[SOLVED] Can't see contents of smb shares

Polarity · 2021-03-20 13:21:12

Hi!
I'm trying to set up file sharing and followed the wiki on smb.

I have gotten to the point where I can see shared folders on other computers in my network, but I can't see their contents. Only THAT they are shared.
I shared these folders using the share option in the folder context menu in Nemo.

I followed the guide up to and including the usershares section until:

If you want to share paths inside your home directory you must make it accessible for the group others.

This is not clear to me, but I'm also not sure if it's the cause of my problem.

I have tried sharing folders inside and outside my home directory.

Any help with debugging this would be much appreciated.

No windows machines on my network. Only Linux and macOS.

my smb.conf

======================= Global Settings =====================================
[global]

# workgroup = NT-Domain-Name or Workgroup-Name, eg: MIDEARTH
   workgroup = WORKGROUP

# server string is the equivalent of the NT Description field
   server string = Samba Server

# Server role. Defines in which mode Samba will operate. Possible
# values are "standalone server", "member server", "classic primary
# domain controller", "classic backup domain controller", "active
# directory domain controller".
#
# Most people will want "standalone server" or "member server".
# Running as "active directory domain controller" will require first
# running "samba-tool domain provision" to wipe databases and create a
# new domain.
   server role = standalone server
   server min protocol = SMB2_02

  usershare path = /var/lib/samba/usershares
  usershare max shares = 100
  usershare allow guests = no
  usershare owner only = yes

# This option is important for security. It allows you to restrict
# connections to machines which are on your local network. The
# following example restricts access to two C class networks and
# the "loopback" interface. For more examples of the syntax see
# the smb.conf man page
;   hosts allow = 192.168.1. 192.168.2. 127.
;   hosts allow = 10.0.0. 127.

# Uncomment this if you want a guest account, you must add this to /etc/passwd
# otherwise the user "nobody" is used
;  guest account = pcguest

# this tells Samba to use a separate log file for each machine
# that connects
   log file = /var/log/samba/%m.log

# Put a capping on the size of the log files (in Kb).
   max log size = 50

# Specifies the Kerberos or Active Directory realm the host is part of
;   realm = MY_REALM

# Backend to store user information in. New installations should 
# use either tdbsam or ldapsam. smbpasswd is available for backwards 
# compatibility. tdbsam requires no further configuration.
;   passdb backend = tdbsam

# Using the following line enables you to customise your configuration
# on a per machine basis. The %m gets replaced with the netbios name
# of the machine that is connecting.
# Note: Consider carefully the location in the configuration file of
#       this line.  The included file is read at that point.
;   include = /usr/local/samba/lib/smb.conf.%m

# Configure Samba to use multiple interfaces
# If you have multiple network interfaces then you must list them
# here. See the man page for details.
;   interfaces = 192.168.12.2/24 192.168.13.2/24 

# Where to store roving profiles (only for Win95 and WinNT)
#        %L substitutes for this servers netbios name, %U is username
#        You must uncomment the [Profiles] share below
;   logon path = \\%L\Profiles\%U

# Windows Internet Name Serving Support Section:
# WINS Support - Tells the NMBD component of Samba to enable it's WINS Server
;   wins support = yes

# WINS Server - Tells the NMBD components of Samba to be a WINS Client
#	Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
;   wins server = w.x.y.z

# WINS Proxy - Tells Samba to answer name resolution queries on
# behalf of a non WINS capable client, for this to work there must be
# at least one	WINS Server on the network. The default is NO.
;   wins proxy = yes

# DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
# via DNS nslookups. The default is NO.
   dns proxy = no 

# These scripts are used on a domain controller or stand-alone 
# machine to add or delete corresponding unix accounts
;  add user script = /usr/sbin/useradd %u
;  add group script = /usr/sbin/groupadd %g
;  add machine script = /usr/sbin/adduser -n -g machines -c Machine -d /dev/null -s /bin/false %u
;  delete user script = /usr/sbin/userdel %u
;  delete user from group script = /usr/sbin/deluser %u %g
;  delete group script = /usr/sbin/groupdel %g


#============================ Share Definitions ==============================
[homes]
   comment = Home Directories
   browseable = no
   writable = no

# Un-comment the following and create the netlogon directory for Domain Logons
; [netlogon]
;   comment = Network Logon Service
;   path = /usr/local/samba/lib/netlogon
;   guest ok = yes
;   writable = no
;   share modes = no


# Un-comment the following to provide a specific roving profile share
# the default is to use the user's home directory
;[Profiles]
;    path = /usr/local/samba/profiles
;    browseable = no
;    guest ok = yes


# NOTE: If you have a BSD-style print system there is no need to 
# specifically define each individual printer
[printers]
   comment = All Printers
   path = /usr/spool/samba
   browseable = no
# Set public = yes to allow user 'guest account' to print
   guest ok = no
   writable = no
   printable = yes

# This one is useful for people to share files
;[tmp]
;   comment = Temporary file space
;   path = /tmp
;   read only = no
;   public = yes

# A publicly accessible directory, but read only, except for people in
# the "staff" group
;[public]
;   comment = Public Stuff
;   path = /home/samba
;   public = yes
;   writable = no
;   printable = no
;   write list = @staff

# Other examples. 
#
# A private printer, usable only by fred. Spool data will be placed in fred's
# home directory. Note that fred must have write access to the spool directory,
# wherever it is.
;[fredsprn]
;   comment = Fred's Printer
;   valid users = fred
;   path = /homes/fred
;   printer = freds_printer
;   public = no
;   writable = no
;   printable = yes

# A private directory, usable only by fred. Note that fred requires write
# access to the directory.
;[fredsdir]
;   comment = Fred's Service
;   path = /usr/somewhere/private
;   valid users = fred
;   public = no
;   writable = yes
;   printable = no

# a service which has a different directory for each machine that connects
# this allows you to tailor configurations to incoming machines. You could
# also use the %U option to tailor it by user name.
# The %m gets replaced with the machine name that is connecting.
;[pchome]
;  comment = PC Directories
;  path = /usr/pc/%m
;  public = no
;  writable = yes

# A publicly accessible directory, read/write to all users. Note that all files
# created in the directory by users will be owned by the default user, so
# any user with access can delete any other user's files. Obviously this
# directory must be writable by the default user. Another user could of course
# be specified, in which case all files would be owned by that user instead.
;[public]
;   path = /usr/somewhere/else/public
;   public = yes
;   only guest = yes
;   writable = yes
;   printable = no

# The following two entries demonstrate how to share a directory so that two
# users can place files there that will be owned by the specific users. In this
# setup, the directory should be writable by both users and should have the
# sticky bit set on it to prevent abuse. Obviously this could be extended to
# as many users as required.
;[myshare]
;   comment = Mary's and Fred's stuff
;   path = /usr/somewhere/shared
;   valid users = mary fred
;   public = no
;   writable = yes
;   printable = no
;   create mask = 0765

Last edited by Polarity (2021-03-21 15:13:48)

Ferdinand · 2021-03-20 16:32:28

If I understand you right, the folders you can see are shared, but cannot enter into, are inside users home directories?

In this case, it seems like an access problem, and I would expect to see that confirmed in the samba logs on the sharing computers.

The problem is likely solved by the wiki passage you referenced; the home directories must be readable by samba (or it won't be able to share them) and the users that should be allowed to access them - and the way to fix that is to make the files and directories world readable. The wiki wording is a bit off I think, as there is no group named "other", but the file permissions must allow others to read files and read and execute directories (e.g. rwxr-xr-x for a directory).

I have never tried this myself, because I think it a bit too hairy - so I might have got something wrong - but in any case I would check those logfiles.

Polarity · 2021-03-20 17:30:33

Thanks for your reply!

I think I've made some progress.

But first to your questions/suggestions:
It's both. Folders inside the home directory and outside on a different drive.

The logs do show a lot of errors like this:

[2021/03/20 18:10:11.379311,  0] ../../source3/smbd/service.c:166(chdir_current_service)
  chdir_current_service: vfs_ChDir(/mnt/files/MyShare) failed: Permission denied. Current token: uid=1001, gid=1001, 1 groups: 1001

But the permissions of MyShare are actually drwxrwxrwx.
And Nemo gives a warning in the share dialog: "The permissions for /mnt/files prevent other users from accessing this share"

Upon posting it here I noticed that this is actually referring to the entire drive rather than just the folder. - When I changed permissions of the folder, it worked!

So now I basically have to set my drives and my entire home directory /home/user to rwxr-xrwx.

Is this really how it works and the only way?
And are there any downsides to doing this? (I'm the only one who uses my computer)

______
Edit:

All files written to the shared folder from the network are now owned by the user I created for the samba login. Is there a way to automatically have those files have rwxr-xrwx permissions?

Last edited by Polarity (2021-03-20 18:29:54)

jonno2002 · 2021-03-21 00:43:01

for guest access yes, all folders above the one being shared need the "r" and "x" permissions set for "other" (rwx---r-x)
if you dont like that then add yourself as a samba user and use authentication when connecting to shares from remote machines
https://wiki.archlinux.org/index.php/sa … management

Ferdinand · 2021-03-21 11:07:04

Polarity wrote:

Is this really how it works and the only way?
And are there any downsides to doing this? (I'm the only one who uses my computer)

It's not the only way - you can configure Samba in many ways - but basically, if you want others to be able to read and write to your files, you must give them read and write access.

Take a look at the link jonno2002 shared.

A good(?) way to do it may be to set aside a separate area for users to share files, and yet a separate area for more extensive collaboration - where all can write (a project area for example):

the home folder is private
in the sharing area:
- the users have write access
- a common group has read access
- others have no access
in the collaboration area:
- root owns the root folder, users own what they create
- a common group has write access
- others have no access

If you want to give access to everybody then you can give access to "others", or put all your users in a common group and give access to that group, for example.
Only you can decide what is best for you

The smb.conf documentation over at the Samba website is a good reference.

At home (with just two users) I chose to specify exactly the users per share:

[Collaboration]
    comment = Write for all
    path = /mnt/Userfiles/Collaboration
    valid users = user1, user2
    public = no
    writable = yes
    available = yes
    browsable = yes
    # Masks forces off all unset bits (AND)
    create mask = 660
    directory mask = 770
    # Force modes forces on all set bits (OR)
    force create mode = 660
    force directory mode = 770
    # Name mangling
    case sensitive = yes
    default case = lower
    preserve case = yes
    short preserve case = no
    mangled names = no

[User1]
    comment = User1 share area
    path = /mnt/Userfiles/User1
    valid users = user1, user2
    public = no
    writable = no
    write list = user1
    available = yes
    browsable = yes
    # Masks forces off all unset bits (AND)
    create mask = 640
    directory mask = 750
    # Force modes forces on all set bits (OR)
    force create mode = 640
    force directory mode = 750
    # Name mangling
    case sensitive = yes
    default case = lower
    preserve case = yes
    short preserve case = no
    mangled names = no

[User2]
    comment = User2 share area
    path = /mnt/Userfiles/User2
    valid users = user1, user2
    public = no
    writable = no 
    write list = user2
    available = yes
    browsable = yes
    # Masks forces off all unset bits (AND)
    create mask = 640
    directory mask = 750
    # Force modes forces on all set bits (OR)
    force create mode = 640
    force directory mode = 750
    # Name mangling
    case sensitive = yes
    default case = lower
    preserve case = yes
    short preserve case = no
    mangled names = no

Last edited by Ferdinand (2021-03-21 11:12:23)

Polarity · 2021-03-21 15:13:22

Thanks everyone for the replies and suggestions. I think I have a much better understanding now of how this works.

For now I went with adding my user to the samba group and created a password. Since it's only me using all of this, it's the easiest solution and it works nicely. But that might change in the future and now this is a great thread to come back to.

All the best to you!

Arch Linux

#1 2021-03-20 13:21:12

[SOLVED] Can't see contents of smb shares

#2 2021-03-20 16:32:28

Re: [SOLVED] Can't see contents of smb shares

#3 2021-03-20 17:30:33

Re: [SOLVED] Can't see contents of smb shares

#4 2021-03-21 00:43:01

Re: [SOLVED] Can't see contents of smb shares

#5 2021-03-21 11:07:04

Re: [SOLVED] Can't see contents of smb shares

#6 2021-03-21 15:13:22

Re: [SOLVED] Can't see contents of smb shares

Board footer