3

TY in advance for all help I'll get on this issue.

I got this unpleasant task to set up an Ubuntu server with samba for file server.

To make it more complicated I have to do it as follows:

4 different user group , about 15 users on the network.

The four group supposed to have different level of access to shared folders.

FE: groups are "high" , "mid" , "low" & "guest". Each group should have its own folder named after group, and access to its own folder and folders belonging to LOWER level groups. Group "high" should have R/W access to all folders, "mid" has no access to "hihg" folder but R/W to mid folder and low folder.Low group inherits this in same manner.Can R/W low folder , but no access to mid,nor high folders.

What I have is a fresh install of UBUNTU 12.04.1LTS and some basic knowledge of Linux.


Any guidance is highly appreciated.

5
  • why must you use Ubuntu - do you need to serve NFS as well? Second question, why did someone with only a basic knowledge of linux get handed a task that is usually handed to someone with SysAdmin level skills? Do you need authentication or directory lookup services as well (ie ldap/kerberos/AD) or will this all be with local permissions?
    – MaQleod
    Feb 1, 2013 at 19:56
  • Yes, I'll need NFS .The "basic knowledge" means I am not quit up to the task- and need help with it :) . Why I got this task? Because I might be the only one capable to make it done - the rest of available people has less knowledge than me ... (facepalm) . The network is LAN and has internet access but the server will be used locally only and user should be able to map their drives.
    – Cups
    Feb 1, 2013 at 20:05
  • Can we assume no Active Directory and you will manually set-up the users on the server?
    – nerdwaller
    Feb 1, 2013 at 20:08
  • Yes , I will add each user manually.
    – Cups
    Feb 1, 2013 at 20:18
  • And thx for taking time to assist me with this.I do appreciate it
    – Cups
    Feb 1, 2013 at 20:19

1 Answer 1

1

I am going to start off assuming that you have:

  1. Installed Samba
  2. Have the file structure already in place (your group folders, mounts, etc.)
  3. Are mostly working on the configuration part now.
  4. Since there are 15 users - I am assuming that you do not have an active directory domain and it will be managed manually on the server.

Note: I am not a sys admin and cannot really tell you that this is the safest way to accomplish your task, however, it should work and be pretty straight forward. It sounds as though it isn't a huge deal there, but in the future you may want to re-structure it if the organization scales or you use AD or some domain service. Since you mention it not being connected to the web, I won't really go into that stuff.

Now, you need to work in the /etc/samba/smb.conf file (which will require root permissions).

The basic structure of the smb.conf file is:

[sharename]
    comment = Whatever comment you want
    path = /path/to/share
    browseable = no   ; I assume...
    read only = no
    writeable = yes   ; Redundant of read only, but whatever
    create mask = 0700
    directory mask = 0700
    valid users = @groupname

So for your situation, it would probably look like:

[high]
    comment = The High User group
    path = /srv/high
    browseable = no
    read only = no
    writable = yes
    create mask = 0700
    directory mask = 0700
    valid users = @high
[mid]
    comment = The Mid User Group
    path = /srv/mid
    ... (copy from above)
    valid users = @high @mid
[low]
    comment = The Low User group
    path = /srv/low
    ...
    valid users = @high @mid @low
[guest]
    comment = The Guest User Group
    path = /srv/guest
    .... ; No valid users needed...

[Be sure you have the path's right, I would mount them like that - but not sure your structure]

You'll need to add the groups to your machine:

addgroup {high,mid,low,guest}

Then you need users all established on your server (unless you want to go the smbusers route, which may be more applicable if you intend to scale ever):

useradd -m -g users -G high -s /bin/nologin USERNAME

That adds a user named "USERNAME" to the group "users" and supplemental group "high". Then to set the password passwd USERNAME. Also sets their shell to nologin so they can't log in locally on the server and execute commands.

Then add that user to SAMBA:

smbpasswd -a USERNAME

Restart Samba to try it out:

Systemd:

service smb restart

Init:

/etc/init.d/smb reload

Under the [global] section, I would recommend that you enable unix password sync = yes (I believe that is default already). That way whatever their unix password is, the password is for the share.

To mount from windows, you'd do: \\SERVERNAMEorIP\high from "map network drive" in My Computer.

7
  • I will try and get back to inform about results asap.TYVM for the help.
    – Cups
    Feb 1, 2013 at 20:23
  • @Cups - You got it, hopefully I remember all the steps from setting up my home server. When you get to NFS stuff, the guide on the Arch Wiki is pretty good, but for debian based I think it's nfs-kernel-server and nfs-common (but double check). Not sure why you're using Ubuntu for a server, I'd do a Debian minimal install, but that's just me.
    – nerdwaller
    Feb 1, 2013 at 20:29
  • UR the man!!! So far (with ur help): Added shares for each group,added groups,added users,set passwords, each group can access their files (no write permissions tho-yet). Only thing I had to change is : smbd restart instead of smb restart & reload smbd instead of /etc/init.d/smb reload. I'd buy you a coffee right now!! TYVM. I owe U a big one
    – Cups
    Feb 1, 2013 at 22:27
  • @Cups glad you're getting there. Make sure that the folders your created for each group have the right permissions to allow users to write. ls -l will get you the folder permissions, owner and group. I would probably change the group to users. Then you could adjust the permissions to 660 with chmod 660 folderName. That should allow the owner and group members to read and write. Though on not fully sure how that interacts with Samba. I believe Samba would rule, but if not you could change groups to each respective group.
    – nerdwaller
    Feb 1, 2013 at 23:28
  • It is totally success ;). MaQleod had lack of faith in me, but after all , the job is well done without SysAdmin lvl of knowledge but with help. I believe all task can be done with only knowledge where to find the answer. And what I love the most : with linux I never had a problem to find ppl willing to help and share knowledge. Once more : Thanx a lot nerdvaller for fast and accurate answer and the willingness in assisting. PS: I'd really love to buy U a drink someday ;) UR my HERO bc U saved the day !
    – Cups
    Feb 2, 2013 at 13:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .