Samba Notes

Package: net-fs/samba

Note that there are kernel options that must be agreeable to Samba. Something like this.

After a lot of research here’s what I think. Samba is doing two things. 1. It is a file transfer protocol, it moves files. And, 2. it decides who can do this, it authenticates. As an authentication mechanism, it’s very flexible. Too flexible. It can keep it’s own users, groups, etc, or it can pass along authentication requests to the underlying system (to PAM, for example). The problem is that when you let Samba use it’s own user database, the records for the passwords are stored in hashes that are different from that which PAM uses. This means that if you want to use PAM (the Linux accounts) you have to enable Samba to pass the passwords in clear text to PAM so that PAM can hash them and compare with what’s in PAM’s database. This works fine in a trusted environment where the chances of someone sniffing passwords off the wire is small, but it is a terrible idea on the wild internet.

There is another way. One possibility is getting an LDAP server set up. With that working, both PAM and Samba can be configured to use the same "directory" of users and hashes (securely).

Perhaps the simplest way to set up is to use smbpasswd, Samba’s own special way of what amounts to keeping an /etc/passwd file. This involves setting up a temporary "directory" (i.e. list) of users in the Samba style (on the Samba server, there will essentially be a separate "password file"). This will require people to have/set a different password (which could be the same).

In the past I used smbpasswd but apparently some things have changed and now there’s a thing called pdbedit. At first I had trouble with this command.

It took a while to figure this out but it turns out that this cured it.

For many situations this problem wouldn’t even come up, but this was on a storage server with no user accounts. It seems that if there are no Unix accounts, there can be no Samba accounts. At the very least, in my case making Unix accounts allowed the Samba accounts to be possible.

I couldn’t figure out how to make pdbedit change Samba passwords, but smbpasswd did still work fine for that.

In smb.conf you need this:

To add Samba users (totally different from Linux PAM users):

Looks like you must have a corresponding Unix account to set the smbpasswd or you get "Failed to modify password entry for user …" So much for the independent authentication mechanisms.

Also you may want to map Samba users to Linux users with whatever was specified here:

Usually contains something like

Note that the real password file seems to live (CentOS7) here.

If it’s zero, you haven’t added your user.

Testing the local host to see if the server is on.

This works for testing the exports.

If there are no passwords.

where "pelican" is the name of the host and "pelicanc" is the name of the share as set in W95.

If you want to use backslashes for some reason, double them up -

The "-N" option bypasses the password prompt.

When in smbclient, FTP commands often work. To exit, "q" works.

THIS IS WRONG

This is correct:

To list what Samba thinks it’s offering:

(Password here seems optional.)

This will mount the share "pelicanc" to path /mnt/pelican -n should be used to mount shares that do not need a password

I had trouble mounting a smb share as non-root. I used su and then had to explicitly call out where smbmount was:

smbumount seems to be for non-root users who use smbmount. To unmount the smb file system as root, use ordinary umount:

If you have trouble mounting because of a host name too long error, "my hostname name too long as a netbios name: cardinal.windmills" try this:

I don’t understand what the deal is, but this makes it work out.

I think on a Mac if you’re in the Finder, you can do a Command-K (or maybe "Go" → "Connect To" if you like menus) and then enter something like this in the "Server Address:" box:

Click the "Connect" button and you’re using your local file manager to move files in and out of the samba server.