Samba file sharing scenario:
• 3 private shares
• Each mapped to one user only
• Force ownership of all files to that user
• 1 public share (read/write for everyone)
• No interactive login allowed
1. Install Samba:
sudo apt update
sudo apt install samba
1a. Enable service:
sudo systemctl enable smbd
sudo systemctl start smbd
2. Create a base directory:
sudo mkdir -p /srv/samba/{user1,user2,user3,public}
3. Create Non-Login System Users
• Disable shell access
• Disable home directory creation
sudo useradd -M -s /usr/sbin/nologin user1
sudo useradd -M -s /usr/sbin/nologin user2
sudo useradd -M -s /usr/sbin/nologin user3
3a. Verify:
getent passwd user1
3b. You should see:
user1:x:1001:1001::/home/user1:/usr/sbin/nologin
✔ Cannot SSH
✔ Cannot log in locally
Public Folder:
Create a shared group:
sudo groupadd smbpublic
sudo usermod -aG smbpublic user1
sudo usermod -aG smbpublic user2
sudo usermod -aG smbpublic user3
Set ownership:
sudo chown root:smbpublic /srv/samba/public
sudo chmod 2775 /srv/samba/public
Explanation:
• 2 sets the SGID bit
• New files inherit group smbpublic
• 775 allows group write
5. Add Samba Passwords
sudo smbpasswd -a user1
sudo smbpasswd -a user2
sudo smbpasswd -a user3
5a. Enable them:
sudo smbpasswd -e user1
sudo smbpasswd -e user2
sudo smbpasswd -e user3
6. Configure Samba
sudo nano /etc/samba/smb.conf
6a. Ensure in [global] section:
security = user
map to guest = never
6b. Private Shares (Ownership Forced). Add:
[user1]
path = /srv/samba/user1
valid users = user1
read only = no
browseable = yes
force user = user1
create mask = 0600
directory mask = 0700
[user2]
path = /srv/samba/user2
valid users = user2
read only = no
browseable = yes
force user = user2
create mask = 0600
directory mask = 0700
[user3]
path = /srv/samba/user3
valid users = user3
read only = no
browseable = yes
force user = user3
create mask = 0600
directory mask = 0700
✔ force user ensures all files are owned by that user
✔ Even if accessed from Windows as that user
7. Public Share. Add:
[public]
path = /srv/samba/public
valid users = @smbpublic
read only = no
browseable = yes
force group = smbpublic
create mask = 0664
directory mask = 2775
Explanation:
• Any authenticated user in smbpublic can read/write
• Group ownership is forced
• SGID keeps group consistent
8. Test Configuration
sudo testparm
If no errors:
sudo systemctl restart smbd
9. Firewall (if enabled)
sudo ufw allow samba
10. What You Now Have:
Share Access Ownership Behavior
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
user1 user1 only All files owned by user1
user2 user2 only All files owned by user2
user3 user3 only All files owned by user3
public All users Group-owned, shared
✔ No SSH login
✔ No shell access
✔ Clean forced ownership
✔ Proper group inheritance
Comments
0 B
|👍
/👎
0 B
|👍
/👎
0 B
|👍
/👎
0 B
|👍
/👎
0 B
|👍
/👎
0 B
|👍
/👎
0 B
|👍
/👎
0 B
|👍
/👎
0 B
|👍
/👎
0 B
|👍
/👎
0 B
|0 👍
/0 👎
0 B
|👍
/👎
0 B
|👍
/👎