I have a Debian 6 system running Samba 3.5.6 that has been successfully set up to authenticate against an Active Directory domain (via SSH that is). I have a directory (let's call it /foo) that I want to be editable by both local users and AD users. I have created a local group "fooedit" and added both the local users and domain users to it. I have set up the neccessary ACLs on /foo to allow fooedit users to edit the files and tested it to be functioning via SSH for both the local and AD users.

I would like the AD users to be able to edit via share as well, but can't seem to get the right configuration. They can see the share, but it prompts them for credentials when trying to access it and credentials don't work. Is this possible and if so what do I need to do it? I don't want to do this with an AD group if possible because I may need to do this on many machines with different users on each machine, so a local group would be cleaner.


path = /foo
writeable = yes
browseable = yes
valid users = @fooedit

getfacl /foo:

# file: foo
# owner: bar
# group: fooedit
# flags: -s-



... and go!

  • Did you found a solution ? I'm also in such trouble, and googled nothing useful. Currently, I'm adding AD/domain user(s) to both samba share write list (write list = DOMAIN\account1,DOMAIN\account2 ...) and ACL entries of the directory for sharing (setfacl -m user:account1:rwx dir && setfacl -m user:account2:rwx dir ...). It's working, but seems too boring. Aug 23, 2012 at 15:37

1 Answer 1


You will have to set up winbind and nss_winbind in order to be able to refer to Windows users in /etc/group.

See https://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/winbind.html

  • winbind is set up, I can log in via SSH using domain users and group permissions with domain users appear to be working properly in a shell. It's just accessing samba shares that ignores /etc/group domain users.
    – fwrawx
    Mar 6, 2012 at 23:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.