I have successfully installed CentOS and joined it to a Windows 2003 Active Directory Domain with Winbind and Samba. We are moving one of our file servers over to CentOS. One of the things I am having trouble figuring out is assigning permissions to file shares.
In case you are curious as to how I set this up, I followed this tutorial: http://www.linuxmail.info/active-directory-integration-samba-centos-5/
To give an example, say we have a share called "Shared", which we want the "Domain Users" group to be able to access and write to. Now say we have a folder inside of that share called "Secret". We only want the "Secret Agents" group to be able to read and write to that folder. It should become clear that restricting access to a subfolder of a Samba share is either impossible or difficult to set up, which is what got me into looking at using POSIX ACLs.
My first question is: Is this a good way to go about setting this up? Your first thought may be to break the "Secret" folder out onto its own share, but since in real life, we have lots and lots of subfolders inside shares with different sets of permissions, giving each differing folder its own share would become a nightmare.
My second question is: If using POSIX ACL's is a good way, then would the ACL's be left intact if files and folders were backed up and restored. Would they also be left intact if say, the server blows up and we restored those files and folders to another server?
I don't know a whole lot about POSIX ACL's. I just learned about them today. So if there are any potential problems or "catches" that you think I should know about, please include those too.
Thanks for your time