ajjahn / puppet-samba Goto Github PK

View Code? Open in Web Editor NEW

22.0 12.0 80.0 150 KB

Puppet module to manage Samba Server

Ruby 54.46% Shell 9.39% Puppet 36.14%

puppet-samba's Introduction

Puppet Samba Module

Module for provisioning Samba

Supports:

Ubuntu: 14.04, 12.04, 16.04 LTS
Debian: 8.x, 7.x
CentOS: 7.x, 6.x

Patches to support other operating systems are welcome.

Installation

Clone this repo to your Puppet modules directory

git clone git://github.com/ajjahn/puppet-samba.git samba

puppet module install ajjahn/samba

Usage

Tweak and add the following to your site manifest:

node 'server.example.com' {
  class {'samba::server':
        workgroup               => 'WORKGROUP',
        server_string           => "${::hostname}",
        dns_proxy               => 'no',
        log_file                => '/var/log/samba/log.%m',
        max_log_size            => '1000',
        syslog                  => '0',
        panic_action            => '/usr/share/samba/panic-action %d',
        server_role             => 'standalone server',
        passdb_backend          => 'tdbsam',
        obey_pam_restrictions   => 'yes',
        unix_password_sync      => 'yes',
        passwd_program          => '/usr/bin/passwd %u',
        passwd_chat             => '*Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .',
        pam_password_change     => 'yes',
        map_to_guest            => 'Never',
        usershare_allow_guests  => 'yes',
        #interfaces             => "eth0 lo",
        bind_interfaces_only    => 'no',
        security                => 'user',
  }

  samba::server::share {'example-share':
    comment                   => 'Example Share',
    path                      => '/path/to/share',
    guest_only                => true,
    guest_ok                  => true,
    guest_account             => "guest",
    browsable                 => false,
    create_mask               => 0777,
    force_create_mask         => 0777,
    directory_mask            => 0777,
    force_directory_mask      => 0777,
    force_group               => 'group',
    force_user                => 'user',
    copy                      => 'some-other-share',
    hosts_allow               => '127.0.0.1, 192.168.0.1'
    acl_allow_execute_always  => true,
  }
}

If you want join Samba server to Active Directory.

node 'server.example.com' {
  class {'samba::server':
    workgroup => 'example',
    server_string => "Example Samba Server",
    interfaces => "eth0 lo",
    security => 'ads'
  }

  samba::server::share {'ri-storage':
    comment           => 'RBTH User Storage',
    path              => "$smb_share",
    browsable         => true,
    writable          => true,
    create_mask       => 0770,
    directory_mask    => 0770,
  }

  class { 'samba::server::ads':
      winbind_acct    => $::domain_admin,
      winbind_pass    => $::admin_password,
      realm           => 'EXAMPLE.COM',
      nsswitch        => true,
      target_ou       => "Nix_Mashine"
  }
}

Most configuration options are optional.

Contributing

Fork it
Create your feature branch (git checkout -b my-new-feature)
Commit your changes (git commit -am 'Added some feature')
Push to the branch (git push origin my-new-feature)
Create new Pull Request

License

This module is released under the MIT license:

http://www.opensource.org/licenses/MIT

puppet-samba's People

Contributors

Stargazers

Watchers

puppet-samba's Issues

Samba module is no longer functional over Puppet 8. ::osfamily is now a deprecated fact

Puppet 8 has functionally deprecated legacy facts such as ::osfamily. Multiple facts in params.pp don't work, and the legacy lsb facts will also need to be changed. I will try and get a pull request to you for this ASAP

Run beaker tests via Travis?

If travis can handle beaker tests, that's a big win: ac64bc8.

Error sending command 'set' with params

I receive this kind of errors when trying to use the puppet-samba module.

Debug: Augeas[box-share-force_create_mask](provider=augeas): sending command 'set' with params ["/files/etc/samba/smb.conf/target[. = 'box-share']/force create mask", "0777"]
Debug: Augeas[box-share-force_create_mask](provider=augeas): Closed the augeas connection
Error: /Stage[main]//Node[l.server.com]/Samba::Server::Share[box-share]/Augeas[box-share-force_create_mask]: Could not evaluate: Error sending command 'set' with params ["/files/etc/samba/smb.conf/target[. = 'box-share']/force create mask", "0777"]/Error sending command 'set' with params ["/files/etc/samba/smb.conf/target[. = 'box-share']/force create mask", "0777"]

Add Hosts Allow option to samba::server::share

Would love to see the ability to define the hosts allow (per share)

failing to join the domain RH6.x

I'm using this module to join a linux box to the domain. We don't yet have a requirement to set up shares, we just want to have it on the domain so we can enable logins to the box.

The thought is coupling this with the SSSD module on a RHEL 6.4 machine.

My knowledge of how Linux and Windows pair up is a bit limited, but I think I'm on the right path. We've also successfully done this manually using kinit and net ads join.

My question here is, the /sbin/configure_active_directory file seems to have some issues.

kinit happens after net ads join. We couldn't get this to work in that order.
the net ads join command fails. It puts two single quotes around the createcomputer= ~OU section. If I take those single quotes out and run the command manually it works. (however I have to run the kinit command first.

I'm hoping someone can clarify if there's something I'm missing here, or if I've actually found a bug in this module.

Thanks

Cannot access share anymore

We are using this module to set up a Samba share for the project root within a Vagrant box.

After updating to version 0.5.0 of this module we where unable to access the share. All we got was a login dialog and no matter what username and password we entered, we couldn't continue.

We could nail it down to this change which changed the map_to_guest parameter from nothing to never. While the latter may be the default anyways, this is a breaking change from previous behavior and should be reverted.

Alternatively bad user could be used what we did locally now to restore the previous behavior.

issue with true and false when using hiera and JSON format !

Hi,
just want let you know, that, when using hiera and JSON as backend, true and false never get matched because of the mssing single quote.
So, basically every JSON encoder will set single or double quotes for every value.
My simple solution: (share.pp)
E.g:
Old:
$read_only ? {
true => "set "${target}/read only" yes",
false => "set "${target}/read only" no",
default => "rm "${target}/read only"",
}

New:
$read_only ? {
'true' => "set "${target}/read only" yes",
'false' => "set "${target}/read only" no",
default => "rm "${target}/read only"",
}

It's also good practice to set strings withing single quotes like:
https://docs.puppet.com/puppet/latest/reference/lang_conditional.html

Rgds.
Franz

Class samba::server cannot set 'bind interfaces only' and 'server string'

Error is:
Error: /Stage[main]/Samba::Server/Augeas[global-interfaces]: Could not evaluate: Error sending command 'set' with params ["/files/etc/samba/smb.conf/target[. = 'global']/bind interfaces only", "yes"]/Error sending command 'set' with params ["/files/etc/samba/smb.conf/target[. = 'global']/bind interfaces only", "yes"]

Error: /Stage[main]/Samba::Server/Augeas[global-server_string]: Could not evaluate: Error sending command 'set' with params ["/files/etc/samba/smb.conf/target[. = 'global']/server string", "test"]/Error sending command 'set' with params ["/files/etc/samba/smb.conf/target[. = 'global']/server string", "test"]

puppet --version

3.1.0

dpkg -l | grep aug

ii augeas-lenses 0.7.0-1ubuntu1 Set of lenses needed by libaugeas0 to parse
ii augeas-tools 0.7.0-1ubuntu1 Augeas command line tools
ii libaugeas-ruby 0.3.0-1.1ubuntu1lucid1 Augeas bindings for the Ruby language
ii libaugeas-ruby1.8 0.3.0-1.1ubuntu1lucid1 Augeas bindings for the Ruby language

ii libaugeas0 0.7.0-1ubuntu1 The augeas configuration editing library and

dpkg -l | grep samba

ii samba 2:3.4.7dfsg-1ubuntu3.10 SMB/CIFS file, print, and login server for U
ii samba-common 2:3.4.7dfsg-1ubuntu3.10 common files used by both the Samba server a

ii samba-common-bin 2:3.4.7~dfsg-1ubuntu3.10 common files used by both the Samba server a

Running Ubuntu 10.04 LTS

augeas issue with ""

The problem parsing AD group with space in the name (ie Domain Users)

hiera example:
samba::server::valid_users: '@"TEST+DomainUsers"'

expected string:
valid users = @"TEST+Domain Users"

puppet string:
valid users = @

samba service name on Debian 8

Hi,
on debian 8 with samba 2:4.1.21+dfsg-2+b2, the service name is now smbd and not samba. This generate the following error:

Error: Could not start Service[samba]: Execution of '/usr/sbin/service samba start' returned 1: Failed to start samba.service: Unit samba.service is masked.
Error: /Stage[main]/Samba::Server::Service/Service[samba]/ensure: change from stopped to running failed: Could not start Service[samba]: Execution of '/usr/sbin/service samba start' returned 1: Failed to start samba.service: Unit samba.service is masked.

See thias/puppet-samba#18

Thanks,
Rot.

Removing a share?

I am new to puppet. I created a share using this module, but the share name is incorrect. Fixing the name creates the new share. What is the recommended way to remove the old share?

Looking for example Vagrant setup using the example snippet script on https://forge.puppetlabs.com/ajjahn/samba under 'Usage'

I'm using https://github.com/mikebell/drupaldev-apache as a Vagrant setup and I want to add samba functionality to the Virtual Machine that is provisioned using this Vagrant setup.

Author of drupaldev-apache Mike Bell recommended your puppet-samba repo for achieving this aim of including Samba functionality, as stated here: https://github.com/mikebell/drupaldev-apache/issues/3#issuecomment-29813000

So I'm keen to use your repo on his recommendation (his Vagrant work is really good so I take heed of his recommendations :) ).

I've looked at your documentation and tried to follow your suggestion "Tweak and add the following to your site manifest:" with the example snippet script for samba setup that you provide, at: on https://forge.puppetlabs.com/ajjahn/samba under 'Usage'

However I have been unlucky so far in getting this to work, 2 problems, 1) errors about positioning of the samba script snippetn you provide and 2) not sure what to supply to Windows in terms of login username and password when mapping the drive. I tried to add your snippet in my local copy of the drupaldev-apache setup, specifically this file: https://github.com/mikebell/drupaldev-apache/blob/master/manifests/example.pp

When I did a vagrant up command I got errors about the node definition being in the wrong place / at the wrong level related to class definitions (I'll try to give exact error messages when I next try this, but maybe what I've just said is enough to give clues as to what I'm doing wrong). I tried placing your snippet at other places in this Vagrant setup and managed to get the setup to run without these errors.

So then I tried to mount this Samba drive from the Windows host upon which my Vagrant VM guest is running. I used the 'Map Network Drive' option in Windows Explorer. I'm uncertain what to supply as user id/name and password and how this relates to the example settings in your samba script setup. I assumed that the address of the samba would either be my VMs IP address which is 33.33.33.10 as setup in that Vagrant drupaldev-apache I also tried 'logging in with different credentials' in the Windows Explorer to bypass the Windows domain that it usually auto-prepends to the username, which might be an unnecessary prefix which causes the user login to be invalid.

If you could provide an example setup, e.g. a Vagrant setup that works with your example then I could go from there and study it and get it working with Mike's drupaldev-apache Vagrant setup.

Error: Could not find a suitable provider for augeas

Got this error when trying to follow our examples.
Installing manually the augeas bindings for ruby via
sudo aptitude install libaugeas-ruby
helped.

SAMBA user provisioning

Not sure if this is the right place for a feature request. But implementing a samba user would be useful.

Wrong service name under Debian

Please look at ngiger@14957b1

It worked for me under Debian Wheezy with Samba 3.6

Options "passwd program" and "passwd change" missing

man smb.conf clearly states, that if you use unix password sync you need to set passwd program, too as default is empty:

If the unix password sync parameter is set this parameter MUST USE ABSOLUTE PATHS for ALL programs called, and must be examined for security implications

Default: passwd program =
Example: passwd program = /bin/passwd %u

Maybe there is some spare time to add these?

AD admin's password in plain text

Obviously a problem. At least chmod 770 the file or something, before we can find a better solution.

Exec[add smb account for myuser]/returns: sudoers: sorry, you must have a tty to run sudo

I'm not sure that the 'sudo' in https://github.com/ajjahn/puppet-samba/blob/master/templates/add_samba_user#L7 is necessary. Puppet almost always will be running as root and the rest of the module requires it to be.

Would you accept a PR removing the use of sudo?

Alternatively, couldn't the pbedit command not just be called from https://github.com/ajjahn/puppet-samba/blob/master/manifests/server/user.pp#L7 directly?

If you do still need add_samba_user and check_samba_user scripts installing (for use outside of puppet), they should probably be moved to the 'files' directory as they're not actually templates.

Kind Regards,
Alex

LDAP support

I've had the following in my [global] config for years:

	security = user
	encrypt passwords = true
	passdb backend = ldapsam:ldap://127.0.0.1
	ldap admin dn = "cn=smbadin,dc=neoice,dc=net"
	ldap suffix = dc=neoice,dc=net
	ldap ssl = off
	ldap passwd sync = yes

I was sad to see that none of the LDAP options are supported.

  samba::server::share {'example-share':
    comment              => 'Example Share',
    path                 => '/path/to/share',
    guest_only           => true,
    guest_ok             => true,
    guest_account        => "guest",
    browsable            => false,
    create_mask          => 0777,
    force_create_mask    => 0777,
    directory_mask       => 0777,
    force_directory_mask => 0777,
    force_group          => 'group',
    force_user           => 'user',
    copy                 => 'some-other-share',
  }

has force_create_mask though the actual parameter value is force_create_mode

Add docs for users?

Hey! Thanks for working on this. I'm struggling to figure out how to add users to Samba and then control their access. Any chance you could add a small section on that?

Thank you,
Matt

What license is puppet-samba under?

Can you specify what license this module is released under? Thanks!

-Andy