lehnert.cloud/ad-ds-simple-file-server
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

localization: Shared -> Geteilt; Private -> Privat

Browse Source
This commit is contained in:
Ludwig Lehnert
2026-02-20 11:59:47 +01:00
parent b0e4916710
commit 3381aadc30
2 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
README.md
View File

@@ -6,8 +6,8 @@ This repository provides a production-oriented Samba file server container that
- Samba runs in ADS mode with `winbind` identity mapping. - Samba runs in ADS mode with `winbind` identity mapping.
- Static shares: - Static shares:
- `\\server\Private` -> `/data/private` - `\\server\Privat` -> `/data/private`
- `\\server\Shared` -> `/data/public` - `\\server\Geteilt` -> `/data/public`
- Dynamic shares are generated from AD groups matching `FileShare_*` or `FS_*` and written to `/etc/samba/generated/shares.conf`. - Dynamic shares are generated from AD groups matching `FileShare_*` or `FS_*` and written to `/etc/samba/generated/shares.conf`.
- Dynamic share records are persisted in SQLite at `/state/shares.db`. - Dynamic share records are persisted in SQLite at `/state/shares.db`.
- Backing storage is GUID-based and stable across group rename: - Backing storage is GUID-based and stable across group rename:
@@ -125,14 +125,14 @@ Kerberos requires close time alignment.
## SMB Shares ## SMB Shares
### Private ### Privat
- Share: `\\server\Private` - Share: `\\server\Privat`
- Root path: `/data/private` - Root path: `/data/private`
- Per-user path: `/data/private/<samAccountName>` - Per-user path: `/data/private/<samAccountName>`
- Script ensures user directories exist and assigns ownership through winbind identity resolution. - Script ensures user directories exist and assigns ownership through winbind identity resolution.
- Root `/data/private` is enforced read/execute-only (`0555`) to prevent folder creation directly under `\\server\Private`. - Root `/data/private` is enforced read/execute-only (`0555`) to prevent folder creation directly under `\\server\Privat`.
- SMB-side ACL changes on `\\server\Private` are blocked (`nt acl support = no`). - SMB-side ACL changes on `\\server\Privat` are blocked (`nt acl support = no`).
- Auto-creation skips well-known/service/non-login accounts (disabled, locked, or expired). - Auto-creation skips well-known/service/non-login accounts (disabled, locked, or expired).
- Each private user tree is reconciled recursively to homogeneous permissions (dirs `0700`, files `0600`, user/admin ACLs). - Each private user tree is reconciled recursively to homogeneous permissions (dirs `0700`, files `0600`, user/admin ACLs).
- Permissions: - Permissions:
@@ -141,9 +141,9 @@ Kerberos requires close time alignment.
- mode: `700` - mode: `700`
- `hide unreadable = yes` + ACLs enforce that users only see their own folder. - `hide unreadable = yes` + ACLs enforce that users only see their own folder.
### Shared ### Geteilt
- Share: `\\server\Shared` - Share: `\\server\Geteilt`
- Path: `/data/public` - Path: `/data/public`
- Read/write for authenticated users in configurable `PUBLIC_GROUP_SID` (default: `DOMAIN_USERS_SID`, resolved through winbind). - Read/write for authenticated users in configurable `PUBLIC_GROUP_SID` (default: `DOMAIN_USERS_SID`, resolved through winbind).
- No guest access. - No guest access.
@@ -234,7 +234,7 @@ docker compose exec samba sh -lc 'tail -n 200 /var/log/samba/log.*'
docker compose exec samba sh -lc 'mods="$(smbd -b | sed -n "s/^ *MODULESDIR: //p" | head -n1)/vfs"; ls -1 "$mods"/acl_xattr.so "$mods"/full_audit.so' docker compose exec samba sh -lc 'mods="$(smbd -b | sed -n "s/^ *MODULESDIR: //p" | head -n1)/vfs"; ls -1 "$mods"/acl_xattr.so "$mods"/full_audit.so'
``` ```
### Permissions in Private share are incorrect ### Permissions in Privat share are incorrect
- Re-run reconciliation to rebuild private directories and ACLs: - Re-run reconciliation to rebuild private directories and ACLs:

4
etc/samba/smb.conf
View File

@@ -39,7 +39,7 @@
include = /etc/samba/generated/shares.conf include = /etc/samba/generated/shares.conf
[Private] [Privat]
path = /data/private path = /data/private
read only = no read only = no
browseable = yes browseable = yes
@@ -55,7 +55,7 @@
ea support = yes ea support = yes
nt acl support = no nt acl support = no
[Shared] [Geteilt]
path = /data/public path = /data/public
read only = no read only = no
browseable = yes browseable = yes