samba - Apr 2015 - Member server - winbind unable to resolve users/groups

On 05/04/15 13:56, Luca Olivetti wrote:
> El 05/04/15 a les 14:25, Rowland Penny ha escrit:
>
>> Well yes, but I wanted to show the OP the relation between what the
>> uidNumber attribute holds and the range set in smb.conf. If what I
>> propose works (and I sure it will), I would have then advised the OP to
>> reset Domain Users back to 513, but I would also have pointed out that
>> you now cannot have *ANY* local users or groups!
> Why not? 1-499 can still be local groups, as can be gids > 50000
>
>> I would also have pointed out that the lowest uid on Debian/Ubuntu,
that
>> is not a system user, is 1000, so using the range '500-50000'
is not a
>> good idea.
> It is if you already have users with those uids. Not everybody can start
> fresh. When I started using linux and samba many years ago, the
> distribution I used had 500 as the lowest uid (e.g. my uid is 500) and
> it's not practical to change the ownership of the more than 3 millions
> files I have.
>
> Bye
OK, so you have users that start at '500', these will undoubtedly be 
local Unix users not AD users, unless you have migrated these users to 
AD, in which case you would have had to remove the local Unix users.

If you will never need any local Unix users (and what happens if the 
domain connection goes down ?) then you could start the AD users at 
where the local Unix users are supposed to start (debian 1000, older 
red-hat 500, newer red-hat 1000), but this is if you *only* have Unix 
system users on the computer.

I cannot recommend this type of setup, there is no reason to have such a 
setup and if you do have such a setup, then my recommendation is to 
retire and let somebody else sort out your mess.

Rowland

El 05/04/15 a les 15:31, Rowland Penny ha escrit:
> 
> OK, so you have users that start at '500', these will undoubtedly
be
> local Unix users not AD users, unless you have migrated these users to
> AD, in which case you would have had to remove the local Unix users.
Uh? They're users, currently in ldap and after that in AD, and they will
maintain the same uids/gids. I would be pretty angry if they didn't,
since it would screw up file ownership
> 
> If you will never need any local Unix users (and what happens if the
> domain connection goes down ?) 
Isn't winbind supposed to cache that?
;-)
> then you could start the AD users at
> where the local Unix users are supposed to start (debian 1000, older
> red-hat 500, newer red-hat 1000), but this is if you *only* have Unix
> system users on the computer.
Nonsense. I can simply use uids/gids outside the range for local users.
> 
> I cannot recommend this type of setup, there is no reason to have such a
> setup and if you do have such a setup, then my recommendation is to
> retire and let somebody else sort out your mess.
This is not a "mess". This was best-practice in its day (some of us
have
been using Linux when it was still not fashionable to do so) and it
still works fine. There is no reason to change what's working fine only
to follow your recommendation. Otherwise there would be no reason to
make the range configurable: it is in order to adapt to one's environment.

Bye
-- 
Luca Olivetti
Wetron Automation Technology http://www.wetron.es
Tel. +34 935883004  Fax +34 935883007

On 05/04/15 15:31, Rowland Penny wrote:
> On 05/04/15 13:56, Luca Olivetti wrote:
>> El 05/04/15 a les 14:25, Rowland Penny ha escrit:
>>
>>> Well yes, but I wanted to show the OP the relation between what the
>>> uidNumber attribute holds and the range set in smb.conf. If what I
>>> propose works (and I sure it will), I would have then advised the
OP to
>>> reset Domain Users back to 513, but I would also have pointed out
that
>>> you now cannot have *ANY* local users or groups!
>> Why not? 1-499 can still be local groups, as can be gids > 50000
>>
>>> I would also have pointed out that the lowest uid on Debian/Ubuntu,
>>> that
>>> is not a system user, is 1000, so using the range
'500-50000' is not a
>>> good idea.
>> It is if you already have users with those uids. Not everybody can
start
>> fresh. When I started using linux and samba many years ago, the
>> distribution I used had 500 as the lowest uid (e.g. my uid is 500) and
>> it's not practical to change the ownership of the more than 3
millions
>> files I have.
>>
>> Bye
>
> OK, so you have users that start at '500', these will undoubtedly
be
> local Unix users not AD users, unless you have migrated these users to 
> AD, in which case you would have had to remove the local Unix users.
>
> If you will never need any local Unix users (and what happens if the 
> domain connection goes down ?) then you could start the AD users at 
> where the local Unix users are supposed to start (debian 1000, older 
> red-hat 500, newer red-hat 1000), but this is if you *only* have Unix 
> system users on the computer.
>
> I cannot recommend this type of setup, there is no reason to have such 
> a setup and if you do have such a setup, then my recommendation is to 
> retire and let somebody else sort out your mess.
>
> Rowland
>
>
I'd recommend you start you own list. For hobbyists only.

On 05/04/15 15:09, Luca Olivetti wrote:
> El 05/04/15 a les 15:31, Rowland Penny ha escrit:
>
>> OK, so you have users that start at '500', these will
undoubtedly be
>> local Unix users not AD users, unless you have migrated these users to
>> AD, in which case you would have had to remove the local Unix users.
> Uh? They're users, currently in ldap and after that in AD, and they
will
> maintain the same uids/gids. I would be pretty angry if they didn't,
> since it would screw up file ownership
You shouldn't really have used such low numbers in the first place, but 
that was your decision.
>
>> If you will never need any local Unix users (and what happens if the
>> domain connection goes down ?)
> Isn't winbind supposed to cache that?
> ;-)
What if the problem is winbind ?
>> then you could start the AD users at
>> where the local Unix users are supposed to start (debian 1000, older
>> red-hat 500, newer red-hat 1000), but this is if you *only* have Unix
>> system users on the computer.
> Nonsense. I can simply use uids/gids outside the range for local users.
Right and what happens if your number of AD users grows ? they could 
collide with your local Unix users.

>> I cannot recommend this type of setup, there is no reason to have such
a
>> setup and if you do have such a setup, then my recommendation is to
>> retire and let somebody else sort out your mess.
> This is not a "mess". This was best-practice in its day (some of
us have
> been using Linux when it was still not fashionable to do so) and it
> still works fine. There is no reason to change what's working fine only
> to follow your recommendation. Otherwise there would be no reason to
> make the range configurable: it is in order to adapt to one's
environment.
Yes, it may have been best practice in its day (cannot think when, but 
hey) but it is not best practice now and hasn't been for quite sometime.

As for using Linux when it was still not fashionable, well I
A) Remember reading Linus's message shortly after he sent it out (didn't
really understand what he was trying to get at)
B) Remember booting my first Linux machine from a couple of 3-1/2 inch 
floppies called 'boot' and 'root'

So, don't try and pull the 'I am older than Methuselah' routine :-D

Rowland
>
> Bye