Ubuntu – Can’t write to Samba Share from Ubuntu

I had to give up using ACLs via NFS. The mask is not working properly.

I use inotify now instead, with a little script launched at startup:

#!/bin/bash

# Directory name as argument. You MUST set it also down there before using it!

LOGFILE="/tmp/inotify-log.tmp"

inotifywait -mrq -e attrib,moved_to,create --format %w%f "$1" | while read FILE ; do
    # Ignore root FIXME you have to put here all possible root arguments
    if [ -d "$FILE" ] && [ $FILE == "/export/proyectos" ] || [ $FILE == "/export/proyectos/" ] ; then
        continue;
    fi
    # Get new permissions
    PERMISOS=$(stat -c %a "$FILE")
    if [ -d "$FILE" ] ; then
        if [ $PERMISOS -ne 2771 ] ; then
            NUEVOSPERMISOS=2771

        else
            NUEVOSPERMISOS=0
        fi
    else
        # Get permissions
        if [ ${#PERMISOS} -eq 3 ] ; then
            PERMISOS_ADICIONALES=0
            PERMISOS_USUARIO=${PERMISOS:0:1}
            PERMISOS_GRUPO=${PERMISOS:1:1}
            PERMISOS_OTROS=${PERMISOS:2:1}
        else
            PERMISOS_ADICIONALES=${PERMISOS:0:1}
            PERMISOS_USUARIO=${PERMISOS:1:1}
            PERMISOS_GRUPO=${PERMISOS:2:1}
            PERMISOS_OTROS=${PERMISOS:3:1}
        fi

        # Check permissions
        if [ $PERMISOS_USUARIO -ne $PERMISOS_GRUPO ] || [ 0 -ne $PERMISOS_OTROS ] ; then
            NUEVOSPERMISOS=${PERMISOS_ADICIONALES}${PERMISOS_USUARIO}${PERMISOS_USUARIO}0
        else
            NUEVOSPERMISOS=0
        fi

    fi

    # Set permissions
    if [ $NUEVOSPERMISOS -ne 0 ] ; then
        chmod $NUEVOSPERMISOS "$FILE"
                # Debug output
                OUTPUT="$(date) : $FILE ($PERMISOS -> $NUEVOSPERMISOS)"
                echo $OUTPUT >> $LOGFILE
    fi

done

The permissions are fixed now by this script, instead of fall back into ACLs via NFS.

You noted that you can get "user Kerberos tickets as root" but you have a "key is not available" error.

find_krb5_cc: /tmp/krb5cc_1000 is owned by 1000, not 0

This error means mount.cifs does not have access to the Kerberos ticket because is not owned by root (userid: 0), which calls mount.cifs. I would assume that the Kerberos tickets root obtained with a user's password were designated for use only by that user.

Now why does mount want the ticket to be owned by root? This part of first line:

uid=0x0;creduid=0x0;user=root;

may be the reason. Mount.cifs is being carried out as root. You might want to try changing uid and creduid to the useruid of the user.

I don't know where you're calling mount.cifs from, so I'm sorry if that's a little vague. Could you please give the mount.cifs command you're running and its options?

As for the share being "accessible for all users on the server": I have pam_mount run after a user logs in and mount a share with their username, password and their Kerberos ticket, so I'm not using a keytab. This is the mount command I'm calling:

mount -t cifs //<SERVER>/<VOLUME> <MOUNTPOINT> -o username=%(USER),sec=krb5,domain=<DOMAIN>,cruid=%(USERUID),uid=%(USERUID),gid=%(USERGID),rw

Add the authorized users to a single group. Also set file_mode= and dir_mode= to the correct permissions for the group to have read/write access to the file, something like 770.