{"id":56,"date":"2010-01-19T05:57:49","date_gmt":"2010-01-19T05:57:49","guid":{"rendered":"http:\/\/poojanwagh.opalstacked.com\/techblog\/?p=56"},"modified":"2011-02-01T04:03:06","modified_gmt":"2011-02-01T04:03:06","slug":"sharing-samba-shares-between-users","status":"publish","type":"post","link":"https:\/\/tech.poojanblog.com\/blog\/unix-linux\/sharing-samba-shares-between-users\/","title":{"rendered":"Sharing Samba shares between users"},"content":{"rendered":"

Update 2<\/h3>\n

The path should look like so:
\n
\n[homes]
\n comment = Home Directories
\n browseable = no
\n writable = yes
\n path = \/tank\/Users\/%S
\n<\/code>
\nNote the capital %S<\/code>.<\/p>\n

Update<\/h3>\n

I found the answer to why the [home]<\/code> share definition seemed to be screwed up. Basically, according to the smb.conf man page<\/a>, %u<\/code> maps to username, while %s<\/code> maps to “service”. So, when I tried to access \\\\server\\Public<\/code>, the [home]<\/code> directive gets matched because Public<\/code> is a valid Samba user on the server. Samba then tries to figure out what directory this share should map to, and finds its definition is \/tank\/Users\/%u<\/code>. Well, %u<\/code> gets expanded as Poojan<\/code>, so it says that \\\\server\\Public<\/code> maps to \/tank\/Users\/Poojan<\/code> (as does \\\\server\\Poojan<\/code>). Instead, if I define the path as \/tank\/Users\/%s<\/code>, the directory gets expanded to \/tank\/Users\/Public<\/code>, because Public<\/code> is the share being requested. And that’s what I want.<\/p>\n

Original Post<\/h3>\n

I wanted to create per-user Samba shares on my file server<\/a>. In addition (similar to Vista\/Windows 7 setup), I wanted to create a Public<\/code> directory. I thought (rather naively) that I could just add Public<\/code> as another user. I did so with the following entry in smb.conf:
\n
\n[homes]
\ncomment = Home Directories
\nbrowseable = no
\nwritable = yes
\npath = \/tank\/Users\/%u
\n<\/code>
\nWhat’s weird is that I could log in and access \\\\server\\Public\\Documents<\/code> (for example), but what I’d see was identical to \\\\server\\Poojan\\Documents[cci] ([cci]Poojan<\/code> being my username). I found a few references that said the correct incantation is:<\/p>\n


\n[homes]
\ncomment = Home Directories
\nbrowseable = no
\nwritable = yes
\npath = \/tank\/Users\/%S
\nvalid users = %S
\n<\/code>
\nThis seemed to work–except I still couldn’t access the share. Apparently, the %S maps to the current user, not just any user (I still haven’t exactly figured this out).
\nUnfortunately, Windows CIFS\/SMB protocol doesn’t allow one to log in to another machine under two different credentials. So, I couldn’t (for example) connect to the server under the credentials Poojan<\/code> and then access a share with the username Public<\/code>. I had a few options here: I could remove the valid users = %S<\/code> directive, which meant that anyone could access the shares. Or, I could rely on UNIX group permissions. I decided to go the latter route. I didn’t want (for example) my kids to delete files in this share, as it contains some important stuff that both my wife and I should have access to. (I say should, because my wife has better things to do than to look up our 2004 tax return.)
\nSo, I created the following entry:<\/p>\n


\n[Public]
\ncomment = Public (user-wide) directories
\nbrowseable = yes
\nwriteable = no
\npath = \/tank\/Users\/Public
\nwrite list = Poojan, Wife
\ncreate mask = 0770
\ndirectory mask = 0770
\n<\/code>
\nWhat’s weird is that I still couldn’t access the share. As it turned out, the [home]<\/code> section took precedence. In order to stop the [home]<\/code> directive from mapping a share to \/tank\/Users\/%S<\/code>, I had to delete the Samba user Public:
\n
\nsmbpasswd -x Public
\n<\/code>
\nIt wasn’t enough to disable (smbpasswd -d<\/code>) the Public<\/code> user. Another thing I found (on FreeBSD at least) is that if you delete the UNIX user, you can’t then delete the Samba user; smbpasswd<\/code> complains that the user database is corrupt because the Samba user exists but the UNIX user does not.
\nAs far as the UNIX groups, etc., I created a UNIX group called Users<\/code> to house the entire family. The UNIX directory \/tank\/Users\/Public<\/code> has the group set to Users<\/code>. So, only members of the group can read\/write (at the UNIX) level, and only the wife and I can write at the Samba level.<\/p>\n