disable smb for some users

Question

disable smb for some users

Hello, I'm trying to disable SMB access for some users accessing shares. OS X 10.9.5 and Server.app 3.2.2.

I cannot disable SMB completely for each share as we have few Windows clients, but after having a number of permissions issues and other errors with Mac clients connecting via SMB, which is now the default method, I want to prevent anyone but a Windows user connecting via SMB.

There's nothing in Server.app I could find, but in System Preferences-> Sharing-> File Sharing-> Advanced... there's a list of users with checkboxes to enable or disable Windows File Sharing per user.

However disabling a user there doesn't seem to do anything to prevent them from accessing shares via SMB.

I tried the steps here to edit the entires in Directory Utility on a test account but no change. Doesn't matter if the box is checked or not, the test account can still connect via SMB.

Anyone have any luck with this or know another method?

Thanks!

Posted on Jul 30, 2015 2:00 PM

Reply

Answer 1

Aug 4, 2015 10:41 AM in response to polyevolver54

Ditto here. I have been unable to find a means to limit SMB to certain users. Anyone?

Reply

Answer 2

Aug 12, 2015 4:08 PM in response to polyevolver54

Had the same problem here also...Here's what I did...

First turn on Time Machine on the Server app, even if not really using it. This makes it so if user goes to Browse the network on a Mac, the connection goes over AFP first. But this still doesn't prevent Mac users from using the Connect to Server and using smb...

Second to completely prevent smb, I setup the OSX pf firewall on each client computer to basically drop the smb connections. A kludge but it works.

Info on pf here:

http://krypted.com/mac-security/a-cheat-sheet-for-using-pf-in-os-x-lion-and-up/

http://blog.scottlowe.org/2013/05/15/using-pf-on-os-x-mountain-lion/

Reply

Answer 3

Aug 12, 2015 8:41 PM in response to polyevolver54

after having a number of permissions issues and other errors with Mac clients connecting via SMB,

If these files are in folders potentially modified by more than one User, take a look at this:

I believe Linc Davis answered this complex question recently on this nearby thread:

Files On Server Not Accessible by Other Users

.

Reply