Connect CIFS File Share to DSPM

CIFS Server Hosted on Linux (Active Directory Integrated)

Use these steps if your Linux CIFS server uses an Active Directory domain for user authentication.

Step 1: Create a User and Group in Active Directory

1. Log in to your Domain Controller (DC) or management workstation with an admin account.
2. Press Win+R and type dsa.msc (or go to Server Manager) to open Active Directory Users and Computers.
3. Go to your desired Organizational Unit (OU).
4. Right-click the OU and select New > User.
5. Fill the wizard to create a new user with:
   • First name: netskope
   • Last name: User
   • User logon name (pre-Windows 2000): netskope.user
     • Note: This is the sAMAccountName.
   • User logon name: netskope.user@yourdomain.com
     • Note: This is the UPN. Make sure yourdomain.com matches your actual AD domain.
6. Click Next.

Step 2: Create and Configure a Security Group in Active Directory

1. In Active Directory Users and Computers, go to the OU where you manage groups.
2. Right-click the OU and select New > Group.
3. Fill in Group Details:
   • Group name: CIFS_Read_Only_Users
   • Group scope: Global
   • Group type: Security
4. Click OK.
5. Find your newly created CIFS_Read_Only_Users group, right-click on it, and select Properties.
6. Go to the Members tab > Click Add > Type netskope.user.
7. Click Check Names to verify > Select OK.
8. Click OK on the group properties.
   • Your netskope.user is now a member of the group.

Step 3: Configure File System and Samba Permissions on Linux

1. Verify that Winbind can see your Active Directory group by running:

   getent group "CIFS_Read_Only_Users"

   • Note: If it returns nothing, wait for Winbind to sync or restart the service with sudo systemctl restart winbind.

2. Set ownership and permissions on the shared folder:

   sudo chown -R root:"CIFS_Read_Only_Users" /path/to/shared_folder_path

   sudo chmod -R 750 /path/to/shared_folder_path

3. Edit your Samba configuration file (e.g., sudo nano /etc/samba/smb.conf) and add a new share definition:

   [ad_read_only_share]
       path = /path/to/shared_folder_path
       browseable = yes
       read only = yes
       guest ok = no
       valid users = +"YOURDOMAIN\CIFS_Read_Only_Users"

   • Replace YOURDOMAIN with your NetBIOS domain name.

4. Check your configuration file for syntax errors:

   testparm

5. Restart the Samba and Winbind services to apply all changes:

   sudo systemctl restart smbd nmbd winbind

6. Verify the status of the services:

   sudo systemctl status smbd nmbd winbind

Step 4: Test Access from a Windows Client

1. Log in to a Windows machine that is joined to your Active Directory domain.
2. Open File Explorer and navigate to your share using its network path (e.g., \\YourLinuxServerHostname\ad_read_only_share).
3. Confirm that you can view the files and folders. Attempting to create or modify a file should result in an “Access Denied” error.