0

Having issues accessing our shares on a Samba 4.7.10 installation recently upgraded from 4.5.15 on AIX server. FYI I have no direct access or control over Samba configuration, but am trying to understand the issue and hopefully help troubleshooting.

Current situation (trying to get access to configuration file so I can detail and/or confirm this):

  • security = ads
  • realm = domain.ca
  • password server = server1 server2
  • clients are Windows 7 and Windows 10; I'm using the later

I'm told that:

  • Samba 4.7 is more secure and requires users primary group to match with group in samba config file for a particular share
  • for a given share to /top/down/directory, all directories must have same group
  • for a given share to /top/down/directory with "valid users = @group", members of @group must have their primary group set to @group

What I'm experiencing:

  • with share to /top/leaf having "valid users = @group1" & top's group = @group1 & leaf's group = @group2 & my primary group = @group1, I'm getting the Windows Security logon prompt, which never allows me in
  • with share to /top/leaf having "valid users" = top's group = leaf's group = my primary group = @group1, access is granted (even without a logon prompt)
  • after I reset leaf's group to @group2, I'm still allowed access; I assume some kind of Windows credential caching is happening here

The issue:

  • having to update directories' group to match users' primary group is not practical nor secure in our environment

Questions:

  • What should I be investigating next?
  • Or more generally does any of that make sense?

ANY clue would be appreciated! :-)

1 Answer 1

0

As it seems I must have a reputation of 50 to ask questions, I will ask here: How is Samba running ? Is it a standalone server, AD DC, Unix domain member, or what ? It sounds like you are running Windows clients, what version of Windows ?

AIX really needs to catch up, 4.7.x is EOL as far as Samba is concerned

6
  • I've updated the post with a "Current situation" section. In short: standalone server with Windows 7/10 clients.
    – FBeaudoin
    Jan 29, 2020 at 14:15
  • Then groups don't really come into it, you connect to a standalone server as a Samba user. This means that you must create a Samba user on the standalone server and preferably also create a Unix user with the same name. When you create the Unix user a user private group with same name is usually created (what you are calling a primary group). Has any of this been done ? Jan 29, 2020 at 14:46
  • Turns out "security" setting is (most probably) "ads" (updated "Current situation" section)... Sorry for this. Yes we do create Unix users for clients (they use the server for processing purposes) and manage directory/file access through groups. To my knowledge, we do not create Samba users.
    – FBeaudoin
    Jan 29, 2020 at 17:07
  • You need find out for certain what 'security' is set to. If it is 'ads', then it will also be joined to an AD domain and you don't create Unix users, you extend Windows users to be Unix users. Jan 29, 2020 at 18:03
  • What are the servers ? Windows DCs or what ? Do you have a 'password server' line in smb.conf that doesn't point to '*' ? if so remove it. Jan 29, 2020 at 18:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .