samba - Jan 2005 - Questions to share right's

Hi all,

I have here following, RHEL clone, Samba 3.09x + Winbind, 2 NT4 domains
(trustet)


Questions in addition:

It concerns the Share [Install].

Why can a user, who does not a member in "write list" is,
nevertheless files and Directorys create??


What do I understand here wrongly?

Thx

Stefan


With the following configuration:

[global] 
    unix charset = ISO8859-15 
    display charset = ISO8859-15 
    workgroup = FELTEN1 
    server string = Linux-Fileserver-SFE002 
    interfaces = 192.168.1.35/24 
    security = DOMAIN 
    password server = 192.168.1.51 
    log level = 1 
    log file = /var/log/samba/%m.log 
    max log size = 50 
    name resolve order = wins lmhosts bcast 
    socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 
    os level = 32 
    local master = No 
    dns proxy = No 
    wins server = 192.168.1.51 
    kernel oplocks = No 
    ldap ssl = no 
    idmap uid = 10000-20000 
    idmap gid = 10000-20000 
    template homedir = /daten/Home privat/%D/%U 
    template shell = /bin/bash 
    winbind separator = + 
    winbind cache time = 15 
    winbind enable local accounts = Yes 
    winbind use default domain = Yes 
    admin users = administrator, backup 
    cups options = raw 
#    vscan-clamav:config-file = /etc/samba/vscan-clamav.conf 
#    vfs objects = vscan-clamav 

[homes] 
    comment = ~~~ privates Homeverzeichnis~~~ 
    path = %H 
    read only = No 
    create mask = 0700 
    directory mask = 0700 
    browseable = No 

[printers] 
    comment = All Printers 
    path = /var/spool/samba 
    printable = Yes 
    browseable = No 

[Install] 
    comment = Install 
    valid users = @DACSYS1+Dom?nen-Benutzer,@Dom?nen-Benutzer 
    writeable = yes 
    create mode = 0664 
    write list = @DACSYS1+Install_Serrig,@Install_Serrig 
    path = /daten/Install 
    directory mode = 0775

The "write list" directive is used to override the 'read only'
or
'writeable' directive.

The best way to achieve what you want to do is put all the users that need
write access to this share in one group.  Remove the "write list"
directive, and change the group owner ship of /daten/Install to that group
and the mode to 660.  This will allow access to that group and the owner,
but not anyone else.  See if this works for you.