Hi guys, I've got a Samba PDC configured, with authenticating off an LDAP backend.
My client is trying to set permissions through Windows, and for some reason no matter what I try the "everyone" group is always showing up as having access. When an admin user tries to set permissions on the share through windows I get the following errors in my /var/log/messages Feb 27 11:28:16 northcity smbd[16707]: [2008/02/27 11:28:16, 0] smbd/posix_acls.c:create_canon_ace_lists(1468) Feb 27 11:28:16 northcity smbd[16707]: create_canon_ace_lists: malformed ACL in inheritable ACL ! Deny entry after Allow entry. Failing to set on file STORE KPI/filename.txt. I presume this is because he's try to deny the everyone group access after it's being allowed at the top. Below is my smb.conf [global] workgroup = NCW server string = Linux server passdb backend = ldapsam:ldap://localhost username map = /etc/samba/smbusers encrypt passwords = yes log level = 1 log file = /var/log/samba/log.%m max log size = 1000 name resolve order = wins bcast hosts time server = Yes socket options = IPTOS_LOWDELAY TCP_NODELAY add user script = /usr/local/sbin/smbldap-useradd -m "%u" delete user script = /usr/local/sbin/smbldap-userdel "%u" add group script = /usr/local/sbin/smbldap-groupadd -p "%g" delete group script = /usr/local/sbin/smbldap-groupdel "%g" add user to group script = /usr/local/sbin/smbldap-groupmod -m "%u" "%g" delete user from group script = /usr/local/sbin/smbldap-groupmod -x "%u" "%g" set primary group script = /usr/local/sbin/smbldap-usermod -g "%g" "%u" add machine script = /usr/local/sbin/smbldap-useradd -w "%u" logon path = logon drive = Z: logon home = logon script = logon.bat domain logons = Yes os level = 65 domain master = yes preferred master = Yes local master = Yes wins support = Yes ldap admin dn = cn=Manager,dc=northcity,dc=net ldap user suffix = ou=Users ldap group suffix = ou=Groups ldap machine suffix = ou=Computers ldap passwd sync = Yes ldap suffix = dc=northcity,dc=net utmp = Yes admin users = @"Domain Admins" map acl inherit = Yes hide files = */desktop.ini/* nt acl support = yes utmp = yes level2 oplocks = yes oplocks = yes [EMAIL PROTECTED] comment = Document share path = /data create mask = 0770 force user = root writeable = yes guest ok = yes I've tried setting guest ok = no and this makes no difference. If I do getfacl data/ I get the following. # file: data # owner: root # group: root user::rwx group::rwx group:Domain\040Admins:rwx mask::rwx other::--- Below is the output from ls -al on this dir. drwxrwx---+ 8 root root 4096 Feb 26 17:13 data I've tried removing perms, changing perms, changing users/groups using setfacl and normal chown/chmod and nothing I do seems to get rid of the "everyone" group access. Below is more info about my samba version and filesystem info. smbd --version Version 3.0.26a-SerNet-SuSE mount -v /dev/sda6 on / type reiserfs (rw,acl,user_xattr) /dev/sdb1 on /data type ext3 (rw,acl,user_xattr) I've tried the same permissions/acl's on both filesystem types without any luck. I'm running SLES9 Linux 2.6.5-7.257-smp #1 x86_64 Any help will be greatly appreciated. Thanks. Regards. -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba