0

Here's the set-up:

I have a server running Samba with a share called "MyShare". MyShare contains a folder that, on the Server's file system is owned by user "User1" and Group "Employees". The folder and it's files are 770 and 660 respectively. Owner and group read/write, no world access.

The Share definition is:

[MyShare]
comment = MyShare
path = /home/samba/Shares/MyShare
browsable = yes
guest ok = yes
read only = no
force group = +Employees
inherit permissions = yes

On the Server, User1, User2, User3, etc. are all members of the "Employees" group. The theory is that any member of the group can work on any file owned by the group regardless of owner (who created it).

On the Clients, the UIDs are arbitrary (they don't match the server UIDs) and the "Employees" group does not exist.

When I ssh into the Server as "User2", I can see and read/write all of the files (even though User1 is the owner) because I'm a member of the "Employees" group, the files and folder are group-owned by "Employees", and the files and folders are group read/writeable. This is as expected.

The problem comes when accessing this share through Samba from an Ubuntu Client machine.

I mount the share with /etc/fstab as:

//192.168.1.100/MyShare        /media/samba/MyShare   cifs
   noperm,credentials=/root/smb/creds,rw,iocharset=utf8,uid=1000 0 0

It mounts OK, but it treats me as if I am not a member of the "Employees" group. In other words, I can access files I own (user2), but not "Employees" group owned files, since it doesn't think I'm a member of the "Employees" group.

How do I get Samba to acknowledge User2's membership of the "Employees" group?

Improve this question

1 Answer 1

Reset to default
0

Have you added an appropriate group mapping for the arbitrary groups on the client machines?

Improve this answer
3
  • I created a matching group ID on the local machine and added the local user to it. No change though. It doesn't seem like local group membership should mater though, since security should be handled by the server and not the client. Otherwise, anyone could just add themselves to the "accountants" group locally and have access to all the financial files on the server.
    – Nick
    Aug 22, 2011 at 2:56
  • If I add myself to a local group that happens to have the same name as a group on another machine, that's entirely arbitrary unless there is some other mechanism keeping UIDs and GIDs in sync. Take a look at samba.org/samba/docs/man/manpages-3/smb.conf.5.html for a more detailed explanation of how SAMBA authenticates.
    – tagram
    Aug 23, 2011 at 14:25
  • I've done a lot of reading on that page, but it doesn't tell you which combinations of options to use in which circumstances. I've played with many of those options, and having failed to get it to do what I want, I am now asking this as a question.
    – Nick
    Aug 25, 2011 at 6:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.