[Samba] NTFS ACLs

[Stewart Lawler]

Hi..

I'm having trouble getting to grips with NTFS ACLs in samba 
(2.2.3a-12.3 pkg for Debian)

I've set up a samba server with the usual homes and share drives &c. 
Windows 98 clients are no problem. But the win 2k boxes are a different 
kettle of things. I was puzzled as to why one user would get another 
user's home share mounted on H: when i could find nothing in the 2k 
user profile that would override the samba settings. I've narrowed it 
down to an odd set of security permissions being applied to files on 
the server.

Basically it seems to be entirely random as to who gets ownership of a 
file/folder in the 2k file properties security tab.   So for eg I find 
Fred owns Joe's home directory and when Joe logs on he gets Fred's home 
mounted instead of his own. I've also noticed things (again in the 2k 
permissions dialog) like names listed as "<Fred Bloggs> DOMAIN\jsmith" 
ie the server user name and user's full name are different.

Removing Fred from the permissions and having Joe 'take ownership' in 
2k doesn't work either, Fred's right back there when i open the dialog 
again.

Something is up with the defaults set by samba, i'm sure, but i don't 
know what. there doesn't seem to be much info out there on how to 
manage NT ACLs from the samba end (because plainly doing anything on 
the client machine isn't working). I have tried running smbcacls but 
it's asking me for a password but there is no clue as to who's password 
it wants and i've tried 'em all. :)

any info or pointers to howtos would be much appreciated...

cheers,
..S.

-------------- next part --------------
Load smb config files from /etc/samba/smb.conf
Processing section "[homes]"
{omitted}
Loaded services file OK.
WARNING: You have some share names that are longer than 8 chars
These may give errors while browsing or may not be accessible
to some older clients
Press enter to see a dump of your service definitions
# Global parameters
[global]
	coding system = 
	client code page = 850
	code page directory = /usr/share/samba/codepages
	workgroup = BLEACH
	netbios name = DOLCE
	netbios aliases = 
	netbios scope = 
	server string = Bleach File Server
	interfaces = 
	bind interfaces only = No
	security = USER
	encrypt passwords = Yes
	update encrypted = No
	allow trusted domains = No
	hosts equiv = 
	min passwd length = 5
	map to guest = Never
	null passwords = No
	obey pam restrictions = No
	password server = 
	smb passwd file = /etc/samba/smbpasswd
	root directory = 
	pam password change = No
	passwd program = /usr/bin/passwd %u
	passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n .
	passwd chat debug = No
	username map = 
	password level = 0
	username level = 0
	unix password sync = Yes
	restrict anonymous = No
	lanman auth = Yes
	use rhosts = No
	log level = 2
	syslog = 1
	syslog only = No
	log file = /var/log/samba/log.%m
	max log size = 5000
	timestamp logs = Yes
	debug hires timestamp = No
	debug pid = No
	debug uid = No
	protocol = NT1
	large readwrite = No
	max protocol = NT1
	min protocol = CORE
	read bmpx = No
	read raw = Yes
	write raw = Yes
	nt smb support = Yes
	nt pipe support = Yes
	announce version = 4.5
	announce as = NT
	max mux = 50
	max xmit = 65535
	name resolve order = lmhosts host wins bcast
	max packet = 65535
	max ttl = 259200
	max wins ttl = 518400
	min wins ttl = 21600
	time server = No
	unix extensions = No
	change notify timeout = 60
	deadtime = 0
	getwd cache = Yes
	keepalive = 300
	lpq cache time = 10
	max smbd processes = 0
	max disk size = 0
	max open files = 10000
	read size = 16384
	socket options = TCP_NODELAY
	stat cache size = 50
	use mmap = Yes
	total print jobs = 0
	load printers = Yes
	printcap name = /etc/printcap
	disable spoolss = No
	enumports command = 
	addprinter command = 
	deleteprinter command = 
	show add printer wizard = Yes
	os2 driver map = 
	strip dot = No
	character set = 
	mangled stack = 50
	stat cache = Yes
	domain admin group = 
	domain guest group = 
	machine password timeout = 604800
	add user script = /usr/sbin/useradd -d /dev/null -g machines -c 'Machine Account' -s /bin/false -M %u
	delete user script = 
	logon script = %U.bat
	logon path = \\%N\%U\profile
	logon drive = H:
	logon home = \\%N\%U
	domain logons = Yes
	os level = 20
	lm announce = Auto
	lm interval = 60
	preferred master = Auto
	local master = Yes
	domain master = Auto
	browse list = Yes
	enhanced browsing = No
	dns proxy = No
	wins proxy = No
	wins server = 
	wins support = Yes
	wins hook = 
	kernel oplocks = Yes
	oplock break wait time = 0
	add share command = 
	change share command = 
	delete share command = 
	config file = 
	preload = 
	lock dir = 
	utmp directory = 
	wtmp directory = 
	utmp = No
	default service = 
	message command = 
	dfree command = 
	valid chars = 
	remote announce = 
	remote browse sync = 
	socket address = 0.0.0.0
	homedir map = 
	time offset = 0
	NIS homedir = No
	source environment = 
	panic action = 
	hide local users = No
	host msdfs = No
	winbind uid = 
	winbind gid = 
	template homedir = /home/%D/%U
	template shell = /bin/false
	winbind separator = \
	winbind cache time = 15
	winbind enum users = Yes
	winbind enum groups = Yes
	comment = 
	path = 
	alternate permissions = No
	username = 
	guest account = nobody
	invalid users = 
	valid users = 
	admin users = 
	read list = 
	write list = 
	printer admin = 
	force user = 
	force group = 
	read only = Yes
	create mask = 0744
	force create mode = 00
	security mask = 0777
	force security mode = 00
	directory mask = 0755
	force directory mode = 00
	directory security mask = 0777
	force directory security mode = 00
	inherit permissions = No
	guest only = No
	guest ok = No
	only user = No
	hosts allow = 192.168.1.
	hosts deny = 
	status = Yes
	nt acl support = Yes
	max connections = 0
	min print space = 0
	strict allocate = No
	strict sync = No
	sync always = No
	write cache size = 0
	max print jobs = 1000
	printable = No
	postscript = No
	printing = bsd
	print command = lpr -r -P'%p' %s
	lpq command = lpq -P'%p'
	lprm command = lprm -P'%p' %j
	lppause command = 
	lpresume command = 
	queuepause command = 
	queueresume command = 
	printer name = 
	use client driver = No
	default devmode = No
	printer driver = 
	printer driver file = /etc/samba/printers.def
	printer driver location = 
	default case = lower
	case sensitive = No
	preserve case = Yes
	short preserve case = Yes
	mangle case = No
	mangling char = ~
	hide dot files = Yes
	hide unreadable = No
	delete veto files = No
	veto files = 
	hide files = Network Trash Folder/TheVolumeSettingsFolder
	veto oplock files = 
	map system = No
	map hidden = No
	map archive = Yes
	mangled names = Yes
	mangled map = 
	browseable = Yes
	blocking locks = Yes
	fake oplocks = No
	locking = Yes
	oplocks = Yes
	level2 oplocks = Yes
	oplock contention limit = 2
	posix locking = Yes
	strict locking = No
	share modes = Yes
	copy = 
	include = 
	exec = 
	preexec close = No
	postexec = 
	root preexec = 
	root preexec close = No
	root postexec = 
	available = Yes
	volume = 
	fstype = NTFS
	set directory = No
	wide links = Yes
	follow symlinks = Yes
	dont descend = 
	magic script = 
	magic output = 
	delete readonly = No
	dos filemode = No
	dos filetimes = No
	dos filetime resolution = No
	fake directory create times = No
	vfs object = 
	vfs options = 
	msdfs root = No

[homes]
	comment = Home Directories
	path = /home/%u
	valid users = @bleach
	read only = No
	create mask = 0700
	directory mask = 0700

{omitted}