0

I am setting up a new Samba3 domain on Debian Wheezy. I installed the packages, and tweaked the smb.conf file to my liking. I cannot access the shares though, except those I'm supposed to based on my own group membership. This may seem normal, but I am also listed as the admin users in the [global] section. At all my other Samba3 sites, I can use that username to get access to every share available. What am I missing?

I pasted most of my smb.conf file, but I'm trying to really access the supo folder.

Output of /etc/samba/smb.conf:

[global]
        workgroup = workgroup
        server string = %h server
        map to guest = Bad User
        obey pam restrictions = Yes
        pam password change = Yes
        passwd program = /usr/bin/passwd %u
        passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
        unix password sync = Yes
        syslog = 0
        log file = /var/log/samba/log.%m
        max log size = 1000
        name resolve order = wins lmhosts host bcast
        add user script = /usr/sbin/adduser --quiet --disabled-password --gecos"" %u
        add group script = /usr/sbin/addgroup --force-badname %g
        add machine script = /usr/sbin/useradd -g machines -c "%u machine account" -d /var/lib/samba -s /bin/false %u
        logon drive = H:
        domain logons = Yes
        dns proxy = No
        wins support = Yes
        panic action = /usr/share/samba/panic-action %d
        idmap config * : backend = tdb
        valid users = @staff
        admin users = luke, @another_group

[homes]
        comment = Home Directories
        valid users = %S
        read only = No
        create mask = 0700
        directory mask = 0700
        browseable = No
# works - I am a user

[trgo]
        path = /home/trgo
        valid users = @trgo
        read only = No
        inherit permissions = Yes
# works - I'm in the trgo group

[supo]
        path = /home/supo
        valid users = @supo
        read only = No
        inherit permissions = Yes
# doesn't work - I'm not in the supo group

[public]
        path = /home/public
        read only = No
        inherit permissions = Yes
# works - I'm in the staff group
0

1 Answer 1

0

You can set several groups/users in the valid users (also invalid users) parameters like this:

[supo]
        path = /home/supo
        valid users = @supo, @trgo
        read only = No
        inherit permissions = Yes
# works - you are joined to at least one of the group

You can also, in case you don't trust someone of that group use invalid users:

[supo]
        path = /home/supo
        invalid users = canadian 
        valid users = @supo, @trgo
        read only = No
        inherit permissions = Yes
# doesn't work - you are not authorised, even if you are member of the trgo group ;)

The manual doesn't specify the order it applies the rules, but the invalid users part implies it takes precedence:

This is a list of users that should not be allowed to login to this
service. This is really a paranoid check to absolutely ensure an
improper setting does not breach your security.
3
  • My issue is that at every other site, I have the common admin users in the [global] section, and I don't have to declare them in each and every share Apr 9, 2014 at 3:12
  • @CanadianLuke is samba 3 right? If I read the manual correctly admins users doesn't allow groups, but individual users: "This option specifies a list of users that perform file operations as if they were root." this compared with valid users: "These two options let you enumerate the users and groups who are granted or denied access to a particular share.". Try removing the @ statement. Also, check if it's samba 3 and not 4, since 4 doesn't have that option.
    – Braiam
    Apr 9, 2014 at 3:33
  • Samba-tool isn't installed, so it's definitely samba3. I'll get the version number tomorrow, as I'm home now Apr 9, 2014 at 3:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .