Member Avatar for Yudi Purwanto

Hello all ... i'm still new in linux networking ...

my office use mandriva 2005 w/ samba as the file server and all client using win Xp to access the shared folder on that server

I need your help about these matter :
1. how to config mandrake/samba to detect file deletion on samba server.
2. how to set access right to samba user, so the user can only create/modify file and can't delete the existing files

Thanks in advance..

  • 3 Contributors
  • 2 Replies
  • 264 Views
  • 7 Months Discussion Span
  • Latest Post Latest Post by madhanoct

Dani AI

Generated

As suggested, the usual way to detect deletions coming from SMB clients is to enable Samba’s full-audit VFS module; for system‑level monitoring you can also audit unlink/rename syscalls with auditd. Add the VFS to the share, pick the VFS operations you want (delete/rename/rmdir) and send them to a dedicated syslog file. Example (smb.conf share):

[records]
    path = /srv/records
    vfs objects = full_audit
    full_audit:prefix = %u|%I
    full_audit:success = renameat unlinkat rmdir
    full_audit:failure = none
    full_audit:facility = LOCAL5
    full_audit:priority = NOTICE

Then add a syslog rule (example for rsyslog) like:

local5.*   /var/log/samba/audit.log

See Samba’s vfs_full_audit documentation for exact option names and output format. (samba.org)

A very important compatibility note: operation names changed across Samba releases (older 3.x configs use names such as unlink/rename while newer 4.x may require unlinkat/renameat). If you list an unknown operation, the module can fail to load and the share may be unusable — check man vfs_full_audit for your version, test with testparm, and start with a small set (or try the names your Samba version expects). (lists.samba.org)

You cannot reliably make Samba “ignore” kernel semantics — on Unix the ability to delete a file is controlled by directory write permissions. Practical options:

  • Use the sticky bit on a shared directory (chmod +t) so users can create files but cannot remove other users’ files.
  • Use chattr +i (immutable) for files that must not be removed (root-only to set; it also prevents edits).
  • Use the Samba vfs_recycle module so deletes are moved to a recoverable repository.
  • Use POSIX/NFSv4 ACLs carefully — Samba maps Windows ACLs to Unix semantics and some Windows “Delete” bits don’t map cleanly. ()

Quick checklist to act now:

  1. Check smbd -V and man vfs_full_audit for the right operation names.
  2. Add vfs objects = full_audit to the share and capture logs via rsyslog.
  3. If you need guaranteed recovery, enable vfs_recycle.
  4. For system-level proof (local or non‑SMB deletes) add an auditd rule for unlink/rename syscalls. (linux.org)

If Mandriva 2005 / Samba there is very old, plan to test configs on a VM first and consider an OS/Samba update — newer Samba has better VFS and ACL support.

Member Avatar for wraza

u need to enable vfs full audit in smb.conf

Member Avatar for madhanoct

how to enable vfs full audit in smb.conf

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.