Hi Again
[netlogon]
path = /shared/%G/netlogon
Yes! Great idea!
Thank you Michael.
First, it works :)
Thanks to Michael for his idea, it's simple and easy to setup. I don't
know why sometimes we're getting in some crazy and complicated ideas and
we don't think just simple! Here is some explainations about our setup
and how to allow different default profile per group.
1. Directories structure :
We have this :
/home/netlogon/
group1/Default User/
group1/foo.bat
group1/bar.bat
group2/Default User/
group2/toto.bat
group3/Default User/
[..]
profiles/default/
profiles/special_profileA/
[..]
We put all our profiles in the profiles/ directory. And all Default
User/ in each groupN directory is a link to the choosen profile
contained in the profiles/ directory. For example, "group1" have a
"default/" profile.
/home/netlogon/group1# ls -l
total 4
lrwxrwxrwx 1 root root 19 2008-02-19 15:01 Default User ->
../profiles/default
-rw-rw-rw- 1 root root 97 2008-02-19 16:17 foo.bat
[..]
And "group2" will have a "special_profileA"
/home/netlogon/group2# ls -l
total 4
lrwxrwxrwx 1 root root 19 2008-02-19 15:01 Default User ->
../profiles/special_profileA
-rw-rw-rw- 1 root root 97 2008-02-19 16:17 toto.bat
[..]
Why ? Because it's easier to manage. Real profile files are only in one
directory and we do not duplicate profiles and waste space. Of course,
you can put your real profile without linked it, it's up to you :)
2. smb.conf setup
Quite simple :
logon script = %U.bat
logon path = \\%h\profiles\%G\%U
logon drive = U:
logon home = \\%h\homes\%G\%U
[netlogon]
path = /home/netlogon/%G
root preexec = /usr/local/bin/disallowdoublelog.sh %u %I %L %G
read only = yes
public = no
writeable = no
browseable = no
The only thing I have to changed between my Default User/ for everyone
to the support of one Default User _per_ group is :
path = /home/netlogon
to
path = /home/netlogon/%G
Extracted from man smb.conf:
%U : session username (the username that the client wanted, not
necessarily the same as the one they got).
%G : primary group name of %U.
Example:
The user 'foo' is a member of 'group1' so its netlogon path will be
/home/netlogon/group1 (%G) and his generated batch file will be, in my
case generated by /usr/local/bin/disallowdoublelog.sh,
/home/netlogon/group1/foo.bat.
Remember, your batch file must be in the netlogon path of the user
otherwise the user will never find his batchfile and it will not be
executed.
That's all ! It takes approximatively 5min to configure and 25min to
finely test the final config. And 10min to understand why the batch file
was in wrong place, I have forgotten how the batch file is done ;) Shame
on me, I haven't touch our samba servers since one year :)
As a bonus, I will join my script to detect tries of multiple login on
different PCs. It's a quick & dirty script to disconnect the second user
or more trying to use an already connected user. If the student is kind
it will works just fine, but if not, there is a workaround. I will let
you this as an exercice :) Imagine that some of my script kiddies are
reading here, I don't want to help them to find the solution even if I
will happy for them if they find it :)
Again, thank you michael to point out this great solution.
A+
Thomas
---
#!/bin/sh
# Arg => $1= login (user)
# $2= IP ADDRESS
# $3= netbios samba's name
# $4= group of the user
# 09/02/5 - Tom v1.0
NETLOGON="/home/netlogon"
LOG=/var/log/samba/auth/err-`date "+%d%m%y"`.log
DATE=`date +"%H:%M:%S %d/%m/%y"`
FILE="$NETLOGON/$4/$1.bat"
echo "@ECHO OFF" > $FILE
NBCNX=`/usr/bin/smbstatus -p -u $1 2>/dev/null |grep $1 |wc -l`
if [[ $NBCNX > 1 ]]
then
echo "$DATE => double login from $1 with $2 [DEBUG] $NBCNX" >> $LOG
echo "logoff" >> $FILE
fi
echo "NET USE V: \\\\${3}\foo /PERSISTENT:NO" >> $FILE
echo "NET USE W: \\\\${3}\bar /PERSISTENT:NO" >> $FILE
---
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
