similar to: cannot set share ACLs

Hi, so you would like to restrict the access to the share definitions? E.g. only "User1" should be able to access the Share "Private"? Have you had a look at this documentation? https://www.samba.org/samba/docs/using_samba/ch09.html (This doc is quite old but should still apply). We're running a seperate fileserver which is joined to the SAMDOM DC. Then we're using

Hi, Is it normal that "chown $user $file" and "chown :$group $file" destroy the Windows-ACLs? Is it normal that changing the file owner in Windows does not change the file owner in Linux, but changing the file owner in Linux does change the file owner in Windows? This should be mentioned in >

Many first time users of Samba-4 seem to struggle with the same issues. I suggest the Wiki should have a Readme First similar like this: http://www.klaus-hartnegg.de/gpo/14-03-12-samba4.html It basicly says that Samba 4 can behave either like Samba 3, or as AD-DC, in which case it should do nothing else. Then it lists the main differences, limitations, and requirements. I would love to see a

On 11/28/2014 9:23 AM, Klaus Hartnegg wrote: > > Is there anything else that I could try, > or do I just have to stay on protocol NT1 > as long as we still use this old software? > > Klaus Try in [global] acl allow execute always=true -- Regards -------------------------------------- Gerald Drouillard Technology Architect Drouillard & Associates, Inc.

Hi, most file access rights sync between ACLs of linux and the security tab of windows file properties, but not all. Where are the other infos stored? I tried in linux 'getfattr -d' and 'samba-tool ntacl get', but neither output changed when using windows to add individual right for a user that already has rights inherited from the parent directory. Windows remembers every

On Wed, May 13, 2015 at 1:20 PM, Klaus Hartnegg <hartnegg at uni-freiburg.de> wrote: > Am 13.05.2015 um 17:30 schrieb S?bastien Le Ray: > >> No they aren't >>> >> >> Yes they are >> > > Not sure about this, but mostly irrelevant anyway, because of this effect > in the other direction: > > If you have set Windows ACLs, and then change

On Fri, 24 Apr 2015, Klaus Hartnegg wrote: > Am 24.04.2015 um 01:02 schrieb Carl G. Riches: >> I'm unable to join a Windows 7 PC >> to the Samba 4 domain when "hosts allow" is defined > >> hosts allow = 127 10.208.29. 10.108.29. > > Maybe the new version insists there must be a dot after the 127. > I put the dot in, to no avail. I also modified the

Missing features from memory from following this mailinglist: - Win7 join to AD still requires two registry changes. - SYSVOL is not replicated, use a cronjob with rsync. - Domain-Trust works only in one direction (which one?). - winbind does not work on DCs, use a separate file server. - Joining an AD requires one of its DCs in the same subnet? - Cluster filesystems destroy TDB files, use CTDB. -

Thanks for your help and replies. Yes, I meant "store dos attributes". It's pretty clear now that I need to keep the parameter 'store dos attributes=no' since 1) the server is an AD member server and 2) the map* parameters don't do the right thing under ZFS / NFSV4 ACLs. I've read that the steps Klaus Hartnegg listed resolves the issue on ZFS on Linux; however, I

Am 10.06.2015 um 03:25 schrieb Mike: > I'm learning to be very deliberate with changing posix and windows acl's so > I don't disturb users' access to files and folders. > I check acl's on a specific file/folder on the server with getfacl. > Then make one small acl modification to one file in a sub-directory of a > share. > Then record the difference reported

Am 29.09.2016 um 16:26 schrieb v g via samba: > Really? Easy and useful, huh? Live sync of directories is VERY useful. So useful that I just try to kill the purchase of EMC Isilon, precisely because it cannot replicate with Windows.

On Thu, 24 Aug 2017, Rowland Penny via samba wrote: > On Thu, 24 Aug 2017 12:41:36 +0200 > Sven Schwedas via samba <samba at lists.samba.org> wrote: > >> On 2017-08-24 12:27, Rowland Penny via samba wrote: > > I actually used worse words when I found out why I couldn't get my work > on the python code to work. ;-) > >> Does this apply only to sysvolreset

Hi Klaus, I haven't used that tool for at least 13 years but I do recall that, among other things, it read from the registry. Coupled with the fact that Samba 4 AD is not a complete implementation of AD I can't imagine that it could possibly work. More to the point, I'd be seriously concerned about the results. This is not something I'm prepared to test in a production

Hi, when I don't want to switch to Active Directory, but don't want to be stuck on version 3.6 either, can I simply give samba 4 a copy of the old smb.conf file? Will it be able to store all windows acl's in extended attributes, or is this improvement only available in combination with letting it run as active directory domain controller? thanks, Klaus

Hello, im trying to setup a share using windows acls. I followed the step ins https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs but hanging at "Adding a Share" # mkdir -p /srv/samba/Demo/ # chown root:"Domain Admins" /srv/samba/Demo/ *--> chown: ungültige Gruppe: »root:Domain Admins“* # net rpc rights list privileges SeDiskOperatorPrivilege -U

Hi, Just wondering: What are you guys using to deploy software on your windows (7) workstations within the samba4 AD? These are options I know of: * wpkg (but it seems it's development is not too active) * wpkg-gp using the group policies * www.opsi.org (Client Management System for Windows clients) * standard windows software deployment, but I think that's msi-only This page also has

On Tue, 2015-03-10 at 11:37 +0100, Klaus Hartnegg wrote: > Am 10.03.2015 um 11:00 schrieb Sergio Rizzi: > > By reading https://wiki.samba.org/index.php/Roadmap#Trust_support seems > > that trust support is not finished yet, btw in changelogs seems that in > > 4.2.* (with winbindd) interdomain trusts are now working. > > The release notes say that windindd "paves

On Thu, 31 Aug 2017, Rowland Penny via samba wrote: > On Thu, 31 Aug 2017 16:04:42 -0400 (EDT) > me at tdiehl.org wrote: > >> On Thu, 24 Aug 2017, Rowland Penny via samba wrote: >> >>> On Thu, 24 Aug 2017 12:41:36 +0200 >>> Sven Schwedas via samba <samba at lists.samba.org> wrote: >>> >>>> On 2017-08-24 12:27, Rowland Penny via

Hi, maybe this thread should ask an even more general question: How are AD-DC admins supposed to test upgrades? If there is more than one AD-DC, an upgraded DC which causes problems cannot (must not) be restored from backup. This is one of the reasons why I do not want to switch to AD. A PDC *can* simply be restored from backup. It is even enough to switch back to the previous contents of

Am 15.05.2015 um 16:30 schrieb Reindl Harald: > the real problem in that thread is that the ordinary chmod/chown > permissions are called repeatly "acls" which is not wrong by the > definiton of "access control list" but mixing that with "windows ACLs" > and "posix ACLs" where on the FS layer we just have ACLs set with > "setfacl" it