Problems with SMB and file sharing in Lion

The following allows a relatively secure "scan to folder" from Ricoh Aficio MF C4500 PS to a MacMini Server late 2012 with OS 10.9.1 (Mavericks). It should work for any network scanner.

Server.app > Account > Users: create the following user:

Full name: Network Scanner

account name: netscan

password: netscan

e-mail:

Allow user to execute login

Do NOT allow user to administer the server

leave the rest blank and click OK

From the listing of users, right click on the new "Network Scanner" and select to modify access to services:

de-select everything except FTP

From the listing of users, right click on the new "Network Scanner" and select the advanced options:

Group: staff

login shell: /bin/bash

initial folder: /Users/Shared/scanner

leave the rest as it is and click OK

Scroll down the list of services, click on "advanced" to reveal additional services.

Select FTP

enable it (top right option)

the shared folder should read "/Users/Shared/scanner"

the permissions should read as follows:

netscan (owner): read and write

staff (first group): read and write

other: read and write

Close Server.app and leave it time to settle with the new service.

I assume you know how to open the firewall.

On the Ricoh (or any network scanner), use FTP to the IP address of the server, with the above login and password. Leave the path empty, because it will write directly to /Users/Shared/scanner.

This works for me.

What does NOT work for me is Apple's default chmod go-rwx on SMB /Users/Shared. I wish I could change it, but the underling samba configurations are gone, and Server.app does not allow changing the permissions. Drop a note if you know how to solve this problem.

Yours,

The following is a workaround to Apple's default chmod go-rwX on SMB /Users/Shared.

It is a copy and paste of my script in my server.

Warnings:

- Do NOT use this if you are not a system administrator.

- Uninstall as soon as you can change Apple's SMB default permissions.

Usage instructions are included in the script.

This works for me.

Yours,

----

#/bin/sh

# This is /Users/Shared/.RepairPermissionsInUsersShared.sh

# URL: https://discussions.apple.com/thread/3208098?start=105&tstart=0

#

# It repairs permissions of files under /Users/Shared (Apple OSX 10.9).

#

# To do:

# Uninstall as soon as you can change Apple's SMB default permissions from go-rwX to ugo+rwX under /Users/Shared/.

#

# How to install:

#

# 1. Move this script to /Users/Shared/.RepairPermissionsInUsersShared.sh

#

# 2. from the terminal:

#

# > chmod u+rwx /Users/Shared/.RepairPermissionsInUsersShared.sh

# > sudo crontab -e

#

# You are presented with the VIM editor.

# Press "i" to enter editing mode.

# Press "Command-v" to paste the following.

# Press "esc" to exit editing mode.

# Press ":w" to save.

# Press ":q" to quit.

#

# The following is the cron script to be copied and pasted above;

# remove the comments "#" (copy and paste in TextEditor.app, remove the comments, then copy and paste into VIM above).

#

# SHELL=/bin/sh

# PATH=/bin:/sbin:/usr/bin:/usr/sbin

# HOME=/var/log

# */1 09-17 * * 1-6 /Users/Shared/.RepairPermissionsInUsersShared.sh >> "/var/log/RepairPermissionsInUsersShared.log" 2>&1

#

# How to uninstall:

#

# terminal> sudo crontab -r

#

# log

#

# $1 [info,warning,error]

# $2 description

#

isotime="/bin/date +%Y-%m-%dT%H-%M-%S%z"

#logfile="/var/log/RepairPermissionsInUsersShared.log"

log() {

# echo "$( ${isotime} ) ${0}: ${1}: ${2}" >> "${logfile}" 2>&1

echo "$( ${isotime} ) ${0}: ${1}: ${2}"

}

#log info "This is $0"

# timestamp

#

TS="/Users/Shared/.timestamp"

if [ ! -f $TS ]; then

log info "Reparing permissions in /Users/Shared/..."

chflags -R nouchg /Users/Shared/*

find /Users/Shared -name ".DS_Store" -print0 | xargs -0 rm

find /Users/Shared -iname "desktop.ini" -print0 | xargs -0 rm

find /Users/Shared -name "Picasa.ini" -print0 | xargs -0 rm

find /Users/Shared -name "Thumbs.db" -print0 | xargs -0 rm

find /Users/Shared -name "ZbThumbnail.info" -print0 | xargs -0 rm

chmod -RN /Users/Shared

find /Users/Shared -type d -print0 | xargs -0 chmod 777

find /Users/Shared -type f -print0 | xargs -0 chmod 666

find /Users/Shared -name "*.exe " -print0 | xargs -0 chmod ugo+x

chgrp -R staff /Users/Shared/*

log info "Permissions repared."

log info "Creating timestamp..."

touch $TS

chmod 644 $TS

log info "Timestamp created."

exit 0;

fi

# update

#

#log info "Reparing permissions in /Users/Shared/...";

find /Users/Shared -type d -newer $TS -print0 | xargs -0 chmod -vv 777

find /Users/Shared -type f -newer $TS -print0 | xargs -0 chmod -vv 666

find /Users/Shared -type f -newer $TS -print0 | xargs -0 chown salbra:staff

find /Users/Shared -name "*.exe " -newer $TS -print0 | xargs -0 chmod -vv ugo+x

find /Users/Shared -newer $TS -print0 | xargs -0 chgrp staff

touch $TS;

chmod 744 $0

# end of script

Script update:

#/bin/sh

# This is /Users/Shared/.RepairPermissionsInUsersShared.sh

# URL: https://discussions.apple.com/thread/3208098?start=105&tstart=0

#

# It repairs permissions of files under /Users/Shared (Apple OSX 10.9).

#

# To do:

# Uninstall as soon as you can change Apple's SMB default permissions from go-rwX to ugo+rwX under /Users/Shared/.

#

# How to install:

#

# 1. Move this script to /Users/Shared/.RepairPermissionsInUsersShared.sh

#

# 2. from the terminal:

#

# > chmod u+rwx /Users/Shared/.RepairPermissionsInUsersShared.sh

# > sudo crontab -e

#

# You are presented with the VIM editor.

# Press "i" to enter editing mode.

# Press "Command-v" to paste the following.

# Press "esc" to exit editing mode.

# Press ":w" to save.

# Press ":q" to quit.

#

# The following is the cron script to be copied and pasted above;

# remove the comments "#" (copy and paste in TextEditor.app, remove the comments, then copy and paste into VIM above).

#

# SHELL=/bin/sh

# PATH=/bin:/sbin:/usr/bin:/usr/sbin

# HOME=/var/log

# */1 09-17 * * 1-6 /Users/Shared/.RepairPermissionsInUsersShared.sh >> "/var/log/RepairPermissionsInUsersShared.log" 2>&1

#

# How to uninstall:

#

# terminal> sudo crontab -r

#

# log

#

# $1 [info,warning,error]

# $2 description

#

isotime="/bin/date +%Y-%m-%dT%H-%M-%S%z"

#logfile="/var/log/RepairPermissionsInUsersShared.log"

log() {

# echo "$( ${isotime} ) ${0}: ${1}: ${2}" >> "${logfile}" 2>&1

echo "$( ${isotime} ) ${0}: ${1}: ${2}"

}

#log info "This is $0"

# timestamp

#

TS="/Users/Shared/.timestamp"

if [ ! -f $TS ]; then

log info "Reparing permissions in /Users/Shared/..."

chflags -R nouchg /Users/Shared/*

find /Users/Shared -name ".DS_Store" -print0 | xargs -0 rm

find /Users/Shared -iname "desktop.ini" -print0 | xargs -0 rm

find /Users/Shared -name "Picasa.ini" -print0 | xargs -0 rm

find /Users/Shared -name "Thumbs.db" -print0 | xargs -0 rm

find /Users/Shared -name "ZbThumbnail.info" -print0 | xargs -0 rm

chmod -RN /Users/Shared

find /Users/Shared -type d -print0 | xargs -0 chmod 777

find /Users/Shared -type f -print0 | xargs -0 chmod 666

find /Users/Shared -name "*.exe " -print0 | xargs -0 chmod ugo+x

chgrp -R staff /Users/Shared/*

log info "Permissions repared."

log info "Creating timestamp..."

touch $TS

chmod 644 $TS

chmod 744 $0

log info "Timestamp created."

exit 0;

fi

# update

#

#log info "Reparing permissions in /Users/Shared/...";

find /Users/Shared -type d -newer $TS -print0 | xargs -0 chmod -vv 777

find /Users/Shared -type f -newer $TS -print0 | xargs -0 chmod -vv 666

find /Users/Shared -name "*.exe " -newer $TS -print0 | xargs -0 chmod -vv ugo+x

find /Users/Shared -newer $TS -print0 | xargs -0 chgrp staff

touch $TS;

chmod 744 $0

# end of script

Message was edited by: 548299159421235

I have a customer who is suffering from this issue as well.

20+ Macs on Xsan

FileServer resharing Xsan via SMB to 10 PC's using Autodesk software (Maya, 3DStudio Max).

Getting insane issues with SMBX.

We are using Samba 3 (via SMBUp) as workaround but would prefer that Apple improved / fixed their implementation. Feels like a poor beta at the moment.

Thanks for providing SMBUp. I wonder, though, why turning it on seems to disable AFP sharing. I'm trying to get my Mavericks server to be more reliably accessed by by flaky Boxee Box (and the crappy WDTV Live I just bought), but turning on SMBUp seems to block AFP access from our laptops.

I started getting this exact issue on one of the machines today, SMBup is blocking AFP! Really weird just one of five macs is affected but I can't find out why. When I connect to our server in the side it only shows SMB shares and will only connect as guest... Ideas anyone?

If you're using the latest version of Mavericks it might be that something has been changed that has this side effect- To date I have only three reports on this issue, and two of them are your posts and the third is a mail I got just before mat3olon's post (it might be his, even).

So far I haven't seen the actual issue nor does SMBUp do anything to disable AFP directly.

Hey Eduado, I'm affraid SMBup is blocking AFP as you can see from these screen shots:

SMBup on Server only allows connections via SMB and only as guest.

SMBup off and we can connect to Server over AFP again using user logins.

Hi.

There's some confusion here. I'll try to clarify:

1.-SMBUp can't block any protocol. It's a front-end for Samba. SMBUp has no network capability in itself.

2.-Samba can't block any protocol other than SMB/CIFs. It can block SMB in the machine

3.-Samba installs its own netbios stack. That shouldn't be causing any issues, but it's the only thing in Samba that could possibly conflict with something else.

Can you check http://eduo.info/2013/07/13/smbup-faq#0 and see if creating the users required lets you log-in with anything other than Guest? I recommend reading the FAQ in general, but that specific one explains how to create the users.

As for AFP, are you sure you're seeing AFP shares? Can you Get-Info on them to make sure it's not SMB shares from OS X Server (which may be being blocked by SMB shares from Samba).

An alternative is to connect directly to the protocol: afp://Server/ vs. smb://Server/ should show the shares available in each case.

My company has been using Mavericks Server for about three months now and we've had some major hiccups along the way, most of them relating to using Apple's iteration of SMB in a mixed environment. After weeks of research, it appears that it all stems from Apple ditching the official Samba systems after the release of Lion Server; I'm having read-only files after doing all of the possible tweaks with .TemporaryItems permissions, etc. During that research I have numerous threads and suggestions regarding SMBup as an easy method to introduce proper SMB into the Mac Mini Server, however I have a few questions about the software before I employ it on a server that powers a multi-billion dollar business.

• Will SMBup interact with all the users I have already created within the Server app or do I have to recreate everyone in SMBup?

  If I do have to recreate users in smbup, will I have to do something different to bind the users to groups I've already created as well?

• Will SMBup interfere with any of the permissions I've set with ACLs through the server app or will they be unchanged? I would assume that if the groups exist as normal (previous question) that permissions would be unchanged, but as I said I'd rather not just point and shoot.
• Finally, will anything need to be done for the Mac clients in the office (as in, would I need to install SMBup on client machines as well)?

I greatly appreciate any and all the assistance you all can provide, unfortunately I never heard back from the developer after several emails over a span of a couple weeks. I figured because of the holidays and a normal developer's working life, that I probably fell through the cracks. Again, thank you and I look forward to any of the answers I can get.

Daniel

Hi.

SMBUp is a GUI for Samba, but all limitations from Samba apply.

Samba uses its own users, but they are mapped to "real" users in the system. All permissions in the system are respected for these real users, ACLs and all.

Also: Samba is not a "proper SMB server". It's just an old, very common one. Strictly speaking the "proper SMB server" would be from Microsoft and Windows-based, which is what Samba is based on. Samba just happens to be the most popular implementation (and, thus, the de-facto standard).

What "developer" you never heard back from? It can't have been SMBUP since I'm the sole developer of it. 🙂

Eduardo,

I actually emailed you at 9:20 EST on the 22nd of December but never heard back; I just assumed I fell through the cracks due to the holidays, so it's not a major problem. Similarly, I was on holiday for the past few days so I saw this response a bit late as well.

Anyway, I just want to make absolutely sure that everything should work as we want it before I deploy the program, so I'll give you a bit more background just to make sure that we're on the same page. So we have Mavericks server deployed and we basically are just using the server for file-sharing capabilities, but we have a pretty complex permissions model going on so that certain groups and users have differing levels of access across the board. Now these users and groups are created through the server app, with the users created with just 'services' (aka there isn't a Home folder created for any of the users). All of our permissions are maintained through Terminal and Server to give read and/or read/write permissions to each group based on the directory and level of the directory. So I want to make absolutely sure that all the permissions and groups that I've created through the Server app will still be usable if I deploy SMBup on our system.

For example, I have a Design directory just for my design team and I have all the permissions set up just for their access. With SMBup would I still be able to use all of these permissions? You said it reflects of all "real" users, so would I just need to recreate each user in SMBup as well?

Thanks for your help!

Daniel

Hi there, Daniel.

If you're using standard Mac/Unix permissions then those are translated as-is in Samba. You just need to map the users.

Yes, you need to create all the users. The code from Apple that allowed to re-use the local users was from Apple and wasn't updated for Lion, so it doesn't work. As of now, if you want to run Samba you need to create individual users (in the terminal you can use smbpasswd, in SMBUp there's GUI functionality for it). If the users you create are named as the users in your system then their permissions are inherited.

If you're using ACL to handle permissions then you should make a few tests to ensure everything is working OK.

Installing Samba (and SMBUp) shouldn't change whatever you currently have being shared nor permissions you may have set. It's a system that sits on top of what you have.

Always keep in mind you don't "deploy SMBUp". You deploy samba, and SMBUp is just a front-end for it. If you install samba from Macports manually then SMBUp can use that. SMBUp is a front-end to make using Samba less of a hassle but all possible problems or issues you find will be related to Samba itself (which is not a bad thing, there's a ton of information on Samba for OSX out there).

I apologize for the long delay in my response. We are using standard Unix-based ACL permissions managed via Terminal and the Server app. I am totally fine with recreating users and passwords to match the foundation that's already there, however I still have a question regarding the actual shares. As I said I have very complex permissions due to the nature of our office and I sometimes have to add entirely new sharepoints; I see on SMBup's GUI that it looks like it requires sharepoints to be created in the interface itself. I recall someone saying that you don't even need to do this portion if you've already set up the fileshares in the Server App; this individual seemed to think that once users were created all that needs to be done is simply unchecking AFP and SMB on the shares in the Server App and SMBup (Samba itself rather) will continue sharing what was already there. Is this correct?

Again, the environment that I am running the Mac Server in is one that's extremely important to ensure that all of the unknowns have been quantified before deploying any major modifications. As a side note, I'm aware that SMBup is simply a GUI for Samba, and using the term "deploy" in my industry (in the ten years I've been doing this thus far) is simply a short term to imply the installation/usage of a new software/hardware implementation. Semantics aside, I appreciate your help greatly.

Hello, Outsider

> I apologize for the long delay in my response. We are using standard Unix-based ACL permissions managed via Terminal and the Server app.

This should work

> As I said I have very complex permissions due to the nature of our office and I sometimes have to add entirely new sharepoints; I see on SMBup's GUI that it looks like it requires sharepoints to be created in the interface itself.

No. SMBUp lets you create the shares in SMBUp if you wish to. You can also create them by editing the Samba server config file: smb.conf.

> I recall someone saying that you don't even need to do this portion if you've already set up the fileshares in the Server App; this individual seemed to think that once users were created all that needs to be done is simply unchecking AFP and SMB on the shares in the Server App and SMBup (Samba itself rather) will continue sharing what was already there. Is this correct?

I would be surprised if it is. OS X SMB uses a wholly different way of setting up shares, and samba is unaware of it. Everything that samba does, needs to be done in the samba config.

AFP is unrelated. You can leave AFP enabled and it shouldn't affect anything.

> Again, the environment that I am running the Mac Server in is one that's extremely important to ensure that all of the unknowns have been quantified before deploying any major modifications.

Easiest would be to try it out, I think.

> As a side note, I'm aware that SMBup is simply a GUI for Samba, and using the term "deploy" in my industry (in the ten years I've been doing this thus far) is simply a short term to imply the installation/usage of a new software/hardware implementation. Semantics aside, I appreciate your help greatly.

I've been working in the IT industry for over two decades. I'm aware of the terminology. But it's important for me to have people be extremely clear that the bulk of what they're installing is Samba, to which SMBUp is just a front-end. If you already had samba you could still run SMBUp. The clarification is not about whether the term is correct, but that what you're "deploying" is in reality Samba. You insist that you're trying to have all information clear so I'm making sure that bit of it is also clarified from my side.

It's important because most of the problems people have when installing SMBUp are actually with Samba itself, and unless it's a common problem I already have a FAQ for, I send people over to the Samba help forums for help.