Thanks for the suggestion, but .. that doesn't work ...
chgrp My\ Group /media/share chgrp: invalid group: `My Group' "My Group" is a windows AD group, not a local linux group. The machine is "joined" to the windows domain through "net ads join", but I don't think the security is that tightly integrated. I don't have windows groups mapped to linux groups I've created or anything like that. chgrp is expecting a linux group. Right? Probably I am missing something, or you guys need more information. Any thoughts? -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of steve Sent: Monday, May 21, 2012 11:57 To: [email protected] Subject: Re: [Samba] Grant only one AD group to samba share ? On 05/21/2012 05:20 PM, Newman, John W wrote: > All, > > On my ubuntu linux machine here, I already have samba set up and > configured with winbind to perform authentication against the local windows > domain controller. Thankfully that part is all working fine - that was > supposed to be the hard part. The issue I have now is: I need to grant > members of a certain AD group access to share (this was supposed to be easy, > but is not working) sanity check of winbind (sample output): > $ wbinfo -g > MYDOMAIN\domain admins > MYDOMAIN\domain users > MYDOMAIN\my group > MYDOMAIN\my group2 > Looks good. I need to grant all users in "my group" access to the share, all > others shouldn't even see it. > > [share] > comment = Testing > path = /media/share > guest ok = no > read only = yes > valid users = @"MYDOMAIN\My Group" > browseable = no > locking = no > If I put guest ok = yes, everything works fine. If I turn it to no, I get an > authentication prompt. Answering it with invalid credentials comes back with > "invalid user name or bad password", vs valid credentials says "access > denied". So I know that the authentication with the domain controller is > working fine, but limiting access to that group only is not. > > The group name has a space in it which probably isn't helping. I have tried > many different combinations, but nothing seems to work. What is the proper > syntax for this? We have winbind separator=\ earlier in tthinkhe config file > -- is that part of the problem maybe? > valid users = @"MYDOMAIN\My Group" > valid users = "@MYDOMAIN\My Group" > valid users = "MYDOMAIN\My Group" > etc > nothing seems to work. My methodology for testing this is fine as soon as i > put guest ok =yes, the share still works. What's the right syntax for valid > users= "My Domain\My Group"? Any thoughts? > Thanks, > John Hi You don't really need smb.conf to get group only entry. Just have smb.conf with: [share] comment = Testing path = /media/share read only = No chgrp My\ Group /media/share chmod 0770 /media/share chmod g+s /media/share setfacl -d -Rm g::rw /media/share Now, only members of My Group can get into the share, no matter what you have in smb.conf. Once inside, any files created therein become group rw for My Group members. HTH Steve -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
