Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Samba file server running, and I was wondering how I could make multiple user accounts that have different permissions. For example, at the moment I have a user, smbusr, but when I ssh to the share, I can read, write, execute, and even navigate out of the samba directory and do stuff on the actual computer. This is bad because I want to be able to give out my IP so friends/family can use the server, but I don't want them to be able to do just anything.

I want to lock the user in the samba share directory(and all the sub directories). Eventually I would like several profiles such as (smbusr_R, smbusr_RW, smbguest_R, smbguest_RW).

I also have a second question related to this, is SSH the best method to connect from other unix machines? What about VPN? Or simply mounting like this:

mount -t ext3 -o user=username //ipaddr/share /mnt/mountpoint

Is that mounting command above the same thing as a vpn? This is really confusing me.

Thanks for the help guys, let me know if you need to see any files, or need anymore information.

EDIT: Here is my samba share definition:

path = /samba
browseable = yes
guest ok = no
read list = smbusr_RO
write list = smbusr

EDIT2: Here is my entire smb.conf file:

share|improve this question
up vote 0 down vote accepted

Yes, Samba can support ACLs nowadays. it takes a few lines in the globals section, and a list of allowed and denied ACLs per share. some adjustment may be needed to your underlying filesystem permissions to support them though, since ext filesystems don't do ACLs by default.

heres a tutorial:

and a general reference for the SMB.conf file:

Edit: try changing your share configuration like this. note that OS groups require an '@' in front, and that write list does not imply read priv, so put both groups in the read list.

add these to globals:

invalid users = root
valid users = @smbusers, @smbusers_RO
create mask = 02775
directory mask = 02770

comment = Debian File Server With Read Write
invalid users=nobody,nobody
valid users=@smbusr,@smbusr_RO
path = /samba
browseable = yes
guest ok = no
read list = @smbusr,@smbusr_RO
write list = @smbusr

also run 'sudo testparm -s' to check your config file integrity.

in terms of filesystem permissions, you can chown -R your files to be owned by 'root:smbusers', so that your group permission controls who can write, and your other permission can control who can read (smb will make sure that read permissions are only granted to 'smbusers_RO'). then I recommend using SetGID so that all new folders created in the share are owned by :smbusers and all your smbusers will have access to them.

chown -R root:smbusers /samba 
chmod -R 2775 /samba
share|improve this answer
I changed it so now there are only two accounts, smbusr and smbusr_RO. I put my share definition in the main post, does that look alright? I'm having permissions confusion now. What should I put for my create mask and directory mask if I want nobody besides root to be able to change permissions? Who should I make the owner of my samba share, and what group should I make it? Thanks – Scriptonaut Nov 12 '12 at 6:55
add smbuser to readlist as well. do your filesystem permissions give both groups the appropriate permissions as well? – Frank Thomas Nov 12 '12 at 8:22
I added my smb.conf file to the main post, could you look at it to see if there's anything preventing access? I'm not quite sure what you mean by my filesystem permissions. I can't seem to even log in as root. Are there things I can try to do in case it is the filesystem permissions? – Scriptonaut Nov 12 '12 at 8:46
see edits above – Frank Thomas Nov 12 '12 at 21:55
What does the preceding 2 in the permissions mean? I'll try to implement this, thanks a lot :) Also, why do I put the smbusr and smbusr_RO groups rather than the users themselves? – Scriptonaut Nov 12 '12 at 23:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.