[Samba] Domain Member Server (wheezy) - Unable to edit permissions of share without usermapping - shall I add to Wiki?

[Rowland Penny]

On 04/03/15 18:31, Shane Robinson wrote:
> Hello again Rowland, list!
>
> Sorry for the delayed response, and top posting.
>
> To recap:
> I'd like to complete the member server wiki so that ACLs can be set from
> windows without taking undocumented steps.
>
> The three ways I've found to do this are:
>
> 1) map root to administrator. (LPH VanBelle's script uses this option.)

This is the way that I have be using for some time, it works, but is it 
the best way ?
You are making the windows Administrator have exactly the same powers 
that 'root' has, do you want/need to do this ?

>
> 2) chmod 0775 then chgrp "<DOMAIN>\Domain Admins" /srv/share

This is a better way, you are only giving members of Domain Admins the 
rights to the directory and remember that Administrator is a member of 
Domain Admins.

>
> 3) chown -R "<DOMAIN>\Administrator" /srv/share

This would mean that you would have to give Administrator a different ID 
other than '0'.

I am now leaning towards a mixture of 2 & 3

>
> I'm leaning towards 2, but would like a better idea of pros and cons so I
> may complete the wiki.
>
> Rowland: From your last response, I was searching for how the ID_TYPE_BOTH
> relates to the above, and found a recent thread between yourself and Andrew
> (Samba4,idmap.ldb & ID_TYPE_BOTH), last posted to on Feb24. The differences
> you point out W.R.T. sysvol appear to relate more to that thread.

You are correct that the thread was all about sysvol, but you seem to be 
missing the point. If there wasn't 'ID_TYPE_BOTH' then getfacl would 
work better, a windows group would show up as only a group, not as it is 
now, showing as a group and a user!
The same goes for windows users.

Rowland

>   
>
> If those differences are important to my current issue, I apologize for
> being obtuse, but would you mind explaining?
>
> Otherwise, List, please let me know which of the above options you prefer
> and why. I will then document them to the best of my knowledge on the wiki.
>
> Thank you kindly,
>