☰

samba：创建掩码和强制创建模式无法设置组写入位

tag-icon • tag-icon permissions sharing samba4
samba：创建掩码和强制创建模式无法设置组写入位

尝试了创建掩码和强制创建模式的所有组合。无论如何，所有创建的文件都获得了“rw-r--r--”而不是“rw-rw-???”（我不关心“其他”权限）。

smbd 版本 4.1.6-ubuntu（最新版本从 14.04 开始）

以下是 smb.conf 的摘录

[global]
    workgroup = MYDOMAIN
    realm = MYDOMAIN.FQDN
    server string = Файловый сервер %h (%i:%a)
    security = ADS
    allow trusted domains = No
    map to guest = Bad User
    obey pam restrictions = Yes
    pam password change = Yes
    passwd program = /usr/bin/passwd %u
    passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
    unix password sync = Yes
    syslog = 0
    log file = /var/log/samba/%U.%m.log
    max log size = 1000
    load printers = No
    printcap name = /dev/null
    disable spoolss = Yes
    dns proxy = No
    usershare allow guests = Yes
    panic action = /usr/share/samba/panic-action %d
    winbind enum users = Yes
    winbind enum groups = Yes
    winbind refresh tickets = Yes
    recycle:keeptree = yes
    idmap config * : range = 10000-50000
    idmap config * : schema_mode = rid
    idmap config MYDOMAIN : default = yes
    idmap config MYDOMAIN : cache time = 180
    idmap config MYDOMAIN : backend = rid
    idmap config MYDOMAIN : range = 100000-500000
    idmap config MYDOMAIN : schema_mode = rid
    idmap config * : backend = rid
    valid users = @MYDOMAIN\\acl_rsk30srv042_valid, @MYDOMAIN\acl_rsk30srv042_sd-rw, MYDOMAIN\svc_scan_330-001, MYDOMAIN\sysop, eao\administrator, MYDOMAIN\svc_sadm_330-02
    admin users = MYDOMAIN\svc_scan_330-001, MYDOMAIN\svc_sadm_330-02
    create mask = 0775
    force create mode = 0770
    directory mask = 0775
    force directory mode = 0770
    map acl inherit = Yes
    map archive = No
    map readonly = no
    store dos attributes = Yes
    vfs objects = recycle, acl_xattr

[homes]
    comment = %S's personal folder
    path = /home/%D/%U
    valid users = @MYDOMAIN\xall-330
    read only = No
    create mask = 0700
    directory mask = 0700
    browseable = No
    volume = %U-%S
    vfs objects = recycle:keeptree=yes

[IPC$]
    path = /etc/samba/fakeIPC
    valid users = "@MYDOMAIN\domain users", @MYDOMAIN\xall-330, @MYDOMAIN\acl_share_330-sov2014, nobody
    guest ok = Yes

[obmen]
    comment = Common file exchange
    path = /var/samba/obmen
    write list = @MYDOMAIN\acl_rsk30srv042_valid
    force group = MYDOMAIN\xall-330
    read only = No
    force create mode = 0666
    force directory mode = 0666
    guest ok = Yes
    browseable = No
    volume = obmen
    vfs objects = extd_audit, recycle:keeptree=yes

[secret]
    comment = Depts' folders
    path = /var/samba/secret
    guest ok = Yes

[053]
    comment = 053 - IT dept
    path = /var/samba/secret/053
    valid users = @MYDOMAIN\acl_share_330-053-rw
    force group = @MYDOMAIN\acl_share_330-053-rw
    read only = No
    guest ok = Yes
    browseable = No
    vfs objects = recycle:keeptree=yes, extd_audit

文件夹权限：

drwxrwxr-x   2 root root fakeIPC 
drwxrwxrwx   9 nobody MYDOMAIN\xall-330 obmen
dr-xrwxr-x  36 nobody MYDOMAIN\xall-330 secret
drwxrwxrwx 17 nobody MYDOMAIN\acl_share_330-053-rw 053

从 win7 和 Ubuntu 14.04 上试过 - 结果相同。肯定是 samba4 出了问题... 尝试设置

create mask = 0666
directory mask = 2775
force create mode = 774
force directory mode = 2774

新创建的目录获得权限：drwxrwsr-x 但复制的文件仍然获得：-rwxr-xr--

不知道该怎么办...老板强迫我转到 winserver 以避免这种情况......

答案1

已解决（似乎）

问题在于遵守 PAM 限制参数。默认情况下它是关闭的，我不记得为什么我打开它。SAMBA 配置部分取自旧安装，可能是因为我有理由遵守那里的规定 :-)

当它处于 ON 状态时，SAMBA 创建的文件将受到 UMASK 限制。我不知道是否可以通过登录默认值来更正（用户是什么？），但 umask 命令给我“0022”，意思是“u+a gw ow”。

希望它能够帮助遇到类似问题的人。

相关内容