I am build another Samba server as an Active Directory Domain Controller to replace an old and buggy one.

Every night I rsync the old one with the new one.

Now I am only changing the shares names in smb.conf in the new server for testing but, even with Administrator, I have no permission to assign groups and users to the shares using Windows. What I am doing wrong? I've tried using chmod 777, 0777 1777, 2777, 775, 755, 0755, 0775. Which permissions are the correct ones in this situation?

I am using a compiled version of samba, 4.1.16 today, in the new server. The smb.conf:

# Global parameters
        workgroup = NEWDOM
        realm = ad.newdom.lan
        netbios name = DOM2
        interfaces = lo eth0
        bind interfaces only = Yes
        server role = active directory domain controller
        dns forwarder =
        idmap_ldb:use rfc2307 = yes

        path = /var/lib/samba/sysvol/funarbe.org.br/scripts
        read only = no

        path = /var/lib/samba/sysvol
        read only = no

        path = /home/shares/share1
        read only = no

        path = /home/shares/share
        read only = no

[Edit] I am starting to think that it has something to do with ext4.

  • Anyone can help me? – msmafra May 23 '15 at 13:41

The guys from samba.org sometimes update/change samba's wiki. Few weeks earlier the added to the main wiki page, https://wiki.samba.org, two new entries: Setup and configure file shares using POSIX ACLs and Setup and configure file shares using Windows ACLs (which where "hidden" inside the "more..." link with bit less text). Now using both methods (not yet fully tested in my config) are working.

So creating or modifying the shares permissons to 2770 and setting the permissions with setfacl -m g:"":rwx is working. Using the Troubleshooting to reset acls now makes sense:

# setfacl -b /path/to/share
# setfacl -b /path/to/share/*
# setfacl -R -m default:group:domain\ admins:rwx /path/to/share

It seems they are improving the documentation (wiki) (Good!!!!!)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.