Servers

Map unix group to a windows domain group

Posted on by Andy

Hello world,

here my scenario: i have a webdevelopment server as a domain member and i need the apache user in one of the domain groups so that apache can access readable and writeable files by the webdev group. The problem now is that you can't add unix users to a windows group because the unix user doesn't exist on the windows machine. BUT: you can map an existing unix group to an existing windows group so that the unix group is like an alias for the windows one and add the unix user to that group… and it is quite easy.

Let's say you have group1 on windows and domgroup1 on unix. Here is how to do it:

create a new unix group
# groupadd domgroup1

now map the groups
# net groupmap add ntgroup="group1" unixgroup="domgroup1" type=domain

list the mapped groups
# net groupmap list

now restart samba
# /etc/init.d/smb restart

The only thing left you have to do now is to add the user add to your domgroup1 in /etc/group

Roaming profiles permissions

Posted on by Andy

Hi again, when i installed a windows 2008 server and configured the roaming folders for domain users, the permissions were wrong and the folders were not created automatically. So here is a basic overview of some working permissions:

NTFS-Level permissions:

Windows User Account Minimum permissions required
Creater/Owner Full Control, Subfolders And Files Only
Administrator None
Security group of users needing to put data on share List Folder/Read Data, Create Folders/Append Data – This Folder Only
Everyone No Permissions
Local System Full Control, This Folder, Subfolders And Files

SMB-Level permissions:

Windows User Account Default Permissions Minimum permissions required
Everyone Full Control No Permissions
Security group of users needing to put data on share N/A Full Control

Following NTFS permissions are set automatically when the folder is created:

Windows User Account Default Permissions Minimum permissions required
%Username% Full Control, Owner Of Folder Full Control, Owner Of Folder
Local System Full Control Full Control
Administrators No Permissions No Permissions
Everyone No Permissions No Permissions

for more information check here.

Smarthost with SMTP/TLS authentication with postfix

Posted on by Andy

Hi all. If you have for example an email server in your basement it is often blocked due to your dynamic ip address. Well, there is a relatively easy way to get around this. The only thing you have to do is set up an smarthost in your mta (e.g. sendmail, postfix, exim…).

What is a smarthost? A smarthost is an external email server, normally a well known one, where you have an email account, e.g. yahoo or hotmail. So as you guessed from the article title we are doing this now with postfix. Why postfix? Because postfix is really easy to configure and gets the job done like sendmail. This howto only describes how to set up the smarthost not how to install postfix. So here we go.

Let's say you want to configure the smarthost with postfix on a CentOS machine and send email over port 587, so open the config file and add some lines to your /etc/postfix/main.cf: 

# vim /etc/postfix/main.cf

 

add: 

relayhost = smarthost.domain.com:587
smtp_sasl_auth_enable = yes
smtp_use_tls = yes
smtp_sasl_password_maps = hash:/etc/postfix/smtp_auth
smtp_sasl_security_options = noanonymous
smtp_sasl_tls_security_options = noanonymous

 

then we create /etc/postfix/smtp_auth and make the file only readable by root and postfix. 

# touch /etc/postfix/smtp_auth && chown root:postfix /etc/postfix/smtp_auth && chmod 640 /etc/postfix/smtp_auth

 

open the previously created file and add some lines: 

# vim /etc/postfix/smtp_auth

 

add: 

smarthost.firma.zz       senduser:supersecret

 

now we have to create a lookup file from that file with 

# postmap /etc/postfix/smtp_auth (this will create smtp_auth.db)

 

The postmap command has to be executed after every change to the smtp_auth file, please remember. If you do not so, postfix will never get notified about the changed file.

If you want your postfix server relay from outside to non-local domains add one of these lines: 

smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination (postfix < 2.10)
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination (postfix >= 2.10)

 

The last step is to restart postfix, done! 

# /etc/init.d/postfix restart

 

have fun with your private mailserver! 🙂