我有一个设置为AD域成员的samba 4.4.3文件服务器。
我目前的smb.conf文件是：
[global] workgroup = MYDOMAIN realm = MYDOMAIN.ROOT security = ADS encrypt passwords = yes idmap config *:backend =tdb idmap config *:range = 70001-80000 idmap config MYDOMAIN:backend = rid idmap config MYDOMAIN:range = 80000 - 1234567890123456 winbind trusted domains only =no winbind enum users = yes winbind enum groups = yes domain master = no local master = no map untrusted to domain = Yes dedicated keytab file = /etc/krb5.keytab kerberos method = secrets and keytab winbind refresh tickets = yes dns proxy = no log level = 10 max log size = 1000 syslog = 0 panic action = /usr/share/samba/panic-action %d server role = member server obey pam restrictions = yes unix password sync = yes passwd program = /usr/bin/passwd %u passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* . pam password change = yes map to guest = bad user template shell = /bin/bash template homedir = /home/%D/%U client use spnego = yes read only = yes create mask = 0700 directory mask = 0700 [rw] path = /srv/rw writable = yes guest ok = no force user = share force group = share valid users= allow hosts = deny hosts = 正如你所看到的，我使用了“强制用户”和“强制组”选项，以便域中的每个用户映射为共享：共享。
现在，安全模型已更改，我想映射域用户共享： 只有当域用户在“shareWriteAccess”（域）组，如果没有， 则共享。 那可能吗 ？
目标是让某些域用户对共享拥有写访问权限，而其他用户只能拥有读访问权限。 我更有信心使用Linux文件权限检查，所以我想映射到2个不同的Linux用户。 / srv / rw拥有权限755 share：share，因此映射为ro：ro的域用户实际上是“只读”的。 我打开另一个解决scheme