MasterM's questions

I have a Samba 4.5.12 file server running on Debian Stretch with a file share configured as follows:

[test]
    path = /srv/test
    read only = no

Inside that share there's a directory: /srv/test/directory. Using Windows client I then create a file test.txt and after creation it has the following permissions:

# file: test.txt
# owner: some_user
# group: some_group
user::rw-
group::r--
other::r--

Now, on the file server I then set a default ACL on /srv/test/directory directory:

setfacl -d -m group:some_other_group:rwx /srv/test/directory
touch /srv/test/directory/test2.txt

test2.txt file has permissions as expected:

# file: test2.txt
# owner: some_user
# group: some_group
user::rw-
group::r-x                      #effective:r--
group:some_other_group:rwx      #effective:rw-
mask::rw-
other::r--

When I then proceed to create another file using Windows client I get this:

# file: test3.txt
# owner: some_user
# group: some_group
user::rw-
group::r--
group:some_other_group:rwx
mask::rwx
other::r--

As you can see the mask is wrong. How can I fix this?

I tried setting create mask = 0666 but that did not help either. The only thing that helps is disabling NT ACL support via nt acl support = no but I don't want to do this.

Full smb.conf is as follows:

[global]
        server role = member server
        security = ADS
        workgroup = *redacted*
        realm = *redacted*
        netbios name = FILES

        kerberos method = secrets and keytab

        acl allow execute always = yes
        map to guest = bad user

        store dos attributes = yes
        map readonly = no
        map archive = no
        map hidden = no
        map system = no

[test]
        path = /srv/test
        read only = no

I've setup a Samba 4 AD domain controller on Debian Jessie (samba 4.2.10). Everything's working fine, except that winbind gives wrong user/group information.

I have a sample user "testuser" and a security group "people". Their UNIX attributes are setup as follows:

Yet winbind shows this:

root@agnus:~# wbinfo -i testuser
testuser:*:10010:100:Test User:/home/HOME/testuser:/bin/false

The UID matches, but everything else is wrong.

My smb.conf contains this:

# Global parameters
[global]
        workgroup = HOME
        realm = HOME.LOCAL
        netbios name = AGNUS
        server role = active directory domain controller
        server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl, winbindd, ntp_signd, kcc, dnsupdate
        idmap_ldb:use rfc2307 = yes

        idmap config *:backend = tdb
        idmap config *:range = 2000-9999

        idmap config HOME:backend = ad
        idmap config HOME:schema_mode = rfc2307
        idmap config HOME:range = 10000-99999

        winbind nss info = rfc2307
        winbind enum users = yes
        winbind enum groups = yes
        winbind normalize names = yes
        winbind use default domain = yes
        winbind refresh tickets = yes

[netlogon]
        path = /var/lib/samba/sysvol/home.local/scripts
        read only = No

[sysvol]
        path = /var/lib/samba/sysvol
        read only = No

What's wrong with my setup?

I'm planning to setup a set of 3x 2TB 7200rpm drives as a LUKS-encrypted Z-RAID pool in Linux (for a NAS solution).

My understanding of the problem at hand is that the only way to achieve this is to luksFormat every physical device and then assemble a zpool out of unlocked LUKS containers.

I have the following concerns with this:

• Wouldn't it significantly impede write performance? In this setup redundant data is encrypted several times because LUKS is not "aware" of Z-RAID. In LUKS-on-mdadm solution data is encrypted once and merely written to disks multiple times. My CPU supports Intel AES-NI.

• Will ZFS be aware of disk failures when operating on device-mapper LUKS containers as opposed to physical devices? How about deduplication and other ZFS features?

I'm using Samba 4.0.0beta2 on Debian Wheezy as Active Directory domain controller. I also use winbind in my /etc/nsswitch.conf so getent passwd returns domain users.

I've set

template homedir = /home/%U

in my smb.conf file but, instead of substituting %U for username, getent passwd returns:

HOME\Administrator:*:0:100::/home/%U:/bin/bash
HOME\Guest:*:3000000:3000001::/home/%U:/bin/bash

Why is that?

I have the following script (what it does exactly is not important):

#!/bin/sh -e
### BEGIN INIT INFO
# Provides:          watchdog_early
# Required-Start:    udev
# Required-Stop:     
# Default-Start:     S
# Default-Stop:
# X-Interactive:     true
# Short-Description: Start watchdog early.
### END INIT INFO

# Do stuff here... 

I insert it into the S runlevel by invoking:

insserv watchdog_early

The aproriate link is created in /etc/rcS.d:

S04watchdog_early -> ../init.d/watchdog_early

and /etc/init.d/watchdog_early is executable (has mode 755).

Despite all this, it is NOT being run at boot. Why?

I wanted to assign an external IP address to my KVM guest and went the bridged networking way. Unfortunately the guest has no network connectivity and I don't know why. After investigating it seems that it doesn't get any reply for it's ARP requests.

I have one physical interface: eth0, the bridged interface: br0 and the tap interface: tap0 brought up by qemu-ifup script by kvm. The host machine runs the latest Ubuntu Server. The guest machine runs GKRML live-cd (based on slackware).

What could be a potential problem is that the host machine and the guest machine are in the different networks. Unfortunately both IP addresses were assigned to me by the datacenter and I cannot change them.

Configuration details follow. Below xx.xx are the same for both host and guest.

Host's /etc/network/interfaces:

# Loopback device:
auto lo
iface lo inet loopback

# Device: eth0
auto eth0
iface eth0 inet manual

# Device: br0
auto br0
iface br0 inet static
  address   xx.xx.110.69
  netmask   255.255.255.224
  network   xx.xx.110.64
  broadcast xx.xx.110.95
  gateway   xx.xx.110.65
  bridge_ports eth0
  bridge_fd 9
  bridge_hello 2
  bridge_maxage 12
  bridge_stp off

Host's routing table:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
xx.xx.110.64    0.0.0.0         255.255.255.224 U     0      0        0 br0
0.0.0.0         xx.xx.110.65    0.0.0.0         UG    100    0        0 br0

Host's /etc/qemu-ifup scirpt (unmodified, shipped with qemu package):

#!/bin/sh
switch=$(/sbin/ip route list | awk '/^default / { print $5 }')
/sbin/ifconfig $1 0.0.0.0 up
/usr/sbin/brctl addif ${switch} $1

Output of brctl show while the guest is running:

bridge name     bridge id               STP enabled     interfaces
br0             8000.4061862b90d5       no              eth0
                                                        tap0

KVM commandline:

kvm -cdrom grml_2009.10.iso -boot d -m 256 -vnc localhost:0 -net nic,macaddr=DE:AD:BE:EF:11:14 -net tap,script=/etc/qemu-ifup

Guest machine network setup (single eth0 interface):

$ ifconfig eth0 xx.xx.129.69/28 up
$ route add default gw xx.xx.129.65

Result of tcpdump -i tap0 while trying to ping anything from the guest:

tcpdump: WARNING: tap0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tap0, link-type EN10MB (Ethernet), capture size 96 bytes
23:38:13.659655 ARP, Request who-has xx.xx.129.65 tell xx.xx.129.69, length 28
23:38:14.659687 ARP, Request who-has xx.xx.129.65 tell xx.xx.129.69, length 28
23:38:15.659655 ARP, Request who-has xx.xx.129.65 tell xx.xx.129.69, length 28
23:38:16.666350 ARP, Request who-has xx.xx.129.65 tell xx.xx.129.69, length 28
23:38:17.666319 ARP, Request who-has xx.xx.129.65 tell xx.xx.129.69, length 28
23:38:18.666324 ARP, Request who-has xx.xx.129.65 tell xx.xx.129.69, length 28

... and so on without reply.

Thanks in advance for any help!