3

I'm running Samba 3.4.7 with Likewise Open 6.0.0.8388 on Ubuntu 10.04 Server x64. This server is joined to a domain (functional level 2003) run by 2008R2 domain controllers. In a Windows server, I can grant permission for a folder and/or share to a computer account (represented by computername$). This allows services/processes running under the SYSTEM account to access these network shares. I'm trying to grant the same permissions on my Linux server but no matter what I do I cannot add a computer account to the ACL. setfacl doesn't recognize the user, and when adding it through the Windows permission dialog it just disappears after hitting apply. Is this possible with Samba?

0
+100

Unfortunately permissions to a share cannot be granted to a computer account; only users. Yes, it looks like you should be able to do that, and the OS allows you to make the entry, but it doesn't actually work like you'd expect.

One way to get around this is, for instance if you're running a script as a scheduled task, is to mount network drive as a specific user who has access to that share, like so:

net use * \\server\share /user:DOMAIN\username

this will use the first-available drive letter (starting at Z: and going backward from XP/2003 on, but starting at the beginning in Win2k).

You can also specify a drive letter as long as it's not in use:

net use u: \\server\share /user:DOMAIN\username

When complete, don't forget to unmount the share with:

net use u: /d

(Note that you can of course test for the presense of the drive's use, or just drop the mount before mounting it, but I leave that to you.)

  • Unfortunately this is for a backup job running on SQL Server 2005. The service is running as local system (I know I know, bad practice - I'm trying to decommission it but it's taking a bit) so I can't mount a network drive prior to the job running.. – Dan Sep 2 '11 at 17:36
  • What is controlling the SQL backup? You could wrap that up into a batch job, or even better, run the backup locally and later copy it off to a share by script later. That would be better because it wouldn't have a connection open longer than needed, and even if the copy failed, you'd still have the local backup. – gWaldo Sep 3 '11 at 13:49
  • These two links should help migrate SQL to a service account: msdn.microsoft.com/en-us/library/ms143504.aspx and support.microsoft.com/kb/283811 – gWaldo Sep 5 '11 at 23:06
  • While not necessarily the solution I was hoping for, a two-hop backup would suffice until we can decommission this server. Thanks for the suggestion. – Dan Sep 7 '11 at 18:21
0

If it is not possible, try adding the computer account to a security group, and set an ACL to confer access to that security group.

  • I gave it a shot but unfortunately no dice :( [2011/09/02 13:30:47, 1] smbd/sesssetup.c:464(reply_spnego_kerberos) Username DOMAIN\COMPUTER$ is invalid on this system – Dan Sep 2 '11 at 17:32
0

Create Security Group in AD with containing these computers in it

run this command on Linux server

setfacl -R -m default:group:"hypervservers":rwx /Share1/

also don't forget to put in /etc/samba/smb.conf

[Share] ....

    inherit permissions = yes
    inherit owner = yes
    inherit acls = yes
    nt acl support = yes

Hope this will help!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.