Best Way to Manage Share Permissions

Wow, I guess I didn't realize it could be that simple! So would I be able to modify permissions on a folder from a Windows XP machine (logged in under Administrator) as if it was a Windows file server?

I know you can't modify Samba's share permissions using MMC like you could if it was a Windows Server, but we usually just give Everyone full access to the shares and let the ACL file permissions take care of security.

So as long as we could change those ACL permissions easily (like we do now) or at worst have a gui on the server that can do it, we should be all set.

And what type of filesystem should I use on the drives that are going to hold the data? Is ext3 sufficient or should I used something like XFS?

My recommendation on the filesystem would depend on the kinds of data being stored... large filesystem with large files (like movies, or database files) would best be served with XFS, smaller more numerous files are probably better off on ext3.

BTW: the list of permissions and how they are set are similar (but not entirely the same) to what any client system could do while connected to a Win server. (Open the properties, look at advanced security and you'll see permissions as if it were a Windows server)

Dan
IT4SOHO

Sorry to get caught up in the other thread, my question was answered and I'm going to close that one. But here's the problem so far:

Whenever copying files from an existing Windows file server, as you suggested, it does not copy the ACL permissions with it. Instead, it creates three ACL entries: Domain Users, Everyone, and the person who copied the files. All three of these entries get Full Control.

Below is my current smb.conf file. It was initially created by SWAT.

[global]
        workgroup = BNL
        realm = BNL.LOCAL
        server string = Samba Server Version %v
        security = ADS
        allow trusted domains = No
        obey pam restrictions = Yes
        password server = bnldc1.bnl.local bnldc2.bnl.local
        passdb backend = tdbsam
        idmap backend = idmap_rid:bnl=16777216-33554431
        idmap uid = 16777216-33554431
        idmap gid = 16777216-33554431
        winbind enum users = Yes
        winbind enum groups = Yes
        winbind use default domain = Yes
        cups options = raw
 
[printers]
        comment = All Printers
        path = /var/spool/samba
        printable = Yes
        browseable = No
 
[Shared]
        comment = Shared Drive
        path = /media/storage1/Shared
        read only = No
        force create mode = 766
        force directory mode = 277

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:

I would also like to add that I tried to modify the permissions on a folder from an XP client and no matter what I do, the permissions get reset to Domain Users (Full), Everyone (Full), and my username (Full).

Ok have a look to

http://www.bluelightning.org/linux/samba_acl_howto/

FAQ 3.1
 see if that make sense ...

The permissions are being forced to full-share mode by your smb.conf file... you HAVE told it to FORCE the mode to 766

If you just want the DEFAULT create mode to be something else, then take away the force part.

Also, permissions work the same on Samba as on a Windows server -- when you COPY files, the new files have the permissions of the user who is doing the copying. To preserve the permissions, use a backup/restore function (like ntbackup)

Good Luck!

Dan
IT4SOHO

PS: I was working in the other thread as well... I'm not a big fan of just turning off SELinux, but if you're comfortable with that, OK...

Well, it sounds similar, but I can't get ANY permissions to stick. They say they have problems removing the Everyone group, I can't add, remove, or change permissions on any group at all.

also, i will tell you to read this one

http://searchenterpriselinux.techtarget.com/tip/0,289483,sid39_gci1080966_mem1,00.html

you might have to create an account in their but its explaining , about what you are trying to do

have a look, might give you an idea..

Below is the output from mount -t ext3. I am reading that article now.

/dev/mapper/VolGroup01-LogVol00 on / type ext3 (rw)
/dev/sda1 on /boot type ext3 (rw)
/dev/sdb1 on /media/storage1 type ext3 (rw)
/dev/sdc1 on /media/storage2 type ext3 (rw)

                                              

1:
2:
3:
4:

And after I read the article, I changed the /etc/fstab file, the did a umount on storage1 and storage2, then did a mount -a. Running mount -t ext3 again, the following is what it returns (which looks good)

/dev/mapper/VolGroup01-LogVol00 on / type ext3 (rw)
/dev/sda1 on /boot type ext3 (rw)
/dev/sdb1 on /media/storage1 type ext3 (rw,acl)
/dev/sdc1 on /media/storage2 type ext3 (rw,acl)

                                              

1:
2:
3:
4:

That definitely made a difference. I can actually apply permissions now. Copying from a Windows server is still a little weird, but I'll report back when I can figure out what's going on.