LinuxQuestions.org
LinuxAnswers - the LQ Linux tutorial section.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
LinkBack Search this Thread
Old 06-19-2011, 05:45 PM   #1
^andrea^
Member
 
Registered: Mar 2011
Distribution: Xubuntu 12.04
Posts: 40

Rep: Reputation: 0
Samba share read only for guests and write for some specific users


Hi All,

I've been reading for a while about samba but I haven't found a solution to my problem yet.

I'd like to know if, the configuration I have in mind, is possible at all ("security = user" is what I'm using now).

I want a directory to be:
1) read only for guests and some UNIX users;
2) write for some other UNIX users.

;eg:
[Music]
path = /data/Music
guest ok = yes
read list = someone, @users
write list = andrea


The advantage of this configuration would be that every single user in my LAN (with or without a UNIX account) would be able to read the content of the shared directory Music and I (UNIX user andrea) could manage the folder directly trough samba preserving the correct owner/group and permissions on the new files/folder created.

Notes about my configuration above:
1) as it is now every user gets authenticated by samba as nobody so even I (andrea) cannot write in it;
2) commenting out the line "guest ok = yes" I can authenticate as "andrea" and write in it but guest access is not possible any longer.

Any suggestios would be appreciated.

Thanks,
Andrea
 
Old 06-19-2011, 10:04 PM   #2
jschiwal
Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 654Reputation: 654Reputation: 654Reputation: 654Reputation: 654Reputation: 654
Did you run the`smbpasswd' program so the linux user is an smb user as well?

Try adding the "andrea" user to the read list as well. Maybe then you will need to authenticate as the andrea user before reading, and not be a "bad user".

Also check the samba logs for clues. (Under /var/lib/samba/ or /var/log). This could reveal unforeseen causes such as selinux or apparmor write restrictions on the smbd daemon.

Last edited by jschiwal; 06-19-2011 at 10:10 PM.
 
Old 06-20-2011, 02:37 AM   #3
^andrea^
Member
 
Registered: Mar 2011
Distribution: Xubuntu 12.04
Posts: 40

Original Poster
Rep: Reputation: 0
I've done the original setup a few months ago so I don't remember exactly but I'm pretty sure I've run smbpasswd. Also bacause I can see shares enabled for the user "andrea" only after having entered the required password.

I checked the samba logs and I can see that, with the "guest ok = yes" option, I get authenticated as user "nobody" even though I should be the user "andrea".
If I remove that option I can see from the logs that I get authenticated as "nobody" without having to enter a password.

I read somewhere that with the option "guest ok = yes" ALL users will be authenticated as guests... :-/
 
Old 06-20-2011, 05:53 AM   #4
tristezo2k
LQ Newbie
 
Registered: Oct 2009
Distribution: debian ubuntu solaris FreeBSD
Posts: 26

Rep: Reputation: 4
Quote:
Originally Posted by ^andrea^ View Post
I've done the original setup a few months ago so I don't remember exactly but I'm pretty sure I've run smbpasswd. Also bacause I can see shares enabled for the user "andrea" only after having entered the required password.

I checked the samba logs and I can see that, with the "guest ok = yes" option, I get authenticated as user "nobody" even though I should be the user "andrea".
If I remove that option I can see from the logs that I get authenticated as "nobody" without having to enter a password.

I read somewhere that with the option "guest ok = yes" ALL users will be authenticated as guests... :-/
Default is to try login with your login user at your workstation.
So, if you are logged with user1, windows will try to auth you as user1.
If samba has a user1 will ask for a passwd.
If not you will be logged as nobody.

You might do two different shares with the same path. One with read only = yes and guest ok = yes and other authenticated for your login user.

Regards
Sebastian
 
Old 06-20-2011, 12:06 PM   #5
scott8035
LQ Newbie
 
Registered: Nov 2010
Posts: 14

Rep: Reputation: 4
To show what users you created, do "pdbedit -L".
 
Old 06-20-2011, 06:17 PM   #6
jschiwal
Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 654Reputation: 654Reputation: 654Reputation: 654Reputation: 654Reputation: 654
I would suggest setting up a private share for `andrea' and try logging in. Make sure that authentication works for user `andrea'. If it doesn't, look in the logs for info on what the problem is.

Did you try adding `andrea' to the read list of your public share? Add it before the @users group.

List the permissions of the /data/Music directory: ls -ld /data/Music
Is Andrea the owner? If not change the ownership of the directory or use setfacl to give andrea write permissions
Code:
setfacl -m g:u:andrea:rwx /data/Music
setfacl -m  u:andrea:rwx /data/Music
I'll guess that the owner is "andrea" and the group "users" with rwx-rxr-x permissions set.

As you probably are aware, the 'guest' user in windows is equivalent to the 'nobody' user in Linux. The 'o' permission bit for r & x needs to be set on the directory to allow nobody to read it.

Last edited by jschiwal; 06-20-2011 at 06:29 PM.
 
Old 06-21-2011, 05:42 PM   #7
^andrea^
Member
 
Registered: Mar 2011
Distribution: Xubuntu 12.04
Posts: 40

Original Poster
Rep: Reputation: 0
Firstly thanks to all of you for the help.

Let's go in order.

- tristezo2k
At the moment there are no Windows machines at all (I managed to get rid of most of them :-D).
I can login with my user (andrea) at the workstation as well as with samba (for instance when I access my home directory trough samba I'm asked for my password).
When I access (trough Nautilus/Ubuntu) the samba share "Music" with "guest ok = yes" though I'm not asked for any password at all (samba log sais I've been logged in as user "nobody").

I thought about making two different shares but that would be a pretty ugly solution since I should do it for 7/8 shared directories and I would end up with: Music, Music_writable, Something, Something_writable and so on... and on...

- scott8035
Thanks for that. I can then confirm that I've run smbpasswd before.
The output of that command is:
sudo pdbedit -L
nobody:65534:nobody
andrea:1001:Andrea Surname
other:1000:Other Surname

etc...

- jschiwal
I confirm you that the authentication for the user "andrea" works.
As stated above I can access my home directory after having authenticated as "andrea".

Just to make sure folder permissions is not the issue I've set it temporarily to 777... nothing changed. :-/

Thanks again guys and any other suggestion is welcome.

Cheers,
Andrea
 
  


Reply

Tags
samba permissions, samba users


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
setting samba read/write permissions for seperate users phildacey Linux - Networking 3 11-07-2006 04:09 AM
Why can I not write to a SAMBA share when read/write is enabled? eric m Linux - General 4 08-21-2006 09:22 PM
samba, some users read, others write? softmoo Linux - Networking 1 07-06-2005 11:13 AM
share read and write permission to users suguname Mandriva 3 01-18-2005 12:53 AM
A share that users can see, read and write to....without password fatboyal Linux - Newbie 11 01-16-2004 08:56 PM


All times are GMT -5. The time now is 08:35 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration