I have created a folder and 770 it; when I try to mount a samba share, permissions are changed to 670 and I cannot access folder data; but if I "su" I can access all the data.
My command is:
sudo smbmount //192.168.1.5/docs /home/my_user/docs -o user=my_user,domain=DOMAIN,uid=my_user,gid=domain_admins
smb.conf is:
[global]
workgroup = domain
netbios name = server
server string = File Server
enable privileges = yes
interfaces = lo,eth0
bind interfaces only = Yes
passdb backend = ldapsam:ldapi://%2fvar%2frun%2fslapd%2fldapi
ldap ssl = Off
log level = 1
syslog = 0
log file = /var/log/samba/%m
max log size = 50
vfs objects = full_audit
full_audit:success = connect opendir open disconnect unlink mkdir rmdir rename
full_audit:failure = none
smb ports = 137 138 139 445
name resolve order = wins bcast hosts
time server = Yes
printcap name = CUPS
wins support = Yes
dns proxy = Yes
ldap suffix = dc=aaa,dc=bbb
ldap machine suffix = ou=Computers
ldap user suffix = ou=Users
ldap group suffix = ou=Groups
ldap idmap suffix = ou=Idmap
ldap admin dn = cn=ccc,dc=aaa,dc=bbb
map acl inherit = Yes
printing = cups
encrypt passwords = Yes
obey pam restrictions = No
ldap passwd sync = Yes
mangling method = hash2
logon script = logon.bat
logon drive = Z:
logon home =
logon path = \\192.168.1.5\profiles\%U
domain logons = Yes
os level = 65
preferred master = Yes
domain master = Yes
add user script = /usr/sbin/smbldap-useradd -m "%u"
ldap delete dn = Yes
add machine script = /usr/sbin/smbldap-useradd -w "%u"
add group script = /usr/sbin/smbldap-groupadd -p "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"
set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u"
hide unreadable = yes
[docs]
comment = documents
path = /home/samba/shares/docs
valid users = #"users"
read list =
write list = #"users"
admin users =
read only = No
browseable = Yes
force create mode = 0660
force directory mode = 0770
vfs objects = full_audit
I solved it some time ago and forgot to post here.
My problem was my shared folder permission, it was just rw, and it should be rwx
Related
I have to connect to different devices simultaneously using kerberos authenication. At present using default cache(File) to store kerberos ticket which stores only one ticket at a time. But for my requirement I have to store multiple tickets. Please suggest how to update cache which stores multiple tickets and how to access them. At present kerberos tickets are accessed using kinit.
Please share the detailed steps to update the cache to handle above requirement. I am new to this space your help is much appreciated.
Below is the sample krb5.conf configuration file. By default File cache is used.
{ [logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
default_realm = EXAMPLE.COM
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
EXAMPLE.COM = {
kdc = kerberos.example.com
admin_server = kerberos.example.com
}
[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
}
Updating more information on my requirement, for example under single active directory there are 10 windows devices all share same domain name , username and password. From this network(say from one linux machine) I want access these devices using Kerberos authentication as different user but not as root user. Currently Kerberos uses default cache FILE which stores only one ticket a time. But for my requirement I want to maintain all 10 tickets and access them not as a root user.With FILE cache and as different user I am able to access device using Kerberos authentication. My application is running in multi threaded environment. Please share the detailed solution I am new to this space.
I want to implementation centralize auth using AWS Simple AD (samba). The client machine is linux based (ubuntu and amazon linux). Ony my ldap, i just creat one user (cn=test) under dc=ldap,dc=test,dc=io.
I am using sssd as the auth client from my linux machine. And here my /etc/sssd/sssd.conf :
[sssd]
config_file_version = 2
services = nss, pam
domains = LDAP
[nss]
[pam]
[domain/LDAP]
id_provider = ldap
auth_provider = ldap
ldap_schema = rfc2307
ldap_uri = ldap://ldap.test.io
ldap_default_bind_dn = dc=ldap,dc=test,dc=io
ldap_default_authtok = password01
ldap_default_authtok_type = password
ldap_search_base = dc=ldap,dc=test,dc=io
ldap_user_search_base = dc=ldap,dc=test,dc=io
ldap_group_search_base = odc=ldap,dc=test,dc=io
ldap_user_object_class = inetOrgPerson
ldap_user_gecos = cn
override_shell = /bin/bash
cache_credentials = true
enumerate = true
But, it looks like not working from the client, i didn't get the ldap user from my client (i execute this getent passwd).
And i got this error:
nss_ldap: reconnecting to LDAP server...
nss_ldap: reconnecting to LDAP server (sleeping 1 seconds)...
nss_ldap: could not search LDAP server - Server is unavailable
No passwd entry for user 'test'
Here is my reference to configure the sssd client enter link description here
Any suggestion for this case ?
Thanks
The error message you are getting is from nss_ldap, not from nss_sss. So I assume in /etc/nsswitch.conf, you configured the ldap module either on its own or before sss. If the user information is to be returned by sssd then use the sss nsswich module.
I would also recommend to not use enumerate=true unless your directory is quite small.
In /etc/nsswitch.conf be sure to have:
passwd: files sss
shadow: files sss
groups: files sss
And of course in the stack of the /etc/pam.d/system-auth-ac and /etc/pam.d/password-auth-ac you have to use the pam_sss.so library.
In my country timezone is GMT+5.30,so I changed the timezone accordingly in preferences menu but in odoo log file the timezone is still GMT.How to change this?
Config file,
[options]
; This is the password that allows database operations:
; admin_passwd = admin
db_host = localhost
db_port = 5432
db_maxconn = 64
db_name = False
db_user = openpg
db_password = openpgpwd
addons_path = C:\Users\odooGit\addons
pg_path = C:\Program Files (x86)\OpenERP 7.0-20150922\PostgreSQL\bin
xmlrpc = True
xmlrpc_port = 8069
xmlrpcs = True
xmlrpcs_port = 8071
syslog = True
This feature isn't available in Odoo at the moment even if you set timezone to something like Africa/Lagos Odoo will use UTC time for the logs, if you're on Linux a workaround to start the odoo server with --syslog, which would uses the machine's timezone just like it does for other system logs.
so start your Odoo server like this
./odoo.py --syslog
or you can just set it in the config file with
syslog = True
Note that specifying --syslog will redirect the logs to the redirect the logs to the system log files (usually var/log/syslog), if you want a separate file, you'll have to do some extra work yourself.
if you're on Ubuntu checkout /etc/rsyslog.d/50-default.conf (rsyslogd)
if you're on CentOS which uses syslogd checkout /etc/syslog.conf
Since google has stopped the openID support for gerrit, i am trying to use LDAP for the same now. I have IP and port number of the LDAP server. But i don't know how to start now.
I also need help to update my etc/gerrit_config file:
[auth]
type = ldap
[ldap]
server = ldap://[IP]
accountBase = ou=people,dc=domain,dc=com
groupBase = ou=groups,dc=domain,dc=com
referral = follow
accountPattern = (uid=${username})
groupPattern = (cn=${groupname})
accountFullName = cn
accountMemberField = memberOf
accountEmailAddress = mail
Since i am a newbie for ldap, could someone please help me in the same.
Thanks!!
At work I am running a gerrit instance that uses one of our work LDAPs for authentication. I use a configuration like this:
[ldap]
server = ldap://xxx.OurDomain.com
username = CN=ldapread,DC=OurDomain,DC=com
password = NotShownHere
accountBase = DC=OurDomain,DC=com
groupBase = DC=OurDomain,DC=com
The key point is that you need an LDAP user that is permitted to read from the LDAP and put the coordinates of that user into the config.
In our case, I obtained these coordinates from a know to work Apache httpd config file. In your case, you may have to ask your LDAP admin for suitable credentials.
My hair is going gray (or grayer that usual) trying to solve this riddle.
running: ubuntu 12.04 LTS
I want a PHP script (executed by apache) to delete a directory with all it's containing files in a cifs mounted directory. But I get "Permission denied".
The file is created by another samba client.
I have tried and tried , all different kinds of settings, but now I need some fresh eyes
Any comment appreciated
B.R Lars
the file:
-rw-rw-rw- 1 countmaster countmaster 60897298 Sep 25 12:13 row_15.52.gz
the containing directory:
drwxrwxr-x 2 countmaster countmaster 4096 Sep 25 13:34 SYNFR1.14247NEVB.1405281044/
the server smb.conf (i've used the default with slight modifications):
[global]
server string = %h server (Samba, Ubuntu)
map to guest = Bad User
guest account = countmaster
obey pam restrictions = Yes
pam password change = Yes
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
unix password sync = Yes
syslog = 0
log file = /var/log/samba/log.%m
max log size = 1000
dns proxy = No
usershare allow guests = Yes
panic action = /usr/share/samba/panic-action %d
idmap config * : backend = tdb
[printers]
comment = All Printers
path = /var/spool/samba
create mask = 0700
printable = Yes
print ok = Yes
browseable = No
[print$]
comment = Printer Drivers
path = /var/lib/samba/printers
[share]
comment = Countmaster File Server Share
path = /nfs/countdata
read only = No
writeable =YES
create mask = 0777
force directory mode = 0755
guest ok = Yes
The client /etc/fstab:
//192.168.1.10/share /home/countserver/public_html/countdata cifs auto,users,noperm,rw,guest,exec,actimeo=0 0 0