On Mon, 28 Jan 2002, Mark Evans wrote:

...

Be clever with linux permissions - use features like SGUID (chmod 2xxx folder) and also your smb.conf settings for the share:

force group = pupils

This will mean that you can then assign permissions to selected groups with considerable ease. Check that the users are also members of additional groups as appropriate. Hey presto.

Won't the force group override whatever the group settings are for that user? Effectivly making any user who can access the share a member of the group...

That all depends on how you look at things. If your user belongs to more than one group, then his/her global rights become the union of the rights across those groups. Should a folder be set to belong to one of the groups of which your user is a member, the rights appropriate to that group prevail. ...if you see what I mean! In a school, I usually have groups as follows: users (everyone belongs to this). pupils (pupils, admins and staff belong to this) staff (staff and admins belong to this) admin (admins alone belong to this) Such a structure makes it easy to choose which group is SGID'd for any given purpose. Again, I don't want to burden the list with heavy detail, but I am more than happy to explain more, if more information is required.

...

RE: hiding shares from view ... Make sure the shares on the linux box (apart from netlogon) are marked browseable = no They do not then show in the output of net view or the windows explorer etc.

One thing which would be useful would be to have a share which only shows up when the combination of "valid users" and "allow hosts" would allow access. But is otherwise invisible. A bit like the way in which user shares work.

But there dosn't appear to be an obvious way to do this.

How right you are, if you let users access files via the network neighbourhood, but if you use scripting sensibly, or arrange batch files to map drives for you, something like: net use p: \\server\yourshare($) /y will result in a successful drive mapping where the user's rights and "allow hosts" intersect to allow access. You can probably make your batch /script even better by placing a tell-tale flag file in place in the given share and do a: if not exist \\server\yourshare($)\flag-file.txt goto FAIL net use p: \\server\yourshare($) /y goto CONTINUE :FAIL echo Helpful message to user telling them there's something they cannot see (always great with heads)! :CONTINUE echo Normal conclusion of batch-file (Sorry about the gotos - another M$ strength!) In this way, the network neighbourhood largely becomes an irrelevance - but you *do* have to be clever with scripting/batches. I have smb.conf examples and plenty of batches if anybody wants more ... Andrew -- Email:aray@computerpark.co.uk> Tel: +44 1536 417155 Fax: +44 1536 417566 Computer Park Ltd Broughton Grange Headlands Kettering Northamptonshire NN15 6XA