samba - Sep 2016 - Computer accounts belonging to groups, using winbind on file server

Hi All,

Some time ago I reluctantly moved DC functionality off my file server and
onto a separate machine, due to the well-known challenges using the same
machine as both a file server and a DC. This went mostly fine, with one
exception - I have one piece of functionality that worked before, but I
still don't have working now.

I use wpkg for software distribution, having all relevant computer accounts
be a member of a group (lets' call it sw-dist) and setting the ownership of
my /data/wpkg directory on the server appropriately so that all members of
that group (i.e. all relevant computer accounts) can access the files - see
below. I am using rfc2307 attributes to specify UIDs and GIDs where I can.

This worked just fine when the file server was also a DC (I was using sssd
at the time for user/group resolution on the machine) but I can't work out
how to get it working now.

Normal user accounts work fine, but if I try to get information on a
computer account, I can't:

[root at fileserver ~]# wbinfo -i "computer$"
failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
Could not get info for user computer$

This is probably explained by me not seeing the option to allocate a UNIX
UID / GID to a computer account in ADUC, of course - it shows me different
options instead and doesn't have the box to specify UID/GID etc.

Nothing shows up in 'net cache list' on the file server, either, for
this
computer:

[root at fileserver ~]# net cache list | grep -i computer

The group itself can be resolved just fine, even though the computer
accounts can't - and it shows that the computer accounts are definitely
members of the group in question:

[root at fileserver ~]# wbinfo --group-info sw-dist
sw-dist:x:12345:computer$,computer2$,computer3$,computer4$

All of this inevitably leads to the key directories in question not being
accessible by the computers who need them. When the computer account
connects to the file server, its group memberships don't really seem to
work. I suspect that sssd had different behaviour to winbind in this regard.

Has anybody else successfully served out files to a computer account
belonging to a specific group, using samba and winbind? I don't really see
how I can practically have computer accounts as a member of a group if I'm
using winbind.

Cheers,

Jonathan


[root at fileserver ~]# getfacl /data/wpkg
getfacl: Removing leading '/' from absolute path names
# file: data/wpkg
# owner: root
# group: sw-dist
# flags: -s-
user::rwx
user:root:rwx
group::rwx
group:sw-dist:r-x
group:domain\040admins:rwx
group:3000075:rwx
mask::rwx
other::r-x
default:user::rwx
default:user:root:rwx
default:group::rwx
default:group:sw-dist:r-x
default:group:domain\040admins:rwx
default:group:3000075:rwx
default:group:3000166:r-x
default:mask::rwx
default:other::rwx


--
"If we knew what it was we were doing, it would not be called research,
would it?"
      - Albert Einstein

On Sun, 11 Sep 2016 19:03:05 +0100
Jonathan Hunter via samba <samba at lists.samba.org> wrote:
> Hi All,
> 
> Some time ago I reluctantly moved DC functionality off my file server
> and onto a separate machine, due to the well-known challenges using
> the same machine as both a file server and a DC. This went mostly
> fine, with one exception - I have one piece of functionality that
> worked before, but I still don't have working now.
> 
> I use wpkg for software distribution, having all relevant computer
> accounts be a member of a group (lets' call it sw-dist) and setting
> the ownership of my /data/wpkg directory on the server appropriately
> so that all members of that group (i.e. all relevant computer
> accounts) can access the files - see below. I am using rfc2307
> attributes to specify UIDs and GIDs where I can.
> 
> This worked just fine when the file server was also a DC (I was using
> sssd at the time for user/group resolution on the machine) but I
> can't work out how to get it working now.
> 
> Normal user accounts work fine, but if I try to get information on a
> computer account, I can't:
> 
> [root at fileserver ~]# wbinfo -i "computer$"
> failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
> Could not get info for user computer$
> 
> This is probably explained by me not seeing the option to allocate a
> UNIX UID / GID to a computer account in ADUC, of course - it shows me
> different options instead and doesn't have the box to specify UID/GID
> etc.
> 
> Nothing shows up in 'net cache list' on the file server, either,
for
> this computer:
> 
> [root at fileserver ~]# net cache list | grep -i computer
> 
> The group itself can be resolved just fine, even though the computer
> accounts can't - and it shows that the computer accounts are
> definitely members of the group in question:
> 
> [root at fileserver ~]# wbinfo --group-info sw-dist
> sw-dist:x:12345:computer$,computer2$,computer3$,computer4$
> 
> All of this inevitably leads to the key directories in question not
> being accessible by the computers who need them. When the computer
> account connects to the file server, its group memberships don't
> really seem to work. I suspect that sssd had different behaviour to
> winbind in this regard.
> 
> Has anybody else successfully served out files to a computer account
> belonging to a specific group, using samba and winbind? I don't
> really see how I can practically have computer accounts as a member
> of a group if I'm using winbind.
> 
> Cheers,
> 
> Jonathan
> 
> 
> [root at fileserver ~]# getfacl /data/wpkg
> getfacl: Removing leading '/' from absolute path names
> # file: data/wpkg
> # owner: root
> # group: sw-dist
> # flags: -s-
> user::rwx
> user:root:rwx
> group::rwx
> group:sw-dist:r-x
> group:domain\040admins:rwx
> group:3000075:rwx
> mask::rwx
> other::r-x
> default:user::rwx
> default:user:root:rwx
> default:group::rwx
> default:group:sw-dist:r-x
> default:group:domain\040admins:rwx
> default:group:3000075:rwx
> default:group:3000166:r-x
> default:mask::rwx
> default:other::rwx
> 
> 
> --
> "If we knew what it was we were doing, it would not be called
> research, would it?"
>       - Albert Einstein
OK, never used a computer as a user, so I tried your command:

rowland at devstation:~/programming/samba/sadms/saddm-2.0.15$ wbinfo -i
devstation\$
failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
Could not get info for user devstation$

I then thought, a computers samaccountname is in uppercase, so I tried
that:

rowland at devstation:~/programming/samba/sadms/saddm-2.0.15$ wbinfo -i
DEVSTATION\$
failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
Could not get info for user DEVSTATION$

So that didn't work, added a uidNumber to devstation's AD object, that
didn't work, so had a thought and then it came to, computers have a
different primary gid to normal users and if Domain Users doesn't have a
gidNumber, winbindd ignores the users. I added a gidNumber to Domain
Computers and:

rowland at devstation:~/programming/samba/sadms/saddm-2.0.15$ getent passwd
DEVSTATION\$
devstation$:*:10009:10003:DEVSTATION:/home/SAMDOM/devstation_:/bin/false
rowland at devstation:~/programming/samba/sadms/saddm-2.0.15$ wbinfo -i
DEVSTATION\$
devstation$:*:10009:10003:DEVSTATION:/home/SAMDOM/devstation_:/bin/false

Try it, I feel sure it will fix your problem.

Rowland

Thank you Rowland, I like your thinking - made sense to me.

I had already allocated a GID to Domain Computers:

[root at fileserver ~]# getent group Domain\ Computers
domain computers:x:12345:

however I just now tried adding a uidNumber attribute to one of my computer
objects using ADSIEdit and hey presto, that computer now appears in 'getent
passwd'!

I wonder if there is some fix that could be made on the samba side - I
don't know exactly how if I'm honest.. but for every domain computer I
will
now have to:
- manually add a uidNumber attribute
- manually reset the AD attribute containing the max uidNumber allocated,
so that ADUC doesn't duplicate UIDs

That'll work - and I'm happy to do that in my case as it will work
around
the issue (thank you!!) but it doesn't seem to be the best replacement for
the MS behaviour of just adding a computer object to a group, and that's it
:) But at the moment I can't think of what we might be able to do better?

Many thanks for the pointer,

Jonathan

On 11 September 2016 at 20:02, Rowland Penny <rpenny at samba.org> wrote:
> On Sun, 11 Sep 2016 19:03:05 +0100
> Jonathan Hunter via samba <samba at lists.samba.org> wrote:
>
> > Hi All,
> >
> > Some time ago I reluctantly moved DC functionality off my file server
> > and onto a separate machine, due to the well-known challenges using
> > the same machine as both a file server and a DC. This went mostly
> > fine, with one exception - I have one piece of functionality that
> > worked before, but I still don't have working now.
> >
> > I use wpkg for software distribution, having all relevant computer
> > accounts be a member of a group (lets' call it sw-dist) and
setting
> > the ownership of my /data/wpkg directory on the server appropriately
> > so that all members of that group (i.e. all relevant computer
> > accounts) can access the files - see below. I am using rfc2307
> > attributes to specify UIDs and GIDs where I can.
> >
> > This worked just fine when the file server was also a DC (I was using
> > sssd at the time for user/group resolution on the machine) but I
> > can't work out how to get it working now.
> >
> > Normal user accounts work fine, but if I try to get information on a
> > computer account, I can't:
> >
> > [root at fileserver ~]# wbinfo -i "computer$"
> > failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
> > Could not get info for user computer$
> >
> > This is probably explained by me not seeing the option to allocate a
> > UNIX UID / GID to a computer account in ADUC, of course - it shows me
> > different options instead and doesn't have the box to specify
UID/GID
> > etc.
> >
> > Nothing shows up in 'net cache list' on the file server,
either, for
> > this computer:
> >
> > [root at fileserver ~]# net cache list | grep -i computer
> >
> > The group itself can be resolved just fine, even though the computer
> > accounts can't - and it shows that the computer accounts are
> > definitely members of the group in question:
> >
> > [root at fileserver ~]# wbinfo --group-info sw-dist
> > sw-dist:x:12345:computer$,computer2$,computer3$,computer4$
> >
> > All of this inevitably leads to the key directories in question not
> > being accessible by the computers who need them. When the computer
> > account connects to the file server, its group memberships don't
> > really seem to work. I suspect that sssd had different behaviour to
> > winbind in this regard.
> >
> > Has anybody else successfully served out files to a computer account
> > belonging to a specific group, using samba and winbind? I don't
> > really see how I can practically have computer accounts as a member
> > of a group if I'm using winbind.
> >
> > Cheers,
> >
> > Jonathan
> >
> >
> > [root at fileserver ~]# getfacl /data/wpkg
> > getfacl: Removing leading '/' from absolute path names
> > # file: data/wpkg
> > # owner: root
> > # group: sw-dist
> > # flags: -s-
> > user::rwx
> > user:root:rwx
> > group::rwx
> > group:sw-dist:r-x
> > group:domain\040admins:rwx
> > group:3000075:rwx
> > mask::rwx
> > other::r-x
> > default:user::rwx
> > default:user:root:rwx
> > default:group::rwx
> > default:group:sw-dist:r-x
> > default:group:domain\040admins:rwx
> > default:group:3000075:rwx
> > default:group:3000166:r-x
> > default:mask::rwx
> > default:other::rwx
> >
> >
> > --
> > "If we knew what it was we were doing, it would not be called
> > research, would it?"
> >       - Albert Einstein
>
> OK, never used a computer as a user, so I tried your command:
>
> rowland at devstation:~/programming/samba/sadms/saddm-2.0.15$ wbinfo -i
> devstation\$
> failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
> Could not get info for user devstation$
>
> I then thought, a computers samaccountname is in uppercase, so I tried
> that:
>
> rowland at devstation:~/programming/samba/sadms/saddm-2.0.15$ wbinfo -i
> DEVSTATION\$
> failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
> Could not get info for user DEVSTATION$
>
> So that didn't work, added a uidNumber to devstation's AD object,
that
> didn't work, so had a thought and then it came to, computers have a
> different primary gid to normal users and if Domain Users doesn't have
a
> gidNumber, winbindd ignores the users. I added a gidNumber to Domain
> Computers and:
>
> rowland at devstation:~/programming/samba/sadms/saddm-2.0.15$ getent passwd
> DEVSTATION\$
> devstation$:*:10009:10003:DEVSTATION:/home/SAMDOM/devstation_:/bin/false
> rowland at devstation:~/programming/samba/sadms/saddm-2.0.15$ wbinfo -i
> DEVSTATION\$
> devstation$:*:10009:10003:DEVSTATION:/home/SAMDOM/devstation_:/bin/false
>
> Try it, I feel sure it will fix your problem.
>
> Rowland
>
>
>

-- 
"If we knew what it was we were doing, it would not be called research,
would it?"
      - Albert Einstein