g p
2010-Jan-22 20:18 UTC
[Samba] force all connections that come from a windows group to be a specific user and problems with net groupmap add
Does anyone know of a simple (share) mechanism that doesn't require setting up a complex ldap, winbind, pdc, etc samba configuration that will allow users connecting to a samba share to always be forced to be a specific unix UID? The idea is to have the linux data owned by a particular linux user, and be able to control write access to that data by adding any arbitrary windows user to a specified windows user group. The reason why ldap, winbind, etc is not a desirable config is that this could be deployed at sites that have stand alone workgroups with a single user to very complex ads or ldap configurations with many thousands of users, and we would like to have a simplistic one size fits all access control method. Note that this doesn't have to conform to ideal security protocols, or what a zealot would consider ideal configurations or IT practices - functional simplicity is preferred. Also - on another related, but separate note, I cannot seem to get the net groupmap add command to work correctly. I have a stand alone samba server, and a windows box that I have local admin permissions to - I add a new windows group and new unix group on the unix side - run the command net group add ntgroup="<windows_grp_name_here>" unixgroup="<unix_group_name_here>", but when I try to actually write to the share with a windows user that is in the supposedly mapped group, I only receive a permission denied error. a net groupmap list shows that the mapping did take, but again, it doesn't appear to actually function as I would have expected. Any hep would be great on either or both of these questions.