similar to: Behavior of acl_xattr:ignore system acls = yes on a share

Does you filesystem support extended attributes? What does "|getfattr -n security.NTACL |filename" return?|| On 30.01.2024 16:13, Peter Milesson wrote: > Hi folks, > > It seems that the setting acl_xattr:ignore system acls = yes reduces > Windows compatibility when defined for a share. In all attempts I have > used Windows tools (except editing smb.conf) > > Assume

On 30.01.2024 16:51, Ralph Boehme via samba wrote: > On 1/30/24 16:27, Rowland Penny via samba wrote: >> On Tue, 30 Jan 2024 16:13:41 +0100 >> Peter Milesson via samba <samba at lists.samba.org> wrote: >> >>> Hi folks, >>> >>> It seems that the setting acl_xattr:ignore system acls = yes reduces >>> Windows compatibility when defined

On 1/30/24 16:27, Rowland Penny via samba wrote: > On Tue, 30 Jan 2024 16:13:41 +0100 > Peter Milesson via samba <samba at lists.samba.org> wrote: > >> Hi folks, >> >> It seems that the setting acl_xattr:ignore system acls = yes reduces >> Windows compatibility when defined for a share. In all attempts I >> have used Windows tools (except editing

Hi all, After setting permissions on a file. If anyone authorised to open the file writes to it, the ACL gets deleted and that person becomes the owner of the file and the group is reset to the default. For example, whenever a certain user opens and changes a file in the problem folder he becomes the owner and another gets kicked of the list: More clearly, lee was the last one to write to this

I have set up a share on a domain member server and am attempting to set the ACLs from a domain-joined Windows 7 computer as per the WiKi at https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs I want to use one of the BUILTIN groups, Backup Operators to be able to have Full Control on files in the share (as it will be used for backups). However, when trying to assign the

On 25 September 2019 17:25, Rowland penny wrote: > On 25/09/2019 16:25, Roy Eastwood via samba wrote: > > I have set up a share on a domain member server and am attempting to set the ACLs from a domain-joined Windows 7 computer as > per the > > WiKi at https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs > > > > I want to use one of the BUILTIN

Dear all, I have set a small test domain in virtualbox. 1. Samba AD DC on Debian bullseye testing 4.11.6 2. Samba domain member Debian Stretch 4.10.14 3. Windows 10 Enterprise evaluation version 1909 Roaming profiles with folder redirection setup. PAM working. The above was setup basically using guides in wiki.samba.org, with nearly the only thing changed was SAMDOM to SAMBA. "Unix

> It's needed after every GPO addition and edit. There must be a root > cause to hunt down somewhere. Or is it a bug in 4.13.0 ? Yes, and no. Yes, its a bug. No, in my opionion its an old setting thats just needs some updating. Try this. samba-tool ntacl set "O:LAG:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;SO)(A;OICI;0x001f01

On 1/30/24 20:15, Peter Milesson via samba wrote: > *Setup shared folder* > > ?* Create the folder /data/migrtest > ?* Set ownership to root:"Domain Admins" > ?* chmod 0770 migrtest iirc this has to be 0777, otherwise the kernel gets in your way. You only want Samba to enforce permissions so you have to get the kernel filesystem permissions our of the way by goint

Problem solved (I hope)! On 31.01.2024 12:40, Ralph Boehme via samba wrote: > On 1/31/24 12:02, Rowland Penny via samba wrote: >> Which looks correct to myself, so a bug ? > something to look into in more detail, ie logs and network traces. :) > > -slow Hi folks, I added the following parameter to the share definition in smb.conf: acl_xattr:default acl style = windows Now the

Perhaps everyone's clear on this - but I thought I should add this, just in case. (And perhaps the clarification should be added to the wiki.) When it says "Samba will ignore the standard Unix system ACL's (ugo)" This is technically true. HOWEVER! It only ignores the standard Unix system ACLS as it applies to SAMBA permissions. This won't allow Samba to read files that the

> You could try using a script Louis wrote, see here: > https://github.com/thctlo/samba4/blob/master/samba-check-set-sysvol.sh > > The 'idmap config' lines are nothing to worry about, you cannot set them on a DC, but, for some reason, testparm etc warns about > them. > > Rowland > Sorry, I should have said - I ran louis' script and set the acl's according

I have a problem that I am unable to sort out. Maybe someone can assist with advice and troubleshooting. Client computer is Windows 10 Pro with latest updates as of today. Servers are a Windows 2019 Standard (logon and AD server) and a Samba 4.11 running on Ubuntu (domain member. AD account configured with account profile \\hp-fssrv\profiles\<username>. Home directory is mapped to

Hai, ? im running samba 4.2.2 sernet on debian. ? when i run : samba-tool gpo aclcheck -UAdministrator ? im getting : ERROR: Invalid GPO ACL O:DAG:DAD:PAI(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED) and it tells me it should be O:DAG:DAD:P?

I am setting up a OpenLdap PDC with file and print services on Ubuntu Jaunty. Jaunty ships with samba 3.3.2. I configured samba to just use the registry back in which I think is pretty cool! What happend when I use the Add print wizard to add my Windows XP drivers I get the famous "unable to install driver access denied" message. I can ssh into the box with my user id and create files in

Hi all, I am referring to the official wiki here: https://wiki.samba.org/index.php/Setting_up_a_home_share#Setting_up_the_share_and_filesystem_permissions I was struggling around for many hours before I have found out what caused my issue. Well, I have created the [home] share exactly as epxlained on the How-To, in detail: I am creating on the linux prompt at the member server the directory with

Just wanted to say very interesting thread! I would like to share my experience as well if that's alright. I have noticed when using the ignore system acls = yes value, when checking on the Windows side permissions it appears as the following (copying from Peter here): -Permissions list- root (Unix User\root) Full Control This folder only Domain Admins (Private\Domain Admins) Read,

Finaly, i was waiting for this one. ;-) Now after all changes Rowland suggested. Run this : getfacl /home/users Show the output. There are 5 things you need to think in. 1) The folder rights 2) The share rights 3) Posix or windows ACL's? ( use Windows ACL's my advice. ) 4) Dont forget the "Primary Group". 5) If you use chmod, you must re-apply the windows ACL again on

Hi, > Follow this wiki page: > > https://wiki.samba.org/index.php/Setup_a_Samba_print_server#Setup_the_.5Bprinters.5D_share > Then the page you referred and use windows ACLs not posix ACLs done > > I also take it you have given your users & groups uidNumber or > gidNumber attributes. yes, this is a test-environment and i have given the unix-id to administrator,

Hai, Ok, i expected a bit different outputs. On my DC, i use /home/samba/sysvol and /home/samba/netlogon. This is what i expected. getfacl /home/samba/ getfacl: Removing leading '/' from absolute path names # file: home/samba/ # owner: root # group: BUILTIN\134administrators user::rwx user:root:rwx group::rwx group:BUILTIN\134administrators:rwx