How to share apache /var/www using samba server in ubuntu

Credit: Martin

You need to change your samba mount configuration so that you give permission to the www-data user and group to write to it. You may or may not have the ability to set specific directory permissions, but if not you'll have to set the entire drive the write access (which is bad for security).

I would personally advise using nfs instead of samba shares for networked storage and the use of ext3 or other fully featured file system.

http://www.cyberciti.biz/tips/how-do-i-set-permissions-to-samba-shares.html

https://help.ubuntu.com/community/Samba/SambaClientGuide

http://www.mattvanstone.com/2006/06/automatically_mounting_smb_sha/

www-data is a system account (<1000 uid/gid) and has no password at all. I would not advice to use uid & gid below 1000. Instead create a new account or use an exsisiting one with uid >1000.

Maybe you want to create a new account for editing webpages via samba only. You can do this by creating a jail.

Hint: You dont need step 1 to 4 when using an exsisting user.

1. create a jail

# mkdir -p /srv/smb/exampleusername

2. Add an entry to /etc/fstab

/var/www /srv/smb/exampleusername none bind 0 0

3. bind /var/www to /srv/smb/exampleusername, so you dont need to reboot to take effect of fstab

# mount -o bind /var/www /srv/smb/exampleusername

4. create a user, then remove his rights and put him in jail.

# adduser exampleuser # chown root:root /home/exampleuser # chmod 0755 /home/exampleuser # usermod -s /usr/sbin/nologin -d /srv/smb/exampleuser exampleuser 

5. Change the rights of www to that new/specific user.

# chown -R exampleuser:exampleuser /var/www # chmod -R 0755 /var/www # chown exampleuser:exampleuser /srv/smb/www # chmod 0755 /srv/smb/exampleuser

6. Example share for smb.conf

[www] path = /srv/smb/exampleuser comment = yada yada yada browseable = yes guest ok = no valid users = exampleuser writeable = yes

7. When not using libpam-smbpass then you need to add the user to smb-db too. I would not advice to use libpam-smbpass for security reasons, but this is up to you. Without this libary you need to add a password for that user.

# smbpasswd -a exampleuser

8. test your configuration

Done !

Assuming you have a linux login user account bill, you have installed samba. If you are running SELinux then there are a number of other commands you will need to execute.

Also, make sure you are not sharing smb to the world, your router or firewall should block port 137, 139, 445.

# Block the outside world from your server's smb shares # assuming your local network is 192.168.0.* iptables -A INPUT -j DROP ! -s 192.168.0.0/24 -m multiport -p tcp --dports 139,445 # Add your user account "bill" to www-data usermod -aG www-data bill # Give bill an smb password smbpasswd -a bill # Set permissions in the html folder for www-data # WARNING: existing apps might require specific permissions on specific folders # web code can now alter existing -/html/dev folder files chown www-data:www-data -R /var/www/html/dev # alternatively, in combination with create mask 775 in smb.conf chown root:www-data -R /var/www/html/dev chmod -R 775 /var/www/html/dev # add the following text to the bottom of /etc/samba/smb.conf [dev] path = /var/www/html/dev available = yes valid users = @www-data read only = no browsable = yes public = no writable = yes create mask = 0775 force user = www-data force group = www-data 

An alternative might be to not set any other permissions but include force user and group as root, but that seems quite a bit scary to me.

With this solution, Apache/Nginx/PHP/etc. will still have operational write access as www-data to /var/www, while a developer has write access with his user account below /var/www:

1. Add the developers/admins user name to the web servers group, usually www-data:
   sudo usermod -a -G www-data UsernameOfSambaShare
2. Guess your public files are below /var/www, then grant write access recursive to the group:
   sudo find /var/www -type d -print0 | xargs -0 chmod 775
   sudo find /var/www -type f -print0 | xargs -0 chmod 664
   sudo chown www-data:GroupnameOfSambaShareUser -R /var/www
3. Prepare /etc/smb.conf for the write access of the new group member to the shared folder:
   [www]
   force create mode = 664
   force directory mode = 775
   writeable=yes
   guest ok=yes
   path=/var/www
   comment="Public area"
   write list = UsernameOfSambaShare ...
   valid users = UsernameOfSambaShare ...

Of course you can have different permissions for multiple shares below /var/www as long as all the users are in the group www-data.

If the web server needs write access to the files or folders provided via the Samba share, you will have to add the user www-data to the group(s) of the Samba share user(s) or correct the permissions (see point 2).

A warning:
This configuration is not recommended for a production system, as it weakens the security concept of the web server. However, it is very useful for a development environment in which you need to write data to a virtual machine, for example.