Procedure 16.8. Adding a Share That Uses POSIX ACLs

1. Optionally, create the folder if it does not exist. For example:

   ~]# mkdir -p /srv/samba/example/

2. If you run SELinux in enforcing mode, set the samba_share_t context on the directory:

   ~]# semanage fcontext -a -t samba_share_t "/srv/samba/example(/.*)?"
   ~]# restorecon -Rv /srv/samba/example/

3. Set file system ACLs on the directory. For details, see Section 16.1.7.1.2, “Setting ACLs”.
4. Add the example share to the /etc/samba/smb.conf file. For example, to add the share write-enabled:

   [example]
   	path = /srv/samba/example/
   	read only = no

   Note

   Regardless of the file system ACLs; if you do not set read only = no, Samba shares the directory in read-only mode.
5. Verify the /etc/samba/smb.conf file:

   ~]# testparm

   For details, see Section 16.1.2, “Verifying the smb.conf File by Using the testparm Utility”.
6. Open the required ports and reload the firewall configuration using the firewall-cmd utility:

   ~]# firewall-cmd --permanent --add-service=samba
   ~]# firewall-cmd --reload

7. Restart the smb service:

   ~]# systemctl restart smb

8. Optionally, enable the smb service to start automatically at boot time:

   ~]# systemctl enable smb

Procedure 16.12. Adding a Share That Uses Windows ACLs

1. Optionally, create the folder if it does not exists. For example:

   ~]# mkdir -p /srv/samba/example/

2. If you run SELinux in enforcing mode, set the samba_share_t context on the directory:

   ~]# semanage fcontext -a -t samba_share_t "/srv/samba/example(/.*)?"
   ~]# restorecon -Rv /srv/samba/example/

3. Add the example share to the /etc/samba/smb.conf file. For example, to add the share write-enabled:

   [example]
   	path = /srv/samba/example/
   	read only = no

   Note

   Regardless of the file system ACLs; if you do not set read only = no, Samba shares the directory in read-only mode.
4. If you have not enabled Windows ACL support in the [global] section for all shares, add the following parameters to the [example] section to enable this feature for this share:

   vfs objects = acl_xattr
   map acl inherit = yes
   store dos attributes = yes

5. Verify the /etc/samba/smb.conf file:

   ~]# testparm

   For details, see Section 16.1.2, “Verifying the smb.conf File by Using the testparm Utility”.
6. Open the required ports and reload the firewall configuration using the firewall-cmd utility:

   ~]# firewall-cmd --permanent --add-service=samba
   ~]# firewall-cmd --reload

7. Restart the smb service:

   ~]# systemctl restart smb

8. Optionally, enable the smb service to start automatically at boot time:

   ~]# systemctl enable smb

Procedure 16.13. Enabling User Shares

1. Create the local example group, if it does not exist:

   ~]# groupadd example

2. Prepare the directory for Samba to store the user share definitions and set its permissions properly. For example:
   1. Create the directory:

      ~]# mkdir -p /var/lib/samba/usershares/

   2. Set write permissions for the example group:

      ~]# chgrp example /var/lib/samba/usershares/
      ~]# chmod 1770 /var/lib/samba/usershares/

      Set the sticky bit to prevent users to rename or delete files stored by other users in this directory.
3. Edit the /etc/samba/smb.conf file and add the following to the [global] section:
   1. Set the path to the directory you configured to store the user share definitions. For example:

      usershare path = /var/lib/samba/usershares/

   2. Set how many user shares Samba allows to be created on this server. For example:

      usershare max shares = 100

      If you use the default of 0 for the usershare max shares parameter, user shares are disabled.
   3. Optionally, set a list of absolute directory paths. For example, to configure that Samba only allows to share subdirectories of the /data and /srv directory to be shared, set:

      usershare prefix allow list = /data /srv

   For a list of further user share-related parameters you can set, see the USERSHARES section in the smb.conf(5) man page.
4. Verify the /etc/samba/smb.conf file:

   ~]# testparm

   For details, see Section 16.1.2, “Verifying the smb.conf File by Using the testparm Utility”.
5. Reload the Samba configuration:

   ~]# smbcontrol all reload-config

Procedure 16.18. Setting up the print$ Share

1. Add the [print$] section to the /etc/samba/smb.conf file:

   [print$]
   	path = /var/lib/samba/drivers/
   	read only = no
   	write list = @printadmin
   	force group = @printadmin
   	create mask = 0664
   	directory mask = 2775

   Using these settings:
   • Only members of the printadmin group can upload printer drivers to the share.
   • The group of new created files and directories will be set to printadmin.
   • The permissions of new files will be set to 664.
   • The permissions of new directories will be set to 2775.
2. To upload only 64-bit drivers for a printer, include this setting in the [global] section in the /etc/samba/smb.conf file:

   spoolss: architecture = Windows x64

   Without this setting, Windows only displays drivers for which you have uploaded at least the 32-bit version.
3. Verify the /etc/samba/smb.conf file:

   ~]# testparm

   For details, see Section 16.1.2, “Verifying the smb.conf File by Using the testparm Utility”.
4. Reload the Samba configuration

   ~]# smbcontrol all reload-config

5. Create the printadmin group if it does not exists:

   ~]# groupadd printadmin

6. Grant the SePrintOperatorPrivilege privilege to the printadmin group.

   ~]# net rpc rights grant "printadmin" SePrintOperatorPrivilege \
          -U "DOMAIN\administrator"
   Enter DOMAIN\administrator's password:
   Successfully granted rights.

   For further details, see Section 16.1.8.4.2, “Enabling Users to Upload and Preconfigure Drivers”.
7. If you run SELinux in enforcing mode, set the samba_share_t context on the directory:

   ~]# semanage fcontext -a -t samba_share_t "/var/lib/samba/drivers(/.*)?"
   ~]# restorecon -Rv /var/lib/samba/drivers/

8. Set the permissions on the /var/lib/samba/drivers/ directory:
   • If you use POSIX ACLs, set:

     ~]# chgrp -R "printadmin" /var/lib/samba/drivers/
     ~]# chmod -R 2775 /var/lib/samba/drivers/

   • If you use Windows ACLs, set:

     Principal	Access	Apply to
     CREATOR OWNER	Full control	Subfolders and files only
     Authenticated Users	Read & execute, List folder contents, Read	This folder, subfolders and files
     printadmin	Full control	This folder, subfolders and files

     For details about setting ACLs on Windows, see your Windows documentation.

Procedure 16.19. Creating a GPO to Enable Clients to Trust the Samba Print Server

1. Log into a Windows computer using an account that is allowed to edit group policies, such as the AD domain Administrator user.
2. Open the Group Policy Management Console.
3. Right-click to your AD domain and select Create a GPO in this domain, and Link it here
   
4. Enter a name for the GPO, such as Legacy printer Driver Policy and click OK. The new GPO will be displayed under the domain entry.
5. Right-click to the newly-created GPO and select Edit to open the Group Policy Management Editor.
6. Navigate to Computer Configuration → Policies → Administrative Templates → Printers.
   
7. On the right side of the window, double-click Point and Print Restriction to edit the policy:
   1. Enable the policy and set the following options:
      1. Select Users can only point and print to these servers and enter the fully-qualified domain name (FQDN) of the Samba print server to the field next to this option.
      2. In both check boxes under Security Prompts, select Do not show warning or elevation prompt.
         
   2. Click OK.
8. Double-click Package Point and Print - Approved servers to edit the policy:
   1. Enable the policy and click the Show button.
   2. Enter the FQDN of the Samba print server.
      
   3. Close both the Show Contents and policy properties window by clicking OK.
9. Close the Group Policy Management Editor.
10. Close the Group Policy Management Console.

Procedure 16.21. Joining a Domain Using the net Command

1. Manually create the /etc/samba/smb.conf file with the following settings:
   • For an AD domain member:

     [global]
     workgroup = domain_name
     security = ads
     passdb backend = tdbsam
     realm = AD_REALM

   • For an NT4 domain member:

     [global]
     workgroup = domain_name
     security = user
     passdb backend = tdbsam

2. Add an ID mapping configuration for the * default domain and for the domain you want to join to the [global] section in the /etc/samba/smb.conf. For details, see Section 16.1.5.3, “Understanding ID Mapping”.
3. Verify the /etc/samba/smb.conf file:

   ~]# testparm

   For details, see Section 16.1.2, “Verifying the smb.conf File by Using the testparm Utility”.
4. Join the domain as the domain administrator:
   • To join an AD domain:

     ~]# net ads join -U "DOMAIN\administrator"

   • To join an NT4 domain:

     ~]# net rpc join -U "DOMAIN\administrator"

5. Append the winbind source to the passwd and group database entry in the /etc/nsswitch.conf file:

   passwd:     files winbind
   group:      files winbind

6. Enable and start the winbind service:

   ~]# systemctl enable winbind
   ~]# systemctl start winbind

7. Optionally, configure PAM using the authconf utility.
   For details, see the Using Pluggable Authentication Modules (PAM) section in the Red Hat System-Level Authentication Guide.
8. Optionally for AD environments, configure the Kerberos client.
   For details, see the Configuring a Kerberos Client section in the Red Hat System-Level Authentication Guide.

Procedure 16.22. Adding a User Account to the Domain

1. Add the account:

   ~]# net user add user password -U "DOMAIN\administrator"
   User user added

2. Optionally, use the remote procedure call (RPC) shell to enable the account on the AD DC or NT4 PDC. For example:

   ~]# net rpc shell -U DOMAIN\administrator -S DC_or_PDC_name
   Talking to domain DOMAIN (S-1-5-21-1424831554-512457234-5642315751)
   
   net rpc> user edit disabled user no
   Set user's disabled flag from [yes] to [no]
   
   net rpc> exit
   

Procedure 16.23. Downloading a File from an SMB Share Using smbclient

1. Connect to the share:

   ~]# smbclient -U "DOMAIN\user_name" //server_name/share_name

2. Change into the /example/ directory:

   smb: \> cd /example/

3. List the files in the directory:

   smb: \example\> ls
     .                    D         0  Mon Sep 1 10:00:00 2017
     ..                   D         0  Mon Sep 1 10:00:00 2017
     example.txt          N   1048576  Mon Sep 1 10:00:00 2017
   
            9950208 blocks of size 1024. 8247144 blocks available

4. Download the example.txt file:

   smb: \example\> get example.txt
   getting file \directory\subdirectory\example.txt of size 1048576 as example.txt (511975,0 KiloBytes/sec) (average 170666,7 KiloBytes/sec)

5. Disconnect from the share:

   smb: \example\> exit