LFCS · Question #620
What must be done to allow only users of the devel system group to access a share?
The correct answer is A. In the smb.conf file, set valid users = @devel. To allow only users of the devel system group to access a Samba share, the valid users parameter in smb.conf must be set to @devel.
Question
Options
- AIn the smb.conf file, set valid users = @devel
- BIn the smb.conf file, set valid groups = @devel
- CIn the smb.conf file, set valid groups = devel
- Dchgrp the directory on the Samba server to the devel group, and then set the GID bit on the directory.
How the community answered
(52 responses)- A90% (47)
- B2% (1)
- C2% (1)
- D6% (3)
Why each option
To allow only users of the `devel` system group to access a Samba share, the `valid users` parameter in `smb.conf` must be set to `@devel`.
In Samba's `smb.conf`, the `valid users` parameter is used to specify which users or groups are permitted to access a share. When a group name is prefixed with an `@` symbol (e.g., `@devel`), Samba interprets this as a UNIX group, thus granting access to all authenticated members of that specific system group.
While `valid groups` exists, `valid users = @groupname` is the more direct and common way to restrict initial share access to members of a specific Unix group.
Setting `valid groups = devel` without the `@` symbol would mean Samba looks for a *user* named 'devel' or might not correctly interpret it as a Unix group, failing to achieve the desired group-based restriction.
Changing Unix filesystem permissions via `chgrp` and setting the GID bit controls underlying file access but does not directly govern who can connect to the Samba share itself; Samba's `smb.conf` parameters manage share-level access control.
Concept tested: Samba share access control (Unix groups)
Source: https://www.samba.org/samba/docs/current/manpages/smb.conf.5.html
Topics
Community Discussion
No community discussion yet for this question.