samba - Jul 2021 - multiuser with simple user mapping

On Thu, 2021-07-01 at 10:41 +0200, Aur?lien Aptel via samba
wrote:
> Eric Levy via samba <samba at lists.samba.org> writes:
> > Is it possible without Kerberos? I investigated it but found no way
> > to
> > provision a deployment in a straightforward way that is suitable
> > for
> > small networks with only a few users. There are few to no resources
> > on
> > the subject not targeted at administrators of networks of many
> > nodes
> > and users. In this case, there are only two nodes and a few users,
> > so
> > it is hoped that there is a relatively simple and easy solution.
> 
> If all the users in all the machines accessing the share in your
> network
> share the the same UID namespace without conflicts, then in that case
> you could use idsfromsid I think. With it, any *new* file created by
> user bob will show up on the share as owned by a special SID that
> contains the UID. And only files created with that mount options
> should
> be listed back with bob uid.
> 
> That being said, if you have the same uid namespace on all machines
> for
> user bob, that means you already have some sort of centralized
> identication server similar to AD and are using winbind or sssd.
That's the problem, he isn't, he is running Samba as a standalone
server, it would be a lot easier if he was running Samba as a Unix
domain member.

Rowland
>

Hello:
I am doing stress testing with samba4(4.13.*); using python I generate a 
batch of 20000 users in an AD that already has 20000 users generated. 
The average time for the generation of the first users of the batch is 
less than 1 second... and this time becomes almost 3 seconds when it is 
reaching the 20000 users (that is with almost 40000 users in the AD). I 
have been monitoring the server resources (and repeating the tests with 
different amount of cores and memory in the vm, for example 4 cores and 
4GB of memory, duplicating these values, etc) and my conclusion is that 
increasing the cores does not decrease the time for the generation of a 
user, but it does improve the loading time of the complete batch, and 
the memory consumption does not modify considerably even if the workload 
varies. I detected that the i/o times to disk increase according to the 
load. My question is if there is any document or recommendation to tune 
configurations in samba that allow me to improve these times (for 
example dump the ldap base to memory or increase cache sizes, etc).
greetings
Marcos Negrini

On Thu, 2021-07-01 at 09:48 +0100, Rowland Penny via samba
wrote:
> > If all the users in all the machines accessing the share in your
> > network
> > share the the same UID namespace without conflicts, then in that
> > case
> > you could use idsfromsid I think. With it, any *new* file created
> > by
> > user bob will show up on the share as owned by a special SID that
> > contains the UID. And only files created with that mount options
> > should
> > be listed back with bob uid.
> > 
> > That being said, if you have the same uid namespace on all machines
> > for
> > user bob, that means you already have some sort of centralized
> > identication server similar to AD and are using winbind or sssd.
> 
> That's the problem, he isn't, he is running Samba as a standalone
> server, it would be a lot easier if he was running Samba as a Unix
> domain member.
> 
> Rowland

Not using a domain is a preference based on a hope to achieve the
stated behavior as simply as possible. All else being equal, two nodes
is simpler than two nodes plus a domain server. Both hardware and
administrative resources are scarce. I had hoped that the coordination
of users and permissions might be accomplished between two nodes using
only what is already provided by these nodes. Certainly, support for
such a case would be a very helpful feature. A domain by definition is
most relevant when the number of other nodes exceeds two, so it is not
optimal to face the requirement to create a domain just to add
capabilities to the way two nodes interact. 

I am not opposed categorically to a domain server, but as the resources
to provision and to maintain any configuration is minimal, and as most
information on the topic of domain servers is targeted at
administrators managing full-scale commercial or institutional
deployments, I am wondering what information or references participants
on this list might offer to help me understand how to achieve this
result as efficiently as possible.

Available nodes are limited to the Synology device, which has some
support for domain servers through add-on packages, and any virtual
machines I may create on the same device. In fact, the "server" I
earlier mentioned is actually a virtual machine on the Synology device.
I had omitted this detail because it is doubtful that it would affect
any answer given so far.

To summarize, I think the following would be most helpful, at this
stage:

   1. Any concise resources explaining how to create a basic configuration
      of a domain server on the Synology device, for the stated use case,
      assuming minimal knowledge on the subject.
   2. A concrete example of the simplest mount command expected to satisfy
      the case.