Password protecting SMB write access to USB automounts

[tievolu]

I'm using 1.0 Beta 2 and I'd like to be able to write to USB automounts over the network using SMB, but only if I connect using the "xbian" user credentials.

Right now the only option in the GUI is to allow write access to all users, including anonymous users. I'd like anonymous users to have read access, with write access reserved for users authenticated with the "xbian" credentials.

Is there a way to achieve this easily?

Also, I noticed that when authenticating with SMB the "xbian" password is still "raspberry", even though I've changed the "xbian" unix account password. That doesn't seem right.

[mk01]

@tievolu

2. xbian smb password and xbian unix password is not synced. to setup (change) smb password, use

Code:

smbpasswd xbian

1. currently not configurable, but can be added to next version of usb mount package. until then edit "/usr/share/usbmount/usbmount" and comment out

Code:

net conf setparm $(basename "$mountpoint" | tr ' ' '_') "force user" xbian || :

on line 259. of course fs on USB auto mounted drive must be supporting access rights (for instance not FAT).

[tievolu]

(21st Nov, 2013 03:53 PM)mk01 Wrote:  2. xbian smb password and xbian unix password is not synced. to setup (change) smb password, use

Code:

smbpasswd xbian

This works, but you have to run it as root using sudo.

(21st Nov, 2013 03:53 PM)mk01 Wrote:  1. currently not configurable, but can be added to next version of usb mount package. until then edit "/usr/share/usbmount/usbmount" and comment out

Code:

net conf setparm $(basename "$mountpoint" | tr ' ' '_') "force user" xbian || :

on line 259. of course fs on USB auto mounted drive must be supporting access rights (for instance not FAT).

This doesn't seem to work. I've tried this with the "enable world writeable" option in the GUI enabled and disabled. Commenting out this line seems to make no difference to the original behaviour i.e. either everyone can write to the share or nobody can, in accordance with the GUI setting.

Thinking about it now, it would be useful to be able to do this for all the samba shares. I don't want anyone on my network accidentally modifying or deleting anything important.

Thanks for your help so far!

EDIT: BTW, the HDD's filesystem is ext4 and everything on the disk has been chowned to xbian:xbian. Permissions are set to 755 across the board:

Code:

drwxr-xr-x 5 xbian xbian 4096 Mar 28  2013 documentaries
drwxr-xr-x 2 xbian xbian 4096 Nov 19 09:03 films
drwxr-xr-x 5 xbian xbian 4096 Nov 18 08:01 kids
drwxr-xr-x 4 xbian xbian 4096 Mar 28  2013 sport
drwxr-xr-x 7 xbian xbian 4096 Nov 21 08:44 tv

[pit79]

(21st Nov, 2013 06:32 PM)tievolu Wrote:  

(21st Nov, 2013 03:53 PM)mk01 Wrote:  2. xbian smb password and xbian unix password is not synced. to setup (change) smb password, use

Code:

smbpasswd xbian

This works, but you have to run it as root using sudo.

(21st Nov, 2013 03:53 PM)mk01 Wrote:  1. currently not configurable, but can be added to next version of usb mount package. until then edit "/usr/share/usbmount/usbmount" and comment out

Code:

net conf setparm $(basename "$mountpoint" | tr ' ' '_') "force user" xbian || :

on line 259. of course fs on USB auto mounted drive must be supporting access rights (for instance not FAT).

This doesn't seem to work. I've tried this with the "enable world writeable" option in the GUI enabled and disabled. Commenting out this line seems to make no difference to the original behaviour i.e. either everyone can write to the share or nobody can, in accordance with the GUI setting.

Thinking about it now, it would be useful to be able to do this for all the samba shares. I don't want anyone on my network accidentally modifying or deleting anything important.

Thanks for your help so far!

EDIT: BTW, the HDD's filesystem is ext4 and everything on the disk has been chowned to xbian:xbian. Permissions are set to 755 across the board:

Code:

drwxr-xr-x 5 xbian xbian 4096 Mar 28  2013 documentaries
drwxr-xr-x 2 xbian xbian 4096 Nov 19 09:03 films
drwxr-xr-x 5 xbian xbian 4096 Nov 18 08:01 kids
drwxr-xr-x 4 xbian xbian 4096 Mar 28  2013 sport
drwxr-xr-x 7 xbian xbian 4096 Nov 21 08:44 tv

Try

Terminal

sudo smbpasswd -a xbian
just make sure password is exactly same as your xbian user account(same to password when you ssh to your pi)

sudo smbpasswd -e xbian

this will turn your samba account on

[mk01]

(21st Nov, 2013 06:32 PM)tievolu Wrote:  This doesn't seem to work. I've tried this with the "enable world writeable" option in the GUI enabled and disabled. Commenting out this line seems to make no difference to the original behaviour i.e. either everyone can write to the share or nobody can, in accordance with the GUI setting.

leave world writeable on. just don't forget to re-mount the usb hdd after you comment the line out (easiest to do is reboot). smb settings are set upon mounting the drive.

[tievolu]

(21st Nov, 2013 07:50 PM)mk01 Wrote:  

(21st Nov, 2013 06:32 PM)tievolu Wrote:  This doesn't seem to work. I've tried this with the "enable world writeable" option in the GUI enabled and disabled. Commenting out this line seems to make no difference to the original behaviour i.e. either everyone can write to the share or nobody can, in accordance with the GUI setting.

leave world writeable on. just don't forget to re-mount the usb hdd after you comment the line out (easiest to do is reboot). smb settings are set upon mounting the drive.

I did reboot, after each change - both to the script and the world writeable GUI option. I would reboot again just to be certain but I'm at work and if I reboot the pi it'll turn the telly on (it's a plasma so I don't want it sitting there all day on the XMBC home screen ).

This is what I did:

1. Commented out the line you specified in the usbmount script (world writeable was disabled at this point)
2. Rebooted pi
3. Checked SMB mount from windows machine, and I could not copy anything to the HDD. This was the case when accessing the share both as a guest and as "xbian".
4. Change GUI setting to enable the world writeable option.
5. Rebooted pi
6. Checked SMB mount from windows machine, and I could copy files to the HDD as xbian or a guest

---

(21st Nov, 2013 07:40 PM)pit79 Wrote:  Try

Terminal

sudo smbpasswd -a xbian
just make sure password is exactly same as your xbian user account(same to password when you ssh to your pi)

sudo smbpasswd -e xbian

this will turn your samba account on

The xbian account is already enabled, and with the right password (same as the xbian unix account). I don't think I need to add it and enable it.

Or are you suggesting that I remove the xbian smb account and re-add it?

[pit79]

(21st Nov, 2013 08:31 PM)tievolu Wrote:  

(21st Nov, 2013 07:50 PM)mk01 Wrote:  

(21st Nov, 2013 06:32 PM)tievolu Wrote:  This doesn't seem to work. I've tried this with the "enable world writeable" option in the GUI enabled and disabled. Commenting out this line seems to make no difference to the original behaviour i.e. either everyone can write to the share or nobody can, in accordance with the GUI setting.

leave world writeable on. just don't forget to re-mount the usb hdd after you comment the line out (easiest to do is reboot). smb settings are set upon mounting the drive.

I did reboot, after each change - both to the script and the world writeable GUI option. I would reboot again just to be certain but I'm at work and if I reboot the pi it'll turn the telly on (it's a plasma so I don't want it sitting there all day on the XMBC home screen ).

This is what I did:

1. Commented out the line you specified in the usbmount script (world writeable was disabled at this point)
2. Rebooted pi
3. Checked SMB mount from windows machine, and I could not copy anything to the HDD. This was the case when accessing the share both as a guest and as "xbian".
4. Change GUI setting to enable the world writeable option.
5. Rebooted pi
6. Checked SMB mount from windows machine, and I could copy files to the HDD as xbian or a guest

---

(21st Nov, 2013 07:40 PM)pit79 Wrote:  Try

Terminal

sudo smbpasswd -a xbian
just make sure password is exactly same as your xbian user account(same to password when you ssh to your pi)

sudo smbpasswd -e xbian

this will turn your samba account on

The xbian account is already enabled, and with the right password (same as the xbian unix account). I don't think I need to add it and enable it.

Or are you suggesting that I remove the xbian smb account and re-add it?

yeah you can try do it again, had similar problem and after enable samba shares start working for xbian. If not, unmount hdd and mount it with uid=1001, gid=1001

[Limjesica]

This doesn't seem to work. I tried this with the option "allow the world-writable" in the GUI to be turned on and off. This line comment doesn't seem to be any different from the original behavior. bitlife smash karts.