I have a samba server which is providing print services. There are times
when we must deny printing to certain user names and are accomplishing
this by having a preexec script which checks the username against a list
and will deny access to the share based on that. This has been working
very well except that now I also have a list of allowed users for
certain printers (color). This is also done in the preexec script and
works quite well when you go through a samba client (in windows doing a
net use). The problem comes in when you pull up a run prompt and connect
directly to the share.
If you do a run prompt and connect to printer1 (the color allowed users
only) you will be denied as you should if you are either in the deny
list or not in the allow list. - this is working correctly
Now, I connect directly to the server that printer1 is on and I get
presented a blank list because browsing is off. However, now I go back
to my run prompt and connect to printer1 again and this time it works.
My assumption here is that I have been authenticated when I log into the
server for a share list and now it won't go through and run a preexec
for any future shares I connect to. Which is a problem because once
someone is connected I can't stop them from printing to printer1 if they
aren't in the allow list.
My setup is using domain security and I need to force the preexec to run
again for each new share the user connects to. Is that possible or have
I missed the problem entirely I guess is where I'm stuck.
I didn't feel like this required copies of configuration files but I
will be happy to get the relevant portions obscured and up if need be.
Thanks,
-Robert
