samba - Oct 2021 - domain-free multi-user use cases

On Tue, 2021-10-26 at 14:29 +0200, cn--- via samba
wrote:
> Am 26.10.21 um 14:15 schrieb Eric Levy via samba:
> > I'm not aware this is possible, and I believe even if it is
> > possible in
> > general, it is not supported by my NAS appliance. However, I would
> > like
> > to review any references on the subject if you have any.
> 
> This should help:
> 
> https://wiki.linux-nfs.org/wiki/index.php/ACLs
> 
> Regards
I'm not understanding how this would help ensure that an NFS share is
accessible only through password-based authentication.

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens Eric 
> Levy via samba
> Verzonden: dinsdag 26 oktober 2021 14:37
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] domain-free multi-user use cases
> 
> On Tue, 2021-10-26 at 14:29 +0200, cn--- via samba wrote:
> > Am 26.10.21 um 14:15 schrieb Eric Levy via samba:
> > > I'm not aware this is possible, and I believe even if it is
> > > possible in
> > > general, it is not supported by my NAS appliance. However, I
would
> > > like
> > > to review any references on the subject if you have any.
> > 
> > This should help:
> > 
> > https://wiki.linux-nfs.org/wiki/index.php/ACLs
> > 
> > Regards
> 
> I'm not understanding how this would help ensure that an NFS share is
> accessible only through password-based authentication.
You need NFS Kerberized. 

Give me a moment and i finish up the mail i started for  you .. Yesterday.. 
You can make long mails, but i can also  ;-) 


Greetz, 

Louis

Am 26.10.21 um 14:37 schrieb Eric Levy via samba:
> On Tue, 2021-10-26 at 14:29 +0200, cn--- via samba wrote:
>> Am 26.10.21 um 14:15 schrieb Eric Levy via samba:
>>> I'm not aware this is possible, and I believe even if it is
>>> possible in
>>> general, it is not supported by my NAS appliance. However, I would
>>> like
>>> to review any references on the subject if you have any.
>>
>> This should help:
>>
>> https://wiki.linux-nfs.org/wiki/index.php/ACLs
>>
>> Regards
> 
> I'm not understanding how this would help ensure that an NFS share is
> accessible only through password-based authentication.
I didn't say anything about passwords in that regard. I said with ACLs 
you can make this more fine grained.


I read your original post 
(https://www.spinics.net/lists/samba/msg170503.html) again. Now I wonder 
why you need the second server in addition to the NAS?

I still think pam_mount _might_ do what you want but in this setup 
(Windows client connecting to a Server that mounts via pam_mount) I have 
never tried it. As the Windows client probably does not send a cleartext 
password I am unsure it will work.

Regards

-- 
Dr. Christian Naumer
Vice President
Unit Head Bioprocess Development

BRAIN Biotech AG
Darmstaedter Str. 34-36, D-64673 Zwingenberg
e-mail cn at brain-biotech.com, homepage www.brain-biotech.com
phone +49-6251-9331-30 / fax +49-6251-9331-11

Sitz der Gesellschaft: Zwingenberg/Bergstrasse
Registergericht AG Darmstadt, HRB 24758
Vorstand: Adriaan Moelker (Vorstandsvorsitzender), 
Lukas Linnig
Aufsichtsratsvorsitzender: Dr. Georg Kellinghusen