Bdtyktl

So I am currently using Samba as a timesheet service for the employees to write their work hours.

I have a share called "timesheets" that is accessible to all users that are part of the "timesheet" group. In this share, there are folders with names of all the employees. Inside the folders are each employee's excel file.

What I am trying to accomplish is to have everyone access their own folder/timesheet, but not those of others. Except for administration, who should have access to everyones folder for payroll.

The permission for each folder is set to the user to whom it belongs, and the group of that folder is set to "timesheetmgmt". Administration (timesheetmgmt group) can now access all folders, and regular employees (timesheet group) cannot access folders other than their own.

Everything works except when users overwrite their timesheet file, it resets the permissions and changes the group to the owner (ex: employee1:timesheetmgmt becomes employee1:employee1 when they update their file). This is problematic as administration cannot access the files anymore.

I decided to use samba because workstations are both windows and mac at my workplace.

What am I doing wrong? Is samba the right tool for this purpose?

[timesheets]

  comment = Samba Share for Timesheets

  path = /data/timesheets

  browseable = yes

  guest ok = no

  read only = no

  writeable = yes

  valid users = @timesheets

  create mode = 770

  create mask = 770

  directory mode = 770

  locking = no

  strict locking = no

  vfs objects = fruit streams_xattr

  fruit:aapl = yes

  fruit:encoding = native

  fruit:locking = none

  fruit:metadata = stream

  fruit:resource = file

To force the created files to belong to a specific group use the paramteter force group.

In your case:

[timesheets]

  comment = Samba Share for Timesheets

  ...

  force group = timesheetmgmt

  ...

In addition, to enforce security, you can add a force create mode or force directory mode to set minimal levels.