Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Ubuntu 12.04 server with samba 4.0.6 and netatalk 3.0.4. Samba is DC and fileserver. All with ACL and ext4 with acl filesystem. I managed to get the ubuntu server to join the domain with centrifydc trough changing the hostname in /etc/hostname

Seems like ACL is complicated in an mixed environment. I have therefore not got it to work as it should (OS X with AFP don't read ACL as windows and don't get write permissions to files and folders).

I guess the easiest solution would be to just skip ACL and use unix filegroups. But how do I do that on samba 4?

I have removed acl (from linux terminal) and got AFP connections to work as I will, but then I dont' get access with smb (seems like samba 4 just recognizes ACL?).

share|improve this question
up vote 3 down vote accepted

You could try whether "map acls = mode" in afp.conf helps with AFP permissions when dealing with ACLS.

share|improve this answer
Thanks! Not found time to try it yet, but I will. Unfortunately limited functionality of winbind 4 keeps us from using AFP on same server as samba 4. – Henrik Ormåsen Jul 2 '13 at 12:25
Did this. Also I will mention that the ugly "hack" to get join AD with Centirfy DC broke after some days. I'm now using winbind 4 (…), and it seems like it is all working now. – Henrik Ormåsen Jul 31 '13 at 8:37

Use Samba3 for the file server and use Samba4 only as an AD DC?

share|improve this answer
On same server? I've found out that winbind 4 has limited functionality, so probably the best solution would have been to have 2 servers. In this case we probably will be stuck with smb until winbind 4 gets better. – Henrik Ormåsen Jul 2 '13 at 12:28
I think having 2 servers may make life a little easier for you. – leftcase Jul 8 '13 at 14:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.