LinuxQuestions.org
Did you know LQ has a Linux Hardware Compatibility List?
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 05-01-2006, 05:55 PM   #1
srosa
LQ Newbie
 
Registered: May 2006
Location: Dallas TX
Distribution: Debian
Posts: 7

Rep: Reputation: 0
Samba domain member server (DMS) group permissions in network with a Samba PDC


Background:

About 18 months ago, we successfully replaced our w2k server running active directory with a linux server (debian-woody, now sarge) running samba (3.0.14) to serve as our PDC. We are a small shop with less than 10 WinXP clients authenticating against the PDC. The server provides home directories for each user and a couple of shares. We are using /etc/passwd for the passdb backend.

Challenge:

As simply as possible, we want to migrate all the samba shares from the samba PDC to a samba domain member server that has more storage than the existing PDC. We want to continue to authenticate against the existing PDC with the unix user and group credentials getting passed through to the domain member server to control access to the samba shares on the domain member server.

Approach:

I followed the instructions in section 7.3.2 in Samba-3 by Example to add a samba domain member server using NSS and Winbind, which can be found here: my.samba.org/samba/docs/man/Samba-Guide/unixclients.html

Also, I looked at:
us2.samba.org/samba/docs/man/Samba-HOWTO-Collection/FastStart.html
us4.samba.org/samba/docs/man/Samba-HOWTO-Collection/FastStart.html

To test my setup, I created one share on the new member server with the same name as one of the shares to be migrated from the PDC.

From the command line on the member server, when I touched a file and tried to change the owner to one of the users from the PDC, it worked.

However, from the command line on the member server, when I tried to change the group to a group on the PDC, it failed.

Problem:

-From my WinXP clients, I can modify and save the existing file, but I cannot create any new folders or files. The share is setup with 775 permissions.

-How do I get the PDC to pass through group permissions to the member server?

-Given that we do not have a w2k server providing any authentication and we do not use windows groups to control access to resources or shares, should I even be using samba at all on the domain member server? I assumed that if I wanted to provide visibility to WinXP clients that I needed to.

Configuration for Domain Member Server:

-winbind is running on the domain member server only
-nscd is not installed, so it is not running
-have not set a password for wbinfo yet

nsswitch.conf
passwd: files winbind
group: files winbind
shadow: files winbind
hosts: files dns winbind
networks: files dns
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis


smb.conf
[global]
workgroup = myworkgroup
netbios name = dms1
security = domain
encrypt passwords = yes
;username map = /etc/samba/smbusers
log level = 2
syslog = 0
log file = /var/log/samba/log.%m
max log size = 10000
smb ports = 139
name resolve order = wins bcast hosts
wins server = 192.168.168.10
password server = fileserver0
os level = 245
idmap uid = 10000-20000
idmap gid = 10000-20000
template primary group = "Domain Users"
template shell = /bin/bash
;winbind separator =
allow hosts = 192.168.168. 192.168.3.
winbind enum users = yes
winbind enum groups = yes
winbind use default domain = yes

[homes]
comment = Home Directories
browseable = yes
writeable = yes
invalid users =
create mode = 700
directory mode = 700
hide dot files = no

[pub]
comment = Public share
browseable = yes
writeable = yes
invalid users =
create mode = 775
directory mode = 775
path = /home/pub
follow symlinks = no

net groupmap list | sort
Account Operators (S-1-5-32-548) -> -1
Administrators (S-1-5-32-544) -> -1
Backup Operators (S-1-5-32-551) -> -1
Domain Admins (S-1-5-21-2085308812-1240886966-3975267953-512) -> -1
Domain Admins (S-1-5-21-3011377730-1923039063-3553163437-512) -> -1
Domain Admins (S-1-5-21-3674331429-3500157320-2370650088-512) -> -1
Domain Admins (S-1-5-21-443014615-1857750776-3794749928-512) -> -1
Domain Guests (S-1-5-21-2085308812-1240886966-3975267953-514) -> -1
Domain Guests (S-1-5-21-3674331429-3500157320-2370650088-514) -> -1
Domain Guests (S-1-5-21-443014615-1857750776-3794749928-514) -> -1
Domain Users (S-1-5-21-2085308812-1240886966-3975267953-513) -> -1
Domain Users (S-1-5-21-3011377730-1923039063-3553163437-513) -> -1
Domain Users (S-1-5-21-3674331429-3500157320-2370650088-513) -> -1
Domain Users (S-1-5-21-443014615-1857750776-3794749928-513) -> -1
Guests (S-1-5-32-546) -> -1
Power Users (S-1-5-32-547) -> -1
Print Operators (S-1-5-32-550) -> -1
Replicators (S-1-5-32-552) -> -1
System Operators (S-1-5-32-549) -> -1
Users (S-1-5-32-545) -> -1
 
  


Reply

Tags
domain, group, member, pdc, permissions, samba, server


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Samba as PDC with Debian : domain network path not found DigitAlex Linux - Networking 7 12-15-2006 05:42 PM
samba 3 problem - samba PDC can not join to the domain ananthak Linux - Networking 1 05-21-2006 10:39 AM
Samba 3.0.21a and Samba Domain Member Servers in a Windows 2003 ADS Domain ramz Linux - Networking 3 04-09-2006 08:26 PM
Samba PDC and Domain Memeber paul_mat Linux - Networking 1 09-19-2005 01:32 AM
Resource thread? SAMBA 3 member server in the Win2k Domain huntz Linux - Software 0 04-30-2004 09:10 PM


All times are GMT -5. The time now is 07:00 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration