Administrace komentářů

Ahoj, důležité je také zmínit nastavení global, jak vedeš účty apod. Samba by měla být ve verzi 4.1, takže ok.
Já mám pod debianem toto nastavení :

[global]

   server string = SMB_Storage_Server
   netbios name = storage
   workgroup = SKUPINA
   server role = standalone server
   #realm = DOMENA.LOCAL
   #server role = active directory domain controller
   #server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl, winbind, ntp_signd, kcc, dnsupdate
   dos charset  = 852
   unix charset = utf8

   client lanman auth = Yes
   wins support = no
   dns proxy = no
   socket options = IPTOS_LOWDELAY TCP_NODELAY
   name resolve order = host #lmhost wins bcast
   interfaces = lo eth0 eth1
   bind interfaces only = yes

   log level = 2
   log file = /var/log/samba/log.%I
   max log size = 1000
   syslog only = no

   passdb backend = tdbsam
   smb passwd file = /etc/samba/smbpasswd
   encrypt passwords = true
   security = user
   obey pam restrictions = yes
   unix password sync = no
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
   pam password change = no

   map to guest = bad password
   invalid users = root
   guest account = nobody

   hosts deny = ALL
   hosts allow = 192.168. 10.0.0. 10.16.3. localhost
   usershare max shares = 100
   usershare allow guests = yes
   max connections = 150

   vfs objects = acl_xattr
   map acl inherit = Yes
   store dos attributes = Yes

   create mask = 0644
   directory mask = 0755
#   level2 oplocks = True
#   read raw = no
#   write cache size = 262144
# mel by se zplepsit vykon :    
#    use sendfile = yes
#    use mmap = no
   smb ports = 139 445


[uzivatel1]
path = /mnt/raid/uzivatel1
valid users = uzivatel1 spravce
public = no
writable = yes
browseable = yes
printable = no
create mask = 0700

[uzivatel2]
path = /mnt/raid/uzivatel2
valid users = uzivatel2 spravce
public = no
writable = yes
browseable = yes
printable = no
create mask = 0700

[verejne]
path = /mnt/raid/verejne
public = true
only guest = yes
writable = yes
browseable = yes
printable = no
directory mask = 0777
create mask = 0777

Tzn., že držím uživatele ve starém formátu tdbsam a uživatele přidávám pomocí "useradd uzivatel1" (do systému) + "smbpasswd -a uzivatel1" (do samby).
Kromě správného nastavení práv na share, je potřeba mít správné nastavení práv na FS.
V poslední řadě ještě existuje "access based enumeration (ABE)", což je volba pro windows share, kdy klienti vidí jen složky, ke kterým mají práva. Složky, ke kterým práva nemají, nevidí. Pak se uživateli tedy nestává, že se snaží vstoupit do složky bez oprávnění a vyhodí mu to chybu. Zároveň uživatel nevidí stovky složek, ale jen ty své, co potřebuje. K tomu by měly sloužit share parametry :

hide unreadable = yes
hide unwriteable files = yes

Zdar Max
PS: toto mám na Archu a též bez problémů :

[global]
        workgroup = DEVAINE
        server string = Samba Server Version %v
        netbios name = DevaineSMB
        # need for netbios informations sharing over the network
        wins support = Yes
        client lanman auth = Yes
        unix extensions = false
        dos charset  = 852
        unix charset = utf8
        domain master = yes

        printcap name = /dev/null
        load printers = no
        disable spoolss = yes
        printing = bsd

        log level = 2
        log file = /var/log/samba/log.%m
        max log size = 50

        interfaces = lo eth0 eth1
        bind interfaces only = true
        dns proxy = no
        write cache size = 2097152
        getwd cache = yes
        min receivefile size = 16384

        # this way samba will not ask for password to connect to the machine
        security = user
        passdb backend = tdbsam
        map to guest = Bad User
        guest account = nobody
        public = yes

#======================= Share Definitions =======================
# my share
        [datastore]
        path = /mnt/datastore
        valid users = max
        writable  = yes
        browsable = yes
        read only = no
        guest ok = no
        public = no
        create mask = 0666
        directory mask = 0777
        force create mode = 0666
        force directory mode = 0777

        [media]
        path = /run/media
        valid users = max
        writable  = no
        browsable = yes
        read only = yes
        guest ok = yes
        public = yes
        create mask = 0666
        directory mask = 0777

# test for everyone share
        [smbtest]
        path = /mnt/datastore/smbtest
#       valid users = admin
        writable  = yes
        browsable = yes
#       read only = yes
        guest ok = yes
        public = yes
        create mask = 0666
        directory mask = 0777
        force create mode = 0666
        force directory mode = 0777