samba - Apr 2020 - Windows Clients are given access to parent directories of the path configured as a Share path

Hi Group,

Mentioned below is the share configuration added to smb.conf.

Windows clients are given access to all directories along the path
"/containers/rda-nas/BackupRoot/Cores/XXX"  from "/" instead
of directory XXX alone as the share's root directory.

In NFS if we export a path, clients will never be known of parent directories
along the export path.

Why in samba, clients are given access to all directories along the configured
share path?

Could anyone point out what configuration would disallow access to
folders(/directories) along the configured share path?
[rda-nas]
   path = /containers/rda-nas/BackupRoot/Cores/XXX
   browseable = no
   read only = no
   writable = yes
   include = /XXX/samba/rda-nas.inc
   force unknown acl user = yes
   ea support = yes
   strict sync = yes
   store dos attributes = yes
   follow symlinks = no
   mangled names = no
   nt acl support = yes
   smb encrypt = no
   oplocks = no
   level2 oplocks = no
   strict locking = no
   vfs object = streams_depot acl_xattr ocafs
   acl_xattr:ignore hashes = yes
   public = yes


Thanks,
Neelakantan K.

On 05/04/2020 11:00, Neelakantan Kannappa (nkannapp) via samba
wrote:
> Hi Group,
>
> Mentioned below is the share configuration added to smb.conf.
>
What version of Samba are you using ?

And on what OS ?

Can you also post your entire smb.conf, this will undoubtedly have a 
bearing.

Rowland

On 05/04/2020 13:14, Neelakantan Kannappa (nkannapp)
wrote:
> Hi Rowland,
>
> Here are the details.
>
> Samba Version String:
> [root at XXX ~]# /XXX/samba/usr/sbin/smbd --version
> Version 4.7.3
> [root at XXX ~]#
>
> Operating System: Red Hat Enterprise Linux Server release 7.5 (Maipo)
OK, there are several default lines and several lines where I went 
'why?', but what I do not see is any 'idmap config' lines. Now
this
either means you have a borked smb.conf or you are using sssd. If the 
latter is the case, then you need to ask on the sssd-users mailing list, 
this is because that is what is doing your authentication.

You should also be aware that once you hit Samba >= 4.8.0, you cannot 
use sssd with Samba.

Rowland

On 06/04/2020 06:12, Neelakantan Kannappa (nkannapp)
wrote:
> Thanks for the response Rowland. Will look into your suggestions.
>
> Rowland/Group,
>
> Apart from id map handling conf/issue, I am still not clear on this: "
In NFS if we export a path, clients will never be known of parent directories
along the export path. Why in samba, clients (do know full path) given access to
all directories along the configured share path?"
>
> Could you explain in my case why this is happening?
No, because you appear to be using sssd and Samba does not produce sssd, 
this means we cannot provide support for it.

If you wish to move to winbind, then I am more than willing to help you 
with the move .

Rowland

On 06/04/2020 10:56, Neelakantan Kannappa (nkannapp)
wrote
> We are using pbis-open(likewise).
Sorry, but we do not produce or support pbis-open either, you need to 
consult them.

I do repeat however, if you want to move to using winbind instead, I am 
willing to help you with doing that.

Rowland