Salut,

Le serveur sur lequel nous travaillons actuellement est sous Debian Squeezy. Ce serveur est membre d'un domaine Samba/LDAP. Nous rencontrons des problèmes lors des accès aux partages de ce serveur.
Certains partages sensibles contiennent le paramètre "valid users" qui contient les groupes (@direction) ayant le droit d'accéder à ce partage.
Le souci que l'on a c'est que si un des utilisateurs appartient au groupe Direction mais qu'il s'agit d'un groupe secondaire et bien il ne peut pas rentrer dans le partage...

Lorsque je lance une commande id username j'obtiens bien tous les groupes du username. C'est, à priori, Samba (3.6.6) qui zappe les groupes secondaires...

Quelqu'un aurait déjà rencontré ce problème ?

smb.conf
Code : Sélectionner tout - Visualiser dans une fenêtre à part
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
 
#======================= Global Settings =======================
 
[global]
 
## Browsing/Identification ###
 
# Change this to the workgroup/NT-domain name your Samba server will part of
   workgroup = DOMAIN
 
# server string is the equivalent of the NT Description field
   server string = %h server
   netbios name = SERVER
 
# Windows Internet Name Serving Support Section:
# WINS Support - Tells the NMBD component of Samba to enable its WINS Server
#   wins support = no
 
# WINS Server - Tells the NMBD components of Samba to be a WINS Client
# Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
   wins server = X.X.X.X
 
# This will prevent nmbd to search for NetBIOS names through DNS.
   dns proxy = no
 
# What naming service and in what order should we use to resolve host names
# to IP addresses
;   name resolve order = lmhosts host wins bcast
 
#### Networking ####
 
# The specific set of interfaces / networks to bind to
# This can be either the interface name or an IP address/netmask;
# interface names are normally preferred
   interfaces = eth0
 
# Only bind to the named interfaces and/or networks; you must use the
# 'interfaces' option above to use this.
# It is recommended that you enable this feature if your Samba machine is
# not protected by a firewall or is a firewall itself.  However, this
# option cannot handle dynamic or non-broadcast interfaces correctly.
   bind interfaces only = yes
 
## Debugging/Accounting ####
 
# This tells Samba to use a separate log file for each machine
# that connects
#   log file = /var/log/samba/log.%m
log level = 3
 
# Cap the size of the individual log files (in KiB).
#   max log size = 1000
 
# If you want Samba to only log through syslog then set the following
# parameter to 'yes'.
#   syslog only = no
 
# We want Samba to log a minimum amount of information to syslog. Everything
# should go to /var/log/samba/log.{smbd,nmbd} instead. If you want to log
# through syslog you should set the following parameter to something higher.
   syslog = 0
 
# Do something sensible when Samba crashes: mail the admin a backtrace
   panic action = /usr/share/samba/panic-action %d
 
 
####### Authentication #######
 
# "security = user" is always a good idea. This will require a Unix account
# in this server for every user accessing the server. See
# /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/ServerType.html
# in the samba-doc package for details.
   security = domain
 
# You may wish to use password encryption.  See the section on
# 'encrypt passwords' in the smb.conf(5) manpage before enabling.
   encrypt passwords = true
 
# Serveurs que Samba doit interroger pour valider le couple identifiant/mdp fournit par le client
# password server = X.X.X.X
 
local master = no
domain master = no
preferred master = no
 
########## Printing ##########
 
# CUPS printing.  See also the cupsaddsmb(8) manpage in the
# cupsys-client package.
   printing = cups
   printcap name = cups
 
############ Misc ############
 
# Most people will find that this option gives better performance.
# See smb.conf(5) and /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/speed.html
# for details
# You may want to add the following on a Linux system:
#         SO_RCVBUF=8192 SO_SNDBUF=8192
   socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
 
winbind use default domain = Yes
nt acl support = Yes
msdfs root = Yes
 
#======================= Share Definitions =======================
 
[printers]
   comment = All Printers
   browseable = yes
   path = /var/spool/samba
   printable = yes
   guest ok = yes
   read only = yes
   use client driver = yes
   create mask = 0700
 
[Direction]
path = /data/Bureautique/Direction
browseable = no
writeable = yes
force group = direction
valid users = @direction,@admins
create mode = 760
directory mode = 770
vfs object = recycle
recycle:repository = 0_Corbeille
recycle:exclude = *.tmp,*.TMP,*.ldb,*.LDB
recycle:keeptree = Yes
recycle:versions = Yes
recycle:touch = Yes
 
[Gestion]
path = /data/Bureautique/Gestion
force group = gestion
browseable = no
writeable = yes
valid users = @direction,@gestion,@admins
create mode = 760
directory mode = 770
vfs object = recycle
recycle:repository = 0_Corbeille
recycle:exclude = *.tmp,*.TMP,*.ldb,*.LDB
recycle:keeptree = Yes
recycle:versions = Yes
recycle:touch = Yes
nsswitch.conf
Code : Sélectionner tout - Visualiser dans une fenêtre à part
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
 
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.
 
passwd:         compat ldap
group:          compat ldap
shadow:         compat ldap
 
hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
networks:       files
 
protocols:      db files
services:       db files
ethers:         db files
rpc:            db files
 
netgroup:       nis