What's the correct way to share a directory with Windows machines using Samba?

Question

I'm running Debian 7.7, intended to be used as a server. I've got Apache installed and I'd like to share its /var/www directory and access it from Windows machines. I've followed the instructions on the Debian wiki and a few other places, but I'm unable to get write access to the folders from Windows.

I apt-get installed samba, disabled home folder sharing, set security = user, added aalaap to the users list using smbpasswd -a and added the following share at the end of smb.conf:

[www]
    comment = Apache web root
    read only = no
    writable = yes
    valid users = @aalaap
    locking = no
    path = /var/www
    guest ok = yes

But when I access \\debian\www, I'm still unable to write to it (permission denied). Also, I can still see the \\debian\aalaap home profile, in spite of having disabled it.

I tried to map the www share in Windows and tried to login using aalaap, but Windows doesn't let me specify or disable the domain part, so it continues to log me in as SURFACEPRO\aalaap.

Needless to say, I've restarted Samba after nearly every step.

Update: I found another similar question with a working answer, but that required chmodding the folder 0777. It works, but that's obviously not secure, so I'd like to know what a better permissions set is.

Answer 1

For now, I would suggest to just add the apache group (typically www-data) as a secondary group to every user in the aalaap group (or just the aalaap user)

See 3rd section: Add a existing user to www-data group

sudo usermod -a -G www-data aalaap
sudo usermod -a -G www-data aalaap2

Assuming you have made apache the owner of www, and having set the needed permissions for the apache group, it seems to me more secure than authorizing everybody.

>ls -al /var  
... www-data www-data 4096 juin  18 22:53 www