[Samba] Secondary Unix Groups

[Samuel Taylor Liston]

Rowland,
	Thanks for replying.  We bind to our campus AD for samba auth.  For auth to the server otherwise we are using sssd.  
	Users are able to mount the share.  In this space ‘other’ perms are removed and if the users’ primary group is not the group owning the directory they cannot access it.  This lack of permission only occurs when accessing through a samba mount.  If the user tries to access this same directory directly one the server they can access them through having secondary group membership.
	I have included my global.smb.conf and one example of a share in smb.conf
 
global.smb.conf
[global]
        workgroup = AD
        server string = CottonWood (%L) Server
	netbios name = chpcvip01
        security = ADS
        passdb backend = tdbsam
	allow trusted domains = no
        encrypt passwords = yes
        realm = AD.UTAH.EDU
        local master = no
        preferred master = no
        wins support = no
        wins proxy = no
        dns proxy = no
        load printers = no
        printcap name = /dev/null
        disable spoolss = yes
        lanman auth = yes
        client plaintext auth = yes
        client lanman auth = yes
	restrict anonymous = 2
	log level = 3
	syslog = 3

smb.conf
[global]
        log file = /var/log/samba/%m-ctdb.log
        encrypt passwords = yes
        include = /etc/samba/global.smb.conf
[chpc-group1]
       comment = chpc-group1 cw10-3 share
       # Hide the secret cluster files
       veto files = /.clumanager/.rgmanager/
       browsable = yes
       writable = yes
       path = /mnt/chpc-group1
       create mask = 0644
       directory mask = 0755
       guest ok = no
       nt acl support = yes
       
Sam Liston (sam.liston at utah.edu)
==========================================
Center for High Performance Computing - Univ. of Utah
155 S. 1452 E. Rm 405
Salt Lake City, Utah 84112 (801)232-6932
==========================================



> On Mar 9, 2021, at 3:20 PM, Rowland penny via samba <samba at lists.samba.org> wrote:
> 
> On 09/03/2021 21:47, Samuel Taylor Liston via samba wrote:
>> This may be a topic already covered somewhere, but I’m not finding much from Google searches.  Sometime between version 4.7.1-6 and 4.10.4-11 were secondary unix groups no longer respected by samba?  Looked through the man page, but didn’t find much by way of configuration options to enable this.  Hoping to find a way to have secondary unix groups respected.
>> Thanks,
> 
> 
> We need more context to really comment on this, how are you running Samba ? As a Unix domain member, a DC, or something else ?
> 
> What I can say is, your user must have logged in before you can rely on a true list of of groups the user is a member of.
> 
> Rowland
> 
> 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba