[global] section to ignore system ACLs and define default permission styles. Then, in your specific [share] definition, set create mask, directory mask, and force create mode to enforce strict file modes and ensure execute permissions are always applied as intended.
Understanding Access Control Requirements
By default, Samba often relies on the underlying POSIX permissions of the Linux filesystem. While this is secure, it can be cumbersome when managing complex user groups or when you need consistent permissions regardless of how files are created from different clients. For many homelab environments or small business setups, administrators prefer explicit control over file creation masks rather than relying solely on the system's discretionary access control lists (DAC). This approach allows you to decouple the network sharing layer from the OS-level permission inheritance. You can specify exactly what permissions new files and directories should have, ensuring that local users interacting with the share get the expected experience without needing root privileges to chmod every single file manually. This is particularly useful when dealing with applications that expect specific executable bits or read/write structures.Configuring Global Samba Settings
The foundation of custom access control lies in the global configuration block. Before defining individual shares, you need to instruct Samba on how to handle permissions at a system level. Open yoursmb.conf file, typically located at /etc/samba/smb.conf, using a text editor like nano or vim.
You will need to add or modify several directives under the [global] section. The most critical setting here is map archive. By default, Samba maps the Windows "Archive" attribute to the Unix "read-only" bit. Setting map archive = no prevents this automatic mapping, giving you cleaner control over write permissions.
Additionally, you should address how Samba interacts with extended attributes. If your system uses ACLs extensively, you might want to use nt acl support = no if you are strictly managing permissions via Unix masks. However, for most modern setups, keeping NT ACL support enabled while overriding defaults via masks is safer. It is also prudent to set unix charset = UTF-8 to ensure compatibility across different operating systems.
For a deeper dive into connecting these shares to other systems, see our guide on Accessing Samba File Share between Ubuntu EC2 instance and Windows Server EC2 instance. This context helps in understanding cross-platform permission expectations.
Defining the Custom Share Section
Once the global settings are established, you define the specific share that requires custom access control. Create a new block starting with[my_custom_share], replacing the name with your desired identifier. Inside this block, specify the path to the directory you wish to share.
The core of the customization involves the following parameters:
- create mask: Defines the permissions for newly created files. A value of
0664is common, allowing the owner and group to read and write. - directory mask: Defines the permissions for newly created directories. A value of
0775ensures directories are executable by the owner and group. - force create mode: Overrides the client's requested mode. This ensures that even if a client tries to create a file with restricted permissions, your server enforces the specified mask.
- force directory mode: Similar to force create mode but applies to directories.
- inherit permissions: Setting this to
yescan sometimes help inherit group ownership, though explicit masks are often more reliable for custom setups.
force create mode and force directory mode take precedence over standard masks. If you set force create mode = 0660, all new files will have those exact permissions, ignoring what the client attempted to send.
Handling Execute Permissions
A common point of confusion arises with executable files. By default, Samba may strip the execute bit from files unless they have a specific extension or are explicitly marked. To ensure that scripts or binaries uploaded to the share retain their executable status, you should use thepreserve case and short preserve case options to maintain filename integrity.
However, the key directive here is default case and case sensitive. More importantly, to "enable file mode and execute always," you can set force create mode to include the execute bit for the owner, such as 0770. Alternatively, if you only want to ensure executability for specific types, you might rely on the vfs objects module, specifically the fuse or xattr modules, but simple mask forcing is usually sufficient for local user scenarios.
If you encounter issues where permissions appear correct locally but fail over the network, check for conflicts with existing ACLs. Our article on Resolving Samba Permissions Inconsistency Across Multiple Systems provides troubleshooting steps for these exact discrepancies.
Restarting and Testing
After saving yoursmb.conf file, you must restart the Samba services for changes to take effect. On systemd-based systems, run:
sudo systemctl restart smbd
sudo systemctl restart nmbdtestparm. This command reads smb.conf and reports any errors or warnings. If testparm returns successfully, proceed to test the share from a client machine. Create a new file and directory within the share and verify their permissions using ls -l on the server side. They should match the masks defined in your configuration.
Frequently Asked Questions
Why do my file permissions change after uploading?
This usually happens because the client application specifies its own permission mode during creation. Using force create mode overrides the client's request, ensuring your server-side mask is always applied. Check your smb.conf to ensure these force options are active.
Can I mix local users with Active Directory users?
Yes, Samba supports both, but they require different authentication backends. Local users rely on smbpasswd or system passwords, while AD users use Kerberos. Ensure your security setting in [global] matches your intended authentication method to avoid access denied errors.
What is the difference between create mask and force create mode?
create mask sets the baseline permissions, but the client can still restrict them further. force create mode acts as a hard override, ensuring that the resulting file never has fewer permissions than specified, regardless of what the client requests.
How do I troubleshoot permission denied errors immediately after setup?
First, verify that the Linux directory itself has the correct ownership and permissions for the Samba service user (usually nobody or sambashare). Second, run testparm to catch syntax errors. Finally, check the Samba logs in /var/log/samba/ for detailed error messages regarding authentication or path access.
Is it safe to disable ACL support entirely?
Disabling ACLs (nt acl support = no) simplifies permission management but removes granular control over individual file attributes. It is generally safe for simple local user setups but not recommended if you need to manage complex security policies or integrate with Windows-specific security descriptors.