Correct user rights for Samba share

Question

I have a server which I want to use to share files on a local network. Each user should have a own directory for himself as well as several shared directories:

FolderUser1 ... FolderUserN and SharedFolder1 ... SharedFolderN

Current folder permission:

drwxr-xr-x  2 admin admin  4096 2012-01-10 13:58 FolderUser1
drwxr-xr-x  2 admin admin  4096 2012-01-10 14:01 SharedFolder1

smb.conf:

[FolderUser1]
comment= FolderUser1 network dirctory
path = /home/admin/FolderUser1
valid users = User1
browsable= yes
public = no
writable = yes

Now I would like to now which file permissions have to be set in on the server for the actual folders and which permissions have to be set in smb.conf configuration file, so that there are no permission conflicts. At the moment the clients can't write to there personal folders and get an error: Permission denied

Answer 1

Your smb.conf looks fine, though the shared folders should be specified as public. I think you need to change the folder ownership on the server though. For example:

drwxr-xr-x  2 admin admin  4096 2012-01-10 13:58 FolderUser1

Should be:

drwxr-xr-x  2 User1 User1(check)  4096 2012-01-10 13:58 FolderUser1

Check the user's default group and use that, it may be different to the username, depending on your setup. Assuming the folders are owned by the correct users then your current permissions (755) should be fine.

Samba should prevent other user's from accessing the private folders despite them having read permissions on server as long as you specify this in smb.conf. Of course any user with regular access to the server will still be able to access these folders, so feel free to tighten up permissions for any folders you want to keep more private, I'm not sure on your exact user setup.

Check man chown for details on changing file/dir ownerships:

Read more at the Linux Man pages.

Answer 2

How is the authentication handled at the moment?

Samba will attempt to impersonate some user after authentication as opposed operating files as root. See the "security modes" defined in Samba's documentation.

If you're using LDAP or ADS, you'll need to look into idmap: Concept and idmap module manpages.