Hi everyone,
So I'm trying to copy files from a windows share to a samba share. I'm
using robocopy to mirror file files a permissions, but I've recently hit
a little problem with the interaction of permissions, and I'm not sure
how to fix it.
What's happening is that after a file is copied, it's permissions are
updated. What I end up with is Domain Users (the default group) is
assigned to the file with no permissions, and the builtin Users group is
assigned, via ACLs, with full permissions. Of course, the problem is
that the builtin Users group actually contains the Domain Users group,
so I end up with a case of Domain Users being unable to access the file.
Now, in an ideal world, unix filesystems would implement ACLs in a way
that isn't a kludgey bolt-on feature, but since it is, I'd like samba to
help me work around it and set the unix group to something which will
then be ignored when reporting file permissions back to Windows. I
thought that I found this feature in the force group command, but I was
wrong.
Force group sounds exactly like what I want. I want samba to assign a
default group, e.g. "root", to all of my files, and then add and
modify
additional groups via the ACL system. This would prevent the wackiness
I'm seeing, and get ACLs working properly. However, what ends up
happening in this case is that the file is created as me, with the
default group set to "root" (yay!), then the permissions are
"fixed",
and the owner is set to "root" and the group is set to "Domain
Users".
This seems a bit strange to me because "Domain Users" is not mentioned
in the Windows ACLs at all, so it makes me wonder:
a) Why is the group being set to "Domain Users" at all?
b) Why isn't the group still forced to "root" as I asked?
One option I've considered is messing with the various mode bits. I
could, for example, ensure that the default group always had full
permissions (or at least read-only permissions), but that changes
the problem because now I am granting permissions where there were none
before.
I'm using samba version 3.6.3, on Ubuntu 12.04.
Here is my config:
=====================[global]
log level = 3
server string = samba
netbios name = samba
interfaces = 10.0.0.36
security = ads
realm = DOMAIN.COM
workgroup = DOMAIN
# I want to see the domain name as part of the user name:
winbind use default domain = no
winbind separator = +
# From here we configure the idmaps
idmap config * : backend = tdb
idmap config * : range = 5000-6000
idmap config DOMAIN: default = yes
idmap config DOMAIN: backend = rid
idmap config DOMAIN: range = 100000-2000000000
winbind enum users = yes
winbind enum groups = yes
winbind nested groups = Yes
# how many nested groups to traverse:
winbind expand groups = 10
client use spnego = yes
encrypt passwords = true
restrict anonymous = 2
# Windows doesn't have this restriction, so neigther do we:
hide dot files = no
# Use extended ACL attributes to store windows permissions:
vfs objects = acl_xattr
ea support = yes
map acl inherit = yes
store dos attributes = yes
map hidden = no
map system = no
map archive = no
map readonly = no
# Just to be safe:
invalid users = root
# Reccommended for ADS security mode:
#name resolve order = wins bcast
template homedir = /srv/Homes/%D/%U
template shell = /bin/false
unix extensions = no
# Allocate file blocks at creation time (no sparse files), helps
# with quotas.
strict allocate = yes
allocation roundup size = 1024
[Share]
path = /srv/Share
writable = yes
admin users = DOMAIN+mike
#force group = root
#force directory security mode = 0070
=====================
Please let me know if I can provide more information.
Thanks,
Mike
(:
--
--------Mike at
PirateHaven.org-----------------------The_glass_is_too_big--------
