samba - Apr 2015 - FW: [Bug 11241] different ids even when idmap.ldb copied. not abug..

Please read the reported bug and bjorn answer.. which does not help any to a
solution of fix, or explenation.
But the big question now is, does someone somewhere know what bjorn is talking
about.

i did search for "gencache" but no go here.. 
just from old documentation.
https://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/tdb.html 
gencache.tdb  Generic caching database. 


Greetz, 

Louis


-----Oorspronkelijk bericht-----
Van: samba-bugs at samba.org [mailto:samba-bugs at samba.org] 
Verzonden: woensdag 29 april 2015 17:51
Aan: L.P.H. van Belle
Onderwerp: [Bug 11241] different ids even when idmap.ldb copied.

https://bugzilla.samba.org/show_bug.cgi?id=11241

Bj?rn Jacke <bj at sernet.de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |INVALID
             Status|NEW                         |RESOLVED

--- Comment #1 from Bj?rn Jacke <bj at sernet.de> ---
this is not a supported thing to do, so this is not a valid bug. winbindd has a
different way of caching (investigate gencache for example) entries and this is
probably what makes that hack stop working for you with winbindd.

-- 
You are receiving this mail because:
You reported the bug.

REPORTED BUG.. 

Louis     2015-04-29 08:51:03 UTC  
Hai. getting same ids on 2 DC's does not work anymore on samba 4.2.1
with in smb.conf 
server services = -dns +winbindd -winbind
Of i set it to 
server services = -dns -winbindd +winbind 
it does work again. 

with 4.1.17 the solution was simple.. we stop samba on both servers. 
scp /var/lib/samba/private/idmap.ldb root at 192.168.0.2:/var/lib/samba/private/
started samba on both servers and 
id administrator gave the same id's for all groups. 

Now on 4.2.1
DC1:  id administrator
uid=0(root) gid=100(users) groups=0(root),100(users),
3000004(group policy creator owners),
3000006(enterprise admins),
3000008(domain admins),
3000007(schema admins),
3000005(denied rodc password replication group),
3000009(BUILTIN\users),
3000000(BUILTIN\administrators)

id administrator
uid=0(root) gid=100(users) groups=0(root),100(users),
3000011(group policy creator owners),
3000010(enterprise admins),
3000007(domain admins),
3000009(schema admins),
3000008(denied rodc password replication group),
3000001(BUILTIN\users),
3000000(BUILTIN\administrators)

On 30/04/15 07:09, L.P.H. van Belle wrote:
> Please read the reported bug and bjorn answer.. which does not help any to
a solution of fix, or explenation.
> But the big question now is, does someone somewhere know what bjorn is
talking about.
>
> i did search for "gencache" but no go here..
> just from old documentation.
> https://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/tdb.html
> gencache.tdb  Generic caching database.
>
>
> Greetz,
>
> Louis
>
>
> -----Oorspronkelijk bericht-----
> Van: samba-bugs at samba.org [mailto:samba-bugs at samba.org]
> Verzonden: woensdag 29 april 2015 17:51
> Aan: L.P.H. van Belle
> Onderwerp: [Bug 11241] different ids even when idmap.ldb copied.
>
> https://bugzilla.samba.org/show_bug.cgi?id=11241
>
> Bj?rn Jacke <bj at sernet.de> changed:
>
>             What    |Removed                     |Added
>
----------------------------------------------------------------------------
>           Resolution|---                         |INVALID
>               Status|NEW                         |RESOLVED
>
> --- Comment #1 from Bj?rn Jacke <bj at sernet.de> ---
> this is not a supported thing to do, so this is not a valid bug. winbindd
has a
> different way of caching (investigate gencache for example) entries and
this is
> probably what makes that hack stop working for you with winbindd.
>
Hi Louis, no I don't understand what Bjorn is talking about, but then I 
don't think that Bjorn really understands the problem. What if somebody 
got sysvol to replicate, you would quickly end up with a mess, if a 
policy was added on one DC, it would end up being owned by 
somebody/group on the other DC, this is a regression.

Rowland

( sorry for mailing directly bjorn, but please have a look ) 

I still think this is a bug.. 

why not a bug:
If i do assign a UID/GID to a user, then yes, this wil work fine. 
new users and groups sure.. but now im talking about the default domain groups..

why a bug: 
User administrator and the domain groups are set by default by samba. 
and its not consistant at all which is needed for a replicated sysvol. 
yes, not supported by samba, but i hope samba is working on that, and then
this wil be an issue also, better fix it now imo. 

let met explain what i see.. 

administrator has uid 0.. 
wbinfo -i DOMAIN\\administrator
DOMAIN\Administrator:*:0:100::/home/DOMAIN/Administrator:/bin/false 
Administrator ... and not administrator..  

so now this is my result of my sysvol... 
 ls -n
total 8
drwxrwx---+ 4 0 3000000 4096 Apr 28 13:32 internal.domain.tld
wbinfo --uid-info 0
administrator:*:0:100::/home/DOMAIN/administrator:/bin/false
administrator and not Administrator ? 

first 2 differences in usernames :  Administrator and administrator

wbinfo --uid-info 0
administrator:*:0:100::/home/DOMAIN/administrator:/bin/false
wbinfo -i DOMAIN\\administrator
DOMAIN\Administrator:*:0:100::/home/DOMAIN/Administrator:/bin/false

wbinfo -i DOMAIN\\Administrator
administrator:*:0:100::/home/BAZRTD/administrator:/bin/false
converted Adminsitrator to administrator.

look at the homedir..  Caps A and not caps.  so 2 different folders. 
2 different users. 
in total 3 users with uid 0 ( root, administrator and Administrator ) 


in the sysvol/internal.domain.tld : 
ls -n
total 16
drwxrwx---+ 4 0 3000000 4096 Apr 28 13:32 Policies
drwxrwx---+ 2 0 3000000 4096 Apr 28 13:32 scripts

ls -l
total 8
drwxrwx---+ 4 root BUILTIN\administrators 4096 Apr 28 13:32 internal.domain.tld

wbinfo --group-info "BUILTIN\administrators"
BUILTIN\administrators:x:3000000:

for the Policies folder :  
Policies# ls -n
total 16
drwxrwx---+ 4 3000008 3000008 4096 Apr 28 13:32
{31B2F340-016D-11D2-945F-00C04FB984F9}
drwxrwx---+ 4 3000008 3000008 4096 Apr 28 13:32
{6AC1786C-016F-11D2-945F-00C04FB984F9}

wbinfo --uid-info 3000008
domain admins:*:3000008:3000008::/home/DOMAIN/domain admins:/bin/false

wbinfo --gid-info 3000008
domain admins:x:3000008:administrator

wbinfo --group-info "DOMAIN\domain admins"
domain admins:x:3000008:administrator

wbinfo --user-info "DOMAIN\domain admins"
domain admins:*:3000008:3000008::/home/BAZRTD/domain admins:/bin/false


getfacl \{31B2F340-016D-11D2-945F-00C04FB984F9\}/
# file: {31B2F340-016D-11D2-945F-00C04FB984F9}/
# owner: domain\040admins
# group: domain\040admins
user::rwx
group::rwx
group:3000002:rwx
group:3000003:r-x
group:enterprise\040admins:rwx
group:domain\040admins:rwx
group:3000010:r-x
mask::rwx
other::---
default:user::rwx
default:user:domain\040admins:rwx
default:group::---
default:group:3000002:rwx
default:group:3000003:r-x
default:group:enterprise\040admins:rwx
default:group:domain\040admins:rwx
default:group:3000010:r-x
default:mask::rwx
default:other::---

the user owner is the group ?  how can the user owner be a group ? 
I this allowed ?  This i really dont know. 

so i have "user" : "domain admins"
and i have group : "domain admins"

Documentation lacks here, or i really cant find it..   

anyone any comment on this ? 



Greetz, 

Louis



>-----Oorspronkelijk bericht-----
>Van: belle at bazuin.nl [mailto:samba-bounces at lists.samba.org] 
>Namens L.P.H. van Belle
>Verzonden: donderdag 30 april 2015 8:10
>Aan: samba at lists.samba.org
>Onderwerp: [Samba] FW: [Bug 11241] different ids even when 
>idmap.ldb copied. not abug..
>
>Please read the reported bug and bjorn answer.. which does not 
>help any to a solution of fix, or explenation. 
>But the big question now is, does someone somewhere know what 
>bjorn is talking about. 
>
>i did search for "gencache" but no go here.. 
>just from old documentation.
>https://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/tdb.html 
>gencache.tdb  Generic caching database. 
>
>
>Greetz, 
>
>Louis
>
>
>-----Oorspronkelijk bericht-----
>Van: samba-bugs at samba.org [mailto:samba-bugs at samba.org] 
>Verzonden: woensdag 29 april 2015 17:51
>Aan: L.P.H. van Belle
>Onderwerp: [Bug 11241] different ids even when idmap.ldb copied.
>
>https://bugzilla.samba.org/show_bug.cgi?id=11241
>
>Bj?rn Jacke <bj at sernet.de> changed:
>
>           What    |Removed                     |Added
>---------------------------------------------------------------
>-------------
>         Resolution|---                         |INVALID
>             Status|NEW                         |RESOLVED
>
>--- Comment #1 from Bj?rn Jacke <bj at sernet.de> ---
>this is not a supported thing to do, so this is not a valid 
>bug. winbindd has a
>different way of caching (investigate gencache for example) 
>entries and this is
>probably what makes that hack stop working for you with winbindd.
>
>-- 
>You are receiving this mail because:
>You reported the bug.
>
>REPORTED BUG.. 
>
>Louis     2015-04-29 08:51:03 UTC  
>Hai. getting same ids on 2 DC's does not work anymore on samba 4.2.1
>with in smb.conf 
>server services = -dns +winbindd -winbind
>Of i set it to 
>server services = -dns -winbindd +winbind 
>it does work again. 
>
>with 4.1.17 the solution was simple.. we stop samba on both servers. 
>scp /var/lib/samba/private/idmap.ldb 
>root at 192.168.0.2:/var/lib/samba/private/
>started samba on both servers and 
>id administrator gave the same id's for all groups. 
>
>Now on 4.2.1
>DC1:  id administrator
>uid=0(root) gid=100(users) groups=0(root),100(users),
>3000004(group policy creator owners),
>3000006(enterprise admins),
>3000008(domain admins),
>3000007(schema admins),
>3000005(denied rodc password replication group),
>3000009(BUILTIN\users),
>3000000(BUILTIN\administrators)
>
>id administrator
>uid=0(root) gid=100(users) groups=0(root),100(users),
>3000011(group policy creator owners),
>3000010(enterprise admins),
>3000007(domain admins),
>3000009(schema admins),
>3000008(denied rodc password replication group),
>3000001(BUILTIN\users),
>3000000(BUILTIN\administrators)
>
>-- 
>To unsubscribe from this list go to the following URL and read the
>instructions:  https://lists.samba.org/mailman/options/samba
>
>

On 30/04/15 09:09, L.P.H. van Belle wrote:
> ( sorry for mailing directly bjorn, but please have a look )
>
> I still think this is a bug..
>
> why not a bug:
> If i do assign a UID/GID to a user, then yes, this wil work fine.
> new users and groups sure.. but now im talking about the default domain
groups..
>
> why a bug:
> User administrator and the domain groups are set by default by samba.
> and its not consistant at all which is needed for a replicated sysvol.
> yes, not supported by samba, but i hope samba is working on that, and then
> this wil be an issue also, better fix it now imo.
>
> let met explain what i see..
>
> administrator has uid 0..
> wbinfo -i DOMAIN\\administrator
> DOMAIN\Administrator:*:0:100::/home/DOMAIN/Administrator:/bin/false
> Administrator ... and not administrator..
>
> so now this is my result of my sysvol...
>   ls -n
> total 8
> drwxrwx---+ 4 0 3000000 4096 Apr 28 13:32 internal.domain.tld
> wbinfo --uid-info 0
> administrator:*:0:100::/home/DOMAIN/administrator:/bin/false
> administrator and not Administrator ?
>
> first 2 differences in usernames :  Administrator and administrator
Don't worry about that, this is just winbind normalising names
>
> wbinfo --uid-info 0
> administrator:*:0:100::/home/DOMAIN/administrator:/bin/false
> wbinfo -i DOMAIN\\administrator
> DOMAIN\Administrator:*:0:100::/home/DOMAIN/Administrator:/bin/false
>
> wbinfo -i DOMAIN\\Administrator
> administrator:*:0:100::/home/BAZRTD/administrator:/bin/false
> converted Adminsitrator to administrator.
>
> look at the homedir..  Caps A and not caps.  so 2 different folders.
> 2 different users.
> in total 3 users with uid 0 ( root, administrator and Administrator )
Now that is a problem
>
>
> in the sysvol/internal.domain.tld :
> ls -n
> total 16
> drwxrwx---+ 4 0 3000000 4096 Apr 28 13:32 Policies
> drwxrwx---+ 2 0 3000000 4096 Apr 28 13:32 scripts
>
> ls -l
> total 8
> drwxrwx---+ 4 root BUILTIN\administrators 4096 Apr 28 13:32
internal.domain.tld
>
> wbinfo --group-info "BUILTIN\administrators"
> BUILTIN\administrators:x:3000000:
>
> for the Policies folder :
> Policies# ls -n
> total 16
> drwxrwx---+ 4 3000008 3000008 4096 Apr 28 13:32
{31B2F340-016D-11D2-945F-00C04FB984F9}
> drwxrwx---+ 4 3000008 3000008 4096 Apr 28 13:32
{6AC1786C-016F-11D2-945F-00C04FB984F9}
>
> wbinfo --uid-info 3000008
> domain admins:*:3000008:3000008::/home/DOMAIN/domain admins:/bin/false
>
> wbinfo --gid-info 3000008
> domain admins:x:3000008:administrator
>
> wbinfo --group-info "DOMAIN\domain admins"
> domain admins:x:3000008:administrator
>
> wbinfo --user-info "DOMAIN\domain admins"
> domain admins:*:3000008:3000008::/home/BAZRTD/domain admins:/bin/false
>
>
> getfacl \{31B2F340-016D-11D2-945F-00C04FB984F9\}/
> # file: {31B2F340-016D-11D2-945F-00C04FB984F9}/
> # owner: domain\040admins
> # group: domain\040admins
> user::rwx
> group::rwx
> group:3000002:rwx
> group:3000003:r-x
> group:enterprise\040admins:rwx
> group:domain\040admins:rwx
> group:3000010:r-x
> mask::rwx
> other::---
> default:user::rwx
> default:user:domain\040admins:rwx
> default:group::---
> default:group:3000002:rwx
> default:group:3000003:r-x
> default:group:enterprise\040admins:rwx
> default:group:domain\040admins:rwx
> default:group:3000010:r-x
> default:mask::rwx
> default:other::---
>
> the user owner is the group ?  how can the user owner be a group ?
> I this allowed ?  This i really dont know.
Yes this a mess and is caused by stupid stupid windows allowing groups 
to own files, therefore you end up with ID_TYPE_BOTH in idmap.ldb. From 
my investigations, it is only one group that owns files: Administrators, 
but instead of just making this group 'ID_TYPE_BOTH', samba makes a lot 
of groups 'ID_TYPE_BOTH', have a look in idmap.ldb.

I also tested replacing the ownership of files and dirs in sysvol, I 
changed 'Administrators' for 'Administrator' and changed all
occurrences
of  'ID_TYPE_BOTH' in idmap.ldb to what it actually is. Looking from 
windows, I couldn't see any difference, because (and I am no windows 
expert) I think that windows doesn't actually care who owns the files, 
it only seems to care about the ACLs.

Rowland
>
> so i have "user" : "domain admins"
> and i have group : "domain admins"
>
> Documentation lacks here, or i really cant find it..
>
> anyone any comment on this ?
>
>
>
> Greetz,
>
> Louis
>
>
>
>
>> -----Oorspronkelijk bericht-----
>> Van: belle at bazuin.nl [mailto:samba-bounces at lists.samba.org]
>> Namens L.P.H. van Belle
>> Verzonden: donderdag 30 april 2015 8:10
>> Aan: samba at lists.samba.org
>> Onderwerp: [Samba] FW: [Bug 11241] different ids even when
>> idmap.ldb copied. not abug..
>>
>> Please read the reported bug and bjorn answer.. which does not
>> help any to a solution of fix, or explenation.
>> But the big question now is, does someone somewhere know what
>> bjorn is talking about.
>>
>> i did search for "gencache" but no go here..
>> just from old documentation.
>> https://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/tdb.html
>> gencache.tdb  Generic caching database.
>>
>>
>> Greetz,
>>
>> Louis
>>
>>
>> -----Oorspronkelijk bericht-----
>> Van: samba-bugs at samba.org [mailto:samba-bugs at samba.org]
>> Verzonden: woensdag 29 april 2015 17:51
>> Aan: L.P.H. van Belle
>> Onderwerp: [Bug 11241] different ids even when idmap.ldb copied.
>>
>> https://bugzilla.samba.org/show_bug.cgi?id=11241
>>
>> Bj?rn Jacke <bj at sernet.de> changed:
>>
>>            What    |Removed                     |Added
>> ---------------------------------------------------------------
>> -------------
>>          Resolution|---                         |INVALID
>>              Status|NEW                         |RESOLVED
>>
>> --- Comment #1 from Bj?rn Jacke <bj at sernet.de> ---
>> this is not a supported thing to do, so this is not a valid
>> bug. winbindd has a
>> different way of caching (investigate gencache for example)
>> entries and this is
>> probably what makes that hack stop working for you with winbindd.
>>
>> -- 
>> You are receiving this mail because:
>> You reported the bug.
>>
>> REPORTED BUG..
>>
>> Louis     2015-04-29 08:51:03 UTC
>> Hai. getting same ids on 2 DC's does not work anymore on samba
4.2.1
>> with in smb.conf
>> server services = -dns +winbindd -winbind
>> Of i set it to
>> server services = -dns -winbindd +winbind
>> it does work again.
>>
>> with 4.1.17 the solution was simple.. we stop samba on both servers.
>> scp /var/lib/samba/private/idmap.ldb
>> root at 192.168.0.2:/var/lib/samba/private/
>> started samba on both servers and
>> id administrator gave the same id's for all groups.
>>
>> Now on 4.2.1
>> DC1:  id administrator
>> uid=0(root) gid=100(users) groups=0(root),100(users),
>> 3000004(group policy creator owners),
>> 3000006(enterprise admins),
>> 3000008(domain admins),
>> 3000007(schema admins),
>> 3000005(denied rodc password replication group),
>> 3000009(BUILTIN\users),
>> 3000000(BUILTIN\administrators)
>>
>> id administrator
>> uid=0(root) gid=100(users) groups=0(root),100(users),
>> 3000011(group policy creator owners),
>> 3000010(enterprise admins),
>> 3000007(domain admins),
>> 3000009(schema admins),
>> 3000008(denied rodc password replication group),
>> 3000001(BUILTIN\users),
>> 3000000(BUILTIN\administrators)
>>
>> -- 
>> To unsubscribe from this list go to the following URL and read the
>> instructions:  https://lists.samba.org/mailman/options/samba
>>
>>

Hi Louis,

I think this is not so much related to bug 11241  but more to

https://bugzilla.samba.org/show_bug.cgi?id=9837 (Administrator on AD DC
shouldn't have uid 0)

right?

Best regards
Bj?rn

Hello Bj?rn, 

I can totaly agree with that, having multiple users with the same id isnt what
we want,
but samba needs at some point root rights, for creating folders/files. 
Now we have a "chicken and the egg problem" which one comes first?

At install of samba files and folders are created, by root. 
when installed, started samba and now we can assign a uid/gid to Administrator. 
But at this point Administrator cannot change files/folders owned by root.. 
the installation script ended, and we dont know the correct uid/gids. 

So for all the default users and groups in the AD i really suggest we do assign
dedicated uid/gids.

wbinfo -g
domain admins
domain users
domain guests
domain computers
enterprise admins
group policy creator owners

wbinfo -u
administrator
guest

I remove some the not needed users/groups, as far is i know. 
imo, above should al have a dedicate uid/gid. 

so when all of the above do have dedicated uid/gid, we can assign the needed
folders and files
at install which need one of the above user/groups. 

and this wil help also in the development of samba in replicated sysvol. 


And big thanks for having a look! 


Greetings, 

Louis


>-----Oorspronkelijk bericht-----
>Van: Bjoern Jacke [mailto:bj at sernet.de] 
>Verzonden: donderdag 30 april 2015 10:59
>Aan: L.P.H. van Belle
>CC: samba at lists.samba.org
>Onderwerp: Re: [Samba] FW: [Bug 11241] different ids even when 
>idmap.ldb copied. not abug..
>
>Hi Louis,
>
>I think this is not so much related to bug 11241  but more to
>
>https://bugzilla.samba.org/show_bug.cgi?id=9837 (Administrator on AD DC
>shouldn't have uid 0)
>
>right?
>
>Best regards
>Bj?rn
>
>

>>
>> wbinfo --uid-info 0
>> administrator:*:0:100::/home/DOMAIN/administrator:/bin/false
>> wbinfo -i DOMAIN\\administrator
>> DOMAIN\Administrator:*:0:100::/home/DOMAIN/Administrator:/bin/false
>>
>> wbinfo -i DOMAIN\\Administrator
>> administrator:*:0:100::/home/BAZRTD/administrator:/bin/false
>> converted Adminsitrator to administrator.
>>
>> look at the homedir..  Caps A and not caps.  so 2 different folders.
>> 2 different users.
>> in total 3 users with uid 0 ( root, administrator and Administrator )
>
>Now that is a problem
now time has passed dont know how much .. and...  how strange again..  

root at dc1:~# wbinfo -i DOMAIN\\Administrator
administrator:*:0:100::/home/DOMAIN/administrator:/bin/false

root at dc1:~# wbinfo -i DOMAIN\\administrator
administrator:*:0:100::/home/DOMAIN/administrator:/bin/false

root at dc1:~# wbinfo --uid-info 0
administrator:*:0:100::/home/DOMAIN/administrator:/bin/false

.. im thinking there is something slow in responding/modify-ing.. 

This is the second time i see this, but i cant figure out, the how and where..  
well.. it works now.. (again)  :-)  im not going to hunt this one..  

if you also notice this. 
This is what i did. 

for x in `ls /etc/init.d/sernet-samba-*` ; do $x restart  ; done
net cache flush 
id administrator

now wait a few min and check again. 




Greetz, 

Louis



>-----Oorspronkelijk bericht-----
>Van: rowlandpenny at googlemail.com 
>[mailto:samba-bounces at lists.samba.org] Namens Rowland Penny
>Verzonden: donderdag 30 april 2015 10:32
>Aan: samba at lists.samba.org
>Onderwerp: Re: [Samba] FW: [Bug 11241] different ids even when 
>idmap.ldb copied. not abug..
>
>On 30/04/15 09:09, L.P.H. van Belle wrote:
>> ( sorry for mailing directly bjorn, but please have a look )
>>
>> I still think this is a bug..
>>
>> why not a bug:
>> If i do assign a UID/GID to a user, then yes, this wil work fine.
>> new users and groups sure.. but now im talking about the 
>default domain groups..
>>
>> why a bug:
>> User administrator and the domain groups are set by default by samba.
>> and its not consistant at all which is needed for a 
>replicated sysvol.
>> yes, not supported by samba, but i hope samba is working on 
>that, and then
>> this wil be an issue also, better fix it now imo.
>>
>> let met explain what i see..
>>
>> administrator has uid 0..
>> wbinfo -i DOMAIN\\administrator
>> DOMAIN\Administrator:*:0:100::/home/DOMAIN/Administrator:/bin/false
>> Administrator ... and not administrator..
>>
>> so now this is my result of my sysvol...
>>   ls -n
>> total 8
>> drwxrwx---+ 4 0 3000000 4096 Apr 28 13:32 internal.domain.tld
>> wbinfo --uid-info 0
>> administrator:*:0:100::/home/DOMAIN/administrator:/bin/false
>> administrator and not Administrator ?
>>
>> first 2 differences in usernames :  Administrator and administrator
>
>Don't worry about that, this is just winbind normalising names
>
>>
>> wbinfo --uid-info 0
>> administrator:*:0:100::/home/DOMAIN/administrator:/bin/false
>> wbinfo -i DOMAIN\\administrator
>> DOMAIN\Administrator:*:0:100::/home/DOMAIN/Administrator:/bin/false
>>
>> wbinfo -i DOMAIN\\Administrator
>> administrator:*:0:100::/home/BAZRTD/administrator:/bin/false
>> converted Adminsitrator to administrator.
>>
>> look at the homedir..  Caps A and not caps.  so 2 different folders.
>> 2 different users.
>> in total 3 users with uid 0 ( root, administrator and Administrator )
>
>Now that is a problem
>
>>
>>
>> in the sysvol/internal.domain.tld :
>> ls -n
>> total 16
>> drwxrwx---+ 4 0 3000000 4096 Apr 28 13:32 Policies
>> drwxrwx---+ 2 0 3000000 4096 Apr 28 13:32 scripts
>>
>> ls -l
>> total 8
>> drwxrwx---+ 4 root BUILTIN\administrators 4096 Apr 28 13:32 
>internal.domain.tld
>>
>> wbinfo --group-info "BUILTIN\administrators"
>> BUILTIN\administrators:x:3000000:
>>
>> for the Policies folder :
>> Policies# ls -n
>> total 16
>> drwxrwx---+ 4 3000008 3000008 4096 Apr 28 13:32 
>{31B2F340-016D-11D2-945F-00C04FB984F9}
>> drwxrwx---+ 4 3000008 3000008 4096 Apr 28 13:32 
>{6AC1786C-016F-11D2-945F-00C04FB984F9}
>>
>> wbinfo --uid-info 3000008
>> domain admins:*:3000008:3000008::/home/DOMAIN/domain 
>admins:/bin/false
>>
>> wbinfo --gid-info 3000008
>> domain admins:x:3000008:administrator
>>
>> wbinfo --group-info "DOMAIN\domain admins"
>> domain admins:x:3000008:administrator
>>
>> wbinfo --user-info "DOMAIN\domain admins"
>> domain admins:*:3000008:3000008::/home/BAZRTD/domain 
>admins:/bin/false
>>
>>
>> getfacl \{31B2F340-016D-11D2-945F-00C04FB984F9\}/
>> # file: {31B2F340-016D-11D2-945F-00C04FB984F9}/
>> # owner: domain\040admins
>> # group: domain\040admins
>> user::rwx
>> group::rwx
>> group:3000002:rwx
>> group:3000003:r-x
>> group:enterprise\040admins:rwx
>> group:domain\040admins:rwx
>> group:3000010:r-x
>> mask::rwx
>> other::---
>> default:user::rwx
>> default:user:domain\040admins:rwx
>> default:group::---
>> default:group:3000002:rwx
>> default:group:3000003:r-x
>> default:group:enterprise\040admins:rwx
>> default:group:domain\040admins:rwx
>> default:group:3000010:r-x
>> default:mask::rwx
>> default:other::---
>>
>> the user owner is the group ?  how can the user owner be a group ?
>> I this allowed ?  This i really dont know.
>
>Yes this a mess and is caused by stupid stupid windows allowing groups 
>to own files, therefore you end up with ID_TYPE_BOTH in 
>idmap.ldb. From 
>my investigations, it is only one group that owns files: 
>Administrators, 
>but instead of just making this group 'ID_TYPE_BOTH', samba 
>makes a lot 
>of groups 'ID_TYPE_BOTH', have a look in idmap.ldb.
>
>I also tested replacing the ownership of files and dirs in sysvol, I 
>changed 'Administrators' for 'Administrator' and changed all
>occurrences 
>of  'ID_TYPE_BOTH' in idmap.ldb to what it actually is. Looking from
>windows, I couldn't see any difference, because (and I am no windows 
>expert) I think that windows doesn't actually care who owns the files, 
>it only seems to care about the ACLs.
>
>Rowland
>
>>
>> so i have "user" : "domain admins"
>> and i have group : "domain admins"
>>
>> Documentation lacks here, or i really cant find it..
>>
>> anyone any comment on this ?
>>
>>
>>
>> Greetz,
>>
>> Louis
>>
>>
>>
>>
>>> -----Oorspronkelijk bericht-----
>>> Van: belle at bazuin.nl [mailto:samba-bounces at lists.samba.org]
>>> Namens L.P.H. van Belle
>>> Verzonden: donderdag 30 april 2015 8:10
>>> Aan: samba at lists.samba.org
>>> Onderwerp: [Samba] FW: [Bug 11241] different ids even when
>>> idmap.ldb copied. not abug..
>>>
>>> Please read the reported bug and bjorn answer.. which does not
>>> help any to a solution of fix, or explenation.
>>> But the big question now is, does someone somewhere know what
>>> bjorn is talking about.
>>>
>>> i did search for "gencache" but no go here..
>>> just from old documentation.
>>>
https://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/tdb.html
>>> gencache.tdb  Generic caching database.
>>>
>>>
>>> Greetz,
>>>
>>> Louis
>>>
>>>
>>> -----Oorspronkelijk bericht-----
>>> Van: samba-bugs at samba.org [mailto:samba-bugs at samba.org]
>>> Verzonden: woensdag 29 april 2015 17:51
>>> Aan: L.P.H. van Belle
>>> Onderwerp: [Bug 11241] different ids even when idmap.ldb copied.
>>>
>>> https://bugzilla.samba.org/show_bug.cgi?id=11241
>>>
>>> Bj?rn Jacke <bj at sernet.de> changed:
>>>
>>>            What    |Removed                     |Added
>>> ---------------------------------------------------------------
>>> -------------
>>>          Resolution|---                         |INVALID
>>>              Status|NEW                         |RESOLVED
>>>
>>> --- Comment #1 from Bj?rn Jacke <bj at sernet.de> ---
>>> this is not a supported thing to do, so this is not a valid
>>> bug. winbindd has a
>>> different way of caching (investigate gencache for example)
>>> entries and this is
>>> probably what makes that hack stop working for you with winbindd.
>>>
>>> -- 
>>> You are receiving this mail because:
>>> You reported the bug.
>>>
>>> REPORTED BUG..
>>>
>>> Louis     2015-04-29 08:51:03 UTC
>>> Hai. getting same ids on 2 DC's does not work anymore on samba
4.2.1
>>> with in smb.conf
>>> server services = -dns +winbindd -winbind
>>> Of i set it to
>>> server services = -dns -winbindd +winbind
>>> it does work again.
>>>
>>> with 4.1.17 the solution was simple.. we stop samba on both
servers.
>>> scp /var/lib/samba/private/idmap.ldb
>>> root at 192.168.0.2:/var/lib/samba/private/
>>> started samba on both servers and
>>> id administrator gave the same id's for all groups.
>>>
>>> Now on 4.2.1
>>> DC1:  id administrator
>>> uid=0(root) gid=100(users) groups=0(root),100(users),
>>> 3000004(group policy creator owners),
>>> 3000006(enterprise admins),
>>> 3000008(domain admins),
>>> 3000007(schema admins),
>>> 3000005(denied rodc password replication group),
>>> 3000009(BUILTIN\users),
>>> 3000000(BUILTIN\administrators)
>>>
>>> id administrator
>>> uid=0(root) gid=100(users) groups=0(root),100(users),
>>> 3000011(group policy creator owners),
>>> 3000010(enterprise admins),
>>> 3000007(domain admins),
>>> 3000009(schema admins),
>>> 3000008(denied rodc password replication group),
>>> 3000001(BUILTIN\users),
>>> 3000000(BUILTIN\administrators)
>>>
>>> -- 
>>> To unsubscribe from this list go to the following URL and read the
>>> instructions:  https://lists.samba.org/mailman/options/samba
>>>
>>>
>
>-- 
>To unsubscribe from this list go to the following URL and read the
>instructions:  https://lists.samba.org/mailman/options/samba
>
>

On 2015-04-30 at 08:57 +0100 Rowland Penny sent off:
> >this is not a supported thing to do, so this is not a valid bug.
winbindd has a
> >different way of caching (investigate gencache for example) entries and
this is
> >probably what makes that hack stop working for you with winbindd.
> >
> 
> Hi Louis, no I don't understand what Bjorn is talking about, but then I
> don't think that Bjorn really understands the problem. What if somebody
got
> sysvol to replicate, you would quickly end up with a mess, if a policy was
> added on one DC, it would end up being owned by somebody/group on the other
> DC, this is a regression.
I see the problem that you try to solve very well. But when a hack stops
working this is not a regression. There are probably ways to make your hack
work again though. But it still is a (unsupported) hack, which can't be
taken
into consideration by Samba in a version update.

Best regards
Bj?rn
-- 
SerNet GmbH, Bahnhofsallee 1b, 37081 G?ttingen
  ? +49-551-370000-0, ? +49-551-370000-9
AG G?ttingen, HRB 2816, GF: Dr. Johannes Loxen

Hi Louis, Bj?rn and Rowland,

Am 30.04.2015 um 08:09 schrieb L.P.H. van Belle:
> Please read the reported bug and bjorn answer.. which does not help any to
a solution of fix, or explenation.
> But the big question now is, does someone somewhere know what bjorn is
talking about.
>
> i did search for "gencache" but no go here..
> just from old documentation.
> https://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/tdb.html
> gencache.tdb  Generic caching database.
>
>
> Greetz,
>
> Louis
>
>
> -----Oorspronkelijk bericht-----
> Van: samba-bugs at samba.org [mailto:samba-bugs at samba.org]
> Verzonden: woensdag 29 april 2015 17:51
> Aan: L.P.H. van Belle
> Onderwerp: [Bug 11241] different ids even when idmap.ldb copied.
>
> https://bugzilla.samba.org/show_bug.cgi?id=11241
>
> Bj?rn Jacke <bj at sernet.de> changed:
>
>             What    |Removed                     |Added
>
----------------------------------------------------------------------------
>           Resolution|---                         |INVALID
>               Status|NEW                         |RESOLVED
>
> --- Comment #1 from Bj?rn Jacke <bj at sernet.de> ---
> this is not a supported thing to do, so this is not a valid bug. winbindd
has a
> different way of caching (investigate gencache for example) entries and
this is
> probably what makes that hack stop working for you with winbindd.
>
A quick internet search for gecache led me to an list of ldb files 
https://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/tdb.html. 
It's from the old samba docs, in there is an file called 
winbndd_idmap.tdb mentioned, can it be this is the place where winbindd 
stores xid mappings? I do not have an running 4.2 instance here for testing.

Have an good day,
Achim~

Hi again,
Am 30.04.2015 um 12:55 schrieb Achim Gottinger:
> Hi Louis, Bj?rn and Rowland,
>
> Am 30.04.2015 um 08:09 schrieb L.P.H. van Belle:
>> Please read the reported bug and bjorn answer.. which does not help 
>> any to a solution of fix, or explenation.
>> But the big question now is, does someone somewhere know what bjorn 
>> is talking about.
>>
>> i did search for "gencache" but no go here..
>> just from old documentation.
>> https://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/tdb.html
>> gencache.tdb  Generic caching database.
>>
>>
>> Greetz,
>>
>> Louis
>>
>>
>> -----Oorspronkelijk bericht-----
>> Van: samba-bugs at samba.org [mailto:samba-bugs at samba.org]
>> Verzonden: woensdag 29 april 2015 17:51
>> Aan: L.P.H. van Belle
>> Onderwerp: [Bug 11241] different ids even when idmap.ldb copied.
>>
>> https://bugzilla.samba.org/show_bug.cgi?id=11241
>>
>> Bj?rn Jacke <bj at sernet.de> changed:
>>
>>             What    |Removed                     |Added
>>
----------------------------------------------------------------------------
>>
>>           Resolution|---                         |INVALID
>>               Status|NEW                         |RESOLVED
>>
>> --- Comment #1 from Bj?rn Jacke <bj at sernet.de> ---
>> this is not a supported thing to do, so this is not a valid bug. 
>> winbindd has a
>> different way of caching (investigate gencache for example) entries 
>> and this is
>> probably what makes that hack stop working for you with winbindd.
>>
>
> A quick internet search for gecache led me to an list of ldb files 
> https://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/tdb.html. 
> It's from the old samba docs, in there is an file called 
> winbndd_idmap.tdb mentioned, can it be this is the place where 
> winbindd stores xid mappings? I do not have an running 4.2 instance 
> here for testing.
>
> Have an good day,
> Achim~
>
Did an quick test in an vm and there is no winbind_idmap.tdb file. But 
there is an /var/cache/samba/gencache.tdb file.  Temoved this file with 
samba stopped and afterwards the changes in idmap.tdb apply.

Test:

root at wheezy:~# getfacl /var/lib/samba/sysvol/example.com
# file: var/lib/samba/sysvol/example.com
# owner: root
# group: 3000000
user::rwx
user:root:rwx
user:3000000:rwx
user:3000001:r-x
user:3000002:rwx
user:3000003:r-x

root at wheezy:~#/etc/init.d/sernet-samba-ad stop
root at wheezy:~#ldbedit -H /var/lib/samba/private/idmap.ldb

Changed

# record 6
dn: CN=CONFIG
cn: CONFIG
lowerBound: 3000000
upperBound: 4000000
xidNumber: 3000016
distinguishedName: CN=CONFIG

Into

# record 6
dn: CN=CONFIG
cn: CONFIG
lowerBound: 3000000
upperBound: 4000000
xidNumber: 3000017
distinguishedName: CN=CONFIG

And

# record 10
dn: CN=S-1-5-11
cn: S-1-5-11
objectClass: sidMap
objectSid: S-1-5-11
type: ID_TYPE_BOTH
xidNumber: 3000003
distinguishedName: CN=S-1-5-11

Into

# record 10
dn: CN=S-1-5-11
cn: S-1-5-11
objectClass: sidMap
objectSid: S-1-5-11
type: ID_TYPE_BOTH
xidNumber: 3000017
distinguishedName: CN=S-1-5-11

Started samba and ran sysvolreset

root at wheezy:~#/etc/init.d/sernet-samba-ad start
root at wheezy:~#samba-tool ntacl sysvolreset

Nothing changed.

root at wheezy:~# getfacl /var/lib/samba/sysvol/example.com
# file: var/lib/samba/sysvol/example.com
# owner: root
# group: 3000000
user::rwx
user:root:rwx
user:3000000:rwx
user:3000001:r-x
user:3000002:rwx
user:3000003:r-x

Stopped samba removed gencache

root at wheezy:~#/etc/init.d/sernet-samba-ad stop
root at wheezy:~#rm /var/cache/samba/gencache*

Started samba and ran sysvolreset

root at wheezy:~#/etc/init.d/sernet-samba-ad start
root at wheezy:~#samba-tool ntacl sysvolreset

Changes applied now the last line now show the xid i changed in idmap.ldb.

root at wheezy:~# getfacl /var/lib/samba/sysvol/example.com
# file: var/lib/samba/sysvol/example.com
# owner: root
# group: 3000000
user::rwx
user:root:rwx
user:3000000:rwx
user:3000001:r-x
user:3000002:rwx
user:3000017:r-x

So the idmap.ldb copying should still work with the addition that 
/var/cache/samba/gencache.tdb must be deleted if winbindd is in use.

Achim~

Hello Achim, 

Ok, thank you for looking into this. 
Its clear now where the problem was. 

Thank you, my sysvol replication script is working fine now again with samba
4.2.1
( found here : https://secure.bazuin.nl/scripts/3-setup-sysvol-bidirectional.sh 
)

upped version 1.0.6.  added te remove of gencache.tdb on the second DC. 
tested with debian wheezy (sernet) samba 4.1.x (winbind)  and 4.2.1. (winbind
and winbindd)


Thanks ! 

Greetz, 

Louis




>-----Oorspronkelijk bericht-----
>Van: achim at ag-web.biz [mailto:samba-bounces at lists.samba.org] 
>Namens Achim Gottinger
>Verzonden: donderdag 30 april 2015 14:23
>Aan: samba at lists.samba.org
>Onderwerp: Re: [Samba] FW: [Bug 11241] different ids even when 
>idmap.ldb copied. not abug..
>
>Hi again,
>Am 30.04.2015 um 12:55 schrieb Achim Gottinger:
>> Hi Louis, Bj?rn and Rowland,
>>
>> Am 30.04.2015 um 08:09 schrieb L.P.H. van Belle:
>>> Please read the reported bug and bjorn answer.. which does not help
>>> any to a solution of fix, or explenation.
>>> But the big question now is, does someone somewhere know what bjorn
>>> is talking about.
>>>
>>> i did search for "gencache" but no go here..
>>> just from old documentation.
>>>
https://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/tdb.html
>>> gencache.tdb  Generic caching database.
>>>
>>>
>>> Greetz,
>>>
>>> Louis
>>>
>>>
>>> -----Oorspronkelijk bericht-----
>>> Van: samba-bugs at samba.org [mailto:samba-bugs at samba.org]
>>> Verzonden: woensdag 29 april 2015 17:51
>>> Aan: L.P.H. van Belle
>>> Onderwerp: [Bug 11241] different ids even when idmap.ldb copied.
>>>
>>> https://bugzilla.samba.org/show_bug.cgi?id=11241
>>>
>>> Bj?rn Jacke <bj at sernet.de> changed:
>>>
>>>             What    |Removed                     |Added
>>> 
>---------------------------------------------------------------
>------------- 
>>>
>>>           Resolution|---                         |INVALID
>>>               Status|NEW                         |RESOLVED
>>>
>>> --- Comment #1 from Bj?rn Jacke <bj at sernet.de> ---
>>> this is not a supported thing to do, so this is not a valid bug. 
>>> winbindd has a
>>> different way of caching (investigate gencache for example) entries
>>> and this is
>>> probably what makes that hack stop working for you with winbindd.
>>>
>>
>> A quick internet search for gecache led me to an list of ldb files 
>> 
>https://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/tdb.html. 
>> It's from the old samba docs, in there is an file called 
>> winbndd_idmap.tdb mentioned, can it be this is the place where 
>> winbindd stores xid mappings? I do not have an running 4.2 instance 
>> here for testing.
>>
>> Have an good day,
>> Achim~
>>
>Did an quick test in an vm and there is no winbind_idmap.tdb file. But 
>there is an /var/cache/samba/gencache.tdb file.  Temoved this 
>file with 
>samba stopped and afterwards the changes in idmap.tdb apply.
>
>Test:
>
>root at wheezy:~# getfacl /var/lib/samba/sysvol/example.com
># file: var/lib/samba/sysvol/example.com
># owner: root
># group: 3000000
>user::rwx
>user:root:rwx
>user:3000000:rwx
>user:3000001:r-x
>user:3000002:rwx
>user:3000003:r-x
>
>root at wheezy:~#/etc/init.d/sernet-samba-ad stop
>root at wheezy:~#ldbedit -H /var/lib/samba/private/idmap.ldb
>
>Changed
>
># record 6
>dn: CN=CONFIG
>cn: CONFIG
>lowerBound: 3000000
>upperBound: 4000000
>xidNumber: 3000016
>distinguishedName: CN=CONFIG
>
>Into
>
># record 6
>dn: CN=CONFIG
>cn: CONFIG
>lowerBound: 3000000
>upperBound: 4000000
>xidNumber: 3000017
>distinguishedName: CN=CONFIG
>
>And
>
># record 10
>dn: CN=S-1-5-11
>cn: S-1-5-11
>objectClass: sidMap
>objectSid: S-1-5-11
>type: ID_TYPE_BOTH
>xidNumber: 3000003
>distinguishedName: CN=S-1-5-11
>
>Into
>
># record 10
>dn: CN=S-1-5-11
>cn: S-1-5-11
>objectClass: sidMap
>objectSid: S-1-5-11
>type: ID_TYPE_BOTH
>xidNumber: 3000017
>distinguishedName: CN=S-1-5-11
>
>Started samba and ran sysvolreset
>
>root at wheezy:~#/etc/init.d/sernet-samba-ad start
>root at wheezy:~#samba-tool ntacl sysvolreset
>
>Nothing changed.
>
>root at wheezy:~# getfacl /var/lib/samba/sysvol/example.com
># file: var/lib/samba/sysvol/example.com
># owner: root
># group: 3000000
>user::rwx
>user:root:rwx
>user:3000000:rwx
>user:3000001:r-x
>user:3000002:rwx
>user:3000003:r-x
>
>Stopped samba removed gencache
>
>root at wheezy:~#/etc/init.d/sernet-samba-ad stop
>root at wheezy:~#rm /var/cache/samba/gencache*
>
>Started samba and ran sysvolreset
>
>root at wheezy:~#/etc/init.d/sernet-samba-ad start
>root at wheezy:~#samba-tool ntacl sysvolreset
>
>Changes applied now the last line now show the xid i changed 
>in idmap.ldb.
>
>root at wheezy:~# getfacl /var/lib/samba/sysvol/example.com
># file: var/lib/samba/sysvol/example.com
># owner: root
># group: 3000000
>user::rwx
>user:root:rwx
>user:3000000:rwx
>user:3000001:r-x
>user:3000002:rwx
>user:3000017:r-x
>
>So the idmap.ldb copying should still work with the addition that 
>/var/cache/samba/gencache.tdb must be deleted if winbindd is in use.
>
>Achim~
>
>
>
>
>-- 
>To unsubscribe from this list go to the following URL and read the
>instructions:  https://lists.samba.org/mailman/options/samba
>
>