[Samba] acl's and samba

[Mahoney, Tom]

So create two share definetions for each logical share? One for admin use
and the other for users?

The problem is that I setup this box to replace a 2k machine serving files.
Some shares are used really only by users and others only by admins and some
by both.
I simply need for my self and the rest of my IT team to be able to go in at
our leasure and add additional users to directories as they need access from
any 2k machine which we are logged in from anywhere on our network.

I tried adding the commas to all shares and samba doesn't seem to care on
way or the other.
Also aren't you only supposed to add @ to the beginning of unix or domain
groups? I'm adding domain user accounts.

Also when your connecting to samba from 2k and are prompted for your login
info. Do you login as domain\user or domain/user? I have / used as the
seperator on samba but don't know if it's 2k that interprets the username
typped at the 2k prompt or if it's samba which interprets it.

Do you also by any chance have an idea of why my first share says invalid
passwords while all others prompt for login info and then say invalid user?

Please let me know if you would like me to include my smb.conf as I would be
more than happy to.
I only have to edit out networks for security.

Thanks for your help so far. =)

-----Original Message-----
From: Noel Kelly [mailto:nkelly at tarsus.co.uk]
Sent: Monday, March 18, 2002 1:50 PM
To: 'Mahoney, Tom'
Cc: Samba generic mail list (E-mail)
Subject: RE: [Samba] acl's and samba


Tom,

It might be a small thing, but I think your 'valid users =' list needs to be
comma delimited - not spaces.  eg: valid users = @uk+it, at uk+developers

Also, the ability to act as root on a share is pretty dangerous.  I only use
it as an administrative thing to alter permissions even on files/directories
created by the users (and therefore owned by them).  Perhaps your users need
to alter permissions themselves but otherwise I would create a normal share
for your users and a special, 'force user =' share for the admins only.

Noel



-----Original Message-----
From: Mahoney, Tom [mailto:tom.mahoney at riaco.com]
Sent: 18 March 2002 18:47
To: 'Noel Kelly'
Cc: Samba generic mail list (E-mail)
Subject: RE: [Samba] acl's and samba


Hmm I tried what you suggested and I'm sure it should work if not for this
problem.
I added the following options to each of my shares:

force user = root
valid users = domain/users to add seperated by space
read only = No
inherit permissions = Yes
create mask = 777
directory mask = 777
nt acl support = Yes
veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/
delte veto files = Yes

directory mask is in global and was removed from the shares when I passed
the alterations through testparm to clean it up. It also has the same mask
set as before I passed it through testparm.

Now my problem is this.
The first share defined after homes give me this error from 2k:
\\server\share is not accesible.
The specified network password is not correct.

All other shares prompt for a user
I enter my domain user as domain/user and then my password and get the
error:
\\server\share is not accesible.
The specified username is invalid.

My homes share works without a hitch.

I also don't have a /etc/pam.d/samba configured to use winbindd which might
be my whole problem.
I'm not clear on how to properly configure /etc/pam.d/samba with
pam_winbind.so with redhat7.2.
I did try altering /etc/pam.d/samba to point to system-auth-winbind which I
created and added the auth and account pam_winbind.so lines to and then
restarted samba but this didn't change anything at all. system-auth-winbind
was created by copying the system system-auth and adding the auth and
account lines.

The share following the homes share also did not contain any funky
characters either which is the only explenation I could come up with for it
behaving differently than all the other shares.
Very odd. ?=/

If you or anyone would like I can include the full contents of my smb.conf
file minus network ips etc.. for security for you to examine.

Thanks for everyone's help so far. =)

-----Original Message-----
From: Noel Kelly [mailto:nkelly at tarsus.co.uk]
Sent: Saturday, March 16, 2002 12:32 PM
To: 'Mahoney, Tom'; Samba generic mail list (E-mail)
Subject: RE: [Samba] acl's and samba


I think the nut of your problem is that it is only the owner of the
file/directory who can alter the ACLs on it.  It does not matter if you are
the member of a group with full rights - only the owner can change ACLs.
Root can of course do whatever he wants to anything.

I got round this by creating a special administrator share which has the
'force user = root' entry.  This causes all operations on the this share to
be done as root.  Obviously very dangerous but effective.  Limit the access
to this special share using 'valid users ='

Noel

[AdminShared]
        force user = root
        valid users = uk+nkelly
        path = /raid/shared/
        public = no
        read only = No
        inherit permissions = yes
        create mask = 777
        directory security mask = 777
        nt acl support = yes
        # Veto the Apple specific files that a NetAtalk server creates.
        veto files = /.AppleDouble/.bin/.AppleDesktop/Network Trash Folder/
        delete veto files = yes


-----Original Message-----
From: Mahoney, Tom [mailto:tom.mahoney at riaco.com]
Sent: 15 March 2002 23:31
To: Samba generic mail list (E-mail)
Subject: [Samba] acl's and samba


I asked a long winded question before about ACL's on linux with bestbits
patches and how everying in samba was essentially working but I couldn't
change modify or add acls' from a 2k workstation also on the domain.

Well I have a two part question.

Should I ((HAVE)) to add a map to /etc/samba/smbusers like:	user =
domain/user	?
My impression from reading the docs and peoples posts is that winbindd
should figure this out ALL ON IT'S OWN.
Is that not the case? In which case I'm SUPPOSED to add the map but it's
either not mentioned or vaguely implied?

Second.

With my homedir accessible ( only because I did add the map, and yes I know
that if I add the map and it works most people would just give me a blank
stare on this over my question above, but I want someone to please confirm
this for me. ) I can go to my home share and set and remove acl's but on my
file shares on the samba box I can't.
Ok, confirmed that kernel and samba support acls' and fileutils/e2fsprogs do
too.
Can set acls' from cli and view them with ls or getfacl and see them through
samba. Samba just can't change them. (except for home share)
Now seeing that it works with my home share I have to think that samba is
perfectly ready and willing to set them but it must be I assume a unix
permission problem.
Now currently ALL files and directories under the file shares have
permissions set like so:
chown -R root /home/samba/<all file share dirs>
chgrp -R domain/Domain Admins /home/samba/<all file share dirs>
chmod -R ugo+rwx /home/samba/<all file share firs>