UNIX for Advanced & Expert Users

I am happy to help you here with the step by step process. But, I would suggest you go through the docs available on CentOS or Samba website. Those are for brush-up and what more you can do with Samba. As of with any Unix program, you can do much more than it appears with Samba. That's the beauty of Unix and one of the reasons of me being in love with it. Okay, before I get carried away, let me post the steps that need to be done by you to setup Samba. I am assuming you are sharing /share folder on the CentOS server.

Here you go:
1. Install Samba package:

Code:

[root@genserv-sl6 ~]# yum install samba

2. Install Samba Client too, for using smbclient program for troubleshooting purposes

Code:

[root@genserv-sl6 ~]# yum install samba-client

3. If SELinux is turned on and running in enforcing mode, turn on the following booleans at least:
samba_export_all_ro
samba_export_all_rw

Code:

[root@genserv-sl6 ~]# setsebool -P samba_export_all_ro on
[root@genserv-sl6 ~]# setsebool -P samba_export_all_rw on

You can get a full list of booleans related to Samba by the following command:

Code:

[root@genserv-sl6 ~]# getsebool -a | grep samba

Prepare the share directory with appropriate SELinux context to avoid AVC denials:

Code:

[root@firewal-el6 ~]# semanage fcontext -a -t samba_share_t "/share(/.*)?"
[root@firewal-el6 ~]# restorecon -Rv /share

4. If IPtables is running on the server, add the following lines in your /etc/sysconfig/iptables before the entries for FORWARD chain starts:

Code:

-A INPUT -m state --state NEW -m tcp -p tcp --dport 111 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 111 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT

Now, restart the iptables service:

Code:

[root@firewal-el6 ~]# service iptables restart

5. Now, it's time to dive into the config file of samba. Open /etc/samba/smb.conf file with your favorite editor and make the following changes in the [global] directive:

Code:

        workgroup = WORKGROUP
        server string = Samba Server Version %v
        netbios name = MYSERVER
        interfaces = lo eth0
        security = share

Please ensure you mention the correct NIC in place of eth0 through which you will be sharing the folders. Now, I have customized it depending upon your needs. "security = share" will enable anonymous mode because of which you won't be prompted for a username/password while accessing the share. If you select "security = user" or "security = domain" when target client machines are Windows and a member of Active Directory domain, believe me, you will spend at least next 48 hours without sleeping to troubleshoot subsequent permission issues. I know it very well!!

6. Create a directive like [share] for an example to share /share folder:

Code:

[share]
        comment = CentOS Share
        path = /share/
        public = yes
        writable = yes
        printable = no
        guest only = yes
        guest ok = yes
        browsable = yes

You need to do this for each of your shares. Remember, the directive should of unique name.

7. Now, for anonymous access, samba maps the "nobody" built-in user and group with the same name by default. So, to make sure whoever accesses this share, gets to read/write/exec, you need to make nobody as the owner of the folder:

Code:

[root@firewal-el6 ~]# chown -R nobody:nobody /share
[root@firewal-el6 ~]# chmod -R 4770 /share

Wait! What did I just do? The first command makes nobody user and nobody group as the owner of the /share folder and the subsequent files/folders.
The second line gives read+write+execute permission to the owner and the group to /share and files/folders beneath it. Now the twist; the number 4 turns on the SGID bit, for which, whenever someone creates a file/folder in the /share or in any directory beneath it, that file/folder gets the group permission enabled automatically. In turn, anybody can see/modify the new file/folder without having you to setup the permission on them manually. This saves a lot of time and SGID bit should be enabled when it comes to collaboration sharing.

8. Did I just forget to start the samba server now? Nope. You are all set now. So, fire up the samba server:

Code:

[root@firewal-el6 ~]# service smb start

Now, go to your Windows 2003 server and map the share with "\\10.1.2.3\share" path. You can map it as a network drive as well.

This would be all you need to accomplish your goal. Samba is a complex thing and you would spend a lot of time checking its logs or troubleshooting if you do not spend time checking out the documents. No shortcuts!!