[Samba] avoiding local users

Tue Sep 1 09:23:33 MDT 2009

Hi,

Please repost your question without the comments, this makes it a lot
harder to read through the config.

Regards,

Serge Fonville

On Tue, Sep 1, 2009 at 5:20 PM, Konrad
Azzopardi<konrad.azzopardi at gmail.com> wrote:
>  Dear all,
>
> I am new to samba. have configured a samba share, pls see config file
> below and my problem is that the share works successfully however to
> work I need to create an equivalent user locally , in the case ' boule
> ' .  Is there a way to authenticate to the domain , force user and
> group as apache and having the valid users not created locally on the
> machine ?
>
> tnx
> konrad
>
>
> # This is the main Samba configuration file. You should read the
> # smb.conf(5) manual page in order to understand the options listed
> # here. Samba has a huge number of configurable options (perhaps too
> # many!) most of which are not shown in this example
> #
> # For a step to step guide on installing, configuring and using samba,
> # read the Samba-HOWTO-Collection. This may be obtained from:
> #  http://www.samba.org/samba/docs/Samba-HOWTO-Collection.pdf
> #
> # Many working examples of smb.conf files can be found in the
> # Samba-Guide which is generated daily and can be downloaded from:
> #  http://www.samba.org/samba/docs/Samba-Guide.pdf
> #
> # Any line which starts with a ; (semi-colon) or a # (hash)
> # is a comment and is ignored. In this example we will use a #
> # for commentry and a ; for parts of the config file that you
> # may wish to enable
> #
> # NOTE: Whenever you modify this file you should run the command "testparm"
> # to check that you have not made any basic syntactic errors.
> #
> #---------------
> # SELINUX NOTES:
> #
> # If you want to use the useradd/groupadd family of binaries please run:
> # setsebool -P samba_domain_controller on
> #
> # If you want to share home directories via samba please run:
> # setsebool -P samba_enable_home_dirs on
> #
> # If you create a new directory you want to share you should mark it as
> # "samba-share_t" so that selinux will let you write into it.
> # Make sure not to do that on system directories as they may already have
> # been marked with othe SELinux labels.
> #
> # Use ls -ldZ /path to see which context a directory has
> #
> # Set labels only on directories you created!
> # To set a label use the following: chcon -t samba_share_t /path
> #
> # If you need to share a system created directory you can use one of the
> # following (read-only/read-write):
> # setsebool -P samba_export_all_ro on
> # or
> # setsebool -P samba_export_all_rw on
> #
> # If you want to run scripts (preexec/root prexec/print command/...) please
> # put them into the /var/lib/samba/scripts directory so that smbd will be
> # allowed to run them.
> # Make sure you COPY them and not MOVE them so that the right SELinux context
> # is applied, to check all is ok use restorecon -R -v /var/lib/samba/scripts
> #
> #--------------
> #
> #======================= Global Settings =====================================
>
> [global]
>
> # ----------------------- Network Related Options -------------------------
> #
> # workgroup = NT-Domain-Name or Workgroup-Name, eg: MIDEARTH
> #
> # server string is the equivalent of the NT Description field
> #
> # netbios name can be used to specify a server name not tied to the hostname
> #
> # Interfaces lets you configure Samba to use multiple interfaces
> # If you have multiple network interfaces then you can list the ones
> # you want to listen on (never omit localhost)
> #
> # Hosts Allow/Hosts Deny lets you restrict who can connect, and you can
> # specifiy it as a per share option as well
> #
>       workgroup = BEILUX
>       server string = Samba Server Version %v
>
>       netbios name = security-portal
>
> ;       interfaces = lo eth0 192.168.12.2/24 192.168.13.2/24
> ;       hosts allow = 127. 192.168.12. 192.168.13.
>
> # --------------------------- Logging Options -----------------------------
> #
> # Log File let you specify where to put logs and how to split them up.
> #
> # Max Log Size let you specify the max size log files should reach
>
>       # logs split per machine
> ;       log file = /var/log/samba/%m.log
>       # max 50KB per log file, then rotate
> ;       max log size = 50
>
> # ----------------------- Standalone Server Options ------------------------
> #
> # Security can be set to user, share(deprecated) or server(deprecated)
> #
> # Backend to store user information in. New installations should
> # use either tdbsam or ldapsam. smbpasswd is available for backwards
> # compatibility. tdbsam requires no further configuration.
>
>       security = user
>       passdb backend = tdbsam
>
>
> # ----------------------- Domain Members Options ------------------------
> #
> # Security must be set to domain or ads
> #
> # Use the realm option only with security = ads
> # Specifies the Active Directory realm the host is part of
> #
> # Backend to store user information in. New installations should
> # use either tdbsam or ldapsam. smbpasswd is available for backwards
> # compatibility. tdbsam requires no further configuration.
> #
> # Use password server option only with security = server or if you can't
> # use the DNS to locate Domain Controllers
> # The argument list may include:
> #   password server = My_PDC_Name [My_BDC_Name] [My_Next_BDC_Name]
> # or to auto-locate the domain controller/s
> #   password server = *
>
>
>       security = domain
> ;       passdb backend = tdbsam
> ;       realm = MY_REALM
>
>       password server = dc1-x4200-f.beilux.eib.org
> dc2-x4200-f.beilux.eib.org  *
>
> # ----------------------- Domain Controller Options ------------------------
> #
> # Security must be set to user for domain controllers
> #
> # Backend to store user information in. New installations should
> # use either tdbsam or ldapsam. smbpasswd is available for backwards
> # compatibility. tdbsam requires no further configuration.
> #
> # Domain Master specifies Samba to be the Domain Master Browser. This
> # allows Samba to collate browse lists between subnets. Don't use this
> # if you already have a Windows NT domain controller doing this job
> #
> # Domain Logons let Samba be a domain logon server for Windows workstations.
> #
> # Logon Scrpit let yuou specify a script to be run at login time on the client
> # You need to provide it in a share called NETLOGON
> #
> # Logon Path let you specify where user profiles are stored (UNC path)
> #
> # Various scripts can be used on a domain controller or stand-alone
> # machine to add or delete corresponding unix accounts
> #
> ;       security = user
> ;       passdb backend = tdbsam
>
> ;       domain master = yes
> ;       domain logons = yes
>
>       # the login script name depends on the machine name
> ;       logon script = %m.bat
>       # the login script name depends on the unix user used
> ;       logon script = %u.bat
> ;       logon path = \\%L\Profiles\%u
>       # disables profiles support by specifing an empty path
> ;       logon path =
>
> ;       add user script = /usr/sbin/useradd "%u" -n -g users
> ;       add group script = /usr/sbin/groupadd "%g"
> ;       add machine script = /usr/sbin/useradd -n -c "Workstation
> (%u)" -M -d /nohome -s /bin/false "%u"
> ;       delete user script = /usr/sbin/userdel "%u"
> ;       delete user from group script = /usr/sbin/userdel "%u" "%g"
> ;       delete group script = /usr/sbin/groupdel "%g"
>
>
> # ----------------------- Browser Control Options ----------------------------
> #
> # set local master to no if you don't want Samba to become a master
> # browser on your network. Otherwise the normal election rules apply
> #
> # OS Level determines the precedence of this server in master browser
> # elections. The default value should be reasonable
> #
> # Preferred Master causes Samba to force a local browser election on startup
> # and gives it a slightly higher chance of winning the election
>       local master = no
> ;       os level = 33
>       preferred master = no
>
> #----------------------------- Name Resolution -------------------------------
> # Windows Internet Name Serving Support Section:
> # Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
> #
> # - WINS Support: Tells the NMBD component of Samba to enable it's WINS Server
> #
> # - WINS Server: Tells the NMBD components of Samba to be a WINS Client
> #
> # - WINS Proxy: Tells Samba to answer name resolution queries on
> #   behalf of a non WINS capable client, for this to work there must be
> #   at least one        WINS Server on the network. The default is NO.
> #
> # DNS Proxy - tells Samba whether or not to try to resolve NetBIOS names
> # via DNS nslookups.
>
> ;       wins support = yes
> ;       wins server = w.x.y.z
> ;       wins proxy = yes
>
> ;       dns proxy = yes
>
> # --------------------------- Printing Options -----------------------------
> #
> # Load Printers let you load automatically the list of printers rather
> # than setting them up individually
> #
> # Cups Options let you pass the cups libs custom options, setting it to raw
> # for example will let you use drivers on your Windows clients
> #
> # Printcap Name let you specify an alternative printcap file
> #
> # You can choose a non default printing system using the Printing option
>
>       load printers = no
>       cups options = raw
>
> ;       printcap name = /etc/printcap
>       #obtain list of printers automatically on SystemV
> ;       printcap name = lpstat
> ;       printing = cups
>
> # --------------------------- Filesystem Options ---------------------------
> #
> # The following options can be uncommented if the filesystem supports
> # Extended Attributes and they are enabled (usually by the mount option
> # user_xattr). Thess options will let the admin store the DOS attributes
> # in an EA and make samba not mess with the permission bits.
> #
> # Note: these options can also be set just per share, setting them in global
> # makes them the default for all shares
>
> ;       map archive = no
> ;       map hidden = no
> ;       map read only = no
> ;       map system = no
> ;       store dos attributes = yes
>
>                  winbind separator = /
>                  winbind cache time = 10
>                  idmap uid = 50000-60000
>                  idmap gid = 50000-60000
>
>
>
> #============================ Share Definitions ==============================
>
> ;[homes]
> ;       comment = Home Directories
> ;       browseable = no
> ;       writable = yes
> ;       valid users = %S
> ;       valid users = MYDOMAIN\%S
>
> ;[printers]
> ;       comment = All Printers
> ;       path = /var/spool/samba
> ;       browseable = no
> ;       guest ok = no
> ;       writable = no
> ;       printable = yes
>
> # Un-comment the following and create the netlogon directory for Domain Logons
> ;       [netlogon]
> ;       comment = Network Logon Service
> ;       path = /var/lib/samba/netlogon
> ;       guest ok = yes
> ;       writable = no
> ;       share modes = no
>
>
> # Un-comment the following to provide a specific roving profile share
> # the default is to use the user's home directory
> ;       [Profiles]
> ;       path = /var/lib/samba/profiles
> ;       browseable = no
> ;       guest ok = yes
>
>
> # A publicly accessible directory, but read only, except for people in
> # the "staff" group
> ;       [public]
> ;       comment = Public Stuff
> ;       path = /home/samba
> ;       public = yes
> ;       writable = yes
> ;       printable = no
> ;       write list = +staff
>
>      [security-portal]
>      comment = security-portal
>      path = /var/www/html/security-portal
>      public = no
>      writable = yes
>      printable = no
>      create mode = 0664
>      directory mode = 0775
>       force user = apache
>      force group = apache
>      valid users = BEILUX/boule
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>