0

I have a simple home Ubuntu server running Samba (Version 4.15.13-Ubuntu) to provide a share for my local network only. The intent is to have Unix users assigned into a group "sambashare", and allow access to the share only if the Samba user is also a member of this Unix group, no guest access. The user would also be forced into the Unix group "sambashare" during their session so that all files/directories remain owned by that group, so all "sambashare" users can read/write.

smb.conf

[global]
    server string = Samba
    client min protocol = SMB3
    server min protocol = SMB2
    security = user
    max log size = 1000
    smb ports = 445
    log level = 3
    server role = standalone server
    map to guest = bad user
    
    ; options to allow iOS devices
    fruit:delete_empty_adfiles = yes
    fruit:veto_appledouble = no
    fruit:posix_rename = yes 
    fruit:wipe_intentionally_left_blank_rfork = yes
    vfs objects = fruit streams_xattr  
    fruit:model = MacSamba
    fruit:nfs_aces = no
    fruit:metadata = stream

[%h]
    path = /samba/share
    valid users = @sambashare
    browseable = yes
    writeable = yes
    public = no
    force group = +sambashare
    create mask = 660
    force create mode = 660
    directory mask = 770
    force directory mode = 770

The shared directory is set up with permissions using chgrp -R sambashare share and chmod -R 770 /samba/share so that it and anything within inherit the correct group.

ls -l /samba
drwxrws--- 3 root sambashare 4096 May 25 14:48 share

My user, alex, exists and is assigned into the "sambashare" group correctly. I can access the server via ssh without issue. I have run smbpasswd -a alex to assign a password and smbpasswd -e alex to enable this user in Samba.

id alex uid=1000(alex) gid=1000(alex) groups=1000(alex),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd),123(sambashare)

When accessing the share from any other device, however, I receive an error that I do not have permissions to access the directory. It is NOT indicating that my username or password are incorrect, only that once authenticated I lack permissions. The logging in /var/log/samba/log.smbd indicate that the identified user is not part of the "sambashare" group.

/var/log/samba/log.smbd

  mobile (ipv4:192.168.64.109:56107) connect to service %h initially as user alex (uid=1000, gid=1000) (pid 282287)
[2023/05/25 15:03:24.162311,  0] ../../source3/smbd/service.c:168(chdir_current_service)
  chdir_current_service: vfs_ChDir(/samba/share) failed: Permission denied. Current token: uid=1000, gid=1000, 7 groups: 1000 4 24 27 30 46 110
[2023/05/25 15:03:24.162376,  3] ../../source3/smbd/smb2_server.c:3954(smbd_smb2_request_error_ex)
  smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[1] status[NT_STATUS_ACCESS_DENIED] || at ../../source3/smbd/smb2_server.c:3246

Clearly the correct user is identified, as the uid, gid, and other groups are all correct, but the log does not indicate group 123 "sambashare" access, and so the attempt to change into the shared directory is denied.

Changing the directory permissions to 777 allows this same user to browse and create files/directories, all of which correctly inherit the "sambashare" group and are viewable by other users who access the share. However I do not want to allow guest access to this share, only users who are members of this dedicated group should be allowed to access, read, or write. I would also prefer not to manage users with any tools beyond Unix users and Samba users (smbpasswd).

Can anyone help me understand what is causing the lack of accurate group information during this authentication? Or if I've make another mistake in my config?

Thank you

2 Answers 2

0

If you want to have restrictions on the share I would be inclined to set them up explicitly. I would use a fixed name for the share (unless you have a really good reason for making it dynamically match the server name). I would also force a direct group name rather than using the + variant:

[sharename]
    path = /samba/share
    valid users = @sambashare
    browseable = yes
    writeable = yes
    public = no
    force group = sambashare
    create mask = 660
    force create mode = 660
    directory mask = 770
    force directory mode = 770

Ideally you would then set /samba/share so it has group write access, and /samba has group read access:

chgrp root:sambashare /samba /samba/share
chmod g=rx /samba
chmod g=rwx /samba/share

If the owner of /samba/share is also part of the group sambashare you will need to set the owner permissions to match the group permissions. (This is because the { owner, group, other } permissions sets are exclusive of each other: group applies to group members except the owner, and other applies to everyone except the group members and the owner.)

You may need to restart the Samba service after these changes, ensuring you kill off any outstanding child processes so they can be restarted with the new configuration. An option at the [global] level that can help with this is deadtime = 10.


On my servers I also have settings for the Recycle bin and Catia. At the [global] level the configuration definitions:

# Recycle settings, where enabled with "vfs objects = recycle"
recycle:repository = $Recycle.Bin
recycle:keeptree = yes
recycle:versions = yes
recycle:touch = yes
recycle:mtime = no
hide files = $Recycle.Bin/.recycle

# Mapping illegal characters, where enabled with "vfs objects = catia"
mangled names = no
catia:mappings = 0x22:0xa8,0x2a:0xa4,0x2f:0xf8,0x3a:0xf7,0x3c:0xab,0x3e:0xbb,0x3f:0xbf,0x5c:0xff,0x7c:0xa6

And then for each [share] where I want to enable them,

vfs objects = recycle catia
0

I had the same problem and while I did not find the root cause, I did find a work-around.

Rename the existing group (all done as root):

groupmod -n cursedgroup sambashare

Create a new group, with the same name but new group id:

groupadd sambashare

Copy members from old group to new:

for user in $(members cursedgroup); do usermod -A sambashare "$user"; done

I then restarted samba and double-checked the (debug level 10) samba log to ensure that new group was being shown as a secondary group.

Then I had to fix all the files owned by cursedgroup and change them to sambashare:

find / -group cursedgroup -exec chgrp -h sambashare {} \;


Side Note: This is a very unsatisfying solution, as I could not figure out why this particular gid was being filtered out by samba. I did figure out it was the gid and not the name though. On my particular system it was gid 107, but I don't think that's special. There must be some cruft in my samba database somewhere that I couldn't find. Note that sambashare doesn't appear at all in my smb.conf file, unlike yours. I also checked the samba databases in /var/lib/samba but I couldn't find any references to that group id.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .