Translations by ZhongHan Cai

Another common use of Samba is to configure it to share printers installed, either locally or over the network, on an Ubuntu server. Similar to <xref linkend="samba-fileserver"/> this section will configure Samba to allow any client on the local network to use the installed printers without prompting for a username and password.

For a more secure configuration see <xref linkend="samba-fileprint-security"/>.

Before installing and configuring Samba it is best to already have a working <application>CUPS</application> installation. See <xref linkend="cups"/> for details.

To install the <application>samba</application> package, from a terminal enter:

After installing samba edit <filename>/etc/samba/smb.conf</filename>. Change the <emphasis>workgroup</emphasis> attribute to what is appropriate for your network, and change <emphasis>security</emphasis> to <emphasis role="italic">share</emphasis>:

In the <emphasis>[printers]</emphasis> section change the <emphasis>guest ok</emphasis> option to <emphasis role="italic">yes</emphasis>:

browsable = yes guest ok = yes

The default Samba configuration will automatically share any printers installed. Simply install the printer locally on your Windows clients.

Also, see the <ulink url="http://www.cups.org/">CUPS Website</ulink> for more information on configuring CUPS.

Securing a Samba File and Print Server

Samba Security Modes

There are two security levels available to the Common Internet Filesystem (CIFS) network protocol <emphasis>user-level</emphasis> and <emphasis>share-level</emphasis>. Samba's <emphasis>security mode</emphasis> implementation allows more flexibility, providing four ways of implementing user-level security and one way to implement share-level:

<emphasis>security = user:</emphasis> requires clients to supply a username and password to connect to shares. Samba user accounts are separate from system accounts, but the <application>libpam-smbpass</application> package will sync system users and passwords with the Samba user database.

<emphasis>security = domain:</emphasis> this mode allows the Samba server to appear to Windows clients as a Primary Domain Controller (PDC), Backup Domain Controller (BDC), or a Domain Member Server (DMS). See <xref linkend="samba-dc"/> for further information.

<emphasis>security = ADS:</emphasis> allows the Samba server to join an Active Directory domain as a native member. See <xref linkend="samba-ad-integration"/> for details.

<emphasis>security = server:</emphasis> this mode is left over from before Samba could become a member server, and due to some security issues should not be used. See the <ulink url="http://samba.org/samba/docs/man/Samba-HOWTO-Collection/ServerType.html#id349531">Server Security</ulink> section of the Samba guide for more details.

<emphasis>security = share:</emphasis> allows clients to connect to shares without supplying a username and password.

The security mode you choose will depend on your environment and what you need the Samba server to accomplish.

Security = User

This section will reconfigure the Samba file and print server, from <xref linkend="samba-fileserver"/> and <xref linkend="samba-printserver"/>, to require authentication.

First, install the <application>libpam-smbpass</application> package which will sync the system users to the Samba user database:

sudo apt-get install libpam-smbpass

If you chose the <emphasis>Samba Server</emphasis> task during installation <application>libpam-smbpass</application> is already installed.

Edit <filename>/etc/samba/smb.conf</filename>, and in the <emphasis>[share]</emphasis> section change:

guest ok = no

Finally, restart Samba for the new settings to take effect:

Now when connecting to the shared directories or printers you should be prompted for a username and password.

If you choose to map a network drive to the share you can check the <quote>Reconnect at Logon</quote> check box, which will require you to only enter the username and password once, at least until the password changes.

Share Security

There are several options available to increase the security for each individual shared directory. Using the <emphasis>[share]</emphasis> example, this section will cover some common options.

By default Samba looks for the local system groups defined in <filename>/etc/group</filename> to determine which users belong to which groups. For more information on adding and removing users from groups see <xref linkend="adding-deleting-users"/>.

When defining groups in the Samba configuration file, <filename>/etc/samba/smb.conf</filename>, the recognized syntax is to preface the group name with an "@" symbol. For example, if you wished to define a group named <emphasis role="italic">sysadmin</emphasis> in a certain section of the <filename>/etc/samba/smb.conf</filename>, you would do so by entering the group name as <emphasis role="bold">@sysadmin</emphasis>.

File Permissions define the explicit rights a computer or user has to a particular directory, file, or set of files. Such permissions may be defined by editing the <filename>/etc/samba/smb.conf</filename> file and specifying the explicit permissions of a defined file share.

For example, if you have defined a Samba share called <emphasis>share</emphasis> and wish to give <emphasis role="italic">read-only</emphasis> permissions to the group of users known as <emphasis role="italic">qa</emphasis>, but wanted to allow writing to the share by the group called <emphasis role="italic">sysadmin</emphasis> and the user named <emphasis role="italic">vincent</emphasis>, then you could edit the <filename>/etc/samba/smb.conf</filename> file, and add the following entries under the <emphasis>[share]</emphasis> entry:

read list = @qa write list = @sysadmin, vincent

Another possible Samba permission is to declare <emphasis>administrative</emphasis> permissions to a particular shared resource. Users having administrative permissions may read, write, or modify any information contained in the resource the user has been given explicit administrative permissions to.

For example, if you wanted to give the user <emphasis role="italic">melissa</emphasis> administrative permissions to the <emphasis role="italic">share</emphasis> example, you would edit the <filename>/etc/samba/smb.conf</filename> file, and add the following line under the <emphasis>[share]</emphasis> entry:

admin users = melissa

After editing <filename>/etc/samba/smb.conf</filename>, restart Samba for the changes to take effect:

For the <emphasis>read list</emphasis> and <emphasis>write list</emphasis> to work the Samba security mode must <emphasis>not</emphasis> be set to <emphasis role="italic">security = share</emphasis>

Now that Samba has been configured to limit which groups have access to the shared directory, the filesystem permissions need to be updated.

Traditional Linux file permissions do not map well to Windows NT Access Control Lists (ACLs). Fortunately POSIX ACLs are available on Ubuntu servers providing more fine grained control. For example, to enable ACLs on <filename>/srv</filename> an EXT3 filesystem, edit <filename>/etc/fstab</filename> adding the <emphasis>acl</emphasis> option:

UUID=66bcdd2e-8861-4fb0-b7e4-e61c569fe17d /srv ext3 noatime,relatime,acl 0 1

Then remount the partition:

sudo mount -v -o remount /srv

The above example assumes <filename>/srv</filename> on a separate partition. If <filename>/srv</filename>, or wherever you have configured your share path, is part of the <filename>/</filename> partition a reboot may be required.