mathias dufresne
2016-Jul-12 08:36 UTC
[Samba] Testing a forest trusts in Samba 4.4.5 AD environment
Hi Alex, Nice information about forest type. Regarding listing domain users, have you tried to set up samba with: winbind use default domain = no? 2016-07-11 19:50 GMT+02:00 Alex Crow <acrow at integrafin.co.uk>:> > > On 11/07/16 13:55, Alex Crow wrote: > > Hi List, > > > > I am currently testing inter-forest trusts between a pair of AD > > domains. All DCs and member servers are using Sernet Samba 4.4.5. > > > > I have set up conditional forwarding in by Bind setup (I'm using > > BIND9_DLZ) and all machines can resolve each other. On the DCs, I can > > see users from the other side of the trust using wbinfo -u > > --domain=<other domain>. In addition if I set up ID mapping in > > smb.conf on the DCs, getent group/password work fine (using winbind in > > nsswitch.conf). > > > > There are two parts I'm struggling to get working. On member servers > > (file servers in my case), even with an ID mapping set up in smb.conf, > > wbinfo -u --domain=<other domain> returns nothing, and I see errors in > > log.wb-<domain>: > > > > [2016/07/11 13:48:25.449458, 0] > > ../source3/librpc/crypto/gse.c:341(gse_get_client_auth_token) > > gss_init_sec_context failed with [ Miscellaneous failure (see text): > > Key version is not available] > > [2016/07/11 13:48:25.449700, 0] > > ../source3/libads/sasl.c:773(ads_sasl_spnego_bind) > > kinit succeeded but ads_sasl_spnego_gensec_bind(KRB5) failed: An > > internal error occurred. > > [2016/07/11 13:48:26.015483, 0] > > ../source3/librpc/crypto/gse.c:341(gse_get_client_auth_token) > > gss_init_sec_context failed with [ Miscellaneous failure (see text): > > Key version is not available] > > [2016/07/11 13:48:26.444479, 0] > > ../source3/librpc/crypto/gse.c:341(gse_get_client_auth_token) > > gss_init_sec_context failed with [ Miscellaneous failure (see text): > > Key version is not available] > > [2016/07/11 13:48:26.444610, 0] > > ../source3/libads/sasl.c:773(ads_sasl_spnego_bind) > > kinit succeeded but ads_sasl_spnego_gensec_bind(KRB5) failed: An > > internal error occurred > > > > Understandably getent fails here too. Here's an example smb.conf from > > a member server: > > > > [global] > > > > workgroup = AAA_NET > > realm = samba.aaa.net > > netbios name = S4FILES > > security = ADS > > #bind interfaces only = yes > > #interfaces = eth0, lo > > #dedicated keytab file = /etc/krb5.keytab > > #kerberos method = secrets and keytab > > idmap_ldb:use rfc2307 = yes > > clustering = yes > > #private dir = /mfs/ctdb/private > > > > > > idmap config *:backend = tdb > > idmap config *:range = 200000-300000 > > idmap config AAA_NET:backend = ad > > idmap config AAA_NET:default = yes > > idmap config AAA_NET:schema_mode = rfc2307 > > idmap config AAA_NET:range = 500-199999 > > > > idmap config BBB:backend = rid > > idmap config BBB:range = 3000000-3100000 > > > > winbind nss info = rfc2307 > > winbind trusted domains only = no > > winbind use default domain = yes > > winbind enum users = yes > > winbind enum groups = yes > > winbind refresh tickets = Yes > > > > The other issue I have is when trying to work with accounts from the > > other side of the trust within Windows. For instance, when trying to > > add a user from the "other" domain to permissions on a directory, I > > can indeed select the accounts in the picker, get prompted for > > credentials on the other domain, but at the final step get an error: > > "The Active Directory Domain Controllers required to find the selected > > objects in the following domains are not available: samba.bbb.net. > > Ensure the Active Directory Domain Controllers are available, and try > > to select the objects again". > > > > Now I'm aware that it's early days for trusts in AD with Samba, but > > I'm curious if there is something I'm missing here or others may have > > got further than I have. > > > > Many thanks > > > > Alex > > -- > > I've have another go at this by deleting and recreating the trust > without --type=forest. It makes a slight improvement, in that: > > 1) I can assign permissions on files/directories served up by DCs > without the "DCs not available" issue, whereas with --type=forest I got > it even on DCs. > 2) I can log in to a domain client W7 VM with an account from the trust > domain > > However, I still can't see any accounts on Samba member servers via > wbinfo -u --domain=<otherdom>, or with getent, and now after adding > permissions on a directory in domain "AAA" to a user in "BBB", when I > check the properties->Security from a windows machine in domain BBB, the > ACL entry shows "Unknown SID", even though it is clearly a SID in Domain > "BBB". > > I hope this helps... > > Thanks again > > Alex > > > -- > This message is intended only for the addressee and may contain > confidential information. Unless you are that person, you may not > disclose its contents or use it in any way and are requested to delete > the message along with any attachments and notify us immediately. > This email is not intended to, nor should it be taken to, constitute > advice. > The information provided is correct to our knowledge & belief and must not > be used as a substitute for obtaining tax, regulatory, investment, legal or > any other appropriate advice. > > "Transact" is operated by Integrated Financial Arrangements Ltd. > 29 Clement's Lane, London EC4N 7AE. Tel: (020) 7608 4900 Fax: (020) 7608 > 5300. > (Registered office: as above; Registered in England and Wales under > number: 3727592). Authorised and regulated by the Financial Conduct > Authority (entered on the Financial Services Register; no. 190856). > > -- > To unsubscribe from this list go to the following URL and read the > instructions: https://lists.samba.org/mailman/options/samba >
Alex Crow
2016-Jul-12 10:55 UTC
[Samba] Testing a forest trusts in Samba 4.4.5 AD environment
On 12/07/16 09:36, mathias dufresne wrote:> Hi Alex, > > Nice information about forest type. > Regarding listing domain users, have you tried to set up samba with: > winbind use default domain = no?Hi, Yes I have, and it works as expected (ie all from the local domain are prepended with DOMAIN\, but does not solve anything for by trusted domain accounts on member servers. It's good to see it's got this far though, even though I'll have to work around it for now (we have a another group company that is working fine with trusts, NT-style, and we'd ideally like to be able to have the same working with Samba AD). Thanks Alex -- This message is intended only for the addressee and may contain confidential information. Unless you are that person, you may not disclose its contents or use it in any way and are requested to delete the message along with any attachments and notify us immediately. This email is not intended to, nor should it be taken to, constitute advice. The information provided is correct to our knowledge & belief and must not be used as a substitute for obtaining tax, regulatory, investment, legal or any other appropriate advice. "Transact" is operated by Integrated Financial Arrangements Ltd. 29 Clement's Lane, London EC4N 7AE. Tel: (020) 7608 4900 Fax: (020) 7608 5300. (Registered office: as above; Registered in England and Wales under number: 3727592). Authorised and regulated by the Financial Conduct Authority (entered on the Financial Services Register; no. 190856).
mathias dufresne
2016-Jul-12 11:22 UTC
[Samba] Testing a forest trusts in Samba 4.4.5 AD environment
Database size would interest us here, with and without trust if you have these metrics. Global catalog is supposed to stored some attributes of almost all objects of all trusted domains, if me understanding is correct and we have no real idea about what that means in concrete terms. 2016-07-12 12:55 GMT+02:00 Alex Crow <acrow at integrafin.co.uk>:> On 12/07/16 09:36, mathias dufresne wrote: > >> Hi Alex, >> >> Nice information about forest type. >> Regarding listing domain users, have you tried to set up samba with: >> winbind use default domain = no? >> > > Hi, > > Yes I have, and it works as expected (ie all from the local domain are > prepended with DOMAIN\, but does not solve anything for by trusted domain > accounts on member servers. > > It's good to see it's got this far though, even though I'll have to work > around it for now (we have a another group company that is working fine > with trusts, NT-style, and we'd ideally like to be able to have the same > working with Samba AD). > > Thanks > > > Alex > > -- > This message is intended only for the addressee and may contain > confidential information. Unless you are that person, you may not > disclose its contents or use it in any way and are requested to delete > the message along with any attachments and notify us immediately. > This email is not intended to, nor should it be taken to, constitute > advice. > The information provided is correct to our knowledge & belief and must not > be used as a substitute for obtaining tax, regulatory, investment, legal or > any other appropriate advice. > > "Transact" is operated by Integrated Financial Arrangements Ltd. > 29 Clement's Lane, London EC4N 7AE. Tel: (020) 7608 4900 Fax: (020) 7608 > 5300. > (Registered office: as above; Registered in England and Wales under > number: 3727592). Authorised and regulated by the Financial Conduct > Authority (entered on the Financial Services Register; no. 190856). >