Samba, Configuration - Revision history

208.86.238.129: /* User accounts in BSD, Samba, and Windows */

2010-07-13T16:24:14Z

User accounts in BSD, Samba, and Windows

Jimbo: Reverted edits by 94.23.2.153 (Talk); changed back to last version by Jimbo

2009-09-17T13:44:23Z

Reverted edits by 94.23.2.153 (Talk); changed back to last version by Jimbo

94.23.2.153: /* Setting up your shares on the machine */

2009-09-15T10:25:43Z

Setting up your shares on the machine

Jimbo: Samba Configuration moved to Samba, Configuration: style consistency

2008-11-19T17:36:39Z

Samba Configuration moved to Samba, Configuration: style consistency

64.235.108.88: /* Configuring Samba to use your shares and interface with local Win.X machines */

2008-03-10T18:42:41Z

Configuring Samba to use your shares and interface with local Win.X machines

64.235.108.88: /* Configuring Samba to use your shares and interface with local Win.X machines */

2008-03-10T18:35:20Z

Configuring Samba to use your shares and interface with local Win.X machines

64.235.108.88: /* Configuring Samba to use your shares and interface with local Win.X machines */

2008-03-10T18:34:33Z

Configuring Samba to use your shares and interface with local Win.X machines

Show changes

145.94.18.141: /* Configuring Samba to use your shares and interface with local Win.X machines */

2007-09-13T10:55:48Z

Configuring Samba to use your shares and interface with local Win.X machines

59.95.66.24: /* Setting up your shares on the machine */

2007-07-22T09:47:20Z

Setting up your shares on the machine

Jimbo: Reverted edits by Map7 (Talk); changed back to last version by Dark Morford

2006-10-30T13:35:49Z

Reverted edits by Map7 (Talk); changed back to last version by Dark Morford

@@ Line 176: / Line 176: @@
 == User accounts in BSD, Samba, and Windows ==
-There are two parts to this step, adding matching matching user accounts to the Samba server and the various windows machines, and adding matching Samba passwords to the Samba server for each user. '''Usernames and passwords must match exactly between the client Windows machines and the Samba server.'''
+There are two parts to this step, adding matching user accounts to the Samba server and the various windows machines, and adding matching Samba passwords to the Samba server for each user. '''Usernames and passwords must match exactly between the client Windows machines and the Samba server.'''
 Let's say ''Bob'' logs onto his windows machine with the username "''bob''" and the password "''syeruncle''". He already has an existing windows account, obviously, so you don't need to set that up, but if he didn't, you would. Bob is going to be a member of the @public group, and Greg will be a member of @private.

@@ Line 1: / Line 1: @@
 This article will walk you through a quick setup of [[Samba]] - creating directories to be shared, telling Samba to share those directories, how to limit access to different shares, and finally, how to set up a windows machine to have unfettered access to appropriate shares based on the currently logged in user. This article assumes you have a fresh, unconfigured [[Samba Installation]] to work with.
-doors.txt;10;15
+== Setting up your shares on the machine ==
 == Configuring Samba to use your shares and interface with local Win.X machines ==

@@ Line 1: / Line 1: @@
 This article will walk you through a quick setup of [[Samba]] - creating directories to be shared, telling Samba to share those directories, how to limit access to different shares, and finally, how to set up a windows machine to have unfettered access to appropriate shares based on the currently logged in user. This article assumes you have a fresh, unconfigured [[Samba Installation]] to work with.
-== Setting up your shares on the machine ==
+doors.txt;10;15
-−
-First we need to decide what we're going to share, or at the very least, where the shares will actually reside. The simplest way to do this is to simply create a new directory in an easy to remember place, say, '''/usr'''. You can either share that new folder directly, or create several new directories within it, and limit access to each directory based on criteria I will make clear later in this article. For now, let's assume you have two sets of documents, public and private, and that you want to limit users' access to those documents based on who they are - they can either access both, or just public. So:
-−
- Oyabun# '''mkdir /usr/smbroot'''
- Oyabun# '''mkdir /usr/smbroot/public'''
- Oyabun# '''mkdir /usr/smbroot/private'''
-−
-The first command creates the '''/usr/smbroot/''' directory, which will hold all of your shares. The second command creates the public directory, which '''all''' users will be able to access, and the third command creates the private directory, which only '''select''' users will be able to access.
-−
-Now we need to set [[permissions]] on these directories. The [[permissions]] article goes into great detail about permissions, but a quick run through here will be fine. We'll use [[chown]] to change ownership of these two directories now. We'll assume you have or will set up two groups for your users, one group named '''public''', and another named '''private'''.
-−
- Oyabun# '''chown :public /usr/smbroot/public'''
- Oyabun# '''chown :private /usr/smbroot/private'''
-−
-The first command sets the owning group of /usr/smbroot/public to :public. The second command assigns ownership of /usr/smbroot/private to the group :private.
-−
-Now we need to set the actual [[permissions]] with [[chmod]].
-−
- Oyabun# '''chmod 770 /usr/smbroot/public'''
- Oyabun# '''chmod 770 /usr/smbroot/private'''
-−
-Same [[permissions]] for each directory, broken down thusly: The first '''7''' is the 'owner' flag, and 7 means read/write/execute. The owner can do all of those things. The second '''7''' is the group flag, meaning the owning :group can also r/w/x. The third character, '''0''', is in the 'rest of the world' position, meaning anyone who is NOT the owner, and NOT a member of the owning group. They can't read, they can't write, and they can't execute. Since we're not setting up anonymous access, we don't want users who aren't explicitly defined as having access to actually have any access, and this will accomplish that.
-−
-−
 == Configuring Samba to use your shares and interface with local Win.X machines ==

← Older revision		Revision as of 18:42, 10 March 2008
Line 25:		Line 25:
	Same [[permissions]] for each directory, broken down thusly: The first '''7''' is the 'owner' flag, and 7 means read/write/execute. The owner can do all of those things. The second '''7''' is the group flag, meaning the owning :group can also r/w/x. The third character, '''0''', is in the 'rest of the world' position, meaning anyone who is NOT the owner, and NOT a member of the owning group. They can't read, they can't write, and they can't execute. Since we're not setting up anonymous access, we don't want users who aren't explicitly defined as having access to actually have any access, and this will accomplish that.		Same [[permissions]] for each directory, broken down thusly: The first '''7''' is the 'owner' flag, and 7 means read/write/execute. The owner can do all of those things. The second '''7''' is the group flag, meaning the owning :group can also r/w/x. The third character, '''0''', is in the 'rest of the world' position, meaning anyone who is NOT the owner, and NOT a member of the owning group. They can't read, they can't write, and they can't execute. Since we're not setting up anonymous access, we don't want users who aren't explicitly defined as having access to actually have any access, and this will accomplish that.

−	~~== Configuring Samba to use your shares and interface with local Win.X machines ==~~

−	Ok, now we have the shares set up appropriately, we just need to define them for Samba. In '''/usr/local/etc/''', there is a file named "'''smb.conf.default'''". This is a seriously large and complex file with waaaay more options than the average user will ever need to get Samba up and running. I highly suggest you go through it, as it has several examples of methods used to share directories, and access restriction methods. For this article, we'll be writing an [[smb.conf]] from scratch.
−
−	~~'''[global]'''~~
−
−	~~The first section of your new [[smb.conf]] file should look like this:~~
−
−	~~[global]~~
−	~~workgroup = WORKGROUP~~
−	~~server string = NameOfServer~~
−	~~log file = /var/log/log.%m~~
−	~~max log size = 50~~
−	~~security = user~~
−	~~encrypt passwords = yes~~
−	~~socket options = TCP_NODELAY~~
−	~~preferred master = yes~~
−
−	~~'''[global]''' is a header in the file, telling Samba all entries after that, before the next [section] are to be globally applied.~~
−
−	~~'''workgroup = WORKGROUP''' - Specifies which Windows Workgroup to make the server a member of.~~
−
−	~~'''server string = NameOfServer''' - Names the server. This is the name you'll see in network neighborhood. For example, my smb.conf names my server 'Oyabun'. (cuz it's the boss!)~~
−
−	'''log file = /var/log/log%m''' - Tells Samba to create log files for each machine that connects in the var/log/ directory. For example, if a machine with the name of ''johndesktop'' connected, a log file named '''log.johndesktop''' would be created in /var/log, and appropriate entries for that machine would be made there.
−
−	~~'''max log size = 50''': limits the size of each log files to x kilobytes, in this case 50. This is so you don't find a gig of logs a year down the road.~~
−
−	~~'''security = user''': This is '''important''', and integral to simple networking between your new Samba server and your Windows machines.~~
−
−	~~'''encrypt passwords = yes''': This is also '''important''' - passwords must be encrypted for each machine to successfuly negotiate login credentials with your Samba server.~~
−
−	~~'''socket options = TCP_NODELAY''': This is not required, but the Samba documentation within smb.conf.default suggests this may yield better performance, so I include it.~~
−
−	'''preferred master = yes''': Windows machines "elect" master browsers, which is a machine which takes on the duties of describing to other machines what all the machine names and locations are. Since your Samba machine is likely to be the sanest machine on your network, it's a good idea to have it 'fudge' the election results and always be the master browser. This option causes Samba to force a browser election when it starts up, and cheats to give it a higher chance of 'winning'.
−
−	~~And that's the global section. Now, on to actually setting up shares.~~
−
−
−	~~----~~
−
−	~~'''[homes]'''~~
−
−	If you want your users to be able to access the home directories of their FreeBSD user accounts, add a [homes] section. If you do NOT want individual users to have private storage areas, do not include this section.
−
−	~~[homes]~~
−	~~comment = Home Directories~~
−	~~browseable = no~~
−	~~writeable = yes~~
−
−	~~The mere existence of [homes] tells Samba to allow users to have access to their home directories via network sharing. If it's not there, they don't have it.~~
−
−	~~'''comment = Home Directories''' is a description for the [section], and will show up in Windows Explorer under the 'comment' field.~~
−
−	'''browseable = no''' means users other than the owner can't see or browse the share. (I can't see your home directory, you can't see mine, but we're both valid users.) Similar in purpose and execution to the 'My Documents' folder Windows users are familiar with. Each user has their own 'My Documents' folder.
−
−	~~'''writeable = yes''' means users can save files in their home directories from across the network.~~
−
−	~~That's it, setting up home directories is simple.~~
−
−	~~---~~
−
−	~~'''[public]'''~~
−
−	~~Now we'll set up the publicly accessible folder, located at '''/usr/smbroot/public/'''.~~
−
−	~~[public]~~
−	~~comment = Public~~
−	~~path = /usr/smbroot/public~~
−	~~public = no~~
−	~~writeable = yes~~
−	~~write list = @public~~
−	~~directory mask = 0770~~
−	~~create mask = 0770~~
−
−	~~'''[public]''': Create a new share named 'Public', which will look like a folder named 'Public' in Network Neighborhood.~~
−
−	~~'''comment = Public''': Same deal, this fills the 'comment' field in windows explorer / network neighborhood, when you're looking at the share.~~
−
−	~~'''path = /usr/smbroot/public''': This tells samba exactly where on the local machine to store files for this share. This is pretty important.~~
−
−	~~'''public = no''': This is sort of counter-intuitive, but you don't want this set to yes.~~
−
−	~~'''writeable = yes''': This tells Samba to let authorized users write to the directory.~~
−
−	~~'''write list = @public''': Lists the ''users'' and ''@groups'' allowed to write here. This is important! To define this further, or add more users or @groups, you'd write the line like this:~~
−	~~"valid users = joe bill @public @friends @dogs".~~
−
−	'''directory mask = 0750''': The directory mask setting controls the '''most permissive''' setting Windows clients are allowed to give a directory. In this example, the mask is set to 750, so a client can set read, write, and execute permissions to anything it wants to for the directory's owner; but for the group the Windows client can only set read and execute permissions, and since the "world" bit is set to 0, the Windows client will be unable to set any allowable permissions at all for "world" (neither the owner nor the group) for that directory. Note that the windows client is free to set ''less'' permissive settings on the directory - if it wanted to, it could still deny access to the owner or group; it just can't ''give'' access more permissive than that specified by the mass.
−
−	~~'''create mask = 0750''': Same deal, only this applies to files.~~
−
−	~~That's it - you've defined all the important parts of the share for Samba, so it knows where to find it, and how to limit users' access to it.~~
−
−	~~Test your new config with [[testparm]], which is a Samba tool that lets you validate your smb.conf.~~
−
−	~~Oyabun# '''testparm'''~~
−
−	I won't list the results here, but you should see a list of your shares. If there are any warnings or error messages, you'll want to analyze and correct the problem. Lastly, testparm will dump your smb.conf to the console.
−
−	~~---~~
−
−	~~'''[private]'''~~
−
−	~~Now we'll set up the private share. It will actually look just like the public share, with a few small changes.~~
−
−	~~[private]~~
−	~~comment = Private~~
−	~~path = /usr/smbroot/private~~
−	~~public = no~~
−	~~writeable = yes~~
−	~~valid users = @private~~
−	~~write list = @private~~
−	~~directory mask = 0770~~
−	~~create mask = 0770~~
−
−	~~Obviously we defined the basic stuff like [private] and where the directory is.~~
−
−	'''valid users = @private''' - This prevents anyone who is not a member of @private from having access to this share. Because '''public = no''', people who are NOT members of @private won't even see this share when they browse the server.
−
−	~~That's it, you now have two distinct shares set up, with two distinct sets of criteria to determine who gets access to those shares from a windows machine.~~

	== Configuring Samba to use your shares and interface with local Win.X machines ==		== Configuring Samba to use your shares and interface with local Win.X machines ==

← Older revision		Revision as of 18:35, 10 March 2008
Line 146:		Line 146:

	That's it, you now have two distinct shares set up, with two distinct sets of criteria to determine who gets access to those shares from a windows machine.		That's it, you now have two distinct shares set up, with two distinct sets of criteria to determine who gets access to those shares from a windows machine.
−
−	~~---~~
−
−	~~'''[printers]'''~~
−
−	If you have a printer (or printers) attached to the FreeBSD box that you wish to share on the network, you have to include them in your configuration as well. Here is the simplest configuration which shares all of the FreeBSD printers with everyone.

	== Configuring Samba to use your shares and interface with local Win.X machines ==		== Configuring Samba to use your shares and interface with local Win.X machines ==

@@ Line 9: / Line 9: @@
   Oyabun# '''mkdir /usr/smbroot/private'''
-The first command creates the '''/usr/smbroot/''' directory, which will hold all of your shares. The second command c'''reates the public directory, which '''all''' users will be able to access, and the third command creates the private directory, which only '''select''' users will be able to access.
+The first command creates the '''/usr/smbroot/''' directory, which will hold all of your shares. The second command creates the public directory, which '''all''' users will be able to access, and the third command creates the private directory, which only '''select''' users will be able to access.
-''
-N'''ow we need to set''' ''''''Bold text''''''Bold text''''''[[permissions]] on these directories. The [[permissions]] article goes into great detail about permissions, but a quick run through here will be fine. We'll use [[chown]] to change ownership of these two directories now. We'll assume you have or will set up two groups for your users, one group named '''public''', and another named '''private'''.
-  Oyabun# '''chown :public /usr/smbroot/public'''''
+Now we need to set [[permissions]] on these directories. The [[permissions]] article goes into great detail about permissions, but a quick run through here will be fine. We'll use [[chown]] to change ownership of these two directories now. We'll assume you have or will set up two groups for your users, one group named '''public''', and another named '''private'''.
   Oyabun# '''chown :private /usr/smbroot/private'''
@@ Line 23: / Line 23: @@
   Oyabun# '''chmod 770 /usr/smbroot/private'''
-Same [[permissions]] for each directory, broken down thusly: The first '''7''' is the 'owner' flag, and 7 means read/write/execute. The owner can do all of those thin'''gs. The second '''7''' is the group flag, meaning the owning :group can also r/w/x. The third character, '''0''', is in the 'rest of the world' position, meaning anyone who is NOT the owner, and NOT a member of the owning group. They can't read, they can't write, and they can't execute. Since we're not setting up anonymous access, we don't want users who aren't explicitly defined as having access to actually have any access, and this will accomplish that.
+Same [[permissions]] for each directory, broken down thusly: The first '''7''' is the 'owner' flag, and 7 means read/write/execute. The owner can do all of those things. The second '''7''' is the group flag, meaning the owning :group can also r/w/x. The third character, '''0''', is in the 'rest of the world' position, meaning anyone who is NOT the owner, and NOT a member of the owning group. They can't read, they can't write, and they can't execute. Since we're not setting up anonymous access, we don't want users who aren't explicitly defined as having access to actually have any access, and this will accomplish that.
-−
-== Headline text ==
 == Configuring Samba to use your shares and interface with local Win.X machines ==
@@ Line 115: / Line 113: @@
 "valid users = joe bill @public @friends @dogs".
-'''directory mask = 0750''': The directory mask setting controls the '''most permissive''' setting Windows clients are allowed to give a directory.  In this example, the mask is set to 750, so a client can set read, write, and execute permissions to anything it wants to for the directory's owner; but for the group the Windows client can only set read and execute permissions, and since the "world" bit is set to 0, the Windows client will be unable to set any allowable permissions at all for "world" (neither the owner nor the group) for that directory.  Note that the windows client is free to set ''less'' permissive settings on the directory - if it wanted to, it could still deny access to the owner or group; it just can't ''give'' access more permissive than that specified by the mass.
+'''directory mask = 0770''': The directory mask setting controls the '''most permissive''' setting Windows clients are allowed to give a directory.  In this example, the mask is set to 770, so a client can set read, write, and execute permissions to anything it wants to for the directory's owner; but for the group the Windows client can only set read and execute permissions, and since the "world" bit is set to 0, the Windows client will be unable to set any allowable permissions at all for "world" (neither the owner nor the group) for that directory.  Note that the windows client is free to set ''less'' permissive settings on the directory - if it wanted to, it could still deny access to the owner or group; it just can't ''give'' access more permissive than that specified by the mass.
-'''create mask = 0750''': Same deal, only this applies to files.
+'''create mask = 0770''': Same deal, only this applies to files.
 That's it - you've defined all the important parts of the share for Samba, so it knows where to find it, and how to limit users' access to it.

@@ Line 193: / Line 193: @@
 Congrats, you now have a Samba server.
 See also: [[Samba]] - [[Samba_Installation]]
 [[Category:Common Tasks]] [[Category:Configuring FreeBSD]]