Linux – Samba share not accessible from Windows 10

Turns out samba was not looking at my user map file. The correct configuration is shown below:

[global]
    log file = /var/log/samba/log.%m
    cups options = raw
    load printers = no
    guest account = oracle
    printing = bsd
    server string = Oracle Recovery Server
    workgroup = UNIX
    debug level = 5
    username map = /etc/samba/smbusers
    null passwords = yes
    encrypt passwords = yes
    security = user
    passdb backend = tdbsam
    max log size = 50


[recovery]
    comment = Recovery Catalog Data
    writeable = yes
    public = yes
    guest only = yes
    guest ok = yes
    valid users = oracle,root
    path = /var/oracle_recovery_catalog

I also had to set my oracle user to a null password: smbpasswd -an oracle.

This configuration does not even require me to change the service to run under another account. WOO HOO!

WARNING: Doing this allows anyone to read/write to the specified share. I am handling security at the firewall level; however if you are implementing this solution you should use something, samba supports a hosts allow directive that may be worth your efforts.

Sorry for no writing this as a comment, but my rep is not high enough for that.

What I see is that you use + as a separator for Domain and Group, but you didn't set the + as the winbind separator in your config.

winbind separator = +

Also you're setting the passdb backend to tdbsam which is a local database. This is probably the reason why your AD authentication fails.

Try setting the following:

workgroup = [SHORTDOMAINNAME]
realm = [KERBEROS REALM / LONG DOMAIN NAME]
password server = [fqdn of your pdc]
winbind use default domain = yes
encrypt passwords = yes
security = ads

the realm and workgroup should be all in caps and match your 'krb5.conf' file

krb5.conf:

[libdefaults]
    default_realm = [KERBEROS REALM / LONG DOMAIN NAME]
    dns_lookup_realm = true
    dns_lookup_kdc = true
    default_tgs_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5 des3-hmac-sha1
    default_tkt_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5 des3-hmac-sha1
    clockskew = 300
    forwardable = true
    proxiable = true

[realms]
    [KERBEROS REALM / LONG DOMAIN NAME] = {
            kdc = [fqdn of your pdc]
            default_domain = [long domain name lowercase]
    }
[domain_realm]
    .[long domain name lowercase] = [KERBEROS REALM / LONG DOMAIN NAME]
    [long domain name lowercase] = [KERBEROS REALM / LONG DOMAIN NAME]

You can also check if everything works with

wbinfo -u 

and you should see the list of users

wbinfo -g 

to see the list of groups.

If you have groups with spaces in the name, don't forget to put them in " in valid users

Hope it helps