[Samba] Nested groups and machine account share access

Marko Cupać marko.cupac at mimar.rs
Fri Sep 30 11:44:57 UTC 2022


I have a share which is to be used for exporting mailboxes from
exchange server to .pst files:

  path        = /zfspool01/smb/pstexport
  read only   = no
  vfs objects = zfsacl acl_xattr
  acl_xattr:ignore system acls = yes
  map acl inherit = yes
  inherit owner = yes

This share has the following ACL ("MYDOMAIN\samba admins" have full
permissions, "MYDOMAIN\samba_pstexport_rw" have modify permissions):

# file: /zfspool01/smb/pstexport
# owner: MYDOMAIN\samba admins
# group: MYDOMAIN\samba admins
group:MYDOMAIN\samba admins:rwxpDdaARWcCo-:fd-----:allow

User accounts which are members of "MYDOMAIN\samba_pstexport_rw"
group can access share, create, modify and delete files and folders
inside of it.

Now, this share should also be accessible by "MYDOMAIN\exchange
trusted subsystem" group, as described here:


If I add "MYDOMAIN\exchange trusted subsystem" group into
"MYDOMAIN\samba_pstexport_rw" group and attempt an export, it does not
succeed. I get message in exchange:

Unable to open PST file '\\MYSAMBASERVER\pstexport\test.pst'.
Error details: Access to the path '\\MYSAMBASERVER\pstexport\test.pst'
is denied.

In log.smbd I see the following:

[2022/09/30 13:09:12.744930,  0]
chdir_current_service: vfs_ChDir(/zfspool01/smb/pstexport) failed:
Permission denied. Current token: uid=2022741, gid=2000515, 10 groups:
2022741 2000515 2005132 2010718 2005123 2005124 2005125 1000003 1000004

However, if I grant "MYDOMAIN\exchange trusted subsystem" group modify
right directly on the share, so it becomes:

# file: /zfspool01/smb/pstexport
# owner: MYDOMAIN\samba admins
# group: MYDOMAIN\samba admins
group:MYDOMAIN\exchange trusted subsystem:rwxp-daARWc---:fd-----:allow
group:MYDOMAIN\samba admins:rwxpDdaARWcCo-:fd-----:allow

...export succeeds.

It appears that exchange server is authenticating with machine account:

me at mybox:~ % getent passwd 2022741

Is there a way to make this work by means of nested group membership?

Thank you in advance,
Before enlightenment - chop wood, draw water.
After  enlightenment - chop wood, draw water.

Marko Cupać

More information about the samba mailing list