I need permission
Yesterday I had ‘the meeting’ with the church administration. I had to present how to use the server, the computer use policy, the user id request forms, etc. They were all very understanding of the policy. It started out as a memo… it turned into a 6 page IT Bible. But you gotta love ministry. They all saw the need and had no problems with the policy.
Saturday I noticed a peculiar behavior Samba was exhibiting. Every time a file was created by a user, it was only editable by that user. That clearly wasn’t a helpful behavior for a file server. After some investigating, I found out this is a default behavior of Linux. No worries, I just needed to figure out how to change the default permissions on user created files.
Well, that’s actually harder than you would think.
At least it was for me. I kept getting led down a ‘umask’ path. After toying with various settings I wasn’t getting anywhere. It was frustrating to say the least. Finally, I stumbled across 3 lines I could add to my Samba config file to override the default Linux permissions. This solved the problem.
Now the question I have is how do I actually set this in Linux and not Samba? It’s hard enough that I’m learning all of this in a trial-and-error way, but it doesn’t help to use an OS I know little about to begin with. It acceptable to have fixed the issue the way I did; no one besides me will ever touch the Linux box. All interaction with it will take place through Samba. But I would think there must be a simple way to set the default behavior in Linux.
Strange.
All you Linux guru’s out there need to help a brother out. I hate not knowing. I fixed the issue (or at least worked around it), so I’m not concerned with continuing to experiment with our server. However, I do have a Linux box at home I can play with. For some reason, I feel like I need to know the answer to this one. Permission setting is one of Linux’s bread-and-butter features. No way is this as complicated as I’m making it.
The way we do it where I work is to set up people in groups. So for example, the Systems departement is all one group, the administration department is one group, etc.
In the smb.conf file (or the corresponding option in the SWAT web interface) you set the area you’re sharing to have a “create mask” of 0664. This causes all files that are created to allow group write and read.
We have a communal drive that we set the “create mask” to 0777. In this mode every file created is world readable, writeable, and executable.
BTW, you might want to check out Alfresco. It’ll provide you with SMB services in addition to a web interface for indexed searching and file management. I’m playing with it right now and it is a tad sliggish, but may be worth it.
Shoot me an email if you have any other questions.