0

It is a bit complex scenario so I will try to make this a simple as possible for you.

ENVIRONMENT

I have a shared filesystem on Linux which I export on Windows using Samba4 and users which belong to multiple groups. Authentication is maintained using Active Directory and mapping between Linux and Windows is achieved using Winbind(Samba package).

PROBLEM

The thing is that I was asked to introduce some sort of security & restrictions on both sides for certain groups of users, to prevent users from looking at each others work.

POSSIBLE SOLUTION

I am able to that using extended ACLs in Linux which will be mapped in Windows (hopefully & somewhat accurately by Samba).

ISSUES ASSOCIATED

Lets say that a user which belongs to both groupsA(primary group) and groupB. He/she would like to access files which are restricted to groupB only. Is that even possible since groupB is not his primary group?

OTHER SOLUTIONS

I was thinking if there is another solution to this. Using extended ACLs for such a massive filesystem will be a pain (if not impossible) to maintain, so I am trying to come up with a more efficient solution.

Any kind of suggestions, help, links etc would be appreciated.

2
  • I'm not sure - I think - that should be comment, but I haven't enough reputation... I have same like this (samba+ext acl). IMHO key is project of your groups. In my organization groups are atomic and role-based. For ex. "product one marketing boss","product one marketing salesman","product two marketing boss". If user need to have access for many resources - then he/she belongs to many groups/roles. If many groups need to use one folder, all of them are listed in this folder permissions. It is pain only while projecting directory structure and permission-tree structure, maybe - writing some sc
    – Mikrobi
    Feb 10, 2015 at 8:19
  • Thanks for the response @Mikrobi but maintaining this solution is my issue. Is there an 'easy' way to maintain the directory/permission tree structure? I know how to add and remove ACLs manually, but this will become very inefficient after some time when the directory tree keeps expanding. Also, how well does Samba work with Windows permissions and ACLs?
    – koullislp
    Feb 12, 2015 at 15:14

0

You must log in to answer this question.