2

I have a SAMBA server with ROLE_DOMAIN_MEMBER in Active Directory. My main aim is to make a different permissions on share sub-folders on very single share. It can be done using Linux acl or Windows permissions GUI. But I prefere a Windows GUI. In this case users can do this by themselves.

I'm already tried to change permissions using chmod,chown,acl, windows gui, windows consol gui. And I can change permissions to sub-folder but it seems thatit doesn't work and only groups added to samba-share worked for me and also for sub-folders

valid users = "+DOMAIN.LOCAL\IT" # "+DOMAIN.LOCAL\adm" # "+DOMAIN.LOCAL\DR" # "DOMAIN.LOCAL\PRINTERS"
admin users = "+DOMAIN.LOCAL\IT" # "+DOMAIN.LOCAL\adm" # "+DOMAIN.LOCAL\DR" # "DOMAIN.LOCAL\PRINTERS"

I print here all my smb.cfg and a single test share:

[global]
# No .tld
workgroup = DOMAIN
netbios name = samba4
server string = %h server (Samba, Ubuntu)
# Active Directory System
security = ads
# With .tld
realm = DOMAIN.LOCAL
# Just a member server
domain master = no
local master = no
preferred master = no
dns proxy = no
# Disable printing error log messages when CUPS is not installed.
printcap name = /dev/null
load printers = no
printcap cache time = 0
#additional section
obey pam restrictions = yes
map to guest = bad user
dns proxy = no
vfs objects = acl_xattr
map acl inherit = yes
nt acl support = yes
acl map full control = yes
#acl compatibility = auto
store dos attributes = yes
map archive = no
map hidden = no
map read only = no
map system = no
# Works both in samba 3.2 and 3.6.
#idmap backend = tdb
# no .tld
idmap config * : backend = tdb
idmap config * : range = 10000-99999
winbind enum users = yes
winbind enum groups = yes
# This way users log in with username instead of [email protected]
winbind use default domain = yes
# Inherit groups in groups
winbind nested groups = yes
winbind refresh tickets = yes
winbind offline logon = true
#winbind separator = \
# Becomes /home/example/username
template homedir = /home/%D/%U
#logon drive = H:
#logon home = \\smb\%U
# No shell access
template shell = /bin/bash
client use spnego = yes
client ntlmv2 auth = yes
#password server = dc01.domain.local, dc02.domain.local
password server = *
encrypt passwords = yes
unix password sync = yes
pam password change = yes
smb passwd file = /etc/samba/smbpasswd
os level = 20
restrict anonymous = 2
log file = /var/log/samba/samba.log
log level = 3
#logging = syslog@1 /var/log/samba/log.%m
vfs objects = full_audit
full_audit:success = mkdir rmdir unlink pwrite
full_audit:prefix = %u|%I|%m|%S
full_audit:failure = none
full_audit:facility = local5
full_audit:priority = notice
recycle:repository = /home/recycle/
recycle:keeptree = yes
recycle:versions = yes
max log size = 100000
panic action = /usr/share/samba/panic-action %d
guest ok = yes

[test$]
        path = /FS/test$
        browseable = yes
        read only = no
        inherit acls = yes
        inherit permissions = yes
        create mask = 700
        directory mask = 700
        valid users = "+DOMAIN.LOCAL\IT" # "+DOMAIN.LOCAL\adm" # "+DOMAIN.LOCAL\DR" # "DOMAIN.LOCAL\PRINTERS"
        admin users = "+DOMAIN.LOCAL\IT" # "+DOMAIN.LOCAL\adm" # "+DOMAIN.LOCAL\DR" # "DOMAIN.LOCAL\PRINTERS"



┌─[root@samba4]─[/FS]
└──╼ #ls -ld test\$/
drwxrwx---+ 6 root root 4096 Jun 25 15:44 test$/

ACL configuration:

cat /boot/config-4.4.0-87-generic  | grep _ACL
CONFIG_EXT4_FS_POSIX_ACL=y
CONFIG_REISERFS_FS_POSIX_ACL=y
CONFIG_JFS_POSIX_ACL=y
CONFIG_XFS_POSIX_ACL=y
CONFIG_BTRFS_FS_POSIX_ACL=y
CONFIG_F2FS_FS_POSIX_ACL=y
CONFIG_FS_POSIX_ACL=y
CONFIG_TMPFS_POSIX_ACL=y
CONFIG_HFSPLUS_FS_POSIX_ACL=y
CONFIG_JFFS2_FS_POSIX_ACL=y
CONFIG_NFS_V3_ACL=y
CONFIG_NFSD_V2_ACL=y
CONFIG_NFSD_V3_ACL=y
CONFIG_NFS_ACL_SUPPORT=m
CONFIG_CEPH_FS_POSIX_ACL=y
CONFIG_CIFS_ACL=y
CONFIG_9P_FS_POSIX_ACL=y

My fstab:

UUID=4ec48dfe-c45d-124b-8145-09fe59cfad9b /FS ext4 relatime,acl,user_xattr,errors=remount-ro 0 1

In samba.log I see a problem with acl permission while I try to change permission to test directory

set_nt_acl: failed to set file acl on file test (Operation not permitted).

Also I change permission on test directory to 777 and delete options "create mask", "directory mask", "admin users". Now I can't even add new user to file permission

4
  • Have you tried what you're wanting to do? At a quick glance it seems that there's nothing wrong. Please edit your question to explain what you've tried and what did - or didn't - work when you tried it.
    – Chris Davies
    Jun 26, 2018 at 8:30
  • #ls -ld test\$/ drwxrwx---+ 6 root root 4096 Jun 25 15:44 test$/
    – Vladyslav Greyswandir
    Jun 26, 2018 at 9:48
  • Also I edit my post
    – Vladyslav Greyswandir
    Jun 26, 2018 at 9:49
  • Ok, I add ls output in the bottom of the code section
    – Vladyslav Greyswandir
    Jun 26, 2018 at 9:56

1 Answer 1

Reset to default
0

If you wanting to use Windows permissions you need to remove the UNIX/Linux permission controls that override them.

chmod 777 '/FS/test$'

Remove these lines from your share definition:

create mask = 700
directory mask = 700
admin users = ...
7
  • Thank you for answer, but after many tests, this not worked for my case
    – Vladyslav Greyswandir
    Jul 10, 2018 at 7:33
  • @VladyslavGreyswandir still what didn't work? What did you try? What results did you get? What do the logs say?
    – Chris Davies
    Jul 10, 2018 at 7:53
  • Sorry for waiting. I have the same problem as described in post. I change permission on test directory to 777 and delete options "create mask", "directory mask", "admin users". Now I can't even add new user to file permission. I think that some directive can block this feature, but I don't know which. I reed a lot about all directives specified in my configure file but still no progress in this case . Also I try change folder permissions only from Windows explorer
    – Vladyslav Greyswandir
    Jul 17, 2018 at 8:52
  • @VladyslavGreyswandir how are you mounting the share?
    – Chris Davies
    Jul 17, 2018 at 10:19
  • I use AD GPO or smb4k(for linux) or simple create Windows shortcut with all available shares inside
    – Vladyslav Greyswandir
    Jul 17, 2018 at 10:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .