I have a Samba server based on Ubuntu 18.04, accessed by Windows 10 machines. There are several regular users and one admin user in the office. Since I want to keep the folder structure and prevent users from accidentally deleting or moving folders, the permission of the root folder is set to 750
, so that only the owner (admin user) can change the directory structure.
This worked as long as the Samba server was running standalone (Ubuntu 16.04). I recently upgraded to 18.04 and now the Samba server is running as primary domain controller (PDC), which means that the extended attributes (acl_xattr
) are enabled by default and cannot be disabled.
Since the migration to Samba as PDC with forced acl_xattr
, something weird happens: Regular users still cannot create folders, this has to be done by the admin user. However, regular users can delete folders, even though the access rights of the parent folder is still set correctly to 750
:
drwxr-x--- 30 admin_user user_group 4096 Jan 2 11:45 data
I am quite puzzled, since with these access rights, it should not be possible to delete anything from within this folder, except for admin_user
and root
. I suspect Samba to somehow overriding the missing write access when trying to delete things, but I failed in debugging this. What am I missing?
PS: Here is the definition of the share in my smb.conf
[Data]
comment = Data
path = /srv/data
browseable = yes
writeable = yes
create mask = 0770
directory mask = 0770
force create mode = 0770
force directory mode = 0770
force group = user_group
hide files = /?esktop.ini/?umbs.db/
guest ok = no
wide links = yes
Update 2020-01-05:
Here is the [global]
part of my smb.conf
. The setup was done with Zentyal.
[global]
workgroup = company
realm = COMPANY.LAN
netbios name = server_name
server string = Zentyal Server
server role = dc
server role check:inhibit = yes
server services = -dns
server signing = auto
dsdb:schema update allowed = yes
ldap server require strong auth = no
drs:max object sync = 1200
idmap_ldb:use rfc2307 = yes
winbind enum users = yes
winbind enum groups = yes
template shell = /bin/bash
template homedir = /home/%U
rpc server dynamic port range = 49152-65535
interfaces = lo,eth0
bind interfaces only = yes
map to guest = Bad User
unix extensions = no