topic Re: setting acl on AD users in Operating System - Linux

setting acl on AD users

Maaz — Tue, 09 Sep 2008 07:25:14 GMT

I have a samba server(as a MS Windows AD member server).
can I grant/set permissions on users/group of AD on shared folders stored on samba server.

in other words, on a samba server that has joined AD domain, I want to assign permissions on users of AD on directories on samba server.

Regards
Maaz

Re: setting acl on AD users

Court Campbell — Wed, 10 Sep 2008 15:09:56 GMT

Yes you can.

Re: setting acl on AD users

Maaz — Thu, 11 Sep 2008 01:34:27 GMT

Hi Court Campbell
>Yes you can.
:), thanks but if you can also please guide how to do this ?
any url/doc/tutorial ?

Regards

Re: setting acl on AD users

Ivan Ferreira — Thu, 11 Sep 2008 12:59:49 GMT

To be able to set permissions to files and folders, you must map the UID/GID to Windows SIDS. For this job, probably, winbind is the way to go.

Re: setting acl on AD users

Court Campbell — Thu, 11 Sep 2008 13:02:16 GMT

Well, I assume that you are using winbind. If so and all is working, you just use the chown or chgrp commands. I just assume you are already familiar with those commands.

Re: setting acl on AD users

Maaz — Fri, 12 Sep 2008 02:07:30 GMT

Hi Ivan Ferreira and Court Campbell, thanks for help.
I dont know about winbind, because this SAMBA server is SLES 10, SLES 10 can join AD Domain, using 3 or 4 mouse clicks, very smoothly and without any issue.

Anyhow I'll check it

Thanks

Re: setting acl on AD users

Gokul Chandola — Sat, 13 Sep 2008 02:55:59 GMT

Hi,
You can do this.
You have to define AD users in Samba Server for desired directories also.

Regards,
Gokul Chandola

Re: setting acl on AD users

Maaz — Sat, 13 Sep 2008 03:25:56 GMT

Hi thanks Gokul Chandola
>You have to define AD users in Samba Server for desired directories also.

say I have a user maaz in MS AD Domain, then what to do in smb.conf ? please share.

cat /etc/samba/smb.conf
[data]
path = /data
read only = No

I want to set permission for maaz(domain user), and to all those users that are member of "grad1" group of MS AD domain on /data directroy

Re: setting acl on AD users

Ivan Ferreira — Tue, 16 Sep 2008 14:37:24 GMT

It depends of the "security = " samba setting. Check the Samba 3 Howto for detailed information about this setting or smb.conf.

Then you will have:

cat /etc/samba/smb.conf
[data]
path = /data
read only = No
valid users = maaz @grad1

Considering that grad1 is a Unix/LDAP group.