Le 10/07/2019 ? 08:46, Rowland penny via samba a ?crit?:> On 09/07/2019 22:49, Yvan Masson wrote:
>> Le 09/07/2019 ? 21:16, Rowland penny via samba a ?crit?:
>>> On 09/07/2019 20:06, Yvan Masson via samba wrote:
>>>> Hi,
>>>>
>>>> First, thanks for all people that continuously giving great
advice
>>>> on this list!
>>>>
>>>> I am setting up a standalone server (Debian 10, Samba
4.9.5+dfsg-5
>>>> from Debian). The following directory is shared and contains
two
>>>> directories:
>>>> /home/eleve/partage/
>>>> ??? Documents
>>>> ??? Travail
>>>>
>>>> I want user "eleve" to be able to modify everything,
and guest users
>>>> to have read access on "Documents/" and write access
on "Travail/".
>>>> Everything works as expected when accessing files locally, but
not
>>>> when mounting the share from a Linux client:
>>>> - when logged in as guest, I can read everything but have no
write
>>>> access in "Travail/"
>>>> - when logged in as "eleve", I can not write inside
"Documents/"
>>> You would be better off setting up two shares
>>>>
>>>> I suppose I am missing something simple, but can not find what
(I
>>>> have read
>>>>
https://wiki.samba.org/index.php/Setting_up_a_Share_Using_POSIX_ACLs).
>>> I know that page refers to a standalone server, but it is mostly
>>> aimed at AD domain members, though the basics should work on a
>>> standalone server.
>>>
>>> Rowland
>>>
>> Thanks for the advice. I have read
>>
https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Standalone_Server
>> which gave me the solution: I had forgot to add "eleve" user
to the
>> smbpasswd database. It would need more testing, but it seems I have a
>> working setup with two shares and no POSIX ACL.
>>
>> I suppose I already know the answer, but is there a way to login with
>> Samba without having a smbpasswd file?
>>
>> Regards,
>> Yvan
>
> Yes, it is known as setting up an AD domain and then accounts are stored
> in AD ;-)
>
> Otherwise if you really mean 'can I connect to a Samba share on a Samba
> standalone server without an account', then yes, you can. you will need
> 'map to guest = bad user' in [global] and 'guest ok = yes'
in the shares
> (note, you cannot use 'valid users' etc in the shares), with these
> settings and no users, anybody can connect to the shares and they will
> be mapped to the guest user (usually 'nobody'). This is very
insecure.
>
> Rowland
OK thanks. However I still want to clarify what is wrong with my
original setup, where "Partage" directory is shared on a standalone
Samba 4.9.5 server:
/home/yvan/Partage/
??? Consultation/
??? Echange/
Connecting with local user "yvan" (added to smbpasswd file this time),
works properly: I have write access in "Consultation/" and
"Echange/".
Connecting as a guest user (mapped to user "nobody") works partially:
I have read access in "Consultation/" and "Echange/", but I
would like
to have write access in "Echange/". For example, this does not work
(the
share is mounted as guest via gvfs):
$ LANG=C touch
/run/user/1000/gvfs/smb-share\:server\=e7440.local\,share\=partage/Echange/test
touch: cannot touch
'/run/user/1000/gvfs/smb-share:server=e7440.local,share=partage/Echange/test':
Permission denied
However, everything works properly when accessing files locally. This works:
$ sudo -u nobody touch /home/yvan/Partage/Echange/test
So I guess I have an issue with guest access in my Samba configuration.
$cat /etc/samba/smb.conf:
[global]
workgroup = AYN
log file = /var/log/samba/log.%m
logging = file syslog at 1
server role = standalone server
map to guest = Bad User
guest account = nobody
[Partage]
path = /home/yvan/Partage
guest ok = yes
writable = yes
inherit acls = yes
$ getfacl Partage/*
# file: Partage/Consultation
# owner: yvan
# group: yvan
user::rwx
user:yvan:rwx
user:nobody:r-x
group::r-x
mask::rwx
other::r-x
default:user::rwx
default:user:yvan:rwx
default:user:nobody:r-x
default:group::r-x
default:mask::rwx
default:other::r-x
# file: Partage/Echange
# owner: yvan
# group: yvan
user::rwx
user:yvan:rwx
user:nobody:rwx
group::r-x
mask::rwx
other::r-x
default:user::rwx
default:user:yvan:rwx
default:user:nobody:rwx
default:group::r-x
default:mask::rwx
default:other::r-x
Any help would be appreciated :-)
Yvan