Samba is a free tool for sharing files through network and also enables user management. It comes pre-installed in Raspbian, so installation part is not covered in this guide. In this project, I followed user creation guid (jaunerg) in order to create two users and shared different folders, so one user doesn't affect the other. Additionally, I used bash code (.sh files) similar to the one I used in the SSH page in order to send email notifications.

1. To add a user to Samba, the user must also be registered in the OS:

   CopyShow Line Numbers
   sudo adduser --no-create-hom --shell /usr/sbin/nologin USERNAME

2. Add and enable user in Samba using smbpasswd:

   CopyShow Line Numbers
   sudo smbpasswd -a USERNAME
   sudo smbpasswd -e USERNAME

3. Assign user to a group. If the group doesn't exist, then create one:

   CopyShow Line Numbers
   # Create group
   sudo groupadd GROUP
   
   # Assign user to a group
   sudo usermod -G GROUPS USERNAME

   Here GROUPS must be replaced with all the groups we would like to assign to USERNAME. This operation overrides previous ones, so if you want to assign a user to a few groups, you must list them above (comma-separated).

4. Create a directory that will be shared with this user and change its group:

   CopyShow Line Numbers
   # Create directory
   sudo mkdir PATH_TO_DIRECTORY
   
   # Change group
   sudo chown root:GROUP PATH_TO_DIRECTORY

   Note: You can also change permissions with chmod command, but it can be configured in Samba configuration file.

5. Add users to Samba configuration file.

   Before doing so, make sure you have a copy of the original file (backup):

   CopyShow Line Numbers
   sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.backup

   You can use "ls" command to verify backup exists:

   CopyShow Line Numbers
   sudo ls /etc/samba/

   Then open config file as super user:

   CopyShow Line Numbers
   sudo nano /etc/samba/smb.conf

   And append the new shared folder to the end:

   CopyShow Line Numbers
   [SHARE_NAME]
       comment = Shared folder called SHARE_NAME
       path = PATH_TO_DIRECTORY
       browseable = yes
       read only = no
       guest ok = no   # No guests allowed
       create mask = 0777  # Can change permissions here
       directory mask = 0777   # Directory permissions here
       writable = yes
       valid users = USERNAME  # List of users that are
                               # allowed to access this directory
       force user = USERNAME   # Default user assigned when connecting to this share

   For more information on smb.conf, visit Samba documentation

6. Restart samba and try to log in:

   CopyShow Line Numbers
   sudo service smbd restart

This step is crucial for monitoring Samba sessions and enhance security. Samba has a few variables (VARIABLE SUBSTITUTIONS) we can utilize in order to create log files Email notifications are sent for each login to or logout from a shared directory, so it allows a quick response in case that someone penetrated the server. Additionaly, you will need an email service that allows third party apps (app password in Gmail). I also tried Yahoo, but their third party service is down.

1. Open terminal in /usr/local/bin/ directory.

   or open terminal and run the following Command

   CopyShow Line Numbers
   cd /usr/local/bin

2. Create a new .sh file (email_temp.sh):

   CopyShow Line Numbers
   sudo nano email_temp.sh

   This is the template of the email. You can change it according to your needs.

   CopyShow Line Numbers
   echo 'From: Samba Connection <sender_email>\n'\
           'To: avivfaraj <receiver_email>\n'\
           'Subject: '$1 '\n\n'\
           $2 	> /usr/local/bin/samba_email.txt

   This code will create the email_template (samba_email.txt) inside /usr/local/bin/ directory. Note that $1,$2 mean the first and second parameters sent while executing file. For example:

   CopyShow Line Numbers
   sh email_temp.sh "First parameter" "Second parameter"

   This code will create a .txt containing "Subject: First parameter" and the content will be "Second parameter"

3. Create a new .sh file (send_email.sh):

   CopyShow Line Numbers
   sudo nano send_email.sh

   This code will send the email using the curl command:

   CopyShow Line Numbers
   curl --ssl-reqd \
       --url 'smtps://smtp.gmail.com:465' \
       --user 'SENDER_EMAIL:PASSWORD' \
       --mail-from 'SENDER_EMAIL' \
       --mail-rcpt 'RECEIVER_EMAIL' \
       --upload-file /usr/local/bin/samba_email.txt

   Replace SENDER_EMAIL and RECEIVER_EMAIL with email addresses. Also, the PASSWORD should be replaced with the app password.

   Note: It is a better practice to use envorinment variables in the code, so instead of writing sensitive information such as password in the file, it is better to read a variable that is defined locally. However, I tried to do so, and it didn't read the variable at all, so login was denied.

4. Create another .sh file that will execute the above .sh programs and send an email for each connection or disconnection:

   CopyShow Line Numbers
   sudo nano custom_log.sh

   In the file write the following code:

   CopyShow Line Numbers
   msg=''
   title=''
   if [ $1 -eq 2 ]; then
       msg="Connected to"
       title="Samba connection established"
   else
       msg="Disconnected from"
       title="Samba Disconnected"
   fi
   
   if [ $1 -eq 2 ] || [ $1 -eq 3 ]; then
       mailcontent="${2} ${3} - ${msg} ${4} on ${5} by ${6} at ${7} os ${8} using ${9} ip ${10}"
       echo "${mailcontent}" >> /usr/local/bin/history.log
       sh /usr/local/bin/mail_temp.sh "$title" "$mailcontent"
       sh /usr/local/bin/send_email.sh
   fi

   Note that $1 can be either 2 for connection or 3 for disconnection.

5. Finally, add root prexec and root postexec parameters under the shared folder in /etc/samba/smb.conf:

   CopyShow Line Numbers
   root preexec = sh /usr/local/bin/custom_log.sh 2 %T %S %h %u %m %a %R %I
   root postexec = sh /usr/local/bin/custom_log.sh 3 %T %S %h %u %m %a %R %I

   Those parameters are executed as root at login (preexec) and logout (postexec). Please note that you can place them under [global] (without the root) in order to affect all users, but it didn't work as expected. In other words, both preexec and postexec were executed at login. Therefore, I place these two lines under every share I create as can be seen in the code below:

   CopyShow Line Numbers
   [SHARE_NAME]
       comment = Shared folder called SHARE_NAME
       path = PATH_TO_DIRECTORY
       browseable = yes
       read only = no
       guest ok = no   # No guests allowed
       create mask = 0777  # Can change permissions here
       directory mask = 0777   # Directory permissions here
       writable = yes
       valid users = USERNAME  # List of users that are allowed to access this directory
       force user = USERNAME   # Default user assigned when connecting to this share
       root preexec = sh /usr/local/bin/custom_log.sh 2 %T %S %h %u %m %a %R %I
       root postexec = sh /usr/local/bin/custom_log.sh 3 %T %S %h %u %m %a %R %I

   Also, %T, %S, %h, etc. are all samba variables, for instance,%T is time and date. Please note that %T is unique since it returns two values: one for date, and one for time. It means that $2, $3 in custom_log.sh represent date and time respectively.