Often you will need to restrict the users who can access a specific share for security reasons. This is very easy to do with Samba since it contains a wealth of options for creating practically any security configuration. Let's introduce a few configurations that you might want to use in your own Samba setup.
WARNING: Again, if you are connecting with Windows 98 or NT 4.0 with Service Pack 3 (or above), those clients will send encrypted passwords to the Samba server. If Samba is not configured for this, it will continually refuse the connection. This chapter describes how to set up Samba for encrypted passwords. See the
Section 6.4, Passwords" section.
We've seen what happens when you specify valid users. However, you are also allowed to specify a list of invalid users - users who should never be allowed access to Samba or its shares. This is done with the
invalid
users option. We hinted at one frequent use of this option earlier: a global default with the
[homes] section to ensure that various system users and superusers cannot be forged for access. For example:
[global]
invalid users = root bin daemon adm sync shutdown \
halt mail news uucp operator gopher
auto services = dave peter bob
[homes]
browsable = no
writeable = yes
The
invalid
users option, like
valid
users, can take group names as well as usernames. In the event that a user or group appears in both lists, the
invalid
users option takes precedence and the user or group will be denied access to the share.
At the other end of the spectrum, you can explicitly specify users who will be allowed superuser (root) access to a share with the
admin
users option. An example follows:
[sales]
path = /home/sales
comment = Fiction Corp Sales Data
writeable = yes
valid users = tom dick harry
admin users = mike
This option takes both group names and usernames. In addition, you can specify NIS netgroups by preceding them with an
@ as well; if the netgroup is not found, Samba will assume that you are referring to a standard Unix group.
Be careful if you assign an entire group administrative privileges to a share. The Samba team highly recommends you avoid using this option, as it essentially gives root access to the specified users or groups for that share.
If you wish to force read-only or read-write access to users who access a share, you can do so with the
read
list and
write
list options, respectively. These options can be used on a per-share basis to restrict a writable share or grant write access to specific users in a read-only share, respectively. For example:
[sales]
path = /home/sales
comment = Fiction Corp Sales Data
read only = yes
write list = tom dick
The
write
list option cannot override Unix permissions. If you've created the share without giving the write-list user write permission on the Unix system, he or she will be denied write access regardless of the setting of
write
list.
