[SOLVED] Samba4

mfoley · 06-09-2015, 11:37 PM

I've ugraded to Slackware-64 14.1 and samba 4.1.0. I had to make some changes to the smb.conf file to get mountsto work without userID or password. Now, users can create files on the share, but can't modify existing files having a different user, but same group (files are group rw). For example, on Linux:

Code:

> ls -l EventsCalendar.jsp OpenWith.reg
-rw-rw---- 1 mfoley ohprs 4638 2015-05-28 14:24 EventsCalendar.jsp
-rw-rw---- 1 ohprso ohprs  144 2015-06-08 10:48 OpenWith.reg

From Windows I dragged the (arbitrarily chosen) OpenWith.reg file to the mapped drive, no problem. But I cannot modify the EventsCalendar.jsp, even though it is group writable. If I change the owner to ohprso, I can then edit EventsCalendar.jsp from Windows.

Need to figure out how to get Samba to pay attention to the group permissions.

Smb.conf:

[global]
netbios name = WEBSERVER
workgroup = WORKGROUP

security = user
map to guest = Bad User
hosts allow = 192.168.0. 127.
guest account = guest
passdb backend = tdbsam

[website]
comment = OHPRS Website download files
path = /srv/tomcat/webapps/ohprs
public = yes
guest ok = yes
guest only = yes
writeable = yes
browseable= yes
printable = no
create mask = 0660
directory mask = 0771

User guest is mapped to user ohprso.

/etc/passwd:

ohprso:x:1001:301:OHPRS Web User:/srv/tomcat/webapps/ohprs/downloads:/bin/bash
guest:x:1001:301:Samba guest account:/dev/null:/bin/false

Any ideas?

joec@home · 06-10-2015, 02:12 PM

Just off the top of my head, some distros come with the guest user and group accounts preloaded to be locked down in some way. Have you tried creating a new user and group?

mfoley · 06-11-2015, 11:32 AM

Yes, these are newly created users, and group. 'guest' did not come pre-loaded.

joec@home · 06-11-2015, 01:36 PM

I'm still not sure but since no one else is stepping up yet I got a couple ideas.

1) Change the user guest to some other name. Just simply to avoid any possible parsing errors since the term guest itself is being used elsewhere in the configuration and might cause an internal conflict.

2) Double check the permissions on the parent directory the files are in to ensure at the directory level the group has write access.

4) Run a "tail -f" on the Samba and Security log files while trying to open the file, see if it gives more details.

4) The only thing I do not see posted in your configuration is the 301 ohprso in the /etc/group file.

Yeah, #4 I am grasping at straws, outside of the name guest itself causing a conflict everything looks good. Since everything looks good then start looking somewhere else.

mfoley · 06-12-2015, 12:18 AM

joec: Thanks for stepping up!

Quote:

2) Double check the permissions on the parent directory the files are in to ensure at the directory level the group has write access.

Yup, the parent directory (ohprs) does have g+rws. The parent's parent (webapps) does not, but this is the way it was before when it worked (albeit with an earler version of samba). In fact, the whole ohprs/ directory was restored from backup after ugrading the system so permissions should be as they were then:

> ls -ld webapps webapps/ohprs
drwxr-xr-x 9 root root 4096 2015-06-07 04:06 webapps/
drwxrwsr-x 12 ohprso ohprs 4096 2015-06-10 00:27 webapps/ohprs/

Quote:

4) The only thing I do not see posted in your configuration is the 301 ohprso in the /etc/group file.

group:
ohprs:x:301:mfoley,tomcat

passwd:
ohprso:x:1001:301:OHPRS Web FTP User:/srv/tomcat/webapps/ohprs/downloads:/bin/bash
guest:x:1001:301:Samba guest account:/dev/null:/bin/false

ohprso doesn't need be in group because its group *is* ohprs.

My guest user entry is different than before because I followed some Samba instructions on permitting mapping shares w/o password. Here is the old passwd entry:

guest:x:1001:301:Samba guest account:/srv/tomcat/webapps/ohprs/downloads:/bin/bash

Maybe I should try changing that back? Though I don't see that making a difference.

Quote:

1) Change the user guest to some other name.

So, would I change "guest account = guest" to "guest account = ohprso"? I give that a shot and see.

mfoley · 06-12-2015, 12:35 AM

Stop the presses!!!! Breakthrough! I upgraded Samba from 4.1.0 to 4.1.17 and now it works!!! I'll verify with the users tomorrow, but I think that must have been it! I'll post back more results.

tombelcher7 · 06-12-2015, 06:38 AM

The latest version on samba.org appears to be 4.2.2. There may be a reason you have selected 4.1.17, I thought I would just highlight this.

mfoley · 06-12-2015, 09:03 AM

Users have confirmed they can now update files on the share. As joec said, "everything looks good" with the configuration so I was pulling my hair out over this one. Turns out to be a bug with the Samba distro.

tombelcher7: the Slackware-64 14.1 DVD ships with Samba 4.1.0 (January 2013), which is what I was using. When I restored the production files from before the upgrade I certainly clobbered some important slackpkg files, so updating the system didn't work. I did the update on Samba manually last evening which fixed this problem. Samba 4.1.17 is the latest version in the Slackware repository and appears to be from around February, 2015. Slackware is always a few "official" releases behind either because they want to test and verify everything first or because Pat Volkerding is overworked and underpaid for the task. 4.1.17 is only 4 updates behind.