Samba and security. Re-Birth

[CharlieDaves]

SO. As fellow kubuntu readers know, I've been having a lot of problems just trying to share a folder or two.
Various results
1. I can see the share, but cannot access it. error port 445 blocked
2. I get prompted for kdewallet, then the username, workgroup, and password box, that just wont disappear, regardless of correct or incorrect information entered
3. As soon as I double click Shared Samba Folder (SMB), I get errors Messages vary but google searches don't tell me much and most indicate your on Windows with this error.

So Question 1. How is a user1 from pc1 added as a valid user of pc2 ?
I've been using @sambashare for valid user, writable users, etc
but on pc1 I use mm3 as username1, and pc2 I use mm7. Both have different passwords.

HENCE. My Question on Samba Security and how it works.
HENCE2 - WHY. I HAVE A winXP PROGRAM =VisualCD= that gets filenames, sizes & types off of CD's, DVD's & HDD's. I haven't purchased a new version of windows nor do I intend to for one(1) little program. I have tried to get it to run under Linux (DOS windows thingy) but I have had even less success with that than I have with Samba. Plus's of Samba is I can copy and move files around.

Also. chmod of the shared folder? Do I do this or not.

I have also re-tried gadmin-samba as suggested earlier different post, and overall it confuses that heck out of me.
Found this at samba.org chapter 1.

Example 1.1. A minimal smb.conf

[global]

workgroup = WKG

netbios name = MYNAME

[share1]

path = /tmp

[share2]

path = /my_shared_folder

comment = Some random files

[CharlieDaves]

My current modified version of smb.conf

[global]
workgroup = 4L67Z85
server string = Mohad-Azarbar
netbios name = Mohad-Azarbar
server role = standalone server
server min protocol = SMB2
client min protocol = NT1
log file = /var/log/samba/log.%m
max log size = 1000
logging = file
panic action = /usr/share/samba/panic-action %d
obey pam restrictions = yes
unix password sync = yes
pam password change = no
map to guest = bad user
security = user
server min protocol = NT1
ntlm auth = yes
name resolve order = bcast host
force user = mm3
force group = sambashare
passdb backend = tdbsam

#[network]
interfaces = 127.0.0.0/8 192.168.1.0/25 en0
dns proxy = no
bind interfaces only = yes

unix password sync = yes
guest ok = yes
username map = /etc/samba/smbusers
os level = 20
winbind use default domain = yes
auto services = global


[printers]
comment = All Printers
browseable = no
path = /var/spool/samba
printable = yes
guest ok = no
read only = yes
create mask = 0700

[print$]
comment = Printer Drivers
path = /var/lib/samba/printers
browseable = yes
read only = yes
guest ok = no


[printers]
comment = All Printers
browseable = no
path = /var/spool/samba
printable = yes
guest ok = no
read only = yes
create mask = 0700

# Windows clients look for this share name as a source of downloadable
# printer drivers
[print$]
comment = Printer Drivers
path = /var/lib/samba/printers
browseable = yes
read only = yes
guest ok = no
# Uncomment to allow remote administration of Windows print drivers.
# You may need to replace 'lpadmin' with the name of the group your
# admin users are members of.
# Please note that you also need to set appropriate Unix permissions
# to the drivers directory for these users to have write rights in it
write list = root, @lpadmin, mm3


[mm3]
path = /home/mm3/
comment = MM3-Home
available = yes
writable = yes
guest ok = no
force user = @sambashare
valid users = @sambashare
#admin users = mm3, mm7
read only = no
browsable = yes
public = yes
write list = @lpadmin, @sambashare
create mask = 0744
@added 221014 https://kifarunix.com/install-and-co...-ubuntu-20-04/
force create mode = 0777
force directory mode = 0777
inherit permissions = yes


#[mm7]
path = /home/mm7/
#comment = MM7-Home
#available = yes
##force user = mm7, mm3
#valid users = @sambashare
##admin users = mm7, mm3
#read only = no
#browsable = yes
public = no
writable = yes
guest ok = no
#write list = @lpadmin, mm3, mm7
##create mask = 0744
create mode = 0777
directory mode = 077

[CharlieDaves]

FYI. I don't like to talk about this, but I do have a minor head injury, that has altered my personality. I may say things F this and other colourful language. I apologise in advance

If I setup my HTPC as "server = primary" how would this work overall?
This is instead of server = stand alone
There is also how CFIS , GID , UID , applies.
I am making some major changers after last week I was filling min my diary when my mouse suddenly started moving by itself, and copy and pasted a chuck of diary text by itself.
I need better security, but I cant even get "no security" samba to work, and this NFS isn't working either.
So if anyone is bored enough can they point me to so walk through to setup basic security, with explaining on what each setting is doing.

FYI many years ago, in my first dive into kubuntu 17.04 I found websetes explaining on how to do something and had copy and paste code. I did copy, paste, excute without a clue, blindly and about 3 months in, the computer was unusable. I had to wipe and start from scratch. I still followed some online guide, and then same occured. PC just wouldn't work properly. Firefox was all screwed up, which puzzled me as it's not linux. it's an external installable program so how did it get screwed up. This is around the time I asked if you can put all your "profile" on a seperate disk or drive and have linux on a seperate one. It's in here somewhere.

I know I lot of regular posters have probably blocked me, and I understand. But my brain requires not just enter code, but what that code does and how to make changes.
OLD EXAMPLE. Dos 6. You could change the text colour, and there was clear instructions on how to create you own batch files. I spent months trialling all of these things. Mainly so I could play games. I would execute a bat file that either erased the game or rezipped it if it had my "save file" At the end my text prompt changed colour so I knew. Another batch file and a new game including setting up the correct pc speed and graphics if needed.

What I am trying to do here is the same. I've amended Samba smb.conf to the point I haven't a clue what it is doing, or CLEARER POINT, how other network machines inter act. Is it smb.conf on pc 1 that's causing the network not to connect, or smb.conf settings on pc2

FYI ATM. I have removed and purged NFS and Samba.
I have a new password on the old user login
I have a new username and password on the HTPC. I am still having problems with auto mount of drives & vdevs(zpool zfs whatever it's called)

All I want is some security (that I understand). I have a separate "switch" that connects to the router, which I block all the ports like 139, and 445. These ports are NOT blocked at the switch. BUTTTT. The IP addresses are obtained from the router.

Next, share files. In Vers 17 or 18, I like clicked properties, then share, and turned share on, and it worked. NOW this doesn't. Hence my question above. How does network PC's communicate security settings I will be using multiple account names and different passwords.

NEW problem that points out the above. I have a USB thumb drive, that I've been using between PC's to transfer files, and setting information. A couple of days ago it was write only for pC1, and PC2 could only read. That sucked the fun out of things.
This problem made me rethink this GID and UID and most pages I read have CIFS.

So I'm closing <solved> this thread and trying to find a walk through that includes guidance on security and multiple users. Home business network type stuff.
Thanks to the forum

[CharlieDaves]

SO. Kubuntu community. Do you have a PEBCAK award I think I qualify.
All these problems with Samba not communicating with each other, came down to 2 problems
1. Win32 (WinXP) had wrong workgroup name. I had changed it within Kubuntu
2. The hostnames were different on the PC \etc\hostname and the file was defaulted to %h... So as I manually typed in what I thought it was titled, it wouldn't work.
I am still testing but hope it is all working.
AS Mentioned. I use winxp and a program called "VisualCD" to get all file and folder names. It is then searchable, for double ups (manually)... AND as I am rapidly running out of storage space again, I know I have several double ups, as I saw them the other day whilst cleaning up some older folders on the backup NAS.

[CharlieDaves]

SO. UPDATE. When I put both Linux PC's as 22.04, and added three lines to the smb.conf file

   server min protocol = NT1
   lanman auth = yes
   ntlm auth = yes
​

My win32bit (WinXP) machine CAN Freely find all the shares.
PROBLEM.... The Linux PC's keep finding but not accepting login's. This really sucks

[Schwarzer Kater]

One can also define client min and max protocols for Samba for example.
Newer Kubuntu (and therefore Samba or vice versa) versions will never use NT1 by default (only when told explicitly), because it has severe security flaws (normally not that important when used at home, of course).

[CharlieDaves]

One can also define client min and max protocols for Samba for example.
Newer Kubuntu (and therefore Samba or vice versa) versions will never use NT1 by default (only when told explicitly), because it has severe security flaws (normally not that important when used at home, of course).

So I should set the max protocol to NT1 as well
Q. Will this force Linux PC's to use NT1

[CharlieDaves]

So I watched a video, and basically followed it. I don't like the fact that I change my share group to smbuser & smbgroup, as indicated in the video... I left everything as me (mm3).
https://www.youtube.com/watch?v=7Q0m...ist=WL&index=2

& for good measure I'll upload my smb.conf and shares.conf files for people to look over.

PROBLEM. WinXP can see and access shares (no write)=(not bothered), but linux wont talk to linux.. Any suggestions on how to fix this, PLEASE.
shares.conf.txt
smb.conf.txt

[CharlieDaves]

One can also define client min and max protocols for Samba for example.
Newer Kubuntu (and therefore Samba or vice versa) versions will never use NT1 by default (only when told explicitly), because it has severe security flaws (normally not that important when used at home, of course).

I was thinking about this statement. As soon as I changed min Protocol = Nt1, && max protocol = nt1, the Win32 worked. Linux still doesn't work.
NOW.....
Do I have to add some other line or command, to force Newer Kubuntu versions to NT1 protocol ??
Or should I just change these min & max protocol settings as needed. In other words ## them out when I don't need win32 WinXP access?
Now that I've typed it, I think the 2nd option would be best.

STILL. I would like to know if there is a force use this protocol command or line in the smb conf
Thanks

----- So I've made the change, ## out the min & max protocol
I can now navigate to my machine via network, but I cannot gain access to the listed shares. I see my <mohad-azarbar> then <Home MM3> then

The file or folder smb://mohad-azarbar.local/MM3 Home does not exist.

. Please see above shares.conf.txt for how I've shared the folder
Q WHY does it not work ?. Please & Thanks

[CharlieDaves]

So! I have been re-reading and re-editing files and stuff. And I've basically copy and pasted (edited or course) smb.conf & shares.conf files between both PC's
As I have checked NFS is disabled on at least on machine.
Using the following as a basic guidehttps://wiki.samba.org/index.php/Set..._smb.conf_File as a basic guide, and reading through various other guides, I get the following simple information
They all create a NEWGROUP && NEWUSER && Set NEWUSER to not have a home folder or ssh access.

Q. Do I actually have to do this??
Q. Why can't I just use my login username and passwords, and just add that to "sambashare" group which is created automatically when you install samba??

Azarbar=smb.conf.txt Badeel=Output of ls-la cmd.txt Badeel=samba_testparamm_output.txt Badeel=shares.conf.txt Badeel=smb.conf.txt

Basically from one pc, the following occurs. This PC is 20.04, and daily asks (demands) and update. As previously pointed out in

https://www.kubuntuforums.net/forum/...-driver-issues

https://www.kubuntuforums.net/forum/...hardware-found

I cannot upgrade due to loss of sound card-output-drivers.

This PC 22.04 doesn't show a "NETWORK" icon or sub-folders sub-PCs etc as the older PC does.

ANY HELP PLEASE