samba share question

chesterman · 08-03-2009, 12:40 PM

hi folks.

i have to create a share with the following settings:
* only one group will have access
* the users are allowed just to create files, not write or ever read access
* it will only allow .xml files

i know that there is a 'veto' option on samba, but i don't know how to block all file types, except one. the specific files permissions are a doubt to me too.

any help is appreciated. tks in advance

jschiwal · 08-05-2009, 08:40 PM

Reverse Veto Files may be implemented in the future.
http://www.spinics.net/lists/samba/msg84276.html

It would probably use a directive like:
Allowed Files = /*.xml/

The Samba mailing list thread thread is only a few days old, so a patch may not be available for a while if it is implemented.

For the rest, search with Google for how "Drop Boxes" are implemented. I think that Apple's OS X configures Samba to implement Drop Boxes. You may be able to find how they configure it, and find an example smb.conf file.

chesterman · 08-10-2009, 08:17 AM

Quote:

Originally Posted by jschiwal

Reverse Veto Files may be implemented in the future.
http://www.spinics.net/lists/samba/msg84276.html

It would probably use a directive like:
Allowed Files = /*.xml/

my samba doesn't recongnize this directive.

i'm using version 3.0.21b-2.

chitambira · 08-10-2009, 09:40 AM

Quote:

Originally Posted by chesterman

* only one group will have access

use valid users = @groupname

Quote:

* the users are allowed just to create files, not write or ever read access

creating files involves writing so what do you mean here.

Quote:

* it will only allow .xml files

Allowed Files =/*.xml/ is coming soon! Check
http://www.nabble.com/Reverse-Veto-F...html#a24867889

Quote:

i know that there is a 'veto' option on samba, but i don't know how to block all file types, except one. the specific files permissions are a doubt to me too.

There are two points I would make about using veto files. First of all
there is a performance hit when using it since all files will have to be scanned. This might not be a problem if yours is a 'proper' file server, but just bear it in mind.

Secondly, there is nothing to stop users renaming files to get
them onto the server (e.g. uploading a non-xml file as "file.xml" just to make it accessible on your share)

jschiwal · 08-10-2009, 09:58 AM

You could run a cron job that periodically uses the "file" command to check new files and quarantines files that aren't xml files. The file command examines the contents of a file and doesn't rely on the extension. If you wanted to, you could even validate the xml files.