Using Samba 3.0.2 (specifically the samba-3.0.2-7.FC1 Fedora package)
with LDAP as a passdb backend I'm encountering problems with Domain
Groups. I have come across various postings, some to this list, with
people that are experiencing similar problems. However I have not found
any information as to the cause/solution. The problem is as follows. I
have the following group configurations in LDAP:
Windows Domain accounts:
dn: cn=Domain Guests,ou=Groups,o=potsdam.edu
objectClass: posixGroup
cn: Domain Guests
gidNumber: 1000
dn: cn=Domain Admins,ou=Groups,o=potsdam.edu
objectClass: posixGroup
cn: Domain Admins
gidNumber: 1001
dn: cn=Domain Users,ou=Groups,o=potsdam.edu
objectClass: posixGroup
cn: Domain Users
gidNumber: 1002
Local Unix accounts:
dn: cn=nobody,ou=Groups,o=potsdam.edu
objectClass: posixGroup
objectClass: sambaGroupMapping
cn: nobody
gidNumber: 99
sambaSID: S-1-5-21-688789465-4019127931-1496692998-514
sambaGroupType: 2
displayName: Domain Guests
description: Local Unix group
dn: cn=users,ou=Groups,o=potsdam.edu
objectClass: posixGroup
objectClass: sambaGroupMapping
cn: users
gidNumber: 100
sambaSID: S-1-5-21-688789465-4019127931-1496692998-513
sambaGroupType: 2
displayName: Domain Users
description: Local Unix group
dn: cn=wheel,ou=Groups,o=potsdam.edu
objectClass: posixGroup
objectClass: sambaGroupMapping
cn: wheel
gidNumber: 10
sambaSID: S-1-5-21-688789465-4019127931-1496692998-512
sambaGroupType: 2
displayName: Domain Admins
description: Local Unix group
If the user 'root' is added to samba/ldap and assigned to the
"Domain
Admins" domain group, then 'root' is allowed domain administrator
access
as it should be. If you create a new user account, say 'blinky', and add
'blinky' to the "Domain Admins" group, 'blinky' does
not have full
Domain Admin access. For example, 'blinky' cannot use the
"USRMGR.EXE"
administration tool, while root can without any problem. However,
'blinky' CAN remove a machine from the domain, but not add.
I have done a seemingly exhaustive search for information regarding this
problem to find no explicit explanation/solution. Packet captures did
not produce any meaningful information for me personally. The logs have
presented me with rather cryptic leads as to the problem. Googling for
these errors presented me with a few similar cases, but no definite
causes or solutions. Attached below is the output from the logs at debug
levels 2 & 3 as they give different error information.
Log for debug level 2:
[2004/04/22 15:55:58, 2] passdb/pdb_ldap.c:init_sam_from_ldap(462)
init_sam_from_ldap: Entry found for user: kuchytgj
[2004/04/22 15:55:58, 2] passdb/pdb_ldap.c:init_group_from_ldap(1697)
init_group_from_ldap: Entry found for group: 10
[2004/04/22 15:55:58, 2] auth/auth.c:check_ntlm_password(305)
check_ntlm_password: authentication for user [kuchytgj] -> [kuchytgj]
-> [kuchytgj] succeeded
[2004/04/22 15:55:58, 2] lib/access.c:check_access(324)
Allowed connection from (137.143.98.202)
[2004/04/22 15:55:59, 2] smbd/server.c:exit_server(558)
Closing connections
[2004/04/22 15:55:59, 2] passdb/pdb_ldap.c:init_sam_from_ldap(462)
init_sam_from_ldap: Entry found for user: kuchytgj
[2004/04/22 15:55:59, 2] passdb/pdb_ldap.c:init_group_from_ldap(1697)
init_group_from_ldap: Entry found for group: 10
[2004/04/22 15:55:59, 2] auth/auth.c:check_ntlm_password(305)
check_ntlm_password: authentication for user [kuchytgj] -> [kuchytgj]
-> [kuchytgj] succeeded
[2004/04/22 15:55:59, 2] lib/access.c:check_access(324)
Allowed connection from (137.143.98.202)
[2004/04/22 15:55:59, 2]
rpc_server/srv_samr_nt.c:_samr_lookup_domain(2461)
Returning domain sid for domain DEVPOTSDAM ->
S-1-5-21-688789465-4019127931-1496692998
[2004/04/22 15:55:59, 2]
rpc_server/srv_samr_nt.c:access_check_samr_object(93)
_samr_open_domain: ACCESS DENIED (requested: 0x00000211)
[2004/04/22 15:55:59, 2]
rpc_server/srv_samr_nt.c:_samr_lookup_domain(2461)
Returning domain sid for domain DEVPOTSDAM ->
S-1-5-21-688789465-4019127931-1496692998
[2004/04/22 15:55:59, 2]
rpc_server/srv_samr_nt.c:access_check_samr_function(115)
_samr_create_user: ACCESS DENIED (granted: 0x00000201; required:
0x00000010)
[2004/04/22 15:56:00, 2] smbd/server.c:exit_server(558)
Log for debug level 3:
[2004/04/22 15:43:11, 3] smbd/reply.c:reply_ulogoffX(1108)
ulogoffX vuid=100
[2004/04/22 15:43:11, 3] smbd/process.c:process_smb(890)
Transaction 41 of length 39
[2004/04/22 15:43:11, 3] smbd/process.c:switch_message(685)
switch message SMBtdis (pid 13906)
[2004/04/22 15:43:11, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2004/04/22 15:43:11, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2004/04/22 15:43:11, 3] smbd/service.c:close_cnum(887)
dun210-12239 (137.143.98.202) closed connection to service IPC$
[2004/04/22 15:43:11, 3] smbd/connection.c:yield_connection(69)
Yielding connection to IPC$
[2004/04/22 15:43:11, 4] smbd/vfs.c:vfs_ChDir(654)
vfs_ChDir to /
[2004/04/22 15:43:11, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2004/04/22 15:43:11, 3] smbd/process.c:timeout_processing(1104)
timeout_processing: End of file from client (client has disconnected).
[2004/04/22 15:43:11, 3] smbd/sec_ctx.c:set_sec_ctx(288)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2004/04/22 15:43:11, 2] smbd/server.c:exit_server(558)
Closing connections
[2004/04/22 15:43:11, 3] smbd/connection.c:yield_connection(69)
Yielding connection to
[2004/04/22 15:43:11, 3] smbd/connection.c:yield_connection(76)
yield_connection: tdb_delete for name failed with error Record does
not exist.
[2004/04/22 15:43:11, 3] smbd/server.c:exit_server(601)
Server exit (normal exit)
I am not ruling out that the groups maybe mis-configured. I have
encountered much debate/confusion regarding the proper set up of Domain
to local group mapping in LDAP. Thank you in advance for your time, and
any help you are able to provide.
--
Greg