With a Samba server, we can make a DC (Domain Controler). Simplifying the meaning of DC, it’s a server where will be stored accounts for the network users. The Samba, is based on the Windows NT and because this, it has many features of the NT server.
One of these features, is groups of users. The main groups of a NT domain are the following ones:
Nt Group
|
Description
| RID (Relative Identifier) |
Domain Admins | Domain administrators | 512 |
Domain Users | Domain Users | 513 |
When a computer join the domain, it’s created these ( and others ) groups. This make the users of these groups have the same privileges as in the domain. But in the Linux, no one of these groups have a corresponding until you say so. To do so, you need specify which groups of the Linux represent the NT groups (Samba).
All we need to do in is create groups to be maped with their respectives on the samba. We will create the groups “ntadmin” and “ntuser“.
groupadd ntadmin
groupadd ntuser
Now we need map these groups in the Samba. To do this, we will use the comand “net“.
net groupmap add ntgroup=”Domain Admins” unixgroup=ntadmin rid=512 type=d comment=”Administradores”
net groupmap add ntgroup=”Domain Users” unixgroup=ntuser rid=513 type=d comment=”Usuários”
We can create now, new users and add them in that group. This is done passing the -g parameter with “useradd“.
useradd -g group userr
Example: useradd -g ntadmin trufelli
If the user already exist, we can change the primary group with the command “usermod” and we need change this user group in samba with the “pdbeit“, we will specify the group in samba with theRID of the group.
usermod -g group user
Example: usermod -g ntadmin trufelli
pdbedit -r -G Group_RID -u User
Example: pdbedit -r -G 512 -u trufelli
All admin users will have access to all shares with admin privileges. To change this, we can add the following options in the share configs:
invalid users = @ntadmin
With this parameter, any member of the group “ntadmin“ couldn’t access to that share.