How to Secure the passwordless share using samba

[sunnysthakur]

Hello,

I have created a pass wordless share using samba on which i have placed the daily uses s/w for teams. I have assigned rw permissions to all so that if other teams want to copy the useful s/w on this share.

Now the problem is this that some users are start putting their data[Personal, Backup] on this share.

Can this be possible that users can not copy the data on this passwordless share but admin can do.

Thanks,
Sunny
MIT, RHCE
System Administrator [Open Source Technologies]

[jpollard]

Put a password on it and do not export it to everyone.

[sunnysthakur]

Thanks pollard,

This is a fileserver which is open for all the team members and we keep its access as public [Passwordless].

Is there any other method for this scenario that user can access the share without password but can't write and admin can write on the same.

[beaker_]

Easy. Delete their data and flog whoever complains.

[DBelton]

well, there could be a way to export it read only for everyone, but for read/write access it requires a password.

what happens if you put in your smb.conf file the following where you have the share defined?

read list = users
write list = adminuser

You can specify groups (like the wheel group in fedora) by using a + eg: +wheel

There was an example of this provided in the default smb.conf file in Fedora as well...

# A publicly accessible directory that is read only, except for users in the
# "staff" group (which have write permissions):
;	[public]
;	comment = Public Stuff
;	path = /home/samba
;	public = yes
;	writable = yes
;	printable = no
;	write list = +staff

---------- Post added at 08:44 AM ---------- Previous post was at 08:34 AM ----------

Edit:

I seem to recall reading someplace that if you specify the guest ok option, then it pretty much over-rides the write-list and allows guest access r/w access as well. I am trying to find where I saw that to make certain of it, though.

[Doug G]

Another option is to create two different shares to the directory, one is read-only the other is restricted to admin users.

[beaker_]

Ok. I'll guess why: look, your 'home' version of Winblows just does not support domain logins. You won't have any real security without a login so just write a batchfile something like "net use ABC \\AA:BBCD\XYZ /user:WhoEverRepresentsGroup /persistent:no".

Thanks,
Sunny
MIT, RHCE
System Administrator [Open Source Technologies]

What's that?

[sunnysthakur]

Hi belton,

i will go through your conf and revert backup to you.

Thanks all for your suggestions.

---------- Post added at 02:37 PM ---------- Previous post was at 02:34 PM ----------

Hi Douge,

But this is a common s/w repo for all the users. Near about 200 users are accessing this share for pick the s/w for their need.

Do you think 2 share one for admin and one for user is fine for this scenario.

[Doug G]

Do you think 2 share one for admin and one for user is fine for this scenario.

It's what I'd do. One share is set up as read-only, that's the share all the users access without a password. A 2nd share (pointing to the same directories) is set up as read-write and requires an admin user and password.

I don't have hundreds of users, just a few, but this is what I do on a shared music library for my family members and it works fine, the listeners can't mess up the files.

[sunnysthakur]

Hi Doug

Thanks for your solution. This worked for me...