Samba file server¶

Practical 6.2 samba-file-server-annex.pdf · PDF

You and the person next to you must work on the same document this week. How do you pass it? A USB stick, WhatsApp, email, Drive. Now imagine you are twelve people, and the file changes ten times a day. Which copy is the good one?

Every office in the world knows these file names: logo_final.png, logo_final2.png, logo_final_GOOD.png. That is the mess Tramuntana Apps lives in today. This page fixes it with the oldest and most useful job a server does: keeping one copy of every file, for everybody.

One cabinet for everybody¶

A file server is a server whose service is to keep files and give them to the clients over the network.

Think of one filing cabinet in the corridor instead of twelve drawers at twelve desks. It gives you one copy, one backup, and one place to decide who opens what.

A share is a folder of the server that it offers to the network under a name: one labelled drawer of the cabinet.

A little history: SMB and Samba¶

• 1983, IBM: Barry Feigenbaum designs a protocol so that PCs can use the files and printers of another PC. He first calls it "BAF", his initials; it ships as SMB, Server Message Block. Microsoft adopts it: it is what Windows speaks every time you open a "network folder".
• January 1992, Australian National University: Andrew Tridgell, a PhD student, wants his PC to reach files on a Unix machine. He has no description of the protocol, so he watches the packets on the network (a sniffer, like Wireshark) and writes a server that answers the same way. A company owns the name "SMBserver", so he searches the dictionary for words with the letters S, M, B in that order. He picks Samba.
• 12 May 2017: the worm WannaCry encrypts more than 200,000 Windows computers in about 150 countries in a few days. It spread through a flaw in the oldest version of the protocol, SMB 1. Today SMB 1 is switched off almost everywhere, and you will see the proof on your own screen.

Samba is free software that makes Linux speak SMB, the Windows file-sharing protocol. It is not a Windows program.

The pieces you will touch:

Install Samba and create the first share¶

From today you work on the server through SSH (ssh srv); nobody uses its console. Take a snapshot pre-samba first.

sudo apt update && sudo apt install samba
systemctl status smbd --no-pager | head -5
sudo ss -tlnp | grep smbd

The status should say active (running), and smbd listens on 445 (older set-ups also show 139).

Now the folder, and a copy of the original configuration in case you break it:

sudo mkdir -p /srv/samba/common
sudo chmod 1777 /srv/samba/common
sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.orig
sudo nano /etc/samba/smb.conf

The 1 in 1777 is the sticky bit from Unit 5: everybody can create files, but only the owner can delete them. Exactly what a common folder needs.

Add this section at the end of smb.conf:

[common]
   comment = Everybody at Tramuntana
   path = /srv/samba/common
   valid users = @dev @design @admin
   read only = no

• [common] is the share name the network sees.
• path is the real folder on the server's disk.
• valid users says who may open the drawer. @dev means "the members of the Linux group dev".
• read only = no lets them write.

Check it, then restart the service:

$ testparm -s
Load smb config files from /etc/samba/smb.conf
Loaded services file OK.
...
$ sudo systemctl restart smbd

Changed smb.conf and nothing happened? You forgot the restart, or the client is still connected with the old settings.

A second password: Samba users¶

$ sudo smbpasswd -a marta
New SMB password:
Retype new SMB password:
Added user marta.
$ sudo pdbedit -L
marta:1001:
joan:1002:

Why does Marta need another password? Windows clients do not send the password itself; they send a proof computed from it, in a format the Linux password file cannot check. So Samba keeps its own list. The user must exist in Linux first (smbpasswd -a fails for a user who is not in /etc/passwd), and then gets a Samba password.

How clients ask for a share¶

The address of a share is the server name plus the share name.

A UNC path (Universal Naming Convention) is the Windows way to write a network address: two backslashes, the server, a backslash, the share.

From Linux¶

On deb-lab:

sudo apt install smbclient cifs-utils
smbclient -L //ubu-srv -U marta

    Sharename       Type      Comment
    ---------       ----      -------
    print$          Disk      Printer Drivers
    common          Disk      Everybody at Tramuntana
    IPC$            IPC       IPC Service (ubu-srv server (Samba, Ubuntu))
SMB1 disabled -- no workgroup available

Look at the last line: SMB1 disabled. The WannaCry door, closed.

smbclient //ubu-srv/common -U marta opens a prompt smb: \> where ls, put file and get file work like a tiny file manager. Or use the real one: Other Locations → smb://ubu-srv/common (leave the domain as WORKGROUP).

To use the share like a local folder, mount it:

sudo mkdir /mnt/common
sudo mount -t cifs //ubu-srv/common /mnt/common -o username=joan,uid=$(id -u),gid=$(id -g)
df -hT /mnt/common
touch /mnt/common/from-mount.txt
sudo umount /mnt/common

df -hT shows the type cifs and the source //ubu-srv/common. On the server, from-mount.txt is owned by joan, the user of the mount. If mount says bad option, the package cifs-utils is missing.

From Windows¶

1. In File Explorer's address bar: \\192.168.122.10\common, then user marta and her Samba password.
2. This PC → the three dots in the toolbar → Map network drive → letter Z: → the same folder → tick Connect using different credentials.
3. Create a file in Z:. On the server, ls -l /srv/samba/common shows it owned by marta: the user you typed, not your Windows account name. The server only knows the identity that was proved to it.

Windows 11 no longer accepts shares without a user: since version 24H2, guest access is off on Pro and every connection must be signed. That is why our share has valid users and no guest access.

Common Windows slips: Windows cannot access \\ubu-srv → win11 does not know that name, use the address · the password is "wrong" but it is right → type the user as ubu-srv\marta · Windows remembers the first user for the whole server → net use * /delete, then connect again.

Four doors: reading the error¶

To take a paper from the cabinet you pass four doors, always in this order. Each closed door gives its own message (all real, from Samba 4.23):

flowchart LR
    D1["<b>1 · The building</b><br>network: address,<br>server on, firewall"] --> D2["<b>2 · Reception</b><br>who are you?<br>Samba user + password"]
    D2 --> D3["<b>3 · The drawer</b><br>the share:<br>valid users"]
    D3 --> D4["<b>4 · The paper</b><br>Linux file<br>permissions"]

And before any door, the builder's check. Here is testparm after a typo:

$ testparm -s
Unknown parameter encountered: "raed only"
Ignoring unknown parameter "raed only"
Loaded services file OK.

When the message is not enough, read the server's logs: sudo journalctl -u smbd -n 30 and the files in /var/log/samba/. Status first, then logs, as in Unit 5.

The Practical 6.2 sheet asks you to close three doors on purpose (a wrong password, chmod 755 on the folder, the raed only typo), read each message, and repair it.

Key takeaways¶

• A file server gives one copy, one backup and one place for permissions. Each share is a named folder it offers to the network.
• SMB (IBM, 1983) is the Windows file protocol; Samba (Andrew Tridgell, 1992) makes Linux speak it. SMB 1 spread WannaCry in 2017 and is now disabled.
• A share is a section in /etc/samba/smb.conf; check it with testparm -s (read the warnings) and restart smbd.
• Samba keeps its own password list: the Linux user must exist, then smbpasswd -a.
• Clients use a UNC path \\server\share on Windows (or a mapped drive) and smbclient or mount -t cifs on Linux.
• Read the error to find the closed door: network, logon failure, tree connect denied, or file-system permissions.

Quick check¶

Today everybody opens the same drawer. Next: one drawer per department, and the invoices are not for the interns. Go to Share permissions and groups.