[Samba] Force Create Mode Problems
Eric Krause
ekrause at ringsidecreative.com
Tue Jun 21 18:21:27 UTC 2016
Rowland,
Thanks for your input. Per your suggestions, I have changed the global options in my configuration:
[global]
netbios name = FS04
workgroup = RSC
server string = Samba Server Version %v
security = ads
realm = AD.RINGSIDECREATIVE.COM
use sendfile = true
idmap config * : backend = tdb
idmap config * : range = 200000-299999
idmap config RSC : backend = rid
idmap config RSC : range = 100000-199999
winbind separator = +
winbind enum users = yes
winbind enum groups = yes
winbind use default domain = yes
winbind refresh tickets = yes
restrict anonymous = 2
log file = /var/log/samba/log.%m
max log size = 50
I then reloaded the samba service (systemctl restart smb) However, I still get the same problems when creating a file from a windows machine.
I appreciate the suggestion about using Windows ACLs. However, I think that doing so would also require a reengineering of the FTP side of this server. I'd like for the server to function without the use of Windows ACLs, if possible.
Are there any logs that I can provide that will assist with troubleshooting this issue? I have looked through the logs in /var/log/samba, but I haven't found very much useful information.
Let me know. Thanks.
-----Original Message-----
From: samba [mailto:samba-bounces at lists.samba.org] On Behalf Of Rowland penny
Sent: Tuesday, June 21, 2016 1:23 PM
To: samba at lists.samba.org
Subject: Re: [Samba] Force Create Mode Problems
On 21/06/16 17:31, Eric Krause wrote:
> Hi there. I am using Samba 4.2.10 on Scientific Linux 7.1.
>
> I am currently trying to make an SMB share that is accessible to all of our Active Directory domain users. Additionally, this share needs to allow read/write access for our clients, who are using FTP. All of the subdirectories for this share represent an individual FTP user's folder.
>
> The share is named "ftpshares". The problem that I am currently having with this share is that I cannot seem to get the "force create mode" setting to perform as expected. I would like it to force 0766 to the share, its subdirectories, and the files created within. However, when I look at a file that was created from a windows machine, these are the permissions that I see:
>
> -rwxrwx-w-+ 1 root domain users 0 Jun 21 12:26 test.txt
>
> This is a problem, as FTP users can only write to the file. This seems like a really strange behavior. I have posted my smb.conf for your review. Any help you can give me would be greatly appreciated.
>
> # This is the main Samba configuration file. For detailed information
> about the # options listed here, refer to the smb.conf(5) manual page.
> Samba has a huge # number of configurable options, most of which are not shown in this example.
> #
> # The Official Samba 3.2.x HOWTO and Reference Guide contains
> step-by-step # guides for installing, configuring, and using Samba:
> # http://www.samba.org/samba/docs/Samba-HOWTO-Collection.pdf
> #
> # The Samba-3 by Example guide has working examples for smb.conf. This
> guide is # generated daily:
> http://www.samba.org/samba/docs/Samba-Guide.pdf
> #
> # In this file, lines starting with a semicolon (;) or a hash (#) are
> # comments and are ignored. This file uses hashes to denote commentary
> and # semicolons for parts of the file you may wish to configure.
> #
> # Note: Run the "testparm" command after modifying this file to check
> for basic # syntax errors.
> #
> #---------------
> # Security-Enhanced Linux (SELinux) Notes:
> #
> # Turn the samba_domain_controller Boolean on to allow Samba to use
> the useradd # and groupadd family of binaries. Run the following
> command as the root user to # turn this Boolean on:
> # setsebool -P samba_domain_controller on # # Turn the
> samba_enable_home_dirs Boolean on if you want to share home #
> directories via Samba. Run the following command as the root user to
> turn this # Boolean on:
> # setsebool -P samba_enable_home_dirs on # # If you create a new
> directory, such as a new top-level directory, label it # with
> samba_share_t so that SELinux allows Samba to read and write to it. Do
> # not label system directories, such as /etc/ and /home/, with
> samba_share_t, as # such directories should already have an SELinux label.
> #
> # Run the "ls -ldZ /path/to/directory" command to view the current
> SELinux # label for a given directory.
> #
> # Set SELinux labels only on files and directories you have created.
> Use the # chcon command to temporarily change a label:
> # chcon -t samba_share_t /path/to/directory # # Changes made via chcon
> are lost when the file system is relabeled or commands # such as
> restorecon are run.
> #
> # Use the samba_export_all_ro or samba_export_all_rw Boolean to share
> system # directories. To share such directories and only allow read-only permissions:
> # setsebool -P samba_export_all_ro on
> # To share such directories and allow read and write permissions:
> # setsebool -P samba_export_all_rw on
> #
> # To run scripts (preexec/root prexec/print command/...), copy them to
> the # /var/lib/samba/scripts/ directory so that SELinux will allow smbd to run them.
> # Note that if you move the scripts to /var/lib/samba/scripts/, they
> retain # their existing SELinux labels, which may be labels that
> SELinux does not allow # smbd to run. Copying the scripts will result in the correct SELinux labels.
> # Run the "restorecon -R -v /var/lib/samba/scripts" command as the
> root user to # apply the correct SELinux labels to these files.
> #
> #--------------
> #
> #======================= Global Settings
> =====================================
>
> [global]
> netbios name = FS04
> workgroup = RSC
> server string = Samba Server Version %v
> security = ads
> realm = AD.RINGSIDECREATIVE.COM
> socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=131072 SO_SNDBUF=131072
> use sendfile = true
> idmap config * : backend = tdb
> idmap config * : range = 100000-199999
> idmap config RSC : backend = rid
> idmap config RSC : range = 100000-199999
> winbind separator = +
> winbind enum users = yes
> winbind enum groups = yes
> winbind use default domain = yes
> winbind refresh tickets = yes
> restrict anonymous = 2
> log file = /var/log/samba/log.%m
> max log size = 50
>
> # ----------------------- Network-Related Options
> ------------------------- # # workgroup = the Windows NT domain name
> or workgroup name, for example, MYGROUP.
> #
> # server string = the equivalent of the Windows NT Description field.
> #
> # netbios name = used to specify a server name that is not tied to the hostname.
> #
> # interfaces = used to configure Samba to listen on multiple network interfaces.
> # If you have multiple interfaces, you can use the "interfaces ="
> option to # configure which of those interfaces Samba listens on.
> Never omit the localhost # interface (lo).
> #
> # hosts allow = the hosts allowed to connect. This option can also be
> used on a # per-share basis.
> #
> # hosts deny = the hosts not allowed to connect. This option can also
> be used on # a per-share basis.
> #
> # max protocol = used to define the supported protocol. The default is
> NT1. You # can set it to SMB2 if you want experimental SMB2 support.
> #
> ; workgroup = RSC
> ; netbios name = FS04
>
> ; interfaces = lo eth0 192.168.12.2/24 192.168.13.2/24
> ; hosts allow = 127. 192.168.12. 192.168.13.
>
> ; max protocol = SMB2
>
> # --------------------------- Logging Options
> ----------------------------- # # log file = specify where log files
> are written to and how they are split.
> #
> # max log size = specify the maximum size log files are allowed to
> reach. Log # files are rotated when they reach the size specified with "max log size".
> #
>
> # log files split per-machine:
> # maximum size of 50KB per log file, then rotate:
>
> # ----------------------- Standalone Server Options
> ------------------------ # # security = the mode Samba runs in. This
> can be set to user, share # (deprecated), or server (deprecated).
> #
> # passdb backend = the backend used to store user information in. New
> # installations should use either tdbsam or ldapsam. No additional
> configuration # is required for tdbsam. The "smbpasswd" utility is
> available for backwards # compatibility.
> #
>
>
>
> # ----------------------- Domain Members Options
> ------------------------ # # security = must be set to domain or ads.
> #
> # passdb backend = the backend used to store user information in. New
> # installations should use either tdbsam or ldapsam. No additional
> configuration # is required for tdbsam. The "smbpasswd" utility is
> available for backwards # compatibility.
> #
> # realm = only use the realm option when the "security = ads" option is set.
> # The realm option specifies the Active Directory realm the host is a part of.
> #
> # password server = only use this option when the "security = server"
> # option is set, or if you cannot use DNS to locate a Domain
> Controller. The # argument list can include My_PDC_Name, [My_BDC_Name], and [My_Next_BDC_Name]:
> #
> # password server = My_PDC_Name [My_BDC_Name] [My_Next_BDC_Name] # #
> Use "password server = *" to automatically locate Domain Controllers.
>
> ; security = domain
> ; passdb backend = tdbsam
> ; realm = MY_REALM
>
> ; password server = <NT-Server-Name>
>
> # ----------------------- Domain Controller Options
> ------------------------ # # security = must be set to user for domain
> controllers.
> #
> # passdb backend = the backend used to store user information in. New
> # installations should use either tdbsam or ldapsam. No additional
> configuration # is required for tdbsam. The "smbpasswd" utility is
> available for backwards # compatibility.
> #
> # domain master = specifies Samba to be the Domain Master Browser,
> allowing # Samba to collate browse lists between subnets. Do not use the "domain master"
> # option if you already have a Windows NT domain controller performing this task.
> #
> # domain logons = allows Samba to provide a network logon service for
> Windows # workstations.
> #
> # logon script = specifies a script to run at login time on the
> client. These # scripts must be provided in a share named NETLOGON.
> #
> # logon path = specifies (with a UNC path) where user profiles are stored.
> #
> #
> ; security = user
> ; passdb backend = tdbsam
>
> ; domain master = yes
> ; domain logons = yes
>
> # the following login script name is determined by the machine name
> # (%m):
> ; logon script = %m.bat
> # the following login script name is determined by the UNIX user used:
> ; logon script = %u.bat
> ; logon path = \\%L\Profiles\%u
> # use an empty path to disable profile support:
> ; logon path =
>
> # various scripts can be used on a domain controller or a stand-alone
> # machine to add or delete corresponding UNIX accounts:
>
> ; add user script = /usr/sbin/useradd "%u" -n -g users
> ; add group script = /usr/sbin/groupadd "%g"
> ; add machine script = /usr/sbin/useradd -n -c "Workstation (%u)" -M -d /nohome -s /bin/false "%u"
> ; delete user script = /usr/sbin/userdel "%u"
> ; delete user from group script = /usr/sbin/userdel "%u" "%g"
> ; delete group script = /usr/sbin/groupdel "%g"
>
>
> # ----------------------- Browser Control Options
> ---------------------------- # # local master = when set to no, Samba
> does not become the master browser on # your network. When set to yes,
> normal election rules apply.
> #
> # os level = determines the precedence the server has in master
> browser # elections. The default value should be reasonable.
> #
> # preferred master = when set to yes, Samba forces a local browser
> election at # start up (and gives itself a slightly higher chance of winning the election).
> #
> ; local master = no
> ; os level = 33
> ; preferred master = yes
>
> #----------------------------- Name Resolution
> ------------------------------- # # This section details the support
> for the Windows Internet Name Service (WINS).
> #
> # Note: Samba can be either a WINS server or a WINS client, but not both.
> #
> # wins support = when set to yes, the NMBD component of Samba enables
> its WINS # server.
> #
> # wins server = tells the NMBD component of Samba to be a WINS client.
> #
> # wins proxy = when set to yes, Samba answers name resolution queries
> on behalf # of a non WINS capable client. For this to work, there must
> be at least one # WINS server on the network. The default is no.
> #
> # dns proxy = when set to yes, Samba attempts to resolve NetBIOS names
> via DNS # nslookups.
>
> ; wins support = yes
> ; wins server = w.x.y.z
> ; wins proxy = yes
>
> ; dns proxy = yes
>
> # --------------------------- Printing Options
> ----------------------------- # # The options in this section allow
> you to configure a non-default printing # system.
> #
> # load printers = when set you yes, the list of printers is
> automatically # loaded, rather than setting them up individually.
> #
> # cups options = allows you to pass options to the CUPS library.
> Setting this # option to raw, for example, allows you to use drivers on your Windows clients.
> #
> # printcap name = used to specify an alternative printcap file.
> #
>
>
> ; printcap name = /etc/printcap
> # obtain a list of printers automatically on UNIX System V systems:
> ; printcap name = lpstat
> ; printing = cups
>
> # --------------------------- File System Options
> --------------------------- # # The options in this section can be
> un-commented if the file system supports # extended attributes, and
> those attributes are enabled (usually via the # "user_xattr" mount
> option). These options allow the administrator to specify # that DOS
> attributes are stored in extended attributes and also make sure that #
> Samba does not change the permission bits.
> #
> # Note: These options can be used on a per-share basis. Setting them
> globally # (in the [global] section) makes them the default for all shares.
>
> ; map archive = no
> ; map hidden = no
> ; map read only = no
> ; map system = no
> ; store dos attributes = yes
>
>
> #============================ Share Definitions
> ==============================
>
> ;[homes]
> ; comment = Home Directories
> ; browseable = no
> ; writable = yes
> ; valid users = %S
> ; valid users = MYDOMAIN\%S
>
> [printers]
> comment = All Printers
> path = /var/spool/samba
> browseable = no
> guest ok = no
> writable = no
> printable = yes
>
> # Un-comment the following and create the netlogon directory for Domain Logons:
> ; [netlogon]
> ; comment = Network Logon Service
> ; path = /var/lib/samba/netlogon
> ; guest ok = yes
> ; writable = no
> ; share modes = no
>
> # Un-comment the following to provide a specific roving profile share.
> # The default is to use the user's home directory:
> ; [Profiles]
> ; path = /var/lib/samba/profiles
> ; browseable = no
> ; guest ok = yes
>
> # A publicly accessible directory that is read only, except for users
> in the # "staff" group (which have write permissions):
> ; [public]
> ; comment = Public Stuff
> ; path = /home/samba
> ; public = yes
> ; writable = yes
> ; printable = no
> ; write list = +staff
>
> [ftpshares]
> writeable = yes
> admin users = @"RSC+Domain Admins"
> path = /mnt/fs/ftps
> write list = "Domain Users",@"Domain Users"
> valid users = "Domain Users",@"Domain Users"
> force create mode = 0766
> browsable = yes
> force directory mode = 0766
>
> eric krause | network engineer
> ringside.cutters.flavor.picnic.moonlink
>
> 248 548 2500 w
> 248 217 3782 c
>
> ringsidecreative.com
>
> <http://ringsidecreative.com/>
Wouldn't you be better setting the permissions from windows ?
See here for more info:
https://wiki.samba.org/index.php/Shares_with_Windows_ACLs
Having said that, there are a couple of things in your smb.conf that I think you need to look at. Do you really understand what you have set in 'socket options' ? are you sure you need this line ?
Second thing is a definite problem, you have:
idmap config * : range = 100000-199999
and:
idmap config RSC : range = 100000-199999
These ranges are not supposed to overlap, never mind overlap, both your ranges are exactly the same, you need to change one.
Rowland
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
eric krause | network engineer
ringside.cutters.flavor.picnic.moonlink
248 548 2500 w
248 217 3782 c
ringsidecreative.com
<http://ringsidecreative.com/>
More information about the samba
mailing list