samba - Mar 2009 - Samba Authorizations

There is one little piece I'm missing.

I have a Samba directory:  /home/documents

I have 10 Window XP users that need R/W access to this directory.
I have another 10 Window XP users that need R/O access to this directory.
No other Windows users should be able to see this directory.

The R/W users will get access by doing a Windows Search, Computers, and click on
the directory.  They may also map the directory to a drive letter, but that
shouldn't be necessary.

Most R/O users will be accessing this directory via UNC (i.e. double click on a
document name that is imbedded in another file).

I have a test Samba server.  The SMB.CONF is near bear minimums:

linux61:/etc/samba # cat smb.conf
# Samba config file created using SWAT
# from 205.235.227.16 (205.235.227.16)
# Date: 2009/03/31 12:42:57

[global]
        workgroup = TESTWORKS
        netbios name = HOBBIT
        null passwords = Yes
        ldap ssl = no

[cityworksro]
        comment = cityworks read only
        path = /home/documents

linux61:/etc/samba #

I don't have a LDAP server, but that may change in late summer.

I seem to go back and forth between windows user having complete R/W access to
this directory and no windows users having access to this directory.

It doesn't seem to matter if I create Linux userids with Yast.  Or if I
create Samba users via SMBPASSWD.

I've been reading "The Officail Samba 3.2.x HOWTO and Reference
Guide" as well as Samba-3 by Example.

They either have too simple of setup jump to a lot more complex of an example.

I've been maintaining this via SWAT.

So what really needs to be done?

Thanks

Tom Duerbusch
THD Consulting

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Am 31.03.2009 20:21, schrieb Tom Duerbusch:
> 
> linux61:/etc/samba # cat smb.conf
> # Samba config file created using SWAT
> # from 205.235.227.16 (205.235.227.16)
> # Date: 2009/03/31 12:42:57
> 
> [global]
>         workgroup = TESTWORKS
>         netbios name = HOBBIT
>         null passwords = Yes
>         ldap ssl = no
> 
> [cityworksro]
>         comment = cityworks read only
>         path = /home/documents
one way could be:

put the one R/W-users in one group, the R/O-users in a second group.
put a line into [cityworksro]:
	valid users = @<group of RW-users>, @<group of RO-users>

and use setfacl for the whole directory to assign specific rights for
both groups.
Setting browseable = no should prevent every other user to see that
share, but it could also hinder the R/W-users from finding that share
via search.

Cheers

Matthias

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAknSbJwACgkQf3LySRiTg2wrCACfcDaneWjzi9AMuEhXa+PVRCwi
6bAAn12TQib9SSBewjmrbGOn1fXKaH7+
=i1dY
-----END PGP SIGNATURE-----