Tranquil IT Forum

Hello.
We have successfully set up a test environment using Samba4 (4.7.0 - Debian Stretch 9.2). Several users and groups have been created.
LVM partitions have been mounted for different uses: storage for individual users and user groups (/home/samba/users and /home/samba/groups).
We have implemented quota management for users, and it works. When we set a quota for a user on the user-reserved partition, and that user logs in (Windows 7 or Windows Server 2008 R2), a personal mapped drive is assigned via Group Policy (G:, for example), and this drive correctly displays the used and maximum storage allocated to the user (e.g., 50MB per user).
We use the same principle for groups: we map a drive via Group Policy to the group to which the user belongs (F:, for example, with a maximum storage of 100MB for the group). The mapping works correctly, but the quota display is incorrect. The used/maximum storage values ​​are wrong: the entire disk space of the partition (/home/samba/groups) is displayed. However, the quota is correctly applied; that is, if we try to copy a 150MB file to the group drive, the copy fails because the file size exceeds the drive's limit (100MB). Only the display is incorrect, which is somewhat confusing for users.
Have you encountered this problem before?
Thank you.

From what I remember, group quotas currently apply to the file's primary group (the G in UGO permissions). In an Active Directory environment, the primary group for an AD user is "domain users," and it's strongly discouraged to change it. Therefore, the primary group when creating a file will be "domain users." This makes group quotas somewhat ineffective, unless you force a group on the share definition.
However, user quotas for HOME directories, for example, work perfectly well.

In any case, strict quotas are mainly useful in educational environments. In professional settings, there will always be a VIP who has something incredibly important to do, prompting you to urgently override the quotas you've set up; otherwise, they won't be able to finish their crucial task.

Denis

First of all, sorry for my late reply, and thank you for the information.

dcardon wrote: From what I remember, group quotas apply to the file's primary group (the G in UGO permissions) in the current state of things. In an AD environment, the primary group for an AD user is "domain users," and it's really not recommended to change it.

I wasn't clear. We haven't changed the user's primary group (in fact, we did on a previous mockup, and your warning is entirely justified) (therefore we did not reproduce this setting).

dcardon wrote:So the primary group when creating a file will be "domain users". This makes group quotas somewhat obsolete, unless you use a "force group" on the share definition. However,
user quotas for HOME directories, for example, work very well.

In any case, strict quotas are mainly useful in a school environment. In a professional environment, there will always be a VIP who has something super important to do, making you urgently override the quotas you've set up; otherwise, they won't be able to finish their super urgent and super important task.

Denis

I was saying that the group quota system works perfectly:
- Enabling group quotas on an LVM partition: /home/samba/groups. Creating the share (smb.conf)
- Via RSAT, in the Active Directory, create a "finance" group and assign users to this group
- Allocation of a quota for the "finance" group
- In /home/samba/groups, create a directory named FINANCES. In the directory properties, assign full control and ownership to the group (finances). Under Linux, its permissions are:
drwxrwx- - - + root WORLDMAINE\finances FINANCES
- When a user from the "finance" group logs into their profile, the GPOs assign them their mapped drives (personal and group drives).
- For the user quota, in the display, the remaining space and the allocated space are clearly shown and it works well within the restrictions.
- However, regarding the group quota, The display is going haywire The allocated space is incorrect. We see the total size of the /home/samba/groups partition (instead of the group quota) while the remaining space is the remaining space on the entire partition (instead of the remaining space for the group). BUT The quota restrictions are correctly applied. If my group quota is 150MB and I try to place a 200MB file on it, I get a warning.

My problem is ultimately aesthetic, but it's still disconcerting for the average user. And for me, who can't understand why it's displayed this way... because there must be an explanation, a logic behind the group quota display.