samba - Feb 2025 - Reported group membership is different between domain member and Samba ADC

On Fri, 14 Feb 2025 10:51:57 -0500
"John R. Graham via samba" <samba at lists.samba.org> wrote:
> I was experimenting with centralized administration of Linux 
> administrative privileges, so I created the group. (I have to assume 
> that there's nothing fundamentally wrong with creating a domain group 
> for some special purpose.) I then added to /etc/sudoers:
> 
>  ??? %SAMDOM\\wheel ALL=(ALL:ALL) ALL
> 
> and to /etc/pam.d/su
> 
>  ??? auth??????? required??? pam_wheel.so use_uid group=SAMDOM\wheel
> 
> With those changes the domain members seem to honor the domain group
> to allow sudo and su, but the ADC does not, presumably because the 
> effective group membership is different. Now, if you were to argue
> that I don't need a new group, that I should be using
> "Administrators" or "Domain Admins" instead, then
I'd accept that
> criticism. I just thought that "wheel" was a more *nix -flavored
> name. And certainly the effective domain user domain group membership
> shouldn't be different when viewed on different domain member
> machines, should it?
> 
Well yes, you can do it that way, but there is an easier way.
There is a group in AD called 'Domain Admins'
Add any AD users that you want to be domain administrators to that
group, then, using visudo add this line to the sudo config:

%SAMDOM\\domain\ admins ALL=(ALL:ALL) ALL

Where 'SAMDOM' is your NetBIOS domain name.

Check that your users are members of Domain Admins, you can do this
with 'getent group domain\ admins'

Now when they log in your domain administrators will be able to use
sudo.

For extra brownie points, you could store the sudo rules in AD ;-)

Rowland

On 2/14/25 11:22, Rowland Penny via samba wrote:
> Well yes, you can do it that way, but there is an easier way.
> There is a group in AD called 'Domain Admins'
> Add any AD users that you want to be domain administrators to that
> group, then, using visudo add this line to the sudo config:
>
> %SAMDOM\\domain\ admins ALL=(ALL:ALL) ALL
>
> Where 'SAMDOM' is your NetBIOS domain name.
>
> Check that your users are members of Domain Admins, you can do this
> with 'getent group domain\ admins'
>
> Now when they log in your domain administrators will be able to use
> sudo.
>
> For extra brownie points, you could store the sudo rules in AD ;-)
>
> Rowland
>
As it turns out, I still have the same issue:

 ??? dc1 ~ # samba-tool group addmembers "Domain Admins" jgraham
 ??? Added members to group Domain Admins
 ??? dc1 ~ # net cache flush
 ??? dc1 ~ # samba-tool group listmembers 'domain admins'
 ??? jgraham
 ??? Administrator

And yet:

 ??? dc1 ~ # id HOME\\jgraham
 ??? uid=11105(SAMDOM\jgraham) gid=10513(SAMDOM\domain users) 
groups=10513(SAMDOM\domain users),3000020,3000006(BUILTIN\users)

and also, logged in as me instead of root:

 ??? SAMDOM\jgraham at dc1 ~ $ getent group domain\ admins
 ??? SAMDOM\domain admins:x:3000000:

So, for an undiagnosed reason, the effective domain membership does not 
include "domain admins" either.

- John