thr3ads.net - samba - [Samba] Different LDAP query in different DC... [Nov 2018]

If this information is useful, please help other people find it:
Share via:

Marco Gaiarin

2018-Nov-29 13:32 UTC

[Samba] Different LDAP query in different DC...

Mandi! Rowland Penny via samba
  In chel di` si favelave...
> You need to explicitly ask for it, for instance:
Oh, cool! Seems effectivaly different:

root at vdcsv1:~# ldbsearch -H /var/lib/samba/private/sam.ldb -b
"DC=ad,DC=fvg,DC=lnf,DC=it" "(cn=prova123)"
nTSecurityDescriptor
# record 1
dn: CN=prova123,CN=Aliases,OU=FVG,DC=ad,DC=fvg,DC=lnf,DC=it
nTSecurityDescriptor: O:DAG:DAD:AI(A;CINPID;RPLCRC;;;S-1-5-21-160080369-360138
 5002-3131615632-1314)(OA;CIIOID;RP;4c164200-20c0-11d0-a768-00aa006e0529;4828c
 c14-1437-45bc-9b07-ad6f015e5f28;RU)(OA;CIIOID;RP;4c164200-20c0-11d0-a768-00aa
 006e0529;bf967aba-0de6-11d0-a285-00aa003049e2;RU)(OA;CIIOID;RP;5f202010-79a5-
 11d0-9020-00c04fc2d4cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)(OA;CIIOID;RP;
 5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)
 (OA;CIIOID;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;4828cc14-1437-45bc-9b07-ad
 6f015e5f28;RU)(OA;CIIOID;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;bf967aba-0de
 6-11d0-a285-00aa003049e2;RU)(OA;CIIOID;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3c
 f;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)(OA;CIIOID;RP;59ba2f42-79a2-11d0-90
 20-00c04fc2d3cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)(OA;CIIOID;RP;037088f
 8-0ae1-11d2-b422-00a0c968f939;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)(OA;CII
 OID;RP;037088f8-0ae1-11d2-b422-00a0c968f939;bf967aba-0de6-11d0-a285-00aa00304
 9e2;RU)(OA;CIIOID;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a86-0de6-11d0-
 a285-00aa003049e2;ED)(OA;CIIOID;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967
 a9c-0de6-11d0-a285-00aa003049e2;ED)(OA;CIIOID;RP;b7c69e6d-2cc7-11d2-854e-00a0
 c983f608;bf967aba-0de6-11d0-a285-00aa003049e2;ED)(OA;CIIOID;RPLCLORC;;4828cc1
 4-1437-45bc-9b07-ad6f015e5f28;RU)(OA;CIIOID;RPLCLORC;;bf967a9c-0de6-11d0-a285
 -00aa003049e2;RU)(OA;CIIOID;RPLCLORC;;bf967aba-0de6-11d0-a285-00aa003049e2;RU
 )(OA;CIID;RPWPCR;91e647de-d96f-4b70-9557-d63ff4f3ccd8;;PS)(A;CIID;RPWPCRCCDCL
 CLORCWOWDSDDTSW;;;EA)(A;CIID;LC;;;RU)(A;CIID;RPWPCRCCLCLORCWOWDSDSW;;;BA)S:AI
 (OU;CIIOIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-
 00aa003049e2;WD)(OU;CIIOIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5
 -0de6-11d0-a285-00aa003049e2;WD)

# Referral
ref: ldap://ad.fvg.lnf.it/CN=Configuration,DC=ad,DC=fvg,DC=lnf,DC=it

# Referral
ref: ldap://ad.fvg.lnf.it/DC=DomainDnsZones,DC=ad,DC=fvg,DC=lnf,DC=it

# Referral
ref: ldap://ad.fvg.lnf.it/DC=ForestDnsZones,DC=ad,DC=fvg,DC=lnf,DC=it

# returned 4 records
# 1 entries
# 3 referrals

root at vdcpp1:~# ldbsearch -H /var/lib/samba/private/sam.ldb -b
"DC=ad,DC=fvg,DC=lnf,DC=it" "(cn=prova123)"
nTSecurityDescriptor
# record 1
dn: CN=prova123,CN=Aliases,OU=FVG,DC=ad,DC=fvg,DC=lnf,DC=it
nTSecurityDescriptor: O:DAG:DAD:AI(OA;CIIOID;RP;4c164200-20c0-11d0-a768-00aa00
 6e0529;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)(OA;CIIOID;RP;4c164200-20c0-11
 d0-a768-00aa006e0529;bf967aba-0de6-11d0-a285-00aa003049e2;RU)(OA;CIIOID;RP;5f
 202010-79a5-11d0-9020-00c04fc2d4cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)(O
 A;CIIOID;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa
 003049e2;RU)(OA;CIIOID;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;4828cc14-1437-
 45bc-9b07-ad6f015e5f28;RU)(OA;CIIOID;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;
 bf967aba-0de6-11d0-a285-00aa003049e2;RU)(OA;CIIOID;RP;59ba2f42-79a2-11d0-9020
 -00c04fc2d3cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)(OA;CIIOID;RP;59ba2f42-
 79a2-11d0-9020-00c04fc2d3cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)(OA;CIIOI
 D;RP;037088f8-0ae1-11d2-b422-00a0c968f939;4828cc14-1437-45bc-9b07-ad6f015e5f2
 8;RU)(OA;CIIOID;RP;037088f8-0ae1-11d2-b422-00a0c968f939;bf967aba-0de6-11d0-a2
 85-00aa003049e2;RU)(OA;CIIOID;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a8
 6-0de6-11d0-a285-00aa003049e2;ED)(OA;CIIOID;RP;b7c69e6d-2cc7-11d2-854e-00a0c9
 83f608;bf967a9c-0de6-11d0-a285-00aa003049e2;ED)(OA;CIIOID;RP;b7c69e6d-2cc7-11
 d2-854e-00a0c983f608;bf967aba-0de6-11d0-a285-00aa003049e2;ED)(OA;CIIOID;RPLCL
 ORC;;4828cc14-1437-45bc-9b07-ad6f015e5f28;RU)(OA;CIIOID;RPLCLORC;;bf967a9c-0d
 e6-11d0-a285-00aa003049e2;RU)(OA;CIIOID;RPLCLORC;;bf967aba-0de6-11d0-a285-00a
 a003049e2;RU)(OA;CIID;RPWPCR;91e647de-d96f-4b70-9557-d63ff4f3ccd8;;PS)(A;CIID
 ;RPWPCRCCDCLCLORCWOWDSDDTSW;;;EA)(A;CIID;LC;;;RU)(A;CIID;RPWPCRCCLCLORCWOWDSD
 SW;;;BA)S:AI(OU;CIIOIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de
 6-11d0-a285-00aa003049e2;WD)(OU;CIIOIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f8036
 7c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)

# Referral
ref: ldap://ad.fvg.lnf.it/CN=Configuration,DC=ad,DC=fvg,DC=lnf,DC=it

# Referral
ref: ldap://ad.fvg.lnf.it/DC=DomainDnsZones,DC=ad,DC=fvg,DC=lnf,DC=it

# Referral
ref: ldap://ad.fvg.lnf.it/DC=ForestDnsZones,DC=ad,DC=fvg,DC=lnf,DC=it

# returned 4 records
# 1 entries
# 3 referrals


Ahem, there's some way to check, in human-readable form, that ACLs?

-- 
dott. Marco Gaiarin				        GNUPG Key ID: 240A3D66
  Associazione ``La Nostra Famiglia''         
http://www.lanostrafamiglia.it/
  Polo FVG   -   Via della Bontà, 7 - 33078   -   San Vito al Tagliamento (PN)
  marco.gaiarin(at)lanostrafamiglia.it   t +39-0434-842711   f +39-0434-842797

		Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA!
      http://www.lanostrafamiglia.it/index.php/it/sostienici/5x1000
	(cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)

Rowland Penny

2018-Nov-29 14:01 UTC

head link

[Samba] Different LDAP query in different DC...

On Thu, 29 Nov 2018 14:32:39 +0100
Marco Gaiarin via samba <samba at lists.samba.org> wrote:
> Mandi! Rowland Penny via samba
>   In chel di` si favelave...
> 
> > You need to explicitly ask for it, for instance:
> 
> Oh, cool! Seems effectivaly different:
> 
> root at vdcsv1:~# ldbsearch -H /var/lib/samba/private/sam.ldb -b
> "DC=ad,DC=fvg,DC=lnf,DC=it" "(cn=prova123)"
nTSecurityDescriptor #
> record 1 dn: CN=prova123,CN=Aliases,OU=FVG,DC=ad,DC=fvg,DC=lnf,DC=it
> nTSecurityDescriptor:
> O:DAG:DAD:AI(A;CINPID;RPLCRC;;;S-1-5-21-160080369-360138
> 5002-3131615632-1314)
This one has an extra ACE and in readable form it is:

(A;CINPID;RPLCRC;;;S-1-5-21-160080369-3601385002-3131615632-1314)

"A" 	SDDL_ACCESS_ALLOWED 	ACCESS_ALLOWED_ACE_TYPE

"CI" 	SDDL_CONTAINER_INHERIT 	CONTAINER_INHERIT_ACE
"NP" 	SDDL_NO_PROPAGATE 	NO_PROPAGATE_INHERIT_ACE
"ID" 	SDDL_INHERITED 	        INHERITED_ACE

"RP"    SDDL_READ_PROPERTY
"LC"    SDDL_LIST_CHILDREN
"RC"    SDDL_READ_CONTROL

account_sid: SID string that identifies the trustee of the ACE.

S-1-5-21-160080369-3601385002-3131615632-1314

Is this the one with the problem ?
Who or what has the RID '1314' ?

Rowland

Marco Gaiarin

2018-Nov-29 14:42 UTC

head link

[Samba] Different LDAP query in different DC...

Mandi! Rowland Penny via samba
  In chel di` si favelave...
> S-1-5-21-160080369-3601385002-3131615632-1314
Bingo! Exactly the 'Restricted' group that own the users i use for
generico LDAP access!
I really think that we have found the trouble!


Now... how can i fix it? ;-)

And... why that vaule get not propagated?!


Thanks.

-- 
dott. Marco Gaiarin				        GNUPG Key ID: 240A3D66
  Associazione ``La Nostra Famiglia''         
http://www.lanostrafamiglia.it/
  Polo FVG   -   Via della Bontà, 7 - 33078   -   San Vito al Tagliamento (PN)
  marco.gaiarin(at)lanostrafamiglia.it   t +39-0434-842711   f +39-0434-842797

		Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA!
      http://www.lanostrafamiglia.it/index.php/it/sostienici/5x1000
	(cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)

Seemingly Similar Threads

Search for more apparently analagous threads

samba - Nov 2018 - Different LDAP query in different DC...

[Samba] Different LDAP query in different DC...

[Samba] Different LDAP query in different DC...

[Samba] Different LDAP query in different DC...

Seemingly Similar Threads