Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running Samba 3.4.7 with Likewise Open 6.0.0.8388 on Ubuntu 10.04 Server x64. This server is joined to a domain (functional level 2003) run by 2008R2 domain controllers. In a Windows server, I can grant permission for a folder and/or share to a computer account (represented by computername$). This allows services/processes running under the SYSTEM account to access these network shares. I'm trying to grant the same permissions on my Linux server but no matter what I do I cannot add a computer account to the ACL. setfacl doesn't recognize the user, and when adding it through the Windows permission dialog it just disappears after hitting apply. Is this possible with Samba?

share|improve this question

2 Answers 2

up vote 0 down vote accepted
+100

Unfortunately permissions to a share cannot be granted to a computer account; only users. Yes, it looks like you should be able to do that, and the OS allows you to make the entry, but it doesn't actually work like you'd expect.

One way to get around this is, for instance if you're running a script as a scheduled task, is to mount network drive as a specific user who has access to that share, like so:

net use * \\server\share /user:DOMAIN\username

this will use the first-available drive letter (starting at Z: and going backward from XP/2003 on, but starting at the beginning in Win2k).

You can also specify a drive letter as long as it's not in use:

net use u: \\server\share /user:DOMAIN\username

When complete, don't forget to unmount the share with:

net use u: /d

(Note that you can of course test for the presense of the drive's use, or just drop the mount before mounting it, but I leave that to you.)

share|improve this answer
    
Unfortunately this is for a backup job running on SQL Server 2005. The service is running as local system (I know I know, bad practice - I'm trying to decommission it but it's taking a bit) so I can't mount a network drive prior to the job running.. –  Dan Sep 2 '11 at 17:36
    
What is controlling the SQL backup? You could wrap that up into a batch job, or even better, run the backup locally and later copy it off to a share by script later. That would be better because it wouldn't have a connection open longer than needed, and even if the copy failed, you'd still have the local backup. –  gWaldo Sep 3 '11 at 13:49
    
These two links should help migrate SQL to a service account: msdn.microsoft.com/en-us/library/ms143504.aspx and support.microsoft.com/kb/283811 –  gWaldo Sep 5 '11 at 23:06
    
While not necessarily the solution I was hoping for, a two-hop backup would suffice until we can decommission this server. Thanks for the suggestion. –  Dan Sep 7 '11 at 18:21

If it is not possible, try adding the computer account to a security group, and set an ACL to confer access to that security group.

share|improve this answer
    
I gave it a shot but unfortunately no dice :( [2011/09/02 13:30:47, 1] smbd/sesssetup.c:464(reply_spnego_kerberos) Username DOMAIN\COMPUTER$ is invalid on this system –  Dan Sep 2 '11 at 17:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.