We use a combination of Samba and WinBind to allow AD logins on an Ubuntu 12.04 machine. We also use Samba as a file server. We do not want Samba file shares to work for AD logins, but only local logins we specify. Currently, when an AD user tries to view files over Samba, they can see everything in our one share. When they try to write changes, they are denied, however. This is issue number one.
Issue number two is that we have a local user on the box that has the same name as an AD user and seemingly when it logs in to the Samba share, it's using the AD account and is unable to write changes to the filesystem instead of logging in as the local user.
Here is my smb.conf:
[global] workgroup = DOMAIN server string = t-u12-dev1 netbios name = t-u12-dev1 dns proxy = no password server = domainserver.com realm = DOMAIN.COM local master = no log file = /var/log/samba/log.%m max log size = 1000 syslog = 0 panic action = /usr/share/samba/panic-action %d wtmp directory = /var/log utmp = yes utmp directory = /var/run security = ads client ntlmv2 auth = yes ntlm auth = no guest account = nobody restrict anonymous = 2 idmap backend = tdb idmap uid = 16777216-33554431 idmap gid = 16777216-33554431 idmap config AD:backend = rid idmap config AD:range = 100000-999999 template shell = /bin/bash template homedir = /home/%D/%U winbind separator = + winbind use default domain = yes winbind offline logon = true winbind enum users = no winbind enum groups = no winbind refresh tickets = true smb ports = 445 socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 load printers = no [sites] writeable = yes path = /sites comment = $HOSTNAME browseable = yes guest ok = no
If I do a
sudo pdbedit -L -v, I only see the one local account that I want to be able to access the Samba file share.
What can I change so that my AD logins keep working, but are not used for Samba file share authentication?