Samba - Users can't write to dirs not created by themselves

Question

I am trying to automate the login process for the site: winpossible.com. The site is running on .NET and expects the VIEWSTATE variable to be appropriately set and that is what is most probably tripping up the login function?

<?php

$username=urlencode('<something>');
$password="<something>";
$cookie="<cookie_file>";

$viewstate="...";
$postdata="__EVENTARGUMENT=&__EVENTTARGET=&__VIEWSTATE=$viewstate&_ctl0%3AContentPlaceHolder1%3APassword=$password&_ctl0%3AContentPlaceHolder1%3AUserName=$username&_ctl0%3AContentPlaceHolder1%3AbtnLogin.x=0&_ctl0%3AContentPlaceHolder1%3AbtnLogin.y=0";

$ch = curl_init();

$headers = 'Connection: Keep-Alive';

// First go to the home-page
curl_setopt($ch, CURLOPT_URL,"http://www.winpossible.com/");
curl_setopt($ch, CURLOPT_COOKIESESSION, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie);
curl_setopt($ch, CURLOPT_VERBOSE, 1);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6");
curl_setopt($ch, CURLOPT_HEADER, TRUE);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
$result0 = curl_exec ($ch);
echo "Hi there - results of hitting the home-page\n";
echo $result0;

// Now try the login
curl_setopt($ch, CURLOPT_URL,"http://www.winpossible.com/LoginCheck.aspx");
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6");
curl_setopt($ch, CURLOPT_TIMEOUT, 60);
curl_setopt($ch, CURLOPT_HEADER, TRUE);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_COOKIESESSION, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie);
curl_setopt($ch, CURLOPT_VERBOSE, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_ANY);
curl_setopt($ch, CURLOPT_REFERER, 'http://www.winpossible.com/Login.aspx');
curl_setopt($ch, CURLOPT_POSTFIELDS, $postdata);
curl_setopt($ch, CURLOPT_POST, 1);

$result = curl_exec ($ch);
echo $result;


// Now access my-account
curl_setopt($ch, CURLOPT_URL, "http://www.winpossible.com/");
$result2 = curl_exec ($ch);
echo $result2;

curl_close($ch);
// unlink($cookie);
exit;
?>

Solution 1

You're missing:

force directory mode = 0777

Also, you really want to use 0666 for force create mask. Probably no good reason to force the execute bits.

Solution 2

Changing permissions to 777 ALWAYS makes me nervous, even if this is a home project. Instead, add all your samba users to a group (like samba_user), then in smb.conf add the line:

force group = samba_user

Naturally, you must also chgrp all the necessary folders as well. Then you can set finer grained permissions, allow people to do their thing in other people's folders, and your server isn't turned into a free for all. Someone wants to have a private folder? Just change that folder's group from samba_user back to the user's private group.

Comments

[nolim1t]

Whats the objective for the automation? There is a lot more elegant solutions you could probably implement rather than using curl?

[Nik]

The objective is to query some info from the account and then based on some client-side stuff... post some additional info back to the server side. Something which would be easily done manually but given the need for automation, it had seemed like curl+php would be a convenient way to pull it off. What would be the elegant alternatives?

[Ivan]

I tried setting the user's umask to 0000 for testing purposes, and samba still gives those user's permission 0644. I also tried setting the umask for root (well, not really root, rather for the admin user in Ubuntu), to no avail.

[Ivan]

I found it: force security mode ... I thought that setting was only supposed to work for Windows clients...

[dotnix]

Note that according to the man page of smb.conf, 'force security mode' has been removed for Samba 4.0.0.

[derobert]

@dotnix Interesting, did they replace it with something?

[dotnix]

@derobert: It has been replaced with 'force create mode'. Take a look at: git.samba.org/…