Samba Administration & Security, for File Sharing, Printer Sharing, & Workgroups, part 2
Ok, now that we have users, lets add some shares for them to access over the network. Go to 'File -] Add Share' to add a folder that you want to be shared over the network.
The directory field is -- of course -- the directory that you want to share. The 'share name' option is what the directory will be called when it is seen over the network. It's best to leave this as the same name as the actual directory, to avoid confusion... that is, unless you want to keep some things 'secret'. The description field is what windows will show under the folder's name to describe it's contents. The visible option specifies whether the share will show up when users are browsing the workgroup, or whether they have to manually type the network path to the share. There's isn't any real advantage to not allowing it to be visible, since you're supposed to be sharing it anyway, so check the box so that you can see it later. The writable option specifies whether or not the allowed users (covered next) will be allowed to create new files and directories, or delete existing files.
This last tab defines who will be allowed access, and who will be denied. It's very simple: you can either allow access to only a certain list of users, or you can allow access to everyone. I think that it goes without saying that it's not a good idea to allow just anyone to access your filesystem. Now remember: the users that you add to the allowed list are the same users that you created in the earlier steps. They are not usix or windows users: they are Samba users (even though they must have a unix account to be a samba user). So, select the users you want, then save your settings and close samba. Now, for the changes to take effect, you must restart the samba server by either going to 'System -] Administration -] Services', and scrolling down the list until you see 'smb', and selecting it, and then seleting the 'restart' option, or, as the root user you can tpye 'service smb restart' into the terminal.
Now, don't go running off just yet, because you'll be pissed that nothing is working, and that you can SEE your shares over the network, but you cannot ACCESS them; instead, you get a message like 'cannot display content of this folder', or it will just keep asking you to enter the user password for the share. This is one of the difficulties of SE Linux (Security Enhanced Linux). If you don't already have the GUI for SE Linux installed, then you will need to yum (or whatever) it. Like the samba system configuration package, this package starts with 'system-config-'. So, download and install 'system-config-selinux'.
In the menu, go to 'Applications -] System Tools -] Se Linux Management' to open the GUI for SE Linux. On the very first menu screen -- entitled 'Status' -- is the option that most users are looking for when trying to fix a problem like this: 'System Default Enforcing Mode'. Most users simply set this to 'Disabled', and then go on with their lives without any more interference from SE Linux, and everything works easier, with less time being spent beating your head into the wall, trying to figure out why some thing is not working properly, only to find that it was SE Linux the whole damned time. We are not going to do this; we're going to do things the right way, and leave our security system intact.
Choose the second menu option in the list on the left -- entitled 'Boolean' -- to view the next screen's options. Now, in the screen on the right will be a long list of application names, and their settings. Scroll down until you see Samba, and the option that you're looking for should be the second Samba option, entitled 'Export all files on the system read and write'. This option is what was preventing samba from exporting the files that you can see over the network, but cannot access. Check the box to enable it, and you should be able to access the shares immediately now, without having to restart anything.
Now, remember: when you go to access the share from windows, the windows machine must have the same workgroup name as the samba server, and the user account that you log in with must be a valid user account on the host system, and the samba password may be different than the password for the for that user's system account. Have fun :D.
