BlackArmor NAS Network Storage Server

[amadill]

We just purchased a BA 420 and I'm trying to integrate it into a customers AD domain.  I can create a machine account for it with no problem but I don't see any way of using domain authentication for access to shares on the NAS,  It seems to use local accounts and workgroup authentication only.  In fact it shows up as it's own little domain or workgroup when browsed from a XP workstation.

Another issue is setting of ACLs on folders and files on the NAS.  I can create a folder, add a domain user in the Security tab of the folder Properties.  It seems to accept it but if I close the window and come back the user is gone again.

I understand that the core of this unit is based on Linux/Samba.  We have been using Samba for years and it has no problem integrating with AD and it is simple to set it up to use extended file access control lists so this isn't a restriction of the OS.  (Yes, we installed the latest firmware)

So am I missing something obvious or did I missunderstand the advertising where it says that it has Active Directory support?

[mygk1234]

the device does not support extended attribute

you need join domain via web. NETWORK\Workgrpup, click "Domain Member"

after joining domain, you can assign share access control via "Access\Share Folder Permission"

[amadill]

But I can't seem to access it as DOMAINNAME\userid and I don't see any place where I can add domain members or groups as users on a share.  The only credentials it recognises are ones that are set up locally.

[mygk1234]

have you joined the domain sucessfully? after joining domain, using ACCESS\Folder Share Permissions to assign ACL. if you join domain successfully, you will find domain usr in the "User Access" and "Group Access" list when you are assigning the ACL to a share.

NETWORK\Workgroup, select "Domain Member"

the way to use proper Domain & NetBIOS name of Windows active directory server:

NetBIOS Name:

(How: [Start] > [Program] > [Administrative Tools] > [Active Directory Users and Computers], then in the left part of the window right click the DNS domain name and select the menu option Properties.)

use the value in the field "Domain Name (pre-Windows 2000)" as NetBIOS name

  

Domain Name. (How: [Control Panel] > [System] applet then the System Properties window appears and select the Network Identification tab.)

use the value in the field of "Domain" as Domain Name

 

============================================= 

Mode Workgroup Domain Member

Domain Name  

Domain NetBIOS Name  

Domain Controller IP Address  

Administrator  

Administrator Password  

[amadill]

The join to the domain is okay, the unit shows up in AD users & computers in our OU.  The netbios name is the same as the name I assigned when joining it to the domain.  The only unusual thing is when browsing from explorer on an XP workstation it shows up as being in a workgroup of it's own.

Domain users and groups do not show up in the User or Group lists when assigning permissions to a share.  Mind you, it's a big domain, over 3000 users and 10000 groups.  When using Samba in this domain you have to turn enumeration off because of the sheer volume of identities.

I'm going to have to leave the shares I'm using wide open, ie public access.

I wish I could look at the smb.conf file on this unit...

[mygk1234]

>>The netbios name is the same as the name I assigned when joining it to the domain. 

the netbios name is not the unit's device name. it's the Windows AD's computer name.

Can you explain how you specify the netbios name?

[amadill]

I follow you now. 

The device name was set in System/General Setup/Device Name.

The domain was set up in Network/WorkGroup

Domain Name - mydomain.net

Domain Netbios Name - mydomain (I had the device netbios name here)

I reset the domain information with the correct settings and now it shows up in mydomain in a workstation browser (nmbd is now broadcasting the correct netbios information).  AD users & computers still shows it as a connected domain member with a good join to the domain. but...

I still don't see any domain users or groups when assigning permissions to shares.

[amadill]

I removed the unit from the domain and deleted the computer account out of Active Directory.  I then renamed the unit, rebooted, and rejoined the domain with the new name.  It now shows domain groups (but not users) when I go to the security / shares.  As a side effect of this it takes a couple of minutes to open up the page where you assign access rights as it populates the list of groups.  It also only shows 3 groups (out of 8 to 10 thousand) at a time in the scroll box in the page.  It doesn't seem designed for an enterprise environment. :-(