thr3ads.net - samba - [Samba] Samba shared folders and windows 7 permissions dialog. [Mar 2017]

If this information is useful, please help other people find it:
Share via:

PF4Public

2017-Mar-22 16:20 UTC

[Samba] Samba shared folders and windows 7 permissions dialog.

"uname -a" gives Linux 4.9.0-1-amd64 #1 SMP Debian 4.9.2-2
(2017-01-12) x86_64 GNU/Linux

"samba -V" : Version 4.5.6-Debian

It is a standalone server with "security = user" and "passdb
backend =
ldapsam:ldap://localhost"

The weirdness I described happens to any share, so I assume detailed share
configuration
is irrelevant. Apart from this weirdness all is fine. That is files are
accessible in
accordance with set permissions as well as permissions set from well-behaved
windows 7
hosts are saved and taken into account. The only weird thing is that it is
impossible to
list all ldap users and groups on some windows hosts. Yet could not determine
how they
differ from those hosts, which do properly display ldap users and groups. Apart
from the
mentioned logfile differences.


PS: sorry for double-reply. didn't "reply-all" at the first place.


22.03.2017 18:51, L.P.H. van Belle wrote:> I think bad breath... ;-)  noo... just joking ..  sorry , ... ;-)
>
> It is may be help full if you provide a bit more info.
>
> Like for example
> OS > Samba version > The smb.conf content.
>
> And what did you setup?
> AD DC server
> NT4 PDC server
> Standalone server?
> Member server?
>
> And based on what you already posted below.
> Im guessing an AD DC setup, but with the wrong backend setup.
> But you tell us..
>
>
> Greetz,
>
> Louis
>
>
>> -----Oorspronkelijk bericht-----
>> Van: samba [mailto:samba-bounces at lists.samba.org] Namens PF4Public
via
>> samba
>> Verzonden: woensdag 22 maart 2017 16:12
>> Aan: samba at lists.samba.org
>> Onderwerp: Re: [Samba] Samba shared folders and windows 7 permissions
>> dialog.
>>
>> Was my wording bad or something?
>>
>>
>> 20.03.2017 20:11, PF4Public wrote:
>>> Hi there
>>>
>>> Trying to solve an issue with samba and windows 7 permissions
dialog.
>> Problem is that
>>> sometimes windows 7 permissions dialog is lacking ldap users and
groups.
>>> Looks like my problem is related to this one:
>>> https://forums.freenas.org/index.php?threads/users-and-groups-not-
>> showing-up-in-windows-7.46023/
>>> Sadly there is no solution in that thread.
>>> Consider the following setup: linux debian with samba and ldap and
>> several windows 7
>>> hosts. Ldap has user named "test" for my tests.
>>> Test 1
>>> Open test users home via samba: "\\samba\test" in windows
7 explorer.
>> Create any
>>> files/folders there and open permissions dialog, switch to advanced
user
>> search. It does
>>> show ldap users and groups on one windows 7 host, but surprisingly
does
>> not on another
>>> windows 7 host even though both connect as user "test".
>>> Test 2
>>> Make sure that locally-logged in user belongs to local
administrators
>> group. Same result
>>> as with Test 1. One windows host shows all the users and groups
from
>> ldap, the other one
>>> does not. Even though that both hosts are logged in with local
>> administrator account and
>>> connecting as same "test" user to samba.
>>> Test 3
>>> Lets take successful windows host and relogin to limited account.
Now
>> permissions dialog
>>> also lacks ldap users and groups. Elevating explorer.exe does not
help
>> by the way.
>>> Test 4
>>> Make samba more verbose: "log level = 10". Repeat the
Test 1. I was
>> overwhelmed while
>>> reading and comparing logfiles, but I notice a subtle difference
there:
>>> successful windows host generates:
>>>
>>>      [2017/03/20 19:22:05.622880,  5, pid=20151, effective(10000,
10002),
>> real(10000, 0)]
>>>      ../source3/auth/token_util.c:639(debug_unix_user_token)
>>>
>>>        UNIX token of user 10000
>>>
>>>        Primary group is 10002 and contains 1 supplementary groups
>>>
>>>        Group[  0]: 10002
>>>
>>>      [2017/03/20 19:22:05.622904,  5, pid=20151, effective(10000,
10002),
>> real(10000, 0)]
>>>      ../source3/smbd/uid.c:452(smbd_become_authenticated_pipe_user)
>>>
>>>        Impersonated user: uid=(10000,10000), gid=(0,10002)
>>>
>>>      [2017/03/20 19:22:05.622917,  5, pid=20151, effective(10000,
10002),
>> real(10000, 0),
>>>      class=rpc_srv]
>> ../source3/rpc_server/srv_pipe.c:1404(api_pipe_request)
>>>        Requested samr rpc service
>>>
>>>      [2017/03/20 19:22:05.622929,  4, pid=20151, effective(10000,
10002),
>> real(10000, 0),
>>>      class=rpc_srv]
../source3/rpc_server/srv_pipe.c:1429(api_rpcTNP)
>>>
>>>        api_rpcTNP: samr op 0x7 - api_rpcTNP: rpc command:
SAMR_OPENDOMAIN
>>>
>>>      [2017/03/20 19:22:05.622942,  6, pid=20151, effective(10000,
10002),
>> real(10000, 0),
>>>      class=rpc_srv]
../source3/rpc_server/srv_pipe.c:1469(api_rpcTNP)
>>>
>>>        api_rpc_cmds[7].fn == 0x7fa14a7c6ed0
>>>
>>>      [2017/03/20 19:22:05.622956,  1, pid=20151, effective(10000,
10002),
>> real(10000, 0)]
>>>      ../librpc/ndr/ndr.c:450(ndr_print_function_debug)
>>>
>>>             samr_OpenDomain: struct samr_OpenDomain
>>>
>>>                in: struct samr_OpenDomain
>>>
>>>                    connect_handle           : *
>>>
>>>                        connect_handle: struct policy_handle
>>>
>>>                            handle_type              : 0x00000000
(0)
>>>
>>>                            uuid                     :
00000021-0000-0000-
>> d058-ad01b74e0000
>>>                    access_mask              : 0x00000304 (772)
>>>
>>>                           0: SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1
>>>
>>>                           0: SAMR_DOMAIN_ACCESS_SET_INFO_1
>>>
>>>                           1: SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2
>>>
>>>                           0: SAMR_DOMAIN_ACCESS_SET_INFO_2
>>>
>>>                           0: SAMR_DOMAIN_ACCESS_CREATE_USER
>>>
>>>                           0: SAMR_DOMAIN_ACCESS_CREATE_GROUP
>>>
>>>                           0: SAMR_DOMAIN_ACCESS_CREATE_ALIAS
>>>
>>>                           0: SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS
>>>
>>>                           1: SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS
>>>
>>>                           1: SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT
>>>
>>>                           0: SAMR_DOMAIN_ACCESS_SET_INFO_3
>>>
>>>
>>> While the other gives:
>>>
>>>      [2017/03/20 18:51:48.939208,  5, pid=4553, effective(10000,
10002),
>> real(10000, 0)]
>>>      ../source3/auth/token_util.c:639(debug_unix_user_token)
>>>
>>>        UNIX token of user 10000
>>>
>>>        Primary group is 10002 and contains 1 supplementary groups
>>>
>>>        Group[  0]: 10002
>>>
>>>      [2017/03/20 18:51:48.939236,  5, pid=4553, effective(10000,
10002),
>> real(10000, 0)]
>>>      ../source3/smbd/uid.c:452(smbd_become_authenticated_pipe_user)
>>>
>>>        Impersonated user: uid=(10000,10000), gid=(0,10002)
>>>
>>>      [2017/03/20 18:51:48.939252,  5, pid=4553, effective(10000,
10002),
>> real(10000, 0),
>>>      class=rpc_srv]
>> ../source3/rpc_server/srv_pipe.c:1404(api_pipe_request)
>>>        Requested samr rpc service
>>>
>>>      [2017/03/20 18:51:48.939265,  4, pid=4553, effective(10000,
10002),
>> real(10000, 0),
>>>      class=rpc_srv]
../source3/rpc_server/srv_pipe.c:1429(api_rpcTNP)
>>>
>>>        api_rpcTNP: samr op 0x7 - api_rpcTNP: rpc command:
SAMR_OPENDOMAIN
>>>
>>>      [2017/03/20 18:51:48.939281,  6, pid=4553, effective(10000,
10002),
>> real(10000, 0),
>>>      class=rpc_srv]
../source3/rpc_server/srv_pipe.c:1469(api_rpcTNP)
>>>
>>>        api_rpc_cmds[7].fn == 0x7fa14a7c6ed0
>>>
>>>      [2017/03/20 18:51:48.939298,  1, pid=4553, effective(10000,
10002),
>> real(10000, 0)]
>>>      ../librpc/ndr/ndr.c:450(ndr_print_function_debug)
>>>
>>>             samr_OpenDomain: struct samr_OpenDomain
>>>
>>>                in: struct samr_OpenDomain
>>>
>>>                    connect_handle           : *
>>>
>>>                        connect_handle: struct policy_handle
>>>
>>>                            handle_type              : 0x00000000
(0)
>>>
>>>                            uuid                     :
00000017-0000-0000-
>> cf58-94fac9110000
>>>                    access_mask              : 0x00000200 (512)
>>>
>>>                           0: SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1
>>>
>>>                           0: SAMR_DOMAIN_ACCESS_SET_INFO_1
>>>
>>>                           0: SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2
>>>
>>>                           0: SAMR_DOMAIN_ACCESS_SET_INFO_2
>>>
>>>                           0: SAMR_DOMAIN_ACCESS_CREATE_USER
>>>
>>>                           0: SAMR_DOMAIN_ACCESS_CREATE_GROUP
>>>
>>>                           0: SAMR_DOMAIN_ACCESS_CREATE_ALIAS
>>>
>>>                           0: SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS
>>>
>>>                           0: SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS
>>>
>>>                           1: SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT
>>>
>>>                           0: SAMR_DOMAIN_ACCESS_SET_INFO_3
>>>
>>> Is it "0: SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS" that blocks
that windows
>> host from
>>> enumerating ldap users and groups? If that's true, then why is
that
>> happening to the
>>> same user on a different hosts? What is the origin of struct
>> samr_OpenDomain and how
>>> does samba derive it?
>>>
>>> Or am I on a wrong track?
>>>
>>> Anyway any advice on this issue is welcome.
>>> Please help me resolve this nasty issue.
>>>
>>> Thanks in advance.
>> --
>> To unsubscribe from this list go to the following URL and read the
>> instructions:  https://lists.samba.org/mailman/options/samba
>

Rowland Penny

2017-Mar-22 17:10 UTC

head link

[Samba] Samba shared folders and windows 7 permissions dialog.

On Wed, 22 Mar 2017 19:20:57 +0300
PF4Public via samba <samba at lists.samba.org> wrote:
> "uname -a" gives Linux 4.9.0-1-amd64 #1 SMP Debian 4.9.2-2
> (2017-01-12) x86_64 GNU/Linux
> 
> "samba -V" : Version 4.5.6-Debian
> 
> It is a standalone server with "security = user" and "passdb
backend
> = ldapsam:ldap://localhost"
> 
That is a very brief smb.conf ;-)

[global]
    security = user
    passdb backend = ldapsam:ldap://localhost

Any chance we can see the rest (as Louis asked) ????

Rowland

PF4Public

2017-Mar-23 17:26 UTC

head link

[Samba] Samba shared folders and windows 7 permissions dialog.

Here is the requested config:

[global]
     workgroup = workgroup
     netbios name = server
     server string = %h server
     wins support = yes
     dns proxy = no
     name resolve order = host wins lmhosts bcast
     interfaces = 127.0.0.0/8 192.168.1.1
     smb ports= 445 139
     bind interfaces only = yes
     log file = /var/log/samba/log.%m
     log level = 1
     max log size = 1000
     panic action = /usr/share/samba/panic-action %d
     security = user
     encrypt passwords = yes
     passdb backend = ldapsam:ldap://localhost
     ldap admin dn = "cn=admin,dc=server"
     ldap delete dn = no
     ldap user suffix = ou=users
     ldap group suffix = ou=groups
     ldap machine suffix = ou=machines
     ldap suffix = dc=server
     ldap ssl = off
     load printers = yes
     printing = cups
     printcap name = cups
     socket options = TCP_NODELAY SO_KEEPALIVE IPTOS_LOWDELAY
     usershare max shares = 0
     rpc_server:spoolss = external
     rpc_daemon:spoolssd = fork
     host msdfs = no
[homes]
    comment = Home Directories
    browseable = no
    read only = no
    create mask = 0700
    directory mask = 0700
    valid users = %S
[printers]
    comment = All Printers
    browseable = yes
    path = /var/spool/samba
    printable = yes
    guest ok = yes
    use client driver=no
[print$]
    comment = Printer Drivers
    path = /var/lib/samba/printers
    writable = yes
    write list =  root
[acltest]
    path = /acltest
    read only = no
    vfs objects = acl_xattr
    map acl inherit = yes
    store dos attributes = yes
...
aand the rest of the shares
...


22.03.2017 20:10, Rowland Penny via samba wrote:> On Wed, 22 Mar 2017 19:20:57 +0300
> PF4Public via samba <samba at lists.samba.org> wrote:
>
>> "uname -a" gives Linux 4.9.0-1-amd64 #1 SMP Debian 4.9.2-2
>> (2017-01-12) x86_64 GNU/Linux
>>
>> "samba -V" : Version 4.5.6-Debian
>>
>> It is a standalone server with "security = user" and
"passdb backend
>> = ldapsam:ldap://localhost"
>>
> That is a very brief smb.conf ;-)
>
> [global]
>      security = user
>      passdb backend = ldapsam:ldap://localhost
>
> Any chance we can see the rest (as Louis asked) ????
>
> Rowland
>
>
>

Reasonably Related Threads

Search for more apparently analagous threads

samba - Mar 2017 - Samba shared folders and windows 7 permissions dialog.

[Samba] Samba shared folders and windows 7 permissions dialog.

[Samba] Samba shared folders and windows 7 permissions dialog.

[Samba] Samba shared folders and windows 7 permissions dialog.

Reasonably Related Threads