samba - Jul 2002 - SUMMARY: hiding Unix perms

Hello,


I figured it out, in short, winbind rocks.

For some reason, I did not see the point of specifying nss_winbind in 
/etc/nsswitch.conf. Now that I did that I can use the UIDs/GIDs mapped
for my system by winbindd for perms.

Using winbind this way eliminates the need to create local Unix accounts :)
Awesome. I'm not sure why I didn't realize this before ( maybe because
the other server I have set up is a dev server where all the developers
have shell accounts, never gave it much thought .. but I wanted ACLs and
the ability to store domain info so I used winbind there. This is a server
intended for windows users, no shells except for mine )

Great work!



Thanks,
Rob


----- Forwarded message from Rob Helmer <robert@namodn.com> -----

Delivered-To: samba@lists.samba.org
From: Rob Helmer <robert@namodn.com>
To: samba@lists.samba.org
User-Agent: Mutt/1.2.5i
Organization: Namodn Artists - http://www.namodn.com
X-OS-Type: Debian GNU/Linux 2.2
Subject: [Samba] hiding Unix perms
Errors-To: samba-admin@lists.samba.org
X-BeenThere: samba@lists.samba.org
X-Mailman-Version: 2.0.8
Precedence: bulk
List-Help: <mailto:samba-request@lists.samba.org?subject=help>
List-Post: <mailto:samba@lists.samba.org>
List-Subscribe: <http://lists.samba.org/mailman/listinfo/samba>,
	<mailto:samba-request@lists.samba.org?subject=subscribe>
List-Id: General questions regarding Samba <samba.lists.samba.org>
List-Unsubscribe: <http://lists.samba.org/mailman/listinfo/samba>,
	<mailto:samba-request@lists.samba.org?subject=unsubscribe>
List-Archive: <http://lists.samba.org/pipermail/samba/>
X-Original-Date: Wed, 24 Jul 2002 14:07:06 -0700
Date: Wed, 24 Jul 2002 14:07:06 -0700

Hello,


Sorry if I missed this in the docs, I haven't seen an option to do this..

I have a Samba server ( Linux 2.20acl kernel ) named "fileserver" set
up and
working well as a fileserver to Windows clients ( I am using winbind also ).

Samba has some awesome capabilities nowadays :) The current issues I am
facing aren't exactly showstoppers, but I know they'll be confusing if I
open it up to users as the main file server when it's like this.

I've noticed that from a Windows box, I can see permissions that match
the Unix permissions ( \\fileserver\rhelmer,  \\fileserver\samba and
Everyone ). 

Also, if I create a file, ( logged into the domain as rhelmer ), it uses
my Unix account ( \\fileserver\rhelmer as the owner, not \\domain\rhelmer ).
I have a script that creates a Unix account for every validated user
from the domain, is this the cause ? ( not sure if I need to do this
anymore now that I am using winbind and ACL ).

How can I :

1) not display the Unix permissions to Windows users ( they can't change
   them anyway.. )

2) have files created by a domain user be owned by \\domain\user not
   \\fileserver\user 



Thanks,
Rob

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  http://lists.samba.org/mailman/listinfo/samba


----- End forwarded message -----

Hi Sven,



On Sat, Jul 27, 2002 at 08:43:52PM +0200, Sven K?hler
wrote:
> > For some reason, I did not see the point of specifying nss_winbind in 
> > /etc/nsswitch.conf. Now that I did that I can use the UIDs/GIDs mapped
> > for my system by winbindd for perms.
> 
> after reading that, i was a little to enthusiastic, and tried to use 
> winbind in combination with a samba PDC - on the same machine.
hmm.. well, what winbind does is make it so accounts on a PDC appear
as Unix UIDs. If the machine IS the PDC, then it already has accounts
for everybody, I don't think winbind will be useful for you.
> 
> > Using winbind this way eliminates the need to create local Unix
accounts :)
> 
> this is, what i tried - and i don't know exactly, what you are talking 
> about here.
> smbpasswd is the program to create samba-users (in this case also 
> domain-users - because samba is my PDC) - and smbpasswd FORCES me to 
> have one system-account for every domain-user.
Yes, the accounts must exist somewhere :)

In my case, they exist on an NT4 PDC sitting next to my new Samba 
fileserver.



HTH,
Rob