CentOS File Server and Windows Active Directory

I think I'm just going to disable SElinux and reboot.....Most of the problems I keep running into with this server are related to SElinux.

But did I do the grouping correctly? I read that you needed to put an '@' in front of a group name, but it didn't say anything about what to do with group names that contain spaces (e.g. Domain Users).

First, I'm assuming you're browsing to \\server\Shared (not \\server\Share) -- the D at the end is in your config, so it has to be there in your client

Second, your read list and write list arguments should be removed...

[Shared]
        comment = PUBLIC FILES
        path = /media/storage1/Shared
        guest ok = No
        writeable = Yes
        force create mode = 0766
        force directory mode = 2777


The two "force" commands make sure that all files that are in Shared are created as sharable (global permissions).

I hope this solves the issue!

Dan
IT4SOHO

It solves that issue, but whenever directories are copied from the existing Windows server, none of the permissions get copied to the CentOS server....everything is set to Full Control for Everyone

First of all make sure that your /etc/resolv.conf points to your AD name server or make sure that you have an /etc/hosts entry so that you can ping the AD server.

You told you'd joined to the AD did you add GID aund UID mappings etc that will help you fully integrate with the AD ??

KeremE:
It's already on the AD domain, and authentication works with it and all that stuff

We dont use Samba too much in our organization thats why never went deep in Samba!!

how ever you can define share in samba for domain like this

[share]        
      comment = a comment        
      path = /home/share        
      browseable = yes        
      read only = no        
      inherit acls = yes        
      inherit permissions = yes        
      create mask = 700        
      directory mask = 700        
      valid users = @"DOMAIN+Domain Users"   <-- define your ADS groups        
      admin users = @"DOMAIN+Domain Admins"  <-- define your ads groups with admin rights  

fosiul01:

This question and my other question are now turning into the same question, so I'm going to close out this question, as disable SElinux solved this question.

Here is a link to my other question:
http://www.experts-exchange.com/OS/Linux/Distributions/CentOS/Q_24651793.html#a25101979

Basically, setting permissions at the share level won't work for us because we have several folders in a share that have different file permissions. So I'm trying to find a way to move that file server to CentOS with all the folders + file permissions intact.

I ended up disabling SElinux altogether because it was causing other problems as well. But I wouldn't have thought about SElinux if you hadn't said anything, so this question is answered as far as I'm concerned.

yes i saw that question but was keep quite because my lack of Samba knowledge!!!
anyway

Ok so you saying

you want to copy all the folder from windows directory to Centos Serer but you want to keep the original permission you had from windows , is that right??

Correct.....but as I just mentioned in my other question, I tried to modify the permissions on a folder from an XP client and no matter what I do, the permissions get reset to Domain Users (Full), Everyone (Full), and my username (Full).

So copying and manually setting permissions fails.

If you used my example and used "force create mode" then you cannot change the permissions (they are forced to the mode you entered)... take away the "force" and you should regain the ability to change permissions.

(The cut/paste example I showed is a folder we call public -- we don't want anything in there but PUBLIC files, so we force the permissions -- your case is obviously different)

I hope this helps!

Dan
IT4SOHO

Also, as I have mentioned before (other threads) regarding retaining permissions, you cannot just COPY files (not even onto a Windows Server) and have them retain the original permissions. When you copy, you create a NEW file that has a NEW set of permissions -- set to the default values to start with.

Also, as has been brought up earlier, if you're going to use multiple Windows (AD or PDC) groups, you'll need to enable ACLs -- on the filesystem AND on Samba.

> Correct.....but as I just mentioned in my other question, I tried to modify the permissions on a folder from
> an XP client and no matter what I do, the permissions get reset to Domain Users (Full), Everyone (Full),
> and my username (Full).
>
> So copying and manually setting permissions fails.

This is because you think that joining a domain in SAMBA is enough for active directory integration. I've previously told you you need other settings besides SAMBA but you told "you've already joined the directory.

Actually AD integration takes you join to the directory and also login to the Kerberos Realm and then you will map UID's and GID's from AD to SAMBA.

but actually it deserves another question. This is way off limits of this question which is already and closed without much consideration :) Pity.

KeremE:

I already have it set up with Kereros and UID and GID's....that was solved in another thread long before this thread existed.

it4soho:

Actually, you DID say that I could just copy the files and have their permissions intact in my other thread:

"If CentOS and Samba were setup correctly, then you should be able to copy the files from the old Windows Server to the CentOS/Samba server (using CIFS) and preserve the permissions automatically."

it4soho:

You did, however mention that the owner would be changed to the person doing the copying.

it4soho:

You also mentioned that using NTBackup would preserve the owner. Would it also preserve the ACL's? If it does, then I can just run NTBackup on the Windows server, backup the drive and do a restore to the CentOS file server.

Seems to me that there's something still missing which will do the trick for you and it is here at the AD integration part. Anyway good luck.

Yes, the NTBackup utility stores ALL of the permissions on the files & folders, and assuming you have the ACLs permitted on your samba filesystem (and in Samba), when they are restored (presumably over a samba share), ALL of the permissions will be restored.

NOTE: "Copy"ing files (in Windows & Linux) makes a NEW file that is owned by the current user and has permissions of any OTHER file owned or created by that user.

"Move"ing files will preserve the previous ownership & permissions, but is DANGEROUS on Windows systems because the source file can be deleted even if the target file isn't created properly.

Thus, your best bet is to use the backup/restore option.

I hope this clears things up... I guess I need to be more careful in using the term "copy"...

Good Luck!

Dan
IT4SOHO