On 12/13/22 10:45, Rowland Penny via samba wrote:> Is 'S-1-5-21-185628584-2620904409-2800336372' the domain SID ?
> Who or what is the RID 1105 ?
Not sure, how Can I determine that?
>
>>
>> 2) If inheritance is disabled, why do the folders in the share show
>> inherited from P:\ ?
>>
>> 3) I am a member of Domain Users and Domain Admins.? I can see files
>> in P:\ but I cant overwrite them or delete them.? It seems to be
>> using the permissions of Domain Admins R+X and not Domain Users Full
>> Control.? yes I know the permissions seem backwards, which is another
>> issue, however shouldn't it allow me write access since I am also a
>> member of Domain Users ?
>>
>> Thanks! Peter
>>
>
> Can you post the output of the following commands run on the machine
> that holds the share:
>
> ls -lad /path/to/share/directory
Did the share point as well as one sub directory:
root at filesvr:~# ls -lad /data/FacilityPictures/
drwxrwxrwt+ 5 root root 4096 Dec? 1 15:22 /data/FacilityPictures/
root at filesvr:~# ls -lad /data/FacilityPictures/*
drwxrwxr-x+ 2316 SDCP\peter?? SDCP\domain admins?? 110592 Nov? 4 11:19?
/data/FacilityPictures/Completed
drwxrwxr-x+??? 6 SDCP\ijenson SDCP\domain users????? 4096 Dec 13 10:42
'/data/FacilityPictures/Encode Videos'
drwxrwxr-x+??? 4 SDCP\peter?? SDCP\domain admins???? 4096 Sep 30 10:46
'/data/FacilityPictures/Stock Images'
-rwxrwxr-x+??? 1 SDCP\peter?? SDCP\domain admins 31156113 Aug 15 13:29?
/data/FacilityPictures/test_video.mp4
>
> getfacl /path/to/share/directory
root at filesvr:~# getfacl /data/FacilityPictures/
getfacl: Removing leading '/' from absolute path names
# file: data/FacilityPictures/
# owner: root
# group: root
# flags: --t
user::rwx
user:root:rwx
user:SDCP\\domain\040users:rwx
group::rwx
group:root:rwx
group:SDCP\\domain\040users:rwx
mask::rwx
other::rwx
default:user::rwx
default:user:root:rwx
default:user:SDCP\\domain\040users:rwx
default:group::r-x
default:group:root:r-x
default:group:SDCP\\domain\040users:rwx
default:mask::rwx
default:other::r-x
root at filesvr:~# getfacl /data/FacilityPictures/Completed
getfacl: Removing leading '/' from absolute path names
# file: data/FacilityPictures/Completed
# owner: SDCP\\peter
# group: SDCP\\domain\040admins
user::rwx
user:SDCP\\domain\040admins:r-x
user:SDCP\\domain\040users:rwx
group::r-x
group:SDCP\\domain\040admins:r-x
group:SDCP\\domain\040users:rwx
group:2001105:rwx
mask::rwx
other::r-x
default:user::rwx
default:user:SDCP\\domain\040users:rwx
default:user:SDCP\\peter:rwx
default:group::r-x
default:group:SDCP\\domain\040admins:r-x
default:group:SDCP\\domain\040users:rwx
default:mask::rwx
default:other::r-x
>
> samba-tool ntacl get /path/to/share/directory --as-sddl
root at filesvr:~# samba-tool ntacl get? /data/FacilityPictures/ --as-sddl
O:S-1-22-1-0G:S-1-22-2-0D:PAI(A;;0x001f01ff;;;S-1-22-1-0)(A;;0x001f01ff;;;S-1-22-2-0)(A;;0x001f01ff;;;WD)(A;OICIIO;0x001f01ff;;;CO)(A;OICIIO;0x001200a9;;;CG)(A;OICIIO;0x001200a9;;;WD)(A;OICI;0x001f01ff;;;DU)
root at filesvr:~# samba-tool ntacl get /data/FacilityPictures/Completed
--as-sddl
O:S-1-5-21-185628584-2620904409-2800336372-1105G:DAD:AI(A;ID;0x001f01ff;;;S-1-5-21-185628584-2620904409-2800336372-1105)(A;OICIIOID;0x001f01ff;;;CO)(A;ID;0x001200a9;;;DA)(A;OICIIOID;0x001200a9;;;CG)(A;OICIID;0x001200a9;;;WD)(A;OICIID;0x001f01ff;;;DU)
>
> Can you also post the smb.conf from the same machine.
Sanitized (and yes I know I shouldn't use .local, dont have the
permission yet to change that historical mess)
root at filesvr:~# cat /etc/samba/smb.conf
[global]
server string = %h server (Samba, Ubuntu)
log file = /var/log/samba/log.%m
max log size = 1000
logging = file
panic action = /usr/share/samba/panic-action %d
server role = member server
template homedir = /home/%U@%D
template shell = /bin/bash
usershare allow guests = yes
kerberos method = secrets and keytab
security = ads
idmap config SDCP : range = 2000000-2999999
idmap config SDCP : backend = rid
idmap config * : range = 10000-999999
idmap config * : backend = tdb
winbind refresh tickets = yes
winbind offline logon = yes
vfs objects = acl_xattr
map acl inherit = yes
realm = SA***NT.LOCAL
workgroup = SDCP
winbind use default domain = no
winbind enum groups = no
winbind enum users = no
#======================= Share Definitions
======================[FacilityPictures]
??? path = /data/FacilityPictures
??? comment = Facility Pictures
??? writable = yes
>
> Rowland
>