Solved

Samba file server using NT4 domain users

Posted on 2004-08-05
8
773 Views
Last Modified: 2010-03-18
I've joined the NT4 domain using "net rpc join -U administrator" and can "wbinfo -u" & -g & -t just fine. But I can only read the shares and cannot write. Plus, I cannot figure out how to give a domain group permissions to read or write. I feel like I'm so close, but just missing a few things to make this all come together. The end goal I'm trying to reach is to create a share on my linux server that my domain users can access (read/write) without typing in any username / password information.

If it's of any value, here's my smb.conf per 'testparm':
# Global parameters
[global]
       workgroup = NT4DOMAIN
       server string = File Server One
       security = DOMAIN
       password server = NTSERVER
       log level = 3
       log file = /var/log/samba/%m.log
       max log size = 50
       socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
       load printers = No
       wins server = 10.10.20.13
       idmap uid = 16777216-33554431
       idmap gid = 16777216-33554431
       winbind separator = +
       winbind use default domain = Yes

[fileshare]
       comment = File Server One Main Share
       path = /fileshare
       valid users = jason
       read only = No
       create mask = 0765
0
Comment
Question by:J. Smith
  • 4
  • 2
  • 2
8 Comments
 
LVL 14

Expert Comment

by:pablouruguay
ID: 11728329
in here you have a complete smb.conf check with that

http://cgi.librelogiciel.com/pipermail/pykota/2004-April/000770.html
0
 
LVL 14

Expert Comment

by:pablouruguay
ID: 11728358
and i check again your conf please add this

writable = yes
0
 
LVL 4

Author Comment

by:J. Smith
ID: 11730282
The smb.conf u've posted is from 2002 and a lot of things have changed since then. I've tried writable and it didn't work.
0
Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

 
LVL 9

Accepted Solution

by:
e-tsik earned 500 total points
ID: 11741936
Hi :-)

If you made it all the way to opening a file share, then you really are almost there.

I would do two things:

1. Make sure that you didn't somehow squeeze yourself through a guest account. Put
map to guest = never
in the global options. Failure to login afterwards will imply that you somehow haven't joined the domain correctly.

2. Make sure the user jason has the right access permissions to "/fileshare". I see that you allow only one user to access this share (for administrative reasons?). In this case, assuming that you do not need to preserve the user/group information for the user who logs in, put
force user = root
force group = root
in the share options.  This makes all the newly created files written as 'root'. Note: this does not close the share to root only. It allows only jason to log on, but after the connections, files and folders are accessed as root.
Another option could be to chmod/chown the files in "/fileshare" to allow access to jason.

Enjoy...
0
 
LVL 4

Author Comment

by:J. Smith
ID: 11752759
ok, i did all that and i'm still getting access denied
0
 
LVL 4

Author Comment

by:J. Smith
ID: 11793584
e-tsik, what you said works, but I have a few questions for you if you don't mind.
First, I had to create an identical Unix user to for each person that I wanted to give access to the share. Is there a way to give access without creating a local user?
Second, how do I set permissions on a per user/group on a share? I don't mind using set force user = root, but how would i give one user/group only read access and the other write?
Finally, I've read about some users "owning" a file and then another not being able to open it because of that. Is the only way to get around this by using the force user = root?

Thanks!
0
 
LVL 9

Expert Comment

by:e-tsik
ID: 11799363
Questions? No problem!

1. The reason why you had to create a local user for everyone was because you haven't configured (correctly) pam_smb. Redhat calls is "smb authentication". Failure to log on with the network user/password caused your users not to be able to log on through samba.

2. Permissions without "force user" are quite easy, but they are governed by the unix permissions, which are quite strict. First, you need to learn how unix permissions work (that is, if you haven't by now). You configure permissions with the unix user/group associations and the chown, chmod commands. Samba also uses ext2 attributes to configure "fine grained" permissions (unix permissions only have one owner and group per file, and permissions are granted to these owner and group, fine grained means you can have multiple). I never found it functional in a binary-downloaded configuration (have not tried it on Fedora, though). When that works, you could configure the permissions using the windows "permissions" tab (cool, isn't it?)
0
 
LVL 4

Author Comment

by:J. Smith
ID: 11811173
Alright, I'll have to look into "fine grained" permissions. Thanks for your help!
0

Featured Post

Master Your Team's Linux and Cloud Stack

Come see why top tech companies like Mailchimp and Media Temple use Linux Academy to build their employee training programs.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Does fail2ban start automatically each time system starts? 1 200
Lame BIND 9.3 10 69
Help with Ubuntu 14.04 LTS 10 137
VPS for routing recomendations 3 65
I have seen several blogs and forum entries elsewhere state that because NTFS volumes do not support linux ownership or permissions, they cannot be used for anonymous ftp upload through the vsftpd program.   IT can be done and here's how to get i…
Note: for this to work properly you need to use a Cross-Over network cable. 1. Connect both servers S1 and S2 on the second network slots respectively. Note that you can use the 1st slots but usually these would be occupied by the Service Provide…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question