samba - Jun 2016 - Rights issue on GPO

On 22/06/16 10:13, mj wrote:
>
>
> On 06/21/2016 04:48 PM, lingpanda101 at gmail.com wrote:
>>
>> I found my issue. On one of my DC's I had misspelled
'idmap_ldb:use
>> rfc2307 = Yes'. I had it 'idmap_lbd:'. Ran 'net cache
flush' and wbinfo
>> gave correct mappings. I find it odd that 'samba-tool testparm'
never
>> threw any errors.
>
> I am under the impression that on a DC:
>  idmap_ldb:use rfc2307 = Yes
> is not required at all?
>
> (but please correct me if I'm wrong)
>
> MJ
>
Happy to correct you :-D

If you are using RFC2307 attributes, you need this line on a DC, it is 
*only* used on a DC.

Rowland

On 06/22/2016 01:20 PM, Rowland penny wrote:
> Happy to correct you :-D
>
> If you are using RFC2307 attributes, you need this line on a DC, it is
> *only* used on a DC.
Right... Thanks!

And then perhaps we also need to set the idmap ranges on the DCs? I 
thought they were only for the domain member servers...

MJ

On 06/22/2016 01:44 PM, mj wrote:
>
> And then perhaps we also need to set the idmap ranges on the DCs? I
> thought they were only for the domain member servers...
https://wiki.samba.org/index.php/Setting_up_RFC2307_in_AD

:-)

And dont forget : 
https://wiki.samba.org/index.php/Idmap_config_ad 

I also noticed and incorrect mapping, which "looks" like rights issues
like in the thead here. ( it is imo not a right issue.. ) read on..

NTDOMAIN\enterprise read-only domain controllers:x:3000202:
NTDOMAIN\domain admins:x:10001:NTDOMAIN\administrator
NTDOMAIN\domain users:x:10000:
NTDOMAIN\domain guests:x:10002:
NTDOMAIN\domain computers:x:10006:
NTDOMAIN\domain controllers:x:3000018:
NTDOMAIN\read-only domain controllers:x:3000203:

Is conflicting with 
BUILTIN\administrators:x:3000000:
BUILTIN\users:x:3000009:
BUILTIN\guests:x:3000015:
BUILTIN\account operators:x:3000185:
BUILTIN\server operators:x:3000001:

Which results in some incorrect mappings. 

But if you add : 	acl_xattr:ignore system acls = yes  to the Sysvol share. 
 !!  AND your using the DC's only as DC's. !! 

Then this incorrect mapping can be ignored, at least im ignoring it, 
since very thing is tested and works fine. 

But im thinking of settings a separated range for the BUILDIN

A setup something like :  

        idmap_ldb:use rfc2307 = yes

        ## map id's outside to domain to tdb files.
        ## use for local (linux only ) users
        idmap config * : backend = tdb
        idmap config * : range = 2000-9999

        ## map ids from the domain and (*) the range may not overlap !
        ## the NTDOMAIN range id mappings
        idmap config NTDOMAIN : backend = ad
        idmap config NTDOMAIN : schema_mode = rfc2307
        idmap config NTDOMAIN : range = 10000-2999999

	  ## map ids from BUILDIN ( LOCAL SYSTEM ) 
	  ##
        idmap config BUILDIN : backend = ad
        idmap config BUILDIN : schema_mode = rfc2307
        idmap config BUILDIN : range = 3000000-3999999

Sometimes, and if you see from within windows security rights like : 
NTDOMAIN\administrators 
Which should be 
BUILDIN\administrators

Anyone any suggestion about setting an extra BUILDIN range for the Local
Computer/System.



Greetz, 

Louis


> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens mj
> Verzonden: woensdag 22 juni 2016 13:59
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] Rights issue on GPO
> 
> 
> 
> On 06/22/2016 01:44 PM, mj wrote:
> >
> > And then perhaps we also need to set the idmap ranges on the DCs? I	
> > thought they were only for the domain member servers...
> https://wiki.samba.org/index.php/Setting_up_RFC2307_in_AD
> 
> :-)
> 
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba