Samba server

(i) you can access configuration examples on my GitHub: https://github.com/guihome-diaz/IT/tree/master/install_scripts/assets/samba

Installation

Core packages

apt-get install samba samba-common libkrb5-3 winbind smbclient
apt-get install cifs-utils

Samba protocol is built upon Windows File Share. All windows versions since XP implements it, including Windows Server. Latest version implements higher specifications and security.

The CIFS protocol is also required as this is one of the default Windows Server share protocol.

Printer share

apt-get install libcups2 cups cups-pdf

User Interface

apt-get install system-config-samba

Usage

Edit configuration

vim  /etc/samba/smb.conf

Service management

/etc/init.d/samba restart

Configuration check

testparm -s

The file content should appears, without any alerts.

Basic share (no authentication)

The following configuration will make all shares available for a specific set of IP @ |or| the whole world.

vim /etc/samba/smb.conf

Global configuration (guest allowed)

#======================= Global Settings =======================
[global]
### Browsing/Identification ###
   workgroup = MYWORKGROUP
   # server name. Windows = netbios ; all the world = server string
   netbios name = MY_SERVER
   server string = MY_SERVER
   dns proxy = no
   wins support = no

### Security ###
   # Password level
   encrypt passwords = true
   # Sync password with current computer
   passdb backend = tdbsam 
   obey pam restrictions = yes
   unix password sync = yes
   # For Unix password sync to work on a Debian GNU/Linux system
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
   # allow samba user to change his password
   pam password change = yes
   # Paranoid check. To forbidden some logins
   #invalid users = vadmin

   # If guests are not allowed, they should be tagged as 'bad user' 
   map to guest = vadmin

   # If guests are allowed, they should use the following account
   # else put 'nobody'
   guest account = myuser 

   # Allow users who've been granted usershare privileges to create public shares
   usershare allow guests = yes
   
#### Networking ####
    # allow local network and localhost only
    # comment it out to make your server “open-bar” ! 
    # Each IP or IP_range/submask must be separated by a space
    allow hosts = 192.168.1.0/24 127.0.0.1 

#### Debugging/Accounting ####
   # This tells Samba to use a separate log file for each machine that connects
   log file = /var/log/samba/log.%m
   # Cap the size of the individual log files (in KiB).
   max log size = 1000
   # Log level in dedicated Samba log file
   log level = 3
   # Do something sensible when Samba crashes: mail the admin a backtrace
   panic action = /usr/share/samba/panic-action %d

############ Misc ############
   # improve TCP connection
   # socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
   # Improve file name management
   preserve case = yes
   short preserve case = no

Share definition (public)

This will set a new share, with full rights.

#======================= Share Definitions =======================
[webserver]
   comment = WEB-SERVER
   path = /var/www

   # Active share
   available = yes

   # Folder rights 
   browseable = yes
   read only = no
   writeable = yes
   
   # Allow guests ?
   guest ok = yes
   public = yes
   # Treat all users as guest?
   only guest = yes

   # Files permissions
   ## new file / directories permissions
   ## Use "2" to inherit permissions of the top directory
   create mask = 2777
   directory mask = 2777

   # Do NOT follow symlinks for security reasons
   follow symlinks = no  

   # Allow user to remove read-only files
   delete readonly = no

   # Every new file must be part of a specific group "users" to avoid conflicts
   force user = www-data
   force group = www-data

   # Do not be case sensitive to avoid Windows <> Linux conflicts
   case sensitive = no

   # hide Linux hidden files
   hide dot files = yes

   # specifics files / folder to hide
   #veto files = /.*

You have to duplicate the [webserver] section for each share.

Restricted share

This is just an effective summary of https://wiki.samba.org/index.php/Standalone_server

Create samba users

First of all you must create Linux users + grant them the samba access.

## Create a new system user 'smbUser' and add it to the list of SAMBA users

# 1. New system user
useradd -c "Samba user" -s /sbin/nologin -m smbUser
passwd smbUser
# 2. Add system user to 'users'
useradd -G users smbUser
# 3. Add account to SAMBA                  
smbpasswd -a smbUser
# 4. Grant SAMBA access to account
smbpasswd -e smbUser

Share rights

Before setting up the configuration, ensure all your share have the 711 root permissions.

## if you plan to share "/mnt/shareDrive/" content
chmod 711 /mnt/shareDrive

Global configuration (guest forbidden)

The configuration is almost the same. Adjust the following parameters:

• map to guest = bad user
• guest account = nobody
• usershare allow guests = yes

#======================= Global Settings =======================
[global]
### Browsing/Identification ###
   workgroup = MYWORKGROUP
   # server name. Windows = netbios ; all the world = server string
   netbios name = MY_SERVER
   server string = MY_SERVER
   dns proxy = no
   wins support = no

### Security ###
   # Password level
   encrypt passwords = true
   # Sync password with current computer
   passdb backend = tdbsam 
   obey pam restrictions = yes
   unix password sync = yes
   # For Unix password sync to work on a Debian GNU/Linux system
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
   # allow samba user to change his password
   pam password change = yes
   # Paranoid check. To forbidden some logins
   #invalid users = vadmin

   # If guests are not allowed, they should be tagged as 'bad user' 
   map to guest = bad user

   # If guests are allowed, they should use the following account
   # else put 'nobody'
   guest account = nobody

   # Allow users who've been granted usershare privileges to create public shares
   usershare allow guests = no
   
#### Networking ####
    # allow local network and localhost only
    # comment it out to make your server “open-bar” ! 
    # Each IP or IP_range/submask must be separated by a space
    allow hosts = 192.168.1.0/24 127.0.0.1 

#### Debugging/Accounting ####
   # This tells Samba to use a separate log file for each machine that connects
   log file = /var/log/samba/log.%m
   # Cap the size of the individual log files (in KiB).
   max log size = 1000
   # Log level in dedicated Samba log file
   log level = 3
   # log level in common Syslog (O.S log)
   syslog = 3
   # Do something sensible when Samba crashes: mail the admin a backtrace
   panic action = /usr/share/samba/panic-action %d

############ Misc ############
   # improve TCP connection
   # socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
   # Improve file name management
   preserve case = yes
   short preserve case = no

Share definition (private)

This will set a new share, with full rights. Compare to a public share, please note the following values:

• guest ok = no
• public = no
• only guest = no
• force user = linuxUser
• force group = users
• valid users = smbuser

(i) The user can be different of the Samba share account. This is just to ensure the file will be created with the correct properties.

#======================= Share Definitions =======================
[share-drive]
   comment = SHARE-DRIVE
   path = /mnt/shareDrive

   # Active share
   available = yes

   # Folder rights 
   browseable = yes
   read only = no
   writeable = yes
   
   # Allow guests ?
   guest ok = no
   public = no
   # Treat all users as guest?
   only guest = no
   
   # Only allow specific users? Put the list separated by a space or a comma
   #valid users = smbuser

   # Files permissions
   ## new file / directories permissions
   ## Use "2" to inherit permissions of the top directory
   create mask = 2777
   directory mask = 2777

   # Do NOT follow symlinks for security reasons
   follow symlinks = no  

   # Allow user to remove read-only files
   delete readonly = no

   # Every new file must be part of a specific group "users" to avoid conflicts
   force user = linuxUser
   force group = users

   # Do not be case sensitive to avoid Windows <> Linux conflicts
   case sensitive = no

   # hide Linux hidden files
   hide dot files = yes

   # specifics files / folder to hide
   #veto files = /.*

View / connect to samba share

List server shares

Public shares:

smbclient -L //server
smbclient -L //172.16.100.34

USER shares (= private + public):

smbclient -U smbUser -L //server
smbclient -U smbUser -L //172.16.100.34

Access share

smbclient -U smbUser //server/shareFolder
smbclient -U smbUser //172.16.100.34/DIVERS