samba - Apr 2024 - Sharing Samba share with Domain User Access

I have a new Linux Domain member on a Samba DC (4.18.9). I want this member to
be a file server, and I want all members of the "Domain Users" group
to have
g+rw access to all the files and diretories in that share.

I also want local non-domain users to have access to these files and folders.

I'm a bit perplexed has to how to configure this. In smb.conf I'm
guessing:

--------------------
[public]
comment = OHPRS main file and document repository
path = /mnt/RAID/public

force group = "Domain Users"
# and possibly:
force create mode = 0660
---------------------

Yes? 

For non-domain users, I could always make all files/directory o-rw, but if I
wanted to limit that to e.g. user joe, is there something I could configure? In
smb.conf? In /etc/group?

On the DC, the users' group is 100:

# getent passwd "HPRS\\mark"
HPRS\mark:*:3000023:100:Mark Foley:/home/HPRS/mark:/bin/false

So for "joe" could I just add the following to /etc/group:

users:x:100:joe

A wrinkle with that is getent on the domain member has a different group:

# getent passwd HPRS\\mark
HPRS\mark:*:11105:10513:Mark Foley:/home/mark:/bin/bash

Why would that be? Why wouldn't the domain member have the same user/group
as
the Domain Controller? In any case, I supposed if I were to use /etc/group
I'd
use whatever group getent on that host shows.


Thanks --Mark

On Sat, 27 Apr 2024 21:12:51 -0400
Mark Foley via samba <samba at lists.samba.org> wrote:
> I have a new Linux Domain member on a Samba DC (4.18.9). I want this
> member to be a file server, and I want all members of the "Domain
> Users" group to have g+rw access to all the files and diretories in
> that share.
> 
> I also want local non-domain users to have access to these files and
> folders.
> 
> I'm a bit perplexed has to how to configure this. In smb.conf I'm
> guessing:
> 
> --------------------
> [public]
> comment = OHPRS main file and document repository
> path = /mnt/RAID/public
> 
> force group = "Domain Users"
> # and possibly:
> force create mode = 0660
> ---------------------
> 
> Yes? 
NO

Use vfs_acl_xattr and set permissions from Windows, see here:

https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs
> 
> For non-domain users, I could always make all files/directory o-rw,
> but if I wanted to limit that to e.g. user joe, is there something I
> could configure? In smb.conf? In /etc/group?
> 
> On the DC, the users' group is 100:
> 
> # getent passwd "HPRS\\mark"
> HPRS\mark:*:3000023:100:Mark Foley:/home/HPRS/mark:/bin/false
It would be, it is mapped that way in idmap.ldb from Domain Users and is
only used on a Samba AD DC.
> 
> So for "joe" could I just add the following to /etc/group:
> 
> users:x:100:joe
NO, if 'joe' is an AD user, he will be a member of Domain Users.
> 
> A wrinkle with that is getent on the domain member has a different
> group:
> 
> # getent passwd HPRS\\mark
> HPRS\mark:*:11105:10513:Mark Foley:/home/mark:/bin/bash
> 
> Why would that be? 
As said above, the IDs on a DC normally have no relation to anything
else, unless you use the 'ad' backend on Unix domain members and set
'idmap_ldb:use rfc2307  = yes' on the DC.
> Why wouldn't the domain member have the same
> user/group as the Domain Controller? 
This is one of the reasons not to use a DC as a fileserver.
> In any case, I supposed if I
> were to use /etc/group I'd use whatever group getent on that host
> shows.
I wouldn't suggest using anything local on a Unix domain member.

Rowland