1

I have a SAMBA server with ROLE_DOMAIN_MEMBER in Active Directory. My main aim is to make a different permissions on share sub-folders on very single share. It can be done using Linux acl or Windows permissions GUI. But I prefere a Windows GUI. In this case users can do this by themselves.

I'm already tried to change permissions using chmod,chown,acl, windows gui, windows consol gui. And I can change permissions to sub-folder but it seems thatit doesn't work and only groups added to samba-share worked for me and also for sub-folders

valid users = "+DOMAIN.LOCAL\IT" # "+DOMAIN.LOCAL\adm" # "+DOMAIN.LOCAL\DR" # "DOMAIN.LOCAL\PRINTERS"
admin users = "+DOMAIN.LOCAL\IT" # "+DOMAIN.LOCAL\adm" # "+DOMAIN.LOCAL\DR" # "DOMAIN.LOCAL\PRINTERS"

I print here all my smb.cfg and a single test share:

[global]
# No .tld
workgroup = DOMAIN
netbios name = samba4
server string = %h server (Samba, Ubuntu)
# Active Directory System
security = ads
# With .tld
realm = DOMAIN.LOCAL
# Just a member server
domain master = no
local master = no
preferred master = no
dns proxy = no
# Disable printing error log messages when CUPS is not installed.
printcap name = /dev/null
load printers = no
printcap cache time = 0
#additional section
obey pam restrictions = yes
map to guest = bad user
dns proxy = no
vfs objects = acl_xattr
map acl inherit = yes
nt acl support = yes
acl map full control = yes
#acl compatibility = auto
store dos attributes = yes
map archive = no
map hidden = no
map read only = no
map system = no
# Works both in samba 3.2 and 3.6.
#idmap backend = tdb
# no .tld
idmap config * : backend = tdb
idmap config * : range = 10000-99999
winbind enum users = yes
winbind enum groups = yes
# This way users log in with username instead of username@example.com
winbind use default domain = yes
# Inherit groups in groups
winbind nested groups = yes
winbind refresh tickets = yes
winbind offline logon = true
#winbind separator = \
# Becomes /home/example/username
template homedir = /home/%D/%U
#logon drive = H:
#logon home = \\smb\%U
# No shell access
template shell = /bin/bash
client use spnego = yes
client ntlmv2 auth = yes
#password server = dc01.domain.local, dc02.domain.local
password server = *
encrypt passwords = yes
unix password sync = yes
pam password change = yes
smb passwd file = /etc/samba/smbpasswd
os level = 20
restrict anonymous = 2
log file = /var/log/samba/samba.log
log level = 3
#logging = syslog@1 /var/log/samba/log.%m
vfs objects = full_audit
full_audit:success = mkdir rmdir unlink pwrite
full_audit:prefix = %u|%I|%m|%S
full_audit:failure = none
full_audit:facility = local5
full_audit:priority = notice
recycle:repository = /home/recycle/
recycle:keeptree = yes
recycle:versions = yes
max log size = 100000
panic action = /usr/share/samba/panic-action %d
guest ok = yes

[test$]
        path = /FS/test$
        browseable = yes
        read only = no
        inherit acls = yes
        inherit permissions = yes
        create mask = 700
        directory mask = 700
        valid users = "+DOMAIN.LOCAL\IT" # "+DOMAIN.LOCAL\adm" # "+DOMAIN.LOCAL\DR" # "DOMAIN.LOCAL\PRINTERS"
        admin users = "+DOMAIN.LOCAL\IT" # "+DOMAIN.LOCAL\adm" # "+DOMAIN.LOCAL\DR" # "DOMAIN.LOCAL\PRINTERS"



┌─[root@samba4]─[/FS]
└──╼ #ls -ld test\$/
drwxrwx---+ 6 root root 4096 Jun 25 15:44 test$/

ACL configuration:

cat /boot/config-4.4.0-87-generic  | grep _ACL
CONFIG_EXT4_FS_POSIX_ACL=y
CONFIG_REISERFS_FS_POSIX_ACL=y
CONFIG_JFS_POSIX_ACL=y
CONFIG_XFS_POSIX_ACL=y
CONFIG_BTRFS_FS_POSIX_ACL=y
CONFIG_F2FS_FS_POSIX_ACL=y
CONFIG_FS_POSIX_ACL=y
CONFIG_TMPFS_POSIX_ACL=y
CONFIG_HFSPLUS_FS_POSIX_ACL=y
CONFIG_JFFS2_FS_POSIX_ACL=y
CONFIG_NFS_V3_ACL=y
CONFIG_NFSD_V2_ACL=y
CONFIG_NFSD_V3_ACL=y
CONFIG_NFS_ACL_SUPPORT=m
CONFIG_CEPH_FS_POSIX_ACL=y
CONFIG_CIFS_ACL=y
CONFIG_9P_FS_POSIX_ACL=y

My fstab:

UUID=4ec48dfe-c45d-124b-8145-09fe59cfad9b /FS ext4 relatime,acl,user_xattr,errors=remount-ro 0 1

In samba.log I see a problem with acl permission while I try to change permission to test directory

set_nt_acl: failed to set file acl on file test (Operation not permitted).

Also I change permission on test directory to 777 and delete options "create mask", "directory mask", "admin users". Now I can't even add new user to file permission

  • Have you tried what you're wanting to do? At a quick glance it seems that there's nothing wrong. Please edit your question to explain what you've tried and what did - or didn't - work when you tried it. – roaima Jun 26 '18 at 8:30
  • #ls -ld test\$/ drwxrwx---+ 6 root root 4096 Jun 25 15:44 test$/ – Vladyslav Greyswandir Jun 26 '18 at 9:48
  • Also I edit my post – Vladyslav Greyswandir Jun 26 '18 at 9:49
  • Ok, I add ls output in the bottom of the code section – Vladyslav Greyswandir Jun 26 '18 at 9:56
0

If you wanting to use Windows permissions you need to remove the UNIX/Linux permission controls that override them.

chmod 777 '/FS/test$'

Remove these lines from your share definition:

create mask = 700
directory mask = 700
admin users = ...
  • Thank you for answer, but after many tests, this not worked for my case – Vladyslav Greyswandir Jul 10 '18 at 7:33
  • @VladyslavGreyswandir still what didn't work? What did you try? What results did you get? What do the logs say? – roaima Jul 10 '18 at 7:53
  • Sorry for waiting. I have the same problem as described in post. I change permission on test directory to 777 and delete options "create mask", "directory mask", "admin users". Now I can't even add new user to file permission. I think that some directive can block this feature, but I don't know which. I reed a lot about all directives specified in my configure file but still no progress in this case . Also I try change folder permissions only from Windows explorer – Vladyslav Greyswandir Jul 17 '18 at 8:52
  • @VladyslavGreyswandir how are you mounting the share? – roaima Jul 17 '18 at 10:19
  • I use AD GPO or smb4k(for linux) or simple create Windows shortcut with all available shares inside – Vladyslav Greyswandir Jul 17 '18 at 10:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.