samba - Nov 2015 - Samba 4.1. creates group rights for not existing group.

On 2015-11-16 at 11:14 +0000, Rowland Penny wrote:
> On 16/11/15 10:11, Alex Sviridov wrote:
> >  I use samba 4.1 as dc with acl. I have user with uid 3000023.
However, I don't have group with guid 3000023. However, when this user
creates a folder samba in acl list creates permissions for group 3000023 and as
result I have broken link. How to fix it?
> >
> >
> 
> Hi, allow me to introduce you to the concept of a user being also a group
> and vica-versa. If you examine idmap.ldb:
> 
> ldbedit -e nano -H /usr/local/samba/private/idmap.ldb
> 
> You will find lines like this:
> 
> type: ID_TYPE_BOTH
> 
> This means that your user can be both a user and a group
> 
> It has to be like this so that the 'Administrators' group can own
> directories and files in sysvol.
Very true.
This can't be over-emphasized, since it seems
to puzzle people: This is by design.

And regarding non-existence of that group:

If you do the supported thing, namely put
winbind into /etc/nsswitch.conf, then this
group exists. :-)

Cheers - Michael
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL:
<http://lists.samba.org/pipermail/samba/attachments/20151116/dcc70c69/signature.sig>

On 16/11/15 12:53, Michael Adam wrote:
> On 2015-11-16 at 11:14 +0000, Rowland Penny wrote:
>> On 16/11/15 10:11, Alex Sviridov wrote:
>>>   I use samba 4.1 as dc with acl. I have user with uid 3000023.
However, I don't have group with guid 3000023. However, when this user
creates a folder samba in acl list creates permissions for group 3000023 and as
result I have broken link. How to fix it?
>>>
>>>
>> Hi, allow me to introduce you to the concept of a user being also a
group
>> and vica-versa. If you examine idmap.ldb:
>>
>> ldbedit -e nano -H /usr/local/samba/private/idmap.ldb
>>
>> You will find lines like this:
>>
>> type: ID_TYPE_BOTH
>>
>> This means that your user can be both a user and a group
>>
>> It has to be like this so that the 'Administrators' group can
own
>> directories and files in sysvol.
> Very true.
> This can't be over-emphasized, since it seems
> to puzzle people: This is by design.
>
> And regarding non-existence of that group:
>
> If you do the supported thing, namely put
> winbind into /etc/nsswitch.conf, then this
> group exists. :-)
>
> Cheers - Michael
er, when did it become supported to put winbind into /etc/nsswitch.conf 
on a DC?
You only need to do this if you actually need to log into the DC and 
this is not recommended on the wiki.

Rowland

On 2015-11-16 at 12:57 +0000, Rowland Penny wrote:
> On 16/11/15 12:53, Michael Adam wrote:
> >On 2015-11-16 at 11:14 +0000, Rowland Penny wrote:
> >>On 16/11/15 10:11, Alex Sviridov wrote:
> >>>  I use samba 4.1 as dc with acl. I have user with uid 3000023.
However, I don't have group with guid 3000023. However, when this user
creates a folder samba in acl list creates permissions for group 3000023 and as
result I have broken link. How to fix it?
> >>>
> >>>
> >>Hi, allow me to introduce you to the concept of a user being also a
group
> >>and vica-versa. If you examine idmap.ldb:
> >>
> >>ldbedit -e nano -H /usr/local/samba/private/idmap.ldb
> >>
> >>You will find lines like this:
> >>
> >>type: ID_TYPE_BOTH
> >>
> >>This means that your user can be both a user and a group
> >>
> >>It has to be like this so that the 'Administrators' group
can own
> >>directories and files in sysvol.
> >Very true.
> >This can't be over-emphasized, since it seems
> >to puzzle people: This is by design.
> >
> >And regarding non-existence of that group:
> >
> >If you do the supported thing, namely put
> >winbind into /etc/nsswitch.conf, then this
> >group exists. :-)
> >
> >Cheers - Michael
> 
> er, when did it become supported to put winbind into
> /etc/nsswitch.conf on a DC?
To my understanding, it was supported from the beginning
(i.e. Samba 4.0.0).
> You only need to do this if you actually need to log into the DC and this
is
> not recommended on the wiki.
Well it is also cosmetic for when e.g. an admin
wants to look at files/perms on the console.

And btw, 'not recommended' does not mean 'not supported'.

Of course, not putting anything winbind-ish into nsswitch,
might also be considered supported, but I'd say that
for a complete setup, winbind belongs into nsswitch.conf.

If you don't put anything, then also the corresponding
uid won't be resolved in 'ls -l' and friends, so one
could complain that that user does not exist just as well.
(With existence defined as 'getent passwd foo' or
'getent group bar' knows them...)

So my point was that putting stuff into /etc/nsswitch.conf
makes users and groups exist. And if you put the *right*
thing into nsswitch (i.e. winbind and not, e.g. sssd), then
these groups do exist.

Michael

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL:
<http://lists.samba.org/pipermail/samba/attachments/20151116/676829bc/signature.sig>