Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Debian 6 system running Samba 3.5.6 that has been successfully set up to authenticate against an Active Directory domain (via SSH that is). I have a directory (let's call it /foo) that I want to be editable by both local users and AD users. I have created a local group "fooedit" and added both the local users and domain users to it. I have set up the neccessary ACLs on /foo to allow fooedit users to edit the files and tested it to be functioning via SSH for both the local and AD users.

I would like the AD users to be able to edit via share as well, but can't seem to get the right configuration. They can see the share, but it prompts them for credentials when trying to access it and credentials don't work. Is this possible and if so what do I need to do it? I don't want to do this with an AD group if possible because I may need to do this on many machines with different users on each machine, so a local group would be cleaner.

smb.conf:

[foo]
path = /foo
writeable = yes
browseable = yes
valid users = @fooedit

getfacl /foo:

# file: foo
# owner: bar
# group: fooedit
# flags: -s-
user::rwx
group::rwx
mask::rwx
other::---
default:user::rwx
default:group::rwx
default:other::---

/etc/group:

...
fooedit:x:69:adsuser
...

... and go!

share|improve this question
    
Did you found a solution ? I'm also in such trouble, and googled nothing useful. Currently, I'm adding AD/domain user(s) to both samba share write list (write list = DOMAIN\account1,DOMAIN\account2 ...) and ACL entries of the directory for sharing (setfacl -m user:account1:rwx dir && setfacl -m user:account2:rwx dir ...). It's working, but seems too boring. –  LiuYan 刘研 Aug 23 '12 at 15:37

1 Answer 1

You will have to set up winbind and nss_winbind in order to be able to refer to Windows users in /etc/group.

See https://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/winbind.html

share|improve this answer
    
winbind is set up, I can log in via SSH using domain users and group permissions with domain users appear to be working properly in a shell. It's just accessing samba shares that ignores /etc/group domain users. –  fwrawx Mar 6 '12 at 23:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.