[mooching]

After messing with my problem some more I found that one of my users could log into the Mac 10.5.2 server via AFP and see one of the shares they had access to but not the other. The only difference I found was that in the POSIX permissions Other was set to Read only on the working one and set to None on the broken one. I set the broken one to Read only and now the ACL permissions work, they get permissions via ACL’s because they are in AD. It also solved my access privileges for SMB access, we have had to use SMB instead of AFP because for some reason in 10.5.x AFP speeds are dog slow when copying large files.

[mooching]

I think there is also a problem in Leopard Client SMB. I can’t always connect to a SMB share on a 10.5 server from a 10.5 client, and when I can I am locked out and have no read or write permission to the folders on the share. I can connect to the same share with the same user and password from a WinXP, a 10.5 client via AFP, and a 10.4 client via AFP and SMB and the ACL’s are working. Before I upgraded our servers to Leopard we had W2K3 AD with a 10.4 OD and 10.4 clients bound to AD and OD, all users are in AD. Everything was working pretty well, I had SSO from my bound Mac Clients to any share I had access to and they would mount without having to give my password again. I then upgraded our OD to 10.5, I had to rebuild the OD master because it wouldn’t upgrade OD correctly, I was not happy about that, and a couple servers I just did an upgrade on. Now I have what appears to be the same problem for the ACL’s not being passed correctly but also appears to be a 10.5 client issue. I also lost SSO from both 10.4 or 10.5, I have to provide my password to get to access to the shares wether they are housed on a Mac or Windows server.

[mooching]

Hi Dave,

I dont know if you have a solution for this yet, I just came accross it. We are using Bluesocket for our wireless solution. We came up with three solutions so far. The one we are currently using is MAC authentication, we collect the wireless MAC for all our Mac clients and register them in the Bluesocket Controller. You do run the risk of a MAC spoof attack though. Our Windows clients are authenticated when they log on via transparent NTLM Another solution is Admitmac and use transparent NTLM authentication, it was very cost prohivitave for us. The other is 802.1x which is what we will probably impliment when we have time to research it.

[Author]

Posts