I've configured samba 3.6.3 to use AD on my ubuntu box. The configuration seems to be correct, commands like getent group, getent passwd return groups and users from AD. I can grant AD user permissions on folders and using sudo that user has access. However, when going through samba the user has no access to the folder. Here's some test code. First just testing winbind and the linux permissions:
sudo mkdir /tmp/test sudo chown root:sambashare /tmp/test sudo chmod 775 /tmp/test sudo usermod -G sambashare DOM+user1 sudo -u DOM+user2 touch /tmp/test/file touch: cannot touch `test/file': Permission denied #good because DOM+user2 is not in sambashare group sudo -u DOM+user1 touch /tmp/test/file #success! ls -l /tmp/test -rw-r--r-- 1 DOM+user1 DOM+domain users 0 Jan 14 16:53 test/file
Now configuring samba share
[Test] path = /tmp/test writable = yes follow symlinks = yes valid users = DOM+user1,@sambashare
The directory is visible to the user. But creating new directory or file is not allowed.
If I change linux permissions:
chown DOM+user1 /tmp/test
I can write to the samba share from windows. Note that I haven't added a write list to samba or anything else, just the user ownership on that share in linux. And linux was allowing the user to write to that folder before based on group permissions.
I've tried opening the share from Windows 7 box, and Ubuntu box via Go -> Open Location -> smb:// . Same issue. So I don't think it's windows.
Anyone know what's going on?
I'm trying to group domain users by local groups and allow access to certain shares, so I don't have to bother AD admins to create custom groups. Also I want to use filesystem permissions instead of samba write lists. It's cleaner and samba is not the only service.
Mapping a domain group to a local linux group isn't what I'm trying to achieve.
So for example locally I create local dev_team1, dev_team2 groups. Add DOM+sally to dev_team1 and DOM+john to dev_team2, then set filesystem permissions using ACL.
I thought this configuration was possible because winbind is mapping domain groups/users to a range specified by samba:
idmap config * : backend = tdb idmap config * : range = 20000-999999
And when you execute getent group; getent passwd you get a list of domain groups/users with ID > 20,000. So based on that I assumed samba authenticates the user, assigns them one of the ids, and it doesn't matter if ID 20,000 is in a local group 500, or part of domain group 21,000.