Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to configure Samba for sharing public folders - without necessity to log in. I'm using Fedora 16.

$ smbd --version
Version 3.6.1-74.fc16

Config:

[global]
   workgroup = WORKGROUP
   security = share
   hosts allow =  192.168.
   load printers = yes
   guest account = nobody
   log file = /var/log/samba/log.%m
   max log size = 50
   domain master = no
   local master = yes
   os level = 35
   null passwords = true
   username map = /etc/samba/smbusers
   name resolve order = hosts wins bcast
   dns proxy = no

[test]
   comment = Pliki Estomedu
   path = /tmp/test/share
   public = yes
   writable = yes
   browseable = yes
   force user = nobody
   force group = nogroup
   create mask = 0777
   directory mask = 0777
   available = yes

Path:

ls -la /tmp/test/share/
total 8
drwxr-xr-x. 2 root root 4096 Nov 14 13:09 .
drwxrwxrwx. 3 root root 4096 Nov 14 13:09 ..

smbusers:

# Unix_name = SMB_name1 SMB_name2 ...
root = admin
nobody = guest pcguest smbguest

What I get when I try to connect (providing empty password):

$ smbclient \\\\localhost\\test
WARNING: The security=share option is deprecated
Enter root's password:
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.6.1-74.fc16]
Server not using user level security and no password supplied.
smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*

Please help. The share is visible from WinXP and Win7 but get access denied message as well.

share|improve this question

2 Answers 2

up vote 5 down vote accepted

I found an alert:

SELinux is preventing /usr/sbin/smbd from read access on the directory share.

The best solution is to allow sharing only chosen directories:

/usr/sbin/semanage fcontext -a -t samba_share_t <path>

You can also allow SAMBA to share all directories:

setsebool -P samba_export_all_ro 1
share|improve this answer
1  
A better solution would be to use /usr/sbin/semanage fcontext -a -t samba_share_t <path> and just add that directory instead of allowing all directories to be shared with samba. See more at docs.fedoraproject.org/en-US/Fedora/13/html/… –  artifex Jan 13 '12 at 10:40
    
Your are right. I will add it to my answer. –  rotman Jan 13 '12 at 11:18
    
You can also use setsebool -P samba_enable_home_dirs 1 for home directories. –  Garrett Hyde Dec 16 at 7:42

I have the same problem with you, I saw that in smb.conf. It solved my problem

Security-Enhanced Linux (SELinux) Notes:

#
# Turn the samba_domain_controller Boolean on to allow Samba to use the useradd
# and groupadd family of binaries. Run the following command as the root user to
# turn this Boolean on:
# setsebool -P samba_domain_controller on
#
# Turn the samba_enable_home_dirs Boolean on if you want to share home
# directories via Samba. Run the following command as the root user to turn this
# Boolean on:
# setsebool -P samba_enable_home_dirs on
#
# If you create a new directory, such as a new top-level directory, label it
# with samba_share_t so that SELinux allows Samba to read and write to it. Do
# not label system directories, such as /etc/ and /home/, with samba_share_t, as
# such directories should already have an SELinux label.
#
# Run the "ls -ldZ /path/to/directory" command to view the current SELinux
# label for a given directory.
#
# Set SELinux labels only on files and directories you have created. Use the
# chcon command to temporarily change a label:
# chcon -t samba_share_t /path/to/directory
#
# Changes made via chcon are lost when the file system is relabeled or commands
# such as restorecon are run.
#
# Use the samba_export_all_ro or samba_export_all_rw Boolean to share system
# directories. To share such directories and only allow read-only permissions:
# setsebool -P samba_export_all_ro on
# To share such directories and allow read and write permissions:
# setsebool -P samba_export_all_rw on
#
# To run scripts (preexec/root prexec/print command/...), copy them to the
# /var/lib/samba/scripts/ directory so that SELinux will allow smbd to run them.
# Note that if you move the scripts to /var/lib/samba/scripts/, they retain
# their existing SELinux labels, which may be labels that SELinux does not allow
# smbd to run. Copying the scripts will result in the correct SELinux labels.
# Run the "restorecon -R -v /var/lib/samba/scripts" command as the root user to
# apply the correct SELinux labels to these files.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.