Disable CentOS users from everything but samba use.

Question

I have a storage server running some samba shares. I need to create multiple users for each individual working at my company, but I only want them to be able to access samba from the client machines. I do not want them to be able to log in locally or through ssh. Is there a way to disable said users from doing anything BUT connecting to the shares from another machine?

Answer 1

Really you should restrict ssh access to a named group or individuals as a matter of course (i.e. a whitelist).

You can control access for any pam authenticated service using the modules which ship as standard with most distributions.

You don't say what services provide access to "log in locally". In addition to configuring pam, with getty you can set /etc/nologin which blocks everyone apart from root or change the users shells to something else. I don't think there's application specific tools for kdm/gdm/xdm (but again these will use pam).

BTW: if you need to create multiple users for each individual then you're probably doing something wrong.

Answer 2

You can use the smbpasswd program to create and manage users that can access samba shares etc but as the man page says

-a This option specifies that the username following should be added to the local smbpasswd file, with the new password typed (type for the old password)... Note that the default passdb backends require the user to already exist in the system password file (usually /etc/passwd), else the request to add the user will fail.

This isn't a huge problem as you can lock the loal user as part of creating the account

useradd freddy
passwd -l freddy
smbpassdw -a freddy
New SMB password:
Retype new SMB password:
Added user freddy.

Will create a user freddy who can use samba shares but who cannot log in

Answer 3

Depending on how you set up Samba to authenticate users, limiting those users' access to SSH login will differ.

If you've configured Samba in "User" mode with a tdbsam backend, you can simply call a "usermod -L " to lock the user account. This will not disrupt Samba access provided you don't also lock the Samba account.

This also works if you're authenticating users against a domain controller in "Domain" mode (which also requires local user accounts).

This doens't seem to be your case, but if you're using Winbind for active directory integration, and you want to limit SSH login to local users only (not domain level users), you can disable PAMAuthentication in sshd.config.

Answer 4

What is Samba authenticating against on the backend? Samba can use it's own database. It seems like that would be the easiest way to restrict Samba users from accessing any resource on the underlying system.

passdb backend = ???