search for: onunix

On 12/11/15 13:05, mathias dufresne wrote: > > > > That's for that same reason I don't agree and think it is not fair to not > give Samba admins the choice. > If all my 120000 users have primary group id set to 100, as you said all > newly created object onUNIX shares will be owned by group n°100 and so > accessible to the whole company. This is the way windows works, you need to use windows ACLs to set just who has access etc. > I'm too thick to see where is the security improvement in that. It works for windows. > > > Let's...

...wrote: >> >>> >>> >>> That's for that same reason I don't agree and think it is not fair to not >>> give Samba admins the choice. >>> If all my 120000 users have primary group id set to 100, as you said all >>> newly created object onUNIX shares will be owned by group n°100 and so >>> accessible to the whole company. >>> >> This is the way windows works, you need to use windows ACLs to set just >> who has access etc. >> >> I'm too thick to see where is the security improvement in that....

..., mathias dufresne wrote: > >> >> >> >> That's for that same reason I don't agree and think it is not fair to not >> give Samba admins the choice. >> If all my 120000 users have primary group id set to 100, as you said all >> newly created object onUNIX shares will be owned by group n°100 and so >> accessible to the whole company. >> > > This is the way windows works, you need to use windows ACLs to set just > who has access etc. > > I'm too thick to see where is the security improvement in that. >> > >...

...>> >>>> That's for that same reason I don't agree and think it is not fair to >>>> not >>>> give Samba admins the choice. >>>> If all my 120000 users have primary group id set to 100, as you said all >>>> newly created object onUNIX shares will be owned by group n°100 and so >>>> accessible to the whole company. >>>> >>>> This is the way windows works, you need to use windows ACLs to set just >>> who has access etc. >>> >>> I'm too thick to see where is the se...

...ser) is what will appear in the access > token when the user accesses a file server. > That's for that same reason I don't agree and think it is not fair to not give Samba admins the choice. If all my 120000 users have primary group id set to 100, as you said all newly created object onUNIX shares will be owned by group n°100 and so accessible to the whole company. I'm too thick to see where is the security improvement in that. > > We can think about making the use of the gidNumber attribute > a configurable option (at least for the start in the domain > member case...

On 2015-11-10 at 13:57 +0000, Rowland Penny wrote: > On 10/11/15 13:42, mathias dufresne wrote: > >Thank you for this quick answer Louis. > > > >On DC: > > > >On DC I had to add one line to have winbind retrieving uidNumber AD field > >rather than having Winbind chosing some random UID for my users. > >This line is: > > > >idmap_ldb:use