On 15/12/2022 08:23, Piviul via samba wrote:> Sorry for the answer delay...
>
> On 12/2/22 14:13, Rowland Penny via samba wrote:
>> I think you are going to have to give us more info. For some reason,
>> PAM seems to be treating the computers as users (which they are in AD,
>> but rather special users), also it isn't winbind that creates home
>> directories, it is a PAM plugin.
>
> yes, you are right, in effect I can't find PC names in users
>
> $ wbinfo --domain-users | grep $(hostname)
> $
>
> or in groups
>
> $ wbinfo --domain-groups | grep $(hostname)
> $
>
> but for PAM the PC is a user:
>
> $ getent passwd $(wbinfo --own-domain)\\$(hostname)$
> DOMINIOCSA\psala-lx$:*:21298:10513::/home/DOMINIOCSA/psala-lx_:/bin/bash
No that isn't PAM, it is a combination of winbind and nsswitch, though
it looks like there is a bug, '10513' is undoubtedly Domain Users and a
computers primary group is Domain Computers.
>
> and it is a group too:
>
> $ getent group $(wbinfo --own-domain)\\$(hostname)$
> DOMINIOCSA\psala-lx$:x:21298:DOMINIOCSA\psala-lx$
That is probably a side effect of the winbind code (synthetic users
group) and possibly would not happen if the 'ad' idmap backend was used.
>
> in my nsswitch.conf I have only set:
>
> $ grep winbind /etc/nsswitch.conf
> passwd:???????? files winbind systemd
> group:????????? files winbind systemd
>
> There is something else I have to do to instruct PAM how to get users?
It isn't PAM.
>
>> What OS ?
>
> from debian stretch with built-in samba 4.5.16 to debian bookworm with
> built-in samba 4.17.3.
There has to be a reason why you are using a dead OS and a dead version
of Samba, but it escapes me.
>
>> How have you set the mkhomedir option ?
> $ grep mkhomedir /etc/security/pam_winbind.conf
> mkhomedir = yes
That is just calling pam_mkhomedir
>
>> Why are the PC's connecting as users ?
>
> I don't know, I was thinking was inside the smb protocol but... never
> take anything for granted ;)
I was just asking in case you were doing something strange, which it
appears you are not. This must be down to another of Windows strange
ideas, where a computer is also a user, something that is meaningless to
Unix.
It looks like you are using the 'rid' idmap backend and if so, there is
a bug for this, see here:
https://bugzilla.samba.org/show_bug.cgi?id=13371
But your problem puts another slant on it, care to add to it ?
Rowland