mjhjmtu

I want Samba share to contain a symlink to directory outside the shared directory tree. Of course I don't want clients to be able to tamper with anything else on the server filesystem except for the shared directory tree and trees of outer directories which I symlink inside it intentionally. I've seen multiple answered similar questions here but solutions didn't work for me. My smb.conf:

[global]
 workgroup = WORKGROUP
 server string = Samba Server
 server role = standalone server
 map to guest = bad user
# I'm not going to need anything that is not supported by Windows clients anyway
 unix extensions = no
# This shouldn't be necessary with unix extensions off
 allow insecure wide links = yes

[Public]
 path = /mnt/Shares/Public
 guest ok = yes
 only guest = yes
 wide links = yes
# Default value, probably an obsolete setting
 follow symlinks = yes

I've tried smbclient //<my hostname>/Public and Windows client, both don't list the symlink linked to outer directory at all. Symlink linked to another directory inside the shared directory is shown. Samba 4.7, running under root account and should be able to access symlinked outer directory.

Besides, I don't get the idea of symlink security in Samba. I see 2 sane ways of handling symlinks:

• server resolves symlinks and presents them to client as regular objects; client can't create symlinks


• server presents symlinks as-is, client resolves them; client can't access server filesystem objects outside of the share directory

How can I achieve the 1st? In the Samba manual it looks like server can allow client to create symlink which is then resolved by server, e. g. in the "follow symlinks" section. What's the point of such behavior?

P. S. So mods are ok with stupid "just do without what you're trying to achieve" comments but delete my answer describing solution of the title problem because they consider it's merely "additional information". Great. Deleted answer: it's the user that's mapped to the client (in my case it's nobody, default for guest account) that should be able to access the target directory, not the one running smbd. Still would be great to demystify the last question.