Samba – Create files/dirs as group

permissionssamba

Say I have a protected directory called Corp that only members of the unix group Corp can access and its mostly working with:

read list = @corp

write list = @corp

create mask = 0770

Problem is, when a user creates a file there, its setting the user and group ownership to them, e.g. when user1 creates foo1, it has the permissions 770 for user1:user1 and user2 can't access or edit the file.

Is there a way to make it user1:corp from samba settings or should I change the create mask to 0777 (which I've enabled temporarily after doing a chgrp -R corp on the shared directory)?

Users have SSH access to the server so the folder /svr/corp itself needs to be restricted, right now its set to 770.

Best Answer

You can use the force group directive in your share definition to force that a particular group be used for all files on that share.

Related Solutions

Linux – Samba – Users can’t write to dirs not created by themselves

You're missing:

force directory mode = 0777

Also, you really want to use 0666 for force create mask. Probably no good reason to force the execute bits.

Samba Permissions – I’m going to throw it!

This might help. I do something similar, but only one share is open to the group's users. Other shares are read-only except for a single maintainer user. The [global] section of my smb.conf is almost identical to yours, except I don't use the force create/directory mode directives (in my case, they'd interfere with the other shares).

Here's the share definition:

[shared stuff]
        comment = blah, blah, etc
        path = /path/to/share
        write list = @sambagroup
        force group = +sambagroup
        read only = yes
        directory mask = 0775
        create mask = 0664
        guest ok = yes
        invalid users = root
        case sensitive = True
        default case = lower
        preserve case = yes
        short preserve case = yes

The important stuff here are these:

read only = yes -- by default, read only.
guest ok = yes -- guests can browse.
write list = @sambagroup -- Authenticated members of sambagroup can write.
force group = +sambagroup -- The + means that the force only applies to existing members of sambagroup. They're already the only ones who can write. I think, without the +, guest is given sambagroup credentials, which is not wanted (particularly with the write list directive above).
directory mask = 0775
create mask = 0664

These do exactly what you want yours to do: "drwxrwxr-x" on directories, "rwxrwxr-x" on files, and newly created files are owned by the user and sambagroup. The maintainers of the other shares get the same permissions as everyone else when working in shared stuff, and permissions & groups are normal when they work in the other shares.

My smb.conf has been working with only minor tweaks through several different versions of Samba, and currently is used with Samba 3.2.5. I never had it running on Ubuntu 8.04, but it ran on Ubuntu 7.04 for a long time before getting migrated to a recent Debian Lenny install.

Best Answer

Related Solutions

Linux – Samba – Users can’t write to dirs not created by themselves

Samba Permissions – I’m going to throw it!

Related Topic