samba - Feb 2021 - Any drawback in changing primary group of domain users ?

On 2/26/21 10:41 AM, Roy Eastwood wrote:
>
>> -----Original Message-----
>> From: Nicola Mingotti <nmingotti at gmail.com>
>> Sent: 25 February 2021 19:06
>> To: Roy Eastwood <spindles7 at gmail.com>; samba at
lists.samba.org
>> Cc: nmingotti at gmail.com
>> Subject: Re: [Samba] Any drawback in changing primary group of domain
users ?
>>
>>
>>
>> On 2/25/21 4:40 PM, Roy Eastwood wrote:
>>>> Nicola wrote
>>>> After reading all of your considerations, which at the moment
>>>> I can only partially understand, this is what I made.
>>>>
>>>> ---- /etc/smb.conf --------------------
>>>> force group = adm
>>>> --------------------------------------------
>>>>
>>>> It seemed to me the easiest solution. To perform and to
maintain.
>>>>
>>>> I leave the Primary Group to "Domain Users" for all
Windows domain user,
>>>> not to go against Windows habits.
>>>>
>>>> I will keep it working for a week and see if any issue emerges.
>>>>
>>>> The benefits seems to be:
>>>>
>>>> . Directories don't get by default "Domain user"
group when written in
>>>> the ext4. So "Domain user" people
>>>> can go only where I say they can go through 'getfacl'. 
I don't need to
>>>> worry any more
>>>> about the interaction between Linux group permission and the
W.Domain
>>>> users.
>>>>
>>>> . My default user in NAS  is in the group "adm".
'adm' is not defined
>>>> as a group in AD => I can walk  freely in the shared disk
still being
>>>> only a
>>>> "Linux user" without any Windows Domain Group.
>>>>
>>>> thank you all for your insightful considerations and experience
!
>>>>
>>>> bye
>>>> Nicola
>>>>
>>> Maybe I've misunderstood your issues, but if you add
>>>    	acl_xattr:ignore system acl = yes
>>> to your smb.conf (instead of force group) will that solve the
problem?
>>>
>>> Roy
>>>
>> Hi Roy,
>>
>> maybe that would work as well.  I preferred the other just because
>> i already used it. The NAS is in production, the amount of experiments
>> I can do is limited.
>>
>> The problem is that I was having strange issues of users not able to
>> reach some contents, condition which, by ACL rules, should not have
>> happened.
>>
>> I red all what i could find about Samba, permissions, ACL, etc. still
my
>> grasp
>> of the whole story is not strong. So I can not analyze the issue
>> deductively.
>> Instead, I noticed that the directory having problems had all
"Domain user"
>> as a group, in Linux, so I induced there might have been a clash of
>> permissions between
>> ACL rules and Linux directory group permissions.
>>
>> Then I thought I might have changed the default group from Domain Users
>> to something different. Somebody reccomended against it, i think
Rowland.
>> So, I preferred to roll back to a previous config which should be
safer.
> @Rowland I think the OP's problems stem from the fact that both POSIX
ACLs and Windows ACLs are in play.
> I have scanned the WiKi and can find no reference to adding the line:
> 	acl_xattr:ignore system acl = yes
> to either the share share definition or the global section of smb.conf when
using Windows ACLs.
> Is it worth making this clear by adding it to the
https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs
> page?
>
> Roy
>
Hi Roy, forgive my beginner question, but If I would set the parameter 
as you
say would it be possible to change the ACL on the shared disk using 
Linux 'setfacl' ?

Using 'setfacl' has been a priceless plus in my case. Much better than 
using Windows tools.
If that would be lost my humble recommendation is not to put it into the 
wiki.


bye
Nicola

On 26 February 2021 17:30 Nicola Mingotti wrote:
> On 2/26/21 10:41 AM, Roy Eastwood wrote:
> >
> >> -----Original Message-----
> >> From: Nicola Mingotti <nmingotti at gmail.com>
> >> Sent: 25 February 2021 19:06
> >> To: Roy Eastwood <spindles7 at gmail.com>; samba at
lists.samba.org
> >> Cc: nmingotti at gmail.com
> >> Subject: Re: [Samba] Any drawback in changing primary group of
domain users
> ?
> >>
> >>
> >>
> >> On 2/25/21 4:40 PM, Roy Eastwood wrote:
> >>>> Nicola wrote
> >>>> After reading all of your considerations, which at the
moment
> >>>> I can only partially understand, this is what I made.
> >>>>
> >>>> ---- /etc/smb.conf --------------------
> >>>> force group = adm
> >>>> --------------------------------------------
> >>>>
> >>>> It seemed to me the easiest solution. To perform and to
maintain.
> >>>>
> >>>> I leave the Primary Group to "Domain Users" for
all Windows domain user,
> >>>> not to go against Windows habits.
> >>>>
> >>>> I will keep it working for a week and see if any issue
emerges.
> >>>>
> >>>> The benefits seems to be:
> >>>>
> >>>> . Directories don't get by default "Domain
user" group when written in
> >>>> the ext4. So "Domain user" people
> >>>> can go only where I say they can go through
'getfacl'.  I don't need to
> >>>> worry any more
> >>>> about the interaction between Linux group permission and
the W.Domain
> >>>> users.
> >>>>
> >>>> . My default user in NAS  is in the group "adm".
'adm' is not defined
> >>>> as a group in AD => I can walk  freely in the shared
disk still being
> >>>> only a
> >>>> "Linux user" without any Windows Domain Group.
> >>>>
> >>>> thank you all for your insightful considerations and
experience !
> >>>>
> >>>> bye
> >>>> Nicola
> >>>>
> >>> Maybe I've misunderstood your issues, but if you add
> >>>    	acl_xattr:ignore system acl = yes
> >>> to your smb.conf (instead of force group) will that solve the
problem?
> >>>
> >>> Roy
> >>>
> >> Hi Roy,
> >>
> >> maybe that would work as well.  I preferred the other just because
> >> i already used it. The NAS is in production, the amount of
experiments
> >> I can do is limited.
> >>
> >> The problem is that I was having strange issues of users not able
to
> >> reach some contents, condition which, by ACL rules, should not
have
> >> happened.
> >>
> >> I red all what i could find about Samba, permissions, ACL, etc.
still my
> >> grasp
> >> of the whole story is not strong. So I can not analyze the issue
> >> deductively.
> >> Instead, I noticed that the directory having problems had all
"Domain user"
> >> as a group, in Linux, so I induced there might have been a clash
of
> >> permissions between
> >> ACL rules and Linux directory group permissions.
> >>
> >> Then I thought I might have changed the default group from Domain
Users
> >> to something different. Somebody reccomended against it, i think
Rowland.
> >> So, I preferred to roll back to a previous config which should be
safer.
> > @Rowland I think the OP's problems stem from the fact that both
POSIX ACLs
> and Windows ACLs are in play.
> > I have scanned the WiKi and can find no reference to adding the line:
> > 	acl_xattr:ignore system acl = yes
> > to either the share share definition or the global section of smb.conf
when
> using Windows ACLs.
> > Is it worth making this clear by adding it to the
> https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs
> > page?
> >
> > Roy
> >
> 
> Hi Roy, forgive my beginner question, but If I would set the parameter
> as you
> say would it be possible to change the ACL on the shared disk using
> Linux 'setfacl' ?
> 
> Using 'setfacl' has been a priceless plus in my case. Much better
than
> using Windows tools.
> If that would be lost my humble recommendation is not to put it into the
> wiki.
> 
> 
> bye
> Nicola
No, see Rowland's reply on this thread.   As he (and the WiKi) says you
should  use Windows ACLs or POSIX ACLs (using setfacl) but not both.   I
don't think the setting I suggested will affect your situation, and may be a
red-herring.   Basically as AD is primarily for Windows clients, I set
everything from Windows using Windows ACLs.   Using setfacl may be the problem
here if you have also set the ACLs using windows, but Rowland or Louis will know
better than I!

Hope that helps

Roy