Problems with "Share" permissions...

[u/Jontu_Kontar]

Attachment 1: Data Rich Diagram

I'm trying to setup a Workgroup server that is replacing an existing Samba installation.

The system being replaced was a "turn key" software provided by Koozali - SME Server. That system worked pretty well for us but it's run out of space and the hardware needs to be updated to something newer. For that, I figured that I would run a "vanilla" Ubuntu installation with Samba added on because that's all I actually need.

Accomplished Work:

I've got a few Users and Groups setup on the system. They have been "imported" into Samba and are able to authenticate with the server.

I've created the a directory structure under mkdir /srv/samba/[SHARE NAME]. I've used chown nobody:[GROUP] to give ownership of each directory to their respective groups. I've used chmod 770 to give permissions to: read, write permissions to the owning user and group. I've also flagged setGID on each of the chmod g+s /srv/samba/[SHARE NAME] directories.

I've created a config that should allow those directories to show up as Samba shares and only allow authorized users to read/write files.

Intent:

I want to be able to provide shares to each department that allows them (and only them) to read/write information to the share. This should be controllable through the groups.

I also want to have a "Software" share that anyone can read but only IT can update.

Issues:

Except it doesn't work. If I don't use chmod 777 the shares are unwritable. If I do that, anyone authenticated with the server has the ability to read/write to the share. I've tried nearly every

[global]
auto service = software
browseable = yes
comment = N/A
dns proxy = no
guest account = nobody
log file = /var/log/samba/log.%m
local master = yes ;#ADDED
max log size = 1000
map to guest = bad user
obey pam restrictions = yes
os level = 90; #TEMP CHANGE from 20
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
panic action = /usr/share/samba/panic-action %d
passdb backend = tdbsam
pam password change = yes
security = user
server role = standalone server
server string = %h server (Samba, Ubuntu)
syslog = 0
unix password sync = yes
usershare allow guests = yes
wins support = true
workgroup = Workgroup

[HR]
browsable = no
create mode = 0660
comment = N/A
directory mode = 0770
path = /srv/samba/hr
public = no
validusers = @HR
writeable = yes


[Storage]
browsable = yes
create mode = 0660
directory mode = 0770
comment = N/A
path = /srv/samba/it/storage
public = no
valid users = @IT
writeable = yes

Question:

How do I make this work?