1

I am using Samba version 4.6.16-git.124.aee309c5c183.32.1-SUSE-SLE_12-x86_64, and the server is member of a Windows AD domain.

We have a couple of jobs using shares on the Linux machine and have been using dedicated users for those so far. We would like to change this and use Managed Service Accounts (MSA) for the jobs now.

The problem I have is that the MSA account cannot access the share, while the dedicated user account can. When I check log.smbd I can see that the MSA account is being successfully authorized and password-checked, however it gets an "ACCESS_DENIED" when trying to access the share. Both the user and the MSA account are members of the same group in AD which was allowed to access the share.

Is this a general issue / does Samba not play well with MSA accounts, or is there something I can tweak in smb.conf to make the share usable?

=> The domain controller is a Windows Server, the Linux system is a domain member.

=> I want that a MSA account e.g. "MSA-ETLJOB$" accesses a samba share on the Linux system. The account is member of a group which is granted access to the share. I can also verify that by checking the groups with the groups command "groups MSA-ETLJOB$"

=> in log.smbd I can see that "MSA-ETLJOB$" gets successfully authenticated, however when it then tries to access the share / chdir, it says "ACCESS_DENIED".

==> why can't "MSA-ETLJOB$" access the directory? Can I make that work somehow? ==> or is there a general issue with MSA-accounts and Samba?

closed as unclear what you're asking by Rui F Ribeiro, Christopher, Mr Shunz, peterph, Thomas Jan 25 at 10:42

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Relevant log file entries, and ideally the global and share-specific parts of your smb.conf (filtered to remove boilerplate blank lines and comments), would be helpful. – roaima Jan 25 at 13:53
  • You've got my reopen vote and yet another from somebody, probably your question will get a reopen, good luck! – peterh Jan 25 at 15:32