Chapter 13. File, Directory and Share Access Controls

Users can not write to a public share
I have set force user and samba still makes root the owner of all the files +Chapter 13. File, Directory and Share Access Controls
Chapter 13. File, Directory and Share Access Controls
Prev Part III. Advanced Configuration Next
Chapter 13. File, Directory and Share Access Controls
John H. Terpstra
Samba Team
<jht@samba.org>
Jeremy Allison
Samba Team
<jra@samba.org>
May 10, 2003
Table of Contents
Features and Benefits
File System Access Controls
MS Windows NTFS Comparison with Unix File Systems
Managing Directories
File and Directory Access Control
Share Definition Access Controls
User and Group Based Controls
File and Directory Permissions Based Controls
Miscellaneous Controls
Access Controls on Shares
Share Permissions Management
MS Windows Access Control Lists and Unix Interoperability
Managing UNIX permissions Using NT Security Dialogs
Viewing File Security on a Samba Share
Viewing file ownership
Viewing File or Directory Permissions
Modifying file or directory permissions
Interaction with the standard Samba create mask + parameters
Interaction with the standard Samba file attribute + mapping
Common Errors
Users can not write to a public share
I have set force user and Samba still makes root the owner of all the files I touch!
Advanced MS Windows users are frequently perplexed when file, directory and share manipulation of resources shared via Samba do not behave in the manner they might expect. MS Windows network -adminstrators are often confused regarding network access controls and what is the best way to +administrators are often confused regarding network access controls and what is the best way to provide users with the type of access they need while protecting resources from the consequences of untoward access capabilities.
@@ -31,9 +30,9 @@ This is an opportune point to mention that it should be borne in mind that Samba provide a means of interoperability and interchange of data between two operating environments that are quite different. It was never the intent to make Unix/Linux like MS Windows NT. Instead the purpose was an is to provide a sufficient level of exchange of data between the two environments. -What is available today extends well beyond early plans and expections, yet the gap continues to +What is available today extends well beyond early plans and expectations, yet the gap continues to shrink. -
Features and Benefits
+
Features and Benefits
Samba offers a lot of flexibility in file system access management. These are the key access control facilities present in Samba today:
Samba Access Control Facilities
@@ -70,15 +69,15 @@ shrink. operating system supports them. If not, then this option will not be available to you. Current Unix technology platforms have native support for POSIX ACLs. There are patches for the Linux kernel that provide - this also. Sadly, few Linux paltforms ship today with native ACLs and + this also. Sadly, few Linux platforms ship today with native ACLs and Extended Attributes enabled. This chapter has pertinent information for users of platforms that support them. -
File System Access Controls
+
File System Access Controls
Perhaps the most important recognition to be made is the simple fact that MS Windows NT4 / 200x / XP implement a totally divergent file system technology from what is provided in the Unix operating system environment. Firstly we should consider what the most significant differences are, then we shall look at how Samba helps to bridge the differences. -
MS Windows NTFS Comparison with Unix File Systems
+
MS Windows NTFS Comparison with Unix File Systems
Samba operates on top of the Unix file system. This means it is subject to Unix file system conventions and permissions. It also means that if the MS Windows networking environment requires file system behaviour that differs from unix file system behaviour then somehow Samba is responsible for emulating @@ -86,7 +85,7 @@ at how Samba helps to bridge the differences.
It is good news that Samba does this to a very large extent and on top of that provides a high degree of optional configuration to over-ride the default behaviour. We will look at some of these over-rides, - but for the greater part we will stay withing the bounds of default behaviour. Those wishing to explore + but for the greater part we will stay within the bounds of default behaviour. Those wishing to explore to depths of control ability should review the smb.conf man page.
File System Feature Comparison
Name Space
MS Windows NT4 / 200x/ XP files names may be up to 254 characters long, Unix file names @@ -137,24 +136,24 @@ at how Samba helps to bridge the differences. Symbolic links are files in Unix that contain the actual location of the data (file OR directory). An operation (like read or write) will operate directly on the file referenced. Symbolic links are also referred to as 'soft links'. A hard link is something that MS Windows is NOT familiar with. It allows - one physical file to be known simulataneously by more than one file name. + one physical file to be known simultaneously by more than one file name.
There are many other subtle differences that may cause the MS Windows administrator some temporary discomfort in the process of becoming familiar with Unix/Linux. These are best left for a text that is dedicated to the purpose of Unix/Linux training/education. -
Managing Directories
+
Managing Directories
There are three basic operations for managing directories, create, delete, rename. -
Table 13.1. Managing directories with unix and windows
Action MS Windows Command Unix Command
create md folder mkdir folder
delete rd folder rmdir folder
rename rename oldname newname mv oldname newname
-
File and Directory Access Control
+
Table 13.1. Managing directories with unix and windows
Action MS Windows Command Unix Command
create md folder mkdir folder
delete rd folder rmdir folder
rename rename oldname newname mv oldname newname
+
File and Directory Access Control
The network administrator is strongly advised to read foundational training manuals and reference materials regarding file and directory permissions maintenance. Much can be achieved with the basic Unix permissions without having to resort to more complex facilities like POSIX Access Control Lists (ACLs) or Extended Attributes (EAs). -
- Unix/Linux file and directory access permissions invloves setting three (3) primary sets of data and one (1) control set. +
+ Unix/Linux file and directory access permissions involves setting three (3) primary sets of data and one (1) control set. A Unix file listing looks as follows:- -
+
jht@frodo:~/stuff> ls -la total 632 drwxr-xr-x 13 jht users 816 2003-05-12 22:56 . @@ -177,13 +176,13 @@ at how Samba helps to bridge the differences. -rw-rw-rw- 1 jht users 41105 2003-05-12 22:32 mydata06.lst -rwxrwxrwx 1 jht users 19312 2003-05-12 22:32 mydata07.lst jht@frodo:~/stuff> -
-
+
+
The columns above represent (from left to right): permissions, no blocks used, owner, group, size (bytes), access date, access time, file name. -
+
The permissions field is made up of: -
+
JRV: Put this into a diagram of some sort [ type ] [ users ] [ group ] [ others ] [File, Directory Permissions] [ d | l ] [ r w x ] [ r w x ] [ r w x ] @@ -199,20 +198,20 @@ at how Samba helps to bridge the differences. | | |-----------------------------> Can Read, Read files | |-----------------------------------> Is a symbolic Link |---------------------------------------> Is a directory -
- +
+
Any bit flag may be unset. An unset bit flag is the equivalent of 'Can NOT' and is represented as a '-' character. -
Example 13.1. Example File
+
Example 13.1. Example File
-rwxr-x--- Means: The owner (user) can read, write, execute the group can read and execute everyone else can NOT do anything with it -
+
-
- Additional posibilities in the [type] field are: c = character device, b = block device, p = pipe device, s = Unix Domain Socket.
- The letters `rwxXst' set permissions for the user, group and others as: read (r), write (w), execute (or access for directories) (x),r + Additional possibilities in the [type] field are: c = character device, b = block device, p = pipe device, s = Unix Domain Socket. +
+ The letters `rwxXst' set permissions for the user, group and others as: read (r), write (w), execute (or access for directories) (x), execute only if the file is a directory or already has execute permission for some user (X), set user or group ID on execution (s), sticky (t).
@@ -229,10 +228,10 @@ at how Samba helps to bridge the differences. the (x) execute flags are not set files can not be listed (seen) in the directory by anyone. The group can read files in the directory but can NOT create new files. NOTE: If files in the directory are set to be readable and writable for the group, then group members will be able to write to (or delete) them. -
Share Definition Access Controls
+
Share Definition Access Controls
The following parameters in the smb.conf file sections that define a share control or affect access controls. Before using any of the following options please refer to the man page for smb.conf. -
User and Group Based Controls
+
User and Group Based Controls
User and group based controls can prove very useful. In some situations it is distinctly desirable to affect all file system operations as if a single user is doing this, the use of the force user and force group behaviour will achieve this. In other situations it may be necessary to affect a @@ -244,7 +243,7 @@ Before using any of the following options please refer to the man page for
Table 13.2. User and Group Based Controls Control Parameter Description - Action - Notes admin users + Table 13.2. User and Group Based Controls Control Parameter Description - Action - Notes admin users List of users who will be granted administrative privileges on the share. They will do all file operations as the super-user (root). Any user in this list will be able to do anything they like on the share, @@ -271,12 +270,12 @@ Before using any of the following options please refer to the man page for write list List of users that are given read-write access to a service. - File and Directory Permissions Based Controls +
File and Directory Permissions Based Controls
The following file and directory permission based controls, if misused, can result in considerable difficulty to diagnose the cause of mis-configuration. Use them sparingly and carefully. By gradually introducing each one by one undesirable side-effects may be detected. In the event of a problem, always comment all of them out and then gradually - re-instroduce them in a controlled fashion. -
Table 13.3. File and Directory Permission Based Controls Control Parameter Description - Action - Notes create mask + re-introduce them in a controlled fashion. + Table 13.3. File and Directory Permission Based Controls Control Parameter Description - Action - Notes create mask Refer to the smb.conf man page. directory mask The octal modes used when converting DOS modes to UNIX modes when creating UNIX directories. @@ -292,17 +291,17 @@ Before using any of the following options please refer to the man page for force security mode Controls UNIX permission bits modified when a Windows NT client manipulates UNIX permissions. hide unreadable - Prevents clients from seeing the existance of files that cannot be read. + Prevents clients from seeing the existence of files that cannot be read. hide unwriteable files - Prevents clients from seeing the existance of files that cannot be written to. Unwriteable directories are shown as usual. + Prevents clients from seeing the existence of files that cannot be written to. Unwriteable directories are shown as usual. nt acl support This parameter controls whether smbd will attempt to map UNIX permissions into Windows NT access control lists. security mask Controls UNIX permission bits modified when a Windows NT client is manipulating the UNIX permissions on a file. - Miscellaneous Controls +
Miscellaneous Controls
The following are documented because of the prevalence of administrators creating inadvertant barriers to file access by not understanding the full implications of smb.conf file settings. -
Table 13.4. Other Controls Control Parameter Description - Action - Notes case sensitive, default case, short preserve case + Table 13.4. Other Controls Control Parameter Description - Action - Notes case sensitive, default case, short preserve case This means that all file name lookup will be done in a case sensitive manner. Files will be created with the precise filename Samba received from the MS Windows client. csc policy @@ -323,9 +322,9 @@ Before using any of the following options please refer to the man page for veto files List of files and directories that are neither visible nor accessible. - Access Controls on Shares +
Access Controls on Shares
This section deals with how to configure Samba per share access control restrictions. - By default samba sets no restrictions on the share itself. Restrictions on the share itself + By default, Samba sets no restrictions on the share itself. Restrictions on the share itself can be set on MS Windows NT4/200x/XP shares. This can be a very effective way to limit who can connect to a share. In the absence of specific restrictions the default setting is to allow the global user Everyone Full Control (ie: Full control, Change and Read). @@ -337,12 +336,12 @@ Before using any of the following options please refer to the man page for
Samba stores the per share access control settings in a file called share_info.tdb. The location of this file on your system will depend on how samba was compiled. The default location - for samba's tdb files is under /usr/local/samba/var. If the tdbdump - utility has been compiled and installed on your system then you can examine the contents of this file + for Samba's tdb files is under /usr/local/samba/var. If the tdbdump + utility has been compiled and installed on your system, then you can examine the contents of this file by: tdbdump share_info.tdb. -
Share Permissions Management
- The best tool for the task is platform dependant. Choose the best tool for your environmemt. -
Windows NT4 Workstation/Server
+
Share Permissions Management
+ The best tool for the task is platform dependant. Choose the best tool for your environment. +
Windows NT4 Workstation/Server
The tool you need to use to manage share permissions on a Samba server is the NT Server Manager. Server Manager is shipped with Windows NT4 Server products but not with Windows NT4 Workstation. You can obtain the NT Server Manager for MS Windows NT4 Workstation from Microsoft - see details below. @@ -352,7 +351,7 @@ Before using any of the following options please refer to the man page for
Now click on the share that you wish to manage, then click on the Properties tab, next click on the Permissions tab. Now you can add or change access control settings as you wish. -
Windows 200x/XP
+
Windows 200x/XP
On MS Windows NT4/200x/XP system access control lists on the share itself are set using native tools, usually from filemanager. For example, in Windows 200x: right click on the shared folder, then select Sharing, then click on Permissions. The default @@ -365,7 +364,7 @@ Before using any of the following options please refer to the man page for Action, select Connect to another computer. If you are not logged onto a domain you will be prompted to enter a domain login user identifier and a password. This will authenticate you to the domain. - If you where already logged in with administrative privilidge this step is not offered. + If you where already logged in with administrative privilege this step is not offered.
If the Samba server is not shown in the Select Computer box, then type in the name of the target Samba server in the field Name:. Now click on the [+] next to @@ -381,7 +380,7 @@ Before using any of the following options please refer to the man page for no access means that MaryK who is part of the group Everyone will have no access even if this user is given explicit full control access. -
MS Windows Access Control Lists and Unix Interoperability
Managing UNIX permissions Using NT Security Dialogs
Windows NT clients can use their native security settings +

Chapter 13. File, Directory and Share Access Controls
Prev	Part III. Advanced Configuration	Next

Action	MS Windows Command	Unix Command
create	md folder	mkdir folder
delete	rd folder	rmdir folder
rename	rename oldname newname	mv oldname newname

Action	MS Windows Command	Unix Command
create	md folder	mkdir folder
delete	rd folder	rmdir folder
rename	rename oldname newname	mv oldname newname

`MS Windows Access Control Lists and Unix Interoperability`

`Managing UNIX permissions Using NT Security Dialogs`

Windows NT clients can use their native security settings dialog box to view and modify the underlying UNIX permissions.

Note that this ability is careful not to compromise the security of the UNIX host Samba is running on, and still obeys all the file permission rules that a Samba @@ -392,7 +391,7 @@ Before using any of the following options please refer to the man page for

`Viewing File Security on a Samba Share`

From an NT4/2000/XP client, single-click with the right +

`Interaction with the standard Samba file attribute + security mask = 0777 force security mode = 0 directory security mask = 0777 force directory security mode = 0`

`Interaction with the standard Samba file attribute mapping`

Samba maps some of the DOS attribute bits (such as "read only") into the UNIX permissions of a file. This means there can be a conflict between the permission bits set via the security @@ -576,13 +575,13 @@ Before using any of the following options please refer to the man page for OK to get back to the attributes dialog you should always hit Cancel rather than OK to ensure that your changes - are not overridden.

`Common Errors`

+ are not overridden.

`Common Errors`

File, Directory and Share access problems are very common on the mailing list. The following are examples taken from the mailing list in recent times. -

`Users can not write to a public share`

+

`Users can not write to a public share`

“ We are facing some troubles with file / directory permissions. I can log on the domain as admin user(root), - and theres a public share, on which everyone needs to have permission to create / modify files, but only + and there's a public share, on which everyone needs to have permission to create / modify files, but only root can change the file, no one else can. We need to constantly go to server to chgrp -R users * and chown -R nobody * to allow others users to change the file. ” @@ -590,72 +589,72 @@ are examples taken from the mailing list in recent times. There are many ways to solve this problem, here are a few hints:

Procedure 13.3. Example Solution:

Go to the top of the directory that is shared -
+

Set the ownership to what ever public owner and group you want -

+			
 			find 'directory_name' -type d -exec chown user.group {}\;
 			find 'directory_name' -type d -exec chmod 6775 'directory_name'
 			find 'directory_name' -type f -exec chmod 0775 {} \;
 			find 'directory_name' -type f -exec chown user.group {}\;
-			

-			Note

+

+

`Note`

The above will set the 'sticky bit' on all directories. Read your Unix/Linux man page on what that does. It causes the OS to assign to all files created in the directories the ownership of the directory. -

Directory is: /foodbar -

+			
 				$ chown jack.engr /foodbar
-			

-			Note

-				This is the same as doing:

-				+			

+			
Note

+				
This is the same as doing:

+				
 					$ chown jack /foodbar
 					$ chgrp engr /foodbar
-				

-

Now do: + +

Now do: -

+			
 				$ chmod 6775 /foodbar
 				$ ls -al /foodbar/..
-			

+

- You should see: -

+			
You should see:
+			
 				drwsrwsr-x  2 jack  engr    48 2003-02-04 09:55 foodbar
-			

-

Now do: - + +

Now do: +

 				$ su - jill
 				$ cd /foodbar
 				$ touch Afile
 				$ ls -al
-

- + + You should see that the file Afile created by Jill will have ownership and permissions of Jack, as follows: - + -rw-r--r-- 1 jack engr 0 2003-02-04 09:57 Afile - -

+ +

Now in your smb.conf for the share add: -

+		
 		force create mode = 0775
-		force direcrtory mode = 6775
-		

-		Note

+		force directory mode = 6775
+

+

`Note`

The above are only needed if your users are not members of the group you have used. ie: Within the OS do not have write permission on the directory. -

+

An alternative is to set in the smb.conf entry for the share: -

+		
 		force user = jack
 		force group = engr
-		

-

Prev	Up	Next
Chapter 12. Mapping MS Windows and Unix Groups	Home	Chapter 14. File and Record Locking