samba - Aug 2011 - No admin privileges after upgrade from 3.5.8 to 3.6.0rc3

Hi,

since I was bitten badly by this today, I take the additional time to 
report this issue here. 

After upgrading from samba 3.5.8 to 3.6.0rc3, Administrator on the xp 
clients (yes, still xp sp3, no vista, no win7 clients here) lost its 
admin privileges.

My Samba PDC setup evolved over about a decade now, but since it still 
needs to support a small environment only (20 xp, 30 users), I kept 
the "security = user" approach, mainly because it allows different 
passwords for the linux and windows environment.

[global]
    security = user
    domain master = yes
    preferred master = yes
    local master = yes
    domain logons = yes
    wins support = yes
    admin users = root @ntadmin

My admin is called admin:

$ id admin
uid=1002(admin) gid=71(ntadmin) Gruppen=71(ntadmin),512(domadmin)

$ cat /etc/samba/smbusers
admin = administrator
nobody = guest pcguest smbguest

$ getent group
domadmin:*:512:admin
domuser:*:513:u1,u2,...
domguest:*:514:
ntadmin:*:71:

$ net groupmap list
Dom?nen Benutzer (S-1-5-21-884593593-3352586541-3369792858-513) -> 
domuser
Dom?nen Administratoren 
(S-1-5-21-884593593-3352586541-3369792858-512) -> domadmin
Dom?nen G?ste (S-1-5-21-884593593-3352586541-3369792858-514) -> domguest

$ net rpc user
u1
u2
admin
...

$ net rpc user info admin
Dom?nen Benutzer
Dom?nen Administratoren

Users and admin can "domain" login just fine, but with 3.6.0rc3, the 
admin lost his privileges, simply downgrading samba to 3.5.8 fixed 
this.

<openSUSE Build Service internals>
Here's my samba build:
https://build.opensuse.org/package/show?package=samba&project=home%3Afrispete%3Asamba%3ASTABLE

That's linked to project network:samba:STABLE. If somebody from this 
project there is reading here: Doesn't the term "STABLE" and the 
project description imply stable released packages? IMHO, a release 
candidate doesn't match this criteria, but others might disagree. 
</openSUSE Build Service internals>

Since this is a productive environment, I can perform tests during the 
weekend only (as long as my family permits..).

Pete

Hans-Peter Jansen wrote:
> Hi,
> 
> since I was bitten badly by this today, I take the additional time to 
> report this issue here. 
> 
> After upgrading from samba 3.5.8 to 3.6.0rc3, Administrator on the xp 
> clients (yes, still xp sp3, no vista, no win7 clients here) lost its 
> admin privileges.
> 
> My Samba PDC setup evolved over about a decade now, 
Ditto.
but since it still
> needs to support a small environment only (20 xp, 30 users), I kept 
> the "security = user" approach,
---
(only need to support 1-2 users ! ... + my many personalities!
> Users and admin can "domain" login just fine, but with 3.6.0rc3,
the
> admin lost his privileges, simply downgrading samba to 3.5.8 fixed 
> this.
===	I didn't catch my problem soon enough and it corrupted my DB,
so after going back to 3.5.10, I'm slowing working on ironing out the 
problems again.


> Here's my samba build:
>
https://build.opensuse.org/package/show?package=samba&project=home%3Afrispete%3Asamba%3ASTABLE
> 
> That's linked to project network:samba:STABLE. If somebody from this 
> project there is reading here: Doesn't the term "STABLE" and
the
> project description imply stable released packages? IMHO, a release 
> candidate doesn't match this criteria, but others might disagree. 
> </openSUSE Build Service internals>
----
I saw the joke on the suse servers...but these are the same guys jumping
to every new tech for 'stable' User releases (still haven't
recovered from
an 11.2->11.4 server upgrade done last april...keep finding
"gotcha's" and
collateral damage.
---
FWIW, I reported 3.6 problems in the user database area on the samba tech
list back a month ago...never got any feedback.

http://lists.samba.org/archive/samba-technical/2011-July/078663.html


My prob, is everytime I get my config 'correct', they change the 
definition of
correct in a newer version...(sigh...what else is new...)...