samba - Nov 2020 - nfs root kerberos

Hi.

I have Samba AD configured correctly, and can mount kerberized NFS from 
all the CentOS 7 clients.? I'm not able to use "root" on the
client even
though the nfs export specifies the option: no_root_squash option.

I completely understand that in order to use the "root" identity
(which
doesn't exist as a user in the domain) on the NFS client, this identity 
has to be mapped to somewhere else.? That's why my samba config 
specifies a file for "username map" which contains:

!root = SAMDOM\Administrator

I figured that I should just need to do a "kinit Administrator" on the
client, and take on the root identity, then I could write as root where 
I have no_root_squash configured...? However, when I tried this on a 
client, I get a permission denied when trying to write.

I saw a reference to adding? to /etc/idmapd.conf a static mapping:

Method = static,nsswitch
[Static]
MYHOST$@MYREALM = root

... but it's really not clear why this would be necessary if the 
username map entry is working. I added this on the server and it's not 
working either after restarting rpcidmapd.

I also saw a red hat document that talked about adding to /etc/krb5.conf:

[realms]
?
EXAMPLE.COM = {
?
auth_to_local = 
RULE:[2:$1/$2@$0](host/nfsclient.example.com at EXAMPLE.COM)s/.*/root/
auth_to_local = DEFAULT
}

... but that doesn't seem to change the permission denied.

Any feedback would be greatly appreciated.

Thanks!

Jason.

On 09/11/2020 19:41, Jason Keltz via samba wrote:
> Hi.
>
> I have Samba AD configured correctly, and can mount kerberized NFS 
> from all the CentOS 7 clients.? I'm not able to use "root" on
the
> client even though the nfs export specifies the option: no_root_squash 
> option.
>
> I completely understand that in order to use the "root" identity 
> (which doesn't exist as a user in the domain) on the NFS client, this 
> identity has to be mapped to somewhere else.? That's why my samba 
> config specifies a file for "username map" which contains:
>
> !root = SAMDOM\Administrator
This works in the opposite way to what you think it does, it maps 
Administrator on the client to root on the server i.e. it allows 
Administrator on one machine to do things on another. The only problem 
is that Administrator is a Windows user and shouldn't be used on a Unix 
machine, so it only really works from Windows machines.
>
> I figured that I should just need to do a "kinit Administrator"
on the
> client, and take on the root identity, then I could write as root 
> where I have no_root_squash configured...? However, when I tried this 
> on a client, I get a permission denied when trying to write.
You need to do the kinit as root or using sudo, so the resultant ticket 
belongs to root.
>
> I saw a reference to adding? to /etc/idmapd.conf a static mapping:
>
> Method = static,nsswitch
> [Static]
> MYHOST$@MYREALM = root
>
> ... but it's really not clear why this would be necessary if the 
> username map entry is working. I added this on the server and it's not 
> working either after restarting rpcidmapd.
The username map is probably working, just not as you
think.
>
> I also saw a red hat document that talked about adding to /etc/krb5.conf:
>
> [realms]
> ?
> EXAMPLE.COM = {
> ?
> auth_to_local = 
> RULE:[2:$1/$2@$0](host/nfsclient.example.com at EXAMPLE.COM)s/.*/root/
> auth_to_local = DEFAULT
> }
>
> ... but that doesn't seem to change the permission denied.
Not sure if that will work.

Where do you have the username map defined, if it is on the DC, remove 
it immediately, the mapping is already done in idmap.ldb.

Can you please post the smb.conf

Rowland

>
> Any feedback would be greatly appreciated.
>
> Thanks!
>
> Jason.
>
>
>

On 11/9/2020 3:00 PM, Rowland penny via samba wrote:
> On 09/11/2020 19:41, Jason Keltz via samba wrote:
>> Hi.
>>
>> I have Samba AD configured correctly, and can mount kerberized NFS 
>> from all the CentOS 7 clients.? I'm not able to use
"root" on the
>> client even though the nfs export specifies the option: 
>> no_root_squash option.
>>
>> I completely understand that in order to use the "root"
identity
>> (which doesn't exist as a user in the domain) on the NFS client,
this
>> identity has to be mapped to somewhere else.? That's why my samba 
>> config specifies a file for "username map" which contains:
>>
>> !root = SAMDOM\Administrator
> This works in the opposite way to what you think it does, it maps 
> Administrator on the client to root on the server i.e. it allows 
> Administrator on one machine to do things on another. The only problem 
> is that Administrator is a Windows user and shouldn't be used on a 
> Unix machine, so it only really works from Windows machines.
Ah... got it.. thanks.. my misunderstanding.
>>
>> I figured that I should just need to do a "kinit
Administrator" on
>> the client, and take on the root identity, then I could write as root 
>> where I have no_root_squash configured...? However, when I tried this 
>> on a client, I get a permission denied when trying to write.
>
> You need to do the kinit as root or using sudo, so the resultant 
> ticket belongs to root.
>
So that would mean I need to "samba-tool user create root
"password" ??
I was under the impression that the "idmapd.conf" mapping would have 
avoided that..

But that's fine... I created "root" with samba-tool, then did a
kinit
root, but removed all the other things I did, and it surprisingly still 
doesn't work.

>>
>> I saw a reference to adding? to /etc/idmapd.conf a static mapping:
>>
>> Method = static,nsswitch
>> [Static]
>> MYHOST$@MYREALM = root
>>
>> ... but it's really not clear why this would be necessary if the 
>> username map entry is working. I added this on the server and it's 
>> not working either after restarting rpcidmapd.
> The username map is probably working, just not as you think.
Do I still need this in nfsidmap.conf?
>>
>> I also saw a red hat document that talked about adding to 
>> /etc/krb5.conf:
>>
>> [realms]
>> ?
>> EXAMPLE.COM = {
>> ?
>> auth_to_local = 
>> RULE:[2:$1/$2@$0](host/nfsclient.example.com at EXAMPLE.COM)s/.*/root/
>> auth_to_local = DEFAULT
>> }
>>
>> ... but that doesn't seem to change the permission denied.
>
> Not sure if that will work.
>
> Where do you have the username map defined, if it is on the DC, remove 
> it immediately, the mapping is already done in idmap.ldb.
I just uncommented those lines, and doesn't make a difference either...

I had the username map defined on the DC and on all the AD clients.? 
They all actually point to the same file, but it only has that one line 
and it's otherwise just empty (which is the case now).? I restart the 
samba-ad-dc on DC and rebooted the client... no difference.
>
> Can you please post the smb.conf
Sure..

on the dc:

# Global parameters
[global]
 ??????? netbios name = DC1
 ??????? realm = AD.EECS.YORKU.CA
 ??????? workgroup = EECSYORKUCA
 ??????? dns forwarder = 130.63.94.4
 ??????? server role = active directory domain controller
 ??????? idmap_ldb:use rfc2307 = yes
 ??????? interfaces = 127.0.0.1 130.63.94.66
 ??????? bind interfaces only = yes

[netlogon]
 ??????? path = /local/samba/sysvol/ad.eecs.yorku.ca/scripts
 ??????? read only = no
 ??????? guest ok = no

[sysvol]
 ??????? path = /local/samba/sysvol
 ??????? read only = no
 ??????? guest ok = no

and on the AD client:

[global]
workgroup = EECSYORKUCA
security = ADS
realm = AD.EECS.YORKU.CA
dedicated keytab file = /etc/krb5.keytab
kerberos method = secrets and keytab


idmap config * : backend = tdb
idmap config * : range = 1000000-1999999
idmap config EECSYORKUCA : backend = ad
idmap config EECSYORKUCA : schema_mode = rfc2307
idmap config EECSYORKUCA : range = 1000-999999
idmap config EECSYORKUCA : unix_primary_group = yes
idmap config EECSYORKUCA : unix_nss_info = yes
winbind refresh tickets = yes
winbind offline logon = yes
winbind nss info = rfc2307
winbind use default domain = yes
winbind enum users? = no
winbind enum groups = no
vfs objects = acl_xattr
map acl inherit = yes
store dos attributes = yes
template shell = /bin/bash
template homedir = /eecs/home/%U
debug timestamp = yes
debug uid = yes
debug pid = yes
debug level = 1
max log size = 0
load printers = no
printing = bsd
printcap name = /dev/null
disable spoolss = yes
username map = /xconf/samba/usermap

Jason.