|
|
Sponsored Content
Top Forums
UNIX for Dummies Questions & Answers
Samba with clients in multiple domains
Post 302597156 by rbatte1 on Thursday 9th of February 2012 11:21:39 AM
02-09-2012
Moderator
Samba with clients in multiple domains
Dear all,
I've not a good starting point I'm afraid, but I was forced to deploy Samba under pressure of failing hardware so an urgent migration was done. We didn't get the IBM AIX 6.1 supplied one running at all, so we pulled down the samba.org version 3.4.3. We couldn't get that working as we wished, but it did at least share. It has been merrily allowing any request to mount (read-only) the shares. All was well with the function, but obviously it is not appropriate for the sensitive data was are sharing. The setting I had to put in was security=SHARE and on each share, we have guest login allowed.
My problem is that our clients are in at least two domains and the server is standalone, i.e. no LDAP or whatever connection set up on the operating system in /etc/netsrv.conf or anything. We are an outsourcing company so we have our servers & users and the client company users all wanting to access the data.
I've tried reading the manual pages, but I have to understand much more about security and protocols than I do to get my foot in the door, so to speak. The more I try to find out, the more confused I get.
What I have tried has always prevented any access. Great for security, but useless for actually operating the business.
It has been parked for quite a while now especially as the failing hardware also allowed guest connections so I had nothing to compare to. I've now forgotten what attempts I have made, but now Internal Audit are on my case to lock it down. Can anyone point me in the right direction? I would prefer to grant access to an Active Directory group of users if that is possible, but then it needs to validate the user on more than one domain......um?
My head hurts already.
Full config (slightly sanitised) can be posted if this is useful, but I didn't want to flood the thread first off.
Robin
Liverpool/Blackburn
UK
I've not a good starting point I'm afraid, but I was forced to deploy Samba under pressure of failing hardware so an urgent migration was done. We didn't get the IBM AIX 6.1 supplied one running at all, so we pulled down the samba.org version 3.4.3. We couldn't get that working as we wished, but it did at least share. It has been merrily allowing any request to mount (read-only) the shares. All was well with the function, but obviously it is not appropriate for the sensitive data was are sharing. The setting I had to put in was security=SHARE and on each share, we have guest login allowed.
My problem is that our clients are in at least two domains and the server is standalone, i.e. no LDAP or whatever connection set up on the operating system in /etc/netsrv.conf or anything. We are an outsourcing company so we have our servers & users and the client company users all wanting to access the data.
I've tried reading the manual pages, but I have to understand much more about security and protocols than I do to get my foot in the door, so to speak. The more I try to find out, the more confused I get.
What I have tried has always prevented any access. Great for security, but useless for actually operating the business.It has been parked for quite a while now especially as the failing hardware also allowed guest connections so I had nothing to compare to. I've now forgotten what attempts I have made, but now Internal Audit are on my case to lock it down. Can anyone point me in the right direction? I would prefer to grant access to an Active Directory group of users if that is possible, but then it needs to validate the user on more than one domain......um?
My head hurts already.
Full config (slightly sanitised) can be posted if this is useful, but I didn't want to flood the thread first off.
Robin
Liverpool/Blackburn
UK
|
|
10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
Hello,
I have 3 domains virtually hosted "name based" the first one "domain1.com" has its ServerName entered as domain1.com. this domain will load in a browser by www.domain1.com or simply domain1.com. the next two domains "domain2.com" and "domain3.com" ServerNames are listed as domain2.com and... (2 Replies)
Discussion started by: ericg
2 Replies
2. UNIX for Dummies Questions & Answers
I need help creating multiple domains with one single DNS server.ex: domain1.com and domain2.com on a sigle machine 1.2.3.4
Thx (1 Reply)
Discussion started by: lekan
1 Replies
3. Solaris
Hi there:
I am currently using Kerberos on Solaris 9 to autenticate using windows active directory. It is working fine, however, we just were made aware that instead of one domain, we have multiple. We configured one real with only one domain, however, I need the autentication process to also... (3 Replies)
Discussion started by: ramosl05
3 Replies
4. Solaris
We have a WAN boot jumpstart server which works fine .. we have a requirement wherein we would require to jumpstart multiple sparc servers simultaneously, Whats the way .. so that we do not have to wait for a cleint to complete the installation before starting with another server.
Any help would... (1 Reply)
Discussion started by: fugitive
1 Replies
5. UNIX for Advanced & Expert Users
Hello all. I'm hoping you can help with a problem I'm having with Samba. I have Samba running on a Solaris host. All of my users authenticate against the same domain, but some of my users are using PCs on a different domain. When the users whose PCs are on a different domain try to connect to... (0 Replies)
Discussion started by: trouphaz
0 Replies
6. Programming
hello everyone,
i am making a tcp chat server using c in linux. i have used socket programming to connect the server and the client.
can anyone please let me know how i can use forking for multiple clients??
thank you (1 Reply)
Discussion started by: sweetbella
1 Replies
7. Red Hat
Hello Friends,
I am running Sendmail 8.14 on rhel6. I have one simple question regarding domain masquerading, i would want to masquerade different domains with different addresses. By that what i mean is that lets say i have 3 domains as home.com, example.com, test.com and i would want to... (0 Replies)
Discussion started by: Rohit Bhanot
0 Replies
8. Red Hat
Hi,
We now have a Samba or Winbind issue. The Linux client under RHEL6 can not get Windows' AD sub-domain info. See the following output please. The main domain 'Global' is shown online, but the sub-domain 'Europe' and 'Asia' are shown offline although they are online.
Commands 'wbinfo -u' and... (0 Replies)
Discussion started by: aixlover
0 Replies
9. UNIX and Linux Applications
Hi Guys,
Kindly advise what options/settings needed in smb.conf to support win7.
currently we are experiencing slow connection issues from our recently upgraded win7 from XP to our Samba server ver. 3.0.33-3.7.el5_3.1 (1 Reply)
Discussion started by: RobertG
1 Replies
10. UNIX for Beginners Questions & Answers
Can you add multiple domains to a nameserver without creating a new IP address? I have one IP address on my machine and have configured forward and reverse zone files. Names are resolving fine.
I know I can add another domain to the named.conf file and create new forward and reverse files. what... (2 Replies)
Discussion started by: LinuxGirl
2 Replies
LEARN ABOUT OSX
sharing
sharing(1) BSD General Commands Manual sharing(1) NAME
sharing -- create share points for afp, ftp and smb services. SYNOPSIS
sharing [-a <path> [options]] [-e <share point name> [options]] [-r <share point name>] [-l] DESCRIPTION
A list of flags and their descriptions: -a <path> add a new share point for the directory specified by <path>. -e <share point name> edit the share point record specified by <share point name>. -r <share point name> delete the share point record specified by <share point name>. -l list all existing share point records. Description of options The following options modify share point record attributes -A <afp name> use customized name <afp name> when using share point with afp. -F <ftp name> use customized name <ftp name> when using share point with ftp. -S <smb name> use customized name <smb name> when using share points with smb. -s <flags> use this option to modify individually, the sharing attribute for afp, ftp and smb. By default a share point record is enabled for afp, ftp and smb. To modify the indiviual attributes AND the following flags as required: 100 (enable sharing for afp only), 010 (enable sharing for ftp only), 001 (enable sharing for smb only). Specify 000 to turn off sharing of a share point all together. use customized name <smb name> when using share points with smb. -g <guest flag> use this option to modify individually, the "guest" attribute for afp, ftp and smb. The "guest" attribute specifies whether a ser- vice will allow guest access to this share point record. By default a "guest" is enabled for afp, ftp and smb. To modify the attribute, AND the following <guest flags> as required: 100 (enable guest access for afp only), 010 (enable guest access for ftp only), 001 (enable guest access for smb only). Specify 000 to turn off guest access for the share point all together. -i <inherit privileges flag> use this option to modify the "inherit privileges" attribute for afp. The "inherit privileges" attribute specifies whether afp will apply the classic privilege model to operations within this share point. By default "inherit privileges" is disabled for afp. To modify the "inherit privileges", AND the following <guest flags> as required: 10 (enable "inherit privileges" for afp only). Spec- ify 00 to turn off "inherit privileges" for the share point all together. -n <customized record name> Specify a <customized record name> to be used as the share point record name. By default the record name is the name of the direc- tory pointed to by the share point record. This directory is specified bt the <path> when the record is created. EXAMPLES
/usr/sbin/sharing -a /SomePath/ShareThisDirectory This example shows how create a share point record for the directory "/SomePath/ShareThisDirectory". /usr/sbin/sharing -e ShareThisDirectory -A SP1 -g 101 This example shows how to edit the share point record created above, adding a customized name "SP1" for afp servies, and enabling guest access only for afp and smb. FILES
/usr/sbin/sharing location of tool Mac OS X Server June 2, 2019 Mac OS X Server