Samba Permissions - I'm going to throw it!

Question

I'm attempting to set up a samba share on my Ubuntu 8.04 LTS box, to be consumed by my mac and windows clients.

I've created a 'samba' group and added my linux users to them, gave them samba passwords, I can connect and place files, everything is peachy except the permissions.

BTW, the default home share has been completely removed to ensure it's not conflicting.

[archive]
path = /home/archive
read only = no
guest ok = yes
browseable = yes
create mode = 0664
directory mode = 0775
force group = samba

The goal is to have it readable by guests, full control for samba users. When a non-guest user places a file in the archive share, it has the correct group of 'samba', but the permissions are 644 instead of the intended 664.

I've tried changing the create mode and directory mode to create mask and directory mask, and every combination with the force word in front of them.

I'm at a loss for why this isn't working, any help is appreciated.

Posting my entire smb.conf:

[global]
 workgroup = EXAMPLE
 server string = %h
 map to guest = Bad User
 obey pam restrictions = Yes
 passdb backend = tdbsam
 pam password change = Yes
 passwd program = /usr/bin/passwd %u
 passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
 unix password sync = Yes
 syslog = 0
 log file = /var/log/samba/log.%m
 max log size = 1000
 dns proxy = No
 usershare allow guests = Yes
 panic action = /usr/share/samba/panic-action %d
 invalid users = root
 force create mode = 0664
 force directory mode = 0775

[printers]
 comment = All Printers
 path = /var/spool/samba
 create mask = 0700
 printable = Yes
 browseable = No

[print$]
 comment = Printer Drivers
 path = /var/lib/samba/printers

[archive]
 path = /home/archive
 force group = samba
 read only = No
 create mask = 0664
 directory mask = 0775

[server_backups]
 path = /home/server_backups
 force user = root
 force group = samba
 read only = No
 create mask = 0664
 directory mask = 0775

Thanks,

Answer 1

This might help. I do something similar, but only one share is open to the group's users. Other shares are read-only except for a single maintainer user. The [global] section of my smb.conf is almost identical to yours, except I don't use the force create/directory mode directives (in my case, they'd interfere with the other shares).

Here's the share definition:

[shared stuff]
        comment = blah, blah, etc
        path = /path/to/share
        write list = @sambagroup
        force group = +sambagroup
        read only = yes
        directory mask = 0775
        create mask = 0664
        guest ok = yes
        invalid users = root
        case sensitive = True
        default case = lower
        preserve case = yes
        short preserve case = yes

The important stuff here are these:

• read only = yes -- by default, read only.
• guest ok = yes -- guests can browse.
• write list = @sambagroup -- Authenticated members of sambagroup can write.
• force group = +sambagroup -- The + means that the force only applies to existing members of sambagroup. They're already the only ones who can write. I think, without the +, guest is given sambagroup credentials, which is not wanted (particularly with the write list directive above).
• directory mask = 0775
• create mask = 0664

These do exactly what you want yours to do: "drwxrwxr-x" on directories, "rwxrwxr-x" on files, and newly created files are owned by the user and sambagroup. The maintainers of the other shares get the same permissions as everyone else when working in shared stuff, and permissions & groups are normal when they work in the other shares.

My smb.conf has been working with only minor tweaks through several different versions of Samba, and currently is used with Samba 3.2.5. I never had it running on Ubuntu 8.04, but it ran on Ubuntu 7.04 for a long time before getting migrated to a recent Debian Lenny install.

Answer 2

I'm not near an active Samba config right now, so I can't check if it's in by default on Ubuntu installations. That said, poke around in your smb.conf and see if there's a "create mask" statement anywhere. You might find it set to 022, and you'd need to blank out the group bit (set to 002 or just nuke the whole line).

Note, also, that "create mode" is synonymous with "create mask."