Trouble making a shared space #73

dngray · 2021-08-10T15:30:38Z

dngray
Aug 10, 2021

I'm trying to set this up so user1, and user2 both have their own shares, whilst they can both read/write to a public shared space, when belonging to a shared group:

When trying to list /mnt/shared I get this:

NT_STATUS_ACCESS_DENIED listing \*

Here's my docker-compose.yml

services:
  samba:
    image: crazymax/samba
    container_name: samba
    hostname: samba.internal
    networks:
      external_v3:
        ipv4_address: 192.168.3.132
    volumes:
      - "/mnt/data/container_data/samba:/data"
      - "/home/user1:/home/user1"
      - "/home/user2:/home/user2"
      - "/mnt/data/shared:/mnt/shared"
    environment:
      - "TZ=UTC"
      - "SAMBA_LOG_LEVEL=0"
    restart: always

and my data/config.yml

auth:
  - user: user1
    group: user1
    uid: 1000
    gid: 1000
    password: {{ password }}
  - user: user2
    group: user2
    uid: 1001
    gid: 1001
    password: {{ password }}

global:
  - "force user = shared"
  - "force group = shared"

share:
  - name: shared
    path: /mnt/shared
    browsable: yes
    readonly: no
    guestok: no
    validusers: user1
    writelist: user1
    veto: no
  - name: user1
    path: /home/user1
    browsable: yes
    readonly: no
    guestok: no
    validusers: user1
    writelist: user1
    veto: no
  - name: user2
    path: /home/user2
    browsable: yes
    readonly: no
    guestok: no
    validusers: user2
    writelist: user2
    veto: no

Normally this is what i have in my /etc/smb.conf (in my old setup)

[user1]
   comment = user1's directory
   path = /home/user1
   valid users = user1
   public = no
   writable = yes
   printable = no
[user2]
   comment = user1's directory
   path = /home/user2
   valid users = user2
   public = no
   writable = yes
   printable = no
[public]
   comment = Public Stuff
   path = /mnt/data/shared
   public = yes
   writable = no
   printable = no
   write list = @shared

The shared group exists on the host as well, and users in it can write to /mnt/data/shared.

Answered by dngray

Aug 5, 2022

I got this working

Correct syntax is a comma for multiple users
Remove the global definition if you want to login with more than one account

services:
  samba:
    image: crazymax/samba
    container_name: samba
    network_mode: host
    volumes:
      - "/mnt/container_data/samba/data:/data"
      - "/home/user1:/samba/user1"
      - "/home/user2:/samba/user2"
      - "/mnt/shared:/samba/shared"
    environment:
      - "SAMBA_LOG_LEVEL=0"
    restart: always

auth:
  - user: user1
    group: user1
    uid: 1000
    gid: 1000
    password: xxxxx
  - user: user2
    group: user2
    uid: 1001
    gid: 1001
    password: xxxxx

#global:
#  - "force user = user1"
#  - "force group = user1…

View full answer

dngray · 2021-08-16T04:37:57Z

dngray
Aug 16, 2021
Author

Not sure if you saw this @crazy-max, bump

0 replies

crazy-max · 2021-09-08T16:19:31Z

crazy-max
Sep 8, 2021
Maintainer

@dngray Can you post the logs of the container please? What kind of fs is /mnt/data/shared?

0 replies

dngray · 2021-09-12T05:08:41Z

dngray
Sep 12, 2021
Author

@dngray Can you post the logs of the container please?

Sure.

$ sudo docker-compose up
Building with native build. Learn about native build in Compose here: https://docs.docker.com/go/compose-native-build/
Starting samba ... done
Attaching to samba
samba    | Setting timezone to UTC
samba    | Initializing files and folders
samba    | Setting global configuration
samba    | Creating user user1/user1 (1000:1000)
samba    | Creating user user2/user2 (1001:1001)
samba    | Add global option: force user = user1
samba    | Add global option: force group = user1
samba    | Creating share shared
samba    | Creating share user1
samba    | Creating share user2
samba    | Load smb config files from /etc/samba/smb.conf
samba    | lpcfg_do_global_parameter: WARNING: The "encrypt passwords" option is deprecated
samba    | Loaded services file OK.
samba    | Weak crypto is allowed
samba    |
samba    | Server role: ROLE_STANDALONE
samba    |
samba    | # Global parameters
samba    | [global]
samba    | 	bind interfaces only = Yes
samba    | 	client min protocol = CORE
samba    | 	disable netbios = Yes
samba    | 	disable spoolss = Yes
samba    | 	dns proxy = No
samba    | 	local master = No
samba    | 	map to guest = Bad User
samba    | 	pam password change = Yes
samba    | 	printcap name = /dev/null
samba    | 	security = USER
samba    | 	server min protocol = SMB2
samba    | 	server role = standalone server
samba    | 	server services = s3fs, rpc, wrepl, ldap, cldap, kdc, drepl, winbindd, ntp_signd, kcc, dnsupdate
samba    | 	server string = Docker Samba Server
samba    | 	smb ports = 445
samba    | 	unix extensions = No
samba    | 	usershare allow guests = Yes
samba    | 	fruit:time machine = yes
samba    | 	fruit:delete_empty_adfiles = yes
samba    | 	fruit:wipe_intentionally_left_blank_rfork = yes
samba    | 	fruit:veto_appledouble = no
samba    | 	fruit:posix_rename = yes
samba    | 	fruit:model = MacSamba
samba    | 	fruit:metadata = stream
samba    | 	idmap config * : backend = tdb
samba    | 	create mask = 0664
samba    | 	directory mask = 0775
samba    | 	force create mode = 0664
samba    | 	force directory mode = 0775
samba    | 	force group = user1
samba    | 	force user = user1
samba    | 	hosts allow = 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
samba    | 	hosts deny = 0.0.0.0/0
samba    | 	printing = bsd
samba    | 	strict locking = No
samba    | 	vfs objects = fruit streams_xattr
samba    | 	wide links = Yes
samba    |
samba    |
samba    | [shared]
samba    | 	delete veto files = Yes
samba    | 	path = /mnt/shared
samba    | 	read only = No
samba    | 	valid users = user1
samba    | 	veto files = /._*/.apdisk/.AppleDouble/.DS_Store/.TemporaryItems/.Trashes/desktop.ini/ehthumbs.db/Network Trash Folder/Temporary Items/Thumbs.db/
samba    | 	write list = user1
samba    |
samba    |
samba    | [user1]
samba    | 	delete veto files = Yes
samba    | 	path = /home/user1
samba    | 	read only = No
samba    | 	valid users = user1
samba    | 	veto files = /._*/.apdisk/.AppleDouble/.DS_Store/.TemporaryItems/.Trashes/desktop.ini/ehthumbs.db/Network Trash Folder/Temporary Items/Thumbs.db/
samba    | 	write list = user1
samba    |
samba    |
samba    | [user2]
samba    | 	delete veto files = Yes
samba    | 	path = /home/user2
samba    | 	read only = No
samba    | 	valid users = user2
samba    | 	veto files = /._*/.apdisk/.AppleDouble/.DS_Store/.TemporaryItems/.Trashes/desktop.ini/ehthumbs.db/Network Trash Folder/Temporary Items/Thumbs.db/
samba    | 	write list = user2
samba    | smbd version 4.14.5 started.
samba    | Copyright Andrew Tridgell and the Samba Team 1992-2021
samba    | daemon_ready: daemon 'smbd' finished starting up and ready to serve connections

What kind of fs is /mnt/data/shared?

It is a ZFS dataset ie POOL/shared mounted to /mnt/data/shared

Note that in the docker container /mnt/data/shared/ is mounted to just /mnt/shared

Note currently shared only allows for valid users = user1 but I actually want it to allow both user1 and user2.

0 replies

crazy-max · 2021-09-12T05:52:02Z

crazy-max
Sep 12, 2021
Maintainer

@dngray

Note currently shared only allows for valid users = user1 but I actually want it to allow both user1 and user2.

Oh ok so it works for user1 but not user2?

0 replies

dngray · 2021-09-12T06:30:11Z

dngray
Sep 12, 2021
Author

@dngray

Note currently shared only allows for valid users = user1 but I actually want it to allow both user1 and user2.

Oh ok so it works for user1 but not user2?

hmm. weirdly not now... I am sure it used to though.

smbclient -U user1 //smb.internal/user1

Works.

smbclient -U user2 //smb.internal/user2
Enter WORKGROUP\user2's password:
Try "help" to get a list of possible commands.
smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*

It connects but can't seem to list. I see this in the log:

samba    | chdir_current_service: vfs_ChDir(/home/user2) failed: Permission denied. Current token: uid=1000, gid=1000, 1 groups: 1000

Which is kind of weird as the UID/GID should be 1001. The current user on my linux machine though is 1000 (ie that i am logged into).

smbclient -U user1 //smb.internal/shared
Enter WORKGROUP\user1's password:
Try "help" to get a list of possible commands.
smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*

No errors in the log.

smbclient -U user2 //smb.internal/shared
Enter WORKGROUP\user2's password:
tree connect failed: NT_STATUS_ACCESS_DENIED

To be expected as shared only has:

validusers: user1
writelist: user1

Can I specify a group? I guess that doesn't really make sense inside the docker container. Both the users are in a shared group on the host though. Can I specify multiple users?

0 replies

dngray · 2022-02-01T17:33:46Z

dngray
Feb 1, 2022
Author

I never actually found a solution to this.

0 replies

dngray · 2022-08-05T08:45:34Z

dngray
Aug 5, 2022
Author

I got this working

Correct syntax is a comma for multiple users
Remove the global definition if you want to login with more than one account

services:
  samba:
    image: crazymax/samba
    container_name: samba
    network_mode: host
    volumes:
      - "/mnt/container_data/samba/data:/data"
      - "/home/user1:/samba/user1"
      - "/home/user2:/samba/user2"
      - "/mnt/shared:/samba/shared"
    environment:
      - "SAMBA_LOG_LEVEL=0"
    restart: always

auth:
  - user: user1
    group: user1
    uid: 1000
    gid: 1000
    password: xxxxx
  - user: user2
    group: user2
    uid: 1001
    gid: 1001
    password: xxxxx

#global:
#  - "force user = user1"
#  - "force group = user1"

share:
  - name: shared
    path: /samba/shared
    browsable: yes
    readonly: no
    guestok: no
    validusers: user1,user2
    writelist: user1,user2
    veto: no
  - name: user1
    path: /samba/user1
    browsable: yes
    readonly: no
    guestok: no
    validusers: user1
    writelist: user1
    veto: no
  - name: user2
    path: /samba/user2
    browsable: yes
    readonly: no
    guestok: no
    validusers: user2
    writelist: user2
    veto: no

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Trouble making a shared space #73

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 7 comments

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

Trouble making a shared space #73

dngray Aug 10, 2021

Replies: 7 comments

dngray Aug 16, 2021 Author

crazy-max Sep 8, 2021 Maintainer

dngray Sep 12, 2021 Author

crazy-max Sep 12, 2021 Maintainer

dngray Sep 12, 2021 Author

dngray Feb 1, 2022 Author

dngray Aug 5, 2022 Author

dngray
Aug 10, 2021

dngray
Aug 16, 2021
Author

crazy-max
Sep 8, 2021
Maintainer

dngray
Sep 12, 2021
Author

crazy-max
Sep 12, 2021
Maintainer

dngray
Sep 12, 2021
Author

dngray
Feb 1, 2022
Author

dngray
Aug 5, 2022
Author