samba - Dec 2010 - winbind / trust questions and issues

I have two domains, one called CORP (which is 2003 AD) and the other is
called LABS (which is running Samba 3.5.4-5.1.2). I have established
bi-directional trust between them and most of the basic tests show
apparent success. However there are a couple of issues left that I am
trying to chase down.

First issue is that I would like to filter out the local (LABS) users and
groups in winbind if possible. I am using LDAP for Posix/Samba accounts,
and adding winbind to nsswitch.conf results in PAM calling LDAP for users
and groups then calling winbind which in turn goes back and searches LDAP
all over again. This results in local users and groups appearing in both
channels but having different characteristics based on the lookup path
(different capitalization for group names, etc). The best fix I can see
here is to prevent Winbind from querying for the local domain, but I can't
find anything in the smb.conf to do this.

One big problem that has me stumped is that remote users do not seem  to
be inheriting the correct filesystem permissions from Samba. For example,
I have the built-in NT Users group mapped to the POSIX Users group in
LDAP, and all of the local user accounts are also direct members of that
group through Posix and NT. So when I assign rw permissions for that group
to a directory, the local users can create and/or modify files and folders
as expected from either Samba or Posix just the same, since the ACLs are
essentially the same for both sides. However if I add CORP\fred from the
remote domain to the local Users group (using the NT User Manager tool),
that account is not able to modify files or folders that other members of
the same group can modify. In fact, if I add CORP.fred (via winbind) to
the Posix Users group, then he is able to manipulate the files just fine,
so I know the local filesystem permissions are correct. What doesn't work
is adding the CORP\user to the NT Uses group--the user does not inherit
the NT filesystem ACLs.

Another problem that may possibly be related to the above is that the
remote domain does not always show up in the Samba tools. For example, I
can add CORP\fred to a group but when I use "net sam listmem Users" to
dump the user list for the group, the user shows up as "\user" and the
domain element is missing. Is this correct behavior or is something
misconfigured (I can see how inability to reverse-map the principal would
correlate with broken ACL inheritance, so maybe this is related to the
above problem?).

Any help appreciated

-- 
Eric A. Hall                                  http://www.eric-a-hall.com/
Network Technology Research Group                    http://www.ntrg.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/

On 12/15/2010 4:19 PM, Eric A. Hall wrote:
> First issue is that I would like to filter out the local (LABS) users and
> groups in winbind if possible. I am using LDAP for Posix/Samba accounts,
> and adding winbind to nsswitch.conf results in PAM calling LDAP for users
> and groups then calling winbind which in turn goes back and searches LDAP
> all over again. This results in local users and groups appearing in both
> channels but having different characteristics based on the lookup path
> (different capitalization for group names, etc). The best fix I can see
> here is to prevent Winbind from querying for the local domain, but I
can't
> find anything in the smb.conf to do this.
Here's an example of why this is bad: 'getent passwd ehall' points
to the
same account as 'getent passwd LABS.ehall' with the same UID, but they
have different full names (Posix uses gecos attribute while Winbind uses
the displayName attribute), and they have different login paths (Posix
uses the homeDirectory attribute while Winbind uses the template value
from smb.conf). So basically there are two logins for every UID, with two
different home directories and display names. BAD BAD BAD how do I turn
this off??
> One big problem that has me stumped is that remote users do not seem  to
> be inheriting the correct filesystem permissions from Samba.
This seems to have been fixed by a reboot. Dunno why, it's working now

-- 
Eric A. Hall                                  http://www.eric-a-hall.com/
Network Technology Research Group                    http://www.ntrg.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/

On 12/15/2010 4:19 PM, Eric A. Hall wrote:
> First issue is that I would like to filter out the local (LABS) users and
> groups in winbind if possible.
I tried using "winbind: ignore domains = LABS" but this causes
winbindd to
completely ignore its own domain, which in turn causes it to freak out,
dump core, and die

I have also tried using require_membership_of=SID for CORP/Domain Users
(the remote users I want to allow local access through winbind), but
pam_winbind complains about the foreign SID and then allows everybody to
login despite the error

Anything else I could try?

-- 
Eric A. Hall                                  http://www.eric-a-hall.com/
Network Technology Research Group                    http://www.ntrg.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/