Home Menu

Samba

Contents

What is Samba?

Samba is a package that allows a Linux system to interoperate with a Windows system. It allows a Windows client to treat a Linux filesystem as a share and vice-versa. It also provide capabilities for sharing printers, authentication services, name resolution and browsing.

The ability to do this is based on the Common Internet File System (CIFS) which is a set of protocols that Microsoft developed and originally called the Server Message Block (SMB). The Samba name can be inferred from there. It is basically a protocol stack that provides an interface between a file system and network I/O, in a manner similar to NFS, but with more capabilities. The underlying structure is SMB running over NetBIOS over TCP.

Samba is a very powerful facility and provides basic services very easily. However, it can be complicated if you want to get involved in various types of permission strategies. It does require an understanding of both Linux and Windows security and access control capabilities. permission

The basic idea is that the Microsoft interoperability protocols are based on running the Server Message Block (SMB) protocol over the NetBIOS protocol over the TCP/IP protocol. This is basically a Remote Procedure Call (RPC) mechanism supporting a distributed management environment. Recently, Microsoft has gone to Direct-hosted TCP, which does away with the NetBIOS layer.

In the SMB world, a share is simply something on one machine which is shareable with the rest of the world within certain constraints. It supports authentication of users and permission checking as well as the basic operations involved in manipulating the things that can be shared, files and printers.

Configuring Samba

When Samba is installed, it typically is started at boot time, so check to make sure that it is enabled. This actually involves two services, smbd and nmbd. smbd performs the actual delivery of SMB services (file and printing services) and nmbd is the NetBIOS name services daemon that provides name services for clients.

The configuration information can be anywhere you want to put it, but the default is /etc/samba. There you will find a number of files:

lmhosts

contains the NetBIOS name to IP address mapping file. It is similar to the /etc/hosts file with each line containing an IP address and a netbios name, which is a simple name (maximum of 15 characters). For example:

As with /etc/hosts, it is a way for a system to get an IP address without having to connect to a NetBIOS name server.

secrets.tdb

is used in setting up a domain controller using Samba and won't be discussed here.

smbusers

is a file of mappings from the Windows domain to the Linux domain. For example, if you are known as "Bozo Clown" in your Windows domain and "Bozo" in the Linux domain, you can map "Bozo Clown" to "Bozo" in the smbusers file like this:

Note that you can map more than one Windows domain account to a single Linux domain account.

This file will normally contain the following lines. If you don't want to allow any of these users access, be sure and delete or comment out these lines.

smbpasswd

is a file of passwords for Samba users. Under normal authentication methods, every user must be assigned a password. This is normally done with the smbpasswd command. This command prompts for the password to use.

Normally, root adds a user and sets an initial password and then the user can change it. This can be done as part of establishing a new account if Samba is widely used, but you should avoid setting some common password for all Samba users.

smb.conf

is the key Samba configuration file. Its structure is a sequence of sections, where each section defines parameters that control Each section defines a share which is a term used by Windows to describe a resource that can be shared over a network. A share is always a directory to which access is granted. A share is always given in square brackets like this: [sharename].

There are three special sections:

Shares always require a password for access unless they are specified as guest services. A Linux guest account is required to define access priviledges for these services.

For example:

These are only examples and there are actually quite a few possible parameters for a Samba share.

The [global] section

The [global] section could contain any parameter you might find in a share, but it applies to all shares.

The [homes] section

The [homes] section is used to connect users to their home directories. If a request for a share is not found elsewhere in the Samba configuration, the user name is treated as a share name and looked up in the password file. If found, a share is created for that user and file system using the properties given in the [homes] section.

[printers] sections

This section works like [homes] but for printers. If a [printers] section exists, then a printer share type is automatically defined. If a request is made for a share and it is neither explicitly defined nor [homes] share, it is treated as a [printer] name and looked up in the printcap file.

The printers share must be printable and is typically a world-writeable spool directory.

Parameters

So far, Samba looks pretty easy and it is in the simplest cases. But the parameters available for Samba configuration can allow you to control the access and use very precisely, but that also means some complications. Following is a simplified discussion of the Samba parameters based on specific issues.

Variables

In order to make configuration fit the situation, Samaba defines a set of variables that can be used in parameters:

Variable    Meaning
%S    Name of the current service, if any.
%P    Root directory of current service, if any.
%u    User name of the current service, if any
%g    Group name of %u
%U    Session user name (what client wanted)
%G    Group name of %U.
%H    Home directory of user %u.
%h    Host name samba is running on.
%m    NetBIOS name of the client system.
%L    NetBIOS name of the server system.
%M    DNS name of the client system.
%I    IP address of the client system.
%T    The current date and time.

Name Mangling

DOS and Windows client can't always use full length filenames, so Samba will handle name mangling if desired. The parameters are:

Shares

The properties of a share are defined by a very large set of possible parameters, most of which you won't need to use in most cases. To see all the possible parameters, check the man page for smb.conf. Remember that anything referred to in the share definition must be properly created. This includes users, groups and directories.

Here are some examples of shares:

If you want to create shares with limited access, you might create a share with these properties:

You might also like to create a partially writable share:

This last point is important. When you create the secrets directory, you will specify an owner and group. When someone accesses the share and creates a file, it will have their normal user and group ownership. For example, suppose you create a user secrets and a group secrets and make that the user and group of /home/secrets. If bob logs in with user = bob and group = bob and creates a file, it will have the correct permissions (rw-rw----), so only bob can access the files. If you want to allow access to other members, you need to specify a default group for anyone logging in to the share. In this case, spies, which has to be created and anyone that logs in to the share is assigned to this group for the session. When bob creates the file, it will be have uid = bob and gid = spies. The permissions would allow read/write access to anyone able to log in.

Of course, if you wanted to allow read access only to non-owners, you can change the create permissions for files to 0640. You can also specify the force group with a + symbol (force group = +staff) so that anyone logging in that is in that group will get their group reassigned to spies, but others (bob and admin) will maintain there normal group assignment. This provides quite a bit of flexibility in providing access to the contents of the share.

There is also a method for forcing a user with the force user parameter. The use of these depends largely on the situation with regard to file access.

The Global Section

When setting up the global properties of a site, it is common to use parameters like the following. Some parameters, such as security can only be used in the global sections, but all parameters can be used in the global section. If a parameter is used in both sections, the local value for a share overrides the global value specified. And remember, that you can specify any parameter in the global section, it is just more common to use those in the set below.

For example, 

   [global]
   workgroup = MYGROUP       # Where I will be found browsing
   netbios name = MYSERVER   # My external name
   netbios aliases = bugs    # Another name that can be used
   hosts allow = isp.com     # who can connect
   hosts deny =  dog.isp.com # except for
   encrypt passwords = yes   # use encryption a la newer Windows
   log level = 3             # higher level logging
   log file = /var/log/samba # where to log
   hide dotfiles = yes       # don't show filenames beginning with "."

The Homes Section

Setting up the [homes] shares is easy. You are specifying that anyone with a local login name can access their home directories as a share without a specific share being created. When an attempt is made to connect to a share, the list of shares is searched and if no match for the share name is found, it is tested to see if it matches a local user name. If it does, it creates the necessary share by cloning the [homes] section with the user name as the share name and using the users home directory as the path (except as noted below).

As with [global] any parameter can be used, but a typical [homes] definition might be:

This simply says that the displayed name for the home directories will be Home Directories when a client queries the server. However, we don't want users to be able to browse home directories as it could be a temptation for potential trouble-makers. Users should be able to write to their directories and the default mode for files created is rw-r----- and the default mode for directories created is rwxr-x---.

If you specify public = yes or guest ok you are giving anyone access to user home directories without a password. If you have a directory for the homes that is not the same as the home directory, you will need to specify it like this:

So each user has a specific subdirectory where their samba share is located.

The Printers Section

The [printers] section has a similar function to [homes], but for printers. The logical parameters to use in this section are limited and a typical printers sections is:

You need a path for the printer temporary files to be located and it must be world writable. You may or may not want to allow printing by anonymous users, printable must be true and finally, you may or may not want to allow your printers to be browsed.

If you have a BSD-style printing system (lpd, printcap, etc.), this configuration works fine. If you have some other type of printing system, you will have to define your printers explicitly. This might also apply is you want to limit the printers available to Samba to a subset of all printers.

Example

Here is an example of a full smb.conf file.

Running Samba

You can run Samba over NetBIOS (the more common method) if you have the following settings in /etc/services:

For the time being, direct-hosted services are experimental and probably to be avoided.

To run samba, you need to run two services, smbd and nmbd (name services). These are usually configured automatically in the init.d directory under the smb service where the run as smbd -D and nmbd -D.

So how do you use Samba? There are two major choices: connecting to your Samba shares from a Windows host; connecting to your Samba shares from a Samba server; and connecting to Windows shares from a Samba server.

If you are talking about an up-to-date Windows system (2000, NT, XP), you would access shares by Mapping a Network Drive from the My Computer -> Tools menu. When presented with the opportunity to specify the share, you give the name of the server and the name of the share. For example, if the Linux server is bebop and the share name is alula, you would enter:

One tricky part is to remember that Windows will try to log you into that share (if not a public share) by using the name and password that you used to log into Windows. If you are using a different name or password, choose the Connect using a different user name offering and enter the user name and password you need to connect on the Samba server.

Another way to connect is through the network neighborhood. If you have browsable shares, they should show up in the browse lists. If not, you will have to connect directly using the Mapping a Network Drive from the Network Neighborhood -> Tools menu.

You can also connect directly from a command prompt or a dos window from a Microsoft OS like this:

where M: is replaced with the appropriate drive moniker for your situation. Windows remembers passwords unless you turn that service off, so if you connect to a share, it may connect you the next time without having to enter the password. BE CAREFUL if you connect to a share on a system that other use.

To connect to Samba share or a Windows share from a Linux system use the smbclient command. For example

Where buddy is a name different than your current login user name. You can enter the password after the share name (also called the service name) or it will ask for you to enter it and it will be unechoed.

smbfs

You can also mount a share as a file system so that all of your normal Linux commands can be used to access the files. The command to use is smbmount and has the syntax:

For example,

Useful options include

Other commands

There are other commands that you might find useful in dealing with Samba including:

testparm    A syntax checker for smb.conf.
testprns    For testing printer names.
smbstatus   To see the current status of any smb connections
nmblookup   To perform NetBIOS queries directly
smbpasswd   To create samba users and passwords

Of particular interest is smbpasswd. Normally, no user can utilize a non-public Samba share unless they have a Samba password. So when a user is given that priviledge, you normally, from root, create an entry like this:

Which adds user username to the smbpasswd file and prompts for the password. Once in the smbpasswd file, the password can be changed like this:

and then entering the new password.

Passwords (users) can be disabled/enabled/deleted with:

and then entering the new password.

Users can also change their own password by simply entering the command as with the passwd command. There are also options to allow users to change their password on remote machines and to specify other user names where appropriate.

Finally, Samba can also be used as a domain controller for a Windows domain. This is just a bit beyond a first pass at Samba.

Assignment

Home Menu