I don't know that particular NAS, but does it allow you to setup an anonymous SMB user?

If not, then setup a normal SMB share on the NAS and mount it on the CentOS server, then rsync the data across

Moving the data is the easy part.

The problem here is that currently SMB runs on the 5.3 box which is also where NIS runs, and people authenticate from there.

The ZFS appliance is going to be the new home for SMB but it does not have a native authentication system and seems to want a pretty elaborate one, not something nice and simple like the Linux Samba software.

if you're running multiple windows systems with a server and DONT have centralized authentication, you have a mess.

if you're not running windows systems, then why are you using SMB ? NFS is the native file sharing system for Unix and Linux systems.

It is a bit of an oddball arrangement. We are a scientific research lab within a hospital environment. Most people use Linux or Mac - and those who do use Windows connect to the hospital domain. We don't have any control over that domain at all - I support the researchers and am independent from central IT. When the Windows users connect to the 5.3 box via SMB they use a local username and password on the 5.3 box, not their central domain credentials.

Hmmm, I probably know what the answer will be, but I could always ask the hospital to let me connect it to the domain. Though that could present security risks that I don't want to deal with.

On 11/25/11 4:50 PM, Alan McKay wrote:

Hmmm, I probably know what the answer will be, but I could always ask the hospital to let me connect it to the domain. Though that could present security risks that I don't want to deal with.

yes, that is the answer, and actually, no, there's no security risks. your server will just be using the domain to authenticate windows users, and they'll see it as a 'single signon' same as any other "windows" server. other authentication, like local unix administration, NFS users will proceed the same as before.

to 'join the domain', the windows domain admins will just need to create a computer account for your server, and then it 'joins' the domain, this involves an automated private key exchange sequence... it can be done several different ways, at the whims of your windows domain admins. one method, a domain admin needs to enter his domain credentials (domainname\username, password) once into your server, and it joins (the admin credentials are only used once and not saved). the other method, they precreate the computer account on the domain, and you then join your host and it exchanges those keys previously mentioned.

this establishes a limited 'trust' relation, where basically your server trusts the domain server(s) to do windows user authentication, and the domain servers allow your windows server to do this. nothing else. its actually all quite well thought out, based on Kerberos and LDAP.

I've never heard of Samba authenticating off NIS, as Windows (SMB/CIFS) and Unix (PAM, NIS, etc) use different incompatible password hashes.  on a pure Samba system that doesn't have an external authentication system such as Active Directory, I've always had to use smbpasswd to setup the SMB passwords for the 'windows' users.

Yeah, this is what I'm afraid of - that I'll have to install some directory services.

I'm going to start off next week with a call to Oracle. Just figured I'd ping the list to see if maybe someone had been here.

On 11/25/11 10:23 AM, Alan McKay wrote:

p.s. even if I could get it to authenticate SMB from the current 5.3 box I'd be happy.

If I have to go the directory services route I can only say that I hope it has improved a lot since the last time I installed it 18 months ago - though that was 389-ds ...

I've been sniffing at FreeIPA, which is a bundle based on the latest version of 389, with a bunch more stuff around it to allow both windows and 'nix systems to authenticate, also stuff for policy management, etc. It looks really interesting, but I haven't had a go at setting it up yet.