Debian – Samba force user does’t work

debianmac-osxsamba

I am using Samba 3.6.6 on Debian Wheezy.

I want to be able to change www files on my dev server using my macbook.
So I setup samba and made a share for the /var/www directory.

I added the users bart & root to samba to connect. And connect using command K and then smb://192.168.2.100 (my samba server).

As apache uses www-data as a user and group for the www files I use force user and force group in samba to prevent errors in the rights.

However it does force the group www-data, but doesn't force the user. Every file I create is being owned by root in the group www-data.

To seek for errors I tailed the logs in /var/log/samba and only found an error in the log.smbd when restarting the samba service. See the log here:

smbd version 3.6.6 started.
  Copyright Andrew Tridgell and the Samba Team 1992-2011
[2013/09/23 11:14:22.601031,  0] printing/print_cups.c:110(cups_connect)
  Unable to connect to CUPS server localhost:631 - Connection refused
[2013/09/23 11:14:22.602215,  0] printing/print_cups.c:487(cups_async_callback)
  failed to retrieve printer list: NT_STATUS_UNSUCCESSFUL

And here is my smb.conf:

[global]
    server string = %h server
    map to guest = Bad User
    obey pam restrictions = Yes
    pam password change = Yes
    passwd program = /usr/bin/passwd %u
    passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
    unix password sync = Yes
    syslog = 0
    log file = /var/log/samba/log.%m
    max log size = 1000
    dns proxy = No
    usershare allow guests = Yes
    panic action = /usr/share/samba/panic-action %d
    idmap config * : backend = tdb

[homes]
    comment = Home Directories
    valid users = %S
    create mask = 0700
    directory mask = 0700
    browseable = No

[printers]
    comment = All Printers
    path = /var/spool/samba
    create mask = 0700
    printable = Yes
    print ok = Yes
    browseable = No

[print$]
    comment = Printer Drivers
    path = /var/lib/samba/printers

[www]
    comment = www
    path = /var/www/
    valid users = bart, root
    admin users = bart, root
    write list = bart, root
    force user = www-data
    force group = www-data
    read only = No

I even tried adding www-data to the valid users as well as the admin users and the write list. This of course did not have any effect.

Can you help me out? Thanks in advance!

Best Answer

I think that in this case the option admin users overrides the option force user. So when you connect as the user bart to the share www it will be granted administrative privileges on it and all file operations will be done under super-user root.

Try to remove the user bart from admin users list, reload the service and verify its behavior again.

Finally, it's worth to mention that the user bart has to have write permissions on that directory. You can use ACLs to achieve that or put the user to the www-data group.

Related Topic