samba - May 2017 - member domain idmap config ad/rid

Rowland,

AD: 4.5.8
Fileserver: 4.6.3

root at fileserver:~# samba -Version
Version 4.6.3-Debian

root at fileserver:~# net rpc rights list privileges SeDiskOperatorPrivilege
-U "ADDC\administrator"
Enter ADDC\administrator's password:
SeDiskOperatorPrivilege:
  ADDC\Domain Admins
  BUILTIN\Administrators

chown root:Domain\ Admins /mnt/dados >>>> ok
chmod 0770  /mnt/dados >>>> ok

root at fileserver:~# getfacl /mnt/dados/
getfacl: Removing leading '/' from absolute path names
# file: mnt/dados/
# owner: root
# group: domain\040admins
user::rwx
group::rwx
other::---

win7 machine with RSAT Tools.

The security tab as shown in the link below does not appear for me.
https://wiki.samba.org/index.php/File:Demo_Share_Security.png

For me it's that way.
http://i.imgur.com/LRuLR03l.png

Any idea?

On Tue, May 30, 2017 at 1:13 PM, Rowland Penny via samba <
samba at lists.samba.org> wrote:
> On Tue, 30 May 2017 12:33:26 -0300
> Elias Pereira <empbilly at gmail.com> wrote:
>
> >
> > *confs fileserver*
> >
> > *smb.conf*
> >
> > winbind nss info = rfc2307
>
> If you are using Samba 4.6.0 or greater, then you do not use the above
> line.
>
> > idmap config ADDC:unix_nss_info = yes
> > idmap config ADDC:unix_primary_group = yes
>
> You only use the above two lines on Samba 4.6.0 or greater
>
> > [storage]
> > path = /mnt/dados
> > read only = no
> > admin users = "ADDC\Domain Admins" ADDC\administrator
>
> You should set the ACLs from windows, so you not are not recommended
> to have the last line above.
>
> >
> >
> > *user.map*
> >
> > !root = ADDC\Administrator ADDC\administrator
> >
>
> I use:
>
> !root = SAMDOM\Administrator SAMDOM\administrator Administrator
> administrator
>
> Not sure if it makes any difference ;-)
>
> If you are logging in to the windows machine to use ADUC as a member of
> Domain Admins, then you need to set the group on the share on the Unix
> domain member to Domain Admins i.e.
> chown root:Domain\ Admins /mnt/dados
>
> You will also need to give Domain Admins the rights to make changes on
> the Unix domain member (aka fileserver), see here:
>
> https://wiki.samba.org/index.php/Setting_up_a_Share_Using_
> Windows_ACLs#Granting_the_SeDiskOperatorPrivilege_Privilege
>
> If you are logging in as Administrator, it should just work, this is
> because Administrator is mapped to root.
>
> Rowland
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>


-- 
Elias Pereira

On Tue, 30 May 2017 15:05:56 -0300
Elias Pereira <empbilly at gmail.com> wrote:
> win7 machine with RSAT Tools.
> 
> The security tab as shown in the link below does not appear for me.
> https://wiki.samba.org/index.php/File:Demo_Share_Security.png
> 
> For me it's that way.
> http://i.imgur.com/LRuLR03l.png
> 
> Any idea?
Who are logged into the win7 machine as, Administrator or a member of
Domain Admins ? 

I take it /mnt/dados is a mount from somewhere else, how is it mounted
and where from ?

Rowland

>
> Who are logged into the win7 machine as, Administrator or a member of
> Domain Admins ?

As administrator.

 I take it /mnt/dados is a mount from somewhere else, how is it
mounted
> and where from ?

For now it is mounted on the folder /mnt/dados in the same HD of the
fileserver. Later I'll add another HD with more space.

root at fileserver:~# cd /mnt/dados/
root at fileserver:/mnt/dados# df -h
Filesystem      Size  Used Avail Use% Mounted on
udev             10M     0   10M   0% /dev
tmpfs           803M  8.6M  795M   2% /run
*/dev/xvda1      7.4G  1.7G  5.4G  24% /*
tmpfs           2.0G     0  2.0G   0% /dev/shm
tmpfs           5.0M     0  5.0M   0% /run/lock
tmpfs           2.0G     0  2.0G   0% /sys/fs/cgroup
tmpfs           402M     0  402M   0% /run/user/0

On Tue, May 30, 2017 at 3:37 PM, Rowland Penny via samba <
samba at lists.samba.org> wrote:
> On Tue, 30 May 2017 15:05:56 -0300
> Elias Pereira <empbilly at gmail.com> wrote:
>
> > win7 machine with RSAT Tools.
> >
> > The security tab as shown in the link below does not appear for me.
> > https://wiki.samba.org/index.php/File:Demo_Share_Security.png
> >
> > For me it's that way.
> > http://i.imgur.com/LRuLR03l.png
> >
> > Any idea?
>
> Who are logged into the win7 machine as, Administrator or a member of
> Domain Admins ?
>
> I take it /mnt/dados is a mount from somewhere else, how is it mounted
> and where from ?
>
> Rowland
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>


-- 
Elias Pereira