Creating fileshares

UCS - Univention Corporate Server
#1

Can somebody point me to a manual / tutorial how to set up properly fileshares permissions with samba for domain. Basically i want to make an archive for my users with creating a share and everyone will have access to it but see only their own folder. I created a share with root as a owner ( default ) and Domain Users as a group. I can see the share but I cant do anything there, even with administrator.

#2

Hey,

Here are the important points you have to set in order for Windows admins to be able to administer the share:

  1. “General” tab

Owner and group: root & “Domain Admins”.
Permissions: Owner and group must have full access (r, w, x); other should have read and list access (r, x).

The important thing here is to give the domain administrators basic write access and all others read access only.

  1. “Samba” tab

Enable “Samba write access” and “Users with write access may modify permissions”. That way domain administrators can not only create directories but actually change the permissions.

  1. “Advanced settings” tab

Only change settings in the “Samba persmissions” section. Leave everything at their defaults, especially the “Samba extended persmissions”.

Enable “NT ACL support”, “Inherit ACLs” and both “Create files/directories with…” options.

That’s it.

Now you can fully manage permissions from Windows if you’re a domain administrator.

As for your specific use case: next you should create one directory per user and make sure that only that user can access it. This is trivial and can be done on Linux. Just set the owner to the user you want to give permissions to (usually you name the directory after their owners in such a case, just like home directories) and assign file permissions as follows: owner = rwx, group & other = none. Example:

cd /srv/shares/permtest for name in jtkirk spock lmccoy mscott hsulu pcheckov nuhura; do mkdir $name chown $name: $name chmod 0700 $name done

Kind regards,
mosu





#3

Thnx you for your reply.

#4

Hi Mosu,

Thanks a lot for this explanation. you saved my ass. I was really struggling to create shares that could be managed via Windows but it didnt work. I was just about to give up and then I saw your answer (with even screenshots!!). Thought its almost one year, I really appreciate this.

Mastodon