Network Logon Service
;   path = /home/samba/netlogon
;   guest ok = yes
;   read only = yes

# Un-comment the following and create the profiles directory to store
# users profiles (see the "logon path" option above)
# (you need to configure Samba to act as a domain controller too.)
# The path below should be writable by all users so that their
# profile directory may be created the first time they log on
;[profiles]
;   comment = Users profiles
;   path = /home/samba/profiles
;   guest ok = no
;   browseable = no
;   create mask = 0600
;   directory mask = 0700

[printers]
    comment = All Printers
    browseable = no
    path = /var/spool/samba
    printable = yes
;   guest ok = no
;   read only = yes
    create mask = 0700

# Windows clients look for this share name as a source of downloadable
# printer drivers
[Simon]
    comment = Simon Fanshawe Personal Files
    path = /home/simon
    writeable = yes
;   browseable = yes
    valid users = simon

[Gannet]
    comment = Gannet Limited Files
    path = /home/gannet
    writeable = yes
;   browseable = yes
    valid users = simon

[Library]
    comment = Files for general access.
    path = /home/library
    writeable = yes
;   browseable = yes
    valid users = guest, simon

[Backup&Archives]
    comment = Files for general access.
    path = /home/backup&archives
    writeable = yes
;   browseable = yes
    valid users = simon

[Shared]
    comment = General drive for sharing files.
    path = /home/shared
    writeable = yes
;   browseable = yes
    guest ok = yes

Client machines had all mounts for all users set up in /etc/fstab. Here is how the file my main machine looked:

# /etc/fstab: static file system information.
#
# Use 'blkid' to print the universally unique identifier for a
# device; this may be used with UUID= as a more robust way to name devices
# that works even if disks are added and removed. See fstab(5).
#
# <file system> <mount point>   <type>  <options>       <dump>  <pass>
# / was on /dev/sda1 during installation
UUID=fed8d5b9-ef42-4798-a4ea-b94dc5e4c9c6 /               ext4    errors=remount-ro 0       1
# swap was on /dev/sda5 during installation
UUID=599e172b-03b4-473e-b61b-2a907884f830 none            swap    sw              0       0
# Samba shares added by SGF 23-06-2016.  Important that users & groups exist on the server and that UIDs are the same on server & client.
# Shared directories need to be installed in home directory on the server a well as mount points in the client.  Directory owners and
# permissions are as set up on the server which is why UIDs & GIDs need to match.
//gannet8.local/Shared  /home/simon/Shared  cifs    auto,user,rw,credentials=/home/simon/.sysaccess
//gannet8.local/Shared  /home/visitor/Shared    cifs    auto,user,rw,credentials=/home/guest/.sysaccess
//gannet8.local/Library /home/simon/Library cifs    auto,user,rw,credentials=/home/simon/.sysaccess
//gannet8.local/Library /home/visitor/Library   cifs    auto,user,ro,credentials=/home/guest/.sysaccess
//gannet8.local/Gannet  /home/simon/Gannet  cifs    auto,user,rw,credentials=/home/simon/.sysaccess
//gannet8.local/Simon   /home/simon/Home    cifs    auto,user,rw,credentials=/home/simon/.sysaccess

I wanted to add more users to the system but immediately hit problems in that most users have UID mostly 1000 or close to on their local machines. When I tried changing UIDs on local machines to those on the server I still couldn't get it working as files in the shared directory had ownerships and permissions set by the clients which prevented access by others.

Is there a simple way of setting up the server such that UIDs and GIDs are set up on the server but appear correct to the user (ie translated to 1000 etc.) in the mounts on their own machines. All I'm after is to have authentication done at the server such that I can control access and permissions for individual directories. I tried looking at OpenLDAP in the Ubuntu documentation but after five minutes my head exploded.

There must be a simple way of doing this. I am using Mint at the moment but may migrate to mainstream Ubuntu versions, at least on the server. I am happy working with command line and text files as long as it isn't too complicated. I would even be happy to persevere with OpenLDAP if that really is the way to go.

13
  • How do people authenticate on your CIFS server? Do you use user mappings: samba.org/samba/docs/using_samba/ch09.html#samba2-CHP-9-TABLE-2 ? User-level secirty? Server-level security?
    – user996142
    Jun 27 '17 at 20:21
  • At the moment clients have credentials files in their home directories and the mounts are in specified is /etc/fstab and are mapped to mount points inside their home directories. The server was set up using the Samba Server Configuration Tool which allows users to be added along with the passwords used in their credentials files in a mini GUI.
    – Gannet
    Jun 27 '17 at 20:38
  • It's not pretty, I imagine I will need to set up something like SSHFS at least for it to work over the web.
    – Gannet
    Jun 27 '17 at 20:48
  • So, each user has her own samba account and mapped to physical user on server using "user map", correct?
    – user996142
    Jun 27 '17 at 20:56
  • Typical line from fstab on client - "//gannet8.local/Library /home/simon/Library cifs auto,user,rw,credentials=/home/simon/.sysaccess". All mounts for all users on client are in fstab.
    – Gannet
    Jun 27 '17 at 21:43
0

When you mount server folder to client over network there are 2 questions you need to ask:

  • Which UID/GID should files have from SERVER point of view
  • Which UID/GID should files have from CLIENT point of view

Use ls -lh in folder to check file owner and its group. Note that Linux translates UID to user if can, or shows it simply as number if can't.

Unless you are using some shared Account Database like LDAP (OpenLDAP or Windows Active Directory) and connect your Linux to it using PAM you have different user databases on client and server each with its own user-password-UID mapping (/etc/passwd file and its shadow with password). Client may have user "joe" with UID 1000 and server may have user "joe" with UID 2000 and "mary" with UID 1000.

There are several ways to solve it with Samba.

Use Unix Extensions.

They are SMB protocol extensions that allows server to tell UID to client. So when you connect to server prividing user=joe server:

  • translates joe to UID using its own database
  • chowns any created file with it
  • reports client its UID, and client maps it to some local user.

It works perfect, but then you need to sync your UIDS on client and server, which may be painful to do manually (use OpenLDAP with pam_ldap if you really want it).

I believe this is your issue!

Worst thing happens when server reports some uid and there is no user with such uid on client. So instead of user name you see number.

Make client to choose which user to use

When you mount your share with uid= and disable unix extensions setting unix extensions = no on server smb.conf.

  • Server uses user from authentication (user= from credentials)
  • Client uses uid=.

You do not even need to have same users on client and server, but it is convinient to have them same. But they may have different UIDS.

So, here is what you should do to add new user:

On server

  • unix extensions = no in global section in smb.conf
  • useradd -m joe
  • smbpasswd -a joe (type password and remember it)

On client

  • useradd -m joe && mkdir /home/joe/Home && chown joe /home/joe/Home
  • In /etc/fstab

//gannet8.local/joe /home/joe/Home cifs auto,user,rw,uid=joe,gid=joe,user=joe,password=PASS_HERE

You should be able create as many users as your like, but after 10-15 of them you should think about OpenLDAP or Active Directory (if you have many Windows clients).

Read https://www.samba.org/samba/docs/man/manpages-3/mount.cifs.8.html

Especially "FILE AND DIRECTORY OWNERSHIP AND PERMISSIONS" section

2
  • Just tried with UNIX extensions disabled. Still have problem that when one user creates a file, other users can't modify in shared directory. Both share and directory have permissions set to RW for everyone. I really want server to be in charge of who can do what on mounted shares. Any suggestions?
    – Gannet
    Jul 11 '17 at 20:06
  • Do you have any suggestions for clients connecting over internet?
    – Gannet
    Jul 11 '17 at 20:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.