Your Name
5da148ac4e
share now checks both common NT_STATUS_ACCESS_DENIED causes before writing the config (warnings only — the share is still applied): - --users entries missing from the Samba passdb (pdbedit -L) get a warning pointing at 'pos share smb-server adduser <user>' — valid users = <u> with no Samba password previously failed for clients with no clue why. - every ancestor of the share path is checked for other:+x traversal (sticky dirs like /tmp count as traversable); a 700 home dir under the share path now warns with 'chmod o+x <dir>'. Docs: howto/share.md SMB section + NT_STATUS_ACCESS_DENIED troubleshooting. Verified with a stub-PATH suite (pdbedit/systemctl/smbcontrol/testparm stubs, SMB_CONF seam): 16/16 green.
254 lines
8.7 KiB
Bash
Executable File
254 lines
8.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
# POS: share smb-server — Manage the Samba server (status, share/unshare exports, users, enable/disable)
|
|
|
|
source "$(dirname "$0")/../lib/common.sh" 2>/dev/null || source "$(dirname "$0")/common.sh"
|
|
source "$(dirname "$0")/../lib/notify.sh" 2>/dev/null || source "$(dirname "$0")/notify.sh"
|
|
|
|
command -v smbd &>/dev/null || err "smbd not found (install samba)"
|
|
command -v smbcontrol &>/dev/null || err "smbcontrol not found (install samba)"
|
|
command -v testparm &>/dev/null || err "testparm not found (install samba)"
|
|
command -v smbpasswd &>/dev/null || err "smbpasswd not found (install samba)"
|
|
|
|
usage() {
|
|
cat <<EOF
|
|
Usage: pos share smb-server <command> [args]
|
|
|
|
Manage the Samba server (smbd, /etc/samba/smb.conf).
|
|
|
|
Commands:
|
|
status Show server status + current shares + users
|
|
share <path> [name] Add or update a share (default name: folder basename)
|
|
unshare <name> Remove a share and reload
|
|
list Show current shares
|
|
adduser <user> Create a Samba user (prompts for password)
|
|
deluser <user> Remove a Samba user
|
|
reload Validate smb.conf and reload the server
|
|
enable Start smbd and enable it on boot
|
|
disable Stop smbd and disable it on boot
|
|
|
|
Options for share:
|
|
--read-only Export read-only
|
|
--guest Allow guest access (ANY user on the network — warns)
|
|
--users <u1,u2> Restrict to these Samba users (comma-separated)
|
|
|
|
Examples:
|
|
pos share smb-server share /mnt/hdd media --users bob,alice
|
|
pos share smb-server share /mnt/hdd/media --read-only
|
|
pos share smb-server adduser bob
|
|
pos share smb-server list
|
|
pos share smb-server unshare media
|
|
EOF
|
|
exit 0
|
|
}
|
|
|
|
SMB_CONF="${SMB_CONF:-/etc/samba/smb.conf}"
|
|
|
|
cmd="${1:-}"
|
|
case "$cmd" in
|
|
-h|--help) usage ;;
|
|
status|share|unshare|list|adduser|deluser|reload|enable|disable) ;;
|
|
"") err "Missing command (status|share|unshare|list|adduser|deluser|reload|enable|disable)" ;;
|
|
*) err "Unknown command '$cmd' (see --help)" ;;
|
|
esac
|
|
|
|
require_root_dir() {
|
|
local path="$1"
|
|
case "$path" in
|
|
/*) ;;
|
|
*) err "Path must be absolute: $path" ;;
|
|
esac
|
|
[ -d "$path" ] || err "Path not found: $path"
|
|
}
|
|
|
|
validate_share_name() {
|
|
case "$1" in
|
|
*[!A-Za-z0-9._-]*) err "Invalid share name '$1' — use letters, digits, . _ -" ;;
|
|
esac
|
|
}
|
|
|
|
# Warn when any ancestor of the share path lacks other:+x — Samba clients
|
|
# traverse as the authenticated user, so a 700 home dir yields
|
|
# NT_STATUS_ACCESS_DENIED no matter what smb.conf says. (Sticky dirs like
|
|
# /tmp show 't' in the other-execute slot — still traversable.)
|
|
check_traversal() {
|
|
local p="$1" blocked="" m
|
|
while [ "$p" != "/" ]; do
|
|
m="$(stat -c '%A' "$p" 2>/dev/null | cut -c10)"
|
|
[ "$m" = "x" ] || [ "$m" = "t" ] || blocked="${blocked:+$blocked, }$p"
|
|
p="$(dirname "$p")"
|
|
done
|
|
[ -z "$blocked" ] || warn "Samba can't traverse: $blocked (missing other:+x) — clients get NT_STATUS_ACCESS_DENIED. Fix: chmod o+x <dir>"
|
|
}
|
|
|
|
# Warn for --users entries missing from the Samba passdb (pdbedit/smbpasswd).
|
|
check_samba_users() {
|
|
local list="$1" sdb u missing=""
|
|
if sdb="$(sudo pdbedit -L 2>/dev/null | cut -d: -f1)"; then
|
|
for u in ${list//,/ }; do
|
|
grep -qxF "$u" <<<"$sdb" || missing="${missing:+$missing, }$u"
|
|
done
|
|
fi
|
|
[ -z "$missing" ] || warn "user(s) not in the Samba passdb: $missing — clients get NT_STATUS_ACCESS_DENIED. Add them: pos share smb-server adduser <user> (needs a system user)"
|
|
}
|
|
|
|
# Validate smb.conf with testparm, then hot-reload smbd if it is running.
|
|
reload_config() {
|
|
testparm -s "$SMB_CONF" >/dev/null || err "smb.conf is invalid — changes not loaded (fix with 'pos share smb-server reload')"
|
|
if systemctl is-active --quiet smbd 2>/dev/null; then
|
|
sudo smbcontrol smbd reload-config
|
|
log "smbd config reloaded"
|
|
else
|
|
warn "smbd not running — config validated but not loaded (enable with 'pos share smb-server enable')"
|
|
fi
|
|
}
|
|
|
|
list_shares() {
|
|
local out
|
|
out="$(testparm -s "$SMB_CONF" 2>/dev/null | grep -F '[' || true)"
|
|
if [ -z "$out" ]; then
|
|
echo " (none)"
|
|
return
|
|
fi
|
|
printf '%s\n' "$out" | grep -Fv '[global]' | sed 's/\[\(.*\)\]/ \1/'
|
|
}
|
|
|
|
case "$cmd" in
|
|
status)
|
|
if systemctl is-active --quiet smbd 2>/dev/null; then
|
|
ok "smbd: running"
|
|
else
|
|
warn "smbd: not running (enable with 'pos share smb-server enable')"
|
|
fi
|
|
echo
|
|
section "Shares"
|
|
list_shares
|
|
echo
|
|
section "Users"
|
|
sudo pdbedit -L 2>/dev/null | cut -d: -f1 | sed 's/^/ /' || echo " (none)"
|
|
;;
|
|
|
|
share)
|
|
path="${2:-}"
|
|
[ -n "$path" ] || err "Usage: pos share smb-server share <path> [name] [--read-only|--guest|--users u1,u2]"
|
|
case "$path" in
|
|
-*) err "Usage: pos share smb-server share <path> [name] [--read-only|--guest|--users u1,u2]" ;;
|
|
esac
|
|
require_root_dir "$path"
|
|
check_traversal "$path"
|
|
[ -f "$SMB_CONF" ] || err "No smb.conf at $SMB_CONF (is samba installed?)"
|
|
|
|
shift 2
|
|
name="" ro=0 guest=0 users=""
|
|
while [ $# -gt 0 ]; do
|
|
case "$1" in
|
|
--read-only) ro=1; shift ;;
|
|
--guest) guest=1; shift ;;
|
|
--users) [ $# -ge 2 ] || err "--users needs a value"; users="$2"; shift 2 ;;
|
|
-*) err "unknown option '$1'" ;;
|
|
*) name="$1"; shift ;;
|
|
esac
|
|
done
|
|
name="${name:-$(basename "$path")}"
|
|
validate_share_name "$name"
|
|
|
|
if [ "$guest" -eq 1 ]; then
|
|
warn "guest access on — ANY network user can access $path. Restrict with --users."
|
|
elif [ -z "$users" ]; then
|
|
warn "No valid users — any Samba account can access $path. Restrict with --users u1,u2."
|
|
fi
|
|
[ -n "$users" ] && check_samba_users "$users"
|
|
|
|
ro_val=no; [ "$ro" -eq 1 ] && ro_val=yes
|
|
guest_val=no; [ "$guest" -eq 1 ] && guest_val=yes
|
|
block="[$name]
|
|
path = $path
|
|
browseable = yes
|
|
read only = $ro_val
|
|
guest ok = $guest_val"
|
|
[ -n "$users" ] && block="$block
|
|
valid users = $users"
|
|
|
|
tmp="$(mktemp)"
|
|
awk -v s="# >>> pos-managed share: $name" -v e="# <<< end pos-managed share" '
|
|
$0 == s {inblock=1}
|
|
$0 == e && inblock == 1 {inblock=0; next}
|
|
!inblock {print}
|
|
' "$SMB_CONF" > "$tmp"
|
|
{
|
|
echo
|
|
echo "# >>> pos-managed share: $name"
|
|
printf '%s\n' "$block"
|
|
echo "# <<< end pos-managed share"
|
|
} >> "$tmp"
|
|
|
|
testparm -s "$tmp" >/dev/null || { rm -f "$tmp"; err "Invalid smb.conf — changes not applied (see testparm -s $SMB_CONF)"; }
|
|
sudo cp "$tmp" "$SMB_CONF"
|
|
rm -f "$tmp"
|
|
reload_config
|
|
log "Share added: [$name] → $path"
|
|
notify_send "SMB share added: $name ($path)"
|
|
;;
|
|
|
|
unshare)
|
|
name="${2:-}"
|
|
[ -n "$name" ] || err "Usage: pos share smb-server unshare <name>"
|
|
validate_share_name "$name"
|
|
[ -f "$SMB_CONF" ] || err "No smb.conf at $SMB_CONF (is samba installed?)"
|
|
|
|
if ! grep -Fq "# >>> pos-managed share: $name" "$SMB_CONF"; then
|
|
warn "No share '$name' found in $SMB_CONF"
|
|
exit 0
|
|
fi
|
|
|
|
tmp="$(mktemp)"
|
|
awk -v s="# >>> pos-managed share: $name" -v e="# <<< end pos-managed share" '
|
|
$0 == s {inblock=1}
|
|
$0 == e && inblock == 1 {inblock=0; next}
|
|
!inblock {print}
|
|
' "$SMB_CONF" > "$tmp"
|
|
sudo cp "$tmp" "$SMB_CONF"
|
|
rm -f "$tmp"
|
|
reload_config
|
|
log "Removed share: $name"
|
|
notify_send "SMB share removed: $name"
|
|
;;
|
|
|
|
list)
|
|
list_shares
|
|
;;
|
|
|
|
adduser)
|
|
user="${2:-}"
|
|
[ -n "$user" ] || err "Usage: pos share smb-server adduser <user>"
|
|
id -u "$user" >/dev/null 2>&1 || err "No system user '$user' — create it first (e.g. sudo adduser $user)"
|
|
sudo smbpasswd -a "$user"
|
|
log "Samba user added: $user"
|
|
notify_send "SMB user added: $user"
|
|
;;
|
|
|
|
deluser)
|
|
user="${2:-}"
|
|
[ -n "$user" ] || err "Usage: pos share smb-server deluser <user>"
|
|
sudo smbpasswd -x "$user"
|
|
log "Samba user removed: $user"
|
|
notify_send "SMB user removed: $user"
|
|
;;
|
|
|
|
reload)
|
|
reload_config
|
|
;;
|
|
|
|
enable)
|
|
sudo systemctl enable --now smbd
|
|
log "smbd enabled (starts on boot)"
|
|
notify_send "SMB server enabled"
|
|
;;
|
|
|
|
disable)
|
|
sudo systemctl disable --now smbd
|
|
log "smbd disabled (will not start on boot)"
|
|
notify_send "SMB server disabled"
|
|
;;
|
|
esac
|