[SOLVED] Question: Permissions: Creating samba share, accessing it

haertig · 03-13-2013, 02:37 PM

I am having permissions troubles writing to a locally mounted Samba share. I am not sure if I need to do something special with the mount options on the hosting end, the client end, or both.

Here is what I do on the server that is hosting the Samba share (IP=192.168.0.9). This is a boot script executed from a hard disk copy of SysRescueCD, therefore on every boot I must recreate the userid, the mountpoint, the smb.conf file, etc. Commented lines in the script show what things look like after the previous commands are executed. I will probably switch to USER level security in Samba later, but for initial testing I am using SHARE security, for simplicity.

Code:

#!/bin/bash

useradd -m samba
passwd  -l samba
#grep samba /etc/passwd
#samba:x:1000:1000::/home/samba:/bin/bash

mkdir   -p /mnt/fileserver1
mount   -t ext3 /dev/vg_fileserver1/lv_fileserver1 /mnt/fileserver1
#ls -al /mnt/fileserver1
#total 28
#drwxr-xr-x  3 root  root   4096 Mar 13 18:44 .
#drwxr-xr-x 11 root  root    220 Mar 13 19:08 ..
#-rw-r--r--  1 samba samba     8 Mar 13 18:44 goodbye
#-rw-r--r--  1 root  root      6 Mar 13 18:03 hello
#drwx------  2 root  root  16384 Mar 12 18:27 lost+found

cat >/etc/samba/smb.conf <<END_OF_SMB_CONF
[global]
workgroup = HOME
server string = SysRescueCD
security = share
log file = /var/log/samba/log.%m
max log size = 50
[public]
path = /mnt/fileserver1
guest ok = yes
guest only = yes
guest account = samba
writable = yes
browseable = yes
END_OF_SMB_CONF

/etc/init.d/samba reload

Here is what I do on the client server that is accessing the remote share. You can see at the bottom of the window the permissions problems being displayed.

Code:

DesktopLinuxMint13 ~ # smbclient -L 192.168.0.9 -N
Domain=[HOME] OS=[Unix] Server=[Samba 3.6.12]

	Sharename       Type      Comment
	---------       ----      -------
	IPC$            IPC       IPC Service (SysRescueCD)
	public          Disk      
Domain=[HOME] OS=[Unix] Server=[Samba 3.6.12]

	Server               Comment
	---------            -------
	SYSRESCCD            SysRescueCD

	Workgroup            Master
	---------            -------
	GLOBAL               LU112338
	HOME                 SYSRESCCD
	WORKGROUP            DESKTOPLINUXMIN
DesktopLinuxMint13 ~ # cat /etc/fstab
# /etc/fstab: static file system information.
#
# Use 'blkid' to print the universally unique identifier for a
# device; this may be used with UUID= as a more robust way to name devices
# that works even if disks are added and removed. See fstab(5).
#
# <file system> <mount point>   <type>  <options>       <dump>  <pass>
proc            /proc           proc    nodev,noexec,nosuid 0       0
# / was on /dev/sda4 during installation
UUID=824d6b9c-d33f-4d77-8103-c3e228ca5b01 /               ext4    errors=remount-ro 0       1
# swap was on /dev/sda3 during installation
UUID=9235cb1a-94da-49a6-b57e-787b2a6bec31 none            swap    sw              0       0
//192.168.0.9/public                      /public         smbfs   errors=remount-ro,password= 0       1
DesktopLinuxMint13 ~ # mount /public
DesktopLinuxMint13 ~ # ls -al /public
total 12
drwxr-xr-x  3 root  root     0 Mar 13 12:44 .
drwxr-xr-x 25 root  root  4096 Mar 13 12:48 ..
-rw-r--r--  1 david david    8 Mar 13 12:44 goodbye
-rw-r--r--  1 root  root     6 Mar 13 12:03 hello
drwx------  2 root  root     0 Mar 12 12:27 lost+found
DesktopLinuxMint13 ~ # grep david /etc/passwd
david:x:1000:1000:initial_user_on_system,,,:/home/david:/bin/bash
DesktopLinuxMint13 ~ # id
uid=0(root) gid=0(root) groups=0(root)
DesktopLinuxMint13 ~ # echo "new data" >> /public/goodbye
-su: /public/goodbye: Permission denied
DesktopLinuxMint13 ~ # exit
logout
david@DesktopLinuxMint13 ~ $ id
uid=1000(david) gid=1000(david) groups=1000(david),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),127(sambashare)
david@DesktopLinuxMint13 ~ $ echo "more new data" >> /public/goodbye
bash: /public/goodbye: Permission denied
david@DesktopLinuxMint13 ~ $

haertig · 03-13-2013, 02:42 PM

Note on the hosting side, the "goodbye" file is owned by userid "samba". And on the client side, it shows as being owner by userid "david". I do not know if this is because of the "guest account = samba" in smb.conf on the hosting side, or because userid samba is user_number 1000 on the hosting side, whereas user_number 1000 maps to userid "david" on the client side.

haertig · 03-13-2013, 02:48 PM

My ultimate goal is for any client to have read/write permissions on every file and every directory on the mounted share. I guess a massive "chmod -r 777" on the hosting server side might accomplish that, but that seems rather brute force. My initial thought was to make files/directories on the host side (/mnt/filesystem1) all owned by userid samba with permissions 755/644. And I was planning on that "guest account = samba" to force all newly created files by clients to be owned by userid "samba". Maybe this is not the correct way to approach the problem, so I'm open to suggestions.

haertig · 03-13-2013, 04:49 PM

Further testing shows that "guest account = samba" in the smb.conf file is not working as documented. Clients are using permissions of userid "nobody", not "samba". Creating a file, mode 644, owned by "nobody", allows clients to write to the file.