Just add comma ',' if you want multiple valid users. See line that I used below.

valid users = @group1, @group2

Each samba user must have a normal linux account as well.

1. Make sure that every user can access the common media folder on the unix side (without samba); alternatively, you can set force user in smb.conf
2. Make sure each user has a samba password set. You can set it with sudo smbpasswd -a your_user
3. Look at /etc/samba/smb.conf: check if the line security = user is set in the [GLOBAL] section
4. Set your shares in /etc/samba/smb.conf, see example

Example shares:

[allaccess]
    path = /media/common
    read only = no
    writeable = yes
    browseable = yes
    valid users = one, two, three, four
    create mask = 0644
    directory mask = 0755
    ; if you set this, all files get written as this user
    force user = one

This will be accessible via \\yourserver\allaccess

A single user share:

[special]
    path = /home/two/onlytwo
    read only = no
    writeable = yes
    browseable = yes
    valid users = one
    create mask = 0640
    directory mask = 0750

Restart the samba server after the changes with:

sudo service smbd restart

let me first start off by saying read up at https://www.samba.org/samba/docs/

because there are a handful of knobs to know about with Samba Server in linux and there is probably more than one way to accomplish what you are asking.

But in a nutshell

• install samba server in linux, this minimal samba functionality to be described should work on any linux
• edit /etc/samba/smb.conf to be at least the following

# smb.conf file sample
[global]
    security = user
    passdb backend = tdbsam
[scratch]
    path = /scratch
    read only = No
    guest ok = No

• read up at samba.org for explanation on security and passdb, but this will set up basic functionality meaning a local linux account needs to exist and valid with that account name [ragnar and harald] which also needs to be the account name from whatever the connectting computer is. And if the account passwords are the same between the connnecting computer and the samba password on the linux system hosting the samba server then connection is granted
• you must do
  • smbpasswd -a ragnar
  • smbpasswd -a harald
  • on your linux system hosting samba server to meet the passdb backend choice... because we are using samba passwords which are different than the local account password in /etc/passwd. Read samba docs for detailed explanation, but this will set up fundamental access security based on linux file/folder permissions for the given account names, until you do guest ok = yes to allow anyone access to that given share specified in smb.conf
  • i only shared out a folder called scratch as an example in my smb.conf sample
• as for all your other specific questions- too hard to answer sorry
• doing it this way, if for example account name harald exists on the linux samba server and on the client system, and the linux server smbpasswd for harald matches the account password of harald on the connecting client, then everything that applies to harald on the linux system will be in affect over the samba connection and you can resort to basic file/folder permissions based on users and groups as defined on the linux [samba] server.

always thought you set all the permissions in SMB and just found out you do it in Windows

not necessarily, you can set them from the client side (from your windows computer) but the file/folder permission authority is derived from samba server... so it's first and foremost the linux file system permissions, that are then read by samba server, and then passed over the SMB (server message block) protocol to whoever the client is which must be able to understand SMB. When there's a mismatch (i.e. guest ok== yes and windows account does not exist on linux [samba] server you will notice permissions are set to nobody when viewed on the linux system.

• read samba doc about Map to Guest
• there are many other tweaks to be done to meet varying levels of access and restrictions
  • obey pam restrictions
  • I suggest you remove that or say no because that's beyond what seems to be your current level of understanding on samba; and PAM is a whole other animal.
  • I am not sure if nologin for the linux accounts will still allow samba smb access for those accounts, so I suggest you make harald and ragnar fully active linux accounts first; and once everything is working then change those accounts to nologin (to prevent ssh). This is is why i say pam=no because your saying obey pam restrictions then making the account nologin is likely to prevent samba access.

Yes, Samba can support ACLs nowadays. it takes a few lines in the globals section, and a list of allowed and denied ACLs per share. some adjustment may be needed to your underlying filesystem permissions to support them though, since ext filesystems don't do ACLs by default.

heres a tutorial: http://aisalen.wordpress.com/2007/08/10/acls-on-samba/

and a general reference for the SMB.conf file: http://www.samba.org/samba/docs/man/manpages-3/smb.conf.5.html

Edit: try changing your share configuration like this. note that OS groups require an '@' in front, and that write list does not imply read priv, so put both groups in the read list.

add these to globals:

invalid users = root
valid users = @smbusers, @smbusers_RO
create mask = 02775
directory mask = 02770

[SAMBA]
comment = Debian File Server With Read Write
invalid users=nobody,nobody
valid users=@smbusr,@smbusr_RO
path = /samba
browseable = yes
guest ok = no
read list = @smbusr,@smbusr_RO
write list = @smbusr
writeable=yes

also run 'sudo testparm -s' to check your config file integrity.

in terms of filesystem permissions, you can chown -R your files to be owned by 'root:smbusers', so that your group permission controls who can write, and your other permission can control who can read (smb will make sure that read permissions are only granted to 'smbusers_RO'). then I recommend using SetGID so that all new folders created in the share are owned by :smbusers and all your smbusers will have access to them.

chown -R root:smbusers /samba 
chmod -R 2775 /samba

Your two users are by default in their own groups: user1:user1 and user2:user2.

The files are likely owned by user1:user1 with no access to 'other' users.

Solutions range from simplest to most robust:

1. Pretend everyone is user1 by adding force user = user1 to the share.

• user2 now has all the rights and permissions that user1 has.
• As per @DeeJayh's comment, you will also want to add valid users = user1 user2 so that user3 and 4, etc cannot browse the share.

1. Pretend everyone is group user1 by adding force group = user1 to the share.

• Same caveat as above but you can remove group write access with chmod g-w ...

1. Grant EVERYONE read/execute access.

• This including user2
• Everyone on the system will have access to the files as they exist now, though not via samba.
• Future additions will need this run each time.
• chmod -R o+rx /media/user1/multimedia/video/movies-library

1. Share group

• Create a group that user1 and user2 are both members of and set ownership of the files to that group.
• Add that group to both users.
• Set the group ownership of the share to that group.
• Make sure everything in that directory is group accessible.
• SetGID on the directory so future additions inherit the group.

sudo usermod -a -G media-share user1 sudo usermod -a -G media-share user2 chown -R user1:media-share /media/user1/multimedia/video/movies-library chmod -R g+rx /media/user1/multimedia/video/movies-library chmod -R g+s /media/user1/multimedia/video/movies-library```

• If you add files via samba then you can set the directory and file mask to ensure group permissions by adding create mask = 0750 and directory mask = 0770 to the share.

1. In theory unlimited. The hardware is your limit.
2. Samba supports a [homes] setting. See chapter 9 in the manual.

[homes]
    browsable = no
    writable = yes 

The [homes] share is a special section of the Samba configuration file. If a user attempts to connect to an ordinary share that doesn't appear in the smb.conf file (such as specifying it with a UNC in Windows Explorer), Samba will search for a [homes] share. If one exists, the incoming share name is assumed to be a username and is queried as such in the password database ( /etc/passwd or equivalent) file of the Samba server. If it appears, Samba assumes the client is a Unix user trying to connect to his home directory.

That is likely to be the easiest to manage method for lots of users.

We have a users group (GID 100) you can use to group those users and apply settings to that group.

But the more obvious way would be to use active directory if you have that. Setup almost totally on the Windows side and not on the server.

Mind the part in bold.