similar to: security settings on [home] share for use in member server

Hey all, I decided to use the default ranges in the smb.conf of my member server, so I changed my smb.conf and it looks like that: ================================================== [global] netbios name = MEMBERSRV workgroup = MYDOM security = ADS realm = MYDOM.EXAMPLE.COM encrypt passwords = yes idmap config MYDOM:backend = ad idmap

Hello, I am running Samba 4.1.12/Sernet on Debian Wheezy 64bit and I am about to setup my member server. The DC was provisioned with rfc2307 and extended attributes. I have assigned to the domain group called "Domain Users" the GID=10000. My member server was prepared with ACL+user_xattr and winbind support. My /etc/nsswitch.conf is using "winbind" for passwd+group, and

Hi folks, It seems that the setting acl_xattr:ignore system acls = yes reduces Windows compatibility when defined for a share. In all attempts I have used Windows tools (except editing smb.conf) Assume there is a share, where the files and folders in the share root should at least be readable by anybody having access to the share. For the sake of simplicity the following permissions apply on

Hello list, I am using the Microsoft ADUC (Active Directory Users & Computers) tool from the RSAT suite for creating and modifying my domain users. I am aware of the "copy" functionality which really is very nice to use. Unfortunately I am missing two important actions during the user-creation process which I try to describe: 1.) When I use the template feauture (by using the

Does you filesystem support extended attributes? What does "|getfattr -n security.NTACL |filename" return?|| On 30.01.2024 16:13, Peter Milesson wrote: > Hi folks, > > It seems that the setting acl_xattr:ignore system acls = yes reduces > Windows compatibility when defined for a share. In all attempts I have > used Windows tools (except editing smb.conf) > > Assume

On 2017-04-23 17:01, Rowland Penny wrote: > On Sun, 23 Apr 2017 14:07:44 +1000 > Henry via samba <samba at lists.samba.org> wrote: > >> Following: >> >> https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs >> >> In windows: >> >> I can set permissions under the "Share Permissions" tab. >> >> I am

> It's needed after every GPO addition and edit. There must be a root > cause to hunt down somewhere. Or is it a bug in 4.13.0 ? Yes, and no. Yes, its a bug. No, in my opionion its an old setting thats just needs some updating. Try this. samba-tool ntacl set "O:LAG:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;SO)(A;OICI;0x001f01

Hi, i'm experiencing a strange behavior in the way samba shows file and folders permissions under windows explorer. When i open the folder or file properties under windows (xp sp2 btw), it shows in the Security panel all the entries, both classical posix ones and posix acl ones; but if i select each one of them to see file permissions, it will show only the permission of users indicated

On 01/07/2020 09:03, Enrico Morelli wrote: > On Wed, 1 Jul 2020 08:43:37 +0100 > Rowland penny via samba <samba at lists.samba.org> wrote: > >> On 01/07/2020 08:36, Enrico Morelli via samba wrote: >>> On Tue, 30 Jun 2020 10:28:41 -0700 >>> Jeremy Allison via samba <samba at lists.samba.org> wrote: >>> >>>> On Tue, Jun 30, 2020 at

Hello! I am following the how to https://wiki.samba.org/index.php/User_home_drives But even though there reported a process for User X does not access the home of Y User, this is happening root at fileserver:/srv/samba# getfacl home/ # file: home/ # owner: root # group: root user::rwx user:root:rwx user:administrator:rwx group::r-x group:root:r-x group:5007:r-x group:domain\040admins:rwx

Hi, > Follow this wiki page: > > https://wiki.samba.org/index.php/Setup_a_Samba_print_server#Setup_the_.5Bprinters.5D_share > Then the page you referred and use windows ACLs not posix ACLs done > > I also take it you have given your users & groups uidNumber or > gidNumber attributes. yes, this is a test-environment and i have given the unix-id to administrator,

Hello, we are using the vfs module recycle with the following config: vfs objects = recycle recycle: repository = .Papierkorb recycle:directory_mode = 0777 recycle:subdir_mode = 0777 recycle: keeptree = Yes recycle: exclude = *.tmp, *.temp, *.log, *.ldb recycle: exclude_dir = tmp recycle:versions = Yes Problem is that everybody can see deleted documents in the recycle bin. But if I set

Hai, After lots of testing and checking today im must concluded that achim and mathias are right. There are "BUILDIN\" security groups which make some GPOs are going wrong. Also, im getting errors again with sysvolcheck. .. i was in the understanding this was resolved.. but im but off with all info, very buzy at the office atm. samba-tool ntacl sysvolcheck ERROR(<class

Gentlemen, I am struggling to solve this problem. My file server Samba 4.4.5. Even the administrator user (domain admin) could not write to the share. Could someone give me a hint, in order to solve this problem? shared folder: /mnt/data Folder permissions: # getfacl /mnt/data/teste/ getfacl: Removing leading '/' from absolute path names # file: mnt/data/teste/ # owner: ricardo

I believe I have found either a bug or something I do not understand. I recently had a file-share issue and the resolution was to set the "others" permissions to 5, read and execute. The problem with this is that once I am in Windows on a workstation, this appears to allow "Everyone", "CREATOR OWNER", and "CREATOR GROUP" access. We normally setup our

I have created a [home] share: user at jupiter:~$ sudo ls -l /srv/samba/ total 24 drwxrwxr-x 2 root domain admins 4096 Nov 22 21:38 Demo drwxrwxr-x 2 root domain admins 4096 Nov 15 11:51 Finance drwxrwxr-x+ 2 root domain admins 4096 Nov 25 08:08 home drwxrwxr-x+ 9 root domain admins 4096 Nov 24 21:06 Printer_drivers When i try to set the ACLs in Windows I get "Permission Denied" In

Hai, Now, i did not know you used the DC for the profiles here but yes it looks good. Small comment on point 3 and 4. 3) Its good, you might notice a few more rights there compaired to what i posted, thats because you have your profiles on the DC but the settings are good. 4) yes, the security is ok, i like the higher security setting and try to mimic the windows settings as much as

Hai, ? im running samba 4.2.2 sernet on debian. ? when i run : samba-tool gpo aclcheck -UAdministrator ? im getting : ERROR: Invalid GPO ACL O:DAG:DAD:PAI(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED) and it tells me it should be O:DAG:DAD:P?

*Another reply that was accidentally sent to the wrong address...* I ran another test of a share on the raid array after making the changes you suggested Rowland. I reset the ACLs on /mnt/md0/samba_shares/test as outlined in the wiki and set the default group to domain admins. I executed setfacl commands g=rwx and chgrp domain admins, then added the directory to my smb.conf and ran

> > On the file serever: > > Collected config --- 2019-07-03-10:27 ----------- > > > > Hostname: srv > > DNS Domain: a.b.hu > > FQDN: srv.a.b.hu > > ipaddress: 10.0.3.15 192.168.0.8 > > ----------- > > Samba is running as a Unix domain member > > ----------- > > > > This computer is running Debian 10.0 x86_64 > >