Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an Ubuntu 10.04.4 LTS server running Samba, and joined to our Active Directory domain using PBIS (formerly likewise-open.) Samba is configured to do authentication using AD users/groups, and this is working correctly. Also, standard Linux permissions (user, group, others) world properly with Samba. BUT, Samba seems to totally ignore any permissions set with extended ACLs.

I have tried various smb.conf configurations I have seen recommended elsewhere, and none of them seem to have any effect.

Machine Setup:

  • Files share is on it's own drive. Mount info from /etc/fstab for the drive is:
    • UUID=372aa637-4b7b-45cc-8340-9d028893c196 /media/news-drive ext4 user_xattr,acl 0 2
  • Machine is joined to domain using PBIS (formerly likewise-open)
  • Samba config for the share is:
[shared]
   comment = , 
   nt acl support = yes
   admin users = 
   force user = 
   force group = \domain^users
   create mask = 0770
   directory mask = 0770
  • Global Samba Config
workgroup = 
dns proxy = no
server string = 
load printers = no
cups options = raw
guest account = pcguest
log file = /var/log/samba/%m.log
max log size = 50
security = ADS
realm = 
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
interfaces = 172.16.0.20 10.4.1.20 127.0.0.1
bind interfaces only = yes
idmap uid = 16777216-33554431
idmap gid = 16777216-33554431
map to guest = Bad User
  • I have also used some of these in the global config, without success
idmap backend = idmap_rid:=16777216-33554431
nt acl support = yes
inherit acls = Yes
map acl inherit = Yes
map archive = no
map hidden = no
map read only = no
map system = no
store dos attributes = yes
inherit permissions = Yes
template shell = /bin/false
winbind use default domain = no

What am I missing here, to get Samba to work with the extended ACLs?

An Example of What is Happening

I have a folder in a samba share. The share itself is wide open within our domain (the "valid users" setting is set to the "Domain Users" group for the AD domain.) Within that share, I have a folder with more restrictive permissions at the file system level (owned by one AD user, with the group set to an AD group with just a few people in it and permissions chmod-ed to 770)

The issue is, I need to give access to that folder to another AD group, so I run "setfacl -m u::rwx " to give them permission to access it. This works within Linux (if I ssh in which one of those users and navigate to the folder)...but if I connect to the SMB share with that same user, and try and navigate to that folder, access is denied.

share|improve this question
    
hmmm....I really don't see a specific question here. –  mdpc Dec 19 '12 at 21:45
    
Sorry, I thought the "what am I doing wrong" was implied. :) –  woodsbw Dec 19 '12 at 22:05
    
I guess I still don't understand the specific problem. A specific example might help everybody to understand your problem. Do you want Samba to map NTFS permission to the underlying Linux ACLs assigned for the windows user to see/use? –  mdpc Dec 19 '12 at 22:06
    
Added to question –  woodsbw Dec 19 '12 at 22:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.