Active Directory Windows share folder from Debian samba
Clash Royale CLAN TAG#URR8PPP
up vote
3
down vote
favorite
This is what I have:
- Group of computers under DOMAIN.LOCAL and all users provided by Active Directory in Windows Server
- Debian server
- Windows AD, DC server
What I need:
- Share a folder from my DebianServer to the other computers so they authenticate with their own users provided by windows AD
What I have already done:
- My DebianServer is already in the DOMAIN.LOCAL
- I can login to DebianServer with all the AD users from windows
What I can't:
- Access the shared folder with the DOMAIN.LOCAL users
Important files:
/etc/nsswitch.conf
passwd: compat sss
group: compat sss
shadow: compat sss
gshadow: files
hosts: files mdns4_minimal [NOTFOUND=return] dns
networks: files
protocols: db files
services: db files sss
ethers: db files
rpc: db files
netgroup: nis sss
sudoers: files sss
/etc/sssd/sssd.conf
[sssd]
services = nss, pam
config_file_version = 2
domains = DOMAIN.LOCAL
[domain/DOMAIN.LOCAL]
id_provider = ad
override_homedir = /home/%d/%u
access_provider = simple
/etc/krb5.conf
[libdefaults]
default_realm = DOMAIN.LOCAL
ticket_lifetime=24h
renew_lifetime=7d
dns_lookup_realm = false
dns_lookup_kdc = false
#estaba en TRUE arriba
# The following krb5.conf variables are only for MIT Kerberos.
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
fcc-mit-ticketflags = true
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[realms]
DOMAIN.LOCAL =
kdc=192.168.0.180:88
admin_server=192.168.0.180:464
default_domain=domain.local
[domain_realm]
.domain.local=DOMAIN.LOCAL
domain.local=DOMAIN.LOCAL
/etc/samba/smb.conf
[global]
workgroup = DOMAIN
security = ads
realm = DOMAIN.LOCAL
template homedir = /home/%D/%U
template shell = /bin/bash
client signing=yes
client use spnego=yes
kerberos method=secrets and keytab
[homes]
comment = Home Directories
browseable = no
read only = yes
create mask = 0700
directory mask = 0700
valid users = %S
[Compartido]
path=/home/DebianUser/Compartido
comment=compartido
browseable=yes
read only=no
valid users=@"DOMAIN.LOCALusersgroup"
debian networking windows samba
asked Feb 1 at 12:32
arturo.mj
162
 |Â
show 1 more comment
up vote
3
down vote
favorite
This is what I have:
- Group of computers under DOMAIN.LOCAL and all users provided by Active Directory in Windows Server
- Debian server
- Windows AD, DC server
What I need:
- Share a folder from my DebianServer to the other computers so they authenticate with their own users provided by windows AD
What I have already done:
- My DebianServer is already in the DOMAIN.LOCAL
- I can login to DebianServer with all the AD users from windows
What I can't:
- Access the shared folder with the DOMAIN.LOCAL users
Important files:
/etc/nsswitch.conf
passwd: compat sss
group: compat sss
shadow: compat sss
gshadow: files
hosts: files mdns4_minimal [NOTFOUND=return] dns
networks: files
protocols: db files
services: db files sss
ethers: db files
rpc: db files
netgroup: nis sss
sudoers: files sss
/etc/sssd/sssd.conf
[sssd]
services = nss, pam
config_file_version = 2
domains = DOMAIN.LOCAL
[domain/DOMAIN.LOCAL]
id_provider = ad
override_homedir = /home/%d/%u
access_provider = simple
/etc/krb5.conf
[libdefaults]
default_realm = DOMAIN.LOCAL
ticket_lifetime=24h
renew_lifetime=7d
dns_lookup_realm = false
dns_lookup_kdc = false
#estaba en TRUE arriba
# The following krb5.conf variables are only for MIT Kerberos.
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
fcc-mit-ticketflags = true
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[realms]
DOMAIN.LOCAL =
kdc=192.168.0.180:88
admin_server=192.168.0.180:464
default_domain=domain.local
[domain_realm]
.domain.local=DOMAIN.LOCAL
domain.local=DOMAIN.LOCAL
/etc/samba/smb.conf
[global]
workgroup = DOMAIN
security = ads
realm = DOMAIN.LOCAL
template homedir = /home/%D/%U
template shell = /bin/bash
client signing=yes
client use spnego=yes
kerberos method=secrets and keytab
[homes]
comment = Home Directories
browseable = no
read only = yes
create mask = 0700
directory mask = 0700
valid users = %S
[Compartido]
path=/home/DebianUser/Compartido
comment=compartido
browseable=yes
read only=no
valid users=@"DOMAIN.LOCALusersgroup"
debian networking windows samba
asked Feb 1 at 12:32
arturo.mj
162
Have you set up domain permissions on the individual directories?
– Raman Sailopal
Feb 1 at 12:48
The point is that I have not been able. Using: "chown -R root:MY_AD_GROUP /my_shared_folder" doesn't work
– arturo.mj
Feb 1 at 12:57
Can you see the domain users with "getent passwd"
– Raman Sailopal
Feb 1 at 13:05
No. But I can login and I try "kinit user" "klist" and works fine.
– arturo.mj
Feb 1 at 21:51
If I use "getent passw USER_FROM_DOMAIN" I get what it is supposed, but when I use just "getent passw" I only get the local users
– arturo.mj
Feb 2 at 8:22
 |Â
show 1 more comment
up vote
3
down vote
favorite
up vote
3
down vote
favorite
This is what I have:
- Group of computers under DOMAIN.LOCAL and all users provided by Active Directory in Windows Server
- Debian server
- Windows AD, DC server
What I need:
- Share a folder from my DebianServer to the other computers so they authenticate with their own users provided by windows AD
What I have already done:
- My DebianServer is already in the DOMAIN.LOCAL
- I can login to DebianServer with all the AD users from windows
What I can't:
- Access the shared folder with the DOMAIN.LOCAL users
Important files:
/etc/nsswitch.conf
passwd: compat sss
group: compat sss
shadow: compat sss
gshadow: files
hosts: files mdns4_minimal [NOTFOUND=return] dns
networks: files
protocols: db files
services: db files sss
ethers: db files
rpc: db files
netgroup: nis sss
sudoers: files sss
/etc/sssd/sssd.conf
[sssd]
services = nss, pam
config_file_version = 2
domains = DOMAIN.LOCAL
[domain/DOMAIN.LOCAL]
id_provider = ad
override_homedir = /home/%d/%u
access_provider = simple
/etc/krb5.conf
[libdefaults]
default_realm = DOMAIN.LOCAL
ticket_lifetime=24h
renew_lifetime=7d
dns_lookup_realm = false
dns_lookup_kdc = false
#estaba en TRUE arriba
# The following krb5.conf variables are only for MIT Kerberos.
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
fcc-mit-ticketflags = true
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[realms]
DOMAIN.LOCAL =
kdc=192.168.0.180:88
admin_server=192.168.0.180:464
default_domain=domain.local
[domain_realm]
.domain.local=DOMAIN.LOCAL
domain.local=DOMAIN.LOCAL
/etc/samba/smb.conf
[global]
workgroup = DOMAIN
security = ads
realm = DOMAIN.LOCAL
template homedir = /home/%D/%U
template shell = /bin/bash
client signing=yes
client use spnego=yes
kerberos method=secrets and keytab
[homes]
comment = Home Directories
browseable = no
read only = yes
create mask = 0700
directory mask = 0700
valid users = %S
[Compartido]
path=/home/DebianUser/Compartido
comment=compartido
browseable=yes
read only=no
valid users=@"DOMAIN.LOCALusersgroup"
debian networking windows samba
asked Feb 1 at 12:32
arturo.mj
162
This is what I have:
- Group of computers under DOMAIN.LOCAL and all users provided by Active Directory in Windows Server
- Debian server
- Windows AD, DC server
What I need:
- Share a folder from my DebianServer to the other computers so they authenticate with their own users provided by windows AD
What I have already done:
- My DebianServer is already in the DOMAIN.LOCAL
- I can login to DebianServer with all the AD users from windows
What I can't:
- Access the shared folder with the DOMAIN.LOCAL users
Important files:
/etc/nsswitch.conf
passwd: compat sss
group: compat sss
shadow: compat sss
gshadow: files
hosts: files mdns4_minimal [NOTFOUND=return] dns
networks: files
protocols: db files
services: db files sss
ethers: db files
rpc: db files
netgroup: nis sss
sudoers: files sss
/etc/sssd/sssd.conf
[sssd]
services = nss, pam
config_file_version = 2
domains = DOMAIN.LOCAL
[domain/DOMAIN.LOCAL]
id_provider = ad
override_homedir = /home/%d/%u
access_provider = simple
/etc/krb5.conf
[libdefaults]
default_realm = DOMAIN.LOCAL
ticket_lifetime=24h
renew_lifetime=7d
dns_lookup_realm = false
dns_lookup_kdc = false
#estaba en TRUE arriba
# The following krb5.conf variables are only for MIT Kerberos.
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
fcc-mit-ticketflags = true
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[realms]
DOMAIN.LOCAL =
kdc=192.168.0.180:88
admin_server=192.168.0.180:464
default_domain=domain.local
[domain_realm]
.domain.local=DOMAIN.LOCAL
domain.local=DOMAIN.LOCAL
/etc/samba/smb.conf
[global]
workgroup = DOMAIN
security = ads
realm = DOMAIN.LOCAL
template homedir = /home/%D/%U
template shell = /bin/bash
client signing=yes
client use spnego=yes
kerberos method=secrets and keytab
[homes]
comment = Home Directories
browseable = no
read only = yes
create mask = 0700
directory mask = 0700
valid users = %S
[Compartido]
path=/home/DebianUser/Compartido
comment=compartido
browseable=yes
read only=no
valid users=@"DOMAIN.LOCALusersgroup"
debian networking windows samba
asked Feb 1 at 12:32
arturo.mj
162
edited Feb 5 at 12:54
asked Feb 1 at 12:32
arturo.mj
162
asked Feb 1 at 12:32
arturo.mj
162
asked Feb 1 at 12:32
arturo.mj
162
162
Have you set up domain permissions on the individual directories?
– Raman Sailopal
Feb 1 at 12:48
The point is that I have not been able. Using: "chown -R root:MY_AD_GROUP /my_shared_folder" doesn't work
– arturo.mj
Feb 1 at 12:57
Can you see the domain users with "getent passwd"
– Raman Sailopal
Feb 1 at 13:05
No. But I can login and I try "kinit user" "klist" and works fine.
– arturo.mj
Feb 1 at 21:51
If I use "getent passw USER_FROM_DOMAIN" I get what it is supposed, but when I use just "getent passw" I only get the local users
– arturo.mj
Feb 2 at 8:22
 |Â
show 1 more comment
Have you set up domain permissions on the individual directories?
– Raman Sailopal
Feb 1 at 12:48
The point is that I have not been able. Using: "chown -R root:MY_AD_GROUP /my_shared_folder" doesn't work
– arturo.mj
Feb 1 at 12:57
Can you see the domain users with "getent passwd"
– Raman Sailopal
Feb 1 at 13:05
No. But I can login and I try "kinit user" "klist" and works fine.
– arturo.mj
Feb 1 at 21:51
If I use "getent passw USER_FROM_DOMAIN" I get what it is supposed, but when I use just "getent passw" I only get the local users
– arturo.mj
Feb 2 at 8:22
Have you set up domain permissions on the individual directories?
– Raman Sailopal
Feb 1 at 12:48
Have you set up domain permissions on the individual directories?
– Raman Sailopal
Feb 1 at 12:48
The point is that I have not been able. Using: "chown -R root:MY_AD_GROUP /my_shared_folder" doesn't work
– arturo.mj
Feb 1 at 12:57
The point is that I have not been able. Using: "chown -R root:MY_AD_GROUP /my_shared_folder" doesn't work
– arturo.mj
Feb 1 at 12:57
Can you see the domain users with "getent passwd"
– Raman Sailopal
Feb 1 at 13:05
Can you see the domain users with "getent passwd"
– Raman Sailopal
Feb 1 at 13:05
No. But I can login and I try "kinit user" "klist" and works fine.
– arturo.mj
Feb 1 at 21:51
No. But I can login and I try "kinit user" "klist" and works fine.
– arturo.mj
Feb 1 at 21:51
If I use "getent passw USER_FROM_DOMAIN" I get what it is supposed, but when I use just "getent passw" I only get the local users
– arturo.mj
Feb 2 at 8:22
If I use "getent passw USER_FROM_DOMAIN" I get what it is supposed, but when I use just "getent passw" I only get the local users
– arturo.mj
Feb 2 at 8:22
 |Â
show 1 more comment
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Â
draft saved
draft discarded
Â
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f421192%2factive-directory-windows-share-folder-from-debian-samba%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Have you set up domain permissions on the individual directories?
– Raman Sailopal
Feb 1 at 12:48
The point is that I have not been able. Using: "chown -R root:MY_AD_GROUP /my_shared_folder" doesn't work
– arturo.mj
Feb 1 at 12:57
Can you see the domain users with "getent passwd"
– Raman Sailopal
Feb 1 at 13:05
No. But I can login and I try "kinit user" "klist" and works fine.
– arturo.mj
Feb 1 at 21:51
If I use "getent passw USER_FROM_DOMAIN" I get what it is supposed, but when I use just "getent passw" I only get the local users
– arturo.mj
Feb 2 at 8:22