0

I have a Samba domain server that houses network shares for AD users. All of the users are created on this server as regular linux users and, as such, are given shell access. I have to remove shell access for the vast majority of these users and I'm thinking of changing the default shell in /etc/passwd from /bin/bash to either /sbin/nologin or /bin/false but will this affect their ability to get to their shares on the server?

1
  • Login shell is unrelated to Samba access. Have you considered joining the domain with the machine, and using sssd (or similar) to authenticate your users directly against AD?
    – Panki
    Jul 12, 2022 at 19:11

1 Answer 1

0

No, giving users a shell like /sbin/nologin or /bin/false won't prevent them from access their samba shares. In fact, it's a pretty common/normal way of doing what you want.

Note, however, that if complex group memberships are important, you're probably better off not having local users or groups for most if not all samba users, but to rely on AD instead - AD supports nested group membership (i.e. a group can be a member of another group). Unix groups don't and can't do that.

(I know this because I once had to write a perl script to extract user and group names for a particular faculty from an AD server and generate local accounts & groups for them...because the Uni I was working for didn't want to install AD's unix extension on their central IT-managed AD server)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .