Translations by Shin Hungjae

Fortunately, your Ubuntu system may provide all such facilities to Windows clients and share network resources among them. One of the principal pieces of software your Ubuntu system includes for Windows networking is the Samba suite of SMB server applications and tools.

This section of the <phrase>Ubuntu</phrase> Server Guide will introduce some of the common Samba use cases, and how to install and configure the necessary packages. Additional detailed documentation and information on Samba can be found on the <ulink url="http://www.samba.org">Samba website</ulink>.

One of the most common ways to network Ubuntu and Windows computers is to configure Samba as a File Server. This section covers setting up a <application>Samba</application> server to share files with Windows clients.

The server will be configured to share files with any client on the network without prompting for a password. If your environment requires stricter Access Controls see <xref linkend="samba-fileprint-security"/>

The first step is to install the <application>samba</application> package. From a terminal prompt enter:

sudo apt-get install samba

That's all there is to it; you are now ready to configure Samba to share files.

The main Samba configuration file is located in <filename>/etc/samba/smb.conf</filename>. The default configuration file has a significant amount of comments in order to document various configuration directives.

Not all the available options are included in the default configuration file. See the <filename>smb.conf</filename><application>man</application> page or the <ulink url="http://samba.org/samba/docs/man/Samba-HOWTO-Collection/">Samba HOWTO Collection</ulink> for more details.

First, edit the following key/value pairs in the <emphasis>[global]</emphasis> section of <filename>/etc/samba/smb.conf</filename>:

workgroup = EXAMPLE ... security = user

The <emphasis>security</emphasis> parameter is farther down in the [global] section, and is commented by default. Also, change <emphasis>EXAMPLE</emphasis> to better match your environment.

Create a new section at the bottom of the file, or uncomment one of the examples, for the directory to be shared:

[share] comment = Ubuntu File Server Share path = /srv/samba/share browsable = yes guest ok = yes read only = no create mask = 0755

<emphasis>comment:</emphasis> a short description of the share. Adjust to fit your needs.

<emphasis>path:</emphasis> the path to the directory to share.

This example uses <filename>/srv/samba/sharename</filename> because, according to the <emphasis>Filesystem Hierarchy Standard (FHS)</emphasis>, <ulink url="http://www.pathname.com/fhs/pub/fhs-2.3.html#SRVDATAFORSERVICESPROVIDEDBYSYSTEM">/srv</ulink> is where site-specific data should be served. Technically Samba shares can be placed anywhere on the filesystem as long as the permissions are correct, but adhering to standards is recommended.

<emphasis>browsable:</emphasis> enables Windows clients to browse the shared directory using <application>Windows Explorer</application>.

<emphasis>guest ok:</emphasis> allows clients to connect to the share without supplying a password.

<emphasis>create mask:</emphasis> determines the permissions new files will have when created.

Now that <application>Samba</application> is configured, the directory needs to be created and the permissions changed. From a terminal enter:

sudo mkdir -p /srv/samba/share

sudo chown nobody.nogroup /srv/samba/share/

The <emphasis>-p</emphasis> switch tells mkdir to create the entire directory tree if it doesn't exist. Change the share name to fit your environment.

Finally, restart the <application>samba</application> services to enable the new configuration:

Once again, the above configuration gives all access to any client on the local network. For a more secure configuration see <xref linkend="samba-fileprint-security"/>.

From a Windows client you should now be able to browse to the Ubuntu file server and see the shared directory. To check that everything is working try creating a directory from Windows.

To create additional shares simply create new <emphasis>[dir]</emphasis> sections in <filename>/etc/samba/smb.conf</filename>, and restart <emphasis>Samba</emphasis>. Just make sure that the directory you want to share actually exists and the permissions are correct.

For in depth Samba configurations see the <ulink url="http://samba.org/samba/docs/man/Samba-HOWTO-Collection/">Samba HOWTO Collection</ulink>

The guide is also available in <ulink url="http://www.amazon.com/exec/obidos/tg/detail/-/0131882228">printed format</ulink>.

O'Reilly's <ulink url="http://www.oreilly.com/catalog/9780596007690/">Using Samba</ulink> is another good reference.

Another common use of Samba is to configure it to share printers installed, either locally or over the network, on an Ubuntu server. Similar to <xref linkend="samba-fileserver"/> this section will configure Samba to allow any client on the local network to use the installed printers without prompting for a username and password.

For a more secure configuration see <xref linkend="samba-fileprint-security"/>.

Before installing and configuring Samba it is best to already have a working <application>CUPS</application> installation. See <xref linkend="cups"/> for details.

To install the <application>samba</application> package, from a terminal enter:

After installing samba edit <filename>/etc/samba/smb.conf</filename>. Change the <emphasis>workgroup</emphasis> attribute to what is appropriate for your network, and change <emphasis>security</emphasis> to <emphasis role="italic">share</emphasis>:

In the <emphasis>[printers]</emphasis> section change the <emphasis>guest ok</emphasis> option to <emphasis role="italic">yes</emphasis>:

browsable = yes guest ok = yes

After editing <filename>smb.conf</filename> restart Samba:

The default Samba configuration will automatically share any printers installed. Simply install the printer locally on your Windows clients.

Also, see the <ulink url="http://www.cups.org/">CUPS Website</ulink> for more information on configuring CUPS.

There are two security levels available to the Common Internet Filesystem (CIFS) network protocol <emphasis>user-level</emphasis> and <emphasis>share-level</emphasis>. Samba's <emphasis>security mode</emphasis> implementation allows more flexibility, providing four ways of implementing user-level security and one way to implement share-level:

<emphasis>security = user:</emphasis> requires clients to supply a username and password to connect to shares. Samba user accounts are separate from system accounts, but the <application>libpam-smbpass</application> package will sync system users and passwords with the Samba user database.

<emphasis>security = domain:</emphasis> this mode allows the Samba server to appear to Windows clients as a Primary Domain Controller (PDC), Backup Domain Controller (BDC), or a Domain Member Server (DMS). See <xref linkend="samba-dc"/> for further information.

<emphasis>security = ADS:</emphasis> allows the Samba server to join an Active Directory domain as a native member. See <xref linkend="samba-ad-integration"/> for details.

<emphasis>security = server:</emphasis> this mode is left over from before Samba could become a member server, and due to some security issues should not be used. See the <ulink url="http://samba.org/samba/docs/man/Samba-HOWTO-Collection/ServerType.html#id349531">Server Security</ulink> section of the Samba guide for more details.

<emphasis>security = share:</emphasis> allows clients to connect to shares without supplying a username and password.

The security mode you choose will depend on your environment and what you need the Samba server to accomplish.

This section will reconfigure the Samba file and print server, from <xref linkend="samba-fileserver"/> and <xref linkend="samba-printserver"/>, to require authentication.

First, install the <application>libpam-smbpass</application> package which will sync the system users to the Samba user database: