samba - Aug 2017 - Share access problem

Good morning Rowland,

I agree, the user boubou is a local user and an AD user too.
If I use another user, vakjak:
# getent passwd vakjak
vakjak:*:11049:10004::/home/DOMAIN:/bin/bash

I got that output so I bet its right.

How can I login with a login name as Sebastien[space]Boulianne on Samba ?

Thanks!

Sébastien
-----Messa
ge d'origine-----
De : samba [mailto:samba-bounces at lists.samba.org] De la part de Rowland Penny
via samba
Envoyé : 18 août 2017 02:51
À : samba at lists.samba.org
Objet : Re: [Samba] Share access problem

On Thu, 17 Aug 2017 17:18:38 -0400
<Sebastien.Boulianne at cpu.ca> wrote:
> Hi again,
> 
> Thanks.
> Now, please see my smb.conf and my testparm. ;)
> 
> smb.conf
> https://pastebin.com/WR2CY9SW
> 
> testparm
> https://pastebin.com/2jMDtWs2
> 
> And yes, if I do getent passwd boubou, I have a good answer.
> I paste the output in the testparm link.
> 
> If I type \\FILESRV on my PC,
> credentials are asked,
> I can see the share FTPFiles and boubou but I cant browse or display 
> the content. Why ? rwxr-xr-x  4 boubou  boubou  4.0K Aug 17 16:56 
> boubou drwsrwxrwx 11 root BUILTIN\administrators 4.0K Aug 11 16:46 
> site
> 
I went through your smb conf and removed any lines that were the default
settings or shouldn't be there and posted the result, you could have cut and
pasted that over your smb.conf.

Mind you, it wouldn't have helped with your problem.

If you look at the idmap block in your smb.conf, there is this:

   idmap config * : backend = tdb
   idmap config * : range = 3000-7999
   idmap config domain : backend = rid
   idmap config domain : range = 10000-20000

The '*' range is for the Well Known SIDS The 'domain' range is
for the AD users & groups

You have now posted this:

getent passwd boubou
boubou:x:1000:1000:Sebastien Boulianne,,,:/home/boubou:/bin/bash

Hmm, '1000' isn't inside '3000-7999' or
'10000-20000'

If we look at your /etc/nsswitch.conf we find these lines:

passwd:         files winbind
group:          files winbind

This means that /etc/passwd is checked first for 'boubou' and if found
this user is returned, if not found, winbind is checked and if found the user is
returned.

Now, as I said above, the ID for 'boubou' isn't inside either of the
domain ranges, this leads to only one conclusion, 'boubou' is in
/etc/passwd.

Is 'boubou' also in AD ?
You cannot have a user in /etc/passwd and AD

Until 'getent passwd boubou' returns an ID number inside the
'10000-20000' range, he will not be recognised by the Unix machine as an
AD user.

Rowland


--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

On Fri, 18 Aug 2017 10:45:02 -0400
<Sebastien.Boulianne at cpu.ca> wrote:
> Good morning Rowland,
> 
> I agree, the user boubou is a local user and an AD user too.
> If I use another user, vakjak:
> # getent passwd vakjak
> vakjak:*:11049:10004::/home/DOMAIN:/bin/bash
> 
> I got that output so I bet its right.
> 
> How can I login with a login name as Sebastien[space]Boulianne on
> Samba ?
You login with the samaccountname, which may be 'boubou', I am unsure
because I do not know how 'boubou' was created in AD. You will first
need to delete the 'boubou' user in /etc/passwd and if the
samaccountname is 'boubou', then, after you run 'net cache
flush',
'getent passwd boubou' should produce a different result. You will then
need to 'chown boubou:Domain\ Users' on any files or directories owned
by 'boubou'

As an aside, I take it the gidNumber for Domain users is 10004 and the
windows RID for vakjak is 1049

Rowland

On Fri, 18 Aug 2017 11:22:18 -0400
<Sebastien.Boulianne at cpu.ca> wrote:
> Ok, but what can I do if the samaccountname have a space in ?
> Most windows samaccountname / Windows username have a space in.
> 
Most user samaccountname attributes are set to the users given name
e.g. if the users CN is 'Fred Bloggs', the samaccountname is usually
set to 'fred', but if it is set to 'fred bloggs' you will need
to
escape the space on Unix. You can do this several ways, by quoting the
name 'fred bloggs' or "fred bloggs" or by doing this fred\
bloggs

Rowland

Hi Rowland,
I tried that but it didn't work.

I can list all users using wbinfo -u but it didn't work if I do getent
passwd <samaccountname>.

Do you have any clues ?

Thanks.

Sébastien

-----Message d'origine-----
De : samba [mailto:samba-bounces at lists.samba.org] De la part de Rowland Penny
via samba
Envoyé : 18 août 2017 11:39
À : samba at lists.samba.org
Objet : Re: [Samba] Share access problem

On Fri, 18 Aug 2017 11:22:18 -0400
<Sebastien.Boulianne at cpu.ca> wrote:
> Ok, but what can I do if the samaccountname have a space in ?
> Most windows samaccountname / Windows username have a space in.
> 
Most user samaccountname attributes are set to the users given name e.g. if the
users CN is 'Fred Bloggs', the samaccountname is usually set to
'fred', but if it is set to 'fred bloggs' you will need to
escape the space on Unix. You can do this several ways, by quoting the name
'fred bloggs' or "fred bloggs" or by doing this fred\ bloggs

Rowland

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba