Samba: configuring a share with write permissions for everyone, mapped as a specific user

Question

I have the following config for samba:

[global]
  workgroup = WORKGROUP
  netbios name = z
  log level = 0 vfs:0
  syslog = 0
  max log size = 0
  load printers = No
  printcap name = /dev/null
  disable spoolss = Yes
  preload = share
  default service = share
  guest ok = Yes
  security = user
  map to guest = Bad User
  guest account = ibm86

And the following share:

[data]
  force group = ibm86
  path = /data
  writeable = yes
  guest ok = yes
  browseable = yes

I'm trying to share the directory /data in my network to be writeable by everyone.

Now, I'm able to read all the files on the disk, but I can't write anywhere. From Windows I get "You need permission to perform this action".

As the mapped user, I can read/write to this directory without any issue:

[ibm86@z ~]$ stat /data
  File: ‘/data’
  Size: 4096            Blocks: 8          IO Block: 4096   directory
Device: 900h/2304d      Inode: 2           Links: 7
Access: (0755/drwxr-xr-x)  Uid: ( 1000/   ibm86)   Gid: ( 1000/   ibm86)
Access: 2015-04-03 05:09:28.631608867 +0300
Modify: 2015-04-03 05:03:58.843604604 +0300
Change: 2015-04-03 05:09:22.783608792 +0300
 Birth: -

[ibm86@z ~]$ cd /data
[ibm86@z /data]$ touch a
[ibm86@z /data]$ ls -l a
-rw-rw-r-- 1 ibm86 ibm86 0 Apr  3 05:23 a

So, what gives? What am I doing wrong? This used to work perfectly with security = share but since Ubuntu upgraded from Samba 2.x, this hasn't work at all. I'm currently on Version 4.1.6-Ubuntu.

Solution

you also need to add force user = someusername . As it is in your current configuration the unix file permissions wont allow one user to change other users file. If you want to have different users to be able to write on all files in a share, you need to force user as well as group, so that all files in share will be owned by same user, who then will have permission to write. I usually do (user and group name will depend on your distribution, but its usually one of nobody / noone / nogroup / nouser):

force user = nobody
force group = nogroup