samba digest, Vol 1 #12 - 20 msgs

[Gary Algier]

Onno Zweers <onno at verweij.com> wrote:
> Message: 17
> Date:   Mon, 28 Aug 2000 16:49:39 +0200
> To: samba at samba.org
> From: Onno Zweers <onno at verweij.com>
> Subject: Making a share visible only to members of a group
> 
> Hi all (and hopefully also someone of the samba team),
> 
> I want a shared directory to be visible only to the members of a group, and
> to no one else. Instead, a shared directory is either visible to everyone
> (browseable=yes) or to no-one (browseable=no). When a non-authorised user
> enters the shared directory, she gets an error message. That's good. But
> since the user cannot use the share anyway, I want her not to see the share
> in the list.
> 
> In the newsgroup comp.protocols.smb they told me it was not possible. I
> have considered using a clever "include" statement, but it seems not
> possible to make an include depend on user ID. In the FAQ, the HowTo en the
> man pages I found no solution, and not even a mention of this problem.
[snip]

Yes, indeed this is possible.  We use it all the time here.  In our case,
we have something like:
-------------------------------------------------------------------------
In /etc/samba/smb.conf:

    [global]
        ...
    [homes]
        ...

    include = /etc/samba/smb.conf.group-%G
    include = /etc/samba/smb.conf.user-%U

------------------
In /etc/samba/smb.conf.group-it:
    [group]
        comment = /u/it/group -- Group Only Share
        path = /u/it/group
        writable = yes
        browsable = yes
    ; only members may write:
        write list = @it
    ; only members force groupness:
        force group = +it
    ; only members may connect:
        valid users = +it
    ; make everything group writable, DON'T let others see:
    ; (also set group-id bit)
        force directory mode = 02770
        force create mode = 0770
        directory mask = 02770
        create mask = 0770

    [public]
        comment = /u/it/public -- Publicly Readable Share
        path = /u/it/public
        writable = yes
        browsable = yes
    ; only members may write:
        write list = @it
    ; only members force groupness:
        force group = +it
    ; only members may connect:
        valid users = +it
    ; make everything group writable, DO let others see:
    ; (also set group-id bit)
        force directory mode = 02775
        force create mode = 0775
        directory mask = 02775
        create mask = 0775
-------------------------------------------------------------------------

Note that you can only use %G and %U.  You can't use %g. So therefore,
you can only make this happen on the primary group.  We use the second
include file to handle odd cases where we want something visible to
a small set of people that cross group boundaries.  The include file
called "smb.conf.user-gaa", for instance, might then have just the
statement:
	include = /etc/sambe/smb.conf.group-special
I try not to tell anyone about this because it could become a mess as
people want to create all possible combinations.  This is what ACLs
are for, not this mechanism.

> Onno
> --
> Onno Zweers, automatisering      mailto:onno at verweij.com
> Verweij Fashion BV                http://www.verweij.com
> 

-- 
Gary Algier, WB2FWZ       gary.algier at ulticom.com           +1 856 787 2758
Ulticom Inc., 1020 Briggs Rd, Mt. Laurel, NJ 08054      Fax:+1 856 866 2033

            This space intentionally left blank by the censors.