0

Linux file share setup issues Using Ubuntu 18 LTS, want to use Linux SMB shares at branch offices with AD authentication and file permissions. Client Windows computer is Windows 10 Pro.

Followed information found online.

https://help.ubuntu.com/lts/serverguide/sssd-ad.html

https://help.ubuntu.com/lts/serverguide/samba-ad-integration.html

https://raymii.org/s/tutorials/SAMBA_Share_with_Active_Directory_Login_on_Ubuntu_12.04.html

I am trying to use SSSD for AD join/authentication;Why SSSD over Winbind, "Likewise Open"?

https://rhelblog.redhat.com/2015/04/02/sssd-vs-winbind/

https://blog.netnerds.net/2016/04/joining-ubuntu-to-an-active-directory-domain/

I open Windows Explorer and enter \\servername into the address bar it prompts for credentials. If I enter my AD username and password it says access denied. If I give it a username that exists on the Linux host in the form of .\username then it will allow me to see the share but double-click on the share to see content and it prompts me again for permission and returns the message "\\servername\sharename is not accessible. You might not have permissions to use this network resource".

The local account 'testsmb' is a member of nogroup. File permissions for /srv/samba/share (777): drwxrwxrwx 2 nobody nogroup 4096 Aug 6 17:28 share

# SMB.CONF
[global]
# Change this to the workgroup/NT-domain name your Samba server will part of
  workgroup = DOM
   ...
    client signing = yes
    client use spnego = yes
    kerberos method = secrets and keytab
    security = ads
    realm = DOMAIN.LOCAL
   ...
[share]
    comment = Ubuntu File Server Share
    path = /srv/samba/share
    browsable = yes
    guest ok = yes
    read only = no
    create mask = 0755
     # testsmb is local account on Linux
    valid users = "@DOM\Domain Users",testsmb

# /etc/sssd/conf.d/sssd.conf
[sssd]
services = nss, pam
config_file_version = 2
domains = DOMAIN.LOCAL

[domain/DOMAIN.LOCAL]
lookup_family_order = ipv4_only
krb5_store_password_if_offline = True
id_provider = ad
access_provider = ad
# access_provider = simple
override_homedir = /home/%d/%u
simple_allow_users = joe.schmoe@domain.local,john.doe@domain.local
simple_allow_groups = domain users,
# Uncomment if the AD domain is named differently than the Samba domain
 ad_domain = domain.local

# /etc/nsswitch.conf
passwd:         compat systemd sss
group:          compat systemd sss
shadow:         compat sss
gshadow:        files

hosts:          files dns
networks:       files

protocols:      db files
services:       db files sss
ethers:         db files
rpc:            db files

netgroup:       nis sss
sudoers:        files sss

Thank you, Jesse.

0

The same problem I have faced.In my case I Restarted my client system(windows 10) and then tried to access share,it worked for me.I think it will work for you.

  • I have restarted both server and client. No change. Thanks though. – Jesse Aug 8 '18 at 20:32
0

I had not gotten back to update the thread but I had found a way around. I thought I'd approch it more like we do in Windows. Set the share to allow all but then restrict with file system permissions.

set the share as follows (removing the 'valid users' directive:

[share]
    comment = Ubuntu File Server Share
    path = /srv/samba/share
    browsable = yes
    guest ok = no
    read only = no
    create mask = 0777

Then I was able to access the share and underlying files. I am able to modify the file system permissions from the command line of the server but not via the Windows Explorer GUI. (jesse is my domain account and nobody is a local linux account)

sudo ls -l /srv/samba/share
total 16
-rwxr--r-- 1 jesse domain users 0 Aug 13 11:27 'New Text Document.txt'
d---rwx--- 2 nobody security-test 4096 Aug 13 12:10 Security-Test
-rwxrw-rw- 1 jesse security-test 19 Aug 13 12:07 testFile03.txt
-rwxrwx---+ 1 jesse domain users 316 Aug 13 11:20 testfile2.txt
-rwxrwxr-x 1 nobody nogroup     38 Aug 13 10:40 testfile.txt

sudo ls -l /srv/samba/share/Security-Test/
total 8
----rwx--- 1 nobody security-test 21 Aug 13 11:06 anotherTest.txt
-rwxrw-rw- 1 jesse domain users 0 Aug 13 11:35 newTest02.txt
-rwxrw-rw- 1 jesse domain users 0 Aug 13 11:33 'New Text Document1.txt'
-rwxrw-rw- 1 jesse security-test 21 Aug 13 12:04 testFile03.txt
-rwxrw-rw- 1 jesse security-test 0 Aug 13 12:10 testFile04.txt

It seems that Samba cannot see AD accounts but the Linux system can. Regards, Jesse.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.