Accessing Samba Shares using winbind

Latest response

I have a RHEL 6 box setup successfully using winbind. I can SSH over to the Linux box and logon using my AD account. I can also see AD users and groups using wbinfo and etc.

I also have SAMBA up sharing out a directory. I can browse to this server and see the directory share via my Windows 7 workstation however when I click on the share it says "access denied" I cannot figure out why my AD account is getting access denied on this share.

Below is my global setting and my share config.

Any help would be appreciated!

#======================= Global Settings =====================================

[global]
#--authconfig--start-line--

# Generated by authconfig on 2013/11/05 12:07:43
# DO NOT EDIT THIS SECTION (delimited by --start-line--/--end-line--)
# Any modification may be deleted or altered by authconfig in future

workgroup = myworkgroup
password server = domain controller
realm = MYDOMAIN.COM
security = ads
idmap config * : backend = tdb
idmap config * : range = 16777216-33554431
idmap config MYDOMAIN:backend = rid
idmap config MYDOMAIN:range = 100000-199999
idmap config MYDOMAIN:base_rid = 0

# idmap backend = rid
# below line a test
# idmap config * : backend = rid
template shell = /bin/bash
winbind use default domain = true
winbind offline logon = false
# additional testing - next three lines made no difference
# winbind separator = +
# winbind enum users = yes
# winbind enum groups = yes

#--authconfig--end-line--

# ----------------------- Domain Members Options ------------------------
#
# Security must be set to domain or ads
#
# Use the realm option only with security = ads
# Specifies the Active Directory realm the host is part of
#
# Backend to store user information in. New installations should
# use either tdbsam or ldapsam. smbpasswd is available for backwards
# compatibility. tdbsam requires no further configuration.
#
# Use password server option only with security = server or if you can't
# use the DNS to locate Domain Controllers
# The argument list may include:
# password server = My_PDC_Name [My_BDC_Name] [My_Next_BDC_Name]
# or to auto-locate the domain controller/s
# password server = *

security = domain
passdb backend = tdbsam
realm = MYDOMAIN.COM

password server = domaincontroller.mydomain.com

[testdir]
path = /testdir
write list = "MYDOMAIN+Domain Users"
browseable = yes
guest ok = yes

ag
Log in to join the conversation

Responses

SS Red Hat Active Contributor 399 points
11 February 2014 6:05 AM

Hi,

Here is a minimum configuration for linux machine to join active directory using winbind mechanism, I saw some confliction in your configuration file, you defined

security = domain
passdb backend = tdbsam
realm = MYDOMAIN.COM
password server = domaincontroller.rustconsulting.com

Section already in GLOBAL, but at the end of configuration you defined it again, I guess you need to remove them, however it's working, but this doesn't come under best practice.

[global]
   workgroup = IDM
   realm = IDM.EXAMPLE.COM
   log level = 2
   syslog = 0
   server string = Linux File Server
   security = ads
   log file = /var/log/samba/%m
   max log size = 50
   winbind enum users = Yes
   winbind enum groups = Yes
   winbind use default domain = true
   winbind separator = +
   template shell = /bin/bash
   idmap config * : backend        = tdb
   idmap config * : range          = 16777216-33554431

   idmap config IDM:backend = rid
   idmap config IDM:range = 100000-199999               <--- change as per requirements.
   idmap config IDM:base_rid = 0

As far as share is concerened, you need to define valid users in shared section to access that share.
below is example for your reference:

[Test Share]
comment = For testing
path = /onlyusers
read only = yes
guest ok = no
printable = no
valid users = +"IDM\Domain Users"
write list = +"IDM\Domain Users"
browseable = yes

Considering you have sufficient permission(s) on "/onlyusers" by members of "IDM\Domain Users" and domain is already joined.

Restrat the service of samba and winbind, try to access the share.

Savitoj

ag Community Member 25 points
11 February 2014 4:21 PM

Okay, so I finally got this working. I'll post my smb.conf file and tell you what I believe did the final trick.

[global]
workgroup = MYDOMAIN
realm = MYDOMAIN.COM
server string = Samba Server Version %v
security = ADS
password server = domain_controller.MYDOMAIN.com
log file = /var/log/samba/log.%m
max log size = 50
template shell = /bin/bash
winbind enum users = Yes
winbind enum groups = Yes
winbind use default domain = Yes
winbind normalize names = Yes
idmap config MYDOMAIN:base_rid = 0
idmap config MYDOMAIN:range = 100000-199999
idmap config MYDOMAIN:backend = rid
idmap config * : range = 16777216-33554431
idmap config * : backend = tdb
cups options = raw

[users]
path = /home/users
valid users = "@MYDOMAIN\Domain Users"
read only = No

The final trick was to follow the specific example in the Samba Selinux Policy Documentation. The example I followed is below

FILE_CONTEXTS
SELinux requires files to have an extended attribute to define the file
type. Policy governs the access daemons have to these files. If you
want to share files other than home directories, those files must be
labeled samba_share_t. So if you created a special directory /var/eng,
you would need to label the directory with the chcon tool.

chcon -t samba_share_t /var/eng

To make this change permanent (survive a relabel), use the semanage
command to add the change to file context configuration:

semanage fcontext -a -t samba_share_t "/var/eng(/.*)?"
This command adds the following entry to /etc/selinux/POLICYTYPE/con‐
texts/files/file_contexts.local:

/var/eng(/.*)? system_ubject_r:samba_share_t:s0

Run the restorecon command to apply the changes:

restorecon -R -v /var/eng/

I created a new test directory and applied the above to label the directory for sharing and the new directory instantly came up!

Thanks for your insight!

SS Red Hat Active Contributor 399 points
12 February 2014 2:57 AM

Hi,

Glad to know, you have working winbind, along with share by restoring SELinux context.

You're welcome.

Savitoj

Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.