[Samba] write list vs read list

[Luca Ferrari]

Hi,
I'd like to set a share as writable for a specific users' group, and only
readable for another, so I did the following:



[global]
netbios name      = SEDELDAP
workgroup = LDAP
security = user
passdb backend = ldapsam:ldap://localhost/
obey pam restrictions = no
ldap admin dn = cn=admin,dc=MyHost,dc=com
ldap suffix = dc=MyHost,dc=com
ldap group suffix = ou=Group
ldap user suffix = ou=People
ldap machine suffix = ou=Computers
ldap idmap suffix = ou=Users
ldap ssl = off
domain logons = yes
follow symlinks = yes
wide links = yes
unix extensions = no
map to guest = Bad User
guest account = guest.samba

[LABORATORIO_SMB]
comment = Cartella privata Laboratorio
path = /mnt/samba/lab_smb
browsable = yes
available = yes
valid users = @laboratorio @estero
write list = @laboratorio
read list = @estero
writable = yes
printable = no
force group = laboratorio

However, the @estero group cannot access the share at all
(NT_STATUS_ACCESS_DENIED). What am I doing wrong?

Thanks,
Luca

[Alex Harrington]

Post by Luca Ferrari
(NT_STATUS_ACCESS_DENIED). What am I doing wrong?

Most likely the filesystem permissions prevent users in @estero from
executing or reading the /home/samba/lab_smb folder and/or the files in
it.

Cheers

Alex

[Luca Ferrari]

Post by Alex Harrington

Post by Luca Ferrari
(NT_STATUS_ACCESS_DENIED). What am I doing wrong?

executing or reading the /home/samba/lab_smb folder and/or the files in
it.

Uhm..I've checked the file permissions, and since they are 777 I guess this is
not the problem. Moreover, since I've got a NT_STATUS_ACCESS_DENIED I think
that it is something that prevents users to access the share at all.
Any suggestion?

Thanks,
Luca

[Luca Ferrari]

Post by Luca Ferrari
Uhm..I've checked the file permissions, and since they are 777 I guess this
is not the problem. Moreover, since I've got a NT_STATUS_ACCESS_DENIED I
think that it is something that prevents users to access the share at all.
Any suggestion?

It is strange, this is the definition of the share:

[LABORATORIO_SMB]
comment = Cartella privata Laboratorio
path = /mnt/samba/lab_smb
browsable = yes
available = yes
valid users = @laboratorio @estero luca.ferrari
write list = @laboratorio
read list = @estero luca.ferrari
writable = yes
printable = no
force group = laboratorio

where I've added myself to the valid and read list. Then I forced a reload of
the configuration:

***@sede:~# /etc/init.d/samba reload
* Reloading /etc/samba/smb.conf...

but if I check the configuration with testparm I got:

[LABORATORIO_SMB]
comment = Cartella Laboratorio Sassuolo
path = /mnt/samba/laboratorio_smb
valid users = @laboratorio
read list = @estero, luca.ferrari
write list = @laboratorio
force group = laboratorio
read only = No

as you can see the luca.ferrari user is not added to the valid users list!
This could be the problem that such user always gets a
NT_STATUS_ACCESS_DENIED???
Any suggestion?

Thanks,
Luca

[Frank Weißer]

from man smb.conf:

Example: valid users = greg, @pcusers

Did you try comma-separating all entries?

readU
Frank

[Chris Smith]

Post by Luca Ferrari
[LABORATORIO_SMB]
        comment           = Cartella privata Laboratorio
        path              = /mnt/samba/lab_smb
        browsable         = yes
        available         = yes
        writable          = yes
        printable         = no
        force group       = laboratorio

Try:

[LABORATORIO_SMB]
comment = Cartella privata Laboratorio
path = /mnt/samba/lab_smb
browsable = yes
valid users = @laboratorio, @estero
write list = @laboratorio
read only = yes

[Luca Ferrari]

Post by Luca Ferrari
[LABORATORIO_SMB]
comment = Cartella privata Laboratorio
path = /mnt/samba/lab_smb
browsable = yes
read only = yes

No way! I've tried to change my configuration to the following:

[LABORATORIO_SMB]
comment = Cartella privata Laboratorio
path = /mnt/samba/lab_smb
browsable = yes
available = yes
valid users = @laboratorio, @estero, luca.ferrari
write list = @laboratorio
read list = @estero, luca.ferrari
writable = yes

but the testparm still says:

[LABORATORIO_SMB]
comment = Cartella Laboratorio Sassuolo
path = /mnt/samba/laboratorio_smb
valid users = @laboratorio
read list = @estero, luca.ferrari
write list = @laboratorio
force group = laboratorio
read only = No

so the valid users property is not changed, and in fact I'm not able to log in
to the share with an account not belonging to the laboratorio group.
Is there something I can check or do to get rid of this problem?

Thanks,
Luca

[Chris Smith]

Post by Luca Ferrari

Post by Luca Ferrari
[LABORATORIO_SMB]
        comment           = Cartella privata Laboratorio
        path              = /mnt/samba/lab_smb
        browsable         = yes
        read only         = yes

No way!

That works for me all day long.

Post by Luca Ferrari
I'd like to set a share as writable for a specific users' group, and
only readable for another

You can simplify as I show, you don't need a "write list" and a "read
list". If you make a share "read only" then it is read only by default,
yet those on the "write list" will have write privileges. The less
complicated, the easier to read and troubleshoot.

Post by Luca Ferrari
[LABORATORIO_SMB]
comment = Cartella privata Laboratorio
path = /mnt/samba/lab_smb
browsable = yes
available = yes
writable = yes
[LABORATORIO_SMB]
comment = Cartella Laboratorio Sassuolo
path = /mnt/samba/laboratorio_smb
force group = laboratorio
read only = No

It looks to me like you have multiple smb.conf files and you're editing
the one the system is not using. Your last testparm still shows
a "force group" parameter but there is none listed in your share
definition. Also "available" is on by default, one less parameter you
can drop to make it all more readable.

[Luca Ferrari]

Post by Chris Smith
It looks to me like you have multiple smb.conf files and you're editing
the one the system is not using. Your last testparm still shows
a "force group" parameter but there is none listed in your share
definition. Also "available" is on by default, one less parameter you
can drop to make it all more readable.

I found the problem....you were almost right, except it was not another
smb.conf file, but the same share defined twice in the file. Removed one of
the definiton and now everything works!

Thanks,
Luca