ubuntuusers.de

Hallo zusammen, ich habe bei mir zu Hause Samba eingerichtet und stehe bei der Konfiguration ein bisschen auf dem Schlauch. Es gibt drei User, die Zugriff auf den eigenen Ordner haben sollen. Zusätzlich gibt es den Ordner Austausch, in dem alle Lese- und Schreibrechte haben sollen. Gesetzt ist GID2, sodass theoretisch alle rechte vererbt werden sollten. Das passiert aber nicht. Wenn ich unter Samba einen Ordner anlege sieht das wie folgt aus:

ls -la /mnt/NAS/User/Austausch/
insgesamt 16
drwxrwsrwx+ 4 root root 4096  6. Okt 14:16  .
drwxr-sr-x  6 root root 4096  5. Okt 19:20  ..
drwxrwsrwx+ 2 max  root 4096  6. Okt 12:49  Filme
drwx--S---+ 2 max  root 4096  6. Okt 14:16 'Neuer Ordner'

Ich habe den Ordner Neuer Ordner entsprechend angelegt. Aussehen sollte es wie beim Ordner Filme. So langsam bin ich ratlos.

Anbei meine Samba-Config:

#
# Sample configuration file for the Samba suite for Debian GNU/Linux.
#
#
# This is the main Samba configuration file. You should read the
# smb.conf(5) manual page in order to understand the options listed
# here. Samba has a huge number of configurable options most of which 
# are not shown in this example
#
# Some options that are often worth tuning have been included as
# commented-out examples in this file.
#  - When such options are commented with ";", the proposed setting
#    differs from the default Samba behaviour
#  - When commented with "#", the proposed setting is the default
#    behaviour of Samba but the option is considered important
#    enough to be mentioned here
#
# NOTE: Whenever you modify this file you should run the command
# "testparm" to check that you have not made any basic syntactic 
# errors. 

#======================= Global Settings =======================

[global]
########## Performance tuning ##########

########## Grundlegendes ##########
   workgroup = WORKGROUP
   server string = NAS Server
   netbios name = NAS
   server role = standalone server
   obey pam restrictions = yes
   unix password sync = yes
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
   pam password change = yes
   map to guest = never
########## Logging ##########
   log file = /var/log/samba/log.%m
   max log size = 1000
   logging = file
   panic action = /usr/share/samba/panic-action %d

########## Performance ##########
   server min protocol = SMB2
   server max protocol = SMB3
   aio read size = 1
   aio write size = 1
   use sendfile = yes
#   socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536
#   write cache size = 262144
   max xmit = 65535
   read raw = yes
   write raw = yes
   getwd cache = yes
   min receivefile size = 16384
   use mmap = yes
   strict allocate = yes
   allocation roundup size = 1048576
   server multi channel support = yes
   smb2 leases = yes
 #  smb2 unix extensions = yes

########## Sicherheit ##########
   usershare allow guests = yes
   guest account = nobody

########## Sonstiges ##########
   veto files = /.DS_Store/
   hide unreadable = yes
   hide unwriteable files = yes

########## Logging ##########
   log level = 1
   logging = file

## Browsing/Identification ###

# Change this to the workgroup/NT-domain name your Samba server will part of
   workgroup = WORKGROUP

#### Networking ####

# The specific set of interfaces / networks to bind to
# This can be either the interface name or an IP address/netmask;
# interface names are normally preferred
;   interfaces = 127.0.0.0/8 eth0

# Only bind to the named interfaces and/or networks; you must use the
# 'interfaces' option above to use this.
# It is recommended that you enable this feature if your Samba machine is
# not protected by a firewall or is a firewall itself.  However, this
# option cannot handle dynamic or non-broadcast interfaces correctly.
;   bind interfaces only = yes


#### Debugging/Accounting ####

# This tells Samba to use a separate log file for each machine
# that connects
   log file = /var/log/samba/log.%m

# Cap the size of the individual log files (in KiB).
   max log size = 1000

# We want Samba to only log to /var/log/samba/log.{smbd,nmbd}.
# Append syslog@1 if you want important messages to be sent to syslog too.
   logging = file

# Do something sensible when Samba crashes: mail the admin a backtrace
   panic action = /usr/share/samba/panic-action %d


####### Authentication #######

# Server role. Defines in which mode Samba will operate. Possible
# values are "standalone server", "member server", "classic primary
# domain controller", "classic backup domain controller", "active
# directory domain controller". 
#
# Most people will want "standalone server" or "member server".
# Running as "active directory domain controller" will require first
# running "samba-tool domain provision" to wipe databases and create a
# new domain.
   server role = standalone server

   obey pam restrictions = yes

# This boolean parameter controls whether Samba attempts to sync the Unix
# password with the SMB password when the encrypted SMB password in the
# passdb is changed.
   unix password sync = yes

# For Unix password sync to work on a Debian GNU/Linux system, the following
# parameters must be set (thanks to Ian Kahan <<kahan@informatik.tu-muenchen.de> for
# sending the correct chat script for the passwd program in Debian Sarge).
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .

# This boolean controls whether PAM will be used for password changes
# when requested by an SMB client instead of the program listed in
# 'passwd program'. The default is 'no'.
   pam password change = yes
# This option controls how unsuccessful authentication attempts are mapped
# to anonymous connections
   map to guest = never

########## Domains ###########

#
# The following settings only takes effect if 'server role = classic
# primary domain controller', 'server role = classic backup domain controller'
# or 'domain logons' is set 
#

# It specifies the location of the user's
# profile directory from the client point of view) The following
# required a [profiles] share to be setup on the samba server (see
# below)
;   logon path = \\%N\profiles\%U
# Another common choice is storing the profile in the user's home directory
# (this is Samba's default)
#   logon path = \\%N\%U\profile

# The following setting only takes effect if 'domain logons' is set
# It specifies the location of a user's home directory (from the client
# point of view)
;   logon drive = H:
#   logon home = \\%N\%U

# The following setting only takes effect if 'domain logons' is set
# It specifies the script to run during logon. The script must be stored
# in the [netlogon] share
# NOTE: Must be store in 'DOS' file format convention
;   logon script = logon.cmd

# This allows Unix users to be created on the domain controller via the SAMR
# RPC pipe.  The example command creates a user account with a disabled Unix
# password; please adapt to your needs
; add user script = /usr/sbin/useradd --create-home %u

# This allows machine accounts to be created on the domain controller via the 
# SAMR RPC pipe.  
# The following assumes a "machines" group exists on the system
; add machine script  = /usr/sbin/useradd -g machines -c "%u machine account" -d /var/lib/samba -s /bin/false %u

# This allows Unix groups to be created on the domain controller via the SAMR
# RPC pipe.  
; add group script = /usr/sbin/addgroup --force-badname %g

############ Misc ############

# Using the following line enables you to customise your configuration
# on a per machine basis. The %m gets replaced with the netbios name
# of the machine that is connecting
;   include = /home/samba/etc/smb.conf.%m

# Some defaults for winbind (make sure you're not using the ranges
# for something else.)
;   idmap config * :              backend = tdb
;   idmap config * :              range   = 3000-7999
;   idmap config YOURDOMAINHERE : backend = tdb
;   idmap config YOURDOMAINHERE : range   = 100000-999999
;   template shell = /bin/bash

# Setup usershare options to enable non-root users to share folders
# with the net usershare command.

# Maximum number of usershare. 0 means that usershare is disabled.
#   usershare max shares = 100

# Allow users who've been granted usershare privileges to create
# public shares, not just authenticated ones
   usershare allow guests = yes

#======================= Share Definitions =======================

#[homes]
   comment = Home Directories
   browseable = no
# By default, the home directories are exported read-only. Change the
# next parameter to 'no' if you want to be able to write to them.
   read only = no

# File creation mask is set to 0700 for security reasons. If you want to
# create files with group=rw permissions, set next parameter to 0775.
   create mask = 0700

# Directory creation mask is set to 0700 for security reasons. If you want to
# create dirs. with group=rw permissions, set next parameter to 0775.
   directory mask = 0700

# By default, \\server\username shares can be connected to by anyone
# with access to the samba server.
# The following parameter makes sure that only "username" can connect
# to \\server\username
# This might need tweaking when using external authentication schemes
   valid users = %S

# Un-comment the following and create the netlogon directory for Domain Logons
# (you need to configure Samba to act as a domain controller too.)
;[netlogon]
;   comment = Network Logon Service
;   path = /home/samba/netlogon
;   guest ok = yes
;   read only = yes

# Un-comment the following and create the profiles directory to store
# users profiles (see the "logon path" option above)
# (you need to configure Samba to act as a domain controller too.)
# The path below should be writable by all users so that their
# profile directory may be created the first time they log on
;[profiles]
;   comment = Users profiles
;   path = /home/samba/profiles
;   guest ok = no
;   browseable = no
;   create mask = 0600
;   directory mask = 0700

[printers]
   comment = All Printers
   browseable = no
   path = /var/tmp
   printable = yes
   guest ok = no
   read only = yes
   create mask = 0700

# Windows clients look for this share name as a source of downloadable
# printer drivers
[print$]
   comment = Printer Drivers
   path = /var/lib/samba/printers
   browseable = yes
   read only = yes
   guest ok = no
# Uncomment to allow remote administration of Windows print drivers.
# You may need to replace 'lpadmin' with the name of the group your
# admin users are members of.
# Please note that you also need to set appropriate Unix permissions
# to the drivers directory for these users to have write rights in it
;   write list = root, @lpadmin

[User]
   path = /mnt/NAS/User
   browseable = yes
   read only = no
   guest ok = no
   valid users = max, glory, leoncia
   hide unreadable = yes
   hide unwriteable files = no

[Max]
path = /mnt/NAS/User/Max
browseable = yes
read only = no
valid users = max
force create mode = 0777
force directory mode = 0777
inherit permissions = yes
inherit acls = yes
hide unreadable = no
hide unwriteable files = no
[Glory]
path = /mnt/NAS/User/Glory
browseable = yes
read only = no
valid users = glory
force group = shared_glory
force create mode = 0777
force directory mode = 0777
inherit permissions = yes
inherit acls = yes
hide unreadable = no
hide unwriteable files = no

[Leoncia]
path = /mnt/NAS/User/Leoncia
browseable = yes
read only = no
valid users = leoncia
force create mode = 0777
force directory mode = 0777
inherit permissions = yes
inherit acls = yes
hide unreadable = no
hide unwriteable files = no
[Austausch]
   path = /mnt/NAS/User/Austausch
   browseable = yes
   read only = no
   guest ok = no
   valid users = max, glory, leoncia
force create mask = 0777
   force directory mask = 0777
   inherit permissions = yes
   inherit acls = yes
   hide unreadable = no
hide unwriteable files = no

Über einen heißen Tipp wäre ich echt dankbar. Vielleicht fällt euch ja etwas ein? Danke schon mal.

Du hast die Abschnittsüberschrift [homes] auskommentiert. Mach die mal wieder aktiv ☺

Da du in [homes] schon den Zugriff auf das jeweilige eigene /home generell freigegeben hast, musst du das nicht nochmal extra für jeden Benutzer hinterherschieben.

--ks

Mit welchen Optionen hast du die Freigabe gemountet?

ich verwende die optionen:

options="file_mode=0770,dir_mode=0770,"/-->

Du bräuchtest vermutlich die 0777

Hallo zusammen, danke für eure Antworten. Ich habe ein bisschen herumgespielt und bin der Lösung etwas näher gekommen.

ls -la /mnt/NAS/User/Austausch
insgesamt 328
drwxrwsrwt+ 4 root root   4096  7. Okt 09:21  .
drwxr-xr-x  6 root root   4096  6. Okt 17:29  ..
drwxrwsrwx+ 2 root root   4096  6. Okt 19:57  Filme
drwxrwsrwt+ 2 max  root   4096  7. Okt 09:21 'Neuer Ordner'
-rw-rw-rw-  1 max  root 317292  7. Okt 00:48  yen-bai-province-vietnam-landscape-HD-Wallpaper-1366x768.jpg.part

Ordner werden jetzt richtig angelegt und auch die Gruppe passt. Vorher wurde alles mit max:max geschrieben. Das einzige Problem, dass ich habe ist, dass Dateien nicht ausführbar oder löschbar sind, sondern nur rw-Rechte besitzen. Zusätzlich habe ich das Problem, das beim Kopieren egal in welchen Ordner am Ende des Kopiervorgangs die Meldung kommt, dass die Part-Datei nicht umbenannt werden kann. Das ist ziemlich doof. Ich habe die Vermutung, dass es an irgendeiner Global-Option hakt.

Ich poste mal nochmal die aktuelle Serverconf:

#
# Sample configuration file for the Samba suite for Debian GNU/Linux.
#
#
# This is the main Samba configuration file. You should read the
# smb.conf(5) manual page in order to understand the options listed
# here. Samba has a huge number of configurable options most of which 
# are not shown in this example
#
# Some options that are often worth tuning have been included as
# commented-out examples in this file.
#  - When such options are commented with ";", the proposed setting
#    differs from the default Samba behaviour
#  - When commented with "#", the proposed setting is the default
#    behaviour of Samba but the option is considered important
#    enough to be mentioned here
#
# NOTE: Whenever you modify this file you should run the command
# "testparm" to check that you have not made any basic syntactic 
# errors. 

#======================= Global Settings =======================

#======================= Global Settings =======================

# ================= Global =================
[global]
   workgroup = WORKGROUP
   server string = NAS Server
   netbios name = NAS
   server role = standalone server

   security = user
   map to guest = never
   usershare allow guests = yes
   guest account = nobody

   # ACL und Rechte
   vfs objects = acl_xattr
   acl_xattr:ignore system acls = yes
   inherit permissions = yes
   inherit acls = yes
   map acl inherit = yes
   store dos attributes = yes
   nt acl support = yes
   hide unreadable = yes
   hide unwriteable files = no

   # Protokoll & Performance
                                              
server min protocol = SMB2
   server max protocol = SMB3
   server multi channel support = yes
   smb2 leases = yes
   use sendfile = yes
   strict allocate = yes

   # Logging
   log file = /var/log/samba/log.%m
   max log size = 1000
   log level = 1
   panic action = /usr/share/samba/panic-action %d


#### Networking ####

# The specific set of interfaces / networks to bind to
# This can be either the interface name or an IP address/netmask;
# interface names are normally preferred
;   interfaces = 127.0.0.0/8 eth0

# Only bind to the named interfaces and/or networks; you must use the
# 'interfaces' option above to use this.
# It is recommended that you enable this feature if your Samba machine is
# not protected by a firewall or is a firewall itself.  However, this
# option cannot handle dynamic or non-broadcast interfaces correctly.
;   bind interfaces only = yes



## Browsing/Identification ###

# Change this to the workgroup/NT-domain name your Samba server will part of
   workgroup = WORKGROUP

#### Networking ####

# The specific set of interfaces / networks to bind to
# This can be either the interface name or an IP address/netmask;
# interface names are normally preferred
;   interfaces = 127.0.0.0/8 eth0

# Only bind to the named interfaces and/or networks; you must use the
# 'interfaces' option above to use this.
# It is recommended that you enable this feature if your Samba machine is
# not protected by a firewall or is a firewall itself.  However, this
# option cannot handle dynamic or non-broadcast interfaces correctly.
;   bind interfaces only = yes



#### Debugging/Accounting ####

# This tells Samba to use a separate log file for each machine
# that connects
   log file = /var/log/samba/log.%m

# Cap the size of the individual log files (in KiB).
   max log size = 1000

# We want Samba to only log to /var/log/samba/log.{smbd,nmbd}.
# Append syslog@1 if you want important messages to be sent to syslog too.
   logging = file

# Do something sensible when Samba crashes: mail the admin a backtrace
   panic action = /usr/share/samba/panic-action %d


####### Authentication #######

# Server role. Defines in which mode Samba will operate. Possible
# values are "standalone server", "member server", "classic primary
# domain controller", "classic backup domain controller", "active
# directory domain controller". 
#
# Most people will want "standalone server" or "member server".
# Running as "active directory domain controller" will require first
# running "samba-tool domain provision" to wipe databases and create a
# new domain.
   server role = standalone server

   obey pam restrictions = yes

# For Unix password sync to work on a Debian GNU/Linux system, the following
# parameters must be set (thanks to Ian Kahan <<kahan@informatik.tu-muenchen.de> for
# sending the correct chat script for the passwd program in Debian Sarge).
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .

# This boolean controls whether PAM will be used for password changes
# when requested by an SMB client instead of the program listed in
# 'passwd program'. The default is 'no'.
   pam password change = yes

# This option controls how unsuccessful authentication attempts are mapped
# to anonymous connections
   map to guest = never

########## Domains ###########

#
# The following settings only takes effect if 'server role = classic
# primary domain controller', 'server role = classic backup domain controller'
# or 'domain logons' is set 
#

# It specifies the location of the user's
# profile directory from the client point of view) The following
# required a [profiles] share to be setup on the samba server (see
# below)
;   logon path = \\%N\profiles\%U
# Another common choice is storing the profile in the user's home directory
# (this is Samba's default)
#   logon path = \\%N\%U\profile

# The following setting only takes effect if 'domain logons' is set
# It specifies the location of a user's home directory (from the client
# point of view)
;   logon drive = H:
#   logon home = \\%N\%U

# The following setting only takes effect if 'domain logons' is set
# It specifies the script to run during logon. The script must be stored
# in the [netlogon] share
# NOTE: Must be store in 'DOS' file format convention
;   logon script = logon.cmd

# This allows Unix users to be created on the domain controller via the SAMR
# RPC pipe.  The example command creates a user account with a disabled Unix
# password; please adapt to your needs
; add user script = /usr/sbin/useradd --create-home %u

# This allows machine accounts to be created on the domain controller via the 
# SAMR RPC pipe.  
# The following assumes a "machines" group exists on the system
; add machine script  = /usr/sbin/useradd -g machines -c "%u machine account" -d /var/lib/samba -s /bin/false %u

# This allows Unix groups to be created on the domain controller via the SAMR
# RPC pipe.  
; add group script = /usr/sbin/addgroup --force-badname %g

############ Misc ############

# Using the following line enables you to customise your configuration
# on a per machine basis. The %m gets replaced with the netbios name
# of the machine that is connecting
;   include = /home/samba/etc/smb.conf.%m

# Some defaults for winbind (make sure you're not using the ranges
# for something else.)
;   idmap config * :              backend = tdb
;   idmap config * :              range   = 3000-7999
;   idmap config YOURDOMAINHERE : backend = tdb
;   idmap config YOURDOMAINHERE : range   = 100000-999999
;   template shell = /bin/bash

# Setup usershare options to enable non-root users to share folders
# with the net usershare command.

# Maximum number of usershare. 0 means that usershare is disabled.
#   usershare max shares = 100

# Allow users who've been granted usershare privileges to create
# public shares, not just authenticated ones
   usershare allow guests = yes

#======================= Share Definitions =======================


#[homes]
   comment = Home Directories
   browseable = no
# By default, the home directories are exported read-only. Change the
# next parameter to 'no' if you want to be able to write to them.
   read only = no

# File creation mask is set to 0700 for security reasons. If you want to
# create files with group=rw permissions, set next parameter to 0775.
   create mask = 0700

# Directory creation mask is set to 0700 for security reasons. If you want to
# create dirs. with group=rw permissions, set next parameter to 0775.
   directory mask = 0700

# By default, \\server\username shares can be connected to by anyone
# with access to the samba server.
# The following parameter makes sure that only "username" can connect
# to \\server\username
# This might need tweaking when using external authentication schemes
   valid users = %S

# Un-comment the following and create the netlogon directory for Domain Logons
# (you need to configure Samba to act as a domain controller too.)
;[netlogon]
;   comment = Network Logon Service
;   path = /home/samba/netlogon
;   guest ok = yes
;   read only = yes

# Un-comment the following and create the profiles directory to store
# users profiles (see the "logon path" option above)
# (you need to configure Samba to act as a domain controller too.)
# The path below should be writable by all users so that their
# profile directory may be created the first time they log on
;[profiles]
;   comment = Users profiles
;   path = /home/samba/profiles
;   guest ok = no
;   browseable = no
;   create mask = 0600
;   directory mask = 0700

[printers]
   comment = All Printers
   browseable = no
   path = /var/tmp
   printable = yes
   guest ok = no
   read only = yes
   create mask = 0700

# Windows clients look for this share name as a source of downloadable
# printer drivers
[print$]
   comment = Printer Drivers
   path = /var/lib/samba/printers
   browseable = yes
   read only = yes
   guest ok = no
# Uncomment to allow remote administration of Windows print drivers.
# You may need to replace 'lpadmin' with the name of the group your
# admin users are members of.
# Please note that you also need to set appropriate Unix permissions
# to the drivers directory for these users to have write rights in it
;   write list = root, @lpadmin


[User]
   path = /mnt/NAS/User
   browseable = yes
   read only = no
   guest ok = no
   valid users = max, glory, leoncia
   hide unreadable = yes
   hide unwriteable files = no

# ================= User Shares =================
[Max]
   path = /mnt/NAS/User/Max
   browseable = yes
   read only = no
   valid users = max
   create mask = 0770
   directory mask = 2770
   force create mode = 0770
   force directory mode = 2770
   inherit permissions = yes
   inherit acls = yes
   map acl inherit = yes
   hide unreadable = no
   hide unwriteable files = no

[Glory]
   path = /mnt/NAS/User/Glory
   browseable = yes
   read only = no
   valid users = glory, max
   create mask = 0770
   directory mask = 2770
   force create mode = 0770
   force directory mode = 2770
   inherit permissions = yes
   inherit acls = yes
   map acl inherit = yes
   hide unreadable = no
   hide unwriteable files = no

[Leoncia]
   path = /mnt/NAS/User/Leoncia
   browseable = yes
   read only = no
   valid users = leoncia
   create mask = 0770
   directory mask = 2770
   force create mode = 0770
   force directory mode = 2770
   inherit permissions = yes
   inherit acls = yes
   map acl inherit = yes
   hide unreadable = no
   hide unwriteable files = no

[Austausch]
   path = /mnt/NAS/User/Austausch
   browseable = yes
   read only = no
   valid users = max, glory, leoncia
   create mask = 0777
   directory mask = 2777
   force create mode = 0777
   force directory mode = 2777
   inherit permissions = yes
   inherit acls = yes
   map acl inherit = yes
   hide unreadable = no
   hide unwriteable files = no

Das Auskommentieren von [homes] hat nichts gebracht.

Gemounted ist so hier:

snoozy_sloth ext4              1.0   NAS            cb7b63e1-bfc1-4216-b30c-13e97c7a27aa    115G     0% /mnt/NAS
└─md0        crypto_LUKS       2                    f8826e58-3467-4eb2-8a7d-cc158466edf6                
  ├─sda      linux_raid_member 1.2   clumsy-camel:0 aae7cb35-2616-8f11-5e64-4b3690a3c8ff                
  └─sdb      linux_raid_member 1.2   clumsy-camel:0 aae7cb35-2616-8f11-5e64-4b3690a3c8ff 

Mit folgendem Befehl:

sudo mount /dev/mapper/snoozy_sloth /mnt/NAS/

So. Jetzt bin ich ein Stückchen weiter. Kopieren klappt. Die Rechte und Angehörigkeiten werden korrekt vergeben. Nur beim Löschen bekomme ich die Fehlermeldung, dass die Datei belegt ist und nicht gelöscht werden kann, was nicht stimmt. Kennt jemand das Problem? Mit ssh im gleichen Ordner habe ich keine Probleme.