You're using
mount -t cifs //data/Shared /mnt/Shared -o uid=1000,gid=1000,user=<my_windows_account_name>,dom=<my_domain>,pass=
What this tells the local system is two-fold:
- Authenticate to to the remote server with the credentials specified as the tuple { user, domain, password }
- Fake all accesses to/from the remote share as if they are from the user account with UID 1000 and GID 1000
You need to continue using #1, although I would strongly recommend that you move the user credentials into a secure file that can be read only by root and the local user representing the account credentials. See man mount.cifs
for the details
# As root...
cat >/usr/local/etc/Shared.cifs <<'X'
username=my_windows_account_name
domain=my_domain
password=my_windows_password
X
chmod u=rw,go= /usr/local/etc/Shared.cifs
chown my_unix_account_name:root /usr/local/etc/Shared.cifs
# Then mount becomes
mount -t cifs //data/Shared /mnt/Shared -o credentials=/usr/local/etc/Share.cifs,noperm
However, you need to stop using #2 and instead have your local client understand the names used within the AD context. That's too much for here, but the essentials are these
- Install
realmd
and the samba
dependencies
- Ensure your DNS servers are the AD domain servers (or local equivalents)
- Run
realm discover
to find and check that you can see the correct AD domain
- Run
realm join {domain}
to join to the domain
You will probably now want to deny logins from other AD users to your local system. The commands to review are variations of realm deny -all
and realm permit --groups 'domain admins'
, along with AllowUsers
and AllowGroups
in /etc/ssh/sshd_config
. If you're not a Domain Admin you'll need to change this accordingly. The man pages are quite good.
You can test that the join was successful with commands such as these
net ads testjoin
getent password my_windows_account_name # As above
getent group "domain admins" # An example group that will exist
uid
override in there. Also, is your Linux system joined to the AD domain that manages the CIFS server? Could it be?uid
override. Added the full command to the question. No, my linux system is not in the AD domain. What does it require to join it to the domain?