Running samba as a user other than root

Questor21 · 04-08-2006, 01:26 PM

Its me again ,

I'm using su -c to launch smbd and nmbd as a user other than root in an rc.samba script. But despite the commands running apparently fine, no log entries are generated and the processes are not running

Questor21 · 04-08-2006, 07:53 PM

Still having this trouble... Completely baffled..

drkstr · 04-09-2006, 01:36 AM

System services are ment to be run as root. Can I ask what you are trying to do with samba and why you want to run it as a non-root user? Be specific in your questions, you will get a better responce.

regards,
...drkstr

Questor21 · 04-09-2006, 01:56 AM

I'm using samba for a basic linux client -> windows client drive mounting. I want it run as a non root user because should someone exploit the service and gain the ability to run code with the service owner's permissions then I want to minimize the damage.

drkstr · 04-09-2006, 02:33 AM

Last I checked, what you are trying to do is not possible. Samba needs root privileges for certain file operations to allow access for "non privileged" windows users. I would instead try to focus on good access policies with hosts.allow and hosts.deny, iptable filtering and implementing encrypted samba passwords. If you find out otherwise, please let me know, I would be interested learning how to do it.

regards,
...drkstr

baskar_k · 04-09-2006, 05:06 AM

Hi,
Why not add the windows share in /etc/fstab or else chmod 'smbmnt' so that non-root users can mount the windows share using userid and password.

drkstr · 04-09-2006, 01:03 PM

Yea that's no problem, non root users can mount samba drives if they are given permission to do so. I thought you were doing it the other way around. The smbd service is to allow other computers access to the samba share on your linux box, which has to be run as root. If just want to mount a samba share from a windows computer, you just need to add this to your fstab:

Code:

//computername/share   /mnt/share   smbfs   gid=users,rw,username=Win32UserName,passwd=Win32Password  0 0

the /mnt/share directory must be owned by the users group.

For added security, you can store the username/password in a seperate file /etc/smb-credentials. The format to this file is as follows:

Code:

username = _*username*_
password = _*password*_
domain = _*domain*_

Make sure you cmod 640 /etc/smb-credentials so only root can read this file. The domain line is not needed if it is in your smb.conf file.

you would then mount the drive like this:

Code:

//computername/share     /mnt/share      smbfs   gid=users,rw,credentials=/etc/smb-credentials  0  0

If you don't want it to mount on boot, add in noauto in the options and you can mount the share by typing mount /mnt/share.

Hope this helps!
...drkstr