I think I'm encountering the same problem you have. For some reason force user seems to require group write permissions. It does not appear to require world write permissions though, so as a workaround you should be able to get away with 660/770 permissions rather than 777. This shouldn't reduce security; it's just annoying to move files into it outside of samba since you need to make them group-writeable.

Put this in your smb.conf under [Stuff]:

force user = myuser
create mask = 0660
directory mask = 0770

Then run this on your share folder:

sudo chown -R myuser:myuser /home/myuser/share
sudo chmod -R 0660 /home/myuser/share
sudo chmod -R ug+X /home/myuser/share

Then restart smbd. The above will set all files to 660 and all directories to 770, for currently existing files and for files newly created through samba. Note that you don't need force group; by default it matches the primary group of force user. Also note that I'm denying world permissions entirely here. You could probably use 0664, 0775 and ugw+X instead if you want them world-readable.

Unfortunately I haven't been able to make it work without group write permissions. I suspect it's a bug in samba. The recent samba bug #14617 prevented deleting files via force user. It's possible this is another related bug but I don't know enough about it to report it. If you figure out how to get it working with 0644/0755 please let me know!

I was able to find the answer about ten minutes after posting this. Source: http://www.linuxquestions.org/questions/linux-server-73/ownership-on-new-files-in-group-samba-share-set-badly-898489/

chgrp storageusers /sharetest && chmod g+s /sharetest

If I understand what you are asking correctly then what you want is inside the smb.conf located here:

   /etc/samba/smb.conf

Add these options to the [global] section:

   force user = rolf
   force group = coders

I finally made it, if it can help someone. I don't know if it is nice, but it works nice with POSIX rights, without ugly ACL.

1] Create groups

$ sudo groupadd Group1
$ sudo groupadd ...

Please notice I did not create an Admin group since my admin users will be in all the other groups. This is the only way I made it work so far. If someone has a nicer way to deal with for instance an admin group with rights on anything, please tell me ! My solution is correct since I am managing a dozen of accounts but not hundreds or thousands...

2] Create users (without home folder and ability to use SSH for security reasons)

$ sudo adduser --no-create-hom --shell /usr/sbin/nologin user1
$ sudo adduser --no-create-hom --shell /usr/sbin/nologin user...

3] Add users in smbpasswd database. Please pay attention to the fact I had to add them, but also to enable them to avoid any kind of problems.

$ sudo smbpasswd -a user1
$ sudo smbpasswd -e user1
$ ...

4] Add users to the groups where they will be. Please notice I thought samba was not able to recognize secondary groups, but actually it does. The mistake was a misusing of the command line.

The error was:

$ sudo usermod -G user1 Group1
$ sudo usermod -G user1 Group2

If you do:

$ groups user1

You have something like:

user1 Group2

Because the secondary group has disappeared.

The good practice is:

$ sudo usermod -G Group1,Group2,Group3 user1

In this case:

$ groups user1

Will show:

$ user1 Admin Group1 Group2 Group3

Please, be careful of primary and secondary groups. An user can be in multiple secondary groups, but only in one primary group.

So another mistake would be:

$ sudo usermod -g Group1

If you do:

$ groups user1

You got:

$ Group1

4] Create the folders with the good permissions:

$ sudo mkdir /path/to/Directory1
$ sudo chown root:Group1 /path/to/Directory1
$ sudo chmod 2775 /path/to/Directory1

Please read this if you don't know nothing about file system permissions and setuid, setgid : chmod + setuid and setgid. The permissions and also there inheritances are important for your groups.

5] Create as many directories you want with the permissions you want.

6] Configure your smb.conf file with the editor of your choice. I personally use vim. Make a backup first before losing anything that was running well.

$ sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.bak
$ sudo vim /etc/samba/smb.conf

Your config file here, with global config and Directory1 config is:

[global]

     workgroup = YOUR-LOCAL-WORKGROUP
     server string = %h # hostname
     log file = /var/samba/smb-%h.log
     max log size = 1000
     disable netbios = yes # since this is a standalone server
     server role = standalone server
     veto files = /*.exe/*.com/*.dll/*.bat/*.vbs/*.tmp/ # whatever your want
     delete veto files = yes

[Directory1]

     path = /path/to/Directory1
     browseable = yes
     guest only = no
     guest ok = yes
     read list = nobody guest
     write list = @Group1
     force create mode = 0665 # please see system file permissions ...
     force directory mode = 2775 # ... and setuid, setgid, right above !

Please note the execution is important for your users. This allows them to navigate through the directories. But the execution is also a danger regarding files. You don't want you users to execute scripts or whatsoever, reading is widely enough.

That is why I restrict files on reading and writing for users and reading for anonymous, while I let executing on directories for navigation. Execute a folder is not a danger but execute a file is.

    force create mode = 0665
    force directory mode = 2775

Note the options delete veto file and veto files are also another shield since you don't want your silly Windows Mac OS X users put blobs or binaries or executable randomwares on your clean server.

7] Test your config file with a gentle command:

$ testparm

8] Everything is good ? Then.

$ sudo systemctl start smbd.service # or restart
$ sudo systemctl enable smbd.service 

Now you can log with the method of your choice and see that anonymous can explore the files on the server without the permission of writing it while your authenticated and designated users can read, write and execute -- i.e navigate from a directory to a directory.

Et voilà ! I hope it will help someone.

OK, I have found an answer myself.

As this is absolutely not obvious from the docs and HOWTOs and whatever, the reason this thing asks for password is because it cannot map guest user to the owner of the directory being shared.

I have NTFS partitions which I need to mount RW so I used the following setup in my /etc/fstab:

/dev/sdb1  /media/disk1  ntfs defaults,noexec,noatime,relatime,utf8,uid=1000,gid=1000 0       2
/dev/sdb2  /media/disk2  ntfs defaults,noexec,noatime,relatime,utf8,uid=1000,gid=1000 0       2

The most important pieces of config are uid and gid (maybe only uid, don't know). They are set to the UID and GID of the user jonnie set up on the server (obviously not root). So, when ntfs-3g will mount these disks, everything will be owned by him.

After that, I have added this user to the Samba registry (or maybe created new identical one, don't care):

# smbpasswd -a jonnie

It asked for password, I have entered the same as for the main system.

After that, I have added the force user and force group settings to the smb.conf:

[global]
  workgroup = WORKGROUP
  netbios name = HOMESERV
  security = user
  map to guest = Bad User

[disk1]
  comment = Disk 1 on 400GB HDD
  path = /media/disk1
  browsable = yes
  guest ok = yes
  read only = no
  create mask = 666
  directory mask = 777
  force user = jonnie
  force group = jonnie

[disk2]
  comment = Disk 2 on 400GB HDD
  path = /media/disk2
  browsable = yes
  guest ok = yes
  read only = no
  create mask = 666
  directory mask = 777
  force user = jonnie
  force group = jonnie

So, most important piece of config relevant to me was force user.

Courtesy of the Samba HOWTO