After hours of searching, I discovered that the share name and the share directory cannot be the same (and it's not case-sensitive, either). See this post on serverfault.

So, if I change my share name in smb.conf from:

[Music]

to

[Tunes]

I can both read and write to the share. No other changes to my smb.conf were necessary, and no need to chmod 0777.

Answer from the_meter413 on askubuntu.com
Discussions

debian - Can't make samba share writable - Unix & Linux Stack Exchange
I'm trying to make my samba share (running on Debian 10) writable but it seems that anything I try just breaks the share and I cannot access it anymore. ... [MediaServer4TB] comment = Media Server 4TB browseable = yes path = /media/sf_filesrvr guest ok = no read only = no create mask = 0600 directory mask = 0700 security = user encrypt passwords = yes force user = root writeable ... More on unix.stackexchange.com
🌐 unix.stackexchange.com
May 1, 2022
Samba permissions mess - can't write anything (from Windows)
you install ssh? enable it? More on reddit.com
🌐 r/linux4noobs
3
3
March 3, 2022
debian - Samba non-root user can't write to share - Unix & Linux Stack Exchange
My problem is non-root users can't write to the share when it's mounted. But they can when it's not mounted. The group changes from users to root when I mount the share. And I can't figure out how ... More on unix.stackexchange.com
🌐 unix.stackexchange.com
How to create a Samba share that is writable from Windows without 777 permissions? - Unix & Linux Stack Exchange
I have a path on a Linux machine (Debian 8) which I want to share with Samba 4 to Windows computers (Win7 and 8 in a domain). In my smb.conf I did the following: [myshare] path = /path/to/share writeable = yes browseable = yes guest ok = yes public = yes More on unix.stackexchange.com
🌐 unix.stackexchange.com
🌐
Stack Exchange
unix.stackexchange.com › questions › 701039 › cant-make-samba-share-writable
debian - Can't make samba share writable - Unix & Linux Stack Exchange
May 1, 2022 - security = user is a global setting and cannot be in the share definition. (See man smb.conf and notice that the definition has (G) after it rather than (S), showing it much be in the global section ... This awnser solves the problem in case you can mount your share properly with an user/passwd pair and you are able to read the content of the share from a remote client, but you can't write into the share. Of course you need a section in your /etc/samba/smb.conf like this:
🌐
LinuxQuestions.org
linuxquestions.org › questions › linux-networking-3 › can't-write-to-samba-share-4175706103
[SOLVED] Can't write to samba share
I have an OpenMediaVault server with Samba shares. I can mount them remotely but I can't write to them. I've wrestled with this problem quite a bit in
🌐
Raspberry Pi Forums
forums.raspberrypi.com › board index › projects › networking and servers
[SOLVED]SAMBA: Can read but can't write to shared drive - Raspberry Pi Forums
The 'root' group has 'read' and 'entry/execute' permissions on the share, the same goes for any other user. If you just want a share anybody can read and write to, just change the permissions for others 'chmod 777 /media/USBHDD1/shares' For more info see here: https://wiki.samba.org/index....
🌐
Reddit
reddit.com › r/linux4noobs › samba permissions mess - can't write anything (from windows)
r/linux4noobs on Reddit: Samba permissions mess - can't write anything (from Windows)
March 3, 2022 -

Hello,

I have a game server running on my machine, and I often move files and folders around.

So I decided to use samba (version 4.7.6-Ubuntu) to create a shared folder (which contains the game server) - and I can't write anything.

The folder is located at /home/locale/Documents.

locale is the username of the account I use to log physically on my machine, and is pretty much the "admin" account. (Note : they don't have root privileges, I'm not that dumb)

To connect to that folder, I use another account, named John. (The username of my Windows account).

I can connect to the share from Windows without any trouble, using the credentials from John (inputing the Unix password) ; but I cannot write anything.

This is what I have in my smb.conf for the folder :

[gameserver]
   path = /home/locale/Documents/
   valid users = John
   browsable = yes
   read only = no
   writeable = yes
   available = yes
   create mask = 0775
   force user = John

I've seen plenty of people on the internet using 644 or 755 as a create mask - I don't want that. The directories set in locale/Documents are all set at 775, and I don't want to change that.

drwxrwxr-x  5 locale locale 4096 mars   3 09:19 .
drwxr-xr-x 19 locale locale 4096 mars   3 09:27 ..
drwxrwxr-x 19 locale locale 4096 mars   1 23:53 gameserver

John is of course part of the locale group. So I should not be a problem to write in the folder right ? After all, it works like that for my FTP.

What I should do ? I am really forced to go full on 777 on my folder in order to make this thing work ?

Thanks.

Top answer
1 of 1
1

From your comment:

I forgot to mention that the drive in /media/USBHDD/shares is formatted in NTFS, to be readable on windows. That makes it unable to be changed using chown and chmod, which are both solutions that I've already tried.

I guess you're using ntfs-3g. In this case you should research the following mount options of it: uid,gid,dmask,fmask. First thing you should do is passing uid=MYUSERNAME to whatever mechanism mounts the drive. This will make the filesystem appear as if everything in it belonged to MYUSERNAME.

If you were mounting via fstab, the proper line would look similar to the one in this question (but read my answer there). The path /media/… suggests the drive might be mounted by some sort of automounter; if so, then you should configure its options.

Some parts of my original answer (below) apply to filesystems that support UNIX permissions. With NTFS, instead of chown you should just pass proper uid and gid while mounting.


Original answer:

Your share and objects under it are owned by root and only the owner has write permissions. I'm talking about UNIX permissions in ls -l output, this itself has nothing to do with Samba.

Then Samba forces any valid user (valid users = backups MYUSERNAME root; these are Samba users, not necessarily UNIX users) to be MYUSERNAME (force user = MYUSERNAME) in context of UNIX permissions. This user has no write access.

Possible solutions:

  • let MYUSERNAME own everything in the share:

    sudo chown -R MYUSERNAME: /media/USBHDD/share
    
  • give every user write access to everything in the share:

    sudo chmod -R +w /media/USBHDD/share
    
  • a combination of above, with reduced scope maybe; or a solution that uses group access; now you know what the issue is, so ask yourself what permissions to what asset you want to give to whom.

  • force user = root (if possible), but this would be stupid.

Some of these solutions will work better with different create mask and directory mask in Samba configuration. Research and understand their meaning.

Find elsewhere
Top answer
1 of 1
5

Looks like you created a folder miguel in the media and you have taken ownership of it. Instead, let's create a group, add users to that group, and set the permissions.

sudo groupadd -g 10000 [samba_group]
sudo adduser migeul [samba_group]
sudo chown root:[samba_group] -R /media/migeul
sudo chgrp [samba_group] /media/migeul
sudo chmod 775 -R /media/migeul

This will create a group and attach it to the folder to be shared. You add the users to that group for access. Set the permissions to 775 which gives the owner and the group read-write-execute access while others only read. Set's it recursively.

Verify that you have total access to the folder. With samba, setting the permissions are a little bit different than file permissions with a ubuntu user. What I mean is that verify the permissions after you take ownership because they could result in a samba error later on down the road. Where nobody can access the drive.

Create a samba account that matches your Linux username precisely.

sudo smbpasswd -a miguel
sudo smbpasswd -e migeul

That will prompt you to create a password for the username miguel. Please note that this is only for SMB shares not for the user in the Operating System.

Afterward, open up the samba config and when sharing the drive make sure you type in writable = yes, browsable = yes, read only = no and add your group to it as well. Also, verify the location you are sharing from. Use the place that it is mounted to.

[migeul]
comment = Migeuls folder
​path = /media/migeul
​browsable = yes
​writable = yes
​guest ok = no
​read only = no
​valid users = @[samba_group]

After you reconfig the /etc/samba/smb.conf file, reload it.

sudo smbd reload

These pages go more in-depth with setting up samba shares.

https://help.ubuntu.com/community/Samba/SambaServerGuide https://www.techrepublic.com/article/how-to-set-up-samba-shares-for-groups/

You may also need to set your umask as well. To do that open up /etc/profile using sudo nano /etc/profile and at the bottom type in umask 002. Use Control+O to save and Control+X to exit. Best to reboot the server using sudo reboot and the new mask permissions will take place. That setting re-asserts the same permissions for the users.

Top answer
1 of 5
103

I recommend to create a dedicated user for that share and specify it in force user(see docs).

Create a user (shareuser for example) and set the owner of everything in the share folder to that user:

adduser --system shareuser
chown -R shareuser /path/to/share

Then add force user and permission mask settings in smb.conf:

[myshare]
path = /path/to/share
writeable = yes
browseable = yes
public = yes
create mask = 0644
directory mask = 0755
force user = shareuser

Note that guest ok is a synonym for public.

2 of 5
6

In the share settings in smb.conf, you'll need to specify the names of users and/or groups that are allowed to write to the share, using a write list = ... line.

Example:

[myshare]
...
write list = my_linux_username

Then you'll need to use the smbpasswd command to set up a password to authenticate my_linux_username for Samba:

sudo smbpasswd -a my_linux_username

This step is necessary because the standard system passwords in /etc/shadow are hashed in algorithms that are incompatible with the password hash algorithms used in the SMB protocol. When a client sends a SMB authentication packet, it includes a hashed password. It can only be compared to another password hash that uses the same algorithm.

(Very, very old instructions from the previous millennium may recommend disabling password encryption in Samba, and using certain registry hacks to allow Windows to emit unencrypted passwords to the network. This advice is obsolete: those registry hacks may no longer work in current versions of Windows, and allow anyone who can monitor your network traffic to trivially capture your password.)


There's one more thing you may have to do client-side. When your Windows client system is joined to an Active Directory domain and you're logged in with an AD account, it automatically prefixes all unqualified usernames with the name of the AD domain of the user, i.e. you will be authenticating as AD_DOMAIN\your_username, not just your_username.

If you are logged in with a local account (or your client system is not joined to an AD domain), Windows may automatically prefix the username with the client hostname unless you specify another domain name.

To successfully log in to a stand-alone Samba server from a stand-alone Windows client, you may have to specify your username as SAMBA_SERVER_HOSTNAME\your_username.

Otherwise Samba will see the username as WINDOWS_CLIENT_HOSTNAME\your_username, conclude that it has no way to verify any users belonging to domain named WINDOWS_CLIENT_HOSTNAME, and will reject the login.

(Newer versions of Samba may have a built-in check for this specific situation, and they might allow you access nevertheless. But this is basically how SMB authentication works "under the hood", and if you need to deal with old versions of Samba, it might be useful still.)

🌐
Arch Linux Forums
bbs.archlinux.org › viewtopic.php
Cannot write to Samba share [SOLVED] / Networking, Server, and Protection / Arch Linux Forums
January 26, 2013 - [global] read raw = no write raw = no server string = Whitebox socket options = TCP_NODELAY force directory mode = 0775 workgroup = WORKGROUP force create mode = 0664 create mask = 664 directory mask = 0775 hosts allow = 192.168.42. security = user [share] read list = nobody,@nobody writeable = yes wide links = no write list = patrick,@users path = /mnt/share valid users = patrick,@users public = yes
🌐
Reddit
reddit.com › r/fedora › i can access my samba shared folder but can't write. permission denied.
r/Fedora on Reddit: I can access my Samba shared folder but can't write. Permission Denied.
March 4, 2020 -

I setup a Samba shared folder and I can access it through my other linux laptop (manjaro) but I can't write any changes to it. I get a Permission Denied message.

samba config file

Also I did steps 2/3 from this site to make samba work on Fedora 31.

Anyone know how can I make my shared folder writeable by other users mainly my other linux machine (manjaro)?

Thanks

🌐
Linux Mint Forums
forums.linuxmint.com › board index › main edition support › software & applications
Samba: Cannot write to share [SOLVED] - Linux Mint Forums
October 19, 2011 - Is /srv under the influence of some other mechanism like apache or is it the mount point of a partition, or perhaps is encrypted ( although I think the force user would circumvent that )? It's not required to use usershare in Debian and this really doesn't sound like a Samba issue to me but a Linux file permissions issue.
🌐
Manjaro Linux
forum.manjaro.org › support › network
Can't write to samba share - Network - Manjaro Linux Forum
April 28, 2021 - Hello everybody, I am trying to conduct Samba sharing between 2 Manjaro XFCE systems. I want to be able to mainly write on computer A from computer B. The reason is, the HDD on computer B has got corrupted and I have to…
🌐
Arch Linux Forums
bbs.archlinux.org › viewtopic.php
[SOLVED] Can't write to Samba share on client without chown / Newbie Corner / Arch Linux Forums
I have set up a Samba share on my server that only allows users with the name "smbuser" and the group "smbgroup" to access the share. Said user and group exist on the server. The issue I am having is that on any client machine, the share cannot be written to unless I use `chown myuser -R /mnt/my-share` or sudo privileges.