On Mon, 29 Jan 2024 09:27:58 -0800
Peter Carlson via samba <samba at lists.samba.org> wrote:
>
> On 1/29/24 08:17, Rowland Penny via samba wrote:
> > On Mon, 29 Jan 2024 07:55:05 -0800
> > Peter Carlson via samba<samba at lists.samba.org> wrote:
> >
> >> Just to make sure this morning, I created another VM and it
behaves
> >> the same, so obviously we have something slightly different in our
> >> configs. I think we have gone through the client side pretty
> >> thoroughly and they are the same.? That leaves:
> >>
> >> * our security settings on the share -? but you said that your
> >> machine isn't in domain users and domain computers doesn't
have
> >> access to the share.? What else there to test here?
> >> * file server samba settings
> >> * possibly version differences
> >> o Client: Version 4.15.13-Ubuntu
> >> o File Server: Version 4.19.0pre1-GIT-1e793357906
> >> o Domain Controller: Version 4.18.0pre1-GIT-d385058ce7c
> >> o I was doing some work on generic user level linux GPOs
> >> which is why the DC and FS are running from source
> >> * or even at the DC.?
> >>
> >> What's the easiest way to proceed?? I can post pretty much any
> >> config needed.
> >>
> > The share I am mounting is a simple share on a Unix domain member
> > using the 'rid' backend (as is the client), these are the
> > permissions on the share:
> >
> > ls -lad /srv/share
> > drwxrwx--- 3 rowland domain users 4096 Jan 28 21:48 /srv/share
> >
> > The share in smb.conf is this:
> >
> > [data]
> > path=/srv/share
> > read only = no
> >
> > With that, I can start my VM and find the share in /mnt/test
> >
> > I think my next step will have to be to set up a new share on the
> > server, but this time set the permissions from Windows and see if
> > that mounts on the Unix client. But it will have to be tomorrow now.
> >
> > Rowland
> >
> No worries on the timeline, I appreciate the help!
OK, I thought I had to go and do something, but it got cancelled.
So I set up yet another couple of shares, one using windows permissions
like yours, the other giving Domain Users full control, they both mount
and work.
>
> here is my windows share permissions:
> https://pasteboard.co/m6j9vYkRkt3q.png
>
> here is my share config:
>
> root at fs1:~# ls -lad /data/test
> drwxrwx--T+ 4 root CARLSON\domain admins 4096 Jan 26 16:13 /data/test
^
|----- Where does the big T' come from, I do not get that.
It is my understanding that it shows the sticky bit is set on 'others',
but there is no 'x' set.
>
>
> [global]
> server string = %h server (Samba, Ubuntu)
> ?? log file = /var/log/samba/log.%m
> ?? max log size = 1000
> ?? logging = file
> ?? panic action = /usr/share/samba/panic-action %d
> log level = 3
>
> kerberos method = secrets and keytab
> realm = CARLSON.LAB
> workgroup = CARLSON
> template homedir = /home/%U@%D
> template shell = /bin/bash
> security = ads
> idmap config CARLSON : range = 2000000-2999999
> idmap config CARLSON : backend = rid
> idmap config * : range = 10000-999999
> idmap config * : backend = tdb
>
> vfs objects = acl_xattr
> map acl inherit = yes
>
> winbind use default domain = no
> winbind refresh tickets = yes
> winbind offline logon = yes
> winbind enum groups = no
> winbind enum users = no
>
> apply group policies = yes
>
> #======================= Share Definitions ======================>
[Test]
> ??? path = /data/test
> ??? comment = test
> ??? writable = yes
>
>
There are some differences between my smb.conf and yours, but nothing
major except that I have:
dedicated keytab file = /etc/krb5.keytab
I am not sure if that has any bearing.
Rowland