Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite
2

Context

We have a Windows server with an Active Directory domain and a network share.

I have a Linux machine and I want to mount the share.

sudo mount -t cifs //server/share /mnt/share -o user=[act-dir user],domain=[domain],uid=[linux user],gid=[linux group]

It's more or less OK. My Linux user gets mapped to all files on the share and some of the ACL are translated. But I want to go a level further:

  • More than one user is connected to the Linux box
  • Each Linux user has a dedicated Active Directory account
  • I want each Windows owner to be mapped to the corresponding Linux owner if it exists

A solution and the problem

Samba offers the mount option cifsacl which requires to set-up cifs.idmap and winbindd. Both are installed, I've read both man pages and tried to configure them but it does not work. The newly mount command is now:

sudo mount -t cifs //server/share /mnt/share -o user=[act-dir user],domain=[domain],cifsacl

But everything is mapped to root:root, which means the cifs.idmap could not be performed.

Actually, I'm not all surprised because I did not understand where to write the actual mapping so where should I write that Windows userX actually maps to Linux userY? And I'm not sure that the winbindd configuration is correct, what should be the minimum set of parameters and is smbd and/or nmbd require to run? Do I need to open the port in the firewall?

Background infos

Share structure

The shared directory has several sub directories, some commons and some "privates" (although the private ones are actually readable by everyone). Each user would need to access from time to time the common space, and also other user private directories, but mainly/often their own directory.

Tech data

  • RHEL 6, Samba 3.5.6
  • Ubuntu 12.04, Samba 3.6.3
share|improve this question
1  
Can't you have each user map to the Windows share individually, with their own credentials, and let the Windows server manage the access rights? That's how SMB is meant to work, I'm not sure whether what you are trying to do is possible. (Note that there's no technical reason why Samba couldn't do it, I just don't see why they'd bother.) – Harry Johnston May 26 '12 at 23:38
What do you mean by "each user map to Windows share individually"? Do you mean that each user mount the share in their local space? I'm adding some extra infos about the share context in the question to clarify our current status. – Huygens May 29 '12 at 7:13
yes, looking from a Windows perspective, I would expect each user to establish their own connection to the file server, using their own Windows username and password to do so. – Harry Johnston May 30 '12 at 22:34
OK, understood. But think of this share from a Windows client perspective. I can access it from my Windows client and some permissions rules apply, I cannot access or modify every files or directories. I just would like these permissions to be mirrored/mimicked (as far as possible) to the Linux CIFS mount point. – Huygens May 31 '12 at 11:02
1  
The permissions should already apply, albeit based on the user account specified in the mount command rather than on the user accessing the mount point. Anyway, we're getting sidetracked, since this isn't what you're trying to do. Doesn't look like anyone here knows the answer, have you tried the Samba mailing lists? – Harry Johnston May 31 '12 at 12:11
show 1 more comment

1 Answer

up vote 1 down vote accepted

You would probably need to use the username map functionality inside samba (winbind) for the mapping to work so that winbind knows about the AD account for every Linux user. I believe username map can take commands and lists (and some pattern conversions), but it's far easier if the Linux usernames can match the AD usernames, by using pam_winbind for instance. I guess that when the mapping is working you can actually start verifying whether the share is working as well.

share|improve this answer
I've look for a winbind tutorial, but I'm stuck at the "Enter the following command to make the Samba server join the domain, where PDC is the name of your PDC and Administrator is a domain user who has administrative privileges in the domain." I don't have and can't have such privileges. So am I screwed? Is it mandatory that my machine join the domain? – Huygens May 29 '12 at 9:49
Yes it is, for the funtionality you want you need to delegate credentials, which won't be possible without being in the domain afaik. – mycroes May 29 '12 at 12:56
That's a pity... Well I hope someone has another possible answer, or I will have to talk with our IT dept. – Huygens May 30 '12 at 15:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.