BetterSamba

The samba server on the device is pretty crippled for a few reasons:

• No ability to authenticate against another server
• No fine-grained access control via the web interface (e.g. write-only dropboxes, etc)

There are a few ways to get around this. One option is to edit the firmware /etc/samba/smb.conf. Really, you need to keep an edited copy on the hard disk, and write a fun_plug script to copy the new version to ramdisk after the machine boots, then restart the samba server (and thus re-read the config file). You may also perform small edits to the file without a fun_plug by use of export and import config. This can be used to make the bundled samba config include another config placed on the harddrive. The format of the exported configs are done several files stacked together separated by newline followed by ';'. The samba config is truncated to a fixed number of lines when reimporting, but it's possible to edit the file and possible add “include = /mnt/HD_a2/smbconfig”.

Another option is to install the debian bootstrap, and use that version of samba (this is probably the better option, since debian's smb server will probably be newer than the firmware version). Again, you're going to have to have a fun_plug script that disables the embedded samba before running the debian initrc and starting debian's samba server.

Not much of a howto just yet, but as I get it set up I'll drop in step-by-step instructions for both methods, with some sample configurations for making samba work well. Hopefully I'll demonstrate how to make samba auth against Active Directory/LDAP so that real system administrators would see how to use the DNS-323 for something useful – like seamless home directory storage for their network!

Note: This was tested using 1.0.4 beta firmware.

Steps to get domain authentication working:

1. edit the smb.default file (on the dns323)

mount -t minix /dev/mtdblock0 /sys/mtd1
mount -t minix /dev/mtdblock1 /sys/mtd2
#EDIT both copies of smb.default
vi /sys/mtd[12]/smb.default
Change the line "security = SHARE" to "security = DOMAIN"
#
sync
umount /sys/mtd1 /sys/mtd2
#

1. You will need a secrets.tdb file from another linux box that you have used to join the domain (on a test inux box)
   1. shutdown samba on your test linux box.
   2. move all the files from /etc/samba to a safe location
   3. create a new smb.conf with the following entries

  [ global ]
  workgroup = MYNTorADDOMAIN
  netbios name = dns323
  security = DOMAIN

1. Join the domain

  net join

1. scp -p /etc/samba/secrets.tdb dns323:/mnt/HD_a2/fun_plug.d/etc/secretes.tdb
2. Move the good samba bits back in to place on your test samba box.
3. Setup the DNS323 to us the secrets.tdb file - create a new startup script:

cd /mnt/HD_a2/fun_plug.d/start
touch samba-1.0.4-domain.sh
chmod 755 samba-1.0.4-domain.sh
vi samba-1.0.4-domain.sh

#!/bin/sh
smbd_start() {
      cp -p ${ETCDIR}/samba/secrets.tdb /tmp/samba/secrets.tdb
      killall smbd
      /usr/bin/smbd -D
}
smbd_stop() {
  killall smbd
}
smbd_status() {
  echo
}
case "$1" in
  stop)
      smbd_stop
      ;;
  restart)
      smbd_stop
      sleep 1
      smbd_start
      ;;
  status)
      smbd_status
      ;;
  start|'')
      smbd_start
      ;;
  *)
      echo "Usage: $0 start|stop|restart|status"
      ;;
esac

1. reboot the dns323 from the webpage

Note: Don't make any mistakes, or you could brick your unit!

A UNC path looks like \\servername\sharename, and there's a problem accessing network shares on the DNS-323 through UNC paths if the share requires a user name and password: Windows will prompt you with a login box that doesn't allow to specify a username (the username is greyed out).

You could make users that have the same username and password as your Windows account. But that would seriously compromise your password security since the DSN-323 only allows a maximum of 8 characters and doesn't allow special characters. To solve this problem D-Link tells you to map network drives to the device and specify a username and password that way. Alternatively, in Windows XP and Vista each user can store a single username and password to use for connections to a DNS323 in Control Panel > User Accounts > Manage Your Network Passwords. Some “Home” versions of Windows deliberately forget such stored passwords each time the machine is rebooted.

If you need to use different passwords to access different shares on the DNS323, or just don't want Windows to store the password, then this howto shows a not-so-hacky way to enable you to access your D-Link with UNC paths providing you with a login box that enables you to specify a username and password.

• Make sure your firmware is version 1.03/1.04 (Not tested with other firmwares)
• From within the D-Link web admin: Save your Configuration Settings
• Edit the saved file with a Linux compatible text editor (Like Notepad++)
• Under [global] change:

  security = SHARE

  to

  security = USER

• Save the file and load it back up onto the DNS-323 (Using 'Load Configuration Settings')
• You're done!

Since the root path of the DNS-323 isn't secured, accessing it will trigger Windows to access the resource anonymously. Accessing a secured resource after this will result in an error telling you you're not allowed to access the resource with multiple login sessions. (You're already logged in with that anonymous account.) To work around this problem make sure to access the secured share directly after Windows starts up. like:

//nas/my_secured_resource/

The more secure solution would be to edit the share setting in smb.conf, unfortunatly I dont se how this could be done in the same way. I use my own smb.conf and copies it to /etc/samba/ using fun_plug

# fun_plug part
if [ -r "${FUNPLUGDIR}/etc/smb.conf" ]; then
	mv ${FUNPLUGDIR}/etc/smb.conf /etc/samba >>${LOGFILE}
	exec smb restart >>${LOGFILE}
else
    echo "*  ${FUNPLUGDIR}/etc/smb.conf: File not found"
fi

# smb.conf changes (started out with dlinks original).
hosts allow = 192.168.1. 
security = USER
# I use groups and dont want other non members to access files.
create mask = 0770
directory mask  = 0770
force create mode = 0770
force directory mode = 0770
# the most share settings
[ Lagring ]
comment = 
path = /mnt/HD_a2/smb
valid users = 
read only = no
guest ok = no # this prevents anonymous access

[ Admin ] #one user only share, to access fun_plug 
comment =
path = /mnt/HD_a2
valid users = sysadm
read only = no
guest ok = no

• The web admin seems to crash when modifying users after you've done this hack. I'm not sure if this is due to the hack.

Both DNS-323 firmware 1.03 and 1.04 have the problem that the Windows archive bit is not handled correctly (it is always set). Some backup programs don't like this.

The problem is that /etc/smb.conf contains the line

force create mode = 0777

Solution is to delete the line. But after the next reboot it is gone again This is why you need funplug and a sambafix.sh file in the funplug.d/start directory. It gets executed at each boot and it contains the following:

# Restart Samba with my configuration
cp /mnt/Volume_1/etc/samba/smb.conf /etc/samba/smb.conf
smb restart

The full procedure is:

1. Copy the original /etc/samba/smb.conf somewhere (e.g. such as /mnt/Volume_1/etc/samba/smb.conf)and edit it to your liking
2. Create a /mnt/Volume_1/funplug.d/start/sambafix.sh file as shown above
3. Set the execute bit with: chmod u+x sambafix.sh
4. Reboot

I hope this way of hacking (using the configuration file) allows for some other nice hacks that don't involve using mod_plug hacks. I think it's a cleaner way to do things. If someone knows a way to secure the root path of the DNS-323 that would be nice since it would prevent Windows from logging in anonymously!