Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a few Mac clients connected to a Linux server running Netatalk 3.1.1. The server is connected to an AD domain, the clients are currently not. Previously all users were connecting under a single user account and everything worked relatively well. We attempted to introduce the new concept that every user should have their own account, but we're seeing permissions issues.

The root of the share has some sane ACLs and default ACLs applied which grant the appropriate rights, but OS X thinks everything read-only and forbids writes. On the local Linux machine, or through a Windows machine (speaking SMB to Samba), writing to the folders works as expected.

I attempted changing map acls = none thinking it would report no permissions to the client at all, but the issue persists.

I joined a single 10.9 test client to AD and set the LDAP settings in Netatalk. That client can now see the group names that have write permission (AD\foo-w) and running the group command shows that I am a member of that group. However, the 'Get Info' dialog still shows read-only access and Finder forbids writes.

Does anyone know how I can convince the OS X clients that it can write?

share|improve this question
Is the single user account you are using to autenticate the Macs to the AFP shares local to the linux server or does it exist in the AD? Have you verified that said account has sufficient permissions? – dean May 13 '14 at 23:15
@dean - The account is in AD. The user does have sufficient permissions. I've verified permissions by su'ing to the user on the Linux system itself as well as connecting as that user from a Windows machine via SMB/Samba. – EvilRyry May 14 '14 at 12:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.