samba nd microsoft excel problem

[shabakeh]

hi everyone


i installed samba on fedora16. my problem related to samba clients and microsoft excell shared files.
i created excel 2007 file and share it. it opened as read only for anyone who accesse to map network drive.

my smb.conf

# The argument list may include:
# password server = My_PDC_Name [My_BDC_Name] [My_Next_BDC_Name]
# or to auto-locate the domain controller/s
# password server = *


; security = domain
; passdb backend = tdbsam
; realm = MY_REALM

; password server = <NT-Server-Name>

# ----------------------- Domain Controller Options ------------------------
#
# Security must be set to user for domain controllers
#
# Backend to store user information in. New installations should
# use either tdbsam or ldapsam. smbpasswd is available for backwards
# compatibility. tdbsam requires no further configuration.
#
# Domain Master specifies Samba to be the Domain Master Browser. This
# allows Samba to collate browse lists between subnets. Don't use this
# if you already have a Windows NT domain controller doing this job
#
# Domain Logons let Samba be a domain logon server for Windows workstations.
#
# Logon Scrpit let yuou specify a script to be run at login time on the client
# You need to provide it in a share called NETLOGON
#
# Logon Path let you specify where user profiles are stored (UNC path)
#
# Various scripts can be used on a domain controller or stand-alone
# machine to add or delete corresponding unix accounts
#
; security = user
; passdb backend = tdbsam

domain master = yes
domain logons = yes

# the login script name depends on the machine name
; logon script = %m.bat
# the login script name depends on the unix user used
; logon script = %u.bat
; logon path = \\%L\Profiles\%u
# disables profiles support by specifing an empty path
; logon path =

; add user script = /usr/sbin/useradd "%u" -n -g users
; add group script = /usr/sbin/groupadd "%g"
; add machine script = /usr/sbin/useradd -n -c "Workstation (%u)" -M -d /nohome -s /bin/false "%u"
; delete user script = /usr/sbin/userdel "%u"
; delete user from group script = /usr/sbin/userdel "%u" "%g"
; delete group script = /usr/sbin/groupdel "%g"


# ----------------------- Browser Control Options ----------------------------
#
# set local master to no if you don't want Samba to become a master
# browser on your network. Otherwise the normal election rules apply
#
# OS Level determines the precedence of this server in master browser
# elections. The default value should be reasonable
#
# Preferred Master causes Samba to force a local browser election on startup
# and gives it a slightly higher chance of winning the election
local master = yes
os level = 65
preferred master = yes

#----------------------------- Name Resolution -------------------------------
# Windows Internet Name Serving Support Section:
# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
#
# - WINS Support: Tells the NMBD component of Samba to enable it's WINS Server
#
# - WINS Server: Tells the NMBD components of Samba to be a WINS Client
#
# - WINS Proxy: Tells Samba to answer name resolution queries on
# behalf of a non WINS capable client, for this to work there must be
# at least one WINS Server on the network. The default is NO.
#
# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
# via DNS nslookups.

wins support = yes
; wins server = w.x.y.z
; wins proxy = yes

; dns proxy = yes

# --------------------------- Printing Options -----------------------------
#
# Load Printers let you load automatically the list of printers rather
# than setting them up individually
#
# Cups Options let you pass the cups libs custom options, setting it to raw
# for example will let you use drivers on your Windows clients
#
# Printcap Name let you specify an alternative printcap file
#
# You can choose a non default printing system using the Printing option

load printers = yes
cups options = raw

; printcap name = /etc/printcap
#obtain list of printers automatically on SystemV
; printcap name = lpstat
; printing = cups

# --------------------------- Filesystem Options ---------------------------
#
# The following options can be uncommented if the filesystem supports
# Extended Attributes and they are enabled (usually by the mount option
# user_xattr). Thess options will let the admin store the DOS attributes
# in an EA and make samba not mess with the permission bits.
#
# Note: these options can also be set just per share, setting them in global
# makes them the default for all shares

; map archive = no
; map hidden = no
; map read only = no
; map system = no
; store dos attributes = yes


#============================ Share Definitions ==============================

[homes]
comment = Home Directories
browseable = no
writable = yes
; valid users = %S
; valid users = MYDOMAIN\%S

[printers]
comment = All Printers
path = /var/spool/samba
browseable = no
guest ok = no
writable = no
printable = yes


[bonexpress]
comment = bonexpress section
path = /opt/bonexpress
browseable = yes
writable = yes
guest ok = no
create mask = 0777
read list = mike,kamran
write list = mike,kamran

what should i do? thanks in advance

[flyingfsck]

Howdy,

The problem is that the files are subject to both Samba permissions and file system permissions. File system permissions include both file read/write/execute permissions and owner permissions.

So, you probably need to make a group that all samba users are members of and ensure that the samba share and everything in it belongs to that group.

[shabakeh]

hi again

there is a problem for membering of users in one group because i need some groups for other goals. for example one group for accounting users one group for support section and i need define limitations.
how can i solve my problem ? i need share excel file for one group .

[beaker_]

Originally Posted by shabakeh

hi again

there is a problem for membering of users in one group because i need some groups for other goals. for example one group for accounting users one group for support section and i need define limitations.
how can i solve my problem ? i need share excel file for one group .

man getfacl
man setfacl

Your future problem will be how files are opened for editing (copied and saved vs open and close) so you'll also want to set a default acl. Ofcourse this means you will use the file-systems security and focus less on samba's.

net and vfs extensions will soon be your best friends.

man net

[shabakeh]

hi again

i cant fix my problem. how can i do that? ;(

[beaker_]

http://www.samba.org/samba/docs/man/...sControls.html

and if you're looking for access control lists to manage all your users and groups:

http://rofi.roger-ferrer.org/eiciel/?s=2

su
yum install eiciel
exit
eiciel

That's the most hand-holding you'll get from me. Good Luck.

[smr54]

This is one thing that Windows still seems to do much better than Linux--a few clicks, or perhaps, type a few key words into help, and you're done.

A good and understandable article on access control lists, even though dated (written for Fedora 2), is at

http://www.vanemery.com/Linux/ACL/linux-acl.html

As for doing X for one group and Y for another, the only thing I can think of off the top of my head is to have two directories, say, one directory for accounting and a second directory for support. If you want to do it with individual files, where accounting has read permission and support has read/write, ACLs are about the only thing I can think of. Unless Linux's GUI samba admin tools have improved a great deal since I last used them, it's easier to put them on a Windows server.

The last time I had to set anything like this up was on a CentOS 5.x box, and I used ACL's. Our samba setups are usually pretty primitive, and for most things where we do very granular permissions, we use Windows.

That link that Beaker provided looks very promising though--it looks as if it's made it as easy to do as MS.

[shabakeh]

hi everyone

thanks for everything. i think my problem is solved.

my exprience show that microsoft excel 2007 on windows7 64bit and 32bit is incompatible.whats your idea?

this is an example that works for me.

my share section in smb.conf:


[express]
comment = express section
path = /opt/express
browseable = yes
writable = yes
valid users = @express
force user = express
force group = express
create mask = 0775
directory mask = 0775