-   Linux - Networking (
-   -   browsing home directories with samba (

rogerdv 08-03-2009 12:53 PM

browsing home directories with samba
I had my samba server configured to let the windows users browse their home directories. I had to reinstall the server, but my old conf didnt worked, and I have just managed to implement login against /etc/passwd and browsing a public directoy, but home directories are inaccesible. Is there any way to solve this or do I have to install some older samba version?

jschiwal 08-04-2009 12:20 PM

Could you post your smb.conf file. Also, look in the documentation that is installed with samba under /usr/share/doc/samba-<version>/. There is a default smb.conf file that you can use for a reference. It uses "security = user" and has a [homes] service. That sounds a lot like your setup.

Also run "testparm" to check your smb.conf for errors.

rogerdv 08-04-2009 01:31 PM

Here is the conf:


  workgroup = SCNET

  netbios name = eht

  server string = Samba Server %v

# 2. Printing Options:
# if you want to automatically load your printer list rather
# than setting them up individually then you'll need this
  printcap name = cups
  load printers = yes

  printing = cups

# 3. Logging Options:
# this tells Samba to use a separate log file for each machine
# that connects
  log file = /var/log/samba/log.%m

# Put a capping on the size of the log files (in Kb).
  max log size = 50

# Set the log (verbosity) level (0 <= log level <= 10)
; log level = 3

;  hosts allow = 192.168.1. 192.168.2. 127.

# Uncomment this if you want a guest account, you must add this to /etc/passwd
# otherwise the user "nobody" is used
;  guest account = pcguest
# Allow users to map to guest:
  map to guest = bad user

  security = user

;  password server = <NT-Server-Name>
;  password server = *

;  password level = 8
;  username level = 8

  encrypt passwords = no

# The following are needed to allow password changing from Windows to
# also update the Linux system password.
# NOTE: Use these with 'encrypt passwords' and 'smb passwd file' above.
# NOTE2: You do NOT need these to allow workstations to change only
#        the encrypted SMB passwords. They allow the Unix password
#        to be kept in sync with the SMB password.
;  unix password sync = Yes
# You either need to setup a passwd program and passwd chat, or
# enable pam password change
;  pam password change = yes
;  passwd program = /usr/bin/passwd %u
;  passwd chat = *New*UNIX*password* %n\n *Re*ype*new*UNIX*password* %n\n \

# Unix users can map to different SMB User names
;  username map = /etc/samba/smbusers

# Using the following line enables you to customise your configuration
# on a per machine basis. The %m gets replaced with the netbios name
# of the machine that is connecting
;  include = /etc/samba/smb.conf.%m

# Options for using winbind. Winbind allows you to do all account and
# authentication from a Windows or samba domain controller, creating
# accounts on the fly, and maintaining a mapping of Windows RIDs to unix uid's
# and gid's. idmap uid and idmap gid are the only required parameters.
# winbind separator is the character a user must use between their domain
# name and username, defaults to "\"
;  winbind separator = +
# winbind use default domain allows you to have winbind return usernames
# in the form user instead of DOMAIN+user for the domain listed in the
# workgroup parameter.
;  winbind use default domain = yes
# template homedir determines the home directory for winbind users, with
# %D expanding to their domain name and %U expanding to their username:
;  template homedir = /home/%D/%U

# When using winbind, you may want to have samba create home directories
# on the fly for authenticated users. Ensure that /etc/pam.d/samba is
# using 'service=system-auth-winbind' in pam_stack modules, and then
# enable obedience of pam restrictions below:
;  obey pam restrictions = yes

# template shell determines the shell users authenticated by winbind get
;  template shell = /bin/bash

# 5. Browser Control and Networking Options:
# Most people will find that this option gives better performance.
# See speed.txt and the manual pages for details
  socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192

# Configure Samba to use multiple interfaces
# If you have multiple network interfaces then you must list them
# here. See the man page for details.
;  interfaces =

# Configure remote browse list synchronisation here
#  request announcement to, or browse list sync from:
#      a specific host or from / to a whole subnet (see below)
;  remote browse sync =
# Cause this host to announce itself to local subnets here
;  remote announce =

# set local master to no if you don't want Samba to become a master
# browser on your network. Otherwise the normal election rules apply
;  local master = no

# OS Level determines the precedence of this server in master browser
# elections. The default value should be reasonable
;  os level = 33

# Domain Master specifies Samba to be the Domain Master Browser. This
# allows Samba to collate browse lists between subnets. Don't use this
# if you already have a Windows NT domain controller doing this job
;  domain master = yes

# Preferred Master causes Samba to force a local browser election on startup
# and gives it a slightly higher chance of winning the election
;  preferred master = yes

# 6. Domain Control Options:
# Enable this if you want Samba to be a domain logon server for
# Windows95 workstations or Primary Domain Controller for WinNT and Win2k
;  domain logons = yes

# if you enable domain logons then you may want a per-machine or
# per user logon script
# run a specific logon batch file per workstation (machine)
;  logon script = %m.bat
# run a specific logon batch file per username
;  logon script = %U.bat

# Where to store roaming profiles for WinNT and Win2k
#        %L substitutes for this servers netbios name, %U is username
#        You must uncomment the [Profiles] share below
;  logon path = \\%L\Profiles\%U

# Where to store roaming profiles for Win9x. Be careful with this as it also
# impacts where Win2k finds it's /HOME share
; logon home = \\%L\%U\.profile

# The add user script is used by a domain member to add local user accounts
# that have been authenticated by the domain controller, or when adding
# users via the Windows NT Tools (ie User Manager for Domains).

# Scripts for file (passwd, smbpasswd) backend:
; add user script = /usr/sbin/useradd -s /bin/false '%u'
; delete user script = /usr/sbin/userdel '%s'
; add user to group script = /usr/bin/gpasswd -a '%u' '%g'
; delete user from group script = /usr/bin/gpasswd -d '%u' '%g'
; set primary group script = /usr/sbin/usermod -g '%g' '%u'
; add group script = /usr/sbin/groupadd %g && getent group '%g'|awk -F: '{print $3}'
; delete group script = /usr/sbin/groupdel '%g'

# Scripts for LDAP backend (assumes nss_ldap is in use on the domain controller.
# Needs IDEALX scripts, and configuration in
# This assumes you've installed the IDEALX scripts into /usr/share/samba/scripts...
; add user script = /usr/share/samba/scripts/ '%u'
; delete user script = /usr/share/samba/scripts/ '%u'
; add user to group script = /usr/share/samba/scripts/ -m '%u' '%g'
; delete user from group script = /usr/share/samba/scripts/ -x '%u' '%g'
; set primary group script = /usr/share/samba/scripts/ -g '%g' '%u'
; add group script = /usr/share/samba/scripts/ '%g' && /usr/share/samba/scripts/ %g|awk '/^gidNumber:/ {print $2}'
; delete group script = /usr/share/samba/scripts/ '%g'

# The add machine script is use by a samba server configured as a domain
# controller to add local machine accounts when adding machines to the domain.
# The script must work from the command line when replacing the macros,
# or the operation will fail. Check that groups exist if forcing a group.
# Script for domain controller for adding machines:
; add machine script = /usr/sbin/useradd -d /dev/null -g machines -c 'Machine Account' -s /bin/false '%u'
# Script for domain controller with LDAP backend for adding machines (You need
# the IDEALX scripts, and to configure the first):
; add machine script = /usr/share/samba/scripts/ -w -d /dev/null -g machines -c 'Machine Account' -s /bin/false '%u'

# Domain groups:
# Domain groups are now configured by using the 'net groupmap' tool

# Samba Password Database configuration:
# Samba now has runtime-configurable password database backends.
# smbpasswd is for backwards compatibility only Default (not recommended),
# new installations should use tdbsam or ldap.
; passdb backend = smbpasswd
# TDB backend
 passdb backend = tdbsam
# LDAP with fallback to smbpasswd guest
# Enable SSL by using an ldaps url, or enable tls with 'ldap ssl' below.
; passdb backend = ldapsam:ldaps://
# Use the samba2 LDAP schema:
; passdb backend = ldapsam_compat:ldaps://

# idmap uid account range:
# This is a range of unix user-id's that samba will map non-unix RIDs to,
# such as when using Winbind
; idmap uid = 10000-20000
; idmap gid = 10000-20000
# LDAP configuration for Domain Controlling:
# The account (dn) that samba uses to access the LDAP server
# This account needs to have write access to the LDAP tree
# You will need to give samba the password for this dn, by
# running 'smbpasswd -w mypassword'
; ldap admin dn = cn=root,dc=mydomain,dc=com
; ldap ssl = start_tls
# start_tls should run on 389, but samba defaults incorrectly to 636
; ldap port = 389
; ldap suffix = dc=mydomain,dc=com
; ldap server =
# Seperate suffixes are available for machines, users, groups, and idmap, if
# ldap suffix appears first, it is appended to the specific suffix.
# Example for a unix-ish directory layout:
; ldap machine suffix = ou=Hosts
; ldap user suffix = ou=People
; ldap group suffix = ou=Group
; ldap idmap suffix = ou=Idmap
# Example for AD-ish layout:
; ldap machine suffix = cn=Computers
; ldap user suffix = cn=Users
; ldap group suffix = cn=Groups
; ldap idmap suffix = cn=Idmap

# 7. Name Resolution Options:
# All NetBIOS names must be resolved to IP Addresses
# 'Name Resolve Order' allows the named resolution mechanism to be specified
# the default order is "host lmhosts wins bcast". "host" means use the unix
# system gethostbyname() function call that will use either /etc/hosts OR
# DNS or NIS depending on the settings of /etc/host.config, /etc/nsswitch.conf
# and the /etc/resolv.conf file. "host" therefore is system configuration
# dependant. This parameter is most often of use to prevent DNS lookups
# in order to resolve NetBIOS names to IP Addresses. Use with care!
# The example below excludes use of name resolution for machines that are NOT
# on the local network segment
# - OR - are not deliberately to be known via lmhosts or via WINS.
; name resolve order = wins host lmhosts bcast

# Windows Internet Name Serving Support Section:
# WINS Support - Tells the NMBD component of Samba to enable it's WINS Server
;  wins support = yes

# WINS Server - Tells the NMBD components of Samba to be a WINS Client
#      Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
;  wins server = w.x.y.z

# WINS Proxy - Tells Samba to answer name resolution queries on
# behalf of a non WINS capable client, for this to work there must be
# at least one  WINS Server on the network. The default is NO.
;  wins proxy = yes

# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
# via DNS nslookups. The built-in default for versions 1.9.17 is yes,
# this has been changed in version 1.9.18 to no.
  dns proxy = no

# 8. File Naming Options:
# Case Preservation can be handy - system default is _no_
# NOTE: These can be set on a per share basis
;  preserve case = no
;  short preserve case = no
# Default case is normally upper case for all DOS files
;  default case = lower
# Be very careful with case sensitivity - it can break things!
;  case sensitive = no

# Enabling internationalization:
# you can match a Windows code page with a UNIX character set.
# Windows: 437 (US), 737 (GREEK), 850 (Latin1 - Western European),
# 852 (Czech), 861 (???), 932 (Japanese),
# 936 (Simplified Chin.), 949 (Korean Hangul),
# 950 (Trad. Chin.).
# More detail about code page is in
# ""
# UNIX: ISO8859-1 (Western European), ISO8859-2 (Eastern Eu.),
# ISO8859-5 (Russian Cyrillic), KOI8-R (Alt-Russ. Cyril.)
# This is an example for french users:
;  dos charset = 850
;  unix charset = ISO8859-1

#============================ Share Definitions ==============================
  comment = Home Directories
  browseable = yes
  writable = yes
# You can enable VFS recycle bin on a per share basis:
# Uncomment the next 2 lines (make sure you create a
# .recycle folder in the base of the share and ensure
# all users will have write access to it. See
# examples/VFS/recycle/REAME in the samba docs for details
;  vfs object = /usr/lib/samba/vfs/

# NOTE: If you have a CUPS print system there is no need to
# specifically define each individual printer.
# You must configure the samba printers with the appropriate Windows
# drivers on your Windows clients. On the Samba server no filtering is
# done. If you wish that the server provides the driver and the clients
# send PostScript ("Generic PostScript Printer" under Windows), you have
# to swap the 'print command' line below with the commented one.
  comment = All Printers
  path = /var/spool/samba
  browseable = no
# set to yes to allow user 'guest account' to print.
  guest ok = no
  writable = no
  printable = yes

# This share is used for Windows NT-style point-and-print support.
# To be able to install drivers, you need to be either root, or listed
# in the printer admin parameter above. Note that you also need write access
# to the directory and share definition to be able to upload the drivers.
# For more information on this, please see the Printing Support Section of
# /usr/share/doc/samba-<version>/Samba-HOWTO-Collection.pdf
  path = /var/lib/samba/printers
  browseable = yes
  read only = yes
  write list = @adm root
  guest ok = yes
  comment = Public Stuff
  path = /home/public
  public = yes
  writable = yes
  printable = no

testparm reports no problems. Currently, users can browse and see the public folder, but they just see a homes folder which is inaccessible, insted of seeing their home folder as before. I thought to downgrade samba, but seems that versions previous to 3.0.33 have been removed from portage.

jschiwal 08-04-2009 09:52 PM

This is the [homes] service that SuSE uses:

        comment = Home Directories
        valid users = %S, %D%w%S
        browseable = No
        read only = No
        inherit acls = Yes

However the Samba default is very similar to yours:

  comment = Home Directories
  browseable = no
  writable = yes

From the smb.conf manpage:

      If you decide to use a path = line in your [homes] section, it may be useful to use the %S macro. For example:

          path = /data/pchome/%S

      is useful if you have different home directories for your PCs than for UNIX access.


      The browseable flag for auto home directories will be inherited from the global browseable flag, not the [homes] browseable
      flag. This is useful as it means setting browseable = no in the [homes] section will hide the [homes] share but make any auto
      home directories visible.

If you have "browseable = no", there will be the users home directory name in the browse list, but not "homes". If you use "browseable = yes" you will see both. I had used a [profile] service on my desktop. I commented it out and used your [home] service instead. It works for me.

Here is another difference from what I have:
# TDB backend
passdb backend = tdbsam

Look at "sudo pdbedit -L". Are all the users listed? Perhaps when you re-installed you didn't backup the samdba trivial database files.

From the Samba HOWTO, these files should be backed up.

account_policy.tdb        Y       
group_mapping.tdb        Y       
lang_en.tdb        Y       
netsamlogon_cache.tdb        Y       
ntdrivers.tdb        Y       
ntforms.tdb        Y       
ntprinters.tdb        Y       
printing directory        Y       
registry.tdb        Y       
share_info.tdb        Y       
winbindd_idmap.tdb        Y       
wins.tdb        Y       
secrets.tdb        Y       
This tdb file stores internal settings such as the machine and the domain SID, secret passwords that are used with LDAP, the machine secret token, etc. This is an essential file that is stored in a secure area. Vendors locate this in various folders. Check smbd -b to find its location on your system.
schannel_store.tdb        Y       

This stores secure channel access token information used with SMB signing.
passdb.tdb        Y       

This stores the Samba SAM account information when using a tdbsam password backend.

Some may not be used in your configuration. You may want to install the samba docs, and read "Chapter 41. Managing TDB Files".
I think you may need to run smbpasswd to add the users back in the password backend.

Good Luck!

rogerdv 08-05-2009 11:07 AM

Setting browseable to no makes dissapear the home directory, but no user folder is displayed. I made a backup of my /etc/samba folder, so, if the tdb files are somewhere else I lost them.

jschiwal 08-08-2009 11:37 AM

Those files are in /var/lib/samba/.

All times are GMT -5. The time now is 12:30 AM.