My samba server was running CentOS 5.6 32bit and samba 3.0.33. I upgraded the OS to CentOS 6.3 64bit and samba 3.5.10. After the upgrade I replaced /etc/passwd (& shadow), /etc/group and /etc/samba/smb.conf.
Before the upgrade, users were authenticating against an AD server, then having their folder access managed by POSIX groups. Each user would have a POSIX user in /etc/passwd corresponding to their domain username, and folder group permissions would be set by creating groups in /etc/group and assigning secondary group membership to the local users.
Since the upgrade, samba authenticates correctly, obeys any 'valid users' directives which reference POSIX secondary groups, grants access to folders restricted by primary group, and world readable folders, but denies access to folders that users should be able to access via secondary group membership. I've tested with security mode set to both ADS and DOMAIN.
Output of testparm:
[global] workgroup = MYDOMAIN server string = Fileserver interfaces = 127.0.0.1, 192.168.101.3 bind interfaces only = Yes security = DOMAIN log level = 3 log file = /var/log/samba/%m.log max log size = 1024 smb ports = 139 unix extensions = No deadtime = 15 load printers = No printcap name = /dev/null hosts allow = 127., 192.168.101.0/24 [homes] comment = Home Directories path = /home/%u valid users = MYDOMAIN\%S read only = No inherit permissions = Yes browseable = No [projects] comment = share for projects -access to top level folders by /etc/group with sgid bit set path = /share/projects write list = +projects read only = No acl group control = Yes create mask = 0774 inherit permissions = Yes inherit owner = Yes
Is it possible to get the functionality I want with Samba 3.5? if so, what needs to change?
EDIT: Further info...
The log files show the following:
string_to_sid: Sid +groupname does not start with 'S-'.
string_to_sid: Sid @groupname does not start with 'S-'.
string_to_sid: Sid MYDOMAIN\username does not start with 'S-'.
When searching for this error, I see that it gets raised a lot but answered seldom, and even then the only fixes seem to be 'upgrade samba' or other 'cross your fingers' stuff (apologies for my inadequate google-fu if the answer is out there and I missed it). I'll look into upgrading, but any actual insight into the problem would still be extremely welcome.