This chapter discusses how to configure users with the Samba server. This topic may seem straightforward at first, but you'll soon discover that there are several ancillary problems that can crop up. One issue that Samba administrators have difficulty with is user authentication - password and security problems are by far the most common support questions on the Samba mailing lists. Learning why various authentication mechanisms work on certain architectures (and don't on others) can save you a tremendous amount of time testing and debugging Samba users in the future.
Before we start, we need to warn you up front that if you are connecting to Samba with a Windows 98 or NT 4.0 Workstation SP3, you need to configure your server for encrypted passwords before you can make a connection; otherwise, the clients will refuse to connect to the Samba server. This is because each of those Windows clients sends encrypted passwords, and Samba needs to be configured to expect and decrypt them. We'll show you how to set up Samba for this task later in the chapter, assuming you haven't already tackled this problem in Chapter 2,
Installing Samba on a Unix System.
Let's start with a single user. The easiest way to set up a client user is to create a Unix account (and home directory) for that individual on the server, and notify Samba of the user's existence. You can do the latter by creating a disk share that maps to the user's home directory in the Samba configuration file, and restricting access to that user with the
valid
users option. For example:
[dave]
path = /home/dave
comment = Dave's home directory
writeable = yes
valid users = dave
The
valid
users option lists the users that will be allowed to access the share. In this case, only the user
dave is allowed to access the share. In the previous chapters, we specified that any user could access a disk share using the
guest
ok parameter. Because we don't wish to allow guest access, that option is absent here. We could grant both authenticated users and guest users access to a specific share if we wanted to. The difference between the two typically involves access rights for each of the files.
Remember that you can abbreviate the user's home directory by using the
%H variable. In addition, you can use the Unix username variable
%u and/or the client username variable
%U in your options as well. For example
:
[dave]
comment = %U home directory
writeable = yes
valid users = dave
path = %H
Both of these examples work as long as the Unix user that Samba uses to represent the client has read/write access to the directory referenced by the
path option. In other words, a client must first pass Samba's security mechanisms (e.g., encrypted passwords, the
valid users option, etc.) as well as the normal Unix file and directory permissions of its Unix-side user
before it can gain read/write access to a share.
With a single user accessing a home directory, access permissions are taken care of when the operating system creates the user account. However, if you're creating a shared directory for group access, there are a few more steps you need to perform. Let's take a stab at a group share for the accounting department in the
smb.conf file:
[accounting]
comment = Accounting Department Directory
writeable = yes
valid users = @account
path = /home/samba/accounting
create mode = 0660
directory mode = 0770
The first thing that you might notice we did differently is to specify
@account as the valid user instead of one or more individual usernames. This is shorthand for saying that the valid users are represented by the Unix group
account. These users will need to be added to the group entry
account in the system group file (
/etc/group or equivalent) to be recognized as part of the group. Once they are, Samba will recognize those users as valid users for the share.
In addition, you will need to create a shared directory that the members of the group can access, which is pointed to by the
path configuration option. Here are the Unix commands that create the shared directory for the accounting department (assuming
/home/samba already exists):
# mkdir /home/samba/accounting
# chgrp account /home/samba/accounting
# chmod 770 /home/samba/accounting
There are two other options in this
smb.conf example, both of which we saw in the previous chapter. These options are
create
mode and
directory
mode. These options set the maximum file and directory permissions that a new file or directory can have. In this case, we have denied all world access to the contents of this share. (This is reinforced by the
chmod command, shown earlier.).
