samba - Mar 2021 - Failed to prepare gensec: NT_STATUS_INVALID_SERVER_STATE

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens Rowland penny
via
> samba
> Verzonden: woensdag 31 maart 2021 16:03
> Aan: sambalist
> Onderwerp: Re: [Samba] Failed to prepare gensec:
> NT_STATUS_INVALID_SERVER_STATE
> 
> On 31/03/2021 14:56, Stefan Bellon wrote:
> > On Wed, 31 Mar, Rowland penny via samba wrote:
> >
> >> OK, I 'think' I may know what is going on here with unison
and if I
> >> am correct, unless we can come up with a fix, we may have to
> >> recommend not using unison.
> >>
> >> O:LAG:BA is:
> >> O = owner
> >> LA = local Administrator
> >> G = group
> >> BA = BUILTIN\Administrators
> >>
> >> I 'think' unison is somehow mapping
'BUILTIN\Administrators' to 'root'
> > Ok, so I should be using the osync approach from
> >
> https://wiki.samba.org/index.php/Bidirectional_Rsync/osync_based_SysVol_re
> plication_workaround instead of unison?
> >
> > Greetings,
> > Stefan
> >
> No, it is an artefact of Louis's script, the group on
> /var/lib/samba/sysvol should not be 'root', but Louis's script
is
> showing it as such and to get the correct 'name', you will have to
set
> up /etc/nsswitch.conf and the winbind links on the DC.
> 
> Rowland
> 
An artefact? Heheh.. i think, i need to add that nsswitch part also in the setup
but yes, i think thats missing also, nsswitch setup.


This is my output.  (Version 4.13.7-Debian) 
Still from the same script (as used above) 

getfacl /var/lib/samba/sysvol/ 
getfacl: Removing leading '/' from absolute path names
# file: var/lib/samba/sysvol/
# owner: root
# group: BUILTIN\\administrators
user::rwx
user:root:rwx
user:BUILTIN\\administrators:rwx
user:BUILTIN\\server\040operators:r-x
user:NT\040AUTHORITY\\system:rwx
user:NT\040AUTHORITY\\authenticated\040users:r-x
group::rwx
group:BUILTIN\\administrators:rwx
group:BUILTIN\\server\040operators:r-x
group:NT\040AUTHORITY\\system:rwx
group:NT\040AUTHORITY\\authenticated\040users:r-x
mask::rwx
other::---
default:user::rwx
default:user:root:rwx
default:user:BUILTIN\\administrators:rwx
default:user:BUILTIN\\server\040operators:r-x
default:user:NT\040AUTHORITY\\system:rwx
default:user:NT\040AUTHORITY\\authenticated\040users:r-x
default:group::---
default:group:BUILTIN\\administrators:rwx
default:group:BUILTIN\\server\040operators:r-x
default:group:NT\040AUTHORITY\\system:rwx
default:group:NT\040AUTHORITY\\authenticated\040users:r-x
default:mask::rwx
default:other::---

Greetz, 

Louis

On Wed, 31 Mar, L.P.H. van Belle via samba wrote:
> This is my output.  (Version 4.13.7-Debian) 
> Still from the same script (as used above) 
> 
> getfacl /var/lib/samba/sysvol/ 
> getfacl: Removing leading '/' from absolute path names
> # file: var/lib/samba/sysvol/
> # owner: root
> # group: BUILTIN\\administrators
Please help me understand ... I fail to see how the script you linked
- with the content -

Create_DC_SYVOL_ACL_FILE () {
    Get_DC_SERVER_OPERATORS
    Get_DC_ADMINISTRATORS
    Get_DC_SYSTEM
    Get_DC_AUTHENTICATED_USERS

    RIGHTSFILE="default-rights-sysvol.acl"
    cat << EOF > "${RIGHTSFILE}"
# file: ${DC_SYSVOL_PATH}
# owner: root
# group: root

can create something different than

# group: root

in its output ... :-}

Samba 4.13.5 from Debian Bullseye (testing), BTW.

Greetings,
Stefan

-- 
Stefan Bellon

I'll try.. 

Line 18-23. 
These SID's are common SID's .. 

Then i can do the convertion of SID 2 UID(or GID)

DC_SERVER_OPERATORS_SID2UID="wbinfo --sid-to-uid=S-1-5-32-549"

wbinfo --sid-to-uid=S-1-5-32-549
3000001

This UID is only in the AD-DB (idmap.ldb as far i know). 
now we are in the script at lines 52-79 

i use wbinfo to find all known names/UIDs/groups and set that. 

if you set uid/gid 3000001 then linux will resolve it. 
If .. nsswitch also contains winbind  
i use it like this on my AD-DC's

passwd:         files systemd winbind
group:          files systemd winbind

so next,  root = Administrator on the AD-DC already (default mapping) 

Thats basicly it, and i do that for all know 4, these. 

DC_SERVER_OPERATORS="S-1-5-32-549"
DC_ADMINISTRATORS="S-1-5-32-544"
DC_SYSTEM="S-1-5-18"
DC_AUTHENTICATED_USERS="S-1-5-11"

so.. how do i get : 
# file: var/lib/samba/sysvol/
# owner: root
# group: BUILTIN\\administrators

we know : 300001 = BUILTIN\\administrators 
so, chmod root:300001 

We cant use : root:"BUILTIN\\administrators" 
because thats not know in linux groups itself. 
But the id's will resolved with nsswitch. 

I hope that helped.. 

if not, office closing, im back tomorrow to reply. 

Greetz, 

Louis


> -----Oorspronkelijk bericht-----
> Van: Stefan Bellon [mailto:bellon at axivion.com]
> Verzonden: woensdag 31 maart 2021 16:47
> Aan: samba at lists.samba.org
> CC: L.P.H. van Belle
> Onderwerp: Re: [Samba] Failed to prepare gensec:
> NT_STATUS_INVALID_SERVER_STATE
> 
> On Wed, 31 Mar, L.P.H. van Belle via samba wrote:
> 
> > This is my output.  (Version 4.13.7-Debian)
> > Still from the same script (as used above)
> >
> > getfacl /var/lib/samba/sysvol/
> > getfacl: Removing leading '/' from absolute path names
> > # file: var/lib/samba/sysvol/
> > # owner: root
> > # group: BUILTIN\\administrators
> 
> Please help me understand ... I fail to see how the script you linked
> - with the content -
> 
> Create_DC_SYVOL_ACL_FILE () {
>     Get_DC_SERVER_OPERATORS
>     Get_DC_ADMINISTRATORS
>     Get_DC_SYSTEM
>     Get_DC_AUTHENTICATED_USERS
> 
>     RIGHTSFILE="default-rights-sysvol.acl"
>     cat << EOF > "${RIGHTSFILE}"
> # file: ${DC_SYSVOL_PATH}
> # owner: root
> # group: root
> 
> can create something different than
> 
> # group: root
> 
> in its output ... :-}
> 
> Samba 4.13.5 from Debian Bullseye (testing), BTW.
> 
> Greetings,
> Stefan
> 
> --
> Stefan Bellon