samba - Jun 2017 - Erro sysvolcheck/sysvolreset

Am 16.06.2017 um 19:17 schrieb Rowland Penny via samba:
> On Fri, 16 Jun 2017 13:58:20 -0300
> "Carlos A. P. Cunha" <carlos.hollow at gmail.com> wrote:
> 
>> :-|
>>
>> ls -lnd /opt/samba/var/locks/sysvol
>> drwxrwx---+ 3 0 3000000 4096 Jun 16 13:56 /opt/samba/var/locks/sysvol
>>
>>
> 
> I have this sinking feeling that you have given your AD users and
> groups from the 'Well Known SIDs' a uidNumber or gidNumber
attribute, I
> cannot think of any other way that 'Builtin\administrators' could
have
> the ID number '4096'.
> 
> 'root' shouldn't have the ID '3000000' either.
> 
> On a DC, 'Administrator' should be mapped to 'root' inside
idmap.ldb:
> 
> dn: CN=S-1-5-21-1768301897-3342589593-1064908849-500
> cn: S-1-5-21-1768301897-3342589593-1064908849-500
> objectClass: sidMap
> objectSid: S-1-5-21-1768301897-3342589593-1064908849-500
> type: ID_TYPE_UID
> xidNumber: 0
> distinguishedName: CN=S-1-5-21-1768301897-3342589593-1064908849-500
> 
> BUILTIN\Administrators gets their ID in the same place:
> 
> dn: CN=S-1-5-32-544
> cn: S-1-5-32-544
> objectClass: sidMap
> objectSid: S-1-5-32-544
> type: ID_TYPE_BOTH
> xidNumber: 3000000
> distinguishedName: CN=S-1-5-32-544
> 
> and as you can see 'Administrator' is a User, but
> 'BUILTIN\Administrator' is both a user and a group, if you give the
> group a gidNumber, it just becomes a group.
> 
> Rowland
> 
/me pokes Rowland
'4096' is the block size.. :)

---

This is how it looks on my productive systems:

root at ad1:~$ ls -dn /var/lib/samba/sysvol
drwxrwx---+ 3 0 3000000 4096 Jun 16 18:46 /var/lib/samba/sysvol

root at ad1:~$ getfacl /var/lib/samba/sysvol
getfacl: Entferne führende '/' von absoluten Pfadnamen
# file: var/lib/samba/sysvol
# owner: root
# group: BUILTIN\134administrators
user::rwx
user:root:rwx
user:3000000:rwx
group::rwx
group:BUILTIN\134administrators:rwx
group:BUILTIN\134server\040operators:r-x
group:3000002:rwx
group:3000003:r-x
mask::rwx
other::---
default:user::rwx
default:user:root:rwx
default:user:3000000:rwx
default:group::---
default:group:BUILTIN\134administrators:rwx
default:group:BUILTIN\134server\040operators:r-x
default:group:3000002:rwx
default:group:3000003:r-x
default:mask::rwx
default:other::---

Bjoern

On Fri, 16 Jun 2017 19:43:44 +0200
Bjoern Trimborn via samba <samba at lists.samba.org> wrote:

> /me pokes Rowland
> '4096' is the block size.. :)
Thanks for that, this is what you get when you try and do several
things at once ;-)

OK, forget what I said, it never happened, it was senior moment ;-)

It doesn't help that the sysvol permissions that Samba sets on sysvol
are all most certainly not correct. I personally would never run
sysvolset or sysvolcheck. 
> 
> ---
> 
> This is how it looks on my productive systems:
> 
Mine looks similar, but I am/was trying to get samba-tool to work
correctly so there are some differences. Did you know that 'Domain
Admins' is supposed to own dirs in sysvol ? which it cannot if you give
the group a gidNumber.

I would suggest that the OP corrects the permissions on sysvol from
Windows and never runs sysvolcheck or sysvolreset again.

Rowland

I run the sysvolreset by without it when I duplicate the gpo (rsync) 
problems occurs later on windows machines perform the same on the DC 
that received the copy ....

Regards....



Em 16-06-2017 15:08, Rowland Penny via samba escreveu:
> Mine looks similar, but I am/was trying to get samba-tool to work
> correctly so there are some differences. Did you know that 'Domain
> Admins' is supposed to own dirs in sysvol ? which it cannot if you give
> the group a gidNumber.
>
> I would suggest that the OP corrects the permissions on sysvol from
> Windows and never runs sysvolcheck or sysvolreset again.
>
> Rowland