Samba configuration help

[TheFu]

1+1 should = 2 but instead equals 3.1415926535897932384626433832795. Like, just why?

Unless 1+1 is just under 4, for "very large values of 1".

I've not seen the issue described. My only guess would be that there are either ACLs preventing the mask or that the underlying file system isn't POSIX i.e. not a native Linux file system. All bets are off when exFAT or NTFS or HPFS are used.

df -Th is a very helpful command, BTW.

[Morbius1]

1+1 should = 2 but instead equals 3.1415926535897932384626433832795. Like, just why?

Your calculation is correct but you are using the wrong base. 1+1 should equal 1.

A new file will come to samba with permissions of 777. Three other parameters are in play here ( map archive , map system, and map hidden ) that turns that into 766. In binary that is 111 110 110.

A "create mask" is converted to binary and then a logical AND is performed on the original permissions passed.
If we use a create mask value of 664 it's binary equivalent is 110 110 100

In a logical AND if both numbers are 1 the answer is 1. If one number is 0 the answer is 0. So what we have is:

111 110 110
110 110 100
========
110 110 100 which is octal 664

So let's do the same thing with a create mask of 755 which is 111 101 101:

111 110 110
111 101 101
========
111 100 100 which is octal 744.

A "force create mode" is similar but it does a logical OR on the result ........

[fjl05]

Why not use the [homes] special stanza to provide access by username for each user's HOME directory?

[homes]
  comment = Home Directories
  hosts allow = 127.0.0.1 172.22.22.0/24  
  hosts deny = 0.0.0.0/0
  browseable = yes
  guest ok = no
  writable = yes
  create mask = 0644
  directory mask = 0755
  valid users = %S

Ok I tried it and it seems to work! Thanks!

The problem i'm having is I dont understand any of it. And why it works. I dont like to just add some configuration code and not understand what its doing. I tried reading up on it at the [homes] section on the samba website here, https://www.samba.org/samba/docs/cur...mb.conf.5.html
But like much everything else, It goes over my head and I cant understand what its trying to say. Can someone explain it like I am an idiot. Which I obviously am..

Also I've condensed the service down from this;

[homes]
  comment = Home Directories
  hosts allow = 127.0.0.1 172.22.22.0/24
  hosts deny = 0.0.0.0/0
  browseable = yes
  guest ok = no
  writable = yes
  create mask = 0644
  directory mask = 0755
  valid users = %S

To this.

[homes]
  comment = %Us Home Directory
  browseable = yes
  guest ok = no
  writable = yes

And it still does what I need. I mostly understand what hosts allow/deny do. But do I really need them for this to function properly? Why did you add those? And what about valid users = %S. What is that supposed to do here? According to the samba website, I read that %S = the name of the current service, if any. But why would you need the name of the current service here? Whats its function in this case?

Also is there a way to rename the [homes] service so its says something like My Folder instead of homes?

[fjl05]

Unless 1+1 is just under 4, for "very large values of 1".

I've not seen the issue described. My only guess would be that there are either ACLs preventing the mask or that the underlying file system isn't POSIX i.e. not a native Linux file system. All bets are off when exFAT or NTFS or HPFS are used.

df -Th is a very helpful command, BTW.

I'm actually running Ubuntu Server on a Raspberry Pi. Everything is currently EXT4. I did try mounting some external drives, exFAT, NTFS even FAT32 and that just gave me a whole bunch of wacky glitches. But I realized I first need to properly learn the ins and outs of SAMBA before I start dealing with the errors that come up when using it with mounted external drives. So once I learn SAMBA properly, I will then tackle head on those wacky glitches. My final plan is to use external drives for storage of the shared files. One step at a time.

[Morbius1]

The [homes] section of smb.conf is a special share in that it will create a samba share of a user's home directory on the fly for every local user on your Linux server. You will note that the [homes] share has no path. Otherwise the admin would have to create a share for user bob pointing to his home directory and another for alice for her home directory .... So you cannot turn it into MyFolder and expect to have the same result.

The valid user = %S is a convoluted way to say how the client user is expected to access the share. By default it is not set browseable and the user is expected not to access the share as //hostname/homes but as //hostname/$USER - as in //hostname/morbius for example. This Windows does by default. In Linux you have to specify it.

[fjl05]

Your calculation is correct but you are using the wrong base. 1+1 should equal 1.

wouldn't that = 10 in binary?

A "create mask" is converted to binary and then a logical AND is performed on the original permissions passed.

Yeah, but why?

[Morbius1]

I'm done here.

Bone for tuna.

[fjl05]

The [homes] section of smb.conf is a special share in that it will create a samba share of a user's home directory on the fly for every local user on your Linux server. You will note that the [homes] share has no path. Otherwise the admin would have to create a share for user bob pointing to his home directory and another for alice for her home directory .... So you cannot turn it into MyFolder and expect to have the same result.

Thats fine but it works under this setting

[homes]
  comment = %Us Home Directory
  browseable = yes
  guest ok = no
  writable = yes

[Mario]
comment = Mario's Folder
path = /Users/U% 
browseable - no
valid users = Mario, Toad, Yoshi

If I login with Mario it uses the above [Mario] service along with its parameters. Basically the way I was expecting 'copy =' to work. How does it know to use that service? If I change the name of the [Mario] service, then it defaults to the users home directory of /home/mario instead of the directory I set on [Mario] 'path='

Just trying to understand how its doing this.

The valid user = %S is a convoluted way to say how the client user is expected to access the share. By default it is not set browseable and the user is expected not to access the share as //hostname/homes but as //hostname/$USER - as in //hostname/morbius for example. This Windows does by default. In Linux you have to specify it.

Not gonna lie, but I think I somewhat understand your explanation here.

I'm done here.

Bone for tuna.

Thanks for you help.

[TheFu]

In many parts of Linux, the only real way to truly understand what is happening is to read the source code. Perhaps spend a few hours in a debugger watching it work.
For people who cannot do that, there are manpages and books written on specific topics. O'Reilly has a book on Samba. I don't have it and never needed it. Long ago, I learned what worked for my needs and have been using those settings all this time. When new stuff happens, I ask Mr. Scroogle for an answer, update my smb.conf until it does what I need.

I'm fairly security conscious. Samba historically has been terrible at security until about 2 yrs ago, so I've always used the host allow/deny parts. For about 10 yrs, I've drastically reduced my need for samba and most files on the network here are accessed using NFS or rsync or sftp or sshfs or ... or ... or ... anything else. My remaining Windows machines are basically stand alone and only get powered on 4x a month for some financial programs. I also have multiple subnets and do not want anything from my lab "getting out" onto other parts of the LAN here. I definitely don't want and IoT or wifi stuff having access to Samba. That's just too crazy to consider, for me.

Samba is a complicated beast. It is trying to make 1 OS appear as another when they have fundamental differences at the way files are handled. The best non-book information that I know about samba settings is the smb.conf manpage. Because it is long and complex, there are many parts that refer to other parts and all the tidbits for 1 settings aren't necessarily just in that page of the manpage. There are many caveats spread throughout the manpage for many settings. Not all settings can be used anywhere, for example. Some can only be used in the [global] stanza and others can only be used in a [share] stanza. Mixing those up is a common issue.

Plus, samba can be an NT4 Domain controller, which added a bunch of other rules. I've completely avoided knowing anything about that. If I want an LDAP domain, I'll run openLDAP or 386Directory Server, not Samba. But a bunch of Windows people confuse Domain Controllers with other services which are completely separate on Unix-Like OSes. Anyways, this stuff doesn't really apply to home users much ... unless they are MSFT-admin trained.

I've shown a stanza that works exactly as expected honoring the masks. You didn't seem to follow that example, so I don't know what is different. Some settings override others. Perhaps the order of my settings and being in the same stanza AND my global settings are what make it all work. And in your situation, any one of those can break it. testparm -s is the best way to share exactly what your system says, but I'm not expert enough (or have the pay) to look at everything. Sorry. I just know what works here.

If you have something working. Make a backup of those files, so you can always go back. Then screw around as much as you like.

[fjl05]

In many parts of Linux, the only real way to truly understand what is happening is to read the source code. Perhaps spend a few hours in a debugger watching it work.
For people who cannot do that, there are manpages and books written on specific topics. O'Reilly has a book on Samba. I don't have it and never needed it. Long ago, I learned what worked for my needs and have been using those settings all this time. When new stuff happens, I ask Mr. Scroogle for an answer, update my smb.conf until it does what I need.

Yeah I suppose I can't expect to learn every little thing. As long as I have the settings I need and make notes of them it should be perhaps enough. Who's Mr. Scroogle?

I'm fairly security conscious. Samba historically has been terrible at security until about 2 yrs ago, so I've always used the host allow/deny parts. For about 10 yrs, I've drastically reduced my need for samba and most files on the network here are accessed using NFS or rsync or sftp or sshfs or ... or ... or ... anything else. My remaining Windows machines are basically stand alone and only get powered on 4x a month for some financial programs.

Is samba even safe to use? I dont really plan to use it for anything but my LAN so I can store and access files. But say I wanted to access from the internet, would using Sambe be a security issue? Really I wanted to try out Samba for the learning experience. But I've heard of openmedia vault. Would that be a better choice?

I also have multiple subnets and do not want anything from my lab "getting out" onto other parts of the LAN here. I definitely don't want and IoT or wifi stuff having access to Samba. That's just too crazy to consider, for me.

Subnets is something else I need to look into implementing. There are things I need to separate. But again, one thing at a time. Networking is not an easy subject. Although learning it is definitely fun.

Samba is a complicated beast. It is trying to make 1 OS appear as another when they have fundamental differences at the way files are handled. The best non-book information that I know about samba settings is the smb.conf manpage. Because it is long and complex, there are many parts that refer to other parts and all the tidbits for 1 settings aren't necessarily just in that page of the manpage. There are many caveats spread throughout the manpage for many settings. Not all settings can be used anywhere, for example. Some can only be used in the [global] stanza and others can only be used in a [share] stanza. Mixing those up is a common issue.

Manpage? got a link?

Plus, samba can be an NT4 Domain controller, which added a bunch of other rules. I've completely avoided knowing anything about that. If I want an LDAP domain, I'll run openLDAP or 386Directory Server, not Samba. But a bunch of Windows people confuse Domain Controllers with other services which are completely separate on Unix-Like OSes. Anyways, this stuff doesn't really apply to home users much ... unless they are MSFT-admin trained.

You just went over my head, buddy lol.

I've shown a stanza that works exactly as expected honoring the masks. You didn't seem to follow that example, so I don't know what is different. Some settings override others. Perhaps the order of my settings and being in the same stanza AND my global settings are what make it all work. And in your situation, any one of those can break it. testparm -s is the best way to share exactly what your system says, but I'm not expert enough (or have the pay) to look at everything. Sorry. I just know what works here.

If you have something working. Make a backup of those files, so you can always go back. Then screw around as much as you like.

Thats exactly what I'm doing. I find this kind of stuff tedious, yet its completely entertaining and fun. For me anyways. Thx for you help btw.