Smokes your problems, coughs fresh air.

Tag: samba (Page 2 of 2)

Permissions on a samba share

When you mount a samba share without unix extensions enabled, you can set a GID, UID and permissions (on the client machine, at mount time) so you can adjust it to let non-root users use it.

Mounting FAT works this way as well. But there is a big difference. Where new files on a FAT file system are created according to the permissions you set at mount-time, new files on a SAMBA share have their permissions determined by the umask. However, when you unmount and remount the share, the permissions are changed to what they were set to at mount time.

This is very annoying behavior, because when you have files that belong to root:smbusers and you copy a file, it still belongs to root:smbusers, but when your umask is 0022, it will no longer be group writable and it has become a read only file.

I think this is a bug in the SMBFS/CIFS file system driver.

Samba rounds filesizes off to whole MB’s

I noticed when I did ‘du -hs’ on a sambamount, I got a disk usage that was unrealistically high. I did some research, and it appears that Samba rounds off file sizes to whole MB units, to optimize for windows clients:

And btw, why is samba rounding the minimum size up to 1MB ?

An optimisation for Windows clients. If we do this they allocate actually run faster against a Samba server (based on tests done by a NAS vendor).

smbmnt user needs to own the mountpoint if you want to mount rw

I just found out that it’s impossible on my system to mount /mnt/smb-docs as user bigsmoke, even with the following fstab:

//server/shared\040documents       /mnt/smb-docs smbfs   noauto,user,uid=bigsmoke,username=secret,password=alsosecret  0 0

I tried to chmod 775 /mnt/smb-docs; chgrp bigsmoke /mnt/smb-docs, but no luck. I had to actually chown bigsmoke /mnt/smb-docs. Does someone understand why? I noticed that I’m not the only one who noticed this.

Setting up a domaincontroller with Samba

I occasionally have to set up a domain controller using Samba. There are a lot of guides and howto’s available, but I made a step-by-step howto just for myself, and I thought it’d be smart to make it available on the internet for me to access anywhere.

These commands have only been tested on Debian. Some distro’s may do thing a little differently, especially when it comes to adding/modifying users and groups.

  • Create a Unix group for ntadmins:
    # groupadd ntadmins
  • And assign root to that group:
    # usermod –append –groups ntadmins root
  • Add the root user to the smb users (use a different password than the Unix root password!):
    # smbpasswd -a root
  • Map Samba groups (the rid is important!):
    # net groupmap add ntgroup=”Domain Admins” unixgroup=ntadmins rid=512 type=d
    # net groupmap add ntgroup=”Domain Users” unixgroup=users rid=513 type=d
    # net groupmap add ntgroup=”Domain Guests” unixgroup=nobody rid=514 type=d
  • Add normal user accounts which can login in the domain controller (without home dirs or shells):
    # useradd -d /dev/null -s /bin/false example_username
    # smbpasswd -a example_username

When adding a machine to the domain, it will ask for a username and password. Use the root username you’ve added to smbusers here. The normal user accounts are for when the machine is successfully added to the domain, and asks for user login.

The following is an example config file, with some comments:

[global]
  ; When using domains, the workgroup is the domain name
  workgroup = my_domain
  server string = my_server (Samba server %v)
  security = USER
  encrypt passwords = true
  os level = 65
  domain master = yes
  local master = yes
  preferred master = yes
  domain logons = yes
  panic action = /usr/share/samba/panic-action %d
  guest account = samba
  log file = /var/log/samba/log.%m
  max log size = 1000
  syslog = 0
  dns proxy = no

  ; Location of NT/2000/XP profiles. %L expands to the servername, %u to the user.
  ; You may also want to put in %m, which expands to the machine name, to have a 
  ; separate account for each machine. With only identical machines, it's useful to have
  ; a "roaming" profile, but you can imagine what happens when you login on a Windows 
  ; 2000 machine with an account that actually belongs to a Windows XP machine...
  ; or, even simply on machines with different versions of software packages installed.
  ; update: I think it should actually be %U. And, you may want the machine name in the path:
  logon path = \\%L\profiles\%m\%U
  ; logon path = \\%L\profiles\%u ; old one, before update.
  logon script = logon.bat

  time server = yes

  ; I don't let useradd create home dirs. I prefer to do that myself. 
  add user script = /usr/sbin/useradd -d /dev/null -s /bin/false %u
  ; I intentionally leave out -r (remove home dir) because I don't accidentally
  ; want to remove home dirs when I happen to remove domain users 
  ; which are also unix users. Also, it means that if a user is recreated, 
  ; its data is accessible again.
  delete user script = /usr/sbin/userdel %u
  add group script = /usr/sbin/groupadd %g
  delete group script = /usr/sbin/groupdel %g
  add user to group script = /usr/sbin/usermod -a -G %g %u
  ; how does one delete a user from a group...? There doesn't seem 
  ; to be a command for that...
  ;delete user from group script = /usr/sbin/ %u %g
  add machine script = /usr/sbin/useradd -s /bin/false -d /dev/null %u

[netlogon]
  ; You can add netlogon.bat here, the logon script executed by the client.
  path = /var/lib/samba/netlogon
  writable = no
  browsable = no

[profiles]
  ; This path should be chmod 777
  path = /home/samba-nt-profiles/
  browsable = no
  writable = yes
  ; You can choose to make these 0660 and 0770. If you force group = samba and put all your samba users in it, that can be convenient. It is a must when you have the machine name in the profile path, otherwise, only the first user can login on a machine.
  create mask = 0600
  directory mask = 0700

The useradd commands are for when a domain admin asks for users to be created and such. The only one I’ve needed in practice, it would seem, is the add machine script. When I add a machine called “butter” to the domain controller, this command will automatically create a user called “$butter” in your /etc/passwd, and the machine can login.

An example command to put in the netlogon.bat, is:

net use o: "\\server\networkshare"

The reason is obvious, I would say :).

An example network share accessible to anyone is:

[our_documents]
  comment = Central storage for all our documents
  path = /home/samba-our-documents
  guest ok = yes
  writeable = yes
  browseable = yes
  force group = samba
  create mask = 0660
  directory mask = 0770

And, a network share for an individual domain user with full access for that user, but read-only to the rest:

[Johns_documents]
  path = /home/samba-john-documenten
  guest ok = yes
  writeable = yes
  browseable = yes
  force group = samba
  create mask = 0640
  directory mask = 0750

I believe this is it. I will update the post with relevant info in the future.

Newer posts »

© 2024 BigSmoke

Theme by Anders NorenUp ↑