Linux – Creating Samba shares across multiple servers from a single LDAP server

ldaplinuxsamba

We have a Fedora Directory Server running LDAP, where a few hundred users exist. We need a way we can create samba shares depending on projects and limit access to these shares across multiple Linux servers.

Here we have 15-20 servers each running different versions of CentOS. Idea is to create folders depending on groups where read/write access is limited to just that group or a subset of users of the specific group.

How do we authenticate users and create Samba Shares in another server in the same subnet. Users use Windows Professional, and they should be accessing a specific samba share to backup files for specific servers.

I need to create a single form, where the admin can create a folder by choosing the server, and assign users accordingly. Ideas welcome on how to go about this.

Best Answer

There should be no problem at all. I have using the following config in production environment

[global]

    workgroup = SYSADM
    server string = File server
    netbios name = FS1
    security = domain

    load printers = no
    show add printer wizard = no
    printcap name = /dev/null
    disable spoolss = yes

    encrypt passwords = yes

    winbind enum groups = yes
    winbind enum users = yes

    idmap backend = ldap:"ldap://pdc.example.net/"
    ldap idmap suffix = ou=idmap

    idmap uid = 1000-500000
    idmap gid = 1000-500000

    idmap config SYSADM : backend  = nss
    idmap config SYSADM : range = 1000-500000

    ldapsam:trusted = yes
    ldapsam:editposix = yes

    ldap suffix = dc=example,dc=net
    ldap user suffix = ou=users
    ldap group suffix = ou=groups
    ldap machine suffix = ou=computers

    ldap admin dn = "uid=ldap_reader,ou=users,dc=example,dc=net"

    enable privileges = yes

    os level = 3
    local master = no
    domain master = no
    preferred master = no
    domain logons = no

    client ntlmv2 auth = yes
    client plaintext auth = no

    lanman auth = no
    lm announce = no

    display charset = utf8
    unix charset = utf8
    dos charset = cp866

    log level  = 3
    host msdfs  = no

[Department1]
    comment = Department1
    path = /samba/department1/
    public=yes
    guest ok = no
    write list = user1, @"SYSADM\department1"
    valid users = @"SYSADM\department1"
    browseable = yes
    force create mode = 0770
    create mode = 0770
    force directory mode = 0770
    directory mode = 0770
    vfs objects = full_audit
    full_audit:prefix = [Department1]:%u|%I
    full_audit:success = write rmdir rename mkdir unlink open read pread write pwrite
    full_audit:failure = none
    full_audit:facility = LOCAL1
    full_audit:priority = ALERT
Related Topic