On Wed, 2021-06-30 at 16:19 -0400, Eric Levy via samba wrote:> On Thu, 2021-06-24 at 14:29 +0100, Rowland Penny via samba wrote: > > > It might help at least if I would receive advice on the subject, > > > putting aside the question of customization to the Samba code > > > base. > > > If > > > it is possible to achieve the configuration using standard > > > versions > > > of > > > Samba, then it is at least worth trying the same method with the > > > Synology device. > > > > Running Samba as a standalone server is akin to running a Windows > > PC > > in > > a workgroup, so this is what I would try: > > > > Use the same workgroup name on all machines. > > Create the same users and groups on all machines, ensure that the > > users > > have the same password everywhere. > > > > Rowland > > Sorry, for not returning a reply to your suggestion earlier, but I am > still trying to resolve this problem, and must remark that I have > found > your idea confusing. > > For a Samba mount in a basic form, all files in the mount take the > same > owner and permissions, generally the owner being root. The function > of > the multiuser option, as I understand, is to enforce different > permissions for each user on the system. Without this option, would > various users have different permissions for files on the mount? > > Perhaps you might illustrate your idea with a concrete minimal case > showing, for example, the mount command.Try read 'man mount.cifs' Where you will find this: multiuser Map user accesses to individual credentials when accessing the server. By default, CIFS mounts only use a single set of user credentials (the mount credentials) when ac? cessing a share. With this option, the client instead creates a new session with the server using the user's credentials whenever a new user accesses the mount. Further accesses by that user will also use those credentials. Because the kernel cannot prompt for passwords, multiuser mounts are limited to mounts using sec= options that don't require passwords. With this change, it's feasible for the server to handle permissions enforcement, so this option also implies noperm . Furthermore, when unix extensions aren't in use and the administrator has not overridden ownership using the uid= or gid= options, ownership of files is presented as the current user accessing the share. Which shows that you have a problem 'multiuser mounts are limited to mounts using sec= options that don't require passwords.' or to put it another way, kerberos. Rowland
On Wed, 2021-06-30 at 21:42 +0100, Rowland Penny via samba wrote:> On Wed, 2021-06-30 at 16:19 -0400, Eric Levy via samba wrote: > > On Thu, 2021-06-24 at 14:29 +0100, Rowland Penny via samba wrote: > > > > It might help at least if I would receive advice on the > > > > subject, > > > > putting aside the question of customization to the Samba code > > > > base. > > > > If > > > > it is possible to achieve the configuration using standard > > > > versions > > > > of > > > > Samba, then it is at least worth trying the same method with > > > > the > > > > Synology device. > > > > > > Running Samba as a standalone server is akin to running a Windows > > > PC > > > in > > > a workgroup, so this is what I would try: > > > > > > Use the same workgroup name on all machines. > > > Create the same users and groups on all machines, ensure that the > > > users > > > have the same password everywhere. > > > > > > Rowland > > > > Sorry, for not returning a reply to your suggestion earlier, but I > > am > > still trying to resolve this problem, and must remark that I have > > found > > your idea confusing. > > > > For a Samba mount in a basic form, all files in the mount take the > > same > > owner and permissions, generally the owner being root. The function > > of > > the multiuser option, as I understand, is to enforce different > > permissions for each user on the system. Without this option, would > > various users have different permissions for files on the mount? > > > > Perhaps you might illustrate your idea with a concrete minimal case > > showing, for example, the mount command. > > Try read 'man mount.cifs' > > Where you will find this: > > multiuser > Map user accesses to individual credentials when > accessing the server. By default, CIFS mounts only use a single set > of > user credentials (the mount credentials) when ac? > cessing a share. With this option, the client instead > creates a new session with the server using the user's credentials > whenever a new user accesses the mount. Further > accesses by that user will also use those credentials. > Because the kernel cannot prompt for passwords, multiuser mounts are > limited to mounts using sec= options that don't > require passwords. > > With this change, it's feasible for the server to > handle > permissions enforcement, so this option also implies noperm . > Furthermore, when unix extensions aren't in use and > the administrator has not overridden ownership using > the > uid= or gid= options, ownership of files is presented as the current > user accessing the share. > > Which shows that you have a problem 'multiuser mounts are limited to > mounts using sec= options that don't require passwords.' or to put it > another way, kerberos. > > RowlandIs it possible without Kerberos? I investigated it but found no way to provision a deployment in a straightforward way that is suitable for small networks with only a few users. There are few to no resources on the subject not targeted at administrators of networks of many nodes and users. In this case, there are only two nodes and a few users, so it is hoped that there is a relatively simple and easy solution.
Eric Levy via samba <samba at lists.samba.org> writes:> Is it possible without Kerberos? I investigated it but found no way to > provision a deployment in a straightforward way that is suitable for > small networks with only a few users. There are few to no resources on > the subject not targeted at administrators of networks of many nodes > and users. In this case, there are only two nodes and a few users, so > it is hoped that there is a relatively simple and easy solution.If all the users in all the machines accessing the share in your network share the the same UID namespace without conflicts, then in that case you could use idsfromsid I think. With it, any *new* file created by user bob will show up on the share as owned by a special SID that contains the UID. And only files created with that mount options should be listed back with bob uid. That being said, if you have the same uid namespace on all machines for user bob, that means you already have some sort of centralized identication server similar to AD and are using winbind or sssd. I realize you might not want to setup AD in your small network, but by default all users uid start from 1000. So if you have machineA where you created user bob (1000) and bart (1001) and machineB where you created user james (1000) and judy (1001) and try to mount with the idsfromsid, then files created by james on machineA will show up as owned by bob on machineB... I hope that clears up some confusion. Cheers, -- Aur?lien Aptel / SUSE Labs Samba Team GPG: 1839 CB5F 9F5B FB9B AA97 8C99 03C8 A49B 521B D5D3 SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 N?rnberg, DE GF: Felix Imend?rffer, Mary Higgins, Sri Rasiah HRB 247165 (AG M?nchen)