Allow access to htdocs dir via samba

Question

I managed to setup samba on a ubuntu server so that I can browse my home directory /home/max via windows.

Now I would like to share the directory /usr/local/apache2/htdocs - what do I have to do in order to share files between windows and the apache htdocs dir? The htdocs dir is owned by www-data.

I am pretty new to unix access permission stuff, so I really dont have a clue where to start with this. Any (easy) explanation is appreciated. Thanks!

Answer 1

Traditional Unix access permissions are fairly simple.

For each file or directory you define it's owner and the group it belongs to. A file or directory only has one group but a user can belong to many groups.

The permissions are defined for each of

• owner
• group
• world

The main permissions of relevance here are

• read
• write (including update)
• execute (if a file) or "access" (if a directory)

When you use ls -l, these permissions are listed in the order suggested above. For example

rw- r-- --- joe www-data ... example.html

(Spaces added for clarity) This means

• the owner joe has rw- permissions and can read or write the file.
• members of group www-data have r-- permissions and can only read the file
• users who are not members of group www-data have --- permissions & cannot read the file

When you access files on the server using a web-browser, it is the web-server which accesses those files on your behalf. background server processes (AKA daemons) have a username and group membership associated with them. Normally, web-users are unauthenticated so the web-server, apache, uses it's own owner and group on your behalf. If the web-server process is using www-data as it's group then it would be able to read the above example.html and serve it to web browsers.

You can see what effective user and group the web-servers is using like this:

$ ps -eo user,group,cmd | grep apache
root     root     /usr/sbin/apache2 -k start
www-data www-data /usr/sbin/apache2 -k start
www-data www-data /usr/sbin/apache2 -k start
www-data www-data /usr/sbin/apache2 -k start

The main process has all-powerful root permissions but the processes that satisfy web-browser requests (three in this case) have user www-data and group www-data. So these processes can read the example.html file using group permissions

The same general principles apply to Samba. The Samba server processes (e.g. smbd) can operate with several security configurations, so the exact answer depends on your Samba config file.

If your samba configuration for the "htdocs" share says "guest account = pcguest" and user pcguest is a member of group www-data then it should be able to read example.html.