samba - Jun 2007 - Share a directory via NFS and Samba at the same time not possible

Hello Folks,

i'have a problem share a directory to both unix(nfs) and windows(samba).
The main problem is, that the rights are associated to winbind groups.
the user in question can access the files from windows correctly and
locally correctly (via su -$USER). If i mount the directory via nfs and
make a su - $USER i can't write to the directory. when calling getfacl $DIR
i can see, that non of the winbind groups are resolved. Only the ldap
groups are resolved. for every winbind group is only the gidnumber shown.
Why are those groups not resolved via nfs?

Mit freundlichem Gruss,

Dirk Laurenz
Systems Engineer
S DE SE PS N/O
Fujitsu Siemens Computers
Hildesheimer Strasse 25
30880 Laatzen
Germany

Telephone:              +49 511 84 89 18 08
Telefax:                +49 511 84 89 25 18 08
Mobile:         +49 170 22 10 781
Email:          mailto: dirk.laurenz@fujitsu-siemens.com
Internet:               http://www.fujitsu-siemens.com
Firmenangaben:          http://www.fujitsu-siemens.de/imprint.html

yes i have

________________________________
From: Daniel Amthor [mailto:daniel.amthor@googlemail.com]
Sent: Monday, June 11, 2007 2:51 PM
To: Laurenz, Dirk
Cc: samba@lists.samba.org
Subject: Re: [Samba] Share a directory via NFS and Samba at the same time not
possible

Hi,

Why are those groups not resolved via nfs?
Have you added "winbind" to  nsswitch.conf ?
Best
Dan

PS : Not sure if my mail will reach the list, therefore writing to you
personally...

Hi,

does this mean that the client resolves groupnames?

The problem is, even if squashing all nfs clients to a uniq userid
(anonuid=xxxx,anongid=xxx,all_squash)
even doesn't help. from my point of view, only the nfs server is responsible
for resolving
groupmemberships (cause the client is mapped to  a uniq userid).
But even this doesn't work.


________________________________
From: Daniel Amthor [mailto:daniel.amthor@googlemail.com]
Sent: Monday, June 11, 2007 3:12 PM
To: Laurenz, Dirk
Subject: Re: [Samba] Share a directory via NFS and Samba at the same time not
possible



2007/6/11, Laurenz, Dirk
<Dirk.Laurenz@fujitsu-siemens.com<mailto:Dirk.Laurenz@fujitsu-siemens.com>>:
yes i have
The problem must be somewhere between the client and the AD Server.
- Is the client joined into the domain, as well as the NFS server ?
- wbinfo -t -g ok ?
- winbind running on client ?
Try troubleshooting the communication between the client and AD.
HTH
Dan



________________________________
From: Daniel Amthor
[mailto:daniel.amthor@googlemail.com<mailto:daniel.amthor@googlemail.com>]
Sent: Monday, June 11, 2007 2:51 PM
To: Laurenz, Dirk
Cc: samba@lists.samba.org<mailto:samba@lists.samba.org>
Subject: Re: [Samba] Share a directory via NFS and Samba at the same time not
possible

Hi,

Why are those groups not resolved via nfs?
Have you added "winbind" to  nsswitch.conf ?
Best
Dan

PS : Not sure if my mail will reach the list, therefore writing to you
personally...

On Mon, Jun 11, 2007 at 03:23:06PM +0200, Laurenz, Dirk
wrote:
> does this mean that the client resolves groupnames?
Sure.

Volker
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url :
http://lists.samba.org/archive/samba/attachments/20070611/9354aac9/attachment.bin

On Mon, Jun 11, 2007 at 02:53:19PM +0200, Laurenz, Dirk
wrote:
> yes i have
Well, then we need some normal debugging of the winbind
installation. In particular logfiles.

Volker

On Mon, Jun 11, 2007 at 02:44:24PM +0200, Laurenz, Dirk
wrote:
> i'have a problem share a directory to both unix(nfs) and
windows(samba).
> The main problem is, that the rights are associated to winbind groups.
> the user in question can access the files from windows correctly and
> locally correctly (via su -$USER). If i mount the directory via nfs and
> make a su - $USER i can't write to the directory. when calling getfacl
$DIR
> i can see, that non of the winbind groups are resolved. Only the ldap
> groups are resolved. for every winbind group is only the gidnumber shown.
> Why are those groups not resolved via nfs?
You did install winbind and nss_winbind on the NFS client
and have it correctly share its idmap via some central
mechanism?

Volker

Hi,
>
> Why are those groups not resolved via nfs?
>
Have you added "winbind" to  nsswitch.conf ?
Best
Dan

PS : Not sure if my mail will reach the list, therefore writing to you
personally...