|
|
Sponsored Content
Top Forums
UNIX for Dummies Questions & Answers
Samba with clients in multiple domains
Post 302597156 by rbatte1 on Thursday 9th of February 2012 11:21:39 AM
02-09-2012
Moderator
Samba with clients in multiple domains
Dear all,
I've not a good starting point I'm afraid, but I was forced to deploy Samba under pressure of failing hardware so an urgent migration was done. We didn't get the IBM AIX 6.1 supplied one running at all, so we pulled down the samba.org version 3.4.3. We couldn't get that working as we wished, but it did at least share. It has been merrily allowing any request to mount (read-only) the shares. All was well with the function, but obviously it is not appropriate for the sensitive data was are sharing. The setting I had to put in was security=SHARE and on each share, we have guest login allowed.
My problem is that our clients are in at least two domains and the server is standalone, i.e. no LDAP or whatever connection set up on the operating system in /etc/netsrv.conf or anything. We are an outsourcing company so we have our servers & users and the client company users all wanting to access the data.
I've tried reading the manual pages, but I have to understand much more about security and protocols than I do to get my foot in the door, so to speak. The more I try to find out, the more confused I get.
What I have tried has always prevented any access. Great for security, but useless for actually operating the business.
It has been parked for quite a while now especially as the failing hardware also allowed guest connections so I had nothing to compare to. I've now forgotten what attempts I have made, but now Internal Audit are on my case to lock it down. Can anyone point me in the right direction? I would prefer to grant access to an Active Directory group of users if that is possible, but then it needs to validate the user on more than one domain......um?
My head hurts already.
Full config (slightly sanitised) can be posted if this is useful, but I didn't want to flood the thread first off.
Robin
Liverpool/Blackburn
UK
I've not a good starting point I'm afraid, but I was forced to deploy Samba under pressure of failing hardware so an urgent migration was done. We didn't get the IBM AIX 6.1 supplied one running at all, so we pulled down the samba.org version 3.4.3. We couldn't get that working as we wished, but it did at least share. It has been merrily allowing any request to mount (read-only) the shares. All was well with the function, but obviously it is not appropriate for the sensitive data was are sharing. The setting I had to put in was security=SHARE and on each share, we have guest login allowed.
My problem is that our clients are in at least two domains and the server is standalone, i.e. no LDAP or whatever connection set up on the operating system in /etc/netsrv.conf or anything. We are an outsourcing company so we have our servers & users and the client company users all wanting to access the data.
I've tried reading the manual pages, but I have to understand much more about security and protocols than I do to get my foot in the door, so to speak. The more I try to find out, the more confused I get.
What I have tried has always prevented any access. Great for security, but useless for actually operating the business.It has been parked for quite a while now especially as the failing hardware also allowed guest connections so I had nothing to compare to. I've now forgotten what attempts I have made, but now Internal Audit are on my case to lock it down. Can anyone point me in the right direction? I would prefer to grant access to an Active Directory group of users if that is possible, but then it needs to validate the user on more than one domain......um?
My head hurts already.
Full config (slightly sanitised) can be posted if this is useful, but I didn't want to flood the thread first off.
Robin
Liverpool/Blackburn
UK
|
|
10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
Hello,
I have 3 domains virtually hosted "name based" the first one "domain1.com" has its ServerName entered as domain1.com. this domain will load in a browser by www.domain1.com or simply domain1.com. the next two domains "domain2.com" and "domain3.com" ServerNames are listed as domain2.com and... (2 Replies)
Discussion started by: ericg
2 Replies
2. UNIX for Dummies Questions & Answers
I need help creating multiple domains with one single DNS server.ex: domain1.com and domain2.com on a sigle machine 1.2.3.4
Thx (1 Reply)
Discussion started by: lekan
1 Replies
3. Solaris
Hi there:
I am currently using Kerberos on Solaris 9 to autenticate using windows active directory. It is working fine, however, we just were made aware that instead of one domain, we have multiple. We configured one real with only one domain, however, I need the autentication process to also... (3 Replies)
Discussion started by: ramosl05
3 Replies
4. Solaris
We have a WAN boot jumpstart server which works fine .. we have a requirement wherein we would require to jumpstart multiple sparc servers simultaneously, Whats the way .. so that we do not have to wait for a cleint to complete the installation before starting with another server.
Any help would... (1 Reply)
Discussion started by: fugitive
1 Replies
5. UNIX for Advanced & Expert Users
Hello all. I'm hoping you can help with a problem I'm having with Samba. I have Samba running on a Solaris host. All of my users authenticate against the same domain, but some of my users are using PCs on a different domain. When the users whose PCs are on a different domain try to connect to... (0 Replies)
Discussion started by: trouphaz
0 Replies
6. Programming
hello everyone,
i am making a tcp chat server using c in linux. i have used socket programming to connect the server and the client.
can anyone please let me know how i can use forking for multiple clients??
thank you (1 Reply)
Discussion started by: sweetbella
1 Replies
7. Red Hat
Hello Friends,
I am running Sendmail 8.14 on rhel6. I have one simple question regarding domain masquerading, i would want to masquerade different domains with different addresses. By that what i mean is that lets say i have 3 domains as home.com, example.com, test.com and i would want to... (0 Replies)
Discussion started by: Rohit Bhanot
0 Replies
8. Red Hat
Hi,
We now have a Samba or Winbind issue. The Linux client under RHEL6 can not get Windows' AD sub-domain info. See the following output please. The main domain 'Global' is shown online, but the sub-domain 'Europe' and 'Asia' are shown offline although they are online.
Commands 'wbinfo -u' and... (0 Replies)
Discussion started by: aixlover
0 Replies
9. UNIX and Linux Applications
Hi Guys,
Kindly advise what options/settings needed in smb.conf to support win7.
currently we are experiencing slow connection issues from our recently upgraded win7 from XP to our Samba server ver. 3.0.33-3.7.el5_3.1 (1 Reply)
Discussion started by: RobertG
1 Replies
10. UNIX for Beginners Questions & Answers
Can you add multiple domains to a nameserver without creating a new IP address? I have one IP address on my machine and have configured forward and reverse zone files. Names are resolving fine.
I know I can add another domain to the named.conf file and create new forward and reverse files. what... (2 Replies)
Discussion started by: LinuxGirl
2 Replies
LEARN ABOUT CENTOS
vfs_acl_xattr
VFS_ACL_XATTR(8) System Administration tools VFS_ACL_XATTR(8) NAME
vfs_acl_xattr - Save NTFS-ACLs in Extended Attributes (EAs) SYNOPSIS
vfs objects = acl_xattr DESCRIPTION
This VFS module is part of the samba(7) suite. The vfs_acl_xattr VFS module stores NTFS Access Control Lists (ACLs) in Extended Attributes (EAs). This enables the full mapping of Windows ACLs on Samba servers. The ACLs are stored in the Extended Attribute security.NTACL of a file or directory. This Attribute is not listed by getfattr -d filename. To show the current value, the name of the EA must be specified (e.g. getfattr -n security.NTACL filename). This module is stackable. OPTIONS
acl_xattr:ignore system acls = [yes|no] When set to yes, a best effort mapping from/to the POSIX ACL layer will not be done by this module. The default is no, which means that Samba keeps setting and evaluating both the system ACLs and the NT ACLs. This is better if you need your system ACLs be set for local or NFS file access, too. If you only access the data via Samba you might set this to yes to achieve better NT ACL compatibility. AUTHOR
The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed. Samba 4.0 06/17/2014 VFS_ACL_XATTR(8)