Hi Rowland,
Just a quick summary, we had to roll back the AD migration due to some users
having issues accessing the shares post the migration. They were getting server
couldn't not be found , using both hostname and IP. It won't even show
the shares available in the server. Some users had no issues, which is the
puzzling bit
Re the OS and file system:
I had a look at the following document regarding the file system support. It
mentions something like adding the
posix:eadb = /usr/local/samba/private/eadb.tdb to smb.conf file
https://wiki.samba.org/index.php/File_System_Support
As mentioned, we got the following during the migration
ERROR(<class 'samba.provision.ProvisioningError'>): uncaught
exception - ProvisioningError: Your filesystem or build does not support posix
ACLs, which s3fs requires. Try the mounting the filesystem with the
'acl' option.
I then put the old tdb files back on /var/lib/samba and re-ran the migration
with the ntvs flag. Could that have caused issues with share access? But having
said that, post the migration some users had no issues accessing the shares.
Re the packages:
I followed the following to install the required files for Ubuntu and it does
include the act and attr package
https://wiki.samba.org/index.php/Package_Dependencies_Required_to_Build_Samba
Let me just explain what I have added to the migration script
- Because some of the unix groups are not in Samba, we're adding them just
before the migration steps. This is because we found that if the groups are not
present pre-migration , they are not migrated which I would expect.
net groupmap add ntgroup abcd unix group abcd
- Then we remove the well know groups (domain admins and domain users)
- Then perform migration based the main Samba Migration wiki page using
Bind9_DLZ
- Then we setup the krb5 and test Kerberos
- Then configure and populate DNS
The one question I have is we have users and groups defined in the /etc/passwd
and /etc/group. The users and most of the groups are also in the tbd, do we
manually remove them pre/post migration? In our test environment we left them
one and didn't have access issues , possibly because nsswitch looks for
files first then winbind
The other issue we found is we seems to have hit a bug of the max 16 group
membership, it came with sys_panic. When we look run groups username we see
lesser groups that when we do id username. It looks like a default group is
added to the user something like BUILTIN\users, is that normal?
Any thoughts?
Regards,
Praveen Ghimire
-----Original Message-----
From: Rowland Penny [mailto:rpenny at samba.org]
Sent: Thursday, 11 April 2019 11:14 PM
To: samba at lists.samba.org
Cc: Praveen Ghimire
Subject: Re: [Samba] AD migration issues
On Thu, 11 Apr 2019 12:05:13 +0000
Praveen Ghimire via samba <samba at lists.samba.org> wrote:
> Hi ,
>
> We migrated to AD account in a Ubuntu 16.04 (Samba 4.3.11)and came
> across issues with user shares. Some of the users were able to access
> the shares and some were not.
Can I suggest you migrate again, this time to Ubuntu 18.04, this will get you a
supported (by Samba) version.
>
> The server in question has both AD and File and we followed the samba
> wiki to enable the Windows ACL
>
> To migrate , we ran the following
> samba-tool domain classicupgrade --dbdir=/var/lib/samba.PDC/dbdir
> --realm=lin.GROUP --dns-backend=BIND9_DLZ /etc/samba.PDC/smb.PDC.conf
> --use-ntvfs
>
> We had to use the ntvfs as we got the Your filesystem or build does
> not support posix ACLs, which s3fs requires. Try the mounting the
> filesystem with the 'acl' option."
Which filesystem are you using, most support acl's by default, have you
installed the acl & xattr packages. Whatever your problem is, you need to
fix it, ntvfs is now only used in testing and isn't built by default, this
happened at Samba 4.5.0
>
> The smbd -b | grep HAVE_LIBACL gave HAVE_LIBACL
>
> A user with the issue has the following
> uid=1091(chel) gid=1091(cheryl)
> groups=1091(cheryl),1002(domainusers),1004(lin),1009(workshop),1017(de
> ptfin),1057(skillsdb),1058(incidentdb),1059(hrdb),1079(deptlegal),1086
> (depteng),1109(deptivolve),1117(deptsop),1119(deptjelldb),1169(depttra
> ining),1170(deptshms),100(users),3000002(lin\ocetest)
> The bit at the end, ocetest is not even a group, it is a user
I bet it is a group as well ;-)
> winbind enum users = yes
> winbind enum groups = yes
Whilst you can use the above two lines on any Samba server, you should only use
them for testing purposes.
> winbind nss info = rfc2307
> idmap config * : backend = tdb
> idmap config * : range = 4000-7999
> idmap config lin:backend = ad
> idmap config lin:schema_mode = rfc2307
> idmap config lin:range = 10000-999999
You need to remove the above lines, they are only used on a Unix domain member
Rowland
______________________________________________________________________
This email has been scanned by the Symantec Email Security.cloud service.
For more information please visit http://www.symanteccloud.com
______________________________________________________________________