samba - Aug 2022 - Cannot set Windows ACL on Sharefolder with other user than Administrator

Can I do some test, if there is winbind implemented corretcly in my machine?


Am 04.08.2022 um 20:05 schrieb Rowland Penny via samba:
> If you do not have secrets.ldb and sam.ldb on a DC, then you have
> really big problems. Have you checked if they exist or not ?
Yes, they are not existing:

ls -ll /usr/local/samba/private/
insgesamt 1012
drwx------ 2 root root?? 4096? 4. Aug 17:20 msg.sock
-rw------- 1 root root? 32768? 3. Aug 14:27 netlogon_creds_cli.tdb
-rw------- 1 root root 421888? 4. Jul 17:11 passdb.tdb
-rw------- 1 root root 577536 30. Jul 10:02 secrets.tdb

> Do you have libpam-winbind and libnss-winbind installed ?
> Or if you complied Samba yourself, did you create the required links ?
Yes, I do following symlinks on both machines:

#Debian Aarch64
 ?ln -s /usr/local/samba/lib/libnss_winbind.so.2 
/lib/aarch64-linux-gnu/libnss_winbind.so.2
 ?ln -s /lib/aarch64-linux-gnu/libnss_winbind.so.2 
/lib/aarch64-linux-gnu/libnss_winbind.so
 ?ldconfig

#Ubuntu x86_64
ln -s /usr/local/samba/lib/libnss_winbind.so.2 /lib/x86_64-linux-gnu/
ln -s /lib/x86_64-linux-gnu/libnss_winbind.so.2 
/lib/x86_64-linux-gnu/libnss_winbind.so
ldconfig

My pre-installed packages before I compile samba are:

# Debian Install Dependencies for Samaba Build from Source
 ?apt-get install acl attr autoconf bison build-essential \
 ? debhelper dnsutils docbook-xml docbook-xsl flex gdb libjansson-dev \
 ? libacl1-dev libaio-dev libarchive-dev libattr1-dev libblkid-dev 
libbsd-dev \
 ? libcap-dev libcups2-dev libgnutls28-dev libgpgme-dev libjson-perl \
 ? libldap2-dev libncurses5-dev libpam0g-dev libparse-yapp-perl \
 ? libpopt-dev libreadline-dev nettle-dev perl perl-modules pkg-config \
 ? python3-all-dev python3-dbg python-dev python3-dnspython \
 ? python3-dnspython python3-markdown python3-markdown \
 ? python3-dev xsltproc zlib1g-dev liblmdb-dev lmdb-utils libdbus-1-dev


# Ubuntu
 ?apt-get install acl attr autoconf bison build-essential \
 ? debhelper dnsutils docbook-xml docbook-xsl flex gdb libjansson-dev \
 ? libacl1-dev libaio-dev libarchive-dev libattr1-dev libblkid-dev 
libbsd-dev \
 ? libcap-dev libcups2-dev libgnutls28-dev libgpgme-dev libjson-perl \
 ? libldap2-dev libncurses5-dev libpam0g-dev libparse-yapp-perl \
 ? libpopt-dev libreadline-dev nettle-dev perl perl-modules pkg-config \
 ? python3-all-dev python3-dbg python2-dev python3-dnspython \
 ? python3-dnspython python3-markdown python3-markdown \
 ? python3-dev xsltproc zlib1g-dev liblmdb-dev lmdb-utils libdbus-1-dev 
python3-gpg
>> - wbinfo on secondarys DC only runs with given Domain e.g.
>> "DOMAIN\\USER"
> Hmm, that isn't correct.
>
>> - ldbsearch works only to remote host DC.
> 'ldbsearch' should work on both DC's
>
> I do hope that '.local' is a replacement for your correct TLD
Yes, I have .home as my TLD.

>
> I think you need to compare your first DC with your second DC, they
> should, apart from the hostname ipaddress etc, be identical.
Actually they are different. May there could be a same hostname inside 
smb.conf before I joined the domain.

> I would also do some reading up on AD attributes (for instance, a group
> will never have a primaryGroupID attribute).
Thanks, I wil do so.


Regards,

Oliver

On Tue, 2022-08-09 at 17:15 +0200, Oliver via samba
wrote:
> Can I do some test, if there is winbind implemented corretcly in my
> machine?
> 
> 
> Am 04.08.2022 um 20:05 schrieb Rowland Penny via samba:
> > If you do not have secrets.ldb and sam.ldb on a DC, then you have
> > really big problems. Have you checked if they exist or not ?
> 
> Yes, they are not existing:
> 
> ls -ll /usr/local/samba/private/
> insgesamt 1012
> drwx------ 2 root root   4096  4. Aug 17:20 msg.sock
> -rw------- 1 root root  32768  3. Aug 14:27 netlogon_creds_cli.tdb
> -rw------- 1 root root 421888  4. Jul 17:11 passdb.tdb
> -rw------- 1 root root 577536 30. Jul 10:02 secrets.tdb
You appear to have a major problem if a run a similar command on one of
my DC's, I get this:

pi at rpidc1:~ $ ls -ll /var/lib/samba/private/
total 20320
-rw-r----- 2 root bind     544 Mar 26  2021 dns.keytab
-rw------- 1 root root    2211 Jun 10  2021 dns_update_cache
-rw-r--r-- 1 root root    3663 Mar 26  2021 dns_update_list
-rw------- 1 root root      16 Mar 26  2021 encrypted_secrets.key
-rw------- 1 root root 1286144 Mar 26  2021 hklm.ldb
-rw------- 1 root root 4927488 Jul 23 12:07 idmap.ldb
-rw-r--r-- 1 root root     216 Mar 26  2021 krb5.conf
srwxrwxrwx 1 root root       0 Jul 30 14:34 ldapi
drwxr-x--- 2 root root    4096 Jul 30 14:34 ldap_priv
drwx------ 2 root root    4096 Aug  9 16:21 msg.sock
-rw------- 1 root root    4792 Jul 30 14:34 netlogon_creds_cli.tdb
-rw------- 1 root root  421888 Mar 26  2021 passdb.tdb
-rw------- 1 root root 1286144 May  7  2021 privilege.ldb
-rw------- 1 root root 4694016 Mar 26  2021 sam.ldb
drwx------ 2 root root    4096 Apr 24  2021 sam.ldb.d
-rw------- 1 root root   12288 Aug  5 10:16 schannel_store.tdb
-rw------- 1 root root     785 Mar 26  2021 secrets.keytab
-rw------- 1 root root 1286144 Mar 26  2021 secrets.ldb
-rw------- 1 root root  430080 Mar 26  2021 secrets.tdb
-rw------- 1 root root 1286144 Mar 26  2021 share.ldb
drwxr-xr-x 2 root root    4096 Mar 26  2021 smbd.tmp
-rw-r--r-- 1 root root     955 Mar 26  2021 spn_update_list
drwxr-xr-x 2 root root    4096 Apr 15  2021 tls

Was this DC provisioned, or another DC you have joined to an existing
domain ?

Rowland