206UsersShare - amagerard/Samba-AD GitHub Wiki

HOME

Return to the Samba-AD

RedHat10/RodcServer.

01- Network 02- RodcServer 03- Settings
05- Software 06- UsersShare
10- GnomeShell 11- TroubleShoots 12- Selinux

6. Users share.

This disk contains :

  • Personal sharing for each users.

Each user will see his personal share folders.
Users will not see the personal share folders of other users.

This disk will be used to store user data.
The format of the disc will be ext4
His name is users.
Users Share need a 10G disk space.
Users Share is installed on another disk.
In the setting of the aoles VM, you will have 3 discs.

  • Disk1 40G ( aoles.dw.learn.lan) Provisonned.
  • Disk2 10G (software share ) Preallocated.
  • Disk3 10G (users share) Preallocated.

6.1 Install Disk 10G.

Reminder: Gnome is installed.
This hypervisor is Proxmox.

Server Aoles.
Log in to a user session with Gnomeshell.
Go to Apps - Utilities and run Disk.
Format the new 10GB disk as EXT4 and name it "users".

Partition: GPT  
Format: Ext4  
Name and label: users  
Information: Note Uuid  
Example Uuid = 71763875-898f-4645-a389-2f9dcc684b33

blkid

/dev/vdc1: LABEL="users" UUID="71763875-898f-4645-a389-2f9dcc684b33" BLOCK_SIZE="4096" TYPE="ext4" PARTUUID="1770c555-b922-48a6-b672-a753f7b7f8c5"

Mount and fstab.
Need /home/users
mkdir /home/users
Fstab.
vi /etc/fstab
Add these lines.

## external users  
UUID=71763875-898f-4645-a389-2f9dcc684b33 /home/users  ext4   defaults,acl,user_xattr,barrier=1   1 2

systemctl daemon-reload
mount /dev/vdc1
mount

/dev/vdc1 on /home/users type ext4 (rw,relatime,seclabel)

Restart the server.
reboot or init 6

6.2 Create a samba sharing.

Add privileges for "Domain Admins".
net rpc rights grant "DW.LEARN\Domain Admins" SeDiskOperatorPrivilege -U "DW.LEARN\administrator"(already done).

Give good right for /home/users
Change share folder permissions.
chown root:"BUILTIN\administrators" /home/users
chmod 710 /home/users
Add ACLs on /home/users
setfacl -m g:"NT Authority\authenticated users":x /home/users

Add Personal folder.
mkdir /home/users/Personal
Give good right for /home/users/Personal
chown root:"BUILTIN\administrators" /home/users/Personal

Edit smb.conf.
vi /etc/samba/smb.conf
Add these line before [sysvol].

# Sharing name  
[Personal]  
        # Sharing path  
        path = /home/users/Personal  
        #  
        #inherit. With this setting enabled, newly created files in this share inherit the permissions  
        #(creator/owner) from the shared-folder.  
        #So it behaves on a similiar way like it does under a windows-based environtment.  
        inherit owner = no  
        inherit permissions = no  
        #  
        # Reading alone  
        read only = no  
        # Browser  
        browseable = no  
        # Guest  
        guest ok = no

Restart samba service.
systemctl restart samba

Add ACLs on /home/users/Personal.
cd /home/users

myfolder=Personal  
setfacl -m u::---  $myfolder  
setfacl -m u:root:rwx $myfolder  
setfacl -m u:"BUILTIN\administrators":rwx  $myfolder  
setfacl -m g::---  $myfolder  
setfacl -m g:"BUILTIN\administrators":rwx $myfolder  
setfacl -m g:"DW.LEARN\Domain Admins":rwx $myfolder  
setfacl -m g:"NT Authority\system":rwx $myfolder  
setfacl -m g:"NT Authority\authenticated users":rwx $myfolder  
setfacl -m mask::rwx $myfolder  
setfacl -m o::---  $myfolder  
setfacl -d -m u::rwx  $myfolder  
setfacl -d -m g::--- $myfolder  
setfacl -d -m g:"users":---  $myfolder  
setfacl -d -m g:"DW.LEARN\Domain Admins":rwx $myfolder  
setfacl -d -m mask::rwx $myfolder  
setfacl -d -m o::--- $myfolder

Restart samba service.
systemctl restart samba

6.3 Give good right on Personal share.

Check users share.
From a computer joined to dw.learn.lan domain.
On the Windows Administrator computer.
Open administrator console.
net use U: \\aoles.dw.learn.lan\Personal

Open File Explorer.
Right click on the network with letter U.

Properties  
Security  
do not edit to change permission.  
Advanced  
Disable the inheritance  (You should see "Enable inheritance").  
Change owner to "Authenticated Users"  
Apply  
Select Administrator(DW.lEARN\Administrator)
Remove
Edit 
Allow   "System"             "Full control"  "This folder,subfolders and files "  
Add  
Select a principal  
Allow  "Authenticated Users"  "Write"        "This folder only"  
Allow   "Creator Owner"      "Full control"   "subfolders and files only"  
Allow   "Domain Admins (DW.LEARN\Domain Admins) "Full control" "This folder,subfolders and files "

Don't forget to have "APPLY" and "OK" before leaving.

6.4 Create a new GPO.

You must install the RSAT on your computer.
Open a session with administrator.

Start button.
Windows tools
Group Policy Management
Forest.dw.learn.lan
Domains
dw.learn.lan

    Group Policy objects.  
       New.  

 Name : Automatic creation folder for user .  
 Edit  
 User Configuration  
  Preferences  
        Windows Settings  
          Folder  
              New Folder  
              Action : Replace  
              Path : \\aoles.dw.learn.lan\Personal\%LogonUser%  
              Common:  
               Run in logged-on user's security context (user policy option)  
                  
        Drive Maps  
              New Mapped Drive  
              Action: Replace  
              Location: \\aoles.dw.learn.lan\Personal\%LogonUser%  
              Reconnect: (yes)  
              Label as : PERSONAL_FOLDER  
              Use : (Letter U)  
              Show this drive: (yes)  
              Show all drives: (yes)  
              Common:  
              Run in logged-on user's security context (user policy option)  
  
               
          ShortCuts  
              New Shortcut  
              Action: Update  
              Name : PERSONAL  
              Target style: File System Object  
              Location : Desktop  
              Target Path :\\aoles.dw.learn.lan\Personal\%LogonUser%  
              Icon File Path: %systemRoot%\System32\SHELL32.dll  
              Icon Index: 150  
              Common:  
               Run in logged-on user's security context (user policy option)

Open Active Directory Users and Computer.
I advise you to create one Organizational Unit to put your users there.

Group Policy Management.
Select the organizational unit you created for your users.
Right Click.
Link an Existing GPO...
Select "Automatic creation folder for user".

Apply your GPO on Organizational Unit.

Open a console .
gpupdate /force

from a computer in the domain.
Log in to a user session.
Do it again a second time.