Veto Users Creating Folders in Samba Shares

barani_pd · 09-03-2018, 10:03 AM

Greetings!

I am using Samba 4 server on Fedora 24 for sometime now. Everything working fine. Recently it is observed that Windows users, who access samba shares, are creating sub-folders which is not desired. The users were instructed not to create folders, but they continue to do so.

I would like to know is there a way to veto or prevent the Windows users from creating sub-folders in any samba shares. They should only able to create permitted file types.

baldur_1 · 09-03-2018, 08:50 PM

it looks like you can use either Posix ACL or SELinux to do that for you. here is a reference to Posix...

Posix ACL

i would suggest that is a good way to go...

barani_pd · 09-04-2018, 04:34 AM

Hi Baldur,

Thanks for your reply.

My requirement is not to allow users to create any folders or directories while they can create any number of files without restrictions in the share until the disk permits.

ACLs may either allow or deny read, write or execute with in the folder. If I deny write permissions in the share for any user or group they can neither create folder nor file.

Hope my understanding is correct.

Honest Abe · 09-04-2018, 05:16 AM

Take a look at "create mask" and "directory mask" in samba's configuration. If you set the directory mask to something like 440 (instead of say, 750), then your windows user should be still able to create a folder (sub-directory) but can not navigate to it to place his/her files there. [I have not tried this !]

OF course, it means you have to have a mechanism to delete these empty directories later on (a script that works out of crontab maybe ? ).

barani_pd · 09-04-2018, 05:21 AM

Hi Abe,

Thanks for your suggestion.

That is what I am doing now but that isn't correct way, isn't it?

Honest Abe · 09-04-2018, 05:52 AM

As I said in #4, I have not tried this myself. The idea is theoretical and you have the liberty to try it out or not.

But if it works the way I *think* it would, you'll have a workaround in place till you find the answer out yourself (research, read references/guides/Man pages etc..) or someone more knowledgeable gives you a solution.