samba: permission for sharing public and private folder

zamri · 08-28-2006, 10:59 PM

Hi all,

I want to setup a folder like this :

1. a public folder for all
2. a folder with only certain groups can browse only

I've read that clamav can be setup to scan accessed files on the fly.

for 1., my setup is like this :

Code:

[public]
        comment = Public Stuff
        path = /home/samba/public
        write list = @staff
        guest ok = Yes
        vfs objects = /usr/lib/samba/vfs/audit.so

I can't access the folder with error "\\Router\public is not accessible. The network name cannot be found". What did i do wrong?

For 2., my setup is like this :

Code:

[sharing]
comment = people stuff
   path = /home/samba/sharing
   valid users = mary jacob
   public = no
   writable = yes
   printable = no
   create mask = 0765

This works ok but for certain users but how to do it for certain groups of users?

centauricw · 08-29-2006, 01:52 AM

For the [public], make sure that the Linux file permissions are set so the directory is world readable. In fact, I would set the directory permissions like this:

Code:

drwxrwxr-x  root staff  /home/samba/public

Then modify the [public] share so it looks like this:

Code:

[public]
    comment = Public Stuff
    path = /home/samba/public
    read only = Yes
    write list = @staff
    guest ok = Yes
    create mask = 0664
    directory mask = 0775
    vfs objects = /usr/lib/samba/vfs/audit.so

This will make the files readable to everyone and writable only by "staff". The "create mask" and "directory mask" ensure new and modified files and directories retain their correct permissions.

For the [sharing] share, create a new group for all users that will have access to this file share. It will not be their primary group. Set the permissions on the directory like this:

Code:

drwxrwx---  root mygroup  /home/samba/sharing

Then modify the [sharing] share so it looks like this:

Code:

[sharing]
    comment = people stuff
    path = /home/samba/sharing
    valid users = @mygroup
    public = no
    writable = yes
    printable = no
    create mask = 0660
    directory mask = 0770
    force group = mygroup

This share will now only be accessable to members of "mygroup". The "create mask" and "directory mask" ensure new and modified files and directories retain their correct permissions, and the "force group" causes all file read/writes to be the group "mygroup" regardless of what the user's primary group is, ensuring that all members can read/write/modify files.

Enjoy.

zamri · 08-29-2006, 04:58 AM

ok thanks. I try it first.

zamri · 09-06-2006, 07:15 AM

1. what is the difference between create mask and directory mask?
2. I can send messages to Win XP client but not to Linux client running samba. I got this error :

message start: ERRSRV - ERRmsgoff (Not receiving messages.)

How to fix this?

zamri · 09-07-2006, 08:09 AM

can someone give me some directions?

centauricw · 09-08-2006, 10:50 PM

Quote:

what is the difference between create mask and directory mask?

The create mask sets the permissions that files will be created with by an SMB client. Directory mask sets the permissions that directories will be created with.

zamri · 09-11-2006, 06:36 AM

tq centauricw. I got a question:

What if I want to allow my clients to change their own passwords? If that possible?

centauricw · 09-12-2006, 01:39 AM

This is handled by the password chat settings in the smb.conf file and detailed in the Samba HOWTO. I have never used this feature, however.

zamri · 09-12-2006, 10:12 PM

o really? which HOWTO? I've read one in TLDP but that one does not mention about the chat settings. Anyway thanks.

centauricw · 09-13-2006, 02:02 PM

The is a wealth of documentation on the Samba web site, including free PDF/HTLM copies of Samba-3 HOWTO and Samba-3 By Example from the Bruce Perens Open Source Series. I highly recommend Samba-3 By Example as a tutorial of how to do things with Samba.

zamri · 09-15-2006, 06:17 AM

ok. thanks.

zamri · 09-19-2006, 01:48 AM

I have setup chat script in [global] section as below :

Code:

unix password sync = yes
passwd program = /usr/bin/passwd %u
encrypt passwords = yes

smb passwd file = /etc/samba/private/smbpasswd
passwd chat = *new*password* %n\n *new*password* %n\n *changed*

How do I change my password in Windows XP/ME client? I can't find any option.
What do I need to set at the client end? or server end?

malor · 04-02-2007, 02:03 AM

I tried to sent message to FC5:
# smbclient -M smirnova
message start: ERRSRV - ERRmsgoff (Not receiving messages.)

When I tried to sent message to Win XP:
# smbclient -M Kur
Connection to Kur failed

What do I have to do ?

My machine has FC5.

balackcheng · 09-26-2007, 12:27 AM

Quote:

Originally Posted by centauricw

For the [public], make sure that the Linux file permissions are set so the directory is world readable. In fact, I would set the directory permissions like this:

Code:

drwxrwxr-x  root staff  /home/samba/public

Then modify the [public] share so it looks like this:

Code:

[public]
    comment = Public Stuff
    path = /home/samba/public
    read only = Yes
    write list = @staff
    guest ok = Yes
    create mask = 0664
    directory mask = 0775
    vfs objects = /usr/lib/samba/vfs/audit.so

This will make the files readable to everyone and writable only by "staff". The "create mask" and "directory mask" ensure new and modified files and directories retain their correct permissions.

For the [sharing] share, create a new group for all users that will have access to this file share. It will not be their primary group. Set the permissions on the directory like this:

Code:

drwxrwx---  root mygroup  /home/samba/sharing

Then modify the [sharing] share so it looks like this:

Code:

[sharing]
    comment = people stuff
    path = /home/samba/sharing
    valid users = @mygroup
    public = no
    writable = yes
    printable = no
    create mask = 0660
    directory mask = 0770
    force group = mygroup

This share will now only be accessable to members of "mygroup". The "create mask" and "directory mask" ensure new and modified files and directories retain their correct permissions, and the "force group" causes all file read/writes to be the group "mygroup" regardless of what the user's primary group is, ensuring that all members can read/write/modify files.

Enjoy.

Hi Centauricw,

If let's say a few of my users - user1, user2 ,and user3 request for the READ permissions for the above folder; What should i do?

npubudu · 02-02-2009, 12:44 AM

Quote:

Originally Posted by centauricw

For the [public], make sure that the Linux file permissions are set so the directory is world readable. In fact, I would set the directory permissions like this:

Code:

drwxrwxr-x  root staff  /home/samba/public

Then modify the [public] share so it looks like this:

Code:

[public]
    comment = Public Stuff
    path = /home/samba/public
    read only = Yes
    write list = @staff
    guest ok = Yes
    create mask = 0664
    directory mask = 0775
    vfs objects = /usr/lib/samba/vfs/audit.so

This will make the files readable to everyone and writable only by "staff". The "create mask" and "directory mask" ensure new and modified files and directories retain their correct permissions.

For the [sharing] share, create a new group for all users that will have access to this file share. It will not be their primary group. Set the permissions on the directory like this:

Code:

drwxrwx---  root mygroup  /home/samba/sharing

Then modify the [sharing] share so it looks like this:

Code:

[sharing]
    comment = people stuff
    path = /home/samba/sharing
    valid users = @mygroup
    public = no
    writable = yes
    printable = no
    create mask = 0660
    directory mask = 0770
    force group = mygroup

This share will now only be accessable to members of "mygroup". The "create mask" and "directory mask" ensure new and modified files and directories retain their correct permissions, and the "force group" causes all file read/writes to be the group "mygroup" regardless of what the user's primary group is, ensuring that all members can read/write/modify files.

Enjoy.

Hi,

I followed the [public] share creation in above and only the alternation I did is introduce the "create mask 0674" - as I want staff group to have all the access (specially reading) but the files are creating with 664 permissoin. ???

[public]
comment = Public Stuff
path = /home/samba/public
read only = Yes
write list = @staff
guest ok = Yes
create mask = 0674
directory mask = 0775

rwxrwxrw- 2 root staff 4,096 Feb 2 11:01 public

see in ls -al /home/samba/public
-rw-rw-r-- 1 pppp pppp 222,170 Dec 8 13:24 net-snmp-perlmods-5.4.2.1-1.f9

how to make it?