|
| 1 | +#! /usr/bin/env sh |
| 2 | + |
| 3 | +# Test it like this, preferably from another machine: |
| 4 | +# smbclient '\\<IP_ADDRESS_HERE>\<SHARE_NAME>' -U <USER> |
| 5 | +# ...so more specifically: |
| 6 | +# smbclient '\\IP_ADDRESS_HERE\scan' -U samba |
| 7 | + |
| 8 | +set -x |
| 9 | + |
| 10 | +ACTIVATE="$1" |
| 11 | +DIRECTORY_NAME_ON_DESKTOP="${2-scan}" # Set a default argument so rm --recursive below doesn't attempt to delete the desktop if no argument was passed |
| 12 | +SAMBA_USER_PASSWORD="$3" |
| 13 | +AUTH_DISALLOW_NTLM_V1="$4" |
| 14 | +ALLOW_NETBIOS="$5" |
| 15 | + |
| 16 | +SCAN_DIRECTORY_SOURCE="/home/.skjult/Skrivebord/$DIRECTORY_NAME_ON_DESKTOP" |
| 17 | +SCAN_DIRECTORY_DESTINATION=$(echo "$SCAN_DIRECTORY_SOURCE" | sed 's/.skjult/user/') |
| 18 | +SAMBA_CONFIG=/etc/samba/smb.conf |
| 19 | +# This share name can really be anything |
| 20 | +SHARE_NAME="scan" |
| 21 | +SAMBA_SERVICE="smbd" |
| 22 | +OUR_USER="user" |
| 23 | +# This name can be anything |
| 24 | +SAMBA_USER="samba" |
| 25 | + |
| 26 | +if [ "$ACTIVATE" != "True" ]; then |
| 27 | + apt-get purge --assume-yes samba samba-common-bin |
| 28 | + rm --recursive "$SCAN_DIRECTORY_SOURCE" |
| 29 | + userdel $SAMBA_USER |
| 30 | + groupdel $SAMBA_USER |
| 31 | + exit 0 |
| 32 | +fi |
| 33 | + |
| 34 | +# A provided password is required when activating this script |
| 35 | +[ -z "$SAMBA_USER_PASSWORD" ] && echo "Error: You need to choose a password for the samba user, which is then used to access the share. Exiting." && exit 1 |
| 36 | + |
| 37 | +if [ "$AUTH_DISALLOW_NTLM_V1" = "False" ]; then |
| 38 | + AUTH_NTLM_V1_TEXT=" |
| 39 | +# Better support for old devices by allowing older auth protocols |
| 40 | +# Newer versions default to: ntlm auth = ntlmv2-only |
| 41 | +# https://wiki.archlinux.org/title/Samba#Enable_access_for_old_clients/devices |
| 42 | + server min protocol = NT1 |
| 43 | + ntlm auth = yes" |
| 44 | +fi |
| 45 | + |
| 46 | +# Defaults are: |
| 47 | +# disable netbios = no |
| 48 | +# smb ports 445 139 |
| 49 | +if [ "$ALLOW_NETBIOS" = "False" ]; then |
| 50 | + NETBIOS_TEXT=" |
| 51 | +# Disabling netbios + stop listening on its TCP port |
| 52 | + disable netbios = yes |
| 53 | + smb ports = 445" |
| 54 | +fi |
| 55 | + |
| 56 | +apt-get update --assume-yes |
| 57 | +# Note: This installation also creates a group named "sambashare". Not currently using that for anything |
| 58 | +apt-get install samba samba-common-bin --assume-yes |
| 59 | + |
| 60 | +# Don't create home dir, add the user fully noninteractively, and don't allow login to the user |
| 61 | +groupadd --system $SAMBA_USER |
| 62 | +adduser --system --no-create-home --disabled-password --disabled-login --group --shell /bin/false $SAMBA_USER |
| 63 | +# Set the provided password for the samba user |
| 64 | +#echo "$SAMBA_USER:$SAMBA_USER_PASSWORD" | /usr/sbin/chpasswd |
| 65 | + |
| 66 | +# Create the user in samba and set the password for it: |
| 67 | +printf "%s\n%s" "$SAMBA_USER_PASSWORD" "$SAMBA_USER_PASSWORD" | smbpasswd -a -s samba |
| 68 | + |
| 69 | +# Enable the user |
| 70 | +smbpasswd -e $SAMBA_USER |
| 71 | + |
| 72 | +# Create the directory and user and group for the share |
| 73 | +# shellcheck disable=SC2174 # --parents is just there to ignore errors if it already exists |
| 74 | +mkdir --parents --mode 0777 "$SCAN_DIRECTORY_SOURCE" |
| 75 | +# User and group will be overwritten and set to root:user if desktop_toggle_writable.sh has been run, therefore we give the dir 777 access so samba can access and write to it |
| 76 | +chown $OUR_USER:$SAMBA_USER "$SCAN_DIRECTORY_SOURCE" |
| 77 | + |
| 78 | +# This is most of the default config, with inactive sections, and print sections removed and only a few changes made (user shares are disabled) |
| 79 | +# This was mostly done to disable the default printer sharing |
| 80 | +cat <<- EOF > $SAMBA_CONFIG |
| 81 | + #======================= Global Settings ======================= |
| 82 | +
|
| 83 | + [global] |
| 84 | +
|
| 85 | + ## Browsing/Identification ### |
| 86 | +
|
| 87 | + # Change this to the workgroup/NT-domain name your Samba server will part of |
| 88 | + workgroup = WORKGROUP |
| 89 | +
|
| 90 | + # server string is the equivalent of the NT Description field |
| 91 | + server string = %h server (Samba, Ubuntu) |
| 92 | +
|
| 93 | + #### Debugging/Accounting #### |
| 94 | +
|
| 95 | + # This tells Samba to use a separate log file for each machine |
| 96 | + # that connects |
| 97 | + log file = /var/log/samba/log.%m |
| 98 | +
|
| 99 | + # Cap the size of the individual log files (in KiB). |
| 100 | + max log size = 1000 |
| 101 | +
|
| 102 | + # We want Samba to only log to /var/log/samba/log.{smbd,nmbd}. |
| 103 | + # Append syslog@1 if you want important messages to be sent to syslog too. |
| 104 | + logging = file |
| 105 | +
|
| 106 | + # Do something sensible when Samba crashes: mail the admin a backtrace |
| 107 | + panic action = /usr/share/samba/panic-action %d |
| 108 | +
|
| 109 | + ### Don't share printers ### |
| 110 | + # https://wiki.archlinux.org/title/Samba#Disable_printer_sharing |
| 111 | + load printers = no |
| 112 | + printing = bsd |
| 113 | + printcap name = /dev/null |
| 114 | + disable spoolss = yes |
| 115 | + show add printer wizard = no |
| 116 | +
|
| 117 | +
|
| 118 | + ####### Authentication ####### |
| 119 | +
|
| 120 | + # Server role. Defines in which mode Samba will operate. Possible |
| 121 | + # values are "standalone server", "member server", "classic primary |
| 122 | + # domain controller", "classic backup domain controller", "active |
| 123 | + # directory domain controller". |
| 124 | + # |
| 125 | + # Most people will want "standalone server" or "member server". |
| 126 | + # Running as "active directory domain controller" will require first |
| 127 | + # running "samba-tool domain provision" to wipe databases and create a |
| 128 | + # new domain. |
| 129 | + server role = standalone server |
| 130 | +
|
| 131 | + obey pam restrictions = yes |
| 132 | +
|
| 133 | + # This boolean parameter controls whether Samba attempts to sync the Unix |
| 134 | + # password with the SMB password when the encrypted SMB password in the |
| 135 | + # passdb is changed. |
| 136 | + unix password sync = yes |
| 137 | +
|
| 138 | + # For Unix password sync to work on a Debian GNU/Linux system, the following |
| 139 | + # parameters must be set (thanks to Ian Kahan <<[email protected]> for |
| 140 | + # sending the correct chat script for the passwd program in Debian Sarge). |
| 141 | + passwd program = /usr/bin/passwd %u |
| 142 | + passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* . |
| 143 | +
|
| 144 | + # This boolean controls whether PAM will be used for password changes |
| 145 | + # when requested by an SMB client instead of the program listed in |
| 146 | + # 'passwd program'. The default is 'no'. |
| 147 | + pam password change = yes |
| 148 | +
|
| 149 | + # This option controls how unsuccessful authentication attempts are mapped |
| 150 | + # to anonymous connections # never is the default. |
| 151 | + map to guest = never |
| 152 | +
|
| 153 | + $AUTH_NTLM_V1_TEXT |
| 154 | +
|
| 155 | + ############ Misc ############ |
| 156 | +
|
| 157 | + # Maximum number of usershare. 0 means that usershare is disabled. |
| 158 | + usershare max shares = 0 |
| 159 | +
|
| 160 | + # Allow users who've been granted usershare privileges to create |
| 161 | + # public shares, not just authenticated ones |
| 162 | + usershare allow guests = no |
| 163 | +
|
| 164 | + $NETBIOS_TEXT |
| 165 | +
|
| 166 | + #======================= Share Definitions ======================= |
| 167 | + # |
| 168 | +EOF |
| 169 | + |
| 170 | +# Modify some global configuration for all "user shares" |
| 171 | +# User shares are shares users can create themselves, without needing root permissions |
| 172 | +#sed --in-place --expression '/\[global\]/a\usershare max shares = 100' \ |
| 173 | +# --expression '/\[global\]/a\usershare allow guests = yes' \ |
| 174 | +# --expression '/\[global\]/a\usershare owner only = false' $SAMBA_CONFIG |
| 175 | + |
| 176 | + |
| 177 | +# Create the share named $SHARE_NAME. Settings: |
| 178 | +# - path: The path to the share on the file system |
| 179 | +# - browseable = yes: "this share is seen in the list of available shares in a net view and in the browse list" |
| 180 | +# - create mask and force create mode: Ensure new files created in the dir has those permissions |
| 181 | +# - directory mask and force directory mode does the same for directories created within the share |
| 182 | +# - force user and force group: Forcing the share to be shared as this user/group |
| 183 | +# - writeable = yes: allow write access |
| 184 | +# - guest ok = no: don't allow connecting to the service without a password |
| 185 | +if ! grep "Scanned documents" $SAMBA_CONFIG; then # Idempotency check |
| 186 | + cat <<- EOF >> $SAMBA_CONFIG |
| 187 | + [$SHARE_NAME] |
| 188 | + comment = Scanned documents |
| 189 | + path = $SCAN_DIRECTORY_DESTINATION |
| 190 | + force user = $SAMBA_USER |
| 191 | + force group = $SAMBA_USER |
| 192 | + create mask = 0664 |
| 193 | + force create mode = 0664 |
| 194 | + directory mask = 0775 |
| 195 | + force directory mode = 0775 |
| 196 | + browseable = yes |
| 197 | + writeable = yes |
| 198 | + guest ok = no |
| 199 | + EOF |
| 200 | +fi |
| 201 | + |
| 202 | +# Now restart samba after the configuration changes. If it starts up successfully, the settings should be at least syntactically valid. |
| 203 | +systemctl restart $SAMBA_SERVICE |
| 204 | +systemctl status $SAMBA_SERVICE |
| 205 | + |
| 206 | +# Check samba status + version info |
| 207 | +smbstatus |
| 208 | + |
| 209 | +# Test configuration file correctness |
| 210 | +testparm --suppress-prompt |
| 211 | + |
| 212 | +echo "Listing processes listening on TCP, matching smbd" |
| 213 | +lsof -nP -iTCP -sTCP:LISTEN | grep smbd |
| 214 | + |
| 215 | +echo "Listing processes using UDP, matching nmbd (netbios)" |
| 216 | +lsof -nP -iUDP | grep nmbd |
0 commit comments