samba - Aug 2019 - winbind on DC : how use gidNumber instead of primaryGroupID as user's primary group

On 20/08/2019 11:16, L.P.H. van Belle via samba wrote
>> The problem with that is, 'id' gets its info from the same
place that
>> 'getent' does, so the OP will still get the wrong group ;-)
>>
>> Rowland
> Maybe i did not understand the question then.
> In: id username |awk -F"=" '{ print $2 }'|cut
-d"(" -f1
> $2 = GID
> $3 = primary group.
The OP wants something like 'idmap config SAMDOM : unix_primary_group = 
yes' but on a DC.

As the 'idmap config' lines do not work on a DC, I think he has three 
options:

Just make do with 'domain Users'.

Set up a Unix domain member and use that instead.

Use nslcd.

Before anyone says 'what about sssd ?' , when the people who produce it 
say 'do not use sssd with winbind', then you shouldn't use it on a
Samba
AD DC.

Rowland

Le mar. 20 ao?t 2019 ? 12:30, Rowland penny via samba
<samba at lists.samba.org> a ?crit :
>
> On 20/08/2019 11:16, L.P.H. van Belle via samba wrote
> >> The problem with that is, 'id' gets its info from the same
place that
> >> 'getent' does, so the OP will still get the wrong group
;-)
> >>
> >> Rowland
> > Maybe i did not understand the question then.
> > In: id username |awk -F"=" '{ print $2 }'|cut
-d"(" -f1
> > $2 = GID
> > $3 = primary group.
>
> The OP wants something like 'idmap config SAMDOM : unix_primary_group
> yes' but on a DC.
>
> As the 'idmap config' lines do not work on a DC, I think he has
three
> options:
>
> Just make do with 'domain Users'.
>
> Set up a Unix domain member and use that instead.
>
> Use nslcd.
>
> Before anyone says 'what about sssd ?' , when the people who
produce it
> say 'do not use sssd with winbind', then you shouldn't use it
on a Samba
> AD DC.
>
> Rowland
>
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
In short. My network design previously work with Debian Stretch
Servers and clients and some Windows clients (not many).

Debian Stretch use Samba 4.5.16 so there is no unix_primary_group
option for the clients. So I have to use the "dirty" tweak of
modifying all my users "primaryGroupID" to the corresponding
"gidNumber". Every things works well with my NFSv4 shares and Samba
shares. I did not notice somethings wrong neither in Linux or Windows
client.

Now my network design will be upgraded to Debian Buster. I was happy
to see the apparition of the "unix_primary_group" option. I think at
start that this will help me ovoiding the dirty trick.

But on the Buster Samba DC this option does not exist and more, now
Samba DC refuse to check the "primaryGroupID" value. My dirty trick
does not works anymore. So il need to convert all my scripts to obtain
the gidNumber.

Here what id give on DC :
# id testteacher6
uid=4000007(FICHLAN\testteacher6) gid=5200001(FICHLAN\domain users)
groups=5200001(FICHLAN\domain
users),5000002(FICHLAN\teachers),5000000(FICHLAN\s4users),3000009(BUILTIN\users)

Surprisingly it seems that winbind_nss put the group corresponding to
the gidNumber just after the "Domain Users" group on the
"id" comment.
But I'm not sure this behavior is reliable. So may the Louis tricks
can work ...

Hai, 
> 
> In short. My network design previously work with Debian Stretch
> Servers and clients and some Windows clients (not many).
> 
> Debian Stretch use Samba 4.5.16 so there is no unix_primary_group
> option for the clients. So I have to use the "dirty" tweak of
> modifying all my users "primaryGroupID" to the corresponding
> "gidNumber". Every things works well with my NFSv4 shares and
Samba
> shares. I did not notice somethings wrong neither in Linux or Windows
> client.
? Uhm, samba-tool does have the option to add uid/gids. 

I can recall our conversation years ago for jessi with nfsv4. 
These days setting up nfsv4 is easy. 
I these days have NFSv4 with sys,krb5,krb5i,krb5p working 
*example, ssh SSO logins and automounted krb5p and protected homedirs, which
even root can not enter.
I'll work this out in the howto's im updating/writing atm for Debian
Buster.
This might take some time, because it will be the full setup of how im running
things.
.. I might speed up a bit because i noticed the samba wiki is really improved a
lot,
so i migh "borrow" some parts ;-).

It might help, if you can explain exactly how you nfsv4 is setup now. 
> 
> Now my network design will be upgraded to Debian Buster. I was happy
> to see the apparition of the "unix_primary_group" option. I think
at
> start that this will help me ovoiding the dirty trick.
> 
I still dont understand what your exactly doing and what was not working.. 
(sorry)
> 
> But on the Buster Samba DC this option does not exist and more, now
> Samba DC refuse to check the "primaryGroupID" value. My dirty
trick
> does not works anymore. So il need to convert all my scripts to obtain
> the gidNumber.
> 
> Here what id give on DC :
> # id testteacher6
> uid=4000007(FICHLAN\testteacher6) gid=5200001(FICHLAN\domain users)
groups=5200001(FICHLAN\domain
users),5000002(FICHLAN\teachers),5000000(FICHLAN\s4users),3000009(BUILTIN\users)
> 
> Surprisingly it seems that winbind_nss put the group corresponding to
> the gidNumber just after the "Domain Users" group on the
"id" comment.
> But I'm not sure this behavior is reliable. So may the Louis tricks
> can work ...
> 
Hmm, so, i've tested a bit more, because if Rowland says something i pay
extra attention ;-).

I create a new user with ADUC. Note, i use Win7, so i have the Unix tab. ;-) 

- clean windows AD users. 
id testuser
uid=3000338(BAZRTD\testuser) gid=10000(BAZRTD\domain users)
groups=10000(BAZRTD\domain
users),3000338(BAZRTD\testuser),3000009(BUILTIN\users)

net cache flush 

- Assigned a UID + Primary Group, shell.   ( testing Primary group : testgroup )
id testuser
uid=10128(NTDOM\testuser) gid=10000(NTDOM\domain users)
groups=10000(NTDOM\domain users),3000009(BUILTIN\users)
? no primary group/GID as i did set. 

net cache flush 

- Going to Tab :  Member of group.
Added group testgroup
Selected it, and clicked on "Set Primary Group" 
id testuser
uid=10128(NTDOM\testuser) gid=10000(NTDOM\domain users)
groups=10000(NTDOM\domain users),10011(NTDOM\testgroup),3000009(BUILTIN\users)
? no primary group/GID as i did set. 

- going back to unix tab
Now here, i also selected the "primary Group", but now same as above.
( testgroup )
uid=10128(NTDOM\testuser) gid=10000(NTDOM\domain users)
groups=10000(NTDOM\domain users),10011(NTDOM\testgroup),3000009(BUILTIN\users)
and again, no primary group. 

So my conclusion.
View point, from Linux CLI. 
The view point from windows GUI might differ, i did not test that. 


Its always : 
UID GID PRIMIARY_GROUP_GID with the output of 'id' as far i notice with
these checks.

!! DC !! 
On the DC, a primay group is not respected as it should. 
And primariy group is always "domain users"


!! MEMBER !!
On the members, keeping the settings as it was, and working back to no uid/gid

id testuser
uid=10128(testuser) gid=10011(testgroup) groups=10011(testgroup),10000(domain
users),2001(BUILTIN\users)
Correct

- going back to unix tab, selected "domain users"
id testuser
uid=10128(testuser) gid=10000(domain users) groups=10000(domain
users),10011(testgroup),2001(BUILTIN\users)
# unix primary is set to "domain users" and the Windows primary group
is set to testgroup.


Switching UNIX primary group and windows primary group.
# unix primary is set to testgroup and the Windows primary group is set to
"domain users"
id testuser
uid=10128(testuser) gid=10011(testgroup) groups=10011(testgroup),10000(domain
users),2001(BUILTIN\users)
Correct

All set to "domain users"
id testuser
uid=10128(testuser) gid=10000(domain users) groups=10000(domain
users),10011(testgroup),2001(BUILTIN\users)
Correct

Remove the Unix attributed
id testuser
id: ?testuser?: no such user

I hope it can help you.



Greetz, 

Louis

Le mar. 20 ao?t 2019 ? 14:30, L.P.H. van Belle via samba
<samba at lists.samba.org> a ?crit :
>
> Hai,
>
> >
> > In short. My network design previously work with Debian Stretch
> > Servers and clients and some Windows clients (not many).
> >
> > Debian Stretch use Samba 4.5.16 so there is no unix_primary_group
> > option for the clients. So I have to use the "dirty" tweak
of
> > modifying all my users "primaryGroupID" to the corresponding
> > "gidNumber". Every things works well with my NFSv4 shares
and Samba
> > shares. I did not notice somethings wrong neither in Linux or Windows
> > client.
> ? Uhm, samba-tool does have the option to add uid/gids.
>
> I can recall our conversation years ago for jessi with nfsv4.
> These days setting up nfsv4 is easy.
> I these days have NFSv4 with sys,krb5,krb5i,krb5p working
> *example, ssh SSO logins and automounted krb5p and protected homedirs,
which even root can not enter.
> I'll work this out in the howto's im updating/writing atm for
Debian Buster.
> This might take some time, because it will be the full setup of how im
running things.
> .. I might speed up a bit because i noticed the samba wiki is really
improved a lot,
> so i migh "borrow" some parts ;-).
>
> It might help, if you can explain exactly how you nfsv4 is setup now.
>
> >
> > Now my network design will be upgraded to Debian Buster. I was happy
> > to see the apparition of the "unix_primary_group" option. I
think at
> > start that this will help me ovoiding the dirty trick.
> >
> I still dont understand what your exactly doing and what was not working..
> (sorry)
>
> >
> > But on the Buster Samba DC this option does not exist and more, now
> > Samba DC refuse to check the "primaryGroupID" value. My
dirty trick
> > does not works anymore. So il need to convert all my scripts to obtain
> > the gidNumber.
> >
> > Here what id give on DC :
> > # id testteacher6
> > uid=4000007(FICHLAN\testteacher6) gid=5200001(FICHLAN\domain users)
groups=5200001(FICHLAN\domain
users),5000002(FICHLAN\teachers),5000000(FICHLAN\s4users),3000009(BUILTIN\users)
> >
> > Surprisingly it seems that winbind_nss put the group corresponding to
> > the gidNumber just after the "Domain Users" group on the
"id" comment.
> > But I'm not sure this behavior is reliable. So may the Louis
tricks
> > can work ...
> >
> Hmm, so, i've tested a bit more, because if Rowland says something i
pay extra attention ;-).
>
> I create a new user with ADUC. Note, i use Win7, so i have the Unix tab.
;-)
>
> - clean windows AD users.
> id testuser
> uid=3000338(BAZRTD\testuser) gid=10000(BAZRTD\domain users)
groups=10000(BAZRTD\domain
users),3000338(BAZRTD\testuser),3000009(BUILTIN\users)
>
> net cache flush
>
> - Assigned a UID + Primary Group, shell.   ( testing Primary group :
testgroup )
> id testuser
> uid=10128(NTDOM\testuser) gid=10000(NTDOM\domain users)
groups=10000(NTDOM\domain users),3000009(BUILTIN\users)
> ? no primary group/GID as i did set.
>
> net cache flush
>
> - Going to Tab :  Member of group.
> Added group testgroup
> Selected it, and clicked on "Set Primary Group"
> id testuser
> uid=10128(NTDOM\testuser) gid=10000(NTDOM\domain users)
groups=10000(NTDOM\domain users),10011(NTDOM\testgroup),3000009(BUILTIN\users)
> ? no primary group/GID as i did set.
>
> - going back to unix tab
> Now here, i also selected the "primary Group", but now same as
above. ( testgroup )
> uid=10128(NTDOM\testuser) gid=10000(NTDOM\domain users)
groups=10000(NTDOM\domain users),10011(NTDOM\testgroup),3000009(BUILTIN\users)
> and again, no primary group.
>
> So my conclusion.
> View point, from Linux CLI.
> The view point from windows GUI might differ, i did not test that.
>
>
> Its always :
> UID GID PRIMIARY_GROUP_GID with the output of 'id' as far i notice
with these checks.
>
> !! DC !!
> On the DC, a primay group is not respected as it should.
> And primariy group is always "domain users"
>
>
> !! MEMBER !!
> On the members, keeping the settings as it was, and working back to no
uid/gid
>
> id testuser
> uid=10128(testuser) gid=10011(testgroup)
groups=10011(testgroup),10000(domain users),2001(BUILTIN\users)
> Correct
>
> - going back to unix tab, selected "domain users"
> id testuser
> uid=10128(testuser) gid=10000(domain users) groups=10000(domain
users),10011(testgroup),2001(BUILTIN\users)
> # unix primary is set to "domain users" and the Windows primary
group is set to testgroup.
>
>
> Switching UNIX primary group and windows primary group.
> # unix primary is set to testgroup and the Windows primary group is set to
"domain users"
> id testuser
> uid=10128(testuser) gid=10011(testgroup)
groups=10011(testgroup),10000(domain users),2001(BUILTIN\users)
> Correct
>
> All set to "domain users"
> id testuser
> uid=10128(testuser) gid=10000(domain users) groups=10000(domain
users),10011(testgroup),2001(BUILTIN\users)
> Correct
>
> Remove the Unix attributed
> id testuser
> id: ?testuser?: no such user
>
> I hope it can help you.
>
>
>
> Greetz,
>
> Louis
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
Thank you very much Louis for your help !!!

You have got exactly the same conclusion than me. On DC it's not
possible to make winbind return the gid I want. And on members
everything is coherent. (Note that the group corresponding to gid on
DC seems to be always the first group displayed after Domain Users).

And these uid/gid are used by the nfsv4 server to manage files. So if
my nfsv4 server is on a DC :
-> When on the member my testuser (uid=testuser, gid=teachers) create
a file on the nfsv4 share
-> The DC translate the user uid/gid and create a file owner by
"testuser:domain users"
-> If I check the file uid/gid from member I see "uid=testuser,
gid=domain user"

So the "problem" is that, with the nfsv4 server on DC, when my users
create files with uid=A/gid=B, the file is created with
uid=A,gid=Domain Users.

For years I found problematic this limitation about serve files on DC.
How do to design your network Louis to get a member file server ?
-> You use virtualization ?
-> You use LXC ?
-> You use two physical servers ?

How OP do in general here ? Is there some tutorial about LXC setup for
samba around here ? I have only one physical server....

@Louis :
It's seems that we are working you and me on network design for
school/enterprise no ? If you are interested I try to publish my work
now :
https://github.com/prunkdump/sclustered

Maybe we can works together or exchange some part of our design. If
you have a virtual machine emulator you can get my setup running in
less than 30 minutes (I use puppet for configuration). If you want
some info contact me by email.

Regards,

Baptiste.

Hai Baptiste,
> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Prunk Dump via samba
> Verzonden: woensdag 21 augustus 2019 10:05
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] winbind on DC : how use gidNumber 
> 
> Thank you very much Louis for your help !!!
Your welkom. 
> 
> You have got exactly the same conclusion than me. On DC it's not
> possible to make winbind return the gid I want. And on members
> everything is coherent. (Note that the group corresponding to gid on
> DC seems to be always the first group displayed after Domain Users).
> 
> And these uid/gid are used by the nfsv4 server to manage files. So if
> my nfsv4 server is on a DC :
> -> When on the member my testuser (uid=testuser, gid=teachers) create
> a file on the nfsv4 share
> -> The DC translate the user uid/gid and create a file owner by
> "testuser:domain users"
> -> If I check the file uid/gid from member I see 
> "uid=testuser, gid=domain user"
> 
> So the "problem" is that, with the nfsv4 server on DC, when my
users
> create files with uid=A/gid=B, the file is created with
> uid=A,gid=Domain Users.
This should not really be a problem as long as your using "Creator
Owner/Creator Group" ( chmod 3XXX 4XXX)
There is more about this, im writing that out in my new howto's. 
This has all todo with the network desigh and file/folder setup, as in your
rights structure.
> 
> For years I found problematic this limitation about serve files on DC.
Yes, and here the solution is very simpel, stop using the DC as fileserver. 
> How do to design your network Louis to get a member file server ?
> -> You use virtualization ?
Yes, i use virtualization, i use XCP-NG the free/opensource version of
Xenserver.
I like it. 
> -> You use LXC ?
No, never have. 
> -> You use two physical servers ?
Uh.. I have about 10 physicals here and about 15 virtuals. 
> 
> How OP do in general here ? Is there some tutorial about LXC setup for
> samba around here ? I have only one physical server....
Show me the specs of  you server:
CPU RAM Harddisks 
How much and in RAID X?  
ssd/scsi/sata? 
Possible also the RPM if its not SSD

I'll have a look at it, what is wize to say. 
> 
> @Louis :
> It's seems that we are working you and me on network design for
> school/enterprise no ? 
And yes, currently im writing my new howto ( on a secret website ;-) ). 
I'm writing out my running network here and yeah, that is enterprize ready. 
Note, i started 2 days ago with it, so before its online.. 
Well, that will take a bit more time, im also adding why i do things a certain
way.
> If you are interested I try to publish my work now :
> https://github.com/prunkdump/sclustered
> 
That looks interesting. 
> Maybe we can works together or exchange some part of our design. If
> you have a virtual machine emulator you can get my setup running in
> less than 30 minutes (I use puppet for configuration). If you want
> some info contact me by email.
Well, i never used puppet, i did have a look at that, but never tried it. 
Its on my list, to learn, but atm time is not my friend, it does not happen
often,
but i really have to do some work in the office..  :-( 

But sure we can always share/exchange design/setup parts. 
Once i have written the setup of AD-DC + an DC join + an member.
Then we could talk, because then you have, 
what i use as base setup and the how and why i use that as base. 

So far,
> 
> Regards,
> 
> Baptiste.
> 

Greetz, 

Louis