Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are trying to solve what we perceive as a problem with the behavior of our Samba server. Please understand we are not claiming this is a bug in Samba. It is simply different from the behavior we want.

Our Samba server is version 3.5.4 (release 68.el6) and runs under CentOS 6.0 (x86_64). We happen to use Active Directory (AD) to authenticate, but I’m not convinced this behavior is specific to AD.

What follows is a generalized statement of the undesirable behavior, with the context provided first as a sequence of events:

  1. A CIFS client establishes (and maintains) a connection to a CIFS share on our Samba server.
  2. After that connection has been established, a configuration change is made (examples provided as bullets below) which we think should immediately revoke the CIFS client's access to the connected CIFS share. For example:
    • The Active Directory user is deleted from the domain (via the Active Directory Administrative Center on the domain controller).
    • The Active Directory user is removed from the CIFS share's list of permitted users (on the Samba server host).
    • The CIFS share is deleted (on the Samba server host).

Here’s the undesirable behavior. As long as the CIFS client maintains the existing connection to the CIFS share, access to that share is not revoked. That is, the user continues to have the same access to the share as they did when the connection was first established. FWIW, we believe this behavior is by design.

The desired behavior is for access to be revoked as soon as “the configuration change” pertinent to access rights is finalized. Disconnecting the affected client session(s) is acceptable and appropriate, but disconnecting other sessions is undesirable.

I would like to get your ideas toward an approach that will yield the desired behavior. Perhaps this is as simple as changing our Samba server’s configuration; we have not found any configuration parameters that appear relevant to this behavior. It appears the art of detecting that access has been revoked is the most difficult part of all this.

share|improve this question

I'm pretty sure this isn't possible at the moment, at least not using the functionality built into Samba itself.

A workaround could be something like a cronjob which regularly checks that all the smbd processes on a machine are from valid users, by parsing the output of the smbstatus utility to check what users are logged on and what processes are serving them, and verifying those processes against the users in AD. You can then use that information to kill any processes for users who are no longer valid.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .