[Samba] Samba and Winbind Group Policy

Patrick Goetz
Tue, 05 Oct 2021 14:29:55 -0000

Hi -

After reading through the updated
https://wiki.samba.org/index.php/Group_Policy, I have a few
questions/comments.

First of all, it seems like all these policies apply only to linux
domain members (e.g. cron, motd, and pam_access).

What about GPO's that apply to Windows machines? Is the set of things
that can be managed using the Group Policy Management Console
constrained by what's in the Samba ADMX Templates?

So, pam_access controls can be managed using a GPO, but it's still not
clear to me how I would restrict access to Windows clients through the
Samba AD.

Wiki editing note: For people less familiar with AD, it would probably
be a good idea to explain that the GPMC is part of RSAT and only
available from Windows.

The thing I care about most is mapping folders, which is covered here:

   https://wiki.samba.org/index.php/Windows_User_Home_Folders

The Wiki page title is misleading here because presumably you can map
*any* folder using the instructions provided here. This page should
probably be referenced on https://wiki.samba.org/index.php/Group_Policy,
along with any other Wiki pages dealing with Group Policy (e.g. the
Configuring Windows Profile Folder Redirections page).


Final Wiki editing note: Under the Startup Script Policies section, this
example is given:

  samba-tool gpo manage scripts startup add
{31B2F340-016D-11D2-945F-00C04FB984F9} test_script.sh '-n'

with no explanation of what {31B2F340-016D-11D2-945F-00C04FB984F9} is.
This is later explained in the Pam Access Policies section; that this is
the SID (? it's called a hash there, doesn't look like a hash to me) for
the GPO.  That should probably be mentioned the first time this is used,
along with the brief explanation of how to determine what this is using
`samba-tool gpo list`, also covered in the PAM Access Policies section.
  An example of using `samba-tool gpo list` would be helpful too.


On 10/4/21 16:01, David Mulder via samba wrote:
> After some discussion about this on the mailing list, I decided to
> update the outdated wiki page and mention it here. There is a great deal
> that has changed since the last time I updated the
> https://wiki.samba.org/index.php/Group_Policy page.
> There are currently 13 distinct policies, including smb.conf, addc
> password/kerberos, scripts, files, symlinks, sudoers, messages
> (motd/issue), pam access, certificate auto enrollment, firefox,
> chrome/chromium, GNOME, and OpenSSH. And I'm not finished. I will try
to
> keep this page up-to-date in the future to avoid confusion.
>
> FYI, the samba-gpupdate command *does* work when joined via either
> winbind or sssd, so you can choose.
>