I have one more quick question if i may. This one maybe a simple one :) Is there any way to set the sysvol and netlogon shares to be not browseable? i know they are very important, but it would be nice if they were "hidden". I have tried browseable = no but I think samba 4 ignores that :)
On Mon, Jan 24, 2011 at 7:30 PM, Taylor, Jonn <[email protected]>wrote: > Glad I could help. > > > On 01/24/2011 05:38 PM, Lynn Dixon wrote: > > AWESOME!!! That fixed it my friend! Once I corrected my fstab for /share > with acl and user_xattr options, and remounted the filesystem, that worked > perfectly. Mind you I did have to delete the old /share/finance folder > since it was created without the new attributes. Its working perfectly now. > I am able to use the built-in windows file ACL tools to configure perms. > > Thanks again for all your help, I hope I will be able to return the favor > in the future! > > Lynn Dixon > > On Mon, Jan 24, 2011 at 12:44 PM, Taylor, Jonn > <[email protected]>wrote: > >> Make sure that you have these installed. >> >> apt-get install build-essential libattr1-dev libblkid-dev libgnutls-dev >> libreadline5-dev python-dev autoconf python-dnspython gdb pkg-config >> bind9utils libpam0g-dev >> >> >> >> NOTE about filesystem support >> >> To use the advanced features of Samba4 you need a filesystem that supports >> both the "user" and "system" xattr namespaces. >> >> If you run Linux with a 2.6 kernel and ext3 this means you need to include >> the option "user_xattr" in your /etc/fstab. For example: >> >> /dev/hda3 /home ext3 user_xattr 1 1 >> >> You also need to compile your kernel with the XATTR and SECURITY options >> for your filesystem. For ext3 that means you need: >> >> CONFIG_EXT3_FS_XATTR=y >> CONFIG_EXT3_FS_SECURITY=y >> >> If you are running a Linux 2.6 kernel with CONFIG_IKCONFIG_PROC defined >> you can check this with the following command: >> >> $ zgrep CONFIG_EXT3_FS /proc/config.gz >> >> If you don't have a filesystem with xattr support, then you can simulate >> it by using the option: >> >> posix:eadb = /usr/local/samba/eadb.tdb >> >> that will place all extra file attributes (NT ACLs, DOS EAs, streams etc), >> in that tdb. It is not efficient, and doesn't scale well, but at least it >> gives you a choice when you don't have a modern filesystem. >> [edit<http://wiki.samba.org/index.php?title=Samba4/HOWTO&action=edit§ion=18> >> ] >> Testing your filesystem >> >> To test your filesystem support, install the 'attr' package and run the >> following 4 commands as root: >> >> # touch test.txt >> # setfattr -n user.test -v test test.txt >> # setfattr -n security.test -v test2 test.txt >> # getfattr -d test.txt >> # getfattr -n security.test -d test.txt >> >> You should see output like this: >> >> # file: test.txt >> user.test="test" >> >> # file: test.txt >> security.test="test2" >> >> If you get any "Operation not supported" errors then it means your kernel >> is not configured correctly, or your filesystem is not mounted with the >> right options. >> >> If you get any "Operation not permitted" errors then it probably means you >> didn't try the test as root. >> >> If you are using the posix:eadb option then you don't need to test your >> filesystem in this manner. >> Jonn >> >> >> On 01/24/2011 11:20 AM, Lynn Dixon wrote: >> >> Hmmm. Here is what I have for permissions and ACLs on the finance folder: >> >> root@dc:/share# ls -la >> total 28 >> drwxr-xr-x 4 root root 4096 2011-01-24 10:10 . >> drwxr-xr-x 22 root root 4096 2011-01-22 23:56 .. >> drwxrwxrwx 5 root users 4096 2011-01-24 11:53 finance >> drwx------ 2 root root 16384 2011-01-22 21:55 lost+found >> root@dc:/share# getfacl finance/ >> # file: finance/ >> # owner: root >> # group: users >> user::rwx >> group::rwx >> other::rwx >> >> root@dc:/share# >> >> And here is what the parent folder /share looks like: >> drwxr-xr-x 4 root root 4096 2011-01-24 10:10 share >> >> root@dc:/# getfacl share >> # file: share >> # owner: root >> # group: root >> user::rwx >> group::r-x >> other::r-x >> >> >> Just to be safe, here is what /etc/fstab looks like for the /share >> directory: >> # /share was on /dev/sda3 during installation >> UUID=a20cec9c-f3e0-4ab7-b9fe-15071e89b7d6 /share ext4 >> defaults 0 2 >> >> >> do I need to mount it with an ACL argument? >> >> >> >> >> >> >> >> >> >> On Mon, Jan 24, 2011 at 12:12 PM, Taylor, Jonn <[email protected] >> > wrote: >> >>> Check you permissions on the folders. >>> >>> [Mon Jan 24 11:30:24 2011 EST, 0 >>> ../ntvfs/posix/pvfs_acl.c:567:pvfs_access_check_unix()] >>> ../ntvfs/posix/pvfs_acl.c:567 denied access to '/share/finance/.' - >>> wanted 0x010e0000 but got 0xfff3ffff (missing 0x000c0000) >>> [Mon Jan 24 11:30:24 2011 EST, 0 >>> ../ntvfs/posix/pvfs_acl.c:567:pvfs_access_check_unix()] >>> ../ntvfs/posix/pvfs_acl.c:567 denied access to '/share/finance/.' - >>> wanted 0x00040000 but got 0xfef3ffff (missing 0x00040000) >>> [Mon Jan 24 11:30:24 2011 EST, 0 >>> ../ntvfs/posix/pvfs_acl.c:567:pvfs_access_check_unix()] >>> ../ntvfs/posix/pvfs_acl.c:567 denied access to '/share/finance/.' - >>> wanted 0x00080000 but got 0xfef3ffff (missing 0x00080000) >>> [Mon Jan 24 11:31:06 2011 EST, 0 >>> ../ntvfs/posix/pvfs_acl.c:567:pvfs_access_check_unix()] >>> ../ntvfs/posix/pvfs_acl.c:567 denied access to '/share/finance/.' - >>> wanted 0x00060000 but got 0xfef3ffff (missing 0x00040000) >>> [Mon Jan 24 11:31:06 2011 EST, 0 >>> ../ntvfs/posix/pvfs_acl.c:567:pvfs_access_check_unix()] >>> ../ntvfs/posix/pvfs_acl.c:567 denied access to '/share/finance/.' - >>> wanted 0x00060000 but got 0xfef3ffff (missing 0x00040000) >>> [Mon Jan 24 11:32:05 2011 EST, 0 >>> ../dsdb/kcc/kcc_topology.c:3479:kcctpl_test()] >>> Testing kcctpl_create_intersite_connections >>> [Mon Jan 24 11:35:28 2011 EST, 0 >>> ../ntvfs/posix/pvfs_acl.c:567:pvfs_access_check_unix()] >>> ../ntvfs/posix/pvfs_acl.c:567 denied access to '/share/finance/.' - >>> wanted 0x00060000 but got 0xfef3ffff (missing 0x00040000) >>> [Mon Jan 24 11:35:28 2011 EST, 0 >>> ../ntvfs/posix/pvfs_acl.c:567:pvfs_access_check_unix()] >>> ../ntvfs/posix/pvfs_acl.c:567 denied access to '/share/finance/.' - >>> wanted 0x00060000 but got 0xfef3ffff (missing 0x00040000) >>> >>> Jonn >>> >>> >>> On 01/24/2011 11:07 AM, Lynn Dixon wrote: >>> >>> Thanks for the help. I have attached my samba.log. >>> >>> >>> >>> On Mon, Jan 24, 2011 at 11:58 AM, Taylor, Jonn < >>> [email protected]> wrote: >>> >>>> Need to see you samba logs. They are in /usr/local/samba/var/samb.log >>>> by default. Directory owner needs to be root and group should be users or >>>> staff. >>>> >>>> Also make sure that you can set the ACL's from the command prompt. How >>>> to do this is on the wiki. >>>> >>>> Jonn >>>> >>>> >>>> On 01/24/2011 10:50 AM, Lynn Dixon wrote: >>>> >>>> Ok. I tried the following: >>>> Navigate to share, right click --> Properties. Went to "security" tab >>>> then clicked "advanced" >>>> That opened up and I was able to click Add and then add my Finance AD >>>> group. The Finance group even shows up with the selected permissions in the >>>> list of users/groups. BUT, when I click "Apply" all of the changes vanish. >>>> I took some snapshots. Check them at the links: >>>> >>>> Before changes: >>>> http://lh3.ggpht.com/_qETGDInSB7Q/TT2tBxte7uI/AAAAAAAALcw/Mf8kYZxcUxI/s400/finance1.JPG >>>> After adding Finance: >>>> http://lh4.ggpht.com/_qETGDInSB7Q/TT2tCEhe8kI/AAAAAAAALc0/4thnUxi_sBo/s400/finance2.JPG >>>> >>>> But when I click apply, the jenfab\finance group dissappears from the >>>> list and the changes never save. >>>> >>>> I have tried giving 777 perms on the actual directory on my ubuntu box >>>> to troubleshoot, but had same results. I have also verified that ACL >>>> package has been installed on my Ubuntu machine. What user:group do I need >>>> to have the actual directory on the ubuntu machine set to? Any other >>>> things >>>> I should try? >>>> >>>> On Mon, Jan 24, 2011 at 11:02 AM, Taylor, Jonn < >>>> [email protected]> wrote: >>>> >>>>> Go to advanced when changing ACL's. >>>>> >>>>> Jonn >>>>> >>>>> >>>>> On 01/24/2011 09:48 AM, Lynn Dixon wrote: >>>>> >>>>> That was the first thing that I had tried. I created a share using >>>>> smb.conf, then restarted samba. >>>>> I can see the share, and navigate down into it from windows. If I >>>>> create a folder and then rick click from a windows machine and do >>>>> security, >>>>> I can add groups, but when I try to save, the changes just disappear. >>>>> >>>>> What is the best way to manage ACL's on the share from a windows >>>>> machine? >>>>> >>>>> Sorry for all the questions, this is my first venture into a Samba 4 AD >>>>> environment. I have used Samba 2/3 i on a workgroup in the past and used >>>>> different security schemes. >>>>> >>>>> On Mon, Jan 24, 2011 at 10:37 AM, Taylor, Jonn < >>>>> [email protected]> wrote: >>>>> >>>>>> This is all you need. >>>>>> >>>>>> [test] >>>>>> path = /data/test >>>>>> read only = no >>>>>> >>>>>> Then use windows to set the acl's. >>>>>> >>>>>> Jonn >>>>>> >>>>>> http://wiki.samba.org/index.php/Samba4/HOWTO >>>>>> >>>>>> On 01/24/2011 09:24 AM, Lynn Dixon wrote: >>>>>> > Thanks. I tried both paramaters in my smb.conf but I got errors when >>>>>> I tried >>>>>> > both: >>>>>> > >>>>>> > jenfab@dc:~$ sudo /etc/init.d/samba4 restart >>>>>> > * Stopping Samba 4 daemon samba >>>>>> > [ OK ] >>>>>> > * Starting Samba 4 daemon >>>>>> > samba Unknown >>>>>> parameter >>>>>> > encountered: "valid users" >>>>>> > Ignoring unknown parameter "valid users" >>>>>> > >>>>>> [ >>>>>> > OK ] >>>>>> > jenfab@dc:~$ sudo nano /etc/samba/smb.conf >>>>>> > jenfab@dc:~$ sudo /etc/init.d/samba4 restart >>>>>> > * Stopping Samba 4 daemon samba >>>>>> [ >>>>>> > OK ] >>>>>> > * Starting Samba 4 daemon >>>>>> > samba Unknown >>>>>> parameter >>>>>> > encountered: "write list" >>>>>> > Ignoring unknown parameter "write list" >>>>>> > Unknown parameter encountered: "read list" >>>>>> > Ignoring unknown parameter "read list" >>>>>> > >>>>>> [ >>>>>> > OK ] >>>>>> > >>>>>> > >>>>>> > On Mon, Jan 24, 2011 at 9:52 AM, <[email protected]> wrote: >>>>>> > >>>>>> >> >>>>>> >> I am not sure how to use Microsoft AD tools to create shares and >>>>>> then set >>>>>> >> those shares permissable to certain AD groups. For example, I need >>>>>> to >>>>>> >> create >>>>>> >> a share called "Finance" and only the people in Finance can >>>>>> read/write to >>>>>> >> it. I was hoping to use SWAT to help in creation and management of >>>>>> those >>>>>> >> shares. >>>>>> >> >>>>>> >> vi smb.conf (or your favorite text editor) >>>>>> >> >>>>>> >> add >>>>>> >> >>>>>> >> [finance] >>>>>> >> >>>>>> >> ...various parameter... >>>>>> >> valid users = @finance >>>>>> >> >>>>>> >> or >>>>>> >> >>>>>> >> write list = @finance >>>>>> >> read list = @finance >>>>>> >> >>>>>> >> >>>>>> >> >>>>>> >> I have been using AD tools to manage the domain and GPO's but I am >>>>>> not sure >>>>>> >> how to use them to create shares. >>>>>> >> >>>>>> >> You can see swat for samba4 here: >>>>>> https://github.com/rvelhote/GSoC-SWAT >>>>>> >> >>>>>> >> On Mon, Jan 24, 2011 at 5:03 AM, Daniel Müller < >>>>>> [email protected] >>>>>> >>> wrote: >>>>>> >> I thought swat is no longer working!!Just use Microsoft ads tools >>>>>> and you >>>>>> >> are up and running. >>>>>> >> >>>>>> >> ----------------------------------------------- >>>>>> >> EDV Daniel Müller >>>>>> >> >>>>>> >> Leitung EDV >>>>>> >> Tropenklinik Paul-Lechler-Krankenhaus >>>>>> >> Paul-Lechler-Str. 24 >>>>>> >> 72076 Tübingen >>>>>> >> >>>>>> >> Tel.: 07071/206-463, Fax: 07071/206-499 >>>>>> >> eMail: [email protected] >>>>>> >> Internet: http://www.tropenklinik.de >>>>>> >> >>>>>> >> ----------------------------------------------- >>>>>> >> >>>>>> >> -----Ursprüngliche Nachricht----- >>>>>> >> Von: [email protected] [mailto: >>>>>> [email protected]] >>>>>> >> Im >>>>>> >> Auftrag von Lynn Dixon >>>>>> >> Gesendet: Sonntag, 23. Januar 2011 06:39 >>>>>> >> An: [email protected] >>>>>> >> Betreff: [Samba] Trouble installing SWAT on a Samba 4 Alpha 13 >>>>>> build on >>>>>> >> Ubuntu Server >>>>>> >> >>>>>> >> Hello all, >>>>>> >> I have setup a complete domain using Samba 4 on my Ubuntu server 32 >>>>>> bit >>>>>> >> machine. I am using the Alpha 13 build (it was actually in the >>>>>> Ubuntu >>>>>> >> Repos). I am trying to setup swat to make it easier to manage >>>>>> shares. I >>>>>> >> have followed the instructions at >>>>>> https://github.com/rvelhote/GSoC-SWATbut >>>>>> >> I am having a few problems. >>>>>> >> >>>>>> >> When I run ./run I get the following errors: >>>>>> >> jenfab@dc:~/GSoC-SWAT$ sudo ./run >>>>>> >> Starting subprocess with file monitor >>>>>> >> Traceback (most recent call last): >>>>>> >> File "/usr/local/bin/paster", line 9, in <module> >>>>>> >> load_entry_point('PasteScript==1.7.3', 'console_scripts', >>>>>> 'paster')() >>>>>> >> File "/usr/lib/pymodules/python2.6/paste/script/command.py", >>>>>> line 84, in >>>>>> >> run >>>>>> >> invoke(command, command_name, options, args[1:]) >>>>>> >> File "/usr/lib/pymodules/python2.6/paste/script/command.py", >>>>>> line 123, >>>>>> >> in >>>>>> >> invoke >>>>>> >> exit_code = runner.run(args) >>>>>> >> File "/usr/lib/pymodules/python2.6/paste/script/command.py", >>>>>> line 218, >>>>>> >> in >>>>>> >> run >>>>>> >> result = self.command() >>>>>> >> File "/usr/lib/pymodules/python2.6/paste/script/serve.py", line >>>>>> 276, in >>>>>> >> command >>>>>> >> relative_to=base, global_conf=vars) >>>>>> >> File "/usr/lib/pymodules/python2.6/paste/script/serve.py", line >>>>>> 313, in >>>>>> >> loadapp >>>>>> >> **kw) >>>>>> >> File "/usr/lib/pymodules/python2.6/paste/deploy/loadwsgi.py", >>>>>> line 204, >>>>>> >> in >>>>>> >> loadapp >>>>>> >> return loadobj(APP, uri, name=name, **kw) >>>>>> >> File "/usr/lib/pymodules/python2.6/paste/deploy/loadwsgi.py", >>>>>> line 224, >>>>>> >> in >>>>>> >> loadobj >>>>>> >> global_conf=global_conf) >>>>>> >> File "/usr/lib/pymodules/python2.6/paste/deploy/loadwsgi.py", >>>>>> line 248, >>>>>> >> in >>>>>> >> loadcontext >>>>>> >> global_conf=global_conf) >>>>>> >> File "/usr/lib/pymodules/python2.6/paste/deploy/loadwsgi.py", >>>>>> line 278, >>>>>> >> in >>>>>> >> _loadconfig >>>>>> >> return loader.get_context(object_type, name, global_conf) >>>>>> >> File "/usr/lib/pymodules/python2.6/paste/deploy/loadwsgi.py", >>>>>> line 409, >>>>>> >> in >>>>>> >> get_context >>>>>> >> section) >>>>>> >> File "/usr/lib/pymodules/python2.6/paste/deploy/loadwsgi.py", >>>>>> line 431, >>>>>> >> in >>>>>> >> _context_from_use >>>>>> >> object_type, name=use, global_conf=global_conf) >>>>>> >> File "/usr/lib/pymodules/python2.6/paste/deploy/loadwsgi.py", >>>>>> line 361, >>>>>> >> in >>>>>> >> get_context >>>>>> >> global_conf=global_conf) >>>>>> >> File "/usr/lib/pymodules/python2.6/paste/deploy/loadwsgi.py", >>>>>> line 248, >>>>>> >> in >>>>>> >> loadcontext >>>>>> >> global_conf=global_conf) >>>>>> >> File "/usr/lib/pymodules/python2.6/paste/deploy/loadwsgi.py", >>>>>> line 285, >>>>>> >> in >>>>>> >> _loadegg >>>>>> >> return loader.get_context(object_type, name, global_conf) >>>>>> >> File "/usr/lib/pymodules/python2.6/paste/deploy/loadwsgi.py", >>>>>> line 561, >>>>>> >> in >>>>>> >> get_context >>>>>> >> object_type, name=name) >>>>>> >> File "/usr/lib/pymodules/python2.6/paste/deploy/loadwsgi.py", >>>>>> line 587, >>>>>> >> in >>>>>> >> find_egg_entry_point >>>>>> >> possible.append((entry.load(), protocol, entry.name)) >>>>>> >> File "/usr/lib/python2.6/dist-packages/pkg_resources.py", line >>>>>> 1954, in >>>>>> >> load >>>>>> >> entry = __import__(self.module_name, globals(),globals(), >>>>>> >> ['__name__']) >>>>>> >> ImportError: No module named swat.config.middleware >>>>>> >> >>>>>> >> >>>>>> >> Any suggestions as to where to go from here? >>>>>> >> -- >>>>>> >> To unsubscribe from this list go to the following URL and read the >>>>>> >> instructions: https://lists.samba.org/mailman/options/samba >>>>>> >> >>>>>> >> >>>>>> >> -- >>>>>> >> >>>>>> >> To unsubscribe from this list go to the following URL and read the >>>>>> >> instructions: https://lists.samba.org/mailman/options/samba >>>>>> >> >>>>>> >> >>>>>> >> >>>>>> >>>>> >>>>> >>>> >>> >> > -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
