Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We use a combination of Samba and WinBind to allow AD logins on an Ubuntu 12.04 machine. We also use Samba as a file server. We do not want Samba file shares to work for AD logins, but only local logins we specify. Currently, when an AD user tries to view files over Samba, they can see everything in our one share. When they try to write changes, they are denied, however. This is issue number one.

Issue number two is that we have a local user on the box that has the same name as an AD user and seemingly when it logs in to the Samba share, it's using the AD account and is unable to write changes to the filesystem instead of logging in as the local user.

Here is my smb.conf:

[global]
   workgroup = DOMAIN
   server string = t-u12-dev1
   netbios name = t-u12-dev1
   dns proxy = no
   password server = domainserver.com
   realm = DOMAIN.COM
   local master = no
   log file = /var/log/samba/log.%m
   max log size = 1000
   syslog = 0
   panic action = /usr/share/samba/panic-action %d
   wtmp directory = /var/log
   utmp = yes
   utmp directory = /var/run
   security = ads
   client ntlmv2 auth = yes
   ntlm auth = no
   guest account = nobody
   restrict anonymous = 2
   idmap backend = tdb
   idmap uid = 16777216-33554431
   idmap gid = 16777216-33554431
   idmap config AD:backend = rid
   idmap config AD:range = 100000-999999
   template shell = /bin/bash
   template homedir = /home/%D/%U
   winbind separator = +
   winbind use default domain = yes
   winbind offline logon = true
   winbind enum users = no
   winbind enum groups = no
   winbind refresh tickets = true
   smb ports = 445
   socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
   load printers = no

[sites]
   writeable = yes
   path = /sites
   comment = $HOSTNAME
   browseable = yes
   guest ok = no

If I do a sudo pdbedit -L -v, I only see the one local account that I want to be able to access the Samba file share.

What can I change so that my AD logins keep working, but are not used for Samba file share authentication?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

If you don't want AD logins to be used for anything Samba related, can you change your Samba security mode to "user" or even "share" level permissions? That way you can leverage your built-in accounts for Samba but keep the AD stuff for logins. Or maybe I misunderstood what you where asking.

I have local accounts on my servers, but I also use AD for Samba. What I end up doing is blocking the shares down to group level with the AD permissions by using these parameters on the shares:

valid users = "+AD\Group Name"
force group = "+AD\Group Name"

That way other users can't even browse the contents of the shares. It seems to honor nested groups too so we can mage AD groups be members of other groups and that way be very granular in what we open up to the users.

share|improve this answer
    
This is not what I meant. My AD users are somehow becoming Samba users without me doing anything. I would expect to have to run smbpasswd before allowing them access to shares. –  tubaguy50035 Jul 16 at 16:13
    
Not sure about that, since comparing your smb.conf file to the ones I use you have it set for AD authentication. But on the share part you don't limit to any particular group or user. So any authenticated AD user would have access to the share. I don't think smbpasswd factors in at all. I know I don't use it on servers that are have samba security set to AD. I have others to "share" security where I do have to create smb accounts and set smbpasswd for all of them. But not for the AD ones. At least that is how it works on my RHEL/Ubuntu boxes. –  noeldiaz Jul 16 at 20:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.