[Samba] Users can Read but not Write / Delete Files

[Gary Dale]

One possible problem is the actual file permissions on the server. I 
think Samba expects to see the files wide open so that Samba/Winbind can 
implement the Windows permissions properly without running afoul of Unix 
permissions.

I recognize that this doesn't fit the way the problem developed, but the 
symptoms match. :)


Michael Casale wrote:
> Hi All,
>
>  
>
> Hi All,
>
> Here is a situation where everyone can read to, but not write to or
> delete, the shares on our Samba server: 
>  
> We moved the file server a few weeks ago - split off some files to a new
> Windows file server - and users could read but not write files to the
> old Samba server after it was renamed (SAN to OLDSAN). It turned out
> SELinux was running, which I disabled, rebooted, and all worked well.
>
>  
>
> Now I've been patching our domain controllers and the same thing
> happened. I assumed I installed the "magic patch" on a domain
> controller.  All users can read the files they are supposed to, but no
> one, including the admin (me), can write to or delete files. In other
> words, the same as before, but I checked, and selinux is still disabled.
>
>  
>
> I tried deleting and re-creating the server's computer object in the
> Windows 2003 Active Directory  - same problem.
>
>  
>
> Has anyone seen this problem? Can anyone shed any light on this?
>
>  
>
> Here is our setup:
>
>  
>
> Red Hat Enterprise Linux AS kernel 2.6.9-5.EL
>
>  
>
> Samba Version: 3.0.10-1.4E
>
>  
>
> Running in AD Security Mode.
>
>  
>
> Not running as a domain controller
>
> Not running as a WINS server.
>
>  
>
> Thanks for all and any help!
>
>  
>
> Mike Casale
>
>  
>
> Here is our smb.conf file:
>
>  
>
> #======================= Global Settings
> =====================================
>
> [global]
>
>  
>
>    workgroup = NYC-14
>
>    netbios name = OLDSAN
>
> # the following changed to adapt to Win2003 MC 19Nov06:
>
> client schannel = no
>
> client use spnego = no 
>
> server signing = auto
>
>    server string = OLD SAN
>
>  
>
>    printcap name = /etc/printcap
>
>    load printers = no
>
>  
>
> cups options = raw
>
>  
>
>  log file = /var/log/samba/%m.log
>
>    max log size = 50
>
>  
>
>    security = ads
>
>    realm = NYC-14.KNOA.COM 
>
>    password server = 192.168.14.243 
>
>  
>
>  
>
>   encrypt passwords = yes
>
>  
>
>  
>
>    socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
>
>  
>
>    wins server = 192.168.14.243
>
>  
>
>    dns proxy = no 
>
>  
>
>    idmap uid = 10000-20000
>
>    idmap gid = 10000-20000
>
>    ;winbind separator = \ 
>
>    winbind enum users = yes
>
>    winbind enum groups = yes
>
>    template shell = /bin/false
>
>    winbind use default domain = yes
>
>  
>
> #============================ Share Definitions
> ==============================
>
> # backup depository
>
> [backup]
>
>   comment = Backup Repository
>
>   force create mode = 0777
>
>   force directory mode = 6777
>
>   path = /mnt/data/backup
>
>   browseable = no
>
>   writable = yes
>
>   valid users = NYC-14\backup, NYC-14\mcasale, NYC-14\administrator,
> NYC-14\sys_bak, NYC-14\PDS$, NYC-14\RDS$, NYC-14\MXS$, "NYC-14\Domain
> Admins"
>
>  
>
>  
>
> # bulk data storage for Development
>
> [bulk]
>
>   browsable = no
>
>   force create mode = 0777
>
>   force directory mode = 6777
>
>   path = /mnt/data/bulk
>
>   writable = yes
>
>   guest ok = yes
>
>  
>
> # clients data
>
> [Clients]
>
>   browsable = yes
>
>   comment = Clients of Knoa Software
>
>   inherit permissions = yes
>
>   path = /mnt/data/clients
>
>   valid users = NYC-14\mcasale, NYC-14\Staff, NYC-14\Extranet,
> NYC-14\administrator, "NYC-14\Domain Admins"
>
>   writable = yes
>
>  
>
> # Engineering signing keys
>
> [CSPDID]
>
>   browseable = no
>
>   # access to this share is controled via valid users list 
>
>   force create mode = 0777
>
>   force directory mode = 6777
>
>   path = /mnt/data/cspdid
>
>   valid users = NYC-14\mcasale, NYC-14\zkopytnik, NYC-14\drayna,
> NYC-14\plui, NYC-14\mkrosky, NYC-14\Administrator, "NYC-14\Domain
> Admins"
>
>   writable = yes
>
>  
>
> # file share for all company departments
>
> [Company]
>
>    comment = Departamental File Share
>
>    browseable = yes
>
>    inherit permissions = yes
>
> #   force create mode = 0777
>
> #   force directory mode = 6777
>
>    path = /mnt/data/company
>
>    valid users = NYC-14\Staff, NYC-14\tester, NYC-14\Administrator,
> "NYC-14\Domain Admins"
>
>    writable = yes
>
>    inherit permissions = yes
>
>  
>
> # image depository
>
> [image]
>
>    comment = Disk Image Repository
>
>    path = /mnt/data/image
>
>    browseable = no
>
>    write list = NYC-14\mcasale, NYC-14\Administrator, "NYC-14\Domain
> Admins"
>
>  
>
> # intranet site files for access by the Intranet server VMC
>
> [intranet]
>
>   path = "/mnt/data/company/Web Development/Intranet"
>
>   browsable = no
>
>   guest ok = yes
>
> #  valid users = NYC-14\sys_web, NYC-14\vmc$
>
>  
>
> # server root - for backup only
>
> [home]
>
>    path = /mnt/data
>
>    valid users = NYC-14\Services, root, NYC-14\Administrator,
> "NYC-14\Domain Admins" NYC-14\mcasale
>
>    browseable = no
>
>  
>
> # software library
>
> [Software]
>
>   comment = Software Library
>
>   force create mode = 0007
>
>   force directory mode = 0007
>
>   path = /mnt/data/software
>
>   valid users = NYC-14\Staff, NYC-14\Administrator, NYC-14\mcasale
>
>   write list = NYC-14\Staff, NYC-14\Administrator, "NYC-14\Domain
> Admins", NYC-14\mcasale
>
>  
>
> [VSS]
>
>   browseable = no
>
>   comment = Visual Source Safe
>
>   create mask = 0666
>
>   directory mask = 0777
>
>   path = /mnt/data/vss
>
>   valid users = NYC-14\Staff, NYC-14\tester, NYC-14\Administrator,
> "NYC-14\Domain Admins"
>
>   writable = yes
>
>  
>
> # Users - public files of staff members
>
> [Users]
>
>    comment = Personal File Repositories
>
> #   create mask = 0666
>
> #   directory mask = 0777
>
>    path = /mnt/data/profiles/public
>
>    valid users = NYC-14\Staff, NYC-14\administrator, "NYC-14\Domain
> Admins"
>
>    writable = yes
>
>    browseable = yes
>
> #   inherit permissions = yes
>
>  
>
> # user profiles
>
> [%U]
>
>    path = /mnt/data/profiles/%U
>
>    create mask = 0666
>
>    directory mask = 0777
>
>    valid users = NYC-14\%U, "NYC-14\Domain Admins"
>
>    writable = yes
>
>    browseable = no
>
>    inherit permissions = yes
>
>  
>
> # Public Directory
>
> [Public]
>
> path = /mnt/data/profiles/public
>
> #create mask = 0007
>
> #directory mask = 0007
>
> #valid users = NYC-14\Staff
>
> writable = yes
>
> browseable = yes
>
> inherit permissions = yes
>
>  
>
> # Test Users Directory
>
> [Users2]
>
> path = /mnt/data/users
>
> #create mask = 0666
>
> #directory mask = 0777
>
> valid users = NYC-14\Staff
>
> writeable = yes
>
> browseable = no
>
> inherit permissions = yes
>
>  
>
> And here is our Kerberos file krb5.conf:
>
>  
>
> [logging]
>
>  default = FILE:/var/log/krb5libs.log
>
>  kdc = FILE:/var/log/krb5kdc.log
>
>  admin_server = FILE:/var/log/kadmind.log
>
>  
>
> [libdefaults]
>
>  default_realm = NYC-14.KNOA.COM
>
>  dns_lookup_realm = true
>
>  dns_lookup_kdc = true
>
>  
>
> [realms]
>
>  NYC-14.KNOA.COM = {
>
>   kdc = credo.nyc-14.knoa.com:88
>
> #  kdc = mxs.nyc-14.knoa.com:88
>
>   admin_server = credo.nyc-14.knoa.com:749
>
> #  admin_server = mxs.nyc-14.knoa.com:749
>
>   default_domain = nyc-14.knoa.com
>
>  }
>
>  
>
> [domain_realm]
>
>  .nyc-14.knoa.com = NYC-14.KNOA.COM
>
>  nyc-14.knoa.com = NYC-14.KNOA.COM
>
>  
>
> [kdc]
>
>  profile = /var/kerberos/krb5kdc/kdc.conf
>
>  
>
> [appdefaults]
>
>  pam = {
>
>    debug = false
>
>    ticket_lifetime = 36000
>
>    renew_lifetime = 36000
>
>    forwardable = true
>
>    krb4_convert = false
>
>  }
>
>  
>
>  
>
> ________________________________
>
> Michael Andrew Casale
>
> Information Technology Manager  | Knoa Software, Inc
>
> 5 Union Square West | New York | New York | 10003
>
> t: 212.807.9608 x 6000 | m: 352-359-1797 | f: 212.675.6121
>
>
>
> www.knoa.com 
>
>
>