Introduction to Samba

Introduction

Samba is an open-source implementation of the SMB/CIFS protocol that Microsoft uses to connect hosts to share drives and printers.

The Big picture

If you want to log who does what on the Samba server, each Windows user must have their own Linux account. To share a directory or printer on a Linux server with Windows users, you must first create accounts on the Linux host (No need to provide a login shell if the user will only interact with the server through Samba), then use smbpasswd (or pdbedit) to add their password to the Samba password database (since password hashing in Linux and Windows aren't compatible), edit smb.conf to share a directory, and finally check Unix file access rights on that directory to make sure Samba and Windows users can work with it as planned. Samba can further restrict access rights, but cannot add more than those set by Unix.

Generally speaking, remember that Samba is just a layer on top of Unix: This means that things must be configured right both in Samba and Unix (user accounts, file access rights).

Things to know:

1. Make sure both hosts are reachable over the network (ping), and firewalls are configured to handle NetBIOS packets
2. To share a directory in read-only, you just need to make sure /etc/passwd includes "nobody", the target shared directory exists and belongs to "nobody" (chown -R nobody:nogroup /my/share; chmod 770 /my/share)
3. After editing smb.conf, always run "testparm smb.conf". Note that this will leave out default settings; For a full dump, run "testparm -sv smb.conf". You can also use testparm to check access from a remote host: testparm /etc/samba/smb.conf remote-laptop 10.0.0.1
4. Once Samba is up and running, you can open a DOS box on the remote Windows host, and type "net view \\192.168.0.1" to list the shares on that host, and "net view" to view all available hosts on the network; If "net view" doesn't work, there's a problem with network browsing
5. Remember to run eg. "/etc/init.d/samba reload" or sometimes "/etc/init.d/samba restart" after editing smb.conf; Check /var/log/messages and /var/log/samba/ for more information

As of 2023, the only books available were published long ago; The wiki is today's authoritive source of infos:

https://wiki.samba.org/index.php/User_Documentation
https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Standalone_Server
https://wiki.samba.org/index.php/FAQ#Samba_as_an_standalone_server

Since NetBIOS is definitely on its way out since SMBv1 had to be turned off after WannaCry, take a look at wsdd/Avahi/Bonjour (so Samba hosts can advertise themselves on the network) and DynamicDNS (what Linux implementation?)

Installing Samba on Debian

Ubuntu (11.04) offers several packages to install Samba. Note that "samba" refers implicitely to Samba 3, while samba4 refers to... Samba 4.

Here are the Samba 3 packages:

• samba - SMB/CIFS file, print, and login server for Unix
• samba-common - common files used by both the Samba server and client
• samba-common-bin - common files used by both the Samba server and client
• samba-doc - Samba documentation
• samba-doc-pdf - Samba documentation in PDF format
• smbclient - command-line SMB/CIFS clients for Unix
• winbind - Samba nameservice integration server
• samba-tools - Samba testing utilities

Here's to install Samba:

1. apt-get update
2. apt-get install samba samba-common
3. To check that Samba is running: ps aux ; netstat -tunlp
4. To restart the two services:
   systemctl restart smbd.service
   systemctl restart nmbd.service
5. To check that smb.conf is correct: testparm
6. Log files in /var/log/samba/
7. To check if *nmd services launch at boot time: systemctl list-unit-files --type=service | grep mbd

Installing Samba on Fedora 5

http://www.reallylinux.com/docs/sambaserver.shtml

http://www.reallylinux.com/docs/windowstolinux.shtml

[root@sip asterisk]# yum search samba

• system-config-samba is a graphical user interface for creating, modifying, and deleting samba shares.
• The samba-swat package includes the new SWAT (Samba Web Administration Tool), for remotely managing Samba's smb.conf file using your favorite Web browser.
• Samba is the suite of programs by which a lot of PC-related machines share files, printers, and other information (such as lists of available files and printers). The Windows NT, OS/2, and Linux operating systems support this natively, and add-on packages can enable the same thing for DOS, Windows, VMS, UNIX of all kinds, MVS, and more. This package provides an SMB server that can be used to provide network services to SMB (sometimes called "Lan Manager") clients. Samba uses NetBIOS over TCP/IP (NetBT) protocols and does NOT need the NetBEUI (Microsoft Raw NetBIOS frame) protocol
• Samba-common provides files necessary for both the server and client packages of Samba
• The samba-client package provides some SMB clients to compliment the built-in SMB filesystem in Linux. These clients allow access of SMB shares and printing to SMB printers.
• smbldap-tools.noarch User and group administration tools for Samba/OpenLDAP. to add, modify and delete users and groups, and to change Unix and Samba passwords. In those contexts they replace the system tools to manage users, groups and passwords.

Securing Samba

Network Browsing

LATER

NetBIOS UDP

WINS, /etc/hosts, DNS

Domain master browser

Local master browser

wsdd

With SMB1 gone because of WannaCry, wsdd lets a Samba server show up in Windows' Network Neighborhood.

apt-get install wsdd

If unavailable as a package:

wget -O- https://pkg.ltec.ch/public/conf/ltec-ag.gpg.key | gpg --dearmour > /usr/share/keyrings/wsdd.gpg

 

source /etc/os-release

 

;IMPORTANT: All on a single line!
echo "deb [signed-by=/usr/share/keyrings/wsdd.gpg] https://pkg.ltec.ch/public/ ${UBUNTU_CODENAME:-${VERSION_CODENAME:-UNKNOWN}} main" > /etc/apt/sources.list.d/wsdd.list

 

apt update

 

apt-get install wsdd

service wsdd start

Python script listening on TCP5357 and and UDP3702/46744.

Infos:

• CHECK once SMBv1 is turned off for safety and wsddn is running, nmbd is no longer needed, along with WINS settings in smb.conf if applicable
• wsdd only supports network browsing through GUI; Say good-bye to "net view" to list all hosts (still works to view shares from a known server). Also, unlike WINS, can't act as name server, so hosts advertise themselves through multi/broadcast
• "net view is provided by Samba's nmbd. If adding wsdd, a host will show up twice in Windows' NetHood (once through NetBIOS, a second time through WSD). Choose your poison
• Win7/10: The service is called "Function Discovery Provider Host". It can also be turned on/off in Advanced sharing settings

smb.conf Samples

Anonymous Read-Only Document Server

Here's /etc/samba/smb.conf:

[global]

workgroup = WORKGROUP

;netbios name = LINUX

 

;Note: security = share is deprecated

security = user

map to guest = bad user

 

;required to make this host master browser and WINS server

wins support = yes

local master = yes

preferred master = yes

domain master = yes

os level = 255

 

;to solve the "WINS server 127.0.0.1 timed out registering IP" message

interfaces = eth0 lo

bind interfaces only = yes
 

;this avoids needless errors in the logs if you have no printer

printcap name = /dev/null

load printers = no

printing = bsd

 

[myshare]

comment = Some comment

path = /my/share

;users will share the "nobody" Unix account

guest ok = yes 

read only = yes

browseable = yes

Here's a newer version, for Samba4 and without WINS (since it's gone with SMB1 turned off):

[global]

workgroup = WORKGROUP

netbios name = MYSRV

server string = Some great server

server role = standalone server

;guest account = nobody

guest account = www-data

map to guest = Bad User

hosts allow = 127.0.0.1 192.168.0.0/24

hosts deny = 0.0.0.0/0

interfaces = lo enp0s20

bind interfaces only = yes

disable netbios = yes

 

log file = /var/log/samba/%m

log level = 1

 

; printers are disabled

disable spoolss = Yes

load printers = No

printcap name = /dev/null

printing = bsd

show add printer wizard= No

 

[guest]

# This share allows anonymous (guest) access without authentication!

path = /var/www/html/

;read only = no

writeable = yes

guest ok = yes

guest only = yes

browseable = yes

comment = Some great directory

public = yes

force create mode = 0660

;force directory mode = 2770

force directory mode = 0770

Anonymous Read-Write Document Server

To let 1) Windows users who log onto their computer without a password 2) connect to a Samba share without typing a password either, here's the smb.conf you can use. This is a very insecure solution since all users will connect and work with the Unix account "nobody", but it can be appropriate for a home solution:

[global]

workgroup = WORKGROUP

netbios name = LINUX

 

;a bit of security

hosts allow = 127.0.0.1 192.168.0.0/24

hosts deny = 0.0.0.0/0

interfaces = eth0 lo

bind interfaces only = yes
 

;security = share is deprecated

security = user

 

;So users don't get 'System error 5 has occurred. Access is denied." when running "net view \\linux"

map to guest = bad user

 

;by default, guest account defaults to Unix user "nobody". Can be changed with "guest account"

;but make sure some.account.other.than.nobody has read-write access to the shared directory

;guest account = some.account.other.than.nobody

 

;interfaces = lo eth0

;if nmbd fails starting, make sure "interfaces" is set to the right interface name

interfaces = 192.168.0.15/255.255.255.0 127.0.0.1/255.255.255.255

 

;to solve the "WINS server 127.0.0.1 timed out registering IP" message

bind interfaces only = yes

 

wins support = no

;to make the host the WINS server

;wins support = yes

;local master = yes

;preferred master = yes

;domain master = yes

;os level = 255

 

;this avoids needless errors in the logs if you have no printer

printcap name = /dev/null

load printers = no

printing = bsd

 

[myshare]

comment = Data

path = /myshare

;Remember to run "chown -R guest.account /myshare"

writable = yes

guest ok = yes

 

browseable=yes

force create mode = 0644

create mask = 0664

#Unknown parameter encountered: "security mask"

security mask = 0664

#Unknown parameter encountered: "force security mode"

force security mode = 0664

Secure Read-Write File and Print Server

This requires first adding a user + password in /etc/passwd and a matching account in the Samba database (smbpass -a jdoe); This user account + password must match the one in Windows so that the user isn't prompted when trying to connect to a Samba share:

mkdir /export

;Assume all Samba users belong to "nogroup"

chown nobody:nogroup /export

chmod 770 /export

Here's smb.conf:

[global]

workgroup = WORKGROUP

netbios name = LINUX

 

[homes]

comment = Home Directories

valid users = %S

read only = No

browseable = No

 

[public]

comment = Data

path = /export

read only = No

Changing a user's encrypted password on an NT PDC

As root, run smbpasswd -r MYPDC. To specify a user account different from root, use the -U option

security=share or security=user

security=server or security=domain

The Samba documentation mentions a add_user script that lets Samba create user accounts on the fly when a new NT user connects to Samba, but I haven't found a trace of it in the 2.0.7-x RPM package that I installed.

I haven't tried it yet, but the following could work: add user script = /usr/sbin/useradd %u. With security=( server | domain), Samba does not store a copy of user passwords; it forwards the authentication step to a DC. So, I guess you can leave those dynamicall-created accounts with no password, and not worry about running passwd or smbpasswd.

To authenticate users against NT DCs, set password server = MYPDC, MYBDC. Alternatively, set password server = * to tell Samba to find DCs itself (by querying a WINS server or other means, and look for MYDOMAIN<1C> resources.)

Securing Samba through IPs

Here's how to configure Samba so it will only accept connections from certain IPs:

hosts allow = 127.0.0.1 192.168.2.0/24 192.168.3.0/24

hosts deny = 0.0.0.0/0

Making Samba a member of an NT domain

1. Stop Samba
2. On the NT PDC, create a computer account for the Samba server
3. On the Samba server, edit /etc/smb.conf, set security=domain and password server = MYPDC MYBDC. If MYPDC cannot be resolved, check that NetBIOS name resolving works.
4. run smbpasswd -J MYDOMAIN

[global]
        printing = BSD
        print command = /usr/bin/lpr -r  %s
	printcap file = /etc/printcap

[printers]
        path = /var/spool/printer
        printable = true 
        guest ok = true
        guest account = pcguest

[printer1]
        printable = yes
        printer = lp
        read only = yes
        guest ok = yes

	[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\VNETSUP]
	" EnablePlainTextPassword"=dword:00000001

        unix password sync = yes
        passwd program = /usr/bin/passwd %u

	for host in `cat ./hosts.txt`
	do
		smbtar -s $host -u test%tttttttt -x backup -d / -t /dev/tape -v *.c *.cpp *.h
	done
	

	#!/bin/bash
	#------- Remove old log files
	if [ -f ./log.txt ]
	then
	        mv ./log.txt ./log.txt.prev
	fi
	
	if [ -f ./log.err.txt ]
	then
	        mv ./log.err.txt ./log.err.txt.prev
	fi
	
	exec >./log.txt 2>./log.err.txt
	
	#----------- Start copying
	if [ ! -d ./AcmeBackup ]
	then
	        mkdir ./AcmeBackup
	fi 
	
	cd ./AcmeBackup
	
	for host in `cat ../acme.txt`
	do
	        if [ ! -d ./$host ]
	        then
	                mkdir ./$host
	        fi 
	
	        cd ./$host
	
	        echo Started backing up $host at `date`
	
	        smbclient //$host/backup -U BackupExec%password -R wins << EOF > /dev/null
	        prompt off
	        recurse
	
	        mask *.c
	        mget *
	
	        mask *.cpp
	        mget *
	
	        mask *.h
	        mget *
	
	        exit
	EOF
	
	        echo Back up of $host ended at `date`
	
	        cd ..
	
	done