This is an old revision of the document!

The samba server on the device is pretty crippled for a few reasons:

- No ability to authenticate against another server

- No fine-grained access control via the web interface (e.g. write-only dropboxes, etc)

There are a few ways to get around this. One option is to edit the firmware /etc/samba/smb.conf. Really, you need to keep an edited copy on the hard disk, and write a fun_plug script to copy the new version to ramdisk after the machine boots, then restart the samba server (and thus re-read the config file). You may also perform small edits to the file without a fun_plug by use of export and import config. This can be used to make the bundled samba config include another config placed on the harddrive. The format of the exported configs are done several files stacked together separated by newline followed by ';'. The samba config is truncated to a fixed number of lines when reimporting, but it's possible to edit the file and possible add “include = /mnt/HD_a2/smbconfig”.

Another option is to install the debian bootstrap, and use that version of samba (this is probably the better option, since debian's smb server will probably be newer than the firmware version). Again, you're going to have to have a fun_plug script that disables the embedded samba before running the debian initrc and starting debian's samba server.

Not much of a howto just yet, but as I get it set up I'll drop in step-by-step instructions for both methods, with some sample configurations for making samba work well. Hopefully I'll demonstrate how to make samba auth against Active Directory/LDAP so that real system administrators would see how to use the DNS-323 for something useful – like seamless home directory storage for their network!

How to make the dns-323 work with a domain, using beta 1.0.4 software:

Steps to get domain authentication working:

  1. edit the smb.default file (on the dns323)
mount -t minix /dev/mtdblock0 /sys/mtd1
mount -t minix /dev/mtdblock1 /sys/mtd2
#EDIT both copies of smb.default
vi /sys/mtd[12]/smb.default
Change the line "security = SHARE" to "security = DOMAIN"
umount /sys/mtd1 /sys/mtd2
  1. You will need a secrets.tdb file from another linux box that you have used to join the domain (on a test inux box)
    1. shutdown samba on your test linux box.
    2. move all the files from /etc/samba to a safe location
    3. create a new smb.conf with the following entries
  [ global ]
  workgroup = MYNTorADDOMAIN
  netbios name = dns323
  security = DOMAIN
  1. Join the domain
  net join
  1. scp -p /etc/samba/secrets.tdb dns323:/mnt/HD_a2/fun_plug.d/etc/secretes.tdb
  2. Move the good samba bits back in to place on your test samba box.
  3. Setup the DNS323 to us the secrets.tdb file - create a new startup script:
cd /mnt/HD_a2/fun_plug.d/start
chmod 755
smbd_start() {
      cp -p ${ETCDIR}/samba/secrets.tdb /tmp/samba/secrets.tdb
      killall smbd
      /usr/bin/smbd -D
smbd_stop() {
  killall smbd
smbd_status() {
case "$1" in
      sleep 1
      echo "Usage: $0 start|stop|restart|status"
  1. reboot the dns323 from the webpage
  2. note dont make any mistakes otherwise you may brick your unit.

How to make the dns-323 work with UNC paths:

There's a problem accessing the DNS-323 through UNC paths. You could make users that have the same username and password as your Windows account. But that would seriously compromise your password security since the DSN-323 only allows a maximum of 8 characters and doesn't allow special characters. If you use a different username and password Windows will prompt you with a login box that doesn't allow to specify a username. (username is greyed out.) To solve this problem D-Link tells you to map network drives to the device and specify a username and password that way.

This howto shows a not-so-hacky way to enable you to access your D-Link with UNC paths (without having to map network drives) and providing you with a login box that enables you to specify a username and password.

  • Make sure your firmware is version 1.03/1.04 (Not tested with other firmwares)
  • From within the D-Link web admin: Save your Configuration Settings
  • Edit the saved file with a Linux compatible text editor (Like Notepad++)
  • Under [global] change:
    security = SHARE


    security = USER
  • Save the file and load it back up onto the DNS-323 (Using 'Load Configuration Settings')
  • You're done!

Some side notes:

  • Since the root path of the DNS-323 isn't secured, accessing it will trigger Windows to access the resource anonymously. Accessing a secured resource after this will result in an error telling you you're not allowed to access the resource with multiple login sessions. (You're already logged in with that anonymous account.) To work around this problem make sure to access the secured share directly after Windows starts up. like:

Prevent anonymous access

The more secure solution would be to edit the share setting in smb.conf, unfortunatly I dont se how this could be done in the same way. I use my own smb.conf and copies it to /etc/samba/ using fun_plug

# fun_plug part
if [ -r "${FUNPLUGDIR}/etc/smb.conf" ]; then
	mv ${FUNPLUGDIR}/etc/smb.conf /etc/samba >>${LOGFILE}
	exec smb restart >>${LOGFILE}
    echo "*  ${FUNPLUGDIR}/etc/smb.conf: File not found"
# smb.conf changes (started out with dlinks original).
hosts allow = 192.168.1. 
security = USER
# I use groups and dont want other non members to access files.
create mask = 0770
directory mask  = 0770
force create mode = 0770
force directory mode = 0770
# the most share settings
[ Lagring ]
comment = 
path = /mnt/HD_a2/smb
valid users = 
read only = no
guest ok = no # this prevents anonymous access

[ Admin ] #one user only share, to access fun_plug 
comment =
path = /mnt/HD_a2
valid users = sysadm
read only = no
guest ok = no
  • The web admin seems to crash when modifying users after you've done this hack. I'm not sure if this is due to the hack.

What's next?

I hope this way of hacking (using the configuration file) allows for some other nice hacks that don't involve using mod_plug hacks. I think it's a cleaner way to do things. If someone knows a way to secure the root path of the DNS-323 that would be nice since it would prevent Windows from logging in anonymously!


Personal Tools