How to share apache /var/www using samba server in ubuntu

Question

My issue is similar to the stackoverflow question, virtual centOS 6.2 - How to share /var/www using Samba, however I am getting the following error:

Windows cannot access \server1\dev You do not have permission to access \\server1\dev

I installed ubuntu server and I am trying to give the /var/www/html/dev directory read and write permissions from other computers (ex: windows 7 and ubuntu desktop).

I changed the owner of folder /var/www to the www-data group and added user dev1 to that group. I then gave 0755 permission to the folder /var/www And below are the contents of my smb.conf file:

[global]
workgroup = WORKGROUP
server string = Samba Server %v
netbios name = ubuntu
security = user
map to guest = bad user
dns proxy = no

#============================ Share Definitions ============================== 
[sharing]
path = /samba/share
browsable =yes
writable = yes
guest ok = yes
read only = no
force user = nobody

[dev]
path = /var/www/html/dev
valid users = @www-data
read only = no
guest ok = no
writable = yes
browsable = yes

So I am tried to access the dev share using a password. I have also added a samba user by following this tutorial, but when I attempt to access this share from windows 7 machine, I receive the following error message:

Windows cannot access \server1\dev.  You do not have permission to access \\server1\dev  

Additional information

I can access /samba/share but cannot access the dev share.

EDIT: Now the windwos system asking to enter password. But after entering password I get the error \\s1\dev is not accessible. You might not have permission to use this network resource. Contact the administrator of this server to find out if you have access permissions.

Answer 1

Credit: Martin

You need to change your samba mount configuration so that you give permission to the www-data user and group to write to it. You may or may not have the ability to set specific directory permissions, but if not you'll have to set the entire drive the write access (which is bad for security).

I would personally advise using nfs instead of samba shares for networked storage and the use of ext3 or other fully featured file system.

http://www.cyberciti.biz/tips/how-do-i-set-permissions-to-samba-shares.html

https://help.ubuntu.com/community/Samba/SambaClientGuide

http://www.mattvanstone.com/2006/06/automatically_mounting_smb_sha/

Answer 2

www-data is a system account (<1000 uid/gid) and has no password at all. I would not advice to use uid & gid below 1000. Instead create a new account or use an exsisiting one with uid >1000.

Maybe you want to create a new account for editing webpages via samba only. You can do this by creating a jail.

Hint: You dont need step 1 to 4 when using an exsisting user.

1. create a jail

# mkdir -p /srv/smb/exampleusername

2. Add an entry to /etc/fstab

/var/www /srv/smb/exampleusername none bind 0 0

3. bind /var/www to /srv/smb/exampleusername, so you dont need to reboot to take effect of fstab

# mount -o bind /var/www /srv/smb/exampleusername

4. create a user, then remove his rights and put him in jail.

# adduser exampleuser
# chown root:root /home/exampleuser
# chmod 0755 /home/exampleuser
# usermod -s /usr/sbin/nologin -d /srv/smb/exampleuser exampleuser

5. Change the rights of www to that new/specific user.

# chown -R exampleuser:exampleuser /var/www
# chmod -R 0755 /var/www
# chown exampleuser:exampleuser /srv/smb/www
# chmod 0755 /srv/smb/exampleuser

6. Example share for smb.conf

[www]
path = /srv/smb/exampleuser
comment = yada yada yada
browseable = yes
guest ok = no
valid users = exampleuser
writeable = yes

7. When not using libpam-smbpass then you need to add the user to smb-db too. I would not advice to use libpam-smbpass for security reasons, but this is up to you. Without this libary you need to add a password for that user.

# smbpasswd -a exampleuser

8. test your configuration

Done !

Answer 3

Assuming you have a linux login user account bill, you have installed samba. If you are running SELinux then there are a number of other commands you will need to execute.

Also, make sure you are not sharing smb to the world, your router or firewall should block port 137, 139, 445.

# Block the outside world from your server's smb shares
# assuming your local network is 192.168.0.*
iptables -A INPUT -j DROP ! -s 192.168.0.0/24 -m multiport -p tcp --dports 139,445

# Add your user account "bill" to www-data
usermod -aG www-data bill
# Give bill an smb password
smbpasswd -a bill
# Set permissions in the html folder for www-data
# WARNING: existing apps might require specific permissions on specific folders
# web code can now alter existing -/html/dev folder files
chown www-data:www-data -R /var/www/html/dev

# alternatively, in combination with create mask 775 in smb.conf
chown root:www-data -R /var/www/html/dev
chmod -R 775 /var/www/html/dev

# add the following text to the bottom of /etc/samba/smb.conf
[dev]
path = /var/www/html/dev
available = yes
valid users = @www-data
read only = no
browsable = yes
public = no
writable = yes
create mask = 0775
force user = www-data
force group = www-data

An alternative might be to not set any other permissions but include force user and group as root, but that seems quite a bit scary to me.

Answer 4

With this solution, Apache/Nginx/PHP/etc. will still have operational write access as www-data to /var/www, while a developer has write access with his user account below /var/www:

1. Add the developers/admins user name to the web servers group, usually www-data:
   sudo usermod -a -G www-data UsernameOfSambaShare
2. Guess your public files are below /var/www, then grant write access recursive to the group:
   sudo find /var/www -type d -print0 | xargs -0 chmod 775
   sudo find /var/www -type f -print0 | xargs -0 chmod 664
   sudo chown www-data:GroupnameOfSambaShareUser -R /var/www
3. Prepare /etc/smb.conf for the write access of the new group member to the shared folder:
   [www]
   force create mode = 664
   force directory mode = 775
   writeable=yes
   guest ok=yes
   path=/var/www
   comment="Public area"
   write list = UsernameOfSambaShare ...
   valid users = UsernameOfSambaShare ...

Of course you can have different permissions for multiple shares below /var/www as long as all the users are in the group www-data.

If the web server needs write access to the files or folders provided via the Samba share, you will have to add the user www-data to the group(s) of the Samba share user(s) or correct the permissions (see point 2).

A warning:
This configuration is not recommended for a production system, as it weakens the security concept of the web server. However, it is very useful for a development environment in which you need to write data to a virtual machine, for example.